Update helpers_cache.json

chore(ai-models): refresh catalog

.github/DISCUSSION_TEMPLATE/share-custom-prompts-for-ai-notifications.yml

@@ -0,0 +1,117 @@
+title: "[Prompt] "
+labels:
+  - custom-prompt
+  - community
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Share Your Custom Prompt
+        
+        Thank you for sharing your custom prompt with the community!
+        
+        **Title format suggestion:** Include the provider in the title for easy filtering.
+        Example: `[Gemini] Clean Spanish - Structured, no emojis`
+        
+        This helps others find prompts for their specific AI provider.
+
+  - type: dropdown
+    id: provider
+    attributes:
+      label: AI Provider
+      description: Which AI provider did you test this prompt with?
+      options:
+        - OpenAI
+        - Gemini
+        - Groq
+        - Ollama
+        - Anthropic
+        - OpenRouter
+        - DeepSeek
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: model
+    attributes:
+      label: Model
+      description: The specific model you tested with
+      placeholder: "e.g., gpt-4o-mini, gemini-2.0-flash, llama3.2:3b"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Describe what your prompt does, main features, and output language
+      placeholder: |
+        This prompt generates concise notifications in Spanish.
+        
+        Features:
+        - Brief format (2-3 lines)
+        - Includes severity indicators
+        - Uses emojis for visual clarity
+    validations:
+      required: true
+
+  - type: textarea
+    id: prompt-content
+    attributes:
+      label: Prompt Content
+      description: Paste your complete custom prompt here
+      render: text
+      placeholder: |
+        You are a notification formatter for ProxMenux Monitor.
+        
+        Your task is to...
+        
+        RULES:
+        1. ...
+        2. ...
+        
+        OUTPUT FORMAT:
+        [TITLE]
+        ...
+        [BODY]
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: example-output
+    attributes:
+      label: Example Output
+      description: Show an example of how a notification looks with your prompt
+      placeholder: |
+        **Input notification:**
+        CPU usage high on node pve01
+        
+        **Output with this prompt:**
+        pve01: High CPU Usage
+        CPU at 95% for 5 minutes. Check running processes.
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional-notes
+    attributes:
+      label: Additional Notes
+      description: Any tips, variations, or known limitations
+      placeholder: |
+        - Works best with models that support system prompts
+        - May need adjustment for very long notifications
+        - Tested with Proxmox VE 8.x
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Confirmation
+      options:
+        - label: I have tested this prompt and it works correctly
+          required: true
+        - label: I am sharing this prompt for the community to use freely
+          required: true

.github/FUNDING.yml

@@ -0,0 +1,15 @@
+# These are supported funding model platforms
+
+github: MacRimi # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: macrimi # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
+thanks_dev: # Replace with a single thanks.dev username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/scripts/build_i18n_messages.py

@@ -0,0 +1,346 @@
+#!/usr/bin/env python3
+"""
+Auto-translate missing keys in AppImage/messages/<locale>/common.json
+against the English source (AppImage/messages/en/common.json).
+
+Guardrails:
+  - Keys already translated in a target locale are PRESERVED. A key is
+    considered "already translated" when the target value is non-empty
+    AND differs from the English source. This protects human-curated
+    locales (Vaso73's sk) from being overwritten.
+  - `{placeholder}` tokens (next-intl style: `{vmid}`, `{appName}`, etc.)
+    are extracted before translation and restored afterwards, so the
+    interpolation contract stays intact regardless of what the
+    translation provider does with the surrounding text.
+  - `sk` IS translated by default too. Guardrail #1 protects every key
+    Vaso73 has curated by hand; auto-translation only fills the keys
+    that are still on the English fallback in sk.
+
+Reuses the same translation providers as build_translation_cache.py so
+the CI environment (googletrans pinning, AppImage provider) stays
+identical.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+import time
+from pathlib import Path
+
+# Reuse providers + cleaner from the CLI translation script.
+sys.path.insert(0, str(Path(__file__).parent))
+from build_translation_cache import (  # noqa: E402
+    clean_translation,
+    protect_technical_terms,
+    restore_technical_terms,
+    translate_appimage,
+    translate_google_web,
+    translate_googletrans,
+)
+
+
+# sk IS included in the default. Guardrail #1 (never overwrite a key
+# whose target value differs from EN) protects every string Vaso73 has
+# already curated by hand — auto-translation only ever touches keys
+# that are still on the English fallback in sk. Trade-off accepted:
+# users on sk see a decent auto-translation for new keys instead of raw
+# English while the human maintainer catches up, and Vaso73 keeps full
+# ownership of the wording via follow-up PRs.
+DEFAULT_LANGUAGES = ("es", "de", "fr", "it", "pt", "sk", "sv")
+DEFAULT_CONTEXT = "Context: Technical UI text for a Proxmox management dashboard. Translate:"
+
+# next-intl / ICU-style placeholders: {name}, {vmid}, {count}, {app_name}.
+# We deliberately do NOT match `{{ escaped }}` or nested braces — the
+# codebase uses only the simple form.
+PLACEHOLDER_RE = re.compile(r"\{[A-Za-z_][A-Za-z0-9_]*\}")
+
+
+def flatten(node: dict, prefix: str = "") -> dict[str, str]:
+    """Depth-first flatten of a nested dict into ``{"a.b.c": "value"}``.
+    Non-string leaves are coerced to str (should not happen in messages
+    catalogs, but keeps the function total)."""
+    out: dict[str, str] = {}
+    for key, value in node.items():
+        path = f"{prefix}{key}" if not prefix else f"{prefix}.{key}"
+        if isinstance(value, dict):
+            out.update(flatten(value, path))
+        elif value is None:
+            out[path] = ""
+        else:
+            out[path] = str(value)
+    return out
+
+
+def unflatten(flat: dict[str, str]) -> dict:
+    """Inverse of ``flatten``: rebuild nested structure from dotted keys."""
+    out: dict = {}
+    for path, value in flat.items():
+        parts = path.split(".")
+        cursor = out
+        for part in parts[:-1]:
+            existing = cursor.get(part)
+            if not isinstance(existing, dict):
+                existing = {}
+                cursor[part] = existing
+            cursor = existing
+        cursor[parts[-1]] = value
+    return out
+
+
+def protect_placeholders(text: str) -> tuple[str, list[str]]:
+    """Swap each ``{xxx}`` for an opaque token that machine translators
+    tend to leave alone. Order is preserved so restore_placeholders can
+    walk it linearly."""
+    placeholders: list[str] = []
+
+    def _swap(match: re.Match) -> str:
+        placeholders.append(match.group(0))
+        return f"__PMX_PH_{len(placeholders) - 1}__"
+
+    return PLACEHOLDER_RE.sub(_swap, text), placeholders
+
+
+def restore_placeholders(text: str, placeholders: list[str]) -> str:
+    """Reverse of ``protect_placeholders``. If the provider mangled a
+    token beyond recognition we leave the mangled form in place — the
+    fallback assignment (target = existing or EN) upstream catches
+    the worst case."""
+    for i, original in enumerate(placeholders):
+        text = text.replace(f"__PMX_PH_{i}__", original)
+    return text
+
+
+def translate_one(
+    text: str,
+    lang: str,
+    provider: str,
+    context: str,
+    timeout: int,
+    appimage_path: Path,
+) -> str:
+    """Dispatch to the correct provider. Reuses the same three
+    implementations as build_translation_cache.py so there is exactly
+    one place to fix if a provider changes upstream."""
+    if provider == "googletrans":
+        raw = translate_googletrans(text, lang, context)
+    elif provider == "google-web":
+        raw = translate_google_web(text, lang, context, timeout)
+    elif provider == "appimage":
+        raw = translate_appimage(text, lang, context, timeout, appimage_path)
+    else:
+        raise ValueError(f"Unknown provider: {provider}")
+    return clean_translation(raw) or text
+
+
+def read_json(path: Path) -> dict:
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return {}
+    except json.JSONDecodeError as exc:
+        raise SystemExit(f"Invalid JSON at {path}: {exc}") from exc
+
+
+def write_json(path: Path, data: dict) -> None:
+    """Write with indent=2, no sort_keys — we want to keep the same
+    top-level ordering the maintainer uses in en/common.json so diffs
+    stay readable side-by-side."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_suffix(path.suffix + ".tmp")
+    tmp.write_text(
+        json.dumps(data, ensure_ascii=False, indent=2, sort_keys=False) + "\n",
+        encoding="utf-8",
+    )
+    tmp.replace(path)
+
+
+def build_arg_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument(
+        "--source",
+        type=Path,
+        default=Path("AppImage/messages/en/common.json"),
+        help="Path to the English source catalog.",
+    )
+    parser.add_argument(
+        "--messages-dir",
+        type=Path,
+        default=Path("AppImage/messages"),
+        help="Directory that contains per-locale subdirectories.",
+    )
+    parser.add_argument(
+        "--languages",
+        default=",".join(DEFAULT_LANGUAGES),
+        help=(
+            "Comma-separated target locales. Includes sk by default; "
+            "guardrail #1 never overwrites keys whose sk value differs "
+            "from EN, so Vaso73's curated translations are safe."
+        ),
+    )
+    parser.add_argument(
+        "--provider",
+        choices=("appimage", "googletrans", "google-web"),
+        default="googletrans",
+        help="Translation provider. Default matches build_translation_cache.",
+    )
+    parser.add_argument(
+        "--appimage-path",
+        type=Path,
+        default=Path("/usr/local/share/proxmenux/ProxMenux-Monitor.AppImage"),
+    )
+    parser.add_argument("--context", default=DEFAULT_CONTEXT)
+    parser.add_argument("--timeout", type=int, default=30)
+    parser.add_argument("--sleep", type=float, default=0.15)
+    parser.add_argument(
+        "--refresh",
+        action="store_true",
+        help=(
+            "Re-translate EVERY key, ignoring existing translations. "
+            "Dangerous: this DOES overwrite human-curated strings. "
+            "Use only when you know what you are doing."
+        ),
+    )
+    parser.add_argument(
+        "--limit",
+        type=int,
+        default=0,
+        help="Only translate the first N missing keys per locale (test runs).",
+    )
+    parser.add_argument(
+        "--save-every",
+        type=int,
+        default=50,
+        help="Write the locale JSON every N translated keys so a crash mid-run leaves partial progress on disk.",
+    )
+    return parser
+
+
+def main() -> int:
+    args = build_arg_parser().parse_args()
+
+    source = args.source.resolve()
+    messages_dir = args.messages_dir.resolve()
+    languages = [lang.strip() for lang in args.languages.split(",") if lang.strip()]
+
+    if not source.is_file():
+        print(f"Source not found: {source}", file=sys.stderr)
+        return 1
+    if not languages:
+        print("No destination languages selected.", file=sys.stderr)
+        return 1
+
+    en_nested = read_json(source)
+    en_flat = flatten(en_nested)
+    print(f"Source: {source}", flush=True)
+    print(f"EN keys: {len(en_flat)}", flush=True)
+    print(f"Target locales: {', '.join(languages)}", flush=True)
+    print(f"Provider: {args.provider}", flush=True)
+    print(f"Sleep between calls: {args.sleep}s", flush=True)
+
+    total_failures: list[tuple[str, str, str]] = []
+
+    for lang in languages:
+        locale_path = messages_dir / lang / "common.json"
+        target_flat = flatten(read_json(locale_path))
+
+        # Decide what needs translating. Same rule as
+        # build_translation_cache.py: only touch keys whose target
+        # value is empty. Never overwrite an existing value — that
+        # covers three legitimate cases in one line:
+        #   1. Human-curated translations (protected trivially).
+        #   2. Universal tokens the maintainer left equal to EN on
+        #      purpose (Hardware, Terminal, Normal, SMART, OK, CPU %,
+        #      {count}h, product names, etc.). Around 120 keys in
+        #      es/common.json — the old `existing == en_value` rule
+        #      kept resending these to Google every run, and the
+        #      provider sometimes mangled them (`Terminal` →
+        #      `terminal`, `CPU %` → `% de CPU`, ...).
+        #   3. Auto-fills from prior runs whose output happened to
+        #      match EN — leaving them alone is the intended
+        #      steady-state, not a bug.
+        # When someone genuinely wants to redo everything, --refresh
+        # is still available (and is destructive by design).
+        missing: list[str] = []
+        for key, en_value in en_flat.items():
+            if not en_value:
+                continue
+            existing = target_flat.get(key, "")
+            if args.refresh or not existing:
+                missing.append(key)
+
+        if args.limit > 0:
+            missing = missing[: args.limit]
+
+        print(f"\n=== {lang}: {len(missing)} keys to translate ===", flush=True)
+        if not missing:
+            print(f"  {lang}: nothing to do", flush=True)
+            continue
+
+        failures_for_lang: list[tuple[str, str, str]] = []
+
+        for index, key in enumerate(missing, start=1):
+            en_value = en_flat[key]
+            protected, placeholders = protect_placeholders(en_value)
+            protected, technical_terms = protect_technical_terms(protected)
+
+            try:
+                translated = translate_one(
+                    protected,
+                    lang,
+                    args.provider,
+                    args.context,
+                    args.timeout,
+                    args.appimage_path,
+                )
+                translated = restore_technical_terms(translated, technical_terms)
+                target_flat[key] = restore_placeholders(translated, placeholders)
+                print(
+                    f"  [{lang} {index}/{len(missing)}] {key}: "
+                    f"{en_value[:60]!r} → {target_flat[key][:60]!r}",
+                    flush=True,
+                )
+            except Exception as exc:  # noqa: BLE001
+                # Fall back to whatever we already had (or EN) so the
+                # runtime fallback still kicks in for this key.
+                target_flat[key] = target_flat.get(key) or en_value
+                failures_for_lang.append((lang, key, str(exc)))
+                print(f"  [{lang}] {key}: FAILED — {exc}", file=sys.stderr, flush=True)
+
+            if args.save_every > 0 and index % args.save_every == 0:
+                # Preserve keys already in target_flat + write partial progress.
+                write_json(locale_path, unflatten(target_flat))
+            time.sleep(args.sleep)
+
+        write_json(locale_path, unflatten(target_flat))
+        print(f"  wrote {locale_path}", flush=True)
+        total_failures.extend(failures_for_lang)
+
+    if total_failures:
+        print(
+            f"\nCompleted with {len(total_failures)} translation failures "
+            f"(partial progress persisted, next run will retry).",
+            file=sys.stderr,
+            flush=True,
+        )
+        for lang, key, error in total_failures[:20]:
+            print(f"  - {lang}: {key} → {error}", file=sys.stderr, flush=True)
+        if len(total_failures) > 20:
+            print(f"  ... and {len(total_failures) - 20} more.", file=sys.stderr, flush=True)
+        # Exit 0 on partial failure so the workflow's Commit + push
+        # step still runs and the keys that DID translate reach
+        # develop. The un-translated keys stay empty and the next
+        # workflow tick (or a manual dispatch) retries them.
+        # Previously we returned 2, which failed the whole run and
+        # discarded 36 out of 38 successful translations because
+        # 2 googletrans timeouts hit sv at the start of the burst.
+        return 0
+
+    print("\ni18n messages generated successfully.", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/build_translation_cache.py

@@ -0,0 +1,483 @@
+#!/usr/bin/env python3
+"""
+Build the ProxMenux translation cache from translate calls in scripts/.
+
+The generated JSON keeps the same shape used by scripts/utils.sh:
+
+{
+  "Original English text": {
+    "es": "Translated text",
+    "fr": "Translated text"
+  }
+}
+"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import asyncio
+import inspect
+import json
+import os
+import subprocess
+import re
+import sys
+import time
+from pathlib import Path
+from typing import Iterable
+from urllib.parse import quote
+from urllib.request import Request, urlopen
+
+
+DEFAULT_LANGUAGES = ("es", "fr", "de", "it", "pt", "sk", "sv")
+DEFAULT_CONTEXT = "Context: Technical message for Proxmox and IT. Translate:"
+# googletrans and the public Google endpoint used by this workflow do not
+# support Cloud Translation glossaries. Protect product names, package names
+# and command identifiers with opaque tokens before sending text to any
+# provider, then restore the exact source spelling afterwards. Keep longer
+# terms first so ``gasket`` cannot consume part of ``gasket-dkms``.
+PROTECTED_TECHNICAL_TERMS = (
+    "google/gasket-driver",
+    "feranick/gasket-driver",
+    "libedgetpu1-std",
+    "Proxmox VE Helper-Scripts",
+    "Docker Compose",
+    "gasket-driver",
+    "gasket-dkms",
+    "libedgetpu1",
+    "libedgetpu",
+    "Google Coral",
+    "Edge TPU",
+    "ProxMenux",
+    "Proxmox",
+    "AppImage",
+    "smartctl",
+    "systemctl",
+    "pveproxy",
+    "apt-get",
+    "Frigate",
+    "Docker",
+    "Coral",
+    "gasket",
+    "apex",
+    "lspci",
+    "dpkg",
+    "DKMS",
+    "QEMU",
+    "LXC",
+    "ZFS",
+    "SSH",
+    "fork",
+)
+TECHNICAL_TERM_RE = re.compile(
+    "|".join(
+        rf"(?<![A-Za-z0-9_]){re.escape(term)}(?![A-Za-z0-9_])"
+        for term in sorted(PROTECTED_TECHNICAL_TERMS, key=len, reverse=True)
+    ),
+    re.IGNORECASE,
+)
+TRANSLATE_CALL_RE = re.compile(
+    r"""translate\s+(?P<quote>["'])(?P<text>(?:\\.|(?! (?P=quote) ).)*?)(?P=quote)""",
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def protect_technical_terms(text: str) -> tuple[str, list[str]]:
+    """Replace glossary terms with stable tokens before translation."""
+    protected: list[str] = []
+
+    def _swap(match: re.Match[str]) -> str:
+        protected.append(match.group(0))
+        return f"__PMX_TERM_{len(protected) - 1}__"
+
+    return TECHNICAL_TERM_RE.sub(_swap, text), protected
+
+
+def restore_technical_terms(text: str, protected: list[str]) -> str:
+    """Restore glossary terms exactly as they appeared in the source."""
+    for index, original in enumerate(protected):
+        text = text.replace(f"__PMX_TERM_{index}__", original)
+    return text
+
+
+def iter_script_files(
+    scripts_dir: Path, extra_files: Iterable[Path] = ()
+) -> Iterable[Path]:
+    # Walk the main scripts tree.
+    for path in sorted(scripts_dir.rglob("*")):
+        if not path.is_file():
+            continue
+        if path.name == "utils.sh":
+            continue
+        if path.suffix not in {".sh", ".func"}:
+            continue
+        yield path
+    # Yield additional files passed explicitly (e.g. the root-level `menu`
+    # entry point or install_proxmenux*.sh). These live outside scripts/
+    # but still contain translate "..." calls we want in the cache.
+    # No extension filter and no utils.sh skip — the caller decided
+    # they belong, we just check the file actually exists.
+    for extra in extra_files:
+        if extra.is_file():
+            yield extra
+
+
+def decode_shell_string(raw: str, quote_char: str) -> str:
+    if quote_char == "'":
+        return raw
+    try:
+        return ast.literal_eval(f'"{raw}"')
+    except Exception:
+        return raw.replace(r"\"", '"').replace(r"\\", "\\")
+
+
+def extract_translate_texts(
+    scripts_dir: Path, extra_files: Iterable[Path] = ()
+) -> list[str]:
+    found: dict[str, None] = {}
+    for path in iter_script_files(scripts_dir, extra_files):
+        try:
+            content = path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            content = path.read_text(encoding="utf-8", errors="replace")
+
+        for match in TRANSLATE_CALL_RE.finditer(content):
+            text = decode_shell_string(match.group("text"), match.group("quote"))
+            text = text.strip()
+            if text and "$" not in text and "`" not in text:
+                found.setdefault(text, None)
+
+    return sorted(found)
+
+
+def translate_googletrans(text: str, dest_lang: str, context: str) -> str:
+    try:
+        from googletrans import Translator  # type: ignore
+    except Exception as exc:
+        raise RuntimeError(
+            "googletrans is not installed. Install googletrans==4.0.0-rc1 "
+            "or run with --provider google-web."
+        ) from exc
+
+    translator = Translator()
+    full_text = f"{context} {text}".strip()
+    result = translator.translate(full_text, dest=dest_lang)
+    if inspect.isawaitable(result):
+        result = asyncio.run(result)
+    return result.text
+
+
+def translate_google_web(text: str, dest_lang: str, context: str, timeout: int) -> str:
+    # The public Google endpoint is not prompt-aware: if we prepend context,
+    # it often translates and returns that context as part of the result.
+    full_text = text
+    url = (
+        "https://translate.googleapis.com/translate_a/single"
+        f"?client=gtx&sl=en&tl={quote(dest_lang)}&dt=t&q={quote(full_text)}"
+    )
+    req = Request(url, headers={"User-Agent": "ProxMenux translation cache builder"})
+    with urlopen(req, timeout=timeout) as response:
+        payload = json.loads(response.read().decode("utf-8"))
+    return "".join(part[0] for part in payload[0] if part and part[0])
+
+
+def translate_appimage(
+    text: str,
+    dest_lang: str,
+    context: str,
+    timeout: int,
+    appimage_path: Path,
+) -> str:
+    if not appimage_path.exists():
+        prev_path = appimage_path.with_name(appimage_path.name + ".prev")
+        if prev_path.exists():
+            appimage_path = prev_path
+        else:
+            raise FileNotFoundError(f"AppImage not found: {appimage_path}")
+
+    req = {
+        "text": text,
+        "dest_lang": dest_lang,
+        "context": context,
+        "cache_file": "",
+    }
+    env = os.environ.copy()
+    env.setdefault("APPIMAGE_EXTRACT_AND_RUN", "1")
+    completed = subprocess.run(
+        [str(appimage_path), "--translate"],
+        input=json.dumps(req, ensure_ascii=False),
+        text=True,
+        capture_output=True,
+        timeout=timeout,
+        check=False,
+        env=env,
+    )
+    if completed.returncode != 0:
+        raise RuntimeError((completed.stderr or completed.stdout).strip())
+
+    # AppRun may print a startup line before translate_cli.py emits JSON.
+    for line in reversed(completed.stdout.splitlines()):
+        line = line.strip()
+        if not line.startswith("{"):
+            continue
+        payload = json.loads(line)
+        if payload.get("success"):
+            return str(payload.get("text", text))
+        raise RuntimeError(str(payload.get("error", "unknown AppImage translation error")))
+
+    raise RuntimeError(f"AppImage did not return JSON: {completed.stdout.strip()}")
+
+
+def clean_translation(value: str) -> str:
+    separator = r"[\s\u00a0]*[:：]"
+    # `Translate` pivot in every locale currently supported. Without
+    # the target-language variant here, the cleaner can't locate the
+    # boundary between the context prompt and the real translation,
+    # and the whole payload leaks through as the translated context.
+    # Caught on the 2026-08-14 workflow run — every sk / sv key ended
+    # up as "Technický text používateľského rozhrania…" or
+    # "Teknisk gränssnittstext för en Proxmox-hanteringspanel.Övers"
+    # because Preložiť / Översätt / Översätta were missing.
+    translate_labels = (
+        "Translate|Traducir|Traduire|Übersetzen|Tradurre|Traduci|Traduzir"
+        "|Preložiť|Prelož|Preloz"          # sk
+        "|Översätta|Översätt"              # sv
+    )
+    context_labels = (
+        "Context|Contexto|Contexte|Kontext|Contesto"
+        "|Sammanhang"                      # sv alternate
+    )
+    value = re.sub(
+        rf"^.*?({translate_labels}){separator}",
+        "",
+        value,
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+    value = re.sub(
+        rf"^.*?({context_labels}){separator}.*?({translate_labels}){separator}",
+        "",
+        value,
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+    value = re.sub(
+        rf"^.*?({context_labels}){separator}",
+        "",
+        value,
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+    return value.strip()
+
+
+def translate_text(
+    text: str,
+    dest_lang: str,
+    provider: str,
+    context: str,
+    timeout: int,
+    appimage_path: Path,
+) -> str:
+    protected_text, protected_terms = protect_technical_terms(text)
+    if provider == "googletrans":
+        translated = translate_googletrans(protected_text, dest_lang, context)
+    elif provider == "google-web":
+        translated = translate_google_web(protected_text, dest_lang, context, timeout)
+    elif provider == "appimage":
+        translated = translate_appimage(
+            protected_text, dest_lang, context, timeout, appimage_path
+        )
+    else:
+        raise ValueError(f"Unknown provider: {provider}")
+    translated = restore_technical_terms(clean_translation(translated), protected_terms)
+    return translated or text
+
+
+def load_language_cache(path: Path) -> dict[str, str]:
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    return {str(text): str(value) for text, value in data.items()}
+
+
+def write_language_cache(path: Path, cache: dict[str, str]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp_path = path.with_suffix(path.suffix + ".tmp")
+    tmp_path.write_text(
+        json.dumps(cache, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    tmp_path.replace(path)
+
+
+def build_arg_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Extract translate calls from scripts/ and build json/cache.json."
+    )
+    parser.add_argument("--scripts-dir", default="scripts", type=Path)
+    parser.add_argument(
+        "--extra-file",
+        action="append",
+        default=[],
+        type=Path,
+        metavar="PATH",
+        help=(
+            "Extra individual files to scan for translate calls in addition "
+            "to --scripts-dir. Useful for the root-level `menu` entry point "
+            "and install_proxmenux*.sh, which sit outside scripts/. "
+            "Pass multiple times to add more than one file."
+        ),
+    )
+    parser.add_argument(
+        "--output-dir",
+        default=Path("lang"),
+        type=Path,
+        help="Directory where per-language JSON files are written. Default: lang",
+    )
+    parser.add_argument(
+        "--output",
+        default=None,
+        type=Path,
+        help="Deprecated combined cache path. If used, per-language files are written next to it under its parent directory.",
+    )
+    parser.add_argument(
+        "--languages",
+        default=",".join(DEFAULT_LANGUAGES),
+        help="Comma-separated destination languages. Default: es,fr,de,it,pt,sk",
+    )
+    parser.add_argument(
+        "--provider",
+        choices=("appimage", "googletrans", "google-web"),
+        default="appimage",
+        help="Translation provider to use. Default: appimage",
+    )
+    parser.add_argument(
+        "--appimage-path",
+        default=Path("/usr/local/share/proxmenux/ProxMenux-Monitor.AppImage"),
+        type=Path,
+        help="Path to the ProxMenux AppImage when using --provider appimage.",
+    )
+    parser.add_argument("--context", default=DEFAULT_CONTEXT)
+    parser.add_argument("--timeout", default=30, type=int)
+    parser.add_argument("--sleep", default=0.15, type=float)
+    parser.add_argument(
+        "--refresh",
+        action="store_true",
+        help="Translate all entries again instead of reusing existing cache values.",
+    )
+    parser.add_argument(
+        "--extract-only",
+        action="store_true",
+        help="Only update the cache keys; missing translations are left empty.",
+    )
+    parser.add_argument(
+        "--limit",
+        type=int,
+        default=0,
+        help="Only process the first N extracted strings. Useful for test runs.",
+    )
+    parser.add_argument(
+        "--save-every",
+        type=int,
+        default=1,
+        help="Write the output JSON every N translated items. Default: 1",
+    )
+    return parser
+
+
+def main() -> int:
+    args = build_arg_parser().parse_args()
+    scripts_dir = args.scripts_dir.resolve()
+    if args.output is not None:
+        output_dir = args.output.resolve().parent / "lang"
+    else:
+        output_dir = args.output_dir.resolve()
+    languages = [lang.strip() for lang in args.languages.split(",") if lang.strip()]
+
+    if not scripts_dir.is_dir():
+        print(f"Scripts directory not found: {scripts_dir}", file=sys.stderr)
+        return 1
+    if not languages:
+        print("No destination languages selected.", file=sys.stderr)
+        return 1
+
+    texts = extract_translate_texts(scripts_dir, args.extra_file)
+    if args.limit > 0:
+        texts = texts[: args.limit]
+    existing_by_lang = {
+        lang: load_language_cache(output_dir / f"{lang}.json")
+        for lang in languages
+    }
+    next_by_lang: dict[str, dict[str, str]] = {lang: {} for lang in languages}
+    print(f"Found {len(texts)} unique translate strings.", flush=True)
+    print(f"Output directory: {output_dir}", flush=True)
+    print(f"Languages: {', '.join(languages)}", flush=True)
+
+    failures: list[tuple[str, str, str]] = []
+    total = len(texts) * len(languages)
+    done = 0
+
+    for lang in languages:
+        existing = existing_by_lang.get(lang, {})
+        print(f"Starting language: {lang}", flush=True)
+
+        for index, text in enumerate(texts, start=1):
+            done += 1
+            if not args.refresh and existing.get(text):
+                next_by_lang[lang][text] = existing[text]
+                continue
+            if args.extract_only:
+                next_by_lang[lang][text] = existing.get(text, "")
+                continue
+
+            print(f"[{done}/{total}] {lang} ({index}/{len(texts)}): {text[:80]}", flush=True)
+            try:
+                next_by_lang[lang][text] = translate_text(
+                    text,
+                    lang,
+                    args.provider,
+                    args.context,
+                    args.timeout,
+                    args.appimage_path,
+                )
+                print(f"  => {next_by_lang[lang][text][:100]}", flush=True)
+            except Exception as exc:
+                next_by_lang[lang][text] = existing.get(text, text)
+                failures.append((text, lang, str(exc)))
+                print(f"  failed: {exc}", file=sys.stderr, flush=True)
+            if args.save_every > 0 and index % args.save_every == 0:
+                write_language_cache(output_dir / f"{lang}.json", next_by_lang[lang])
+            time.sleep(args.sleep)
+
+        write_language_cache(output_dir / f"{lang}.json", next_by_lang[lang])
+        print(f"Completed language: {lang}", flush=True)
+
+    for lang, cache in next_by_lang.items():
+        write_language_cache(output_dir / f"{lang}.json", cache)
+
+    if failures:
+        print(
+            f"Completed with {len(failures)} translation failures "
+            f"(partial progress persisted, next run will retry).",
+            file=sys.stderr, flush=True,
+        )
+        for text, lang, error in failures[:20]:
+            print(f"- {lang}: {text[:80]} -> {error}", file=sys.stderr, flush=True)
+        if len(failures) > 20:
+            print(f"... and {len(failures) - 20} more.", file=sys.stderr, flush=True)
+        # Exit 0 on partial failure so the workflow's Commit + push
+        # step still runs. Otherwise a couple of transient googletrans
+        # timeouts would fail the whole workflow and discard every
+        # successful translation from the same batch.
+        return 0
+
+    print("Translation cache generated successfully.", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/build_web_docs_i18n.py

@@ -0,0 +1,853 @@
+#!/usr/bin/env python3
+"""Build missing translations for the ProxMenux documentation catalog."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import re
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Callable
+
+sys.path.insert(0, str(Path(__file__).parent))
+from build_translation_cache import (  # noqa: E402
+    clean_translation,
+    translate_appimage,
+    translate_google_web,
+    translate_googletrans,
+)
+
+
+DEFAULT_LANGUAGES = ("es", "de", "fr", "it", "pt", "sk", "sv")
+DEFAULT_CONTEXT = (
+    "Context: ProxMenux technical documentation for Proxmox VE users. "
+    "Preserve product names, commands, paths, variables and placeholders. Translate:"
+)
+
+TECHNICAL_TERMS = (
+    "Proxmox VE Helper-Scripts",
+    "Proxmox Backup Server",
+    "Proxmox Mail Gateway",
+    "Proxmox VE",
+    "ProxMenux Monitor",
+    "ProxMenux Scripts",
+    "Docker Compose",
+    "Docker Engine",
+    "Google Coral",
+    "Edge TPU",
+    "Let's Encrypt",
+    "Cloudflare",
+    "Pushover",
+    "Telegram",
+    "Discord",
+    "Microsoft Teams",
+    "GitHub",
+    "Gotify",
+    "Apprise",
+    "Frigate",
+    "Vaultwarden",
+    "Portainer",
+    "ProxMenux",
+    "AppImage",
+    "systemctl",
+    "journalctl",
+    "smartctl",
+    "pveproxy",
+    "apt-get",
+    "gasket-dkms",
+    "libedgetpu",
+    "QEMU",
+    "LXC",
+    "ZFS",
+    "Ceph",
+    "Docker",
+    "OpenAI",
+    "WebSocket",
+    "OAuth",
+    "DKMS",
+    "SSH",
+    "API",
+)
+
+PROTECTED_PATTERNS = (
+    # Keep rich-text tags visible to Google Translate. It preserves their
+    # structure while translating the enclosed prose, whereas replacing
+    # opening/closing tags with adjacent sentinels can make the provider drop
+    # one side of the pair. The contract is validated after translation.
+    re.compile(r"`[^`]+`"),
+    re.compile(r"https?://[^\s<>]+"),
+    re.compile(r"\{[A-Za-z_][A-Za-z0-9_.-]*\}"),
+    re.compile(r"\$\{?[A-Za-z_][A-Za-z0-9_]*\}?"),
+    re.compile(r"(?<![\w-])--[A-Za-z0-9][A-Za-z0-9_-]*"),
+    re.compile(r"(?<![A-Za-z0-9<])/(?:[A-Za-z0-9._~:@%+=-]+/)*[A-Za-z0-9._~:@%+=-]+"),
+    re.compile(r"\b[A-Za-z0-9_.-]+\.(?:json|ya?ml|toml|conf|service|socket|sh|py|tsx?|jsx?|md)\b"),
+)
+LITERAL_TAG_RE = re.compile(
+    r"<(code|kbd|pre)\b[^>]*>.*?</\1>",
+    re.IGNORECASE | re.DOTALL,
+)
+
+TERM_RE = re.compile(
+    "|".join(
+        rf"(?<![A-Za-z0-9_]){re.escape(term)}(?![A-Za-z0-9_])"
+        for term in sorted(TECHNICAL_TERMS, key=len, reverse=True)
+    ),
+    re.IGNORECASE,
+)
+TAG_RE = re.compile(r"</?([A-Za-z][A-Za-z0-9]*)>")
+PLACEHOLDER_RE = re.compile(r"\{[A-Za-z_][A-Za-z0-9_.-]*\}")
+NON_TRANSLATABLE_KEYS = {
+    "command",
+    "code",
+    "href",
+    "icon",
+    "id",
+    "path",
+    "route",
+    "slug",
+    "src",
+    "url",
+}
+SOURCE_STATE_VERSION = 1
+
+
+@dataclass(frozen=True)
+class Leaf:
+    path: tuple[str | int, ...]
+    source: str
+
+
+def read_json(path: Path) -> Any:
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return None
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"Invalid JSON in {path}: {exc}") from exc
+
+
+def write_json(path: Path, value: Any) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temporary = path.with_suffix(path.suffix + ".tmp")
+    temporary.write_text(
+        json.dumps(value, ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8",
+    )
+    temporary.replace(path)
+
+
+def iter_leaves(node: Any, path: tuple[str | int, ...] = ()) -> list[Leaf]:
+    leaves: list[Leaf] = []
+    if isinstance(node, dict):
+        for key, value in node.items():
+            leaves.extend(iter_leaves(value, path + (key,)))
+    elif isinstance(node, list):
+        for index, value in enumerate(node):
+            leaves.extend(iter_leaves(value, path + (index,)))
+    elif isinstance(node, str):
+        leaves.append(Leaf(path, node))
+    return leaves
+
+
+def get_at_path(node: Any, path: tuple[str | int, ...]) -> Any:
+    current = node
+    try:
+        for part in path:
+            if isinstance(part, int):
+                if not isinstance(current, list):
+                    return None
+                current = current[part]
+            else:
+                if not isinstance(current, dict):
+                    return None
+                current = current[part]
+    except (IndexError, KeyError, TypeError):
+        return None
+    return current
+
+
+def path_key(path: tuple[str | int, ...]) -> str:
+    return ".".join(str(part) for part in path)
+
+
+def should_copy(source: str, path: tuple[str | int, ...]) -> bool:
+    if not source.strip() or not re.search(r"[A-Za-z]", source):
+        return True
+    last = str(path[-1]).lower() if path else ""
+    if last in NON_TRANSLATABLE_KEYS or any(
+        last.endswith(suffix)
+        for suffix in ("url", "href", "path", "command", "code", "icon")
+    ):
+        return True
+    if re.fullmatch(r"https?://\S+", source) or re.fullmatch(r"/[A-Za-z0-9_./:@%+=-]+", source):
+        return True
+    if re.fullmatch(r"[A-Z0-9_.:/+-]{2,}", source):
+        return True
+    return False
+
+
+def leaf_token(path: tuple[str | int, ...]) -> str:
+    return json.dumps(path, ensure_ascii=False, separators=(",", ":"))
+
+
+def source_fingerprints(source: Any) -> dict[str, str]:
+    return {
+        leaf_token(leaf.path): hashlib.sha256(leaf.source.encode("utf-8")).hexdigest()[:20]
+        for leaf in iter_leaves(source)
+    }
+
+
+def needs_translation(
+    source: str,
+    target: Any,
+    path: tuple[str | int, ...],
+    refresh: bool,
+    forced_tokens: set[str] | None = None,
+) -> bool:
+    if should_copy(source, path):
+        return False
+    if refresh:
+        return True
+    if forced_tokens and leaf_token(path) in forced_tokens:
+        return True
+    return not isinstance(target, str) or not target.strip() or target == source
+
+
+def protect_rich_tags(text: str) -> tuple[str, dict[str, str]]:
+    """Give translatable rich-text tags opaque names during translation.
+
+    Google can remove semantic tags such as ``strong`` or ``em`` after
+    translating their contents. Unknown tag names are retained, so rename
+    non-literal tags temporarily and restore them before contract validation.
+    Literal ``code``, ``kbd`` and ``pre`` elements stay untouched because the
+    provider preserves both their markup and their contents.
+    """
+
+    names: dict[str, str] = {}
+    reverse: dict[str, str] = {}
+
+    def replace(match: re.Match[str]) -> str:
+        original = match.group(1)
+        if original.lower() in {"code", "kbd", "pre"}:
+            return match.group(0)
+        key = original.lower()
+        internal = names.get(key)
+        if internal is None:
+            internal = f"pmxrich{len(names):04d}"
+            names[key] = internal
+            reverse[internal] = original
+        slash = "/" if match.group(0).startswith("</") else ""
+        return f"<{slash}{internal}>"
+
+    return TAG_RE.sub(replace, text), reverse
+
+
+def restore_rich_tags(text: str, mapping: dict[str, str]) -> str:
+    for internal, original in mapping.items():
+        text = re.sub(
+            rf"<(/?){re.escape(internal)}>",
+            lambda match: f"<{match.group(1)}{original}>",
+            text,
+            flags=re.IGNORECASE,
+        )
+    return text
+
+
+def protect_text(text: str) -> tuple[str, dict[str, str]]:
+    # Google already keeps both the markup and the contents of literal rich-
+    # text blocks. Replacing a filename or path inside one of these blocks can
+    # leave the sentinel as its only child, which the provider may discard.
+    literal_ranges = [(match.start(), match.end()) for match in LITERAL_TAG_RE.finditer(text)]
+
+    def overlaps_literal(start: int, end: int) -> bool:
+        return any(start < literal_end and end > literal_start for literal_start, literal_end in literal_ranges)
+
+    candidates: list[tuple[int, int]] = []
+    for pattern in PROTECTED_PATTERNS:
+        candidates.extend(
+            (match.start(), match.end())
+            for match in pattern.finditer(text)
+            if not overlaps_literal(match.start(), match.end())
+        )
+    candidates.extend(
+        (match.start(), match.end())
+        for match in TERM_RE.finditer(text)
+        if not overlaps_literal(match.start(), match.end())
+    )
+    candidates.sort(key=lambda item: (item[0], -(item[1] - item[0])))
+
+    selected: list[tuple[int, int]] = []
+    cursor = -1
+    for start, end in candidates:
+        if start >= cursor:
+            selected.append((start, end))
+            cursor = end
+
+    mapping: dict[str, str] = {}
+    chunks: list[str] = []
+    cursor = 0
+    for index, (start, end) in enumerate(selected):
+        # Google Translate can drop underscore-delimited sentinels when they
+        # sit directly beside inline markup (for example an opening <em>
+        # token followed by translated prose). Triple brackets remain opaque
+        # in that position and preserve the complete rich-text contract.
+        token = f"[[[PMXDOC{index:04d}]]]"
+        chunks.append(text[cursor:start])
+        chunks.append(token)
+        mapping[token] = text[start:end]
+        cursor = end
+    chunks.append(text[cursor:])
+    return "".join(chunks), mapping
+
+
+def restore_text(text: str, mapping: dict[str, str]) -> str:
+    missing = [token for token in mapping if token not in text]
+    if missing:
+        raise ValueError(f"translation provider changed protected token {missing[0]}")
+    for token, original in mapping.items():
+        text = text.replace(token, original)
+    return text
+
+
+def validate_contract(source: str, target: str) -> None:
+    if sorted(TAG_RE.findall(source)) != sorted(TAG_RE.findall(target)):
+        raise ValueError("rich-text tag contract changed")
+    if sorted(PLACEHOLDER_RE.findall(source)) != sorted(PLACEHOLDER_RE.findall(target)):
+        raise ValueError("placeholder contract changed")
+
+
+def provider_function(args: argparse.Namespace) -> Callable[[str, str], str]:
+    def translate(text: str, language: str) -> str:
+        if args.provider == "googletrans":
+            raw = translate_googletrans(text, language, args.context)
+        elif args.provider == "google-web":
+            raw = translate_google_web(text, language, args.context, args.timeout)
+        else:
+            raw = translate_appimage(
+                text,
+                language,
+                args.context,
+                args.timeout,
+                args.appimage_path,
+            )
+        return clean_translation(raw).strip()
+
+    return translate
+
+
+def translate_with_retry(
+    source: str,
+    language: str,
+    translate: Callable[[str, str], str],
+    retries: int,
+    delay: float,
+) -> str:
+    rich_text, rich_mapping = protect_rich_tags(source)
+    protected, mapping = protect_text(rich_text)
+    last_error: Exception | None = None
+    for attempt in range(retries + 1):
+        try:
+            translated = translate(protected, language)
+            if not translated:
+                raise ValueError("translation provider returned an empty value")
+            translated = restore_text(translated, mapping)
+            translated = restore_rich_tags(translated, rich_mapping)
+            validate_contract(source, translated)
+            return translated
+        except Exception as exc:  # network/provider errors are retried together
+            last_error = exc
+            if attempt < retries:
+                time.sleep(delay * (attempt + 1))
+    raise RuntimeError(str(last_error)) from last_error
+
+
+def merge_tree(
+    source: Any,
+    target: Any,
+    translations: dict[tuple[str | int, ...], str],
+    path: tuple[str | int, ...] = (),
+) -> Any:
+    if isinstance(source, dict):
+        target_dict = target if isinstance(target, dict) else {}
+        return {
+            key: merge_tree(value, target_dict.get(key), translations, path + (key,))
+            for key, value in source.items()
+        }
+    if isinstance(source, list):
+        target_list = target if isinstance(target, list) else []
+        return [
+            merge_tree(
+                value,
+                target_list[index] if index < len(target_list) else None,
+                translations,
+                path + (index,),
+            )
+            for index, value in enumerate(source)
+        ]
+    if isinstance(source, str):
+        if path in translations:
+            return translations[path]
+        if should_copy(source, path):
+            return source
+        if isinstance(target, str) and target.strip():
+            return target
+        return source
+    return source
+
+
+def source_files(source_root: Path, section: str) -> list[Path]:
+    scope = (source_root / section).resolve()
+    root = source_root.resolve()
+    if scope != root and root not in scope.parents:
+        raise ValueError("section must stay inside the English messages directory")
+    if scope.is_file():
+        if scope.suffix != ".json":
+            raise ValueError("section file must be JSON")
+        return [scope]
+    if not scope.is_dir():
+        raise ValueError(f"section does not exist: {scope}")
+    return sorted(
+        path
+        for path in scope.rglob("*.json")
+        if not any(part.startswith(".") for part in path.relative_to(root).parts)
+    )
+
+
+def collect_memory(source_root: Path, messages_root: Path, language: str) -> dict[str, str]:
+    memory: dict[str, str] = {}
+    conflicts: set[str] = set()
+    for source_path in sorted(source_root.rglob("*.json")):
+        if any(part.startswith(".") for part in source_path.relative_to(source_root).parts):
+            continue
+        target_path = messages_root / language / source_path.relative_to(source_root)
+        source = read_json(source_path)
+        target = read_json(target_path)
+        if target is None:
+            continue
+        for leaf in iter_leaves(source):
+            translated = get_at_path(target, leaf.path)
+            if not isinstance(translated, str) or not translated.strip() or translated == leaf.source:
+                continue
+            previous = memory.get(leaf.source)
+            if previous is not None and previous != translated:
+                conflicts.add(leaf.source)
+            else:
+                memory[leaf.source] = translated
+    for source in conflicts:
+        memory.pop(source, None)
+    return memory
+
+
+def pending_leaves(
+    source: Any,
+    target: Any,
+    refresh: bool,
+    forced_tokens: set[str] | None = None,
+) -> list[Leaf]:
+    return [
+        leaf
+        for leaf in iter_leaves(source)
+        if needs_translation(
+            leaf.source,
+            get_at_path(target, leaf.path),
+            leaf.path,
+            refresh,
+            forced_tokens,
+        )
+    ]
+
+
+def schema_matches(source: Any, target: Any) -> bool:
+    if type(source) is not type(target):
+        return False
+    if isinstance(source, dict):
+        return list(source) == list(target) and all(
+            schema_matches(source[key], target[key]) for key in source
+        )
+    if isinstance(source, list):
+        return len(source) == len(target) and all(
+            schema_matches(left, right) for left, right in zip(source, target)
+        )
+    if isinstance(source, str):
+        # Localized strings intentionally differ from the English source.
+        return True
+    # Booleans, numbers and null values are structural data and must stay in
+    # sync with the English catalog instead of retaining an obsolete value.
+    return source == target
+
+
+def empty_source_state() -> dict[str, Any]:
+    return {
+        "version": SOURCE_STATE_VERSION,
+        "initialized": False,
+        "source": {},
+        "pending": {},
+    }
+
+
+def load_source_state(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        return empty_source_state()
+    try:
+        value = read_json(path)
+    except ValueError:
+        return empty_source_state()
+    if not isinstance(value, dict) or value.get("version") != SOURCE_STATE_VERSION:
+        return empty_source_state()
+    if not isinstance(value.get("source"), dict) or not isinstance(value.get("pending"), dict):
+        return empty_source_state()
+    value.setdefault("initialized", True)
+    return value
+
+
+def state_pending_tokens(state: dict[str, Any], language: str, relative: str) -> set[str]:
+    language_state = state.setdefault("pending", {}).setdefault(language, {})
+    values = language_state.get(relative, [])
+    if not isinstance(values, list):
+        return set()
+    return {str(value) for value in values}
+
+
+def set_state_pending_tokens(
+    state: dict[str, Any], language: str, relative: str, tokens: set[str]
+) -> None:
+    language_state = state.setdefault("pending", {}).setdefault(language, {})
+    if tokens:
+        language_state[relative] = sorted(tokens)
+    else:
+        language_state.pop(relative, None)
+    if not language_state:
+        state["pending"].pop(language, None)
+
+
+def translate_file(
+    source: Any,
+    target: Any,
+    leaves: list[Leaf],
+    language: str,
+    memory: dict[str, str],
+    translate: Callable[[str, str], str],
+    args: argparse.Namespace,
+) -> tuple[Any | None, list[str], int]:
+    resolved: dict[tuple[str | int, ...], str] = {}
+    failures: list[str] = []
+    jobs: dict[str, list[tuple[str | int, ...]]] = {}
+
+    for leaf in leaves:
+        if not args.refresh and leaf.source in memory:
+            resolved[leaf.path] = memory[leaf.source]
+            continue
+        jobs.setdefault(leaf.source, []).append(leaf.path)
+
+    if jobs:
+        with ThreadPoolExecutor(max_workers=args.workers) as executor:
+            futures = {
+                executor.submit(
+                    translate_with_retry,
+                    text,
+                    language,
+                    translate,
+                    args.retries,
+                    args.retry_delay,
+                ): text
+                for text in jobs
+            }
+            for future in as_completed(futures):
+                text = futures[future]
+                try:
+                    translated = future.result()
+                    memory[text] = translated
+                    for path in jobs[text]:
+                        resolved[path] = translated
+                except Exception as exc:
+                    failures.append(f"{text[:90]}: {exc}")
+                if args.sleep:
+                    time.sleep(args.sleep)
+
+    if failures:
+        return None, failures, len(jobs)
+    return merge_tree(source, target, resolved), [], len(jobs)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--source-dir", type=Path, default=Path("web/messages/en"))
+    parser.add_argument("--messages-dir", type=Path, default=Path("web/messages"))
+    parser.add_argument("--languages", default=",".join(DEFAULT_LANGUAGES))
+    parser.add_argument(
+        "--section",
+        default=".",
+        help="Relative file or directory below the English messages directory.",
+    )
+    parser.add_argument(
+        "--provider",
+        choices=("google-web", "googletrans", "appimage"),
+        default="googletrans",
+    )
+    parser.add_argument("--appimage-path", type=Path, default=Path("ProxMenux-Monitor.AppImage"))
+    parser.add_argument(
+        "--source-state",
+        type=Path,
+        default=None,
+        help=(
+            "Source fingerprint state used to detect changed English strings. "
+            "Defaults to <messages-dir>/.docs-i18n-source-state.json."
+        ),
+    )
+    parser.add_argument("--context", default=DEFAULT_CONTEXT)
+    parser.add_argument("--timeout", type=int, default=30)
+    parser.add_argument("--workers", type=int, default=4)
+    parser.add_argument("--retries", type=int, default=3)
+    parser.add_argument("--retry-delay", type=float, default=2.0)
+    parser.add_argument("--sleep", type=float, default=0.0)
+    parser.add_argument(
+        "--max-files",
+        type=int,
+        default=0,
+        help="Maximum pending files per locale; zero processes all files.",
+    )
+    parser.add_argument("--dry-run", action="store_true")
+    parser.add_argument("--check", action="store_true")
+    parser.add_argument(
+        "--refresh",
+        action="store_true",
+        help="Overwrite existing translations in the selected scope.",
+    )
+    parser.add_argument("--strict", action="store_true")
+    return parser
+
+
+def main() -> int:
+    args = build_parser().parse_args()
+    if args.workers < 1 or args.retries < 0 or args.max_files < 0:
+        print("workers must be positive; retries and max-files cannot be negative", file=sys.stderr)
+        return 2
+
+    source_root = args.source_dir.resolve()
+    messages_root = args.messages_dir.resolve()
+    source_state_path = (
+        args.source_state.resolve()
+        if args.source_state is not None
+        else messages_root / ".docs-i18n-source-state.json"
+    )
+    languages = [item.strip() for item in args.languages.split(",") if item.strip()]
+    try:
+        files = source_files(source_root, args.section)
+    except ValueError as exc:
+        print(exc, file=sys.stderr)
+        return 2
+
+    if not languages:
+        print("No target languages selected.", file=sys.stderr)
+        return 2
+    if args.refresh:
+        print("WARNING: --refresh overwrites existing translations in the selected scope.")
+
+    translate = provider_function(args)
+    state = load_source_state(source_state_path)
+    state_was_initialized = bool(state.get("initialized"))
+    previous_source_state = state.setdefault("source", {})
+
+    file_info: dict[
+        str, tuple[Path, Any, dict[str, str], set[str], set[str]]
+    ] = {}
+    selected_relatives: set[str] = set()
+    for source_path in files:
+        relative = source_path.relative_to(source_root).as_posix()
+        selected_relatives.add(relative)
+        source = read_json(source_path)
+        current_fingerprints = source_fingerprints(source)
+        translatable_tokens = {
+            leaf_token(leaf.path)
+            for leaf in iter_leaves(source)
+            if not should_copy(leaf.source, leaf.path)
+        }
+        previous_fingerprints = previous_source_state.get(relative, {})
+        if not isinstance(previous_fingerprints, dict):
+            previous_fingerprints = {}
+        if state_was_initialized:
+            changed_tokens = {
+                token
+                for token, fingerprint in current_fingerprints.items()
+                if token in translatable_tokens
+                # Existing English leaves whose text changed must be sent to
+                # the provider even when the target still contains the old,
+                # non-empty translation. New leaves are handled by the usual
+                # missing-target detection, preserving a translation supplied
+                # manually in the same commit.
+                and token in previous_fingerprints
+                and previous_fingerprints[token] != fingerprint
+            }
+        else:
+            # The first run establishes the baseline without replacing
+            # existing human/Codex translations. Missing target values are
+            # still discovered separately for every locale below.
+            changed_tokens = set()
+        file_info[relative] = (
+            source_path,
+            source,
+            current_fingerprints,
+            changed_tokens,
+            translatable_tokens,
+        )
+
+    # Materialize every locale's pending queue before advancing the shared
+    # English baseline. If the runner stops halfway through, unprocessed
+    # locales retain the exact changed leaf tokens for the next run.
+    for language in languages:
+        for relative, (
+            _,
+            source,
+            _,
+            changed_tokens,
+            translatable_tokens,
+        ) in file_info.items():
+            target_path = messages_root / language / relative
+            target = read_json(target_path)
+            pending_tokens = (
+                state_pending_tokens(state, language, relative)
+                & translatable_tokens
+            )
+            pending_tokens.update(changed_tokens)
+            pending_tokens.update(
+                leaf_token(leaf.path)
+                for leaf in pending_leaves(source, target, args.refresh)
+            )
+            set_state_pending_tokens(state, language, relative, pending_tokens)
+
+    for relative, (_, _, current_fingerprints, _, _) in file_info.items():
+        previous_source_state[relative] = current_fingerprints
+    state["initialized"] = True
+
+    # A complete run also mirrors deletion of an English catalog. Partial
+    # --section runs deliberately leave unrelated paths untouched.
+    if args.section in (".", ""):
+        removed_files = set(previous_source_state) - selected_relatives
+        for relative in sorted(removed_files):
+            for language in languages:
+                target_path = messages_root / language / relative
+                if target_path.exists() and not (args.check or args.dry_run):
+                    target_path.unlink()
+                    print(f"[{language}] removed obsolete catalog {target_path}")
+                set_state_pending_tokens(state, language, relative, set())
+            previous_source_state.pop(relative, None)
+
+    if not (args.check or args.dry_run):
+        write_json(source_state_path, state)
+
+    total_failures = 0
+    total_written = 0
+    print(f"English files: {len(files)} | locales: {', '.join(languages)}")
+
+    for language in languages:
+        memory = collect_memory(source_root, messages_root, language)
+        # A target value paired with a newly changed English source is the old
+        # translation, not valid translation memory for the new sentence.
+        # Remove every queued source text before provider reuse; successful
+        # translations repopulate memory normally for later files.
+        queued_source_texts: set[str] = set()
+        for relative_key, (_, source, _, _, _) in file_info.items():
+            queued_tokens = state_pending_tokens(state, language, relative_key)
+            queued_source_texts.update(
+                leaf.source
+                for leaf in iter_leaves(source)
+                if leaf_token(leaf.path) in queued_tokens
+            )
+        for source_text in queued_source_texts:
+            memory.pop(source_text, None)
+        pending: list[
+            tuple[Path, Path, Any, Any, list[Leaf], set[str], bool]
+        ] = []
+        total_strings = 0
+        missing_strings = 0
+
+        for source_path in files:
+            relative = source_path.relative_to(source_root)
+            relative_key = relative.as_posix()
+            target_path = messages_root / language / relative
+            source = file_info[relative_key][1]
+            target = read_json(target_path)
+            queued_tokens = state_pending_tokens(state, language, relative_key)
+            leaves = pending_leaves(source, target, args.refresh, queued_tokens)
+            total_strings += len(iter_leaves(source))
+            missing_strings += len(leaves)
+            schema_changed = not schema_matches(source, target)
+            if leaves or schema_changed:
+                pending.append(
+                    (
+                        source_path,
+                        target_path,
+                        source,
+                        target,
+                        leaves,
+                        queued_tokens,
+                        schema_changed,
+                    )
+                )
+
+        print(
+            f"[{language}] {missing_strings}/{total_strings} strings pending "
+            f"across {len(pending)} files; reusable translations: {len(memory)}"
+        )
+        if args.check or args.dry_run:
+            continue
+        if args.max_files:
+            pending = pending[: args.max_files]
+
+        for index, (
+            source_path,
+            target_path,
+            source,
+            target,
+            leaves,
+            queued_tokens,
+            schema_changed,
+        ) in enumerate(pending, 1):
+            relative = source_path.relative_to(source_root)
+            relative_key = relative.as_posix()
+            suffix = " + schema sync" if schema_changed else ""
+            print(
+                f"[{language} {index}/{len(pending)}] {relative} "
+                f"({len(leaves)} strings{suffix})",
+                flush=True,
+            )
+            built, failures, calls = translate_file(
+                source,
+                target,
+                leaves,
+                language,
+                memory,
+                translate,
+                args,
+            )
+            if failures:
+                total_failures += len(failures)
+                set_state_pending_tokens(state, language, relative_key, queued_tokens)
+                write_json(source_state_path, state)
+                print(
+                    f"  skipped atomically after {len(failures)} failures "
+                    f"({calls} calls)",
+                    file=sys.stderr,
+                )
+                for failure in failures[:5]:
+                    print(f"  - {failure}", file=sys.stderr)
+                continue
+            write_json(target_path, built)
+            set_state_pending_tokens(state, language, relative_key, set())
+            write_json(source_state_path, state)
+            total_written += 1
+            print(f"  wrote {target_path} ({calls} provider calls)", flush=True)
+
+    if args.check or args.dry_run:
+        return 0
+    print(f"Completed: {total_written} files written; {total_failures} failed strings.")
+    return 1 if args.strict and total_failures else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/generate_helpers_cache.py

@@ -67,9 +67,9 @@ def fetch_all_records(url: str, *, expand: str | None = None, per_page: int = 50
     return items
 
 
-def normalize_os_variants(install_methods_json: list[dict[str, Any]]) -> list[str]:
+def normalize_os_variants(install_methods: list[dict[str, Any]]) -> list[str]:
     os_values: list[str] = []
-    for item in install_methods_json:
+    for item in install_methods:
         if not isinstance(item, dict):
             continue
         resources = item.get("resources", {})
@@ -83,6 +83,31 @@ def normalize_os_variants(install_methods_json: list[dict[str, Any]]) -> list[st
     return os_values
 
 
+def split_notes(notes_raw: list[dict[str, Any]]) -> tuple[list[str], list[str]]:
+    """Split PocketBase notes into (info_notes, warnings).
+
+    Each entry has shape ``{"text": str, "type": "warning"|...}``. Anything
+    flagged ``type == "warning"`` lands in the warnings list so the bash
+    menu can render those in red with a dedicated WARNINGS header. Other
+    notes go to the regular notes list.
+    """
+    info: list[str] = []
+    warns: list[str] = []
+    for note in notes_raw or []:
+        if not isinstance(note, dict):
+            continue
+        text = note.get("text")
+        if not isinstance(text, str) or not text.strip():
+            continue
+        text = text.strip()
+        ntype = (note.get("type") or "").strip().lower()
+        if ntype == "warning":
+            warns.append(text)
+        else:
+            info.append(text)
+    return info, warns
+
+
 def build_script_path(type_name: str, slug: str) -> str:
     type_name = (type_name or "").strip().lower()
     slug = (slug or "").strip()
@@ -138,19 +163,19 @@ def main() -> int:
         full_script_url = f"{SCRIPT_BASE}/{script_path}"
         script_url_mirror = to_mirror_url(full_script_url)
 
-        install_methods_json = raw.get("install_methods_json", [])
-        if not isinstance(install_methods_json, list):
-            install_methods_json = []
+        # Sprint 11.7: PocketBase exposes these as `install_methods` and
+        # `notes`, not `install_methods_json` / `notes_json`. The legacy field
+        # names silently returned [] for every entry, which is why the cache
+        # had empty notes and missing OS variants for every script.
+        install_methods = raw.get("install_methods", [])
+        if not isinstance(install_methods, list):
+            install_methods = []
 
-        notes_json = raw.get("notes_json", [])
-        if not isinstance(notes_json, list):
-            notes_json = []
+        notes_raw = raw.get("notes", [])
+        if not isinstance(notes_raw, list):
+            notes_raw = []
 
-        notes = [
-            note.get("text", "")
-            for note in notes_json
-            if isinstance(note, dict) and isinstance(note.get("text"), str) and note.get("text", "").strip()
-        ]
+        notes, warnings = split_notes(notes_raw)
 
         category_ids = raw.get("categories", [])
         if not isinstance(category_ids, list):
@@ -193,6 +218,7 @@ def main() -> int:
             "categories": category_ids,
             "category_names": category_names,
             "notes": notes,
+            "warnings": warnings,
             "port": raw.get("port", 0),
             "website": raw.get("website", ""),
             "documentation": raw.get("documentation", ""),
@@ -210,7 +236,7 @@ def main() -> int:
         # Emit one entry per install method so the menu shell can offer an
         # explicit OS choice. When there is only one method (or none), a
         # single entry is emitted with os="" (script decides at runtime).
-        os_variants = normalize_os_variants(install_methods_json)
+        os_variants = normalize_os_variants(install_methods)
 
         if len(os_variants) > 1:
             for os_name in os_variants:
@@ -228,11 +254,12 @@ def main() -> int:
     with OUTPUT_FILE.open("w", encoding="utf-8") as f:
         json.dump(cache, f, ensure_ascii=False, indent=2)
 
+    total_notes = sum(len(e.get("notes", [])) for e in cache)
+    total_warns = sum(len(e.get("warnings", [])) for e in cache)
     print(f"\n✅ helpers_cache.json → {OUTPUT_FILE}")
-    print(f"   Guardados: {len(cache)}")
+    print(f"   Guardados: {len(cache)} entries, {total_notes} notes, {total_warns} warnings")
 
     return 0
 
-
 if __name__ == "__main__":
     sys.exit(main())

.github/scripts/tests/test_build_web_docs_i18n.py

@@ -0,0 +1,221 @@
+import importlib.util
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+SCRIPT = Path(__file__).parents[1] / "build_web_docs_i18n.py"
+SPEC = importlib.util.spec_from_file_location("build_web_docs_i18n", SCRIPT)
+MODULE = importlib.util.module_from_spec(SPEC)
+assert SPEC and SPEC.loader
+sys.modules[SPEC.name] = MODULE
+SPEC.loader.exec_module(MODULE)
+
+
+class WebDocsI18nTests(unittest.TestCase):
+    def run_generator(self, root, provider):
+        source_root = root / "messages" / "en"
+        messages_root = root / "messages"
+        state_path = messages_root / ".docs-i18n-source-state.json"
+        argv = [
+            str(SCRIPT),
+            "--source-dir",
+            str(source_root),
+            "--messages-dir",
+            str(messages_root),
+            "--languages",
+            "de",
+            "--source-state",
+            str(state_path),
+            "--workers",
+            "1",
+        ]
+        with mock.patch.object(sys, "argv", argv), mock.patch.object(
+            MODULE, "provider_function", return_value=provider
+        ):
+            return MODULE.main()
+
+    def test_protected_contract_round_trip(self):
+        source = (
+            "Run <code>systemctl restart pveproxy</code> in Proxmox VE, "
+            "then open <link>Settings</link> at {host}."
+        )
+        protected, mapping = MODULE.protect_text(source)
+        self.assertIn("<code>systemctl restart pveproxy</code>", protected)
+        self.assertNotIn("Proxmox VE", protected)
+        self.assertIn("<code>", protected)
+        self.assertIn("</code>", protected)
+        self.assertIn("<link>", protected)
+        self.assertIn("</link>", protected)
+        self.assertNotIn("<code>", mapping.values())
+        self.assertNotIn("</code>", mapping.values())
+        self.assertNotIn("systemctl", mapping.values())
+        self.assertEqual(MODULE.restore_text(protected, mapping), source)
+
+    def test_human_translation_is_not_pending(self):
+        source = {"title": "Updates", "url": "https://example.com"}
+        target = {"title": "Actualizaciones", "url": "https://example.com"}
+        self.assertEqual(MODULE.pending_leaves(source, target, refresh=False), [])
+
+    def test_changed_source_text_is_pending_even_with_existing_translation(self):
+        source = {"title": "Updated installation guidance"}
+        target = {"title": "Vorherige Installationsanleitung"}
+        token = MODULE.leaf_token(("title",))
+        leaves = MODULE.pending_leaves(
+            source,
+            target,
+            refresh=False,
+            forced_tokens={token},
+        )
+        self.assertEqual([leaf.path for leaf in leaves], [("title",)])
+
+    def test_source_fingerprints_change_per_leaf(self):
+        before = MODULE.source_fingerprints({"title": "One", "body": "Same"})
+        after = MODULE.source_fingerprints({"title": "Two", "body": "Same"})
+        self.assertNotEqual(
+            before[MODULE.leaf_token(("title",))],
+            after[MODULE.leaf_token(("title",))],
+        )
+        self.assertEqual(
+            before[MODULE.leaf_token(("body",))],
+            after[MODULE.leaf_token(("body",))],
+        )
+
+    def test_schema_mismatch_detects_removed_keys(self):
+        self.assertFalse(
+            MODULE.schema_matches(
+                {"title": "Title"},
+                {"title": "Título", "removed": "Old"},
+            )
+        )
+
+    def test_schema_mismatch_detects_changed_structural_values(self):
+        self.assertFalse(
+            MODULE.schema_matches(
+                {"enabled": True, "retries": 2},
+                {"enabled": False, "retries": 2},
+            )
+        )
+
+    def test_schema_allows_localized_string_values(self):
+        self.assertTrue(
+            MODULE.schema_matches(
+                {"title": "Updates"},
+                {"title": "Aktualisierungen"},
+            )
+        )
+
+    def test_translatable_rich_tags_use_opaque_names(self):
+        source = (
+            "Keep <strong>this</strong>, <em>that</em> and "
+            "<code>systemctl restart pveproxy</code>."
+        )
+        protected, mapping = MODULE.protect_rich_tags(source)
+        self.assertIn("<pmxrich0000>this</pmxrich0000>", protected)
+        self.assertIn("<pmxrich0001>that</pmxrich0001>", protected)
+        self.assertIn("<code>systemctl restart pveproxy</code>", protected)
+        self.assertEqual(MODULE.restore_rich_tags(protected, mapping), source)
+
+    def test_source_schema_drives_output(self):
+        source = {"title": "Title", "items": ["One", "Two"]}
+        target = {
+            "title": "Título",
+            "items": ["Uno", "Dos", "Obsoleto"],
+            "removed": "Old",
+        }
+        translated = {
+            ("items", 0): "Uno",
+            ("items", 1): "Dos",
+        }
+        self.assertEqual(
+            MODULE.merge_tree(source, target, translated),
+            {"title": "Título", "items": ["Uno", "Dos"]},
+        )
+
+    def test_translation_memory_ignores_conflicts(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source_root = root / "messages" / "en"
+            target_root = root / "messages" / "es"
+            source_root.mkdir(parents=True)
+            target_root.mkdir(parents=True)
+            (source_root / "one.json").write_text(
+                json.dumps({"label": "Settings"}), encoding="utf-8"
+            )
+            (target_root / "one.json").write_text(
+                json.dumps({"label": "Ajustes"}), encoding="utf-8"
+            )
+            (source_root / "two.json").write_text(
+                json.dumps({"label": "Settings"}), encoding="utf-8"
+            )
+            (target_root / "two.json").write_text(
+                json.dumps({"label": "Configuración"}), encoding="utf-8"
+            )
+            memory = MODULE.collect_memory(source_root, root / "messages", "es")
+            self.assertNotIn("Settings", memory)
+
+    def test_source_state_retranslates_an_existing_changed_leaf(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source_path = root / "messages" / "en" / "page.json"
+            target_path = root / "messages" / "de" / "page.json"
+            source_path.parent.mkdir(parents=True)
+            target_path.parent.mkdir(parents=True)
+            source_path.write_text(json.dumps({"title": "Original"}), encoding="utf-8")
+            target_path.write_text(json.dumps({"title": "Ursprünglich"}), encoding="utf-8")
+
+            self.assertEqual(
+                self.run_generator(root, lambda *_: self.fail("provider called during baseline")),
+                0,
+            )
+            self.assertEqual(read_json_file(target_path), {"title": "Ursprünglich"})
+
+            source_path.write_text(json.dumps({"title": "Changed"}), encoding="utf-8")
+            calls = []
+
+            def provider(text, language):
+                calls.append((text, language))
+                return "Geändert"
+
+            self.assertEqual(self.run_generator(root, provider), 0)
+            self.assertEqual(calls, [("Changed", "de")])
+            self.assertEqual(read_json_file(target_path), {"title": "Geändert"})
+
+    def test_new_leaf_preserves_translation_supplied_with_source_change(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source_path = root / "messages" / "en" / "page.json"
+            target_path = root / "messages" / "de" / "page.json"
+            source_path.parent.mkdir(parents=True)
+            target_path.parent.mkdir(parents=True)
+            source_path.write_text(json.dumps({"title": "Original"}), encoding="utf-8")
+            target_path.write_text(json.dumps({"title": "Ursprünglich"}), encoding="utf-8")
+            self.assertEqual(self.run_generator(root, lambda *_: "unused"), 0)
+
+            source_path.write_text(
+                json.dumps({"title": "Original", "new": "New text"}),
+                encoding="utf-8",
+            )
+            target_path.write_text(
+                json.dumps({"title": "Ursprünglich", "new": "Neuer Text"}),
+                encoding="utf-8",
+            )
+            self.assertEqual(
+                self.run_generator(root, lambda *_: self.fail("manual translation overwritten")),
+                0,
+            )
+            self.assertEqual(
+                read_json_file(target_path),
+                {"title": "Ursprünglich", "new": "Neuer Text"},
+            )
+
+
+def read_json_file(path):
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/workflows/build-appimage-Release.yml

@@ -6,22 +6,19 @@ on:
 permissions:
   contents: write
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 jobs:
   build:
     runs-on: ubuntu-22.04
     
     steps:
     - name: Checkout main
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         ref: main
         token: ${{ secrets.GITHUB_TOKEN }}
       
     - name: Setup Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v6
       with:
         node-version: '22'
         
@@ -59,7 +56,7 @@ jobs:
         cat ProxMenux-Monitor.AppImage.sha256
 
     - name: Upload AppImage artifact
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         name: ProxMenux-${{ steps.version.outputs.VERSION }}-AppImage
         path: |

.github/workflows/build-appimage-beta.yml

@@ -6,22 +6,19 @@ on:
 permissions:
   contents: write
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 jobs:
   build:
     runs-on: ubuntu-22.04
     
     steps:
     - name: Checkout develop
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         ref: develop
         token: ${{ secrets.GITHUB_TOKEN }}
       
     - name: Setup Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v6
       with:
         node-version: '22'
         
@@ -59,7 +56,7 @@ jobs:
         cat ProxMenux-Monitor.AppImage.sha256
 
     - name: Upload AppImage artifact
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         name: ProxMenux-${{ steps.version.outputs.VERSION }}-beta-AppImage
         path: |

.github/workflows/build-appimage-manual.yml

@@ -0,0 +1,81 @@
+name: Build ProxMenux Monitor AppImage
+
+on:
+
+  workflow_dispatch:  
+  
+permissions:
+  contents: write
+  
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v6
+      
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: '20'
+        
+    - name: Install dependencies
+      working-directory: AppImage
+      run: npm install --legacy-peer-deps
+      
+    - name: Build Next.js app
+      working-directory: AppImage
+      run: npm run build
+      
+    - name: Install Python dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y python3 python3-pip python3-venv
+        
+    - name: Make build script executable
+      working-directory: AppImage
+      run: chmod +x scripts/build_appimage.sh
+      
+    - name: Build AppImage
+      working-directory: AppImage
+      run: ./scripts/build_appimage.sh
+      
+    - name: Get version from package.json
+      id: version
+      working-directory: AppImage
+      run: echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
+      
+    - name: Upload AppImage artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: ProxMenux-${{ steps.version.outputs.VERSION }}-AppImage
+        path: AppImage/dist/*.AppImage
+        retention-days: 30
+
+    - name: Generate SHA256 checksum
+      run: |
+        cd AppImage/dist
+        sha256sum *.AppImage > ProxMenux-Monitor.AppImage.sha256
+        echo "Generated SHA256:"
+        cat ProxMenux-Monitor.AppImage.sha256
+
+    - name: Upload AppImage and checksum to /AppImage folder in main
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        git config --global user.name "github-actions[bot]"
+        git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+        git fetch origin main
+        git checkout main
+
+        rm -f AppImage/*.AppImage AppImage/*.sha256 || true
+
+        # Copy new files
+        cp AppImage/dist/*.AppImage AppImage/
+        cp AppImage/dist/ProxMenux-Monitor.AppImage.sha256 AppImage/
+
+        git add AppImage/*.AppImage AppImage/*.sha256
+        git commit -m "Update AppImage build ($(date +'%Y-%m-%d %H:%M:%S'))" || echo "No changes to commit"
+        git push origin main

.github/workflows/build-appimage.yml

@@ -9,19 +9,16 @@ on:
     paths: [ 'AppImage/**' ]
   workflow_dispatch:  
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 jobs:
   build:
     runs-on: ubuntu-22.04
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       
     - name: Setup Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v6
       with:
         node-version: '22'
         
@@ -52,7 +49,7 @@ jobs:
       run: echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
       
     - name: Upload AppImage artifact
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         name: ProxMenux-${{ steps.version.outputs.VERSION }}-AppImage
         path: AppImage/dist/*.AppImage

.github/workflows/build-i18n-messages.yml

@@ -0,0 +1,138 @@
+name: Build i18n messages
+
+# Auto-translate missing keys in AppImage/messages/<locale>/common.json
+# against the English source whenever the source changes.
+#
+# The Monitor's i18n layer (AppImage/lib/i18n/provider.tsx) does its own
+# runtime fallback (locale → en → key), so this workflow doesn't break
+# anything if it misses a key: it just eliminates the visible-English
+# blocks in non-en locales.
+#
+# Guardrails baked into build_i18n_messages.py:
+#   - Never overwrites a key whose target value differs from EN (i.e.
+#     already translated by a human). This is what makes it safe to
+#     include sk in the default set: Vaso73's curated strings are
+#     protected end-to-end; auto only fills keys still on the EN
+#     fallback.
+#   - `{placeholder}` tokens are protected end-to-end.
+#
+# Triggers:
+#   - push to develop touching AppImage/messages/en/common.json
+#   - manual via workflow_dispatch
+
+on:
+  push:
+    branches: [develop]
+    paths:
+      # Only en/ triggers the run — it's the source of truth. Other
+      # locales are destinations, and the bot auto-commits them at
+      # the end of every run; if they were in the trigger too, each
+      # auto-commit would fire another (empty) run.
+      # Manual edits to a curated locale that empty a key for the
+      # workflow to refill are the exception — dispatch this
+      # workflow manually from Actions in that case, or piggy-back
+      # a trivial en/ change onto the commit.
+      - 'AppImage/messages/en/common.json'
+      - '.github/scripts/build_i18n_messages.py'
+      - '.github/workflows/build-i18n-messages.yml'
+  workflow_dispatch:
+    inputs:
+      refresh:
+        description: 'Re-translate every key (overwrites human translations!)'
+        type: boolean
+        default: false
+      languages:
+        description: 'Comma-separated locales. Default: es,de,fr,it,pt,sk,sv (guardrail protects Vaso73 sk).'
+        default: 'es,de,fr,it,pt,sk,sv'
+
+# Prevent two runs from racing on the same branch and fighting over the
+# auto-commit. cancel-in-progress:false because a full first-run may take
+# ~30 min for the initial bootstrap and interrupting mid-flight would
+# waste the calls already made.
+concurrency:
+  group: build-i18n-messages-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  translate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # auto-commit AppImage/messages/*/common.json to develop
+    # First-run bootstrap of ~5 locales × 3.8k keys can take a while at
+    # 0.15s/call with rate-limit backoffs. 90 min headroom.
+    timeout-minutes: 90
+
+    steps:
+      - name: Checkout develop
+        uses: actions/checkout@v4
+        with:
+          ref: develop
+          # Full history so the auto-commit doesn't drift when another
+          # push landed between trigger and this job start.
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install googletrans
+        run: |
+          python -m pip install --upgrade pip
+          # Same pinning as build-translation-cache.yml so the two
+          # workflows share behavior. Bump both in lockstep.
+          pip install 'googletrans==4.0.0-rc1' 'httpx==0.13.3' 'httpcore==0.9.1' 'h11==0.9.0'
+
+      - name: Translate missing keys
+        run: |
+          REFRESH_FLAG=""
+          if [[ "${{ github.event.inputs.refresh }}" == "true" ]]; then
+            REFRESH_FLAG="--refresh"
+          fi
+          LANGS="${{ github.event.inputs.languages }}"
+          # Keep this fallback in sync with the workflow_dispatch input
+          # default above AND with DEFAULT_LANGUAGES in the Python script —
+          # `push` triggers hit this branch (inputs are empty on push).
+          LANGS="${LANGS:-es,de,fr,it,pt,sk,sv}"
+          python .github/scripts/build_i18n_messages.py \
+            --source AppImage/messages/en/common.json \
+            --messages-dir AppImage/messages \
+            --languages "$LANGS" \
+            --provider googletrans \
+            $REFRESH_FLAG
+
+      - name: Commit + push if changed
+        run: |
+          if git diff --quiet -- AppImage/messages/; then
+            echo "No translation changes — skipping commit."
+            exit 0
+          fi
+          git config user.name  "ProxMenuxBot"
+          git config user.email "bot@proxmenux.local"
+          git add AppImage/messages/
+          git commit -m "chore(i18n): auto-fill missing translations in messages/{locale}/common.json
+
+          Source: ${GITHUB_SHA::7}
+          Triggered by: ${{ github.event_name }}"
+          # Rebase-and-retry against develop: between the initial
+          # checkout and this push another workflow (e.g.
+          # build-translation-cache auto-commit) or a manual push can
+          # land on develop first, and a naked push fails with
+          # non-fast-forward — losing the freshly generated translation
+          # commit. Rebasing the local i18n commit on top of the newer
+          # HEAD is safe: paths don't overlap with cache/script
+          # workflows, and the same-branch collisions between two i18n
+          # runs are already blocked by the concurrency group above.
+          for attempt in 1 2 3 4 5; do
+            git fetch origin develop
+            if git rebase origin/develop && git push origin develop; then
+              echo "push succeeded on attempt ${attempt}"
+              exit 0
+            fi
+            echo "push attempt ${attempt} failed, retrying..."
+            git rebase --abort 2>/dev/null || true
+            sleep $(( attempt * 3 ))
+          done
+          echo "push failed after 5 attempts"
+          exit 1

.github/workflows/build-translation-cache.yml

@@ -0,0 +1,118 @@
+name: Build translation cache
+
+# Regenerates lang/*.json whenever a bash script under scripts/ changes.
+# The runtime translate() in scripts/utils.sh reads these JSON files and
+# falls back to the English source on miss, so keeping them up-to-date is
+# what makes ProxMenux multilingual without any runtime googletrans
+# dependency on the user's host.
+#
+# Triggers:
+#   - push to develop touching scripts/**/*.sh
+#   - manual via workflow_dispatch (force --refresh)
+
+on:
+  push:
+    branches: [develop]
+    paths:
+      - 'scripts/**/*.sh'
+      - 'menu'
+      - 'install_proxmenux.sh'
+      - 'install_proxmenux_beta.sh'
+      - '.github/scripts/build_translation_cache.py'
+      - '.github/workflows/build-translation-cache.yml'
+  workflow_dispatch:
+    inputs:
+      refresh:
+        description: 'Re-translate every entry (ignore cached values)'
+        type: boolean
+        default: false
+
+# Avoid two cache rebuilds from racing each other on the same branch and
+# fighting over the auto-commit.
+concurrency:
+  group: build-translation-cache-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  rebuild-cache:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # auto-commit lang/*.json back to develop
+
+    steps:
+      - name: Checkout develop
+        uses: actions/checkout@v4
+        with:
+          ref: develop
+          # Need full history so the auto-commit doesn't fail when the
+          # cache job runs minutes after the trigger push (GH default
+          # fetch-depth=1 sometimes diverges from origin/develop after a
+          # quick follow-up push).
+          fetch-depth: 0
+          # Use a PAT (or default GITHUB_TOKEN if branch protections allow
+          # it) so the push back to develop actually fires later steps
+          # (workflow runs from auto-commits) if you ever need them.
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install googletrans
+        run: |
+          python -m pip install --upgrade pip
+          # 4.0.0-rc1 is the same pin that build_translation_cache.py
+          # was written against. Bump in lockstep with the script.
+          pip install 'googletrans==4.0.0-rc1' 'httpx==0.13.3' 'httpcore==0.9.1' 'h11==0.9.0'
+
+      - name: Regenerate lang/*.json
+        run: |
+          REFRESH_FLAG=""
+          if [[ "${{ github.event.inputs.refresh }}" == "true" ]]; then
+            REFRESH_FLAG="--refresh"
+          fi
+          # Extra files outside scripts/ that also contain translate "..."
+          # calls. Keep this list in sync with the `paths` trigger above.
+          python .github/scripts/build_translation_cache.py \
+            --scripts-dir scripts \
+            --extra-file menu \
+            --extra-file install_proxmenux.sh \
+            --extra-file install_proxmenux_beta.sh \
+            --output-dir lang \
+            --provider googletrans \
+            $REFRESH_FLAG
+
+      - name: Commit + push if changed
+        run: |
+          if git diff --quiet -- lang/; then
+            echo "No translation changes — skipping commit."
+            exit 0
+          fi
+          git config user.name  "ProxMenuxBot"
+          git config user.email "bot@proxmenux.local"
+          git add lang/
+          git commit -m "chore(lang): auto-rebuild translation cache
+
+          Source: ${GITHUB_SHA::7}
+          Triggered by: ${{ github.event_name }}"
+          # Rebase-and-retry against develop: between the initial
+          # checkout and this push another workflow (e.g.
+          # build-i18n-messages auto-commit) or a manual push can land
+          # on develop first, and a naked push fails with
+          # non-fast-forward — losing the freshly built cache commit.
+          # Paths don't overlap with the other workflows, and
+          # same-branch collisions between two cache runs are already
+          # blocked by the concurrency group.
+          for attempt in 1 2 3 4 5; do
+            git fetch origin develop
+            if git rebase origin/develop && git push origin develop; then
+              echo "push succeeded on attempt ${attempt}"
+              exit 0
+            fi
+            echo "push attempt ${attempt} failed, retrying..."
+            git rebase --abort 2>/dev/null || true
+            sleep $(( attempt * 3 ))
+          done
+          echo "push failed after 5 attempts"
+          exit 1

.github/workflows/build-web-docs-i18n.yml

@@ -0,0 +1,119 @@
+name: Build web documentation translations
+
+on:
+  push:
+    branches: [develop]
+    paths:
+      - 'web/messages/en/*.json'
+      - 'web/messages/en/**/*.json'
+      - '.github/scripts/build_web_docs_i18n.py'
+      - '.github/scripts/build_translation_cache.py'
+      - '.github/workflows/build-web-docs-i18n.yml'
+  workflow_dispatch:
+    inputs:
+      languages:
+        description: 'Comma-separated locales'
+        default: 'es,de,fr,it,pt,sk,sv'
+      section:
+        description: 'File or directory below web/messages/en'
+        default: '.'
+      max_files:
+        description: 'Maximum pending files per locale; 0 means all'
+        default: '0'
+      refresh:
+        description: 'Overwrite existing translations in the selected scope'
+        type: boolean
+        default: false
+      dry_run:
+        description: 'Report pending coverage without writing files'
+        type: boolean
+        default: false
+
+concurrency:
+  group: build-web-docs-i18n-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  translate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    timeout-minutes: 120
+
+    steps:
+      - name: Checkout develop
+        uses: actions/checkout@v4
+        with:
+          ref: develop
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install translation provider
+        run: |
+          python -m pip install --upgrade pip
+          pip install 'googletrans==4.0.0-rc1' 'httpx==0.13.3' 'httpcore==0.9.1' 'h11==0.9.0'
+
+      - name: Build missing translations
+        shell: bash
+        run: |
+          LANGUAGES="${{ github.event.inputs.languages }}"
+          LANGUAGES="${LANGUAGES:-es,de,fr,it,pt,sk,sv}"
+          SECTION="${{ github.event.inputs.section }}"
+          SECTION="${SECTION:-.}"
+          MAX_FILES="${{ github.event.inputs.max_files }}"
+          MAX_FILES="${MAX_FILES:-0}"
+
+          EXTRA_ARGS=()
+          if [[ "${{ github.event.inputs.refresh }}" == "true" ]]; then
+            EXTRA_ARGS+=(--refresh)
+          fi
+          if [[ "${{ github.event.inputs.dry_run }}" == "true" ]]; then
+            EXTRA_ARGS+=(--dry-run)
+          fi
+
+          python .github/scripts/build_web_docs_i18n.py \
+            --source-dir web/messages/en \
+            --messages-dir web/messages \
+            --languages "$LANGUAGES" \
+            --section "$SECTION" \
+            --max-files "$MAX_FILES" \
+            --provider googletrans \
+            --workers 4 \
+            "${EXTRA_ARGS[@]}"
+
+      - name: Validate catalogs
+        run: |
+          python .github/scripts/build_web_docs_i18n.py \
+            --source-dir web/messages/en \
+            --messages-dir web/messages \
+            --languages "${{ github.event.inputs.languages || 'es,de,fr,it,pt,sk,sv' }}" \
+            --check
+
+      - name: Commit and push changes
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        shell: bash
+        run: |
+          if git diff --quiet -- web/messages/; then
+            echo "No documentation translations changed."
+            exit 0
+          fi
+
+          git config user.name "ProxMenuxBot"
+          git config user.email "bot@proxmenux.local"
+          git add web/messages/
+          git commit -m "docs(i18n): update documentation translations"
+
+          for attempt in 1 2 3 4 5; do
+            git fetch origin develop
+            if git rebase origin/develop && git push origin develop; then
+              exit 0
+            fi
+            git rebase --abort 2>/dev/null || true
+            sleep $((attempt * 3))
+          done
+          exit 1

.github/workflows/deploy.yml

@@ -6,7 +6,7 @@ on:
       - "main"
     paths:
       - "web/**"
-      - "guides/**"
+      - "lang/**"
       - "CHANGELOG.md"
   workflow_dispatch:
 
@@ -24,22 +24,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: 'npm'
-          cache-dependency-path: 'web/package.json'
+          cache-dependency-path: 'web/package-lock.json'
 
       - name: Setup Pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@v6
 
-      - name: Install dependencies and generate lock file
+      - name: Install dependencies
         run: |
           cd web
-          npm install
+          npm ci
 
       - name: Build with Next.js
         run: |
@@ -47,7 +47,7 @@ jobs:
           npm run build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: web/out
 
@@ -60,4 +60,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/repo-growth.yml

@@ -0,0 +1,27 @@
+name: Update project growth
+
+on:
+  schedule:
+    - cron: "17 4 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: repo-growth
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: MacRimi/repo-growth@v1
+        with:
+          title: ProxMenux growth
+          output: images/project-growth.svg
+          history: .github/repo-growth/history.json
+          metrics: stars,forks,clones
+          traffic-token: ${{ secrets.REPO_GROWTH_TRAFFIC_TOKEN }}
+          layout: dashboard

.github/workflows/update-app-tracking-hints.yml

@@ -0,0 +1,164 @@
+name: Update App Tracking Hints
+
+on:
+  # Manual trigger from the Actions UI
+  workflow_dispatch:
+
+  # Re-merge whenever the generator, workflow, or the maintainer-
+  # curated runtime overrides change. `runtime_verified_overrides.json`
+  # is the file to edit when a real LXC reveals a canonical path the
+  # community-scripts helper doesn't ship (legacy /app/package.json,
+  # /opt/vaultwarden/bin/vaultwarden, etc.) — the generator folds it
+  # into the operational catalog every run.
+  push:
+    branches: [main]
+    paths:
+      - ".github/scripts/generate_app_tracking_catalog.py"
+      - ".github/workflows/update-app-tracking-hints.yml"
+      - "json/runtime_verified_overrides.json"
+
+  # Regen every 6h — picks up new community-scripts LXC apps and
+  # detector-relevant script edits without needing a manual trigger.
+  schedule:
+    - cron: "0 */6 * * *"
+
+jobs:
+  update-hints:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: ⬇️ Checkout the repository
+        uses: actions/checkout@v6
+
+      - name: 🐍 Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+
+      - name: ⚙️ Generate app_tracking_hints.generated.json (intermediate)
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # The generator writes 4 files; only `.generated.json` is
+        # consumed downstream by the merge step. The v2 catalog and
+        # per-app audit are useful for local review but not kept in
+        # the repo — written under /tmp so they never appear as
+        # dirty files here.
+        #
+        # `--runtime-overrides` folds real-CT evidence into the
+        # operational hints (canonical paths, cross-method fallbacks
+        # per app) so the runtime doesn't get fed helper-marker
+        # false-positives. Modern helper markers are included as their
+        # official version contract; runtime keeps them distinguishable from
+        # canonical package/binary/manual detectors for legacy compatibility.
+        run: |
+          python .github/scripts/generate_app_tracking_catalog.py \
+            --helpers-cache json/helpers_cache.json \
+            --existing json/app_tracking_hints.json \
+            --runtime-overrides json/runtime_verified_overrides.json \
+            --include-helper-markers \
+            --output json/app_tracking_hints.generated.json \
+            --v2-output /tmp/app_tracking_catalog.v2.json \
+            --audit-output /tmp/app_tracking_hints.audit.json
+
+      - name: 🧬 Smart-merge generated into app_tracking_hints.json
+        # Single source of truth: `app_tracking_hints.json` is the ONE
+        # file. It contains 3 kinds of entries:
+        #   1. Auto-verified from community-scripts (the generator
+        #      manages every "generator-owned" field on these).
+        #   2. User-edited additions to those entries — extra fields
+        #      the generator doesn't touch (default_ports,
+        #      file_fallbacks, custom logo overrides…).
+        #   3. User-only entries the generator can't verify (Docker,
+        #      AdGuard, Pi-hole, WireGuard, …) — left alone.
+        # Merge rule: for slugs the generator produces, refresh only
+        # the whitelisted fields; preserve everything else. For slugs
+        # NOT in the generator's output, keep the existing entry
+        # untouched.
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          GEN = Path("json/app_tracking_hints.generated.json")
+          OUT = Path("json/app_tracking_hints.json")
+
+          # Fields owned by the generator — refreshed on every run.
+          # These are all populated deterministically by the generator
+          # (the audit script folds `runtime_verified_overrides.json`
+          # in as it runs), so a local hand-edit for a generator-known
+          # slug would get overwritten on the next tick. To add a new
+          # canonical path or a cross-method fallback for a slug the
+          # generator already knows, edit `runtime_verified_overrides
+          # .json` — that file IS the maintainer-controlled input.
+          #
+          # For user-only slugs (Docker, WireGuard, Pi-hole and any
+          # other entry not in the generator's output) EVERY field is
+          # preserved verbatim by the merge below — the whitelist only
+          # governs generator-covered slugs.
+          GENERATOR_FIELDS = {
+              "installed_via", "package", "file_path", "file_regex",
+              "binary_path", "binary_args", "python_path", "distribution",
+              "container_name", "label", "command_argv", "installed_version",
+              "repo", "github_source", "tag_regex", "installed_regex",
+              # Upstream source discriminator + per-type fields
+              # (http_json + docker_hub). Kept in the whitelist so a
+              # curated entry in runtime_verified_overrides.json can
+              # supply them and the smart merge won't drop them on the
+              # next regeneration.
+              "upstream_type", "upstream_url", "upstream_json_path",
+              "docker_image",
+              "logo", "website",
+              "default_ports", "file_fallbacks", "alt_detectors",
+          }
+
+          generated = json.loads(GEN.read_text(encoding="utf-8"))
+          existing = {}
+          if OUT.is_file():
+              try:
+                  existing = json.loads(OUT.read_text(encoding="utf-8"))
+                  if not isinstance(existing, dict):
+                      existing = {}
+              except json.JSONDecodeError:
+                  existing = {}
+
+          merged = {}
+          for slug, gen_entry in generated.items():
+              base = dict(existing.get(slug) or {})
+              # Refresh generator-owned fields (add/update).
+              for k, v in gen_entry.items():
+                  if k in GENERATOR_FIELDS:
+                      base[k] = v
+              # Drop generator-owned fields that the generator no
+              # longer emits for this slug (e.g. path renamed away).
+              for k in list(base):
+                  if k in GENERATOR_FIELDS and k not in gen_entry:
+                      del base[k]
+              merged[slug] = base
+          # Preserve user-only entries the generator can't verify.
+          for slug, entry in existing.items():
+              if slug not in generated and isinstance(entry, dict):
+                  merged[slug] = dict(entry)
+
+          OUT.write_text(json.dumps(merged, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+
+          added = sorted(set(generated) - set(existing))
+          removed = sorted(set(existing) - set(generated) - {s for s, e in existing.items() if not (
+              set(e.keys()) - GENERATOR_FIELDS
+          )})
+          print(f"merged: {len(merged)} entries "
+                f"(generated={len(generated)}, existing={len(existing)})")
+          if added:
+              print(f"  new from generator: {len(added)}")
+          # Clean up the intermediate file so it doesn't get committed.
+          GEN.unlink()
+          PY
+
+      - name: 📤 Commit + push if changed
+        run: |
+          git config user.name "ProxMenuxBot"
+          git config user.email "bot@proxmenux.local"
+          git add json/app_tracking_hints.json
+          git diff --cached --quiet || git commit -m "Update app tracking hints"
+          git push

.github/workflows/update-helpers-cache.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: ⬇️ Checkout the repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: 🐍 Set up Python
         uses: actions/setup-python@v4

.gitignore

@@ -6,6 +6,14 @@ web/out/
 web/node_modules/
 node_modules/
 
+# Local-only — accidental pagefind install at project root.
+# Pagefind is declared and installed from web/package.json; the
+# CI build (.github/workflows/deploy.yml) only runs
+# `cd web && npm install`, so a root-level package.json/lock is
+# never consumed and just adds noise. Keep them ignored.
+/package.json
+/package-lock.json
+
 # Logs
 web/*.log
 *.log
@@ -33,6 +41,15 @@ Thumbs.db
 /web/.next
 /web/out
 
+# Build artifacts generated by web's prebuild + build scripts.
+# `prebuild` runs `sync:scripts` which rsyncs ../scripts/ into
+# public/scripts/. `build` runs pagefind --site out which writes the
+# search index into public/pagefind/. Both are regenerated fresh by
+# the GitHub Pages CI on every deploy; committing them would just
+# bloat the repo and produce constant noise in `git status`.
+/web/public/pagefind/
+/web/public/scripts/
+
 # Cache
 .cache
 /web/.cache

AppImage/ProxMenux-Monitor.AppImage.sha256

@@ -1 +1 @@
-f35de512c1a19843d15a9a3263a5104759d041ffc9d01249450babe0b0c3f889  ProxMenux-1.0.1.AppImage
+6449a4e1126f428765d0bb9459342a079d2bc1d4c372b676d579f1c48a2d7d4a  ProxMenux-1.2.5.AppImage

AppImage/README.md

@@ -27,19 +27,97 @@ A modern, responsive dashboard for monitoring Proxmox VE systems built with Next
 
 ## Overview
 
-**ProxMenux Monitor** is a comprehensive, real-time monitoring dashboard for Proxmox VE environments. Built with modern web technologies, it provides an intuitive interface to monitor system resources, virtual machines, containers, storage, network traffic, and system logs.
+**ProxMenux Monitor** is a comprehensive, real-time monitoring dashboard for Proxmox VE environments. Built with modern web technologies, it provides an intuitive interface to monitor system resources, virtual machines, containers, storage, network traffic, backups, health status and system logs — all from a single browser tab.
 
 The application runs as a standalone AppImage on your Proxmox server and serves a web interface accessible from any device on your network.
 
+**Full documentation:** [proxmenux.com/docs/monitor](https://proxmenux.com/docs/monitor) — per-feature walkthroughs, API reference and integration guides.
+
 
 ## Screenshots
 
-Get a quick overview of ProxMenux Monitor's main features:
+A tour of the Monitor's main areas. See the [public documentation](https://proxmenux.com/docs/monitor) for the full walkthrough.
+
+### Dashboard overview
 
 <p align="center">
-  <img src="public/images/onboarding/imagen1.png" alt="Overview Dashboard" width="800"/>
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/dashboard-home.png" alt="Dashboard home" width="900"/>
   <br/>
-  <em>System Overview - Monitor CPU, memory, temperature, and uptime in real-time</em>
+  <em>Real-time CPU, memory, temperature, storage and network activity on one glance-optimised page.</em>
+</p>
+
+### Backup & Restore
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/images/docs/backup-restore/scheduled-backup-monitor.png" alt="Scheduled backup jobs" width="900"/>
+  <br/>
+  <em>Integrated host backup & restore — Local, PBS or Borg destinations; own timer or attached to a PVE vzdump job with live-inherited retention; PBS encryption with paired recovery blobs; direction-aware cross-kernel restore.</em>
+</p>
+
+### Storage & SMART
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/storage-top-row.png" alt="Storage top row" width="900"/>
+  <br/>
+  <em>Per-disk cards with capacity palette shared across Storage and Backups. USB-NVMe enclosures (ASMedia / JMicron / Realtek) show the drive's real identity and temperature, not the bridge.</em>
+</p>
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/disk-modal-smart.png" alt="Disk SMART modal" width="900"/>
+  <br/>
+  <em>Per-disk detail modal — SMART attributes, temperature history, observations and downloadable PDF report.</em>
+</p>
+
+### Network — live topology
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/network-flow-overview.png" alt="Network Flow diagram" width="900"/>
+  <br/>
+  <em>Network Flow — live view of NICs → host → bridges → guests with animated rx / tx pulses on every link. Bridges without active guests are hidden.</em>
+</p>
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/network-latency-historical.png" alt="Network latency historical" width="900"/>
+  <br/>
+  <em>Latency modal — historical view and real-time ping test against Gateway / Cloudflare / Google, with a downloadable PDF report.</em>
+</p>
+
+### Virtual machines & LXCs
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/vms-top-row.png" alt="VMs & LXCs overview" width="900"/>
+  <br/>
+  <em>Inventory of running VMs and containers with resource usage and per-guest controls.</em>
+</p>
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/vms-modal-status.png" alt="VM detail modal — status" width="900"/>
+  <br/>
+  <em>Per-guest modal with status, backups, mounts and (for LXC) apt / apk / community-scripts update inventory.</em>
+</p>
+
+### Health Monitor
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/health-monitor.png" alt="Health Monitor" width="900"/>
+  <br/>
+  <em>Ten categories of proactive health checks with hysteresis, per-error dismiss (24 h / 7 d / permanent) and an Active Suppressions panel to revoke.</em>
+</p>
+
+### System overview — top processes
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/system-overview-top-processes.png" alt="Top processes" width="900"/>
+  <br/>
+  <em>Per-process CPU / memory / I/O sorted by consumer, with a click-through detail modal.</em>
+</p>
+
+### Mobile
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/mobile-home.png" alt="Mobile responsive layout" width="360"/>
+  <br/>
+  <em>Fully responsive — every panel adapts to phone and tablet layouts.</em>
 </p>
 
 
@@ -47,18 +125,21 @@ Get a quick overview of ProxMenux Monitor's main features:
 
 ## Features
 
-- **System Overview**: Real-time monitoring of CPU, memory, temperature, and system uptime
-- **Storage Management**: Visual representation of storage distribution, disk health, and SMART data
-- **Network Monitoring**: Network interface statistics, real-time traffic graphs, and bandwidth usage
-- **Virtual Machines & LXC**: Comprehensive view of all VMs and containers with resource usage and controls
-- **Hardware Information**: Detailed hardware specifications including CPU, GPU, PCIe devices, and disks
-- **System Logs**: Real-time system log monitoring with filtering and search capabilities
-- **Health Monitoring**: Proactive system health checks with persistent error tracking
-- **Authentication & 2FA**: Optional password protection with TOTP-based two-factor authentication
-- **RESTful API**: Complete API access for integrations with Homepage, Home Assistant, and custom dashboards
-- **Dark/Light Theme**: Toggle between themes with Proxmox-inspired design
-- **Responsive Design**: Works seamlessly on desktop, tablet, and mobile devices
-- **Release Notes**: Automatic notifications of new features and improvements
+- **Host Backup & Restore** — integrated section covering Local, PBS and Borg destinations; schedule with a systemd timer or attach to an existing PVE vzdump job; PBS encryption with paired recovery blobs; direction-aware cross-kernel restore with kernel-agnostic hydration (IOMMU / VFIO / GRUB), cascade-safe package replay, and NIC auto-remap by MAC after a motherboard swap
+- **System Overview** — real-time CPU / memory / temperature / uptime with a per-process drill-down (Top Processes view) and click-through detail modal
+- **Storage & SMART** — per-disk cards in a responsive grid; temperature history, SMART attributes and a downloadable PDF SMART report per drive. USB-NVMe bridges (ASMedia / JMicron / Realtek) show the real drive's identity and temperature instead of the enclosure's
+- **Network** — live topology (Network Flow) with animated rx / tx pulses, per-interface RRD charts, latency modal against Gateway / Cloudflare / Google with a downloadable PDF report
+- **Virtual Machines & LXCs** — inventory, per-guest metrics and controls, per-LXC update inventory (apt / apk / community-scripts), backup state, mount inspection
+- **Hardware** — CPU / GPU / PCIe / disks / NICs, with correct SSD vs HDD classification even behind USB-SATA bridges
+- **System Logs** — journalctl with severity / since / free-text filters and a download-as-text action
+- **Health Monitor** — ten categories of proactive checks with hysteresis and configurable thresholds; per-error dismiss (24 h / 7 d / permanent) and an Active Suppressions panel to revoke
+- **Notifications** — five channels (Telegram, Discord, Gotify, Email, Apprise for ~80 endpoints), per-event toggles, Quiet Hours, Daily Digest, optional AI enrichment (Groq / OpenAI / Ollama / Gemini / Anthropic / OpenRouter)
+- **Authentication & 2FA** — optional password protection with TOTP-based two-factor authentication and long-lived API tokens (365 days) for integrations
+- **RESTful API** — complete access with JWT auth; ready-made recipes for Homepage, Home Assistant and custom dashboards; Prometheus scrape endpoint
+- **Reports (PDF)** — SMART report per-disk and Network Latency report per-target, ready to send to a vendor or an ISP
+- **Dark / Light Theme** — Proxmox-inspired palette with live switch
+- **Responsive Design** — desktop, tablet and mobile layouts
+- **Release Notes** — automatic notification of new features on each Monitor upgrade
 
 ## Technology Stack
 
@@ -106,7 +187,7 @@ On first launch, you'll be presented with three options:
 2. **Enable 2FA** - Add TOTP-based two-factor authentication for enhanced security
 3. **Skip** - Continue without authentication (not recommended for production environments)
 
-![Authentication Setup](AppImage/public/images/docs/auth-setup.png)
+![Authentication Setup](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/auth-setup.png)
 
 ### Two-Factor Authentication (2FA)
 
@@ -118,7 +199,21 @@ After setting up your password, you can enable 2FA using any TOTP authenticator
 4. Enter the 6-digit code to verify
 5. Save your backup codes in a secure location
 
-![2FA Setup](AppImage/public/images/docs/2fa-setup.png)
+![2FA Setup](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/2fa-setup.png)
+
+### Embedding in Trusted Iframes
+
+By default, ProxMenux Monitor blocks embedding in iframes with `frame-ancestors 'none'` and `X-Frame-Options: DENY`.
+
+If you run a trusted local portal or monitoring page and need to embed the Monitor, set `PROXMENUX_ALLOWED_FRAME_ANCESTORS` to the exact parent origins that may frame it:
+
+```bash
+PROXMENUX_ALLOWED_FRAME_ANCESTORS="https://portal.example.com http://raspberrypi.local:8080"
+```
+
+Only exact `http://` or `https://` origins are accepted. Paths, wildcards, broad schemes, credentials, and malformed values are ignored. When this setting is present, the Monitor sends a matching CSP `frame-ancestors` allowlist and omits `X-Frame-Options`, because that legacy header cannot express multiple allowed parents.
+
+`ALLOWED_FRAME_ANCESTORS` is also accepted as a compatibility alias when `PROXMENUX_ALLOWED_FRAME_ANCESTORS` is not set.
 
 ### Security Best Practices for API Tokens
 
@@ -254,7 +349,7 @@ The easiest way to generate an API token is through the ProxMenux Monitor web in
 6. Click **Generate Token**
 7. Copy the token immediately - it will not be shown again
 
-![Generate API Token](AppImage/public/images/docs/generate-api-token.png)
+![Generate API Token](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/api-tokens.png)
 
 The token will be valid for **365 days** (1 year) and can be used for integrations with Homepage, Home Assistant, or any custom application.
 
@@ -643,8 +738,6 @@ Finally, reference the secret in your `services.yaml`:
           format: bytes
 ```
 
-![Homepage Integration Example](AppImage/public/images/docs/homepage-integration.png)
-
 ### Home Assistant Integration
 
 [Home Assistant](https://www.home-assistant.io/) is an open-source home automation platform.
@@ -727,7 +820,13 @@ entities:
     icon: mdi:clock-outline
 ```
 
-![Home Assistant Integration Example](AppImage/public/images/docs/homeassistant-integration.png)
+---
+
+## License
+
+This project is licensed under the **GNU General Public License, version 3 (GPL-3.0)**.
+
+You are free to use, study, share and modify the software under the terms of the licence. Any distributed derivative work must be licensed under the same terms and include the full source code — see the [full licence text](https://www.gnu.org/licenses/gpl-3.0.html) or the [`LICENSE`](https://github.com/MacRimi/ProxMenux/blob/main/LICENSE) file at the repository root.
 
 
 

AppImage/app/globals.css

@@ -163,3 +163,15 @@
 .xterm-rows {
   margin: 0 !important;
 }
+
+/* ===================== */
+/* Progress Animations   */
+/* ===================== */
+@keyframes indeterminate {
+  0% {
+    transform: translateX(-100%);
+  }
+  100% {
+    transform: translateX(400%);
+  }
+}

AppImage/app/layout.tsx

@@ -1,8 +1,11 @@
 import type React from "react"
-import type { Metadata } from "next"
+import type { Metadata, Viewport } from "next"
 import { GeistSans } from "geist/font/sans"
 import { GeistMono } from "geist/font/mono"
 import { ThemeProvider } from "../components/theme-provider"
+import { PwaRegister } from "../components/pwa-register"
+import { PwaInstallPrompt } from "../components/pwa-install-prompt"
+import { I18nProvider } from "../lib/i18n/provider"
 import { Suspense } from "react"
 import "./globals.css"
 
@@ -20,7 +23,13 @@ export const metadata: Metadata = {
     shortcut: "/favicon.ico",
     apple: [{ url: "/apple-touch-icon.png", sizes: "180x180", type: "image/png" }],
   },
-  viewport: "width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no",
+}
+
+export const viewport: Viewport = {
+  width: "device-width",
+  initialScale: 1,
+  maximumScale: 1,
+  userScalable: false,
   themeColor: [
     { media: "(prefers-color-scheme: light)", color: "#ffffff" },
     { media: "(prefers-color-scheme: dark)", color: "#2b2f36" },
@@ -35,11 +44,15 @@ export default function RootLayout({
   return (
     <html lang="en" suppressHydrationWarning>
       <body className={`${GeistSans.variable} ${GeistMono.variable} antialiased bg-background text-foreground`}>
-        <Suspense fallback={<div>Loading...</div>}>
-          <ThemeProvider attribute="class" defaultTheme="dark" enableSystem disableTransitionOnChange>
-            {children}
-          </ThemeProvider>
+        <Suspense fallback={null}>
+          <I18nProvider>
+            <ThemeProvider attribute="class" defaultTheme="dark" enableSystem disableTransitionOnChange>
+              {children}
+            </ThemeProvider>
+            <PwaInstallPrompt />
+          </I18nProvider>
         </Suspense>
+        <PwaRegister />
       </body>
     </html>
   )

AppImage/app/page.tsx

@@ -5,8 +5,10 @@ import { ProxmoxDashboard } from "../components/proxmox-dashboard"
 import { Login } from "../components/login"
 import { AuthSetup } from "../components/auth-setup"
 import { getApiUrl } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
 
 export default function Home() {
+  const t = useT()
   const [authStatus, setAuthStatus] = useState<{
     loading: boolean
     authEnabled: boolean
@@ -29,20 +31,65 @@ export default function Home() {
       const response = await fetch(getApiUrl("/api/auth/status"), {
         headers: token ? { Authorization: `Bearer ${token}` } : {},
       })
+
+      // 401 here means the token is present but invalid — typically signed
+      // under a previous jwt_secret (rotated on AppImage upgrade or fresh
+      // install). If we let this fall into the catch below, the dashboard
+      // would render and every authenticated component would fire its own
+      // 401 in parallel, flooding the backend logs and looping reloads.
+      // Drop the dead token and force the Login screen instead.
+      if (response.status === 401) {
+        try {
+          localStorage.removeItem("proxmenux-auth-token")
+        } catch {
+          // private browsing — best-effort
+        }
+        setAuthStatus({
+          loading: false,
+          authEnabled: true,
+          authConfigured: true,
+          authenticated: false,
+        })
+        return
+      }
+
+      // Check if response is valid JSON before parsing
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status}`)
+      }
+
+      const contentType = response.headers.get("content-type")
+      if (!contentType || !contentType.includes("application/json")) {
+        throw new Error("Response is not JSON")
+      }
+
       const data = await response.json()
 
-      console.log("[v0] Auth status:", data)
-
       const authenticated = data.auth_enabled ? data.authenticated : true
 
+      // Clear the 401 cascade-prevention flag when we successfully end
+      // up in the authenticated state. The flag is meant to dedupe a
+      // burst of 401s during a single page load; once we've confirmed
+      // the user is in, a future 401 (token rotation, restart, etc.)
+      // should be allowed to reload again. Without this, a stale flag
+      // can prevent the post-2FA dashboard from recovering from any
+      // transient 401 and leaves the UI blocked.
+      if (authenticated) {
+        try {
+          sessionStorage.removeItem("proxmenux-auth-401-handled")
+        } catch {
+          // private browsing — best-effort
+        }
+      }
+
       setAuthStatus({
         loading: false,
         authEnabled: data.auth_enabled,
         authConfigured: data.auth_configured,
         authenticated,
       })
-    } catch (error) {
-      console.error("[v0] Failed to check auth status:", error)
+    } catch {
+      // API not available - assume no auth configured (silent fail, no console error)
       setAuthStatus({
         loading: false,
         authEnabled: false,
@@ -63,9 +110,13 @@ export default function Home() {
   if (authStatus.loading) {
     return (
       <div className="min-h-screen bg-background flex items-center justify-center">
-        <div className="text-center space-y-4">
-          <div className="animate-spin rounded-full h-12 w-12 border-b-2 border-primary mx-auto"></div>
-          <p className="text-muted-foreground">Loading...</p>
+        <div className="flex flex-col items-center gap-4">
+          <div className="relative">
+            <div className="h-12 w-12 rounded-full border-2 border-muted"></div>
+            <div className="absolute inset-0 h-12 w-12 rounded-full border-2 border-transparent border-t-primary animate-spin"></div>
+          </div>
+          <div className="text-sm font-medium text-foreground">{t("app.loading")}</div>
+          <p className="text-xs text-muted-foreground">{t("app.connecting")}</p>
         </div>
       </div>
     )

AppImage/components/about.tsx

@@ -0,0 +1,234 @@
+"use client"
+
+import Image from "next/image"
+import {
+  Github,
+  Heart,
+  BookOpen,
+  MessageSquare,
+  Bug,
+  Sparkles,
+  Scale,
+  ExternalLink,
+} from "lucide-react"
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card"
+import { APP_VERSION } from "./release-notes-modal"
+import { useT } from "../lib/i18n/provider"
+
+// Issue #191: a dedicated About tab. Centralises project metadata
+// (version, license, author) and every external link the project
+// already exposes — GitHub, docs, donation. Replaces the lone
+// "Support and contribute to the project" footer link with a proper
+// information surface that's easy to extend with new social channels
+// without re-cluttering the dashboard footer.
+
+interface LinkRow {
+  labelKey: string
+  descriptionKey: string
+  href: string
+  Icon: React.ComponentType<{ className?: string }>
+  accent?: keyof typeof ACCENT_CLASSES
+}
+
+// Tailwind only emits classes that appear as literal strings in the
+// source. A dynamic `bg-${accent}/10` template does not survive the
+// purge step, so each accent maps to a fully-spelled class pair below.
+const ACCENT_CLASSES = {
+  gray:   "bg-gray-500/10 text-gray-400",
+  blue:   "bg-blue-500/10 text-blue-500",
+  purple: "bg-purple-500/10 text-purple-400",
+  red:    "bg-red-500/10 text-red-500",
+  pink:   "bg-pink-500/10 text-pink-500",
+} as const
+
+const PROJECT_LINKS: LinkRow[] = [
+  {
+    labelKey: "about.links.repository.label",
+    descriptionKey: "about.links.repository.description",
+    href: "https://github.com/MacRimi/ProxMenux",
+    Icon: Github,
+    accent: "gray",
+  },
+  {
+    labelKey: "about.links.documentation.label",
+    descriptionKey: "about.links.documentation.description",
+    href: "https://proxmenux.com",
+    Icon: BookOpen,
+    accent: "blue",
+  },
+  {
+    labelKey: "about.links.discussions.label",
+    descriptionKey: "about.links.discussions.description",
+    href: "https://github.com/MacRimi/ProxMenux/discussions",
+    Icon: MessageSquare,
+    accent: "purple",
+  },
+  {
+    labelKey: "about.links.issues.label",
+    descriptionKey: "about.links.issues.description",
+    href: "https://github.com/MacRimi/ProxMenux/issues",
+    Icon: Bug,
+    accent: "red",
+  },
+]
+
+const SUPPORT_LINKS: LinkRow[] = [
+  {
+    labelKey: "about.links.support.label",
+    descriptionKey: "about.links.support.description",
+    href: "https://ko-fi.com/macrimi",
+    Icon: Heart,
+    accent: "pink",
+  },
+]
+
+function LinkCard({ row }: { row: LinkRow }) {
+  const t = useT()
+  const accentClass = ACCENT_CLASSES[row.accent ?? "blue"]
+  // Style mirrors the PCI Devices cards in the Hardware tab: subtle
+  // translucent background by default, slightly lighter on hover, no
+  // accent-coloured borders or text colour changes — keeps the look
+  // consistent with the rest of the project.
+  return (
+    <a
+      href={row.href}
+      target="_blank"
+      rel="noopener noreferrer"
+      className="cursor-pointer flex items-start gap-3 rounded-lg border border-white/10 sm:border-border bg-white/5 sm:bg-card sm:hover:bg-white/5 p-3 transition-colors"
+    >
+      <span
+        className={`inline-flex h-9 w-9 flex-shrink-0 items-center justify-center rounded-md ${accentClass}`}
+      >
+        <row.Icon className="h-4 w-4" />
+      </span>
+      <div className="min-w-0 flex-1">
+        <div className="flex items-center gap-1.5 text-sm font-medium text-foreground">
+          {t(row.labelKey)}
+          <ExternalLink className="h-3 w-3 text-muted-foreground" />
+        </div>
+        <p className="text-xs text-muted-foreground mt-0.5 leading-snug">{t(row.descriptionKey)}</p>
+      </div>
+    </a>
+  )
+}
+
+export function About() {
+  const t = useT()
+  return (
+    <div className="space-y-4 md:space-y-6">
+      {/* Hero — logo, name, version, one-line description. */}
+      <Card>
+        <CardContent className="pt-6 pb-6">
+          <div className="flex flex-col md:flex-row items-center md:items-start gap-4 md:gap-6">
+            <div className="relative w-24 h-24 md:w-28 md:h-28 flex-shrink-0">
+              <Image
+                src="/images/proxmenux-logo.png"
+                alt={t("about.logoAlt")}
+                fill
+                priority
+                className="object-contain"
+              />
+            </div>
+            <div className="text-center md:text-left flex-1 min-w-0">
+              <h2 className="text-2xl md:text-3xl font-semibold text-foreground">
+                ProxMenux Monitor
+              </h2>
+              <p className="text-sm text-muted-foreground mt-1">
+                {t("about.heroDescription")}
+              </p>
+              <div className="flex flex-wrap items-center justify-center md:justify-start gap-2 mt-3">
+                <span className="inline-flex items-center gap-1.5 rounded-md bg-blue-500/10 text-blue-500 border border-blue-500/30 px-2.5 py-1 text-xs font-mono">
+                  <Sparkles className="h-3 w-3" />
+                  v{APP_VERSION}
+                </span>
+                {/* Beta versions surface their pre-release notes on the
+                    GitHub Releases page (where each beta is tagged + signed);
+                    stable versions point at the canonical web changelog
+                    which only carries shipped releases. Detection: the
+                    APP_VERSION string carries a "-beta" / "-rc" /
+                    "-alpha" suffix for any non-stable build. */}
+                {(() => {
+                  const isPrerelease = /-(beta|rc|alpha)/i.test(APP_VERSION)
+                  const href = isPrerelease
+                    ? "https://github.com/MacRimi/ProxMenux/releases"
+                    : "https://proxmenux.com/en/changelog"
+                  const label = isPrerelease ? t("about.releaseNotes") : t("about.changelog")
+                  return (
+                    <a
+                      href={href}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      className="inline-flex items-center gap-1.5 rounded-md bg-muted hover:bg-muted/70 transition-colors text-foreground border border-border px-2.5 py-1 text-xs"
+                    >
+                      {label}
+                      <ExternalLink className="h-3 w-3" />
+                    </a>
+                  )
+                })()}
+              </div>
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* Project links — GitHub, docs, discussions, bug tracker. */}
+      <Card>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2 text-base">
+            <Github className="h-4 w-4 text-muted-foreground" />
+            {t("about.project.title")}
+          </CardTitle>
+          <CardDescription>{t("about.project.description")}</CardDescription>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
+            {PROJECT_LINKS.map(row => (
+              <LinkCard key={row.href} row={row} />
+            ))}
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* Support + License combined — donation link and licensing
+          info in one card. The previous layout had a separate "Author"
+          block that has been removed by request. */}
+      <Card>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2 text-base">
+            <Heart className="h-4 w-4 text-pink-500" />
+            {t("about.support.title")}
+          </CardTitle>
+          <CardDescription>
+            {t("about.support.description")}
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-1 gap-2">
+            {SUPPORT_LINKS.map(row => (
+              <LinkCard key={row.href} row={row} />
+            ))}
+            <a
+              href="https://github.com/MacRimi/ProxMenux/blob/main/LICENSE"
+              target="_blank"
+              rel="noopener noreferrer"
+              className="cursor-pointer flex items-start gap-3 rounded-lg border border-white/10 sm:border-border bg-white/5 sm:bg-card sm:hover:bg-white/5 p-3 transition-colors"
+            >
+              <span className="inline-flex h-9 w-9 flex-shrink-0 items-center justify-center rounded-md bg-gray-500/10 text-gray-400">
+                <Scale className="h-4 w-4" />
+              </span>
+              <div className="min-w-0 flex-1">
+                <div className="flex items-center gap-1.5 text-sm font-medium text-foreground">
+                  {t("about.license.label")}
+                  <ExternalLink className="h-3 w-3 text-muted-foreground" />
+                </div>
+                <p className="text-xs text-muted-foreground mt-0.5 leading-snug">
+                  {t("about.license.description")}
+                </p>
+              </div>
+            </a>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  )
+}

AppImage/components/apps-dashboard.tsx

@@ -0,0 +1,727 @@
+"use client"
+
+import { useEffect, useMemo, useRef, useState } from "react"
+import useSWR from "swr"
+import { ArrowUpCircle, Check, ExternalLink, Pencil, Plus, Search } from "lucide-react"
+import { fetchApi } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+import { ThemeAwareLogo } from "./lxc-app-panel"
+import { CustomLinkEditor, type CustomLink, type GuestOption } from "./custom-link-editor"
+import { Button } from "./ui/button"
+import { categoryChipStyle, useIsLightTheme } from "../lib/category-color"
+
+// ─── Local subset of /api/vms shape ─────────────────────────────
+// Kept narrow on purpose — this component only needs what feeds a
+// launcher card. Full VMData / LxcAppWatch types live in
+// virtual-machines.tsx.
+
+interface AppPort {
+  port: number
+  description?: string
+  scheme?: "http" | "https"
+  web_path?: string
+  logo_url?: string | null
+  category?: string
+  custom_url?: string
+}
+
+interface AppWatch {
+  id: string
+  name: string | null
+  logo_url?: string | null
+  ports?: AppPort[]
+  installed_version: string | null
+  latest_version: string | null
+  update_available: boolean | null
+  managed_oci_app_id?: string | null
+  helper_slug?: string
+}
+
+interface DockerImageUpdate {
+  reference: string
+  display_name?: string | null
+  used_by?: string[]
+  update_available: boolean | null
+}
+
+// Locate the docker_inventory image whose lifecycle matches a given
+// Web Link. The port's `description` is a user-typed label (e.g.
+// "Paperless") so exact match on `used_by` (real container names
+// like "paperless-webserver-1") almost never hits. Fall back through:
+//   1. exact match in `used_by`
+//   2. case-insensitive substring either way in `used_by`
+//   3. substring in `display_name`
+//   4. substring in `reference` (the full image path)
+// Returns undefined when nothing matches — the caller treats that as
+// "no upstream update signal for this port".
+function findDockerImageForPort(
+  port: AppPort,
+  images: DockerImageUpdate[],
+): DockerImageUpdate | undefined {
+  const desc = (port.description || "").trim().toLowerCase()
+  if (!desc || !images.length) return undefined
+  const exact = images.find((i) =>
+    (i.used_by || []).some((c) => c.toLowerCase() === desc),
+  )
+  if (exact) return exact
+  const inclUsedBy = images.find((i) =>
+    (i.used_by || []).some((c) => {
+      const cl = c.toLowerCase()
+      return cl.includes(desc) || desc.includes(cl)
+    }),
+  )
+  if (inclUsedBy) return inclUsedBy
+  const byDisplay = images.find((i) => {
+    const d = (i.display_name || "").toLowerCase()
+    return !!d && (d.includes(desc) || desc.includes(d))
+  })
+  if (byDisplay) return byDisplay
+  return images.find((i) => (i.reference || "").toLowerCase().includes(desc))
+}
+
+interface VM {
+  vmid: number
+  name: string
+  ip?: string
+  type: string
+  app_watches?: AppWatch[]
+  docker_inventory?: { images?: DockerImageUpdate[] }
+}
+
+interface LaunchLink {
+  key: string
+  // Present for LXC-registered apps and for custom links with a
+  // guest binding. Absent when the link is an unbound custom entry
+  // (e.g. an external service).
+  vmid: number | null
+  guestType: "lxc" | "qemu" | null
+  ctName: string
+  appName: string
+  logoUrl: string | null
+  weblink: string
+  category: string
+  updateAvailable: boolean
+  // Set for user-defined custom links so the card can offer edit
+  // and delete actions in edit mode.
+  isCustom: boolean
+  customId?: string
+}
+
+// ─── Helpers ─────────────────────────────────────────────────────
+
+// Same URL construction as the Web Link row in the App tab.
+// Duplicated (small) on purpose — buildWebUrl in lxc-app-panel.tsx
+// is scoped to that module, and copying keeps this component free of
+// hidden cross-file dependencies. A per-port `custom_url` overrides
+// the ip:port composition entirely — used for apps served behind a
+// reverse-proxy domain.
+function buildWebUrl(ip: string | undefined, port: AppPort): string | null {
+  const custom = (port.custom_url || "").trim()
+  if (custom) return custom
+  const raw = (ip || "").trim().split("/")[0]
+  if (!raw || raw === "DHCP" || !port?.port) return null
+  const host = raw.includes(":") && !raw.startsWith("[") ? `[${raw}]` : raw
+  const scheme = port.scheme || ([443, 8443, 9443].includes(port.port) ? "https" : "http")
+  const path = port.web_path ? `/${port.web_path.replace(/^\/+/, "")}` : ""
+  return `${scheme}://${host}:${port.port}${path}`
+}
+
+type SortMode = "name" | "ct" | "category"
+const SORT_STORAGE_KEY = "proxmenux-apps-sort"
+const ALL_CATEGORIES = "__all__"
+
+const fetcher = async (url: string) => fetchApi(url)
+
+// ─── Component ───────────────────────────────────────────────────
+
+export function AppsDashboard() {
+  const t = useT()
+  const { data: vms } = useSWR<VM[]>("/api/vms", fetcher, { refreshInterval: 5000, revalidateOnFocus: false })
+  // Custom links persisted in /etc/proxmenux/custom_links.json. Small
+  // and rarely changes, so we don't poll on an interval — mutate() is
+  // called explicitly after create / update / delete.
+  const { data: customLinks, mutate: mutateCustomLinks } = useSWR<CustomLink[]>(
+    "/api/apps/custom-links", fetcher, { revalidateOnFocus: false },
+  )
+  // Category presets for the "+ Add link" modal.
+  const { data: categoryPresets } = useSWR<string[]>(
+    "/api/apps/categories", fetcher, { revalidateOnFocus: false },
+  )
+
+  const isLightTheme = useIsLightTheme()
+
+  // Flatten VMs → LaunchLinks. One card per (app × port with weblink)
+  // for LXC-registered apps, plus one card per user-defined custom
+  // link. A custom link with a binding resolves its ctName from the
+  // matching guest in `vms` so renames stay in sync automatically.
+  const links = useMemo<LaunchLink[]>(() => {
+    const out: LaunchLink[] = []
+    const vmsList = Array.isArray(vms) ? vms : []
+    for (const vm of vmsList) {
+      const apps = vm.app_watches || []
+      if (!apps.length) continue
+      for (const app of apps) {
+        // Skip the synthetic entry ProxMenux inserts for managed
+        // OCI apps (Secure Gateway) — it has no user-assigned
+        // Web Link and doesn't belong in a launcher.
+        if (app.managed_oci_app_id) continue
+        // `app.update_available` refers to the app itself. For a
+        // Docker registration that app is the Docker engine, and its
+        // ports are containers running INSIDE Docker (Portainer,
+        // Frigate…) — each with an independent image update
+        // lifecycle in `vm.docker_inventory.images[]`. Propagating
+        // the engine-level flag to every container card would falsely
+        // mark Portainer/Frigate as updatable when only the engine
+        // needs bumping; missing the per-image flag would hide real
+        // Portainer/Frigate updates that ARE tracked in the App tab
+        // and fire notifications. Resolution: for each Docker port,
+        // find the image entry whose `used_by` includes the port's
+        // container name (== `port.description`) and use THAT image's
+        // update_available. Engine update stays out of the port cards
+        // — it belongs in the Updates tab.
+        const isDockerApp = app.helper_slug === "docker"
+        const dockerImages = vm.docker_inventory?.images || []
+        for (const port of app.ports || []) {
+          const url = buildWebUrl(vm.ip, port)
+          if (!url) continue
+          let updateAvailable = false
+          if (isDockerApp) {
+            const img = findDockerImageForPort(port, dockerImages)
+            updateAvailable = img?.update_available === true
+          } else {
+            updateAvailable = app.update_available === true
+          }
+          out.push({
+            key: `lxc-${vm.vmid}-${app.id}-${port.port}`,
+            vmid: vm.vmid,
+            guestType: "lxc",
+            ctName: vm.name,
+            appName: (port.description || app.name || vm.name || "").trim(),
+            logoUrl: port.logo_url || app.logo_url || null,
+            weblink: url,
+            category: (port.category || "").trim(),
+            updateAvailable,
+            isCustom: false,
+          })
+        }
+      }
+    }
+    // Merge user-defined custom links. Their `binding` decides how the
+    // CT/VM reference renders and where clicking it navigates.
+    const guestByVmid = new Map<number, { name: string; type: string }>()
+    for (const vm of vmsList) guestByVmid.set(vm.vmid, { name: vm.name, type: vm.type })
+    for (const link of customLinks || []) {
+      let ctName = ""
+      let vmid: number | null = null
+      let guestType: "lxc" | "qemu" | null = null
+      if (link.binding) {
+        const guest = guestByVmid.get(link.binding.vmid)
+        vmid = link.binding.vmid
+        guestType = link.binding.guest_type
+        ctName = guest?.name || ""
+      }
+      out.push({
+        key: `custom-${link.id}`,
+        vmid,
+        guestType,
+        ctName,
+        appName: link.name,
+        logoUrl: link.logo_url || null,
+        weblink: link.url,
+        category: (link.category || "").trim(),
+        updateAvailable: false,
+        isCustom: true,
+        customId: link.id,
+      })
+    }
+    return out
+  }, [vms, customLinks])
+
+  // Category list for the filter dropdown — built from the data so
+  // it always reflects reality (presets and custom-entered names).
+  const categoryCounts = useMemo(() => {
+    const map = new Map<string, number>()
+    for (const l of links) {
+      const key = l.category || t("apps.uncategorized")
+      map.set(key, (map.get(key) || 0) + 1)
+    }
+    return map
+  }, [links, t])
+  const sortedCategoryEntries = useMemo(
+    () => Array.from(categoryCounts.entries()).sort((a, b) => a[0].localeCompare(b[0])),
+    [categoryCounts],
+  )
+
+  // ─── Controls state ────────────────────────────────────────────
+
+  const [query, setQuery] = useState("")
+  const [currentCat, setCurrentCat] = useState<string>(ALL_CATEGORIES)
+  const [sortMode, setSortMode] = useState<SortMode>("name")
+  const [searchExpanded, setSearchExpanded] = useState(false)
+  const searchInputRef = useRef<HTMLInputElement | null>(null)
+
+  // Restore sort from localStorage on mount.
+  useEffect(() => {
+    try {
+      const saved = localStorage.getItem(SORT_STORAGE_KEY)
+      if (saved === "name" || saved === "ct" || saved === "category") {
+        setSortMode(saved)
+      }
+    } catch (_) { /* private mode / storage disabled — silent */ }
+  }, [])
+
+  // Persist sort choice — only this one preference survives reload;
+  // category filter and search reset each visit so the dashboard
+  // always opens showing every app.
+  useEffect(() => {
+    try { localStorage.setItem(SORT_STORAGE_KEY, sortMode) } catch (_) {}
+  }, [sortMode])
+
+  // Filter category resets if the user removes/renames the currently
+  // selected one and it disappears from the list.
+  useEffect(() => {
+    if (currentCat === ALL_CATEGORIES) return
+    if (!categoryCounts.has(currentCat)) setCurrentCat(ALL_CATEGORIES)
+  }, [currentCat, categoryCounts])
+
+  // ─── Custom link editor state ──────────────────────────────────
+
+  const [editorOpen, setEditorOpen] = useState(false)
+  const [editingLink, setEditingLink] = useState<CustomLink | null>(null)
+  const [editMode, setEditMode] = useState(false)
+
+  // Guest list feeds the binding dropdown in the editor modal.
+  const guestOptions = useMemo<GuestOption[]>(() => {
+    if (!Array.isArray(vms)) return []
+    return vms
+      .filter((v) => v.type === "lxc" || v.type === "qemu")
+      .map((v) => ({
+        vmid: v.vmid,
+        name: v.name,
+        type: v.type as "lxc" | "qemu",
+      }))
+  }, [vms])
+
+  const openNewLink = () => {
+    setEditingLink(null)
+    setEditorOpen(true)
+  }
+  const openEditForLink = (customId: string) => {
+    const found = (customLinks || []).find((l) => l.id === customId)
+    if (!found) return
+    setEditingLink(found)
+    setEditorOpen(true)
+  }
+
+  // ─── Filter + sort ─────────────────────────────────────────────
+
+  const shown = useMemo(() => {
+    const q = query.trim().toLowerCase()
+    const uncatKey = t("apps.uncategorized")
+    let filtered = links
+    if (currentCat !== ALL_CATEGORIES) {
+      filtered = filtered.filter((l) => (l.category || uncatKey) === currentCat)
+    }
+    if (q) {
+      filtered = filtered.filter((l) =>
+        l.appName.toLowerCase().includes(q) ||
+        (l.ctName || "").toLowerCase().includes(q) ||
+        (l.vmid != null && String(l.vmid).includes(q)) ||
+        (l.category || "").toLowerCase().includes(q)
+      )
+    }
+    const sorted = [...filtered]
+    sorted.sort((a, b) => {
+      if (sortMode === "name") return a.appName.localeCompare(b.appName)
+      if (sortMode === "ct") {
+        // Unbound custom links have no vmid; sort them after every
+        // bound entry, ordered alphabetically by app name.
+        if (a.vmid == null && b.vmid == null) return a.appName.localeCompare(b.appName)
+        if (a.vmid == null) return 1
+        if (b.vmid == null) return -1
+        return (a.vmid - b.vmid) || a.appName.localeCompare(b.appName)
+      }
+      // category — grouped alphabetically, then by app name inside
+      const catA = a.category || uncatKey
+      const catB = b.category || uncatKey
+      const c = catA.localeCompare(catB)
+      return c !== 0 ? c : a.appName.localeCompare(b.appName)
+    })
+    return sorted
+  }, [links, query, currentCat, sortMode, t])
+
+  // ─── Empty state ───────────────────────────────────────────────
+
+  const hasAnyData = links.length > 0 || (customLinks && customLinks.length > 0)
+  if (vms && !hasAnyData) {
+    return (
+      <>
+        <div className="text-center text-muted-foreground py-16">
+          <div className="text-sm">{t("apps.emptyTitle")}</div>
+          <div className="text-xs mt-1 opacity-80">{t("apps.emptyHint")}</div>
+          <Button
+            onClick={openNewLink}
+            variant="outline"
+            className="mt-4"
+          >
+            <Plus className="h-4 w-4 mr-1.5" />
+            {t("apps.customLinkAdd")}
+          </Button>
+        </div>
+        <CustomLinkEditor
+          open={editorOpen}
+          onOpenChange={setEditorOpen}
+          editing={editingLink}
+          guests={guestOptions}
+          categoryPresets={categoryPresets || []}
+          onSaved={() => mutateCustomLinks()}
+        />
+      </>
+    )
+  }
+
+  // ─── Render ────────────────────────────────────────────────────
+
+  const countLabel = shown.length === 1
+    ? t("apps.countOne")
+    : t("apps.countMany", { n: shown.length })
+
+  return (
+    <div className="space-y-4">
+      {/* Toolbar */}
+      <div className="flex flex-wrap items-center gap-2">
+        {/* Search — icon-only until tapped on narrow screens */}
+        <div className={`relative ${searchExpanded ? "flex-1 min-w-full sm:min-w-0 sm:flex-none sm:w-72" : "sm:flex-1 sm:min-w-40 sm:max-w-xs"}`}>
+          {!searchExpanded && (
+            <button
+              type="button"
+              onClick={() => {
+                setSearchExpanded(true)
+                requestAnimationFrame(() => searchInputRef.current?.focus())
+              }}
+              className="sm:hidden inline-flex items-center justify-center w-9 h-9 rounded-md border border-border bg-card text-muted-foreground hover:text-foreground hover:border-border/80 transition-colors"
+              aria-label={t("apps.searchAriaLabel")}
+            >
+              <Search className="h-4 w-4" />
+            </button>
+          )}
+          <div className={`relative ${searchExpanded ? "block" : "hidden sm:block"}`}>
+            <Search className="absolute left-2.5 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground pointer-events-none" />
+            <input
+              ref={searchInputRef}
+              type="search"
+              value={query}
+              onChange={(e) => setQuery(e.target.value)}
+              onBlur={() => { if (!query.trim()) setSearchExpanded(false) }}
+              placeholder={t("apps.searchPlaceholder")}
+              aria-label={t("apps.searchAriaLabel")}
+              className="w-full h-9 pl-8 pr-3 text-sm bg-card border border-border rounded-md text-foreground placeholder:text-muted-foreground focus:border-border/80 focus:outline-none focus:ring-1 focus:ring-ring"
+            />
+          </div>
+        </div>
+
+        {/* Category filter */}
+        <select
+          value={currentCat}
+          onChange={(e) => setCurrentCat(e.target.value)}
+          aria-label={t("apps.filterAriaLabel")}
+          className="h-9 pl-3 pr-8 text-sm bg-card border border-border rounded-md text-foreground appearance-none cursor-pointer max-w-[9.5rem] sm:max-w-none truncate focus:border-border/80 focus:outline-none focus:ring-1 focus:ring-ring bg-no-repeat bg-[right_0.6rem_center]"
+          style={{
+            backgroundImage: "url(\"data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%23888' stroke-width='2.2' stroke-linecap='round' stroke-linejoin='round'><path d='m6 9 6 6 6-6'/></svg>\")",
+          }}
+        >
+          <option value={ALL_CATEGORIES}>{t("apps.filterAll")}</option>
+          {sortedCategoryEntries.map(([cat, n]) => (
+            <option key={cat} value={cat}>{`${cat} · ${n}`}</option>
+          ))}
+        </select>
+
+        {/* Sort */}
+        <select
+          value={sortMode}
+          onChange={(e) => setSortMode(e.target.value as SortMode)}
+          aria-label={t("apps.sortAriaLabel")}
+          className="h-9 pl-3 pr-8 text-sm bg-card border border-border rounded-md text-foreground appearance-none cursor-pointer max-w-[8rem] sm:max-w-none truncate focus:border-border/80 focus:outline-none focus:ring-1 focus:ring-ring bg-no-repeat bg-[right_0.6rem_center]"
+          style={{
+            backgroundImage: "url(\"data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%23888' stroke-width='2.2' stroke-linecap='round' stroke-linejoin='round'><path d='m6 9 6 6 6-6'/></svg>\")",
+          }}
+        >
+          <option value="name">{t("apps.sortName")}</option>
+          <option value="ct">{t("apps.sortId")}</option>
+          <option value="category">{t("apps.sortCategory")}</option>
+        </select>
+
+        {/* Count — desktop only. Mobile gives the horizontal room to
+            the + button instead so everything stays on one line. */}
+        <span className="ml-auto hidden sm:inline-flex items-center h-9 px-3 text-xs text-muted-foreground rounded-md bg-card border border-border font-mono tabular-nums">
+          {countLabel}
+        </span>
+
+        {/* + Add custom link. Icon-only on mobile (mirrors the search
+            icon-toggle pattern) so the toolbar fits in one line even
+            in the narrowest viewport. On desktop shows label + icon. */}
+        <Button
+          type="button"
+          variant="outline"
+          onClick={openNewLink}
+          className="sm:ml-2 ml-auto h-9 px-2.5 sm:px-3 flex-shrink-0"
+          aria-label={t("apps.customLinkAdd")}
+        >
+          <Plus className="h-4 w-4 sm:mr-1.5" />
+          <span className="hidden sm:inline">{t("apps.customLinkAdd")}</span>
+        </Button>
+
+        {/* Edit mode toggle — only shown when at least one custom link
+            exists, since it's the only card type that carries per-card
+            edit/delete actions. LXC-registered apps are edited in the
+            LXC App tab of their guest modal. */}
+        {(customLinks && customLinks.length > 0) && (
+          <Button
+            type="button"
+            variant="outline"
+            onClick={() => setEditMode((v) => !v)}
+            className={`h-9 px-2.5 sm:px-3 flex-shrink-0 ${editMode ? "border-blue-500/60 text-blue-400" : ""}`}
+            aria-pressed={editMode}
+            aria-label={t("apps.editModeToggle")}
+          >
+            {editMode ? <Check className="h-4 w-4 sm:mr-1.5" /> : <Pencil className="h-4 w-4 sm:mr-1.5" />}
+            <span className="hidden sm:inline">{editMode ? t("apps.editModeDone") : t("apps.editModeToggle")}</span>
+          </Button>
+        )}
+      </div>
+
+      {/* Grid — grouped headers when sorted by category */}
+      <CardsGrid
+        links={shown}
+        grouped={sortMode === "category"}
+        uncategorizedLabel={t("apps.uncategorized")}
+        openLabel={t("apps.openAriaLabel")}
+        isLightTheme={isLightTheme}
+        editMode={editMode}
+        onEditCustom={openEditForLink}
+      />
+
+      <CustomLinkEditor
+        open={editorOpen}
+        onOpenChange={setEditorOpen}
+        editing={editingLink}
+        guests={guestOptions}
+        categoryPresets={categoryPresets || []}
+        onSaved={() => mutateCustomLinks()}
+      />
+    </div>
+  )
+}
+
+// ─── Cards grid + card ───────────────────────────────────────────
+
+function CardsGrid({
+  links,
+  grouped,
+  uncategorizedLabel,
+  openLabel,
+  isLightTheme,
+  editMode,
+  onEditCustom,
+}: {
+  links: LaunchLink[]
+  grouped: boolean
+  uncategorizedLabel: string
+  openLabel: string
+  isLightTheme: boolean
+  editMode: boolean
+  onEditCustom: (customId: string) => void
+}) {
+  if (!links.length) {
+    return (
+      <div className="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-3">
+        <div className="col-span-full text-center text-muted-foreground text-sm py-8">
+          {/* No results after filter/search */}
+        </div>
+      </div>
+    )
+  }
+
+  if (!grouped) {
+    return (
+      <div className="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-3">
+        {links.map((link) => (
+          <AppCard key={link.key} link={link} openLabel={openLabel} isLightTheme={isLightTheme} editMode={editMode} onEditCustom={onEditCustom} />
+        ))}
+      </div>
+    )
+  }
+
+  // Group by category, insert header rows spanning the full grid width.
+  const groups: Array<[string, LaunchLink[]]> = []
+  let currentCat: string | null = null
+  let bucket: LaunchLink[] = []
+  for (const link of links) {
+    const cat = link.category || uncategorizedLabel
+    if (cat !== currentCat) {
+      if (bucket.length) groups.push([currentCat!, bucket])
+      currentCat = cat
+      bucket = []
+    }
+    bucket.push(link)
+  }
+  if (bucket.length) groups.push([currentCat!, bucket])
+
+  return (
+    <div className="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-3">
+      {groups.map(([cat, items]) => (
+        <div key={`grp-${cat}`} className="contents">
+          <h3 className="col-span-full uppercase text-xs tracking-wider text-muted-foreground font-semibold pt-3 pb-1.5 border-b border-border/60 flex items-center gap-2">
+            <span>{cat}</span>
+            <span className="font-mono tabular-nums text-[10px] px-1.5 py-0.5 rounded bg-card border border-border/60 font-normal">{items.length}</span>
+          </h3>
+          {items.map((link) => (
+            <AppCard key={link.key} link={link} openLabel={openLabel} isLightTheme={isLightTheme} editMode={editMode} onEditCustom={onEditCustom} />
+          ))}
+        </div>
+      ))}
+    </div>
+  )
+}
+
+// hueForCategory / categoryChipStyle / readIsLightTheme moved to
+// lib/category-color.ts so the LXC App tab can render the same chip.
+
+// Dispatch the pair of events that jumps from the Apps dashboard to
+// the VMs modal on the App tab for a given CT. Two events by design:
+// `changeTab` switches the outer tab (dashboard-level) and
+// `openLxcAppModal` tells VirtualMachines which guest to open and on
+// which inner tab to land. Both fire in the same tick.
+function openLxcModalOnAppTab(vmid: number) {
+  window.dispatchEvent(new CustomEvent("changeTab", { detail: { tab: "vms" } }))
+  window.dispatchEvent(new CustomEvent("openLxcAppModal", { detail: { vmid } }))
+}
+
+// Same pattern for a QEMU guest: land on the modal's Status tab
+// (QEMU guests don't have the App tab). Used by custom links whose
+// binding is a VM instead of an LXC.
+function openVmModalOnStatusTab(vmid: number) {
+  window.dispatchEvent(new CustomEvent("changeTab", { detail: { tab: "vms" } }))
+  window.dispatchEvent(new CustomEvent("openVmStatusModal", { detail: { vmid } }))
+}
+
+function AppCard({
+  link,
+  openLabel,
+  isLightTheme,
+  editMode,
+  onEditCustom,
+}: {
+  link: LaunchLink
+  openLabel: string
+  isLightTheme: boolean
+  editMode: boolean
+  onEditCustom: (customId: string) => void
+}) {
+  const t = useT()
+  // Navigate to the bound guest's modal on the appropriate inner tab:
+  // LXC → App tab (where the weblink was registered), VM → Status tab
+  // (VMs don't have an App tab). Unbound custom links have no CT ref
+  // to click, so this handler is only wired when `link.vmid` exists.
+  const goToBoundGuest = (e: React.MouseEvent | React.KeyboardEvent) => {
+    e.preventDefault()
+    e.stopPropagation()
+    if (link.vmid == null) return
+    if (link.guestType === "qemu") {
+      openVmModalOnStatusTab(link.vmid)
+    } else {
+      openLxcModalOnAppTab(link.vmid)
+    }
+  }
+
+  const goToEditor = (e: React.MouseEvent | React.KeyboardEvent) => {
+    e.preventDefault()
+    e.stopPropagation()
+    if (link.customId) onEditCustom(link.customId)
+  }
+
+  const guestPrefix = link.guestType === "qemu" ? "VM" : "CT"
+  const hasBinding = link.vmid != null
+
+  return (
+    <a
+      href={link.weblink}
+      target="_blank"
+      rel="noopener noreferrer"
+      aria-label={openLabel.replace("{name}", link.appName)}
+      className="group relative flex flex-col gap-2 p-3.5 bg-card border border-border rounded-xl no-underline text-foreground hover:bg-white/5 hover:border-border/80 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring active:translate-y-px"
+    >
+      {/* Head: logo + name (+ update icon) */}
+      <div className="flex items-center gap-3">
+        <div className="w-14 h-14 rounded-md bg-muted/40 grid place-items-center flex-shrink-0 overflow-hidden">
+          {link.logoUrl ? (
+            <ThemeAwareLogo src={link.logoUrl} className="w-9 h-9 object-contain" />
+          ) : (
+            <span className="text-[10px] font-mono text-muted-foreground uppercase">{link.appName.slice(0, 2)}</span>
+          )}
+        </div>
+        <div className="flex-1 min-w-0">
+          <div className="text-base font-semibold text-foreground truncate leading-tight">{link.appName}</div>
+        </div>
+        {/* Edit mode on a custom card takes over the update-icon slot
+            with a proper edit button — custom links never carry the
+            update signal, so nothing is displaced. Falls back to the
+            update icon in every other case. */}
+        {editMode && link.isCustom ? (
+          <button
+            type="button"
+            onClick={goToEditor}
+            onKeyDown={(e) => { if (e.key === "Enter" || e.key === " ") goToEditor(e) }}
+            className="h-8 w-8 rounded-md border border-border bg-background hover:bg-muted flex items-center justify-center flex-shrink-0 self-start text-muted-foreground hover:text-foreground transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+            aria-label={t("apps.customLinkEditAria", { name: link.appName })}
+            title={t("actions.edit")}
+          >
+            <Pencil className="h-4 w-4" />
+          </button>
+        ) : link.updateAvailable && (
+          <ArrowUpCircle className="h-5 w-5 text-purple-400 flex-shrink-0 self-start mt-0.5" aria-hidden="true" />
+        )}
+      </div>
+
+      {/* Foot: weblink + CT ref + category chip */}
+      <div className="flex flex-col gap-1.5 mt-auto pt-2 border-t border-dashed border-border/60">
+        <div className="flex items-center gap-1.5 text-blue-400 text-sm font-mono truncate">
+          <ExternalLink className="h-3.5 w-3.5 flex-shrink-0 opacity-80" />
+          <span className="truncate">{link.weblink}</span>
+        </div>
+        <div className="flex items-center gap-2 text-[11px] text-muted-foreground">
+          {/* Guest ref → click opens that guest's modal (LXC → App
+              tab, VM → Status tab). stopPropagation keeps the outer
+              anchor from firing at the same time. Unbound custom
+              links: in edit mode show the edit button here, otherwise
+              show nothing. */}
+          {hasBinding && (
+            <button
+              type="button"
+              onClick={goToBoundGuest}
+              onKeyDown={(e) => { if (e.key === "Enter" || e.key === " ") goToBoundGuest(e) }}
+              className="inline-flex items-center gap-1.5 min-w-0 rounded hover:text-blue-400 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring cursor-pointer"
+              aria-label={t("apps.openGuestAriaLabel", {
+                name: link.ctName || String(link.vmid),
+                type: guestPrefix,
+                id: link.vmid!,
+              })}
+            >
+              <span className="font-mono px-1.5 py-0.5 rounded bg-muted/40 text-muted-foreground/90 flex-shrink-0">{link.vmid}</span>
+              <span className="truncate min-w-0">{link.ctName || `${guestPrefix} ${link.vmid}`}</span>
+            </button>
+          )}
+          {link.category && (
+            <span
+              style={categoryChipStyle(link.category, isLightTheme)}
+              className="ml-auto px-1.5 py-0.5 border rounded text-[10px] font-medium flex-shrink-0 truncate max-w-[45%]"
+              title={link.category}
+            >
+              {link.category}
+            </span>
+          )}
+        </div>
+      </div>
+    </a>
+  )
+}

AppImage/components/auth-setup.tsx

@@ -1,18 +1,20 @@
 "use client"
 
-import { useState, useEffect } from "react"
+import { useState, useEffect, useRef } from "react"
 import { Button } from "./ui/button"
 import { Dialog, DialogContent, DialogTitle } from "./ui/dialog"
 import { Input } from "./ui/input"
 import { Label } from "./ui/label"
-import { Shield, Lock, User, AlertCircle, Eye, EyeOff } from "lucide-react"
+import { Shield, Lock, User, AlertCircle, Eye, EyeOff, Upload, Trash2 } from "lucide-react"
 import { getApiUrl } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
 
 interface AuthSetupProps {
   onComplete: () => void
 }
 
 export function AuthSetup({ onComplete }: AuthSetupProps) {
+  const t = useT()
   const [open, setOpen] = useState(false)
   const [step, setStep] = useState<"choice" | "setup">("choice")
   const [username, setUsername] = useState("")
@@ -22,23 +24,39 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
   const [loading, setLoading] = useState(false)
   const [showPassword, setShowPassword] = useState(false)
   const [showConfirmPassword, setShowConfirmPassword] = useState(false)
+  // Profile (Fase 2 — v1.2.2). Both optional decorations on top of the
+  // mandatory username + password. Persisted via PUT /api/auth/profile
+  // and POST /api/auth/profile/avatar after the user lands a successful
+  // /api/auth/setup so we don't change the setup endpoint's contract.
+  const [displayName, setDisplayName] = useState("")
+  const [avatarFile, setAvatarFile] = useState<File | null>(null)
+  const [avatarPreviewUrl, setAvatarPreviewUrl] = useState<string | null>(null)
+  const fileInputRef = useRef<HTMLInputElement>(null)
 
   useEffect(() => {
     const checkOnboardingStatus = async () => {
       try {
         const response = await fetch(getApiUrl("/api/auth/status"))
+        
+        // Check if response is valid JSON before parsing
+        if (!response.ok) {
+          // API not available - don't show modal in preview
+          return
+        }
+        
+        const contentType = response.headers.get("content-type")
+        if (!contentType || !contentType.includes("application/json")) {
+          return
+        }
+        
         const data = await response.json()
 
-        console.log("[v0] Auth status for modal check:", data)
-
         // Show modal if auth is not configured and not declined
         if (!data.auth_configured) {
           setTimeout(() => setOpen(true), 500)
         }
-      } catch (error) {
-        console.error("[v0] Failed to check auth status:", error)
-        // Fail-safe: show modal if we can't check status
-        setTimeout(() => setOpen(true), 500)
+      } catch {
+        // API not available (preview environment) - don't show modal
       }
     }
 
@@ -50,58 +68,65 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
     setError("")
 
     try {
-      console.log("[v0] Skipping authentication setup...")
       const response = await fetch(getApiUrl("/api/auth/skip"), {
         method: "POST",
         headers: { "Content-Type": "application/json" },
       })
 
       const data = await response.json()
-      console.log("[v0] Auth skip response:", data)
 
       if (!response.ok) {
-        throw new Error(data.error || "Failed to skip authentication")
+        throw new Error(data.error || t("authSetup.skipFailed"))
       }
 
       if (data.auth_declined) {
-        console.log("[v0] Authentication skipped successfully - APIs should be accessible without token")
       }
 
-      console.log("[v0] Authentication skipped successfully")
       localStorage.setItem("proxmenux-auth-declined", "true")
       localStorage.removeItem("proxmenux-auth-token") // Remove any old token
       setOpen(false)
       onComplete()
     } catch (err) {
-      console.error("[v0] Auth skip error:", err)
-      setError(err instanceof Error ? err.message : "Failed to save preference")
+      console.error("Auth skip error:", err)
+      setError(err instanceof Error ? err.message : t("authSetup.savePreferenceFailed"))
     } finally {
       setLoading(false)
     }
   }
 
+  const handleAvatarPick = () => fileInputRef.current?.click()
+
+  const handleAvatarChange = (file: File | null) => {
+    // Revoke the previous local preview so we don't leak blob URLs while
+    // the user picks another file before submitting.
+    if (avatarPreviewUrl) {
+      URL.revokeObjectURL(avatarPreviewUrl)
+    }
+    setAvatarFile(file)
+    setAvatarPreviewUrl(file ? URL.createObjectURL(file) : null)
+  }
+
   const handleSetupAuth = async () => {
     setError("")
 
     if (!username || !password) {
-      setError("Please fill in all fields")
+      setError(t("authSetup.fillFields"))
       return
     }
 
     if (password !== confirmPassword) {
-      setError("Passwords do not match")
+      setError(t("authSetup.passwordMismatch"))
       return
     }
 
     if (password.length < 6) {
-      setError("Password must be at least 6 characters")
+      setError(t("authSetup.passwordTooShort"))
       return
     }
 
     setLoading(true)
 
     try {
-      console.log("[v0] Setting up authentication...")
       const response = await fetch(getApiUrl("/api/auth/setup"), {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -112,23 +137,76 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
       })
 
       const data = await response.json()
-      console.log("[v0] Auth setup response:", data)
 
       if (!response.ok) {
-        throw new Error(data.error || "Failed to setup authentication")
+        throw new Error(data.error || t("authSetup.setupFailed"))
       }
 
       if (data.token) {
         localStorage.setItem("proxmenux-auth-token", data.token)
         localStorage.removeItem("proxmenux-auth-declined")
-        console.log("[v0] Authentication setup successful")
+      }
+
+      // Profile decorations (Fase 2). Sent as a follow-up to the setup
+      // call so the /api/auth/setup endpoint stays minimal (username +
+      // password only) — these calls reuse the existing profile
+      // endpoints and the JWT we just received. Failures here are
+      // non-fatal: the user is already authenticated and can finish
+      // configuring the profile from the /profile page.
+      const token = data.token
+      if (token) {
+        const trimmedDisplayName = displayName.trim()
+        if (trimmedDisplayName) {
+          try {
+            await fetch(getApiUrl("/api/auth/profile"), {
+              method: "PUT",
+              headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${token}`,
+              },
+              body: JSON.stringify({ display_name: trimmedDisplayName }),
+            })
+          } catch (e) {
+            console.warn("[auth-setup] failed to save display_name:", e)
+          }
+        }
+        if (avatarFile) {
+          try {
+            await fetch(getApiUrl("/api/auth/profile/avatar"), {
+              method: "POST",
+              headers: {
+                "Content-Type": avatarFile.type,
+                Authorization: `Bearer ${token}`,
+              },
+              body: avatarFile,
+            })
+          } catch (e) {
+            console.warn("[auth-setup] failed to upload avatar:", e)
+          }
+        }
+      }
+
+      // Release the local preview blob now that the file has been
+      // uploaded (or skipped). The header avatar pulls a fresh copy
+      // from the backend.
+      if (avatarPreviewUrl) {
+        URL.revokeObjectURL(avatarPreviewUrl)
+        setAvatarPreviewUrl(null)
+      }
+
+      // Notify the header AvatarMenu (mounted on dashboard load with
+      // auth_enabled=false) to re-fetch its status + profile so the
+      // avatar appears immediately after first-time setup instead of
+      // requiring a page refresh.
+      if (typeof window !== "undefined") {
+        window.dispatchEvent(new CustomEvent("proxmenux:profile-changed"))
       }
 
       setOpen(false)
       onComplete()
     } catch (err) {
-      console.error("[v0] Auth setup error:", err)
-      setError(err instanceof Error ? err.message : "Failed to setup authentication")
+      console.error("Auth setup error:", err)
+      setError(err instanceof Error ? err.message : t("authSetup.setupFailed"))
     } finally {
       setLoading(false)
     }
@@ -138,7 +216,7 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
     <Dialog open={open} onOpenChange={setOpen}>
       <DialogContent className="max-w-md max-h-[90vh] overflow-y-auto">
         <DialogTitle className="sr-only">
-          {step === "choice" ? "Setup Dashboard Protection" : "Create Password"}
+          {step === "choice" ? t("authSetup.choiceTitle") : t("authSetup.passwordTitle")}
         </DialogTitle>
         {step === "choice" ? (
           <div className="space-y-6 py-2">
@@ -146,16 +224,16 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
               <div className="mx-auto w-16 h-16 bg-blue-500/10 rounded-full flex items-center justify-center">
                 <Shield className="h-8 w-8 text-blue-500" />
               </div>
-              <h2 className="text-2xl font-bold">Protect Your Dashboard?</h2>
+              <h2 className="text-2xl font-bold">{t("authSetup.protectTitle")}</h2>
               <p className="text-muted-foreground text-sm">
-                Add an extra layer of security to protect your Proxmox data when accessing from non-private networks.
+                {t("authSetup.protectDescription")}
               </p>
             </div>
 
             <div className="space-y-3">
               <Button onClick={() => setStep("setup")} className="w-full bg-blue-500 hover:bg-blue-600" size="lg">
                 <Lock className="h-4 w-4 mr-2" />
-                Yes, Setup Password
+                {t("authSetup.setupPassword")}
               </Button>
               <Button
                 onClick={handleSkipAuth}
@@ -164,11 +242,11 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
                 size="lg"
                 disabled={loading}
               >
-                No, Continue Without Protection
+                {t("authSetup.skipProtection")}
               </Button>
             </div>
 
-            <p className="text-xs text-center text-muted-foreground">You can always enable this later in Settings</p>
+            <p className="text-xs text-center text-muted-foreground">{t("authSetup.enableLater")}</p>
           </div>
         ) : (
           <div className="space-y-6 py-2">
@@ -176,8 +254,8 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
               <div className="mx-auto w-16 h-16 bg-blue-500/10 rounded-full flex items-center justify-center">
                 <Lock className="h-8 w-8 text-blue-500" />
               </div>
-              <h2 className="text-2xl font-bold">Setup Authentication</h2>
-              <p className="text-muted-foreground text-sm">Create a username and password to protect your dashboard</p>
+              <h2 className="text-2xl font-bold">{t("authSetup.setupTitle")}</h2>
+              <p className="text-muted-foreground text-sm">{t("authSetup.setupDescription")}</p>
             </div>
 
             {error && (
@@ -190,14 +268,14 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
             <div className="space-y-4">
               <div className="space-y-2">
                 <Label htmlFor="username" className="text-sm">
-                  Username
+                  {t("authSetup.username")}
                 </Label>
                 <div className="relative">
                   <User className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
                   <Input
                     id="username"
                     type="text"
-                    placeholder="Enter username"
+                    placeholder={t("authSetup.usernamePlaceholder")}
                     value={username}
                     onChange={(e) => setUsername(e.target.value)}
                     className="pl-10 text-base"
@@ -209,14 +287,14 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
 
               <div className="space-y-2">
                 <Label htmlFor="password" className="text-sm">
-                  Password
+                  {t("authSetup.password")}
                 </Label>
                 <div className="relative">
                   <Lock className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
                   <Input
                     id="password"
                     type={showPassword ? "text" : "password"}
-                    placeholder="Enter password"
+                    placeholder={t("authSetup.passwordPlaceholder")}
                     value={password}
                     onChange={(e) => setPassword(e.target.value)}
                     className="pl-10 text-base"
@@ -236,14 +314,14 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
 
               <div className="space-y-2">
                 <Label htmlFor="confirm-password" className="text-sm">
-                  Confirm Password
+                  {t("authSetup.confirmPassword")}
                 </Label>
                 <div className="relative">
                   <Lock className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
                   <Input
                     id="confirm-password"
                     type={showConfirmPassword ? "text" : "password"}
-                    placeholder="Confirm password"
+                    placeholder={t("authSetup.confirmPasswordPlaceholder")}
                     value={confirmPassword}
                     onChange={(e) => setConfirmPassword(e.target.value)}
                     className="pl-10 text-base"
@@ -260,14 +338,108 @@ export function AuthSetup({ onComplete }: AuthSetupProps) {
                   </Button>
                 </div>
               </div>
+
+              {/* Optional profile decorations (Fase 2). Visually
+                  separated from the mandatory credential fields by a
+                  divider + a small heading so the operator understands
+                  they can skip everything below and still complete the
+                  setup. Both are saved with follow-up calls after the
+                  setup endpoint returns the JWT. */}
+              <div className="pt-3 border-t border-border/60 space-y-4">
+                <p className="text-xs text-muted-foreground uppercase tracking-wider">
+                  {t("authSetup.profileOptional")}
+                </p>
+
+                <div className="space-y-2">
+                  <Label htmlFor="display-name" className="text-sm">
+                    {t("authSetup.displayName")}
+                  </Label>
+                  <div className="relative">
+                    <User className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
+                    <Input
+                      id="display-name"
+                      type="text"
+                      placeholder={t("authSetup.displayNamePlaceholder")}
+                      value={displayName}
+                      onChange={(e) => setDisplayName(e.target.value)}
+                      maxLength={64}
+                      className="pl-10 text-base"
+                      disabled={loading}
+                    />
+                  </div>
+                  <p className="text-[11px] text-muted-foreground">
+                    {t("authSetup.displayNameHint")}
+                  </p>
+                </div>
+
+                <div className="space-y-2">
+                  <Label className="text-sm">{t("authSetup.avatar")}</Label>
+                  <div className="flex items-center gap-3">
+                    {avatarPreviewUrl ? (
+                      // eslint-disable-next-line @next/next/no-img-element
+                      <img
+                        src={avatarPreviewUrl}
+                        alt=""
+                        className="w-14 h-14 rounded-full object-cover border border-border bg-cyan-500/5 shrink-0"
+                      />
+                    ) : (
+                      <span className="w-14 h-14 rounded-full bg-cyan-500/15 text-cyan-600 dark:text-cyan-300 flex items-center justify-center text-xl font-semibold border border-border shrink-0">
+                        {(displayName || username || "U").trim().charAt(0).toUpperCase() || "U"}
+                      </span>
+                    )}
+                    <div className="flex flex-col gap-1.5 min-w-0">
+                      <input
+                        ref={fileInputRef}
+                        type="file"
+                        accept="image/png,image/jpeg,image/webp,image/gif"
+                        className="hidden"
+                        onChange={(e) => {
+                          const file = e.target.files?.[0] || null
+                          handleAvatarChange(file)
+                          if (fileInputRef.current) fileInputRef.current.value = ""
+                        }}
+                      />
+                      <div className="flex items-center gap-2">
+                        <Button
+                          type="button"
+                          variant="outline"
+                          size="sm"
+                          onClick={handleAvatarPick}
+                          disabled={loading}
+                          className="h-7 text-xs"
+                        >
+                          <Upload className="h-3 w-3 mr-1.5" />
+                          {avatarFile ? t("authSetup.change") : t("authSetup.chooseImage")}
+                        </Button>
+                        {avatarFile && (
+                          <Button
+                            type="button"
+                            variant="outline"
+                            size="sm"
+                            onClick={() => handleAvatarChange(null)}
+                            disabled={loading}
+                            className="h-7 text-xs text-red-500 hover:text-red-500 hover:bg-red-500/10"
+                          >
+                            <Trash2 className="h-3 w-3 mr-1.5" />
+                            {t("authSetup.clear")}
+                          </Button>
+                        )}
+                      </div>
+                      <p className="text-[11px] text-muted-foreground">
+                        {t("authSetup.avatarHint")}
+                      </p>
+                    </div>
+                  </div>
+                </div>
+              </div>
             </div>
 
             <div className="space-y-2">
               <Button onClick={handleSetupAuth} className="w-full bg-blue-500 hover:bg-blue-600" disabled={loading}>
-                {loading ? "Setting up..." : "Setup Authentication"}
+                {loading ? t("authSetup.settingUp") : t("authSetup.setupAuthentication")}
               </Button>
               <Button onClick={() => setStep("choice")} variant="ghost" className="w-full" disabled={loading}>
-                Back
+                {t("authSetup.back")}
               </Button>
             </div>
           </div>

AppImage/components/avatar-menu.tsx

@@ -0,0 +1,284 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { User, Shield, LogOut } from "lucide-react"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "./ui/dropdown-menu"
+import { fetchApi, getApiUrl, getAuthToken } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+
+interface AuthStatus {
+  auth_enabled?: boolean
+  username?: string | null
+}
+
+interface ProfileData {
+  success: boolean
+  username?: string | null
+  display_name?: string | null
+  has_avatar?: boolean
+  avatar_mtime?: number | null
+}
+
+interface AvatarMenuProps {
+  /** Size of the avatar circle in the header trigger. */
+  size?: "md" | "lg"
+  /**
+   * Callback used by the Security menu item. The Monitor renders its
+   * Settings/Security panels inside the same dashboard route, not on
+   * a separate URL, so navigation is handled by the parent that knows
+   * how to switch tabs. Optional — when omitted the menu item is hidden.
+   */
+  onOpenSecurity?: () => void
+  /**
+   * Callback for "View profile". Same rationale: the parent decides how
+   * to route there (modal, page, tab switch). Until Fase 2 lands the
+   * caller typically passes an alert/toast that the page is coming.
+   */
+  onOpenProfile?: () => void
+}
+
+/**
+ * AvatarMenu — user/account dropdown for the header.
+ *
+ * Self-fetches the current auth status to derive the username and the
+ * initial that fills the avatar circle. Stays silent (renders nothing)
+ * when authentication is disabled on this install — no point showing
+ * an account menu for a "Sign out" that doesn't apply.
+ *
+ * Sign out clears the token from localStorage and reloads, mirroring
+ * the existing `handleLogout` in `security.tsx`. That keeps a single
+ * source of truth for the logout flow until Fase 2 introduces a
+ * proper /api/auth/logout that revokes the JWT server-side too.
+ */
+export function AvatarMenu({ size = "lg", onOpenSecurity, onOpenProfile }: AvatarMenuProps) {
+  const t = useT()
+
+  // IMPORTANT — all hooks must run unconditionally on every render. The
+  // previous version short-circuited with `if (!auth_enabled) return null`
+  // BEFORE the avatar blob hooks, so the hook count changed between
+  // renders the moment auth status loaded → React error #310 ("rendered
+  // more hooks than during the previous render"). All `useState` and
+  // `useEffect` calls now live above any early return; the null branch
+  // is at the very end after the hooks.
+  const [status, setStatus] = useState<AuthStatus | null>(null)
+  const [profile, setProfile] = useState<ProfileData | null>(null)
+  const [open, setOpen] = useState(false)
+  const [avatarBlobUrl, setAvatarBlobUrl] = useState<string | null>(null)
+
+  // Load both auth_status (to decide whether to render at all) and the
+  // profile (to render display_name + avatar). Profile is fetched only
+  // when auth is enabled — saves one roundtrip on installs without
+  // auth where the menu won't show anyway.
+  useEffect(() => {
+    let cancelled = false
+    fetchApi<AuthStatus>("/api/auth/status")
+      .then(data => {
+        if (cancelled) return
+        setStatus(data)
+        if (data?.auth_enabled && data?.username) {
+          fetchApi<ProfileData>("/api/auth/profile")
+            .then(p => {
+              if (!cancelled) setProfile(p)
+            })
+            .catch(() => {
+              // Profile fetch is best-effort. Falls back to username + initials.
+            })
+        }
+      })
+      .catch(() => {
+        if (!cancelled) setStatus(null)
+      })
+    // Reload status + profile when the user updates the profile from
+    // the /profile page OR completes first-time auth setup. Refreshing
+    // status is what flips the menu visible after setup (when the
+    // initial mount saw auth_enabled=false); refreshing profile is
+    // what makes a new avatar/display name appear without a full
+    // browser refresh.
+    const handler = () => {
+      fetchApi<AuthStatus>("/api/auth/status")
+        .then(s => {
+          if (cancelled) return
+          setStatus(s)
+          if (s?.auth_enabled && s?.username) {
+            fetchApi<ProfileData>("/api/auth/profile")
+              .then(p => {
+                if (!cancelled) setProfile(p)
+              })
+              .catch(() => {})
+          }
+        })
+        .catch(() => {})
+    }
+    if (typeof window !== "undefined") {
+      window.addEventListener("proxmenux:profile-changed", handler)
+    }
+    return () => {
+      cancelled = true
+      if (typeof window !== "undefined") {
+        window.removeEventListener("proxmenux:profile-changed", handler)
+      }
+    }
+  }, [])
+
+  // Avatar fetch — the endpoint requires the Bearer header, which
+  // <img src=…> can't send, so we fetch as a blob and convert it to a
+  // local object URL for rendering. The blob URL is revoked on cleanup
+  // and on every refetch to avoid leaking memory.
+  useEffect(() => {
+    let cancelled = false
+    let currentBlobUrl: string | null = null
+    if (profile?.has_avatar) {
+      const token = getAuthToken()
+      const url = `${getApiUrl("/api/auth/profile/avatar")}?v=${profile.avatar_mtime || ""}`
+      fetch(url, { headers: token ? { Authorization: `Bearer ${token}` } : {} })
+        .then(r => (r.ok ? r.blob() : null))
+        .then(blob => {
+          if (cancelled || !blob) return
+          currentBlobUrl = URL.createObjectURL(blob)
+          setAvatarBlobUrl(currentBlobUrl)
+        })
+        .catch(() => {
+          if (!cancelled) setAvatarBlobUrl(null)
+        })
+    } else {
+      setAvatarBlobUrl(null)
+    }
+    return () => {
+      cancelled = true
+      if (currentBlobUrl) URL.revokeObjectURL(currentBlobUrl)
+    }
+  }, [profile?.has_avatar, profile?.avatar_mtime])
+
+  // ── Hooks finished. Safe to early-return now. ──
+  // Hide the avatar entirely when auth isn't enabled on this install —
+  // there's no user identity to surface and no Sign out to offer.
+  if (!status?.auth_enabled || !status?.username) return null
+
+  const username = status.username
+  const displayName = profile?.display_name || username
+  const initial = displayName.trim().charAt(0).toUpperCase() || "U"
+
+  const handleSignOut = () => {
+    try {
+      localStorage.removeItem("proxmenux-auth-token")
+      localStorage.removeItem("proxmenux-auth-setup-complete")
+    } catch {
+      // localStorage may be unavailable (private mode); fall through.
+    }
+    window.location.reload()
+  }
+
+  // Avatar size in the header trigger. The trigger has no chevron now —
+  // removing it freed enough horizontal space to bump the avatar a
+  // notch up (40 → 44 / 32 → 36) without nudging the Refresh / Theme
+  // buttons sitting to its left.
+  const avatarSize = size === "lg" ? "w-11 h-11 text-lg" : "w-9 h-9 text-sm"
+
+  return (
+    <>
+      {/* Backdrop overlay — dim only (no blur). Mounted while the
+          dropdown is open. `bg-black/40` dims the page enough to focus
+          attention on the dropdown without distorting the content
+          behind, which testers found annoying when full backdrop blur
+          was used (especially on wider desktop viewports). `z-40`
+          places it above the dashboard content but below the dropdown
+          portal (`DropdownMenuContent` lands on z-[60]) and below the
+          header (which stays on z-50 so the avatar trigger remains
+          clickable). Clicking the backdrop closes the menu — the
+          explicit `onClick` mirrors Radix's outside-click handler. */}
+      {open && (
+        <div
+          aria-hidden="true"
+          onClick={() => setOpen(false)}
+          className="fixed inset-0 z-40 bg-black/40 animate-in fade-in-0 duration-150"
+        />
+      )}
+      <DropdownMenu open={open} onOpenChange={setOpen}>
+        <DropdownMenuTrigger asChild>
+          <button
+            className="rounded-full hover:ring-2 hover:ring-cyan-500/30 transition-all relative z-50 focus:outline-none focus-visible:outline-none active:outline-none data-[state=open]:outline-none data-[state=open]:ring-0 select-none"
+            aria-label={t("actions.openUserMenu")}
+            // WebKit ignores `outline` for the tap-highlight overlay
+            // shown on iOS / Android Chrome after a touch. That overlay
+            // was the white border that lingered on the avatar after
+            // dismissing the dropdown without picking anything. Setting
+            // `-webkit-tap-highlight-color` to transparent suppresses
+            // it without affecting keyboard focus visibility (handled
+            // separately by `focus-visible:outline-none` above).
+            style={{ WebkitTapHighlightColor: "transparent" }}
+          >
+            {avatarBlobUrl ? (
+              // eslint-disable-next-line @next/next/no-img-element
+              <img
+                src={avatarBlobUrl}
+                alt=""
+                className={`${avatarSize} rounded-full object-cover bg-cyan-500/10`}
+              />
+            ) : (
+              <span
+                className={`${avatarSize} rounded-full flex items-center justify-center font-semibold bg-cyan-500/15 text-cyan-600 dark:text-cyan-300`}
+              >
+                {initial}
+              </span>
+            )}
+          </button>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent align="end" className="w-72 z-[60]">
+        <DropdownMenuLabel>
+          <div className="flex items-center gap-3 py-1">
+            {avatarBlobUrl ? (
+              // eslint-disable-next-line @next/next/no-img-element
+              <img
+                src={avatarBlobUrl}
+                alt=""
+                className="w-20 h-20 rounded-full object-cover bg-cyan-500/10 shrink-0"
+              />
+            ) : (
+              <span className="w-20 h-20 rounded-full bg-cyan-500/15 text-cyan-600 dark:text-cyan-300 flex items-center justify-center text-3xl font-semibold shrink-0">
+                {initial}
+              </span>
+            )}
+            <div className="min-w-0">
+              <div className="text-base font-semibold truncate">{displayName}</div>
+              {profile?.display_name && (
+                <div className="text-xs text-muted-foreground truncate">{username}</div>
+              )}
+              {!profile?.display_name && (
+                <div className="text-xs text-muted-foreground truncate">{t("account.signedIn")}</div>
+              )}
+            </div>
+          </div>
+        </DropdownMenuLabel>
+        <DropdownMenuSeparator />
+        {onOpenProfile && (
+          <DropdownMenuItem onClick={onOpenProfile}>
+            <User className="h-4 w-4 mr-2" />
+            {t("account.viewProfile")}
+          </DropdownMenuItem>
+        )}
+        {onOpenSecurity && (
+          <DropdownMenuItem onClick={onOpenSecurity}>
+            <Shield className="h-4 w-4 mr-2" />
+            {t("account.security")}
+          </DropdownMenuItem>
+        )}
+        {(onOpenProfile || onOpenSecurity) && <DropdownMenuSeparator />}
+        <DropdownMenuItem
+          onClick={handleSignOut}
+          className="text-red-600 focus:text-red-600 dark:text-red-400 dark:focus:text-red-400"
+        >
+          <LogOut className="h-4 w-4 mr-2" />
+          {t("account.signOut")}
+        </DropdownMenuItem>
+        </DropdownMenuContent>
+      </DropdownMenu>
+    </>
+  )
+}

AppImage/components/custom-link-editor.tsx

@@ -0,0 +1,306 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { Trash2 } from "lucide-react"
+import { fetchApi } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+import { Dialog, DialogContent, DialogFooter, DialogHeader, DialogTitle } from "./ui/dialog"
+import { Button } from "./ui/button"
+import { Input } from "./ui/input"
+import { Label } from "./ui/label"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
+
+// Minimal shape we need from the /api/vms poll. Kept narrow so this
+// component stays independent of the fuller VMData type used in
+// virtual-machines.tsx.
+export interface GuestOption {
+  vmid: number
+  name: string
+  type: "lxc" | "qemu"
+}
+
+export interface CustomLink {
+  id: string
+  name: string
+  url: string
+  logo_url: string
+  category: string
+  binding: { vmid: number; guest_type: "lxc" | "qemu" } | null
+  created_at?: number
+  updated_at?: number
+}
+
+export interface DraftCustomLink {
+  name: string
+  url: string
+  logo_url: string
+  category: string
+  bindingKey: string
+}
+
+const UNBOUND_KEY = "__none__"
+
+function buildKey(binding: CustomLink["binding"]): string {
+  if (!binding) return UNBOUND_KEY
+  return `${binding.guest_type}:${binding.vmid}`
+}
+
+function parseKey(key: string): CustomLink["binding"] {
+  if (!key || key === UNBOUND_KEY) return null
+  const [type, vmid] = key.split(":")
+  if (type !== "lxc" && type !== "qemu") return null
+  const n = Number(vmid)
+  if (!Number.isFinite(n)) return null
+  return { guest_type: type, vmid: n }
+}
+
+export function CustomLinkEditor({
+  open,
+  onOpenChange,
+  editing,
+  guests,
+  categoryPresets,
+  onSaved,
+}: {
+  open: boolean
+  onOpenChange: (v: boolean) => void
+  /** null = create; existing link = edit */
+  editing: CustomLink | null
+  /** VMs + LXCs from /api/vms so the user can bind a link to a guest */
+  guests: GuestOption[]
+  /** Populated from /api/apps/categories */
+  categoryPresets: string[]
+  /** Called on successful save/delete so the parent can refresh */
+  onSaved: () => void
+}) {
+  const t = useT()
+  const [draft, setDraft] = useState<DraftCustomLink>({
+    name: "", url: "", logo_url: "", category: "", bindingKey: UNBOUND_KEY,
+  })
+  const [customCategoryMode, setCustomCategoryMode] = useState(false)
+  const [saving, setSaving] = useState(false)
+  const [deleting, setDeleting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  // Reset the draft whenever the modal opens with a new target.
+  useEffect(() => {
+    if (!open) return
+    setError(null)
+    if (editing) {
+      setDraft({
+        name: editing.name,
+        url: editing.url,
+        logo_url: editing.logo_url || "",
+        category: editing.category || "",
+        bindingKey: buildKey(editing.binding),
+      })
+      setCustomCategoryMode(
+        !!editing.category && !categoryPresets.includes(editing.category),
+      )
+    } else {
+      setDraft({ name: "", url: "", logo_url: "", category: "", bindingKey: UNBOUND_KEY })
+      setCustomCategoryMode(false)
+    }
+  }, [open, editing, categoryPresets])
+
+  const canSave = draft.name.trim() && draft.url.trim() && !saving
+
+  const handleSave = async () => {
+    setError(null)
+    setSaving(true)
+    try {
+      const payload = {
+        name: draft.name.trim(),
+        url: draft.url.trim(),
+        logo_url: draft.logo_url.trim(),
+        category: draft.category.trim(),
+        binding: parseKey(draft.bindingKey),
+      }
+      if (editing) {
+        await fetchApi(`/api/apps/custom-links/${editing.id}`, {
+          method: "PUT",
+          body: JSON.stringify(payload),
+          headers: { "Content-Type": "application/json" },
+        })
+      } else {
+        await fetchApi("/api/apps/custom-links", {
+          method: "POST",
+          body: JSON.stringify(payload),
+          headers: { "Content-Type": "application/json" },
+        })
+      }
+      onSaved()
+      onOpenChange(false)
+    } catch (e: any) {
+      setError((e && e.message) || t("apps.customLinkSaveError"))
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const handleDelete = async () => {
+    if (!editing) return
+    setError(null)
+    setDeleting(true)
+    try {
+      await fetchApi(`/api/apps/custom-links/${editing.id}`, { method: "DELETE" })
+      onSaved()
+      onOpenChange(false)
+    } catch (e: any) {
+      setError((e && e.message) || t("apps.customLinkDeleteError"))
+    } finally {
+      setDeleting(false)
+    }
+  }
+
+  // Sort guests by vmid so the dropdown is easy to scan
+  const sortedGuests = [...guests].sort((a, b) => a.vmid - b.vmid)
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[520px] bg-accent [&_input]:bg-background [&_[role=combobox]]:bg-background">
+        <DialogHeader>
+          <DialogTitle>
+            {editing ? t("apps.customLinkEditTitle") : t("apps.customLinkNewTitle")}
+          </DialogTitle>
+        </DialogHeader>
+
+        <div className="grid gap-3 py-2">
+          <div className="grid gap-1.5">
+            <Label htmlFor="cl-name" className="text-xs uppercase tracking-wider text-muted-foreground">{t("apps.customLinkName")}</Label>
+            <Input
+              id="cl-name"
+              autoFocus
+              value={draft.name}
+              onChange={(e) => setDraft((d) => ({ ...d, name: e.target.value }))}
+              placeholder={t("apps.customLinkNamePlaceholder")}
+              maxLength={80}
+              className="text-sm"
+            />
+          </div>
+
+          <div className="grid gap-1.5">
+            <Label htmlFor="cl-url" className="text-xs uppercase tracking-wider text-muted-foreground">{t("apps.customLinkUrl")}</Label>
+            <Input
+              id="cl-url"
+              type="url"
+              value={draft.url}
+              onChange={(e) => setDraft((d) => ({ ...d, url: e.target.value }))}
+              placeholder="https://example.com"
+              maxLength={512}
+              className="text-sm font-mono"
+            />
+          </div>
+
+          <div className="grid gap-1.5">
+            <Label htmlFor="cl-logo" className="text-xs uppercase tracking-wider text-muted-foreground">{t("apps.customLinkLogo")}</Label>
+            <Input
+              id="cl-logo"
+              type="url"
+              value={draft.logo_url}
+              onChange={(e) => setDraft((d) => ({ ...d, logo_url: e.target.value }))}
+              placeholder={t("apps.customLinkLogoPlaceholder")}
+              maxLength={512}
+              className="text-sm font-mono"
+            />
+          </div>
+
+          <div className="grid gap-1.5">
+            <Label className="text-xs uppercase tracking-wider text-muted-foreground">{t("apps.customLinkCategory")}</Label>
+            {customCategoryMode ? (
+              <Input
+                autoFocus
+                value={draft.category}
+                onChange={(e) => setDraft((d) => ({ ...d, category: e.target.value }))}
+                placeholder={t("vmLxc.appEditor.portCategoryCustomPlaceholder")}
+                maxLength={60}
+                className="text-sm"
+                onBlur={() => { if (!draft.category.trim()) setCustomCategoryMode(false) }}
+              />
+            ) : (
+              <Select
+                value={draft.category || "__none__"}
+                onValueChange={(v) => {
+                  if (v === "__add__") {
+                    setCustomCategoryMode(true)
+                    setDraft((d) => ({ ...d, category: "" }))
+                  } else if (v === "__none__") {
+                    setDraft((d) => ({ ...d, category: "" }))
+                  } else {
+                    setDraft((d) => ({ ...d, category: v }))
+                  }
+                }}
+              >
+                <SelectTrigger className="text-sm h-9">
+                  <SelectValue placeholder={t("vmLxc.appEditor.portCategoryPlaceholder")} />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="__none__">{t("vmLxc.appEditor.portCategoryNone")}</SelectItem>
+                  {categoryPresets.map((c) => (
+                    <SelectItem key={c} value={c}>{c}</SelectItem>
+                  ))}
+                  <SelectItem value="__add__">{t("vmLxc.appEditor.portCategoryAddNew")}</SelectItem>
+                </SelectContent>
+              </Select>
+            )}
+          </div>
+
+          <div className="grid gap-1.5">
+            <Label className="text-xs uppercase tracking-wider text-muted-foreground">{t("apps.customLinkBinding")}</Label>
+            <Select
+              value={draft.bindingKey}
+              onValueChange={(v) => setDraft((d) => ({ ...d, bindingKey: v }))}
+            >
+              <SelectTrigger className="text-sm h-9">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value={UNBOUND_KEY}>{t("apps.customLinkBindingNone")}</SelectItem>
+                {sortedGuests.map((g) => (
+                  <SelectItem key={`${g.type}:${g.vmid}`} value={`${g.type}:${g.vmid}`}>
+                    {g.type === "qemu" ? "VM" : "CT"} {g.vmid} · {g.name}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            <p className="text-[11px] text-muted-foreground leading-relaxed">
+              {t("apps.customLinkBindingHelp")}
+            </p>
+          </div>
+
+          {error && (
+            <div className="text-xs text-red-400 bg-red-500/10 border border-red-500/30 rounded px-3 py-2">
+              {error}
+            </div>
+          )}
+        </div>
+
+        <DialogFooter className="gap-2 sm:justify-between">
+          {editing ? (
+            <Button
+              variant="ghost"
+              onClick={handleDelete}
+              disabled={deleting || saving}
+              className="text-red-400 hover:text-red-300 hover:bg-red-500/10"
+            >
+              <Trash2 className="h-4 w-4 mr-1.5" />
+              {t("apps.customLinkDelete")}
+            </Button>
+          ) : <div />}
+          <div className="flex gap-2">
+            <Button variant="ghost" onClick={() => onOpenChange(false)} disabled={saving}>
+              {t("apps.customLinkCancel")}
+            </Button>
+            <Button
+              onClick={handleSave}
+              disabled={!canSave}
+              className="bg-blue-500 hover:bg-blue-600 !text-white"
+            >
+              {editing ? t("apps.customLinkSave") : t("apps.customLinkCreate")}
+            </Button>
+          </div>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

AppImage/components/disk-temperature-card.tsx

@@ -0,0 +1,178 @@
+"use client"
+
+import { useEffect, useRef, useState } from "react"
+import { Thermometer } from "lucide-react"
+import { Badge } from "./ui/badge"
+import { AreaChart, Area, ResponsiveContainer, Tooltip, YAxis } from "recharts"
+import { fetchApi } from "@/lib/api-config"
+import { useDiskTempThresholds } from "@/lib/health-thresholds"
+import { useT } from "@/lib/i18n/provider"
+
+interface TempPoint {
+  timestamp: number
+  value: number
+}
+
+interface DiskTemperatureCardProps {
+  diskName: string
+  liveTemperature: number
+  /** Disk class — "HDD" | "SSD" | "NVMe" | "SAS". Drives the threshold colors. */
+  diskType: string
+  /** Click handler — opens the full timeframe-selector modal as drill-down. */
+  onOpenDetail?: () => void
+}
+
+// Disk-temperature thresholds come from the user-configurable backend
+// (lib/health-thresholds.ts). The classifier here takes the resolved
+// pair so the consumer can read it from the hook once per render.
+function statusFor(temp: number, thresholds: { warn: number; hot: number }) {
+  if (temp <= 0) return { labelKey: "common.notAvailable", className: "bg-gray-500/10 text-gray-500 border-gray-500/20", color: "#6b7280" }
+  if (temp >= thresholds.hot) return { labelKey: "details.temperature.status.hot", className: "bg-red-500/10 text-red-500 border-red-500/20", color: "#ef4444" }
+  if (temp >= thresholds.warn) return { labelKey: "details.temperature.status.warm", className: "bg-yellow-500/10 text-yellow-500 border-yellow-500/20", color: "#f59e0b" }
+  return { labelKey: "details.temperature.status.normal", className: "bg-green-500/10 text-green-500 border-green-500/20", color: "#22c55e" }
+}
+
+const MiniTooltip = ({ active, payload }: any) => {
+  if (active && payload && payload.length) {
+    const ts = payload[0].payload?.timestamp
+    const date = ts ? new Date(ts * 1000) : null
+    return (
+      <div className="bg-gray-900/95 backdrop-blur-sm border border-gray-700 rounded-md px-2 py-1 shadow-xl">
+        {date && (
+          <p className="text-[10px] text-gray-300">
+            {date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })}
+          </p>
+        )}
+        <p className="text-xs font-semibold text-white">{payload[0].value}°C</p>
+      </div>
+    )
+  }
+  return null
+}
+
+export function DiskTemperatureCard({
+  diskName,
+  liveTemperature,
+  diskType,
+  onOpenDetail,
+}: DiskTemperatureCardProps) {
+  const t = useT()
+  const [data, setData] = useState<TempPoint[]>([])
+  const [loading, setLoading] = useState(true)
+  const cancelled = useRef(false)
+
+  useEffect(() => {
+    cancelled.current = false
+    const fetchHistory = async () => {
+      setLoading(true)
+      try {
+        // 24-h timeframe gives a more useful "is this drive trending
+        // up over a day" view; the 1-h window was too short to spot
+        // anything that mattered.
+        const result = await fetchApi<{ data: TempPoint[] }>(
+          `/api/disk/${encodeURIComponent(diskName)}/temperature/history?timeframe=day`,
+        )
+        if (cancelled.current) return
+        setData(result?.data || [])
+      } catch {
+        if (!cancelled.current) setData([])
+      } finally {
+        if (!cancelled.current) setLoading(false)
+      }
+    }
+    fetchHistory()
+    // Refresh once a minute so the inline chart tracks the collector
+    // without needing the user to reopen the modal.
+    const id = setInterval(fetchHistory, 60_000)
+    return () => {
+      cancelled.current = true
+      clearInterval(id)
+    }
+  }, [diskName])
+
+  const allThresholds = useDiskTempThresholds()
+  const dt = (() => {
+    const t = (diskType || "").toUpperCase()
+    if (t === "HDD") return allThresholds.HDD
+    if (t === "NVME") return allThresholds.NVMe
+    if (t === "SAS") return allThresholds.SAS
+    return allThresholds.SSD
+  })()
+  const status = statusFor(liveTemperature, dt)
+  const lineColor = status.color
+  const tempDisplay = liveTemperature > 0 ? `${liveTemperature}°C` : t("common.notAvailable")
+  const samples = data.length
+
+  const interactive = !!onOpenDetail
+  const Wrapper: any = interactive ? "button" : "div"
+
+  return (
+    <Wrapper
+      type={interactive ? "button" : undefined}
+      onClick={interactive ? onOpenDetail : undefined}
+      className={[
+        "w-full text-left border border-white/10 rounded-lg p-3 bg-white/[0.02]",
+        interactive ? "cursor-pointer hover:bg-white/[0.04] transition-colors focus:outline-none focus:ring-1 focus:ring-white/20" : "",
+      ].join(" ")}
+      title={interactive ? t("details.temperature.openHistory") : undefined}
+    >
+      <div className="flex items-start justify-between gap-3 mb-1.5">
+        <div className="min-w-0">
+          <p className="text-[11px] uppercase tracking-wider text-muted-foreground">{t("details.temperature.diskTitle")}</p>
+          <p className="text-xl font-bold leading-tight mt-0.5" style={{ color: lineColor }}>
+            {tempDisplay}
+          </p>
+        </div>
+        <div className="flex flex-col items-end gap-1 flex-shrink-0">
+          <Thermometer className="h-3.5 w-3.5" style={{ color: lineColor }} />
+          <Badge variant="outline" className={`${status.className} text-[10px] px-2 py-0`}>
+            {t(status.labelKey)}
+          </Badge>
+        </div>
+      </div>
+
+      <div className="h-[40px] -mx-1">
+        {loading ? (
+          <div className="h-full w-full animate-pulse bg-white/[0.03] rounded" />
+        ) : samples < 2 ? (
+          <div className="h-full flex items-center justify-center text-[10px] text-muted-foreground">
+            {t("details.temperature.collectingSamples")}
+          </div>
+        ) : (
+          <ResponsiveContainer width="100%" height="100%">
+            <AreaChart data={data} margin={{ top: 2, right: 4, left: 4, bottom: 0 }}>
+              <defs>
+                <linearGradient id={`diskTempCardGrad-${diskName}`} x1="0" y1="0" x2="0" y2="1">
+                  <stop offset="0%" stopColor={lineColor} stopOpacity={0.35} />
+                  <stop offset="100%" stopColor={lineColor} stopOpacity={0.02} />
+                </linearGradient>
+              </defs>
+              {/* Y domain is computed the same way the detail modal
+                  does — floor(min−3) / ceil(max+3), floor at 0 — so
+                  the line shape here matches the bigger chart instead
+                  of recharts' auto-domain collapsing 24 → 29 °C into
+                  a near-flat line that doesn't look like the modal. */}
+              <YAxis
+                hide
+                domain={[
+                  (dataMin: number) => Math.max(0, Math.floor(dataMin - 3)),
+                  (dataMax: number) => Math.ceil(dataMax + 3),
+                ]}
+              />
+              <Tooltip content={<MiniTooltip />} cursor={{ stroke: lineColor, strokeOpacity: 0.3, strokeWidth: 1 }} />
+              <Area
+                type="monotone"
+                dataKey="value"
+                stroke={lineColor}
+                strokeWidth={1.6}
+                fill={`url(#diskTempCardGrad-${diskName})`}
+                dot={false}
+                isAnimationActive={false}
+              />
+            </AreaChart>
+          </ResponsiveContainer>
+        )}
+      </div>
+    </Wrapper>
+  )
+}

AppImage/components/disk-temperature-detail-modal.tsx

@@ -0,0 +1,269 @@
+"use client"
+
+import { useState, useEffect } from "react"
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "./ui/dialog"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
+import { Thermometer, TrendingDown, TrendingUp, Minus } from "lucide-react"
+import { AreaChart, Area, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContainer } from "recharts"
+import { useIsMobile } from "../hooks/use-mobile"
+import { fetchApi } from "@/lib/api-config"
+import { useDiskTempThresholds, type DiskTempThreshold } from "@/lib/health-thresholds"
+import { useT } from "@/lib/i18n/provider"
+
+const TIMEFRAME_OPTIONS = [
+  { value: "hour", labelKey: "details.temperature.timeframes.hour" },
+  { value: "day", labelKey: "details.temperature.timeframes.day" },
+  { value: "week", labelKey: "details.temperature.timeframes.week" },
+  { value: "month", labelKey: "details.temperature.timeframes.month" },
+]
+
+interface TempHistoryPoint {
+  timestamp: number
+  value: number
+  min?: number
+  max?: number
+}
+
+interface TempStats {
+  min: number
+  max: number
+  avg: number
+  current: number
+}
+
+interface DiskTemperatureDetailModalProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  diskName: string
+  diskModel?: string
+  liveTemperature?: number
+  diskType?: "HDD" | "SSD" | "NVMe" | "SAS" | string
+}
+
+const CustomTooltip = ({ active, payload, label }: any) => {
+  if (active && payload && payload.length) {
+    return (
+      <div className="bg-gray-900/95 backdrop-blur-sm border border-gray-700 rounded-lg p-3 shadow-xl">
+        <p className="text-sm font-semibold text-white mb-2">{label}</p>
+        <div className="space-y-1.5">
+          {payload.map((entry: any, index: number) => (
+            <div key={index} className="flex items-center gap-2">
+              <div className="w-2.5 h-2.5 rounded-full flex-shrink-0" style={{ backgroundColor: entry.color }} />
+              <span className="text-xs text-gray-300 min-w-[60px]">{entry.name}:</span>
+              <span className="text-sm font-semibold text-white">{entry.value}°C</span>
+            </div>
+          ))}
+        </div>
+      </div>
+    )
+  }
+  return null
+}
+
+// Per-disk-class thresholds come from the user-configurable backend
+// (lib/health-thresholds.ts), so the chart line color stays in sync
+// with whatever the user sets in Settings → Health Monitor Thresholds.
+function colorFor(temp: number, t: DiskTempThreshold): string {
+  if (temp >= t.hot) return "#ef4444"
+  if (temp >= t.warn) return "#f59e0b"
+  return "#22c55e"
+}
+
+function statusInfoFor(temp: number, t: DiskTempThreshold) {
+  if (temp <= 0) return { color: "bg-gray-500/10 text-gray-500 border-gray-500/20" }
+  if (temp >= t.hot) return { color: "bg-red-500/10 text-red-500 border-red-500/20" }
+  if (temp >= t.warn) return { color: "bg-yellow-500/10 text-yellow-500 border-yellow-500/20" }
+  return { color: "bg-green-500/10 text-green-500 border-green-500/20" }
+}
+
+export function DiskTemperatureDetailModal({
+  open,
+  onOpenChange,
+  diskName,
+  diskModel,
+  liveTemperature,
+  diskType,
+}: DiskTemperatureDetailModalProps) {
+  const t = useT()
+  const [timeframe, setTimeframe] = useState("day")
+  const [data, setData] = useState<TempHistoryPoint[]>([])
+  const [stats, setStats] = useState<TempStats>({ min: 0, max: 0, avg: 0, current: 0 })
+  const [loading, setLoading] = useState(true)
+  const isMobile = useIsMobile()
+
+  useEffect(() => {
+    if (open && diskName) {
+      fetchHistory()
+    }
+  }, [open, timeframe, diskName])
+
+  const fetchHistory = async () => {
+    setLoading(true)
+    try {
+      const result = await fetchApi<{ data: TempHistoryPoint[]; stats: TempStats }>(
+        `/api/disk/${encodeURIComponent(diskName)}/temperature/history?timeframe=${timeframe}`,
+      )
+      if (result && result.data) {
+        setData(result.data)
+        setStats(result.stats)
+      } else {
+        setData([])
+        setStats({ min: 0, max: 0, avg: 0, current: 0 })
+      }
+    } catch (err) {
+      console.error("[ProxMenux] Failed to fetch disk temperature history:", err)
+      setData([])
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  const formatTime = (timestamp: number) => {
+    const date = new Date(timestamp * 1000)
+    if (timeframe === "hour" || timeframe === "day") {
+      return date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })
+    }
+    return date.toLocaleDateString([], { month: "short", day: "numeric", hour: "2-digit", minute: "2-digit" })
+  }
+
+  const chartData = data.map((d) => ({ ...d, time: formatTime(d.timestamp) }))
+
+  const currentTemp = liveTemperature && liveTemperature > 0 ? Math.round(liveTemperature * 10) / 10 : stats.current
+  const allThresholds = useDiskTempThresholds()
+  const dt: DiskTempThreshold = (() => {
+    const t = (diskType || "").toUpperCase()
+    if (t === "HDD") return allThresholds.HDD
+    if (t === "NVME") return allThresholds.NVMe
+    if (t === "SAS") return allThresholds.SAS
+    return allThresholds.SSD
+  })()
+  const chartColor = colorFor(currentTemp, dt)
+  const currentStatus = statusInfoFor(currentTemp, dt)
+
+  const values = data.map((d) => d.value)
+  const yMin = values.length > 0 ? Math.max(0, Math.floor(Math.min(...values) - 3)) : 0
+  const yMax = values.length > 0 ? Math.ceil(Math.max(...values) + 3) : 100
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-3xl bg-card border-border px-3 sm:px-6">
+        <DialogHeader>
+          {/*
+            Header layout mirrors temperature-detail-modal exactly so the
+            mobile breakpoints behave the same. Earlier we tried to inline
+            the model name in the DialogTitle, but the long WD/Samsung
+            strings broke `truncate` and pushed the dialog past the
+            viewport — clipping the timeframe selector and the right two
+            stat cards. Keeping the title short and parking the model in
+            a second line (DialogDescription) lets the standard mobile
+            grid render correctly.
+          */}
+          <div className="flex items-center justify-between pr-6">
+            <DialogTitle className="text-foreground flex items-center gap-2">
+              <Thermometer className="h-5 w-5" />
+              /dev/{diskName}
+            </DialogTitle>
+            <Select value={timeframe} onValueChange={setTimeframe}>
+              <SelectTrigger className="w-[130px] bg-card border-border">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {TIMEFRAME_OPTIONS.map((opt) => (
+                  <SelectItem key={opt.value} value={opt.value}>
+                    {t(opt.labelKey)}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+          {diskModel && (
+            <p className="text-xs text-muted-foreground truncate pr-6 mt-0.5">{diskModel}</p>
+          )}
+        </DialogHeader>
+
+        <div className="grid grid-cols-2 sm:grid-cols-4 gap-2 sm:gap-3">
+          <div className={`rounded-lg p-3 text-center border ${currentStatus.color}`}>
+            <div className="text-xs opacity-80 mb-1">{t("details.temperature.current")}</div>
+            <div className="text-lg font-bold">{currentTemp > 0 ? `${currentTemp}°C` : t("common.notAvailable")}</div>
+          </div>
+          <div className="bg-muted/50 rounded-lg p-3 text-center">
+            <div className="text-xs text-muted-foreground mb-1 flex items-center justify-center gap-1">
+              <TrendingDown className="h-3 w-3" /> {t("details.temperature.min")}
+            </div>
+            <div className="text-lg font-bold text-green-500">{stats.min}°C</div>
+          </div>
+          <div className="bg-muted/50 rounded-lg p-3 text-center">
+            <div className="text-xs text-muted-foreground mb-1 flex items-center justify-center gap-1">
+              <Minus className="h-3 w-3" /> {t("details.temperature.avg")}
+            </div>
+            <div className="text-lg font-bold text-foreground">{stats.avg}°C</div>
+          </div>
+          <div className="bg-muted/50 rounded-lg p-3 text-center">
+            <div className="text-xs text-muted-foreground mb-1 flex items-center justify-center gap-1">
+              <TrendingUp className="h-3 w-3" /> {t("details.temperature.max")}
+            </div>
+            <div className="text-lg font-bold text-red-500">{stats.max}°C</div>
+          </div>
+        </div>
+
+        <div className="h-[300px] lg:h-[350px]">
+          {loading ? (
+            <div className="h-full flex items-center justify-center">
+              <div className="space-y-3 w-full animate-pulse">
+                <div className="h-4 bg-muted rounded w-1/4 mx-auto" />
+                <div className="h-[250px] bg-muted/50 rounded" />
+              </div>
+            </div>
+          ) : chartData.length === 0 ? (
+            <div className="h-full flex items-center justify-center text-muted-foreground">
+              <div className="text-center">
+                <Thermometer className="h-8 w-8 mx-auto mb-2 opacity-50" />
+                <p>{t("details.temperature.noData")}</p>
+                <p className="text-sm mt-1">{t("details.temperature.sampleInterval")}</p>
+              </div>
+            </div>
+          ) : (
+            <ResponsiveContainer width="100%" height="100%">
+              <AreaChart data={chartData} margin={{ top: 10, right: 10, left: 0, bottom: 0 }}>
+                <defs>
+                  <linearGradient id={`diskTempGradient-${diskName}`} x1="0" y1="0" x2="0" y2="1">
+                    <stop offset="0%" stopColor={chartColor} stopOpacity={0.3} />
+                    <stop offset="100%" stopColor={chartColor} stopOpacity={0.02} />
+                  </linearGradient>
+                </defs>
+                <CartesianGrid strokeDasharray="3 3" stroke="currentColor" className="text-border" />
+                <XAxis
+                  dataKey="time"
+                  stroke="currentColor"
+                  className="text-foreground"
+                  tick={{ fill: "currentColor", fontSize: isMobile ? 10 : 12 }}
+                  interval="preserveStartEnd"
+                  minTickGap={isMobile ? 40 : 60}
+                />
+                <YAxis
+                  domain={[yMin, yMax]}
+                  stroke="currentColor"
+                  className="text-foreground"
+                  tick={{ fill: "currentColor", fontSize: isMobile ? 10 : 12 }}
+                  tickFormatter={(v) => `${v}°`}
+                  width={isMobile ? 40 : 45}
+                />
+                <Tooltip content={<CustomTooltip />} />
+                <Area
+                  type="monotone"
+                  dataKey="value"
+                  name={t("details.temperature.seriesName")}
+                  stroke={chartColor}
+                  strokeWidth={2}
+                  fill={`url(#diskTempGradient-${diskName})`}
+                  dot={false}
+                  activeDot={{ r: 4, fill: chartColor, stroke: "#fff", strokeWidth: 2 }}
+                />
+              </AreaChart>
+            </ResponsiveContainer>
+          )}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}

AppImage/components/gpu-switch-mode-indicator.tsx

@@ -0,0 +1,417 @@
+"use client"
+
+import { cn } from "@/lib/utils"
+import { useT } from "../lib/i18n/provider"
+
+interface SriovInfo {
+  role: "vf" | "pf-active" | "pf-idle"
+  physfn?: string   // VF only: parent PF BDF
+  vfCount?: number  // PF only: active VF count
+  totalvfs?: number // PF only: maximum VFs
+}
+
+interface GpuSwitchModeIndicatorProps {
+  mode: "lxc" | "vm" | "sriov" | "unknown"
+  isEditing?: boolean
+  pendingMode?: "lxc" | "vm" | null
+  onToggle?: (e: React.MouseEvent) => void
+  className?: string
+  sriovInfo?: SriovInfo
+}
+
+export function GpuSwitchModeIndicator({
+  mode,
+  isEditing = false,
+  pendingMode = null,
+  onToggle,
+  className,
+  sriovInfo,
+}: GpuSwitchModeIndicatorProps) {
+  const t = useT()
+
+  // SR-IOV is a non-editable hardware state. Pending toggles don't apply here.
+  const displayMode = mode === "sriov" ? "sriov" : (pendingMode ?? mode)
+  const isLxcActive = displayMode === "lxc"
+  const isVmActive = displayMode === "vm"
+  const isSriovActive = displayMode === "sriov"
+  const hasChanged =
+    mode !== "sriov" && pendingMode !== null && pendingMode !== mode
+
+  // Colors
+  const sriovColor = "#14b8a6" // teal-500
+  const activeColor = isSriovActive
+    ? sriovColor
+    : isLxcActive
+      ? "#3b82f6"
+      : isVmActive
+        ? "#a855f7"
+        : "#6b7280"
+  const inactiveColor = "#374151" // gray-700 for dark theme
+  const dimmedColor = "#4b5563"   // gray-600 for dashed SR-IOV branches
+  const lxcColor = isLxcActive ? "#3b82f6" : inactiveColor
+  const vmColor = isVmActive ? "#a855f7" : inactiveColor
+
+  const handleClick = (e: React.MouseEvent) => {
+    // SR-IOV state can't be toggled — swallow the click so it doesn't reach
+    // the card (which would open the detail modal unexpectedly from this
+    // area). For lxc/vm, preserve the original behavior.
+    if (isSriovActive) {
+      e.stopPropagation()
+      return
+    }
+    if (isEditing) {
+      e.stopPropagation()
+      if (onToggle) {
+        onToggle(e)
+      }
+    }
+    // When not editing, let the click propagate to the card to open the modal
+  }
+
+  // Build the VF count label shown in the SR-IOV badge. For PFs we know
+  // exactly how many VFs are active; for a VF we show its parent PF.
+  const sriovBadgeText = (() => {
+    if (!isSriovActive) return ""
+    if (sriovInfo?.role === "vf") return t("hardware.gpuSwitch.sriovVf")
+    if (sriovInfo?.vfCount && sriovInfo.vfCount > 0) {
+      return t("hardware.gpuSwitch.sriovCount", { count: sriovInfo.vfCount })
+    }
+    return t("hardware.gpuSwitch.sriov")
+  })()
+
+  return (
+    <div
+      className={cn(
+        // On very narrow containers (mobile, narrow modal), stack the SVG
+        // above the status text so the 224px-wide SVG doesn't squeeze the
+        // text into a 2-character-wide column. At sm+ we go back to the
+        // original side-by-side layout.
+        "flex flex-col items-start gap-3 sm:flex-row sm:items-center sm:gap-6",
+        isEditing && !isSriovActive && "cursor-pointer",
+        className
+      )}
+      onClick={handleClick}
+    >
+      {/* Large SVG Diagram */}
+      <svg
+        viewBox="0 0 220 100"
+        className="h-24 w-56 flex-shrink-0"
+        xmlns="http://www.w3.org/2000/svg"
+      >
+        {/* GPU Chip - Large with "GPU" text */}
+        <g transform="translate(0, 22)">
+          {/* Main chip body */}
+          <rect
+            x="4"
+            y="8"
+            width="44"
+            height="36"
+            rx="6"
+            fill={`${activeColor}20`}
+            stroke={activeColor}
+            strokeWidth="2.5"
+            className="transition-all duration-300"
+          />
+          {/* Chip pins - top */}
+          <line x1="14" y1="2" x2="14" y2="8" stroke={activeColor} strokeWidth="2.5" strokeLinecap="round" className="transition-all duration-300" />
+          <line x1="26" y1="2" x2="26" y2="8" stroke={activeColor} strokeWidth="2.5" strokeLinecap="round" className="transition-all duration-300" />
+          <line x1="38" y1="2" x2="38" y2="8" stroke={activeColor} strokeWidth="2.5" strokeLinecap="round" className="transition-all duration-300" />
+          {/* Chip pins - bottom */}
+          <line x1="14" y1="44" x2="14" y2="50" stroke={activeColor} strokeWidth="2.5" strokeLinecap="round" className="transition-all duration-300" />
+          <line x1="26" y1="44" x2="26" y2="50" stroke={activeColor} strokeWidth="2.5" strokeLinecap="round" className="transition-all duration-300" />
+          <line x1="38" y1="44" x2="38" y2="50" stroke={activeColor} strokeWidth="2.5" strokeLinecap="round" className="transition-all duration-300" />
+          {/* GPU text */}
+          <text
+            x="26"
+            y="32"
+            textAnchor="middle"
+            fill={activeColor}
+            className="text-[14px] font-bold transition-all duration-300"
+            style={{ fontFamily: 'system-ui, sans-serif' }}
+          >
+            {t("hardware.gpuSwitch.gpu")}
+          </text>
+        </g>
+
+        {/* Connection line from GPU to switch */}
+        <line
+          x1="52"
+          y1="50"
+          x2="78"
+          y2="50"
+          stroke={activeColor}
+          strokeWidth="3"
+          strokeLinecap="round"
+          className="transition-all duration-300"
+        />
+
+        {/* Central Switch Node - Large circle with inner dot */}
+        <circle
+          cx="95"
+          cy="50"
+          r="14"
+          fill={isEditing && !isSriovActive ? "#f59e0b20" : `${activeColor}20`}
+          stroke={isEditing && !isSriovActive ? "#f59e0b" : activeColor}
+          strokeWidth="3"
+          className="transition-all duration-300"
+        />
+        <circle
+          cx="95"
+          cy="50"
+          r="6"
+          fill={isEditing && !isSriovActive ? "#f59e0b" : activeColor}
+          className="transition-all duration-300"
+        />
+
+        {/* LXC Branch Line - going up-right.
+            In SR-IOV mode the branch is dashed + dimmed to show that the
+            target is theoretically reachable via a VF but not controlled
+            by ProxMenux. */}
+        <path
+          d="M 109 42 L 135 20"
+          fill="none"
+          stroke={isSriovActive ? dimmedColor : lxcColor}
+          strokeWidth={isLxcActive ? "3.5" : "2"}
+          strokeLinecap="round"
+          strokeDasharray={isSriovActive ? "3 3" : undefined}
+          className="transition-all duration-300"
+        />
+
+        {/* VM Branch Line - going down-right (dashed/dimmed in SR-IOV). */}
+        <path
+          d="M 109 58 L 135 80"
+          fill="none"
+          stroke={isSriovActive ? dimmedColor : vmColor}
+          strokeWidth={isVmActive ? "3.5" : "2"}
+          strokeLinecap="round"
+          strokeDasharray={isSriovActive ? "3 3" : undefined}
+          className="transition-all duration-300"
+        />
+
+        {/* SR-IOV in-line connector + badge (only when mode === 'sriov').
+            A horizontal line from the switch node leads to a pill-shaped
+            badge carrying the "SR-IOV ×N" label. Placed on the GPU's
+            baseline to visually read as an in-line extension, not as a
+            third branch. */}
+        {isSriovActive && (
+          <>
+            <line
+              x1="109"
+              y1="50"
+              x2="130"
+              y2="50"
+              stroke={sriovColor}
+              strokeWidth="3"
+              strokeLinecap="round"
+              className="transition-all duration-300"
+            />
+            <rect
+              x="132"
+              y="40"
+              width="60"
+              height="20"
+              rx="10"
+              fill={`${sriovColor}25`}
+              stroke={sriovColor}
+              strokeWidth="2"
+              className="transition-all duration-300"
+            />
+            <text
+              x="162"
+              y="54"
+              textAnchor="middle"
+              fill={sriovColor}
+              className="text-[11px] font-bold transition-all duration-300"
+              style={{ fontFamily: 'system-ui, sans-serif' }}
+            >
+              {sriovBadgeText}
+            </text>
+          </>
+        )}
+
+        {/* LXC Container Icon - dimmed/smaller in SR-IOV mode. */}
+        {!isSriovActive && (
+          <g transform="translate(138, 2)">
+            <rect
+              x="0"
+              y="0"
+              width="32"
+              height="28"
+              rx="4"
+              fill={isLxcActive ? `${lxcColor}25` : "transparent"}
+              stroke={lxcColor}
+              strokeWidth={isLxcActive ? "2.5" : "1.5"}
+              className="transition-all duration-300"
+            />
+            <line x1="0" y1="10" x2="32" y2="10" stroke={lxcColor} strokeWidth={isLxcActive ? "1.5" : "1"} className="transition-all duration-300" />
+            <line x1="0" y1="19" x2="32" y2="19" stroke={lxcColor} strokeWidth={isLxcActive ? "1.5" : "1"} className="transition-all duration-300" />
+            <circle cx="7" cy="5" r="2" fill={lxcColor} className="transition-all duration-300" />
+            <circle cx="7" cy="14.5" r="2" fill={lxcColor} className="transition-all duration-300" />
+            <circle cx="7" cy="23.5" r="2" fill={lxcColor} className="transition-all duration-300" />
+          </g>
+        )}
+        {/* SR-IOV: compact dimmed LXC glyph so the geometry stays recognizable
+            but it's clearly not the active target. */}
+        {isSriovActive && (
+          <g transform="translate(138, 6)" opacity="0.35">
+            <rect x="0" y="0" width="20" height="18" rx="3" fill="transparent" stroke={dimmedColor} strokeWidth="1.5" />
+            <line x1="0" y1="6" x2="20" y2="6" stroke={dimmedColor} strokeWidth="1" />
+            <line x1="0" y1="12" x2="20" y2="12" stroke={dimmedColor} strokeWidth="1" />
+          </g>
+        )}
+
+        {/* LXC Label */}
+        {!isSriovActive && (
+          <text
+            x="188"
+            y="22"
+            textAnchor="start"
+            fill={lxcColor}
+            className={cn(
+              "transition-all duration-300",
+              isLxcActive ? "text-[14px] font-bold" : "text-[12px] font-medium"
+            )}
+            style={{ fontFamily: 'system-ui, sans-serif' }}
+          >
+            {t("hardware.gpuSwitch.lxc")}
+          </text>
+        )}
+        {isSriovActive && (
+          <text
+            x="162"
+            y="16"
+            fill={dimmedColor}
+            className="text-[9px] font-medium"
+            style={{ fontFamily: 'system-ui, sans-serif' }}
+          >
+            {t("hardware.gpuSwitch.lxc")}
+          </text>
+        )}
+
+        {/* VM Monitor Icon - active view */}
+        {!isSriovActive && (
+          <g transform="translate(138, 65)">
+            <rect
+              x="2"
+              y="0"
+              width="28"
+              height="18"
+              rx="3"
+              fill={isVmActive ? `${vmColor}25` : "transparent"}
+              stroke={vmColor}
+              strokeWidth={isVmActive ? "2.5" : "1.5"}
+              className="transition-all duration-300"
+            />
+            <rect
+              x="5"
+              y="3"
+              width="22"
+              height="12"
+              rx="1"
+              fill={isVmActive ? `${vmColor}30` : `${vmColor}10`}
+              className="transition-all duration-300"
+            />
+            <line x1="16" y1="18" x2="16" y2="24" stroke={vmColor} strokeWidth={isVmActive ? "2.5" : "1.5"} strokeLinecap="round" className="transition-all duration-300" />
+            <line x1="8" y1="24" x2="24" y2="24" stroke={vmColor} strokeWidth={isVmActive ? "2.5" : "1.5"} strokeLinecap="round" className="transition-all duration-300" />
+          </g>
+        )}
+        {/* SR-IOV: compact dimmed VM monitor glyph, mirror of the LXC glyph. */}
+        {isSriovActive && (
+          <g transform="translate(138, 72)" opacity="0.35">
+            <rect x="0" y="0" width="20" height="13" rx="2" fill="transparent" stroke={dimmedColor} strokeWidth="1.5" />
+            <line x1="10" y1="13" x2="10" y2="17" stroke={dimmedColor} strokeWidth="1.5" strokeLinecap="round" />
+            <line x1="5" y1="17" x2="15" y2="17" stroke={dimmedColor} strokeWidth="1.5" strokeLinecap="round" />
+          </g>
+        )}
+
+        {/* VM Label */}
+        {!isSriovActive && (
+          <text
+            x="188"
+            y="84"
+            textAnchor="start"
+            fill={vmColor}
+            className={cn(
+              "transition-all duration-300",
+              isVmActive ? "text-[14px] font-bold" : "text-[12px] font-medium"
+            )}
+            style={{ fontFamily: 'system-ui, sans-serif' }}
+          >
+            {t("hardware.gpuSwitch.vm")}
+          </text>
+        )}
+        {isSriovActive && (
+          <text
+            x="162"
+            y="82"
+            fill={dimmedColor}
+            className="text-[9px] font-medium"
+            style={{ fontFamily: 'system-ui, sans-serif' }}
+          >
+            {t("hardware.gpuSwitch.vm")}
+          </text>
+        )}
+      </svg>
+
+      {/* Status Text - Large like GPU name */}
+      <div className="flex flex-col gap-1 min-w-0 flex-1">
+        <span
+          className={cn(
+            "text-base font-semibold transition-all duration-300",
+            isSriovActive
+              ? "text-teal-500"
+              : isLxcActive
+                ? "text-blue-500"
+                : isVmActive
+                  ? "text-purple-500"
+                  : "text-muted-foreground"
+          )}
+        >
+          {isSriovActive
+            ? t("hardware.gpuSwitch.sriovActive")
+            : isLxcActive
+              ? t("hardware.gpuSwitch.readyForLxc")
+              : isVmActive
+                ? t("hardware.gpuSwitch.readyForVm")
+                : t("hardware.gpuSwitch.modeUnknown")}
+        </span>
+        <span className="text-sm text-muted-foreground">
+          {isSriovActive
+            ? t("hardware.gpuSwitch.virtualFunctionsExternal")
+            : isLxcActive
+              ? t("hardware.gpuSwitch.nativeDriverActive")
+              : isVmActive
+                ? t("hardware.gpuSwitch.vfioDriverActive")
+                : t("hardware.gpuSwitch.noDriverDetected")}
+        </span>
+        {isSriovActive && sriovInfo && (
+          <span className="text-xs font-mono text-teal-600/80 dark:text-teal-400/80">
+            {sriovInfo.role === "vf"
+              ? t(
+                  sriovInfo.physfn
+                    ? "hardware.gpuSwitch.virtualFunctionWithParent"
+                    : "hardware.gpuSwitch.virtualFunction",
+                  { parent: sriovInfo.physfn || "" },
+                )
+              : sriovInfo.vfCount !== undefined
+                ? t(
+                    sriovInfo.totalvfs
+                      ? "hardware.gpuSwitch.physicalFunctionWithMax"
+                      : "hardware.gpuSwitch.physicalFunction",
+                    {
+                      count: sriovInfo.vfCount,
+                      max: sriovInfo.totalvfs || "",
+                    },
+                  )
+                : null}
+          </span>
+        )}
+        {hasChanged && (
+          <span className="text-sm text-amber-500 font-medium animate-pulse">
+            {t("hardware.gpuSwitch.changePending")}
+          </span>
+        )}
+      </div>
+    </div>
+  )
+}

AppImage/components/health-thresholds.tsx

@@ -0,0 +1,871 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card"
+import { Input } from "./ui/input"
+import {
+  SlidersHorizontal,
+  Cpu,
+  MemoryStick,
+  HardDrive,
+  Server,
+  Thermometer,
+  Settings2,
+  Check,
+  Loader2,
+  RotateCcw,
+  AlertCircle,
+  FolderOpen,
+  Database,
+  Waves,
+} from "lucide-react"
+import { getApiUrl, getAuthToken } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+
+// Local fetch wrapper that *preserves* the JSON body on non-2xx
+// responses so we can surface backend validation messages
+// (e.g. "critical must be >= warning") to the user. The shared
+// `fetchApi` throws a generic "API request failed: 400" on any
+// non-OK response, eating the body.
+async function fetchJson<T>(endpoint: string, init?: RequestInit): Promise<T> {
+  const token = getAuthToken()
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    ...((init?.headers as Record<string, string>) || {}),
+  }
+  if (token) headers["Authorization"] = `Bearer ${token}`
+  const res = await fetch(getApiUrl(endpoint), {
+    ...init,
+    headers,
+    cache: "no-store",
+  })
+  let data: any = null
+  try {
+    data = await res.json()
+  } catch {
+    // empty body — fall through with raw status
+  }
+  if (!res.ok) {
+    if (res.status === 401 && typeof window !== "undefined") {
+      try {
+        localStorage.removeItem("proxmenux-auth-token")
+      } catch {}
+      const path = window.location.pathname
+      if (!path.startsWith("/auth") && !path.startsWith("/login")) {
+        window.location.assign("/")
+      }
+    }
+    const msg =
+      (data && (data.message || data.error)) ||
+      `${res.status} ${res.statusText}`
+    throw new Error(msg)
+  }
+  return data as T
+}
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+//
+// The backend returns a tree of leaves. Each leaf carries the metadata
+// the UI needs to render an input + the recommended/customised flags.
+// We mirror the shape rather than hand-coding it to keep the contract
+// in one place — the backend is the source of truth.
+interface ThresholdLeaf {
+  value: number
+  recommended: number
+  customised: boolean
+  unit: string
+  min: number
+  max: number
+  step: number
+}
+
+interface ThresholdsTree {
+  cpu: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+  memory: { warning: ThresholdLeaf; critical: ThresholdLeaf; swap_high: ThresholdLeaf; available_min: ThresholdLeaf }
+  host_storage: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+  lxc_rootfs: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+  cpu_temperature: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+  disk_temperature: {
+    hdd: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+    ssd: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+    nvme: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+    sas: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+  }
+  // Phase 3 additions
+  lxc_mount: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+  pve_storage: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+  zfs_pool: { warning: ThresholdLeaf; critical: ThresholdLeaf }
+}
+
+// Pending edits: { "section/key" : "76" } — kept as raw strings while
+// the user types so partial input ("8" mid-type) doesn't fail the
+// numeric coercion. Coerced + validated on Save.
+type PendingEdits = Record<string, string>
+
+// ─── Section descriptors ─────────────────────────────────────────────────────
+//
+// Drives both the render order and the labels. Keeping it data-only
+// means adding a new section later (Phase 4) is one entry, not a JSX
+// surgery.
+interface SectionField {
+  // Path in the thresholds tree, e.g. ["cpu", "warning"] or
+  // ["disk_temperature", "nvme", "critical"].
+  path: string[]
+  label: string
+}
+
+interface SectionDef {
+  id: string         // Backend section key — used by the reset endpoint
+  title: string
+  icon: React.ComponentType<{ className?: string }>
+  description?: string
+  fields: SectionField[]
+  // For tabular sections (disk temperature) we group by sub-key. When
+  // present, fields are rendered in a 2-column grid (warning, critical)
+  // labelled by sub-key (HDD / SSD / NVMe / SAS).
+  rowGroups?: Array<{ subKey: string; label: string }>
+}
+
+// Order: compute → heat → storage capacity. Reading top-to-bottom
+// flows naturally with no domain jumps:
+//   • Compute (CPU usage, RAM/Swap)
+//   • Heat (CPU temp, then disk temp — both °C)
+//   • Storage capacity (host → LXC rootfs → LXC mounts → PVE → ZFS,
+//     i.e. concrete to abstract)
+const SECTIONS: SectionDef[] = [
+  // ── Compute ─────────────────────────────────────────────────────
+  {
+    id: "cpu",
+    title: "CPU usage",
+    icon: Cpu,
+    fields: [
+      { path: ["cpu", "warning"], label: "Warning" },
+      { path: ["cpu", "critical"], label: "Critical" },
+    ],
+  },
+  {
+    id: "memory",
+    title: "Memory & Swap",
+    icon: MemoryStick,
+    fields: [
+      { path: ["memory", "warning"], label: "Memory warning" },
+      { path: ["memory", "critical"], label: "Memory critical" },
+      { path: ["memory", "swap_high"], label: "Swap high" },
+      { path: ["memory", "available_min"], label: "Memory available minimum" },
+    ],
+  },
+  // ── Heat ────────────────────────────────────────────────────────
+  {
+    id: "cpu_temperature",
+    title: "CPU temperature",
+    icon: Thermometer,
+    fields: [
+      { path: ["cpu_temperature", "warning"], label: "Warning" },
+      { path: ["cpu_temperature", "critical"], label: "Critical" },
+    ],
+  },
+  {
+    id: "disk_temperature",
+    title: "Disk temperature",
+    icon: Thermometer,
+    description:
+      "Per-class thresholds. Same units (°C) — different defaults because each class tolerates a different envelope.",
+    rowGroups: [
+      { subKey: "hdd", label: "HDD" },
+      { subKey: "ssd", label: "SSD" },
+      { subKey: "nvme", label: "NVMe" },
+      { subKey: "sas", label: "SAS" },
+    ],
+    // For row-group sections, `fields` is unused — we generate per-row
+    // path lookups from the rowGroups + a hardcoded ["warning","critical"].
+    fields: [],
+  },
+  // ── Storage capacity ────────────────────────────────────────────
+  {
+    id: "host_storage",
+    title: "Disk space — host",
+    icon: HardDrive,
+    description: "Applies to / and every mountpoint under /var/lib/vz, /mnt/* etc.",
+    fields: [
+      { path: ["host_storage", "warning"], label: "Warning" },
+      { path: ["host_storage", "critical"], label: "Critical" },
+    ],
+  },
+  {
+    id: "lxc_rootfs",
+    title: "Disk space — LXC rootfs",
+    icon: Server,
+    description: "Per-container root disk, evaluated against the rootfs size from PVE.",
+    fields: [
+      { path: ["lxc_rootfs", "warning"], label: "Warning" },
+      { path: ["lxc_rootfs", "critical"], label: "Critical" },
+    ],
+  },
+  {
+    id: "lxc_mount",
+    title: "LXC mount points",
+    icon: FolderOpen,
+    description:
+      "Capacity of mountpoints inside running CTs (mp0, mp1, NFS, bind mounts). Excludes the rootfs — that's covered above.",
+    fields: [
+      { path: ["lxc_mount", "warning"], label: "Warning" },
+      { path: ["lxc_mount", "critical"], label: "Critical" },
+    ],
+  },
+  {
+    id: "pve_storage",
+    title: "PVE storage capacity",
+    icon: Database,
+    description:
+      "Block-style PVE storages: LVM, LVM-thin, ZFS-pool, RBD/Ceph, PBS. Filesystem-style (dir/nfs/cifs) is already covered by host disk thresholds.",
+    fields: [
+      { path: ["pve_storage", "warning"], label: "Warning" },
+      { path: ["pve_storage", "critical"], label: "Critical" },
+    ],
+  },
+  {
+    id: "zfs_pool",
+    title: "ZFS pool capacity",
+    icon: Waves,
+    description:
+      "ZFS pools at the host level — independent of PVE registration so rpool and dedicated backup pools are also monitored.",
+    fields: [
+      { path: ["zfs_pool", "warning"], label: "Warning" },
+      { path: ["zfs_pool", "critical"], label: "Critical" },
+    ],
+  },
+]
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+function getLeaf(tree: ThresholdsTree | null, path: string[]): ThresholdLeaf | null {
+  if (!tree) return null
+  let node: any = tree
+  for (const p of path) {
+    if (node == null || typeof node !== "object") return null
+    node = node[p]
+  }
+  return node as ThresholdLeaf | null
+}
+
+function pathKey(path: string[]): string {
+  return path.join("/")
+}
+
+// Trim the visible slider range to a window around the saved +
+// recommended values so the track has usable resolution (e.g. CPU
+// 60–100 instead of the backend's 0–100). Derived from stable inputs
+// so the range does NOT shift under an active drag.
+function computeVisualRange(
+  values: number[],
+  backendMin: number,
+  backendMax: number,
+  step: number,
+): { min: number; max: number } {
+  const totalRange = Math.max(1, backendMax - backendMin)
+  // Margin ≈ 25% of total range, clamped to at least 5 steps so tiny
+  // step sizes (e.g. step=1 on 0–100) still get a usable window.
+  const rawMargin = Math.max(step * 5, Math.round(totalRange * 0.25))
+  const lo = Math.min(...values)
+  const hi = Math.max(...values)
+  const snap = (n: number) => Math.round(n / step) * step
+  let visMin = Math.max(backendMin, snap(lo - rawMargin))
+  let visMax = Math.min(backendMax, snap(hi + rawMargin))
+  // Ensure the window is at least 4 steps wide so the slider has
+  // room to move even if all inputs collapse to one value.
+  if (visMax - visMin < step * 4) {
+    const mid = (visMax + visMin) / 2
+    visMin = Math.max(backendMin, snap(mid - step * 2))
+    visMax = Math.min(backendMax, snap(mid + step * 2))
+  }
+  return { min: visMin, max: visMax }
+}
+
+// ─── Component ───────────────────────────────────────────────────────────────
+
+export function HealthThresholds() {
+  const t = useT()
+  const tFallback = (key: string, fallback: string) => {
+    const translated = t(key)
+    return translated === key ? fallback : translated
+  }
+  const [tree, setTree] = useState<ThresholdsTree | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [editMode, setEditMode] = useState(false)
+  const [saving, setSaving] = useState(false)
+  const [savedFlash, setSavedFlash] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [pending, setPending] = useState<PendingEdits>({})
+
+  // Load on mount + auto-refresh after each save
+  const fetchTree = async () => {
+    try {
+      setLoading(true)
+      const res = await fetchJson<{ success: boolean; thresholds: ThresholdsTree }>(
+        "/api/health/thresholds",
+      )
+      if (res?.success && res.thresholds) setTree(res.thresholds)
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("settings.healthThresholds.loadFailed"))
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    fetchTree()
+  }, [])
+
+  const hasPendingChanges = Object.keys(pending).length > 0
+
+  // Build the partial payload from pending. Any blank or unparseable
+  // entry is skipped — the backend will reject anything malformed
+  // anyway, but we want to fail fast on the UI side too.
+  const buildPayload = (): Record<string, any> | null => {
+    const payload: Record<string, any> = {}
+    for (const [key, raw] of Object.entries(pending)) {
+      const parts = key.split("/")
+      const trimmed = raw.trim()
+      if (trimmed === "") continue
+      const num = Number(trimmed)
+      if (!isFinite(num)) {
+        setError(t("settings.healthThresholds.invalidValue", { key }))
+        return null
+      }
+      // Walk into payload mirroring the path
+      let cur: any = payload
+      for (let i = 0; i < parts.length - 1; i++) {
+        cur[parts[i]] = cur[parts[i]] || {}
+        cur = cur[parts[i]]
+      }
+      cur[parts[parts.length - 1]] = num
+    }
+    return payload
+  }
+
+  const handleEdit = () => {
+    setEditMode(true)
+    setError(null)
+  }
+
+  const handleCancel = () => {
+    setEditMode(false)
+    setPending({})
+    setError(null)
+  }
+
+  const handleSave = async () => {
+    const payload = buildPayload()
+    if (payload === null) return
+    if (Object.keys(payload).length === 0) {
+      setEditMode(false)
+      return
+    }
+    try {
+      setSaving(true)
+      setError(null)
+      const data = await fetchJson<{ success: boolean; thresholds: ThresholdsTree; message?: string }>(
+        "/api/health/thresholds",
+        { method: "PUT", body: JSON.stringify(payload) },
+      )
+      if (!data.success || !data.thresholds) {
+        setError(data.message || t("status.saveFailed"))
+        return
+      }
+      setTree(data.thresholds)
+      setPending({})
+      setEditMode(false)
+      setSavedFlash(true)
+      setTimeout(() => setSavedFlash(false), 2000)
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("status.networkErrorWhileSaving"))
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const handleResetSection = async (sectionId: string) => {
+    const section = SECTIONS.find((s) => s.id === sectionId)
+    const sectionTitle = section ? tFallback(`settings.healthThresholds.sections.${section.id}.title`, section.title) : sectionId
+    if (!confirm(t("settings.healthThresholds.resetSectionConfirm", { section: sectionTitle })))
+      return
+    try {
+      const data = await fetchJson<{ success: boolean; thresholds: ThresholdsTree; message?: string }>(
+        `/api/health/thresholds/reset?section=${encodeURIComponent(sectionId)}`,
+        { method: "POST" },
+      )
+      if (!data.success || !data.thresholds) {
+        setError(data.message || t("settings.healthThresholds.resetFailed"))
+        return
+      }
+      setTree(data.thresholds)
+      // Drop any pending edits within this section so the UI stays
+      // consistent — the values were just reset on the server.
+      setPending((p) => {
+        const next: PendingEdits = {}
+        for (const [k, v] of Object.entries(p)) {
+          if (!k.startsWith(sectionId + "/")) next[k] = v
+        }
+        return next
+      })
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("settings.healthThresholds.networkErrorWhileResetting"))
+    }
+  }
+
+  const handleResetAll = async () => {
+    if (!confirm(t("settings.healthThresholds.resetAllConfirm"))) return
+    try {
+      const data = await fetchJson<{ success: boolean; thresholds: ThresholdsTree; message?: string }>(
+        "/api/health/thresholds/reset",
+        { method: "POST" },
+      )
+      if (!data.success || !data.thresholds) {
+        setError(data.message || t("settings.healthThresholds.resetFailed"))
+        return
+      }
+      setTree(data.thresholds)
+      setPending({})
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("settings.healthThresholds.networkErrorWhileResetting"))
+    }
+  }
+
+  const renderField = (path: string[], label: string) => {
+    // Kept for single-value leaves that don't have a warn/crit pair
+    // (e.g. Memory's swap_critical). The pair-cases route to
+    // renderThresholdRange below.
+    const leaf = getLeaf(tree, path)
+    if (!leaf) return null
+    const key = pathKey(path)
+    const editingValue = pending[key] ?? String(leaf.value)
+    const last = path[path.length - 1] || ""
+    const isCritical = last.toLowerCase().includes("critical")
+    const isWarning = last.toLowerCase().includes("warning")
+    const severityClass = isCritical
+      ? "border-red-500/70 bg-red-500/10 focus-visible:border-red-500"
+      : isWarning
+        ? "border-amber-500/70 bg-amber-500/10 focus-visible:border-amber-500"
+        : "border-input"
+    const isCustomised = leaf.customised && !(key in pending)
+    const customisedClass = "border-blue-500 bg-blue-500/10 focus-visible:border-blue-500"
+    const fieldClass = isCustomised ? customisedClass : severityClass
+    const recommendedTooltip = `${t("settings.healthThresholds.recommended")}: ${leaf.recommended}${leaf.unit}`
+    return (
+      <div key={key} className="flex items-center justify-between gap-2 py-1.5 px-1">
+        <span className="text-xs sm:text-sm text-foreground/90 min-w-0">
+          {label}
+        </span>
+        <div className="flex items-center gap-2 flex-shrink-0">
+          <Input
+            type="number"
+            min={leaf.min}
+            max={leaf.max}
+            step={leaf.step}
+            disabled={!editMode}
+            value={editingValue}
+            title={recommendedTooltip}
+            onChange={(e) =>
+              setPending((p) => ({ ...p, [key]: e.target.value }))
+            }
+            className={`w-20 h-7 text-xs text-right tabular-nums border ${fieldClass} ${
+              !editMode ? "disabled:opacity-100 disabled:cursor-default" : ""
+            }`}
+          />
+          <span className="text-[11px] text-muted-foreground w-6">{leaf.unit}</span>
+        </div>
+      </div>
+    )
+  }
+
+  // Single-handle slider for thresholds that don't have a warn/crit
+  // pair (only Memory's swap_critical today). Same visual language as
+  // the dual-handle: red handle, value above, OK / CRIT zones below
+  // — so the operator doesn't read it as a different control.
+  const renderSingleThresholdSlider = (path: string[], severity: "warning" | "critical" = "critical") => {
+    const leaf = getLeaf(tree, path)
+    if (!leaf) return null
+    const key = pathKey(path)
+    const val = Number(pending[key] ?? leaf.value)
+    const step = leaf.step || 1
+    const unit = leaf.unit || ""
+    const { min, max } = computeVisualRange(
+      [leaf.value, leaf.recommended],
+      leaf.min,
+      leaf.max,
+      step,
+    )
+    const pct = ((Math.max(min, Math.min(max, val)) - min) / (max - min)) * 100
+    const custom = leaf.customised && !(key in pending)
+    const color = severity === "critical" ? "red" : "amber"
+    const handleClass = severity === "critical"
+      ? "[&::-webkit-slider-thumb]:bg-red-500 [&::-moz-range-thumb]:bg-red-500"
+      : "[&::-webkit-slider-thumb]:bg-amber-500 [&::-moz-range-thumb]:bg-amber-500"
+    const numberColor = custom
+      ? "text-blue-400"
+      : severity === "critical"
+        ? "text-red-500"
+        : "text-amber-500"
+    const fillColor = severity === "critical" ? "bg-red-500/30" : "bg-amber-500/30"
+
+    return (
+      <div className="px-1 py-3">
+        <div className="relative h-6 sm:h-5 mb-1 select-none">
+          <span
+            className={`absolute -translate-x-1/2 text-xs font-semibold tabular-nums ${numberColor}`}
+            style={{ left: `${pct}%` }}
+          >
+            {val}{unit}
+          </span>
+        </div>
+        <div className="relative h-9 sm:h-6">
+          <div className="absolute inset-x-0 top-1/2 -translate-y-1/2 h-1.5 rounded-full bg-muted" />
+          <div
+            className={`absolute top-1/2 -translate-y-1/2 h-1.5 rounded-r-full ${fillColor}`}
+            style={{ left: `${pct}%`, right: 0 }}
+          />
+          <input
+            type="range"
+            min={min}
+            max={max}
+            step={step}
+            disabled={!editMode}
+            value={val}
+            onChange={(e) => setPending((p) => ({ ...p, [key]: e.target.value }))}
+            className={`absolute inset-0 w-full appearance-none bg-transparent pointer-events-none [&::-webkit-slider-thumb]:pointer-events-auto [&::-moz-range-thumb]:pointer-events-auto [&::-webkit-slider-thumb]:appearance-none [&::-webkit-slider-thumb]:h-8 [&::-webkit-slider-thumb]:w-8 sm:[&::-webkit-slider-thumb]:h-4 sm:[&::-webkit-slider-thumb]:w-4 [&::-webkit-slider-thumb]:rounded-full [&::-webkit-slider-thumb]:border-2 [&::-webkit-slider-thumb]:border-background [&::-webkit-slider-thumb]:shadow [&::-moz-range-thumb]:h-8 [&::-moz-range-thumb]:w-8 sm:[&::-moz-range-thumb]:h-4 sm:[&::-moz-range-thumb]:w-4 [&::-moz-range-thumb]:rounded-full [&::-moz-range-thumb]:border-2 [&::-moz-range-thumb]:border-background ${handleClass}`}
+            title={`${t("settings.healthThresholds.recommended")}: ${leaf.recommended}${unit}`}
+          />
+        </div>
+        <div className="grid grid-cols-2 gap-2 mt-1.5 text-[10px] uppercase tracking-wider text-muted-foreground">
+          <span>{t("settings.healthThresholds.ok")} &lt; {val}{unit}</span>
+          <span className="text-right">{severity === "critical" ? t("settings.healthThresholds.crit") : t("settings.healthThresholds.warn")} &gt; {val}{unit}</span>
+        </div>
+      </div>
+    )
+  }
+
+  // Dual-handle range slider replacing the two stacked number inputs
+  // for warn/crit pairs. Visual model: a horizontal track split into
+  // three zones — OK (left of warning, muted), WARN→CRIT (between
+  // handles, amber-to-red gradient), and OVER-CRIT (right of critical,
+  // dark red overlay). The handles themselves stay coloured (amber for
+  // warning, red for critical) so the operator reads the same severity
+  // mapping they're used to from the old inputs. Numbers ride above
+  // each handle and double as a click-to-edit affordance — clicking a
+  // number swaps it for a tight `<Input type="number">` so precise
+  // values are still keyboard-friendly. Customised values surface as a
+  // small blue dot on the affected handle (same signal as the old blue
+  // ring, less visual weight).
+  const renderThresholdRange = (
+    basePath: string[],
+    options?: { hideLabels?: boolean }
+  ) => {
+    const wPath = [...basePath, "warning"]
+    const cPath = [...basePath, "critical"]
+    const wLeaf = getLeaf(tree, wPath)
+    const cLeaf = getLeaf(tree, cPath)
+    if (!wLeaf || !cLeaf) return null
+
+    const wKey = pathKey(wPath)
+    const cKey = pathKey(cPath)
+    const wVal = Number(pending[wKey] ?? wLeaf.value)
+    const cVal = Number(pending[cKey] ?? cLeaf.value)
+
+    // Backend validates warning <= critical on save.
+    const step = Math.max(wLeaf.step, cLeaf.step) || 1
+    const backendMin = Math.min(wLeaf.min, cLeaf.min)
+    const backendMax = Math.max(wLeaf.max, cLeaf.max)
+    const { min, max } = computeVisualRange(
+      [wLeaf.value, cLeaf.value, wLeaf.recommended, cLeaf.recommended],
+      backendMin,
+      backendMax,
+      step,
+    )
+    const pct = (v: number) => ((Math.max(min, Math.min(max, v)) - min) / (max - min)) * 100
+    const wPct = pct(wVal)
+    const cPct = pct(cVal)
+    const unit = wLeaf.unit || cLeaf.unit || ""
+
+    const wCustom = wLeaf.customised && !(wKey in pending)
+    const cCustom = cLeaf.customised && !(cKey in pending)
+
+    const setVal = (key: string, value: number, peer: number, isWarn: boolean) => {
+      // Clamp on the fly: warning can't cross critical and vice-versa,
+      // matching the backend invariant so the user can't drag into an
+      // invalid state.
+      let v = value
+      if (isWarn && v >= peer) v = peer - step
+      if (!isWarn && v <= peer) v = peer + step
+      setPending((p) => ({ ...p, [key]: String(v) }))
+    }
+
+    return (
+      <div className="px-1 py-3">
+        {/* Numeric labels above each handle, positioned absolutely so
+            they ride above the corresponding thumb regardless of the
+            slider width. Pointer events disabled so they don't steal
+            clicks from the underlying range inputs. */}
+        <div className="relative h-6 sm:h-5 mb-1 select-none">
+          <span
+            className={`absolute -translate-x-1/2 text-xs font-semibold tabular-nums ${wCustom ? "text-blue-400" : "text-amber-500"}`}
+            style={{ left: `${wPct}%` }}
+          >
+            {wVal}{unit}
+          </span>
+          <span
+            className={`absolute -translate-x-1/2 text-xs font-semibold tabular-nums ${cCustom ? "text-blue-400" : "text-red-500"}`}
+            style={{ left: `${cPct}%` }}
+          >
+            {cVal}{unit}
+          </span>
+        </div>
+
+        {/* Two range inputs stacked. Mobile track box is taller so the
+            enlarged thumbs (h-7) have room to sit without clipping. */}
+        <div className="relative h-9 sm:h-6">
+          {/* Background track: OK zone (muted) running the full width */}
+          <div className="absolute inset-x-0 top-1/2 -translate-y-1/2 h-1.5 rounded-full bg-muted" />
+          {/* Warn-to-Crit gradient between the two handles */}
+          <div
+            className="absolute top-1/2 -translate-y-1/2 h-1.5 rounded-full"
+            style={{
+              left: `${wPct}%`,
+              width: `${Math.max(0, cPct - wPct)}%`,
+              background: "linear-gradient(90deg, rgb(245 158 11), rgb(239 68 68))",
+            }}
+          />
+          {/* OVER-CRIT zone (right of critical) — solid red dim */}
+          <div
+            className="absolute top-1/2 -translate-y-1/2 h-1.5 rounded-r-full bg-red-500/30"
+            style={{ left: `${cPct}%`, right: 0 }}
+          />
+          {/* Two superposed range inputs. Pointer-events on the thumb
+              only, so the inert track bar above stays visible. */}
+          <input
+            type="range"
+            min={min}
+            max={max}
+            step={step}
+            disabled={!editMode}
+            value={wVal}
+            onChange={(e) => setVal(wKey, Number(e.target.value), cVal, true)}
+            className="absolute inset-0 w-full appearance-none bg-transparent pointer-events-none [&::-webkit-slider-thumb]:pointer-events-auto [&::-moz-range-thumb]:pointer-events-auto [&::-webkit-slider-thumb]:appearance-none [&::-webkit-slider-thumb]:h-8 [&::-webkit-slider-thumb]:w-8 sm:[&::-webkit-slider-thumb]:h-4 sm:[&::-webkit-slider-thumb]:w-4 [&::-webkit-slider-thumb]:rounded-full [&::-webkit-slider-thumb]:bg-amber-500 [&::-webkit-slider-thumb]:border-2 [&::-webkit-slider-thumb]:border-background [&::-webkit-slider-thumb]:shadow [&::-moz-range-thumb]:h-8 [&::-moz-range-thumb]:w-8 sm:[&::-moz-range-thumb]:h-4 sm:[&::-moz-range-thumb]:w-4 [&::-moz-range-thumb]:rounded-full [&::-moz-range-thumb]:bg-amber-500 [&::-moz-range-thumb]:border-2 [&::-moz-range-thumb]:border-background"
+            title={`${t("settings.healthThresholds.warning")} (${t("settings.healthThresholds.recommended").toLowerCase()}: ${wLeaf.recommended}${unit})`}
+          />
+          <input
+            type="range"
+            min={min}
+            max={max}
+            step={step}
+            disabled={!editMode}
+            value={cVal}
+            onChange={(e) => setVal(cKey, Number(e.target.value), wVal, false)}
+            className="absolute inset-0 w-full appearance-none bg-transparent pointer-events-none [&::-webkit-slider-thumb]:pointer-events-auto [&::-moz-range-thumb]:pointer-events-auto [&::-webkit-slider-thumb]:appearance-none [&::-webkit-slider-thumb]:h-8 [&::-webkit-slider-thumb]:w-8 sm:[&::-webkit-slider-thumb]:h-4 sm:[&::-webkit-slider-thumb]:w-4 [&::-webkit-slider-thumb]:rounded-full [&::-webkit-slider-thumb]:bg-red-500 [&::-webkit-slider-thumb]:border-2 [&::-webkit-slider-thumb]:border-background [&::-webkit-slider-thumb]:shadow [&::-moz-range-thumb]:h-8 [&::-moz-range-thumb]:w-8 sm:[&::-moz-range-thumb]:h-4 sm:[&::-moz-range-thumb]:w-4 [&::-moz-range-thumb]:rounded-full [&::-moz-range-thumb]:bg-red-500 [&::-moz-range-thumb]:border-2 [&::-moz-range-thumb]:border-background"
+            title={`${t("settings.healthThresholds.critical")} (${t("settings.healthThresholds.recommended").toLowerCase()}: ${cLeaf.recommended}${unit})`}
+          />
+        </div>
+
+        {/* Zone labels — explicit ranges so the operator knows where
+            "warn" starts and ends without having to read the handles. */}
+        {!options?.hideLabels && (
+          <div className="grid grid-cols-3 gap-2 mt-1.5 text-[10px] uppercase tracking-wider text-muted-foreground">
+            <span>{t("settings.healthThresholds.ok")} &lt; {wVal}{unit}</span>
+            <span className="text-center">{t("settings.healthThresholds.warn")} {wVal}–{cVal}{unit}</span>
+            <span className="text-right">{t("settings.healthThresholds.crit")} &gt; {cVal}{unit}</span>
+          </div>
+        )}
+      </div>
+    )
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <div className="flex items-center justify-between gap-2 flex-wrap">
+          <div className="flex items-center gap-2 min-w-0">
+            <SlidersHorizontal className="h-5 w-5 text-amber-500" />
+            <CardTitle>{t("settings.healthThresholds.title")}</CardTitle>
+          </div>
+          {!loading && (
+            <div className="flex items-center gap-2">
+              {savedFlash && (
+                <span className="flex items-center gap-1 text-xs text-green-500">
+                  <Check className="h-3.5 w-3.5" />
+                  {t("status.saved")}
+                </span>
+              )}
+              {editMode ? (
+                <>
+                  <button
+                    className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors text-muted-foreground"
+                    onClick={handleCancel}
+                    disabled={saving}
+                  >
+                    {t("actions.cancel")}
+                  </button>
+                  <button
+                    className="h-7 px-3 text-xs rounded-md bg-blue-600 hover:bg-blue-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1.5"
+                    onClick={handleSave}
+                    disabled={saving || !hasPendingChanges}
+                  >
+                    {saving ? (
+                      <Loader2 className="h-3 w-3 animate-spin" />
+                    ) : (
+                      <Check className="h-3 w-3" />
+                    )}
+                    {t("actions.save")}
+                  </button>
+                </>
+              ) : (
+                <>
+                  <button
+                    className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors text-muted-foreground flex items-center gap-1.5"
+                    onClick={handleResetAll}
+                    title={t("settings.healthThresholds.resetAllTitle")}
+                  >
+                    <RotateCcw className="h-3 w-3" />
+                    {t("actions.resetAll")}
+                  </button>
+                  <button
+                    className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5"
+                    onClick={handleEdit}
+                  >
+                    <Settings2 className="h-3 w-3" />
+                    {t("actions.edit")}
+                  </button>
+                </>
+              )}
+            </div>
+          )}
+        </div>
+        <CardDescription>
+          {t("settings.healthThresholds.description")}
+        </CardDescription>
+      </CardHeader>
+      {/* Intentional exception to the global "edit mode contrast"
+          rule: the numeric inputs already carry semantic colored
+          backgrounds (red critical, amber warning, blue customised)
+          which are meaningful and more graphical than a plain form.
+          A sunken selector would either erase those tints or force
+          us to `!important` every one — cleaner to keep this card
+          untouched in edit mode. */}
+      <CardContent>
+        {loading ? (
+          <div className="flex items-center justify-center py-8">
+            <Loader2 className="h-5 w-5 animate-spin text-muted-foreground" />
+          </div>
+        ) : !tree ? (
+          <div className="text-sm text-muted-foreground">{t("settings.healthThresholds.loadFailed")}</div>
+        ) : (
+          <div>
+            {error && (
+              <div className="mb-4 flex items-start gap-2 p-2.5 rounded-md bg-red-500/10 border border-red-500/30 text-red-500 text-xs">
+                <AlertCircle className="h-4 w-4 flex-shrink-0 mt-0.5" />
+                <div className="flex-1">{error}</div>
+              </div>
+            )}
+
+            {/*
+              Masonry-style flow via CSS columns: cards keep their natural
+              height (CPU = 2 rows, Disk temperature = 8 rows) and the
+              browser packs them top-to-bottom into 1/2/3 columns based on
+              viewport. `break-inside-avoid` keeps each card whole.
+              Mobile (<md) stays single-column as today.
+            */}
+            <div className="columns-1 md:columns-2 2xl:columns-3 gap-4 space-y-4 [&>*]:break-inside-avoid">
+            {SECTIONS.map((section) => {
+              const Icon = section.icon
+              return (
+                <div key={section.id} className="rounded-md border border-border/50 px-3 py-2">
+                  <div className="flex items-center justify-between mb-1.5">
+                    <div className="flex items-center gap-2 min-w-0">
+                      <Icon className="h-4 w-4 text-muted-foreground flex-shrink-0" />
+                      <h4 className="text-sm font-medium">{tFallback(`settings.healthThresholds.sections.${section.id}.title`, section.title)}</h4>
+                    </div>
+                    {editMode && (
+                      <button
+                        className="h-6 w-6 rounded-md text-muted-foreground hover:bg-muted hover:text-foreground transition-colors flex items-center justify-center"
+                        onClick={() => handleResetSection(section.id)}
+                        title={t("settings.healthThresholds.resetSectionTitle")}
+                      >
+                        <RotateCcw className="h-3 w-3" />
+                      </button>
+                    )}
+                  </div>
+                  {section.description && (
+                    <p className="text-[11px] text-muted-foreground mb-1.5 leading-snug">
+                      {tFallback(`settings.healthThresholds.sections.${section.id}.description`, section.description)}
+                    </p>
+                  )}
+                  <div>
+                    {section.rowGroups ? (
+                      // Per-class disk temperature: one slider per row
+                      // (HDD / SSD / NVMe / SAS). Group label sits on
+                      // top of each slider so the operator scans the
+                      // column from top down without losing context.
+                      section.rowGroups.map((group) => (
+                        <div key={group.subKey} className="py-1.5 border-b border-border/40 last:border-b-0">
+                          <div className="text-[11px] uppercase tracking-wider text-muted-foreground px-1">
+                            {group.label}
+                          </div>
+                          {renderThresholdRange([section.id, group.subKey])}
+                        </div>
+                      ))
+                    ) : section.id === "memory" ? (
+                      // Memory & Swap is special: warn/crit pair for
+                      // RAM, plus the swap-pressure pair. Swap
+                      // CRITICAL fires only when both conditions hold
+                      // — swap file above `swap_high` AND available
+                      // RAM below `available_min`. Rendering the two
+                      // sliders one under the other under a shared
+                      // header reads as "the two knobs of one signal".
+                      <>
+                        <div className="text-[11px] uppercase tracking-wider text-muted-foreground px-1">
+                          {t("settings.healthThresholds.ram")}
+                        </div>
+                        {renderThresholdRange(["memory"])}
+                        <div className="border-t border-border/40 pt-1.5 mt-1.5">
+                          <div className="text-[11px] uppercase tracking-wider text-muted-foreground px-1">
+                            {t("settings.healthThresholds.swapPressure")}
+                          </div>
+                          <p className="text-[11px] text-muted-foreground px-1 pt-1 pb-1 leading-snug">
+                            {t("settings.healthThresholds.swapPressureHint")}
+                          </p>
+                          <div>
+                            <div className="text-[10px] uppercase tracking-wider text-muted-foreground/80 px-1 pt-1">
+                              {t("settings.healthThresholds.swapHighLabel")}
+                            </div>
+                            {renderSingleThresholdSlider(["memory", "swap_high"], "critical")}
+                          </div>
+                          <div>
+                            <div className="text-[10px] uppercase tracking-wider text-muted-foreground/80 px-1">
+                              {t("settings.healthThresholds.availableMinLabel")}
+                            </div>
+                            {renderSingleThresholdSlider(["memory", "available_min"], "warning")}
+                          </div>
+                        </div>
+                      </>
+                    ) : section.fields.length === 2 &&
+                      section.fields[0].path[section.fields[0].path.length - 1] === "warning" &&
+                      section.fields[1].path[section.fields[1].path.length - 1] === "critical" ? (
+                      // Generic warn+crit pair (CPU, CPU temp, storage
+                      // capacities …) → single slider.
+                      renderThresholdRange([section.id])
+                    ) : (
+                      // Fallback for any future section shape — keep
+                      // the original per-field number inputs.
+                      <div className="divide-y divide-border/40">
+                        {section.fields.map((f) => renderField(f.path, f.label))}
+                      </div>
+                    )}
+                  </div>
+                </div>
+              )
+            })}
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  )
+}

AppImage/components/login.tsx

@@ -2,13 +2,14 @@
 
 import type React from "react"
 
-import { useState, useEffect } from "react"
+import { useState, useEffect, useRef } from "react"
 import { Button } from "./ui/button"
 import { Input } from "./ui/input"
 import { Label } from "./ui/label"
 import { Checkbox } from "./ui/checkbox"
-import { Lock, User, AlertCircle, Server, Shield } from "lucide-react"
+import { Lock, User, AlertCircle, Server, Shield, Eye, EyeOff } from "lucide-react"
 import { getApiUrl } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
 import Image from "next/image"
 
 interface LoginProps {
@@ -16,15 +17,33 @@ interface LoginProps {
 }
 
 export function Login({ onLogin }: LoginProps) {
+  const t = useT()
   const [username, setUsername] = useState("")
   const [password, setPassword] = useState("")
   const [totpCode, setTotpCode] = useState("")
   const [requiresTotp, setRequiresTotp] = useState(false)
   const [rememberMe, setRememberMe] = useState(false)
+  const [showPassword, setShowPassword] = useState(false)
   const [error, setError] = useState("")
   const [loading, setLoading] = useState(false)
+  const lastAutoSubmittedTotp = useRef("")
 
   useEffect(() => {
+    // The Login screen is, by construction, the recovery path from any
+    // 401 cascade (the api-config wrapper redirects here when an
+    // expired/invalid JWT is detected). Clear the cascade-prevention
+    // flag on mount so a successful login can subsequently fire a fresh
+    // reload if a NEW 401 ever occurs. Without this clear, any 401 set
+    // earlier in the session sticks around forever and the next 401
+    // (e.g. mid-2FA, or right after a successful login if the token was
+    // briefly stale) is silently swallowed by the de-dup — the user
+    // sees a blank/stuck dashboard.
+    try {
+      sessionStorage.removeItem("proxmenux-auth-401-handled")
+    } catch {
+      // private browsing — best-effort
+    }
+
     const savedUsername = localStorage.getItem("proxmenux-saved-username")
     const savedPassword = localStorage.getItem("proxmenux-saved-password")
 
@@ -35,17 +54,18 @@ export function Login({ onLogin }: LoginProps) {
     }
   }, [])
 
-  const handleLogin = async (e: React.FormEvent) => {
-    e.preventDefault()
+  const submitLogin = async (totpOverride?: string) => {
     setError("")
 
+    const token = totpOverride ?? totpCode
+
     if (!username || !password) {
-      setError("Please enter username and password")
+      setError(t("login.missingCredentials"))
       return
     }
 
-    if (requiresTotp && !totpCode) {
-      setError("Please enter your 2FA code")
+    if (requiresTotp && !token) {
+      setError(t("login.missingTotp"))
       return
     }
 
@@ -58,23 +78,34 @@ export function Login({ onLogin }: LoginProps) {
         body: JSON.stringify({
           username,
           password,
-          totp_token: totpCode || undefined, // Include 2FA code if provided
+          totp_token: token || undefined, // Include 2FA code if provided
         }),
       })
 
       const data = await response.json()
 
-      if (data.requires_totp) {
+      if (response.ok && data.requires_totp) {
         setRequiresTotp(true)
         setLoading(false)
         return
       }
 
       if (!response.ok) {
-        throw new Error(data.message || "Login failed")
+        if (response.status === 429) {
+          throw new Error(t("login.tooManyAttempts"))
+        }
+        if (response.status === 401) {
+          throw new Error(data.requires_totp ? t("login.invalidTotp") : t("login.invalidCredentials"))
+        }
+        throw new Error(t("login.loginFailed"))
       }
 
       localStorage.setItem("proxmenux-auth-token", data.token)
+      try {
+        sessionStorage.removeItem("proxmenux-auth-401-handled")
+      } catch {
+        // ignore
+      }
 
       if (rememberMe) {
         localStorage.setItem("proxmenux-saved-username", username)
@@ -86,12 +117,28 @@ export function Login({ onLogin }: LoginProps) {
 
       onLogin()
     } catch (err) {
-      setError(err instanceof Error ? err.message : "Login failed")
+      setError(err instanceof Error ? err.message : t("login.loginFailed"))
     } finally {
       setLoading(false)
     }
   }
 
+  const handleLogin = async (e: React.FormEvent) => {
+    e.preventDefault()
+    await submitLogin()
+  }
+
+  useEffect(() => {
+    if (!requiresTotp || loading || !/^\d{6}$/.test(totpCode)) {
+      return
+    }
+    if (lastAutoSubmittedTotp.current === totpCode) {
+      return
+    }
+    lastAutoSubmittedTotp.current = totpCode
+    void submitLogin(totpCode)
+  }, [requiresTotp, totpCode, loading])
+
   return (
     <div className="min-h-screen bg-background flex items-center justify-center p-4">
       <div className="w-full max-w-md space-y-8">
@@ -118,8 +165,8 @@ export function Login({ onLogin }: LoginProps) {
             </div>
           </div>
           <div>
-            <h1 className="text-3xl font-bold">ProxMenux Monitor</h1>
-            <p className="text-muted-foreground mt-2">Sign in to access your dashboard</p>
+            <h1 className="text-3xl font-bold">{t("app.title")}</h1>
+            <p className="text-muted-foreground mt-2">{t("login.subtitle")}</p>
           </div>
         </div>
 
@@ -136,14 +183,14 @@ export function Login({ onLogin }: LoginProps) {
               <>
                 <div className="space-y-2">
                   <Label htmlFor="login-username" className="text-sm">
-                    Username
+                    {t("login.username")}
                   </Label>
                   <div className="relative">
                     <User className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
                     <Input
                       id="login-username"
                       type="text"
-                      placeholder="Enter your username"
+                      placeholder={t("login.usernamePlaceholder")}
                       value={username}
                       onChange={(e) => setUsername(e.target.value)}
                       className="pl-10 text-base"
@@ -155,20 +202,33 @@ export function Login({ onLogin }: LoginProps) {
 
                 <div className="space-y-2">
                   <Label htmlFor="login-password" className="text-sm">
-                    Password
+                    {t("login.password")}
                   </Label>
                   <div className="relative">
                     <Lock className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
                     <Input
                       id="login-password"
-                      type="password"
-                      placeholder="Enter your password"
+                      type={showPassword ? "text" : "password"}
+                      placeholder={t("login.passwordPlaceholder")}
                       value={password}
                       onChange={(e) => setPassword(e.target.value)}
-                      className="pl-10 text-base"
+                      className="pl-10 pr-10 text-base"
                       disabled={loading}
                       autoComplete="current-password"
                     />
+                    <button
+                      type="button"
+                      onClick={() => setShowPassword(!showPassword)}
+                      className="absolute right-3 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground transition-colors"
+                      disabled={loading}
+                      tabIndex={-1}
+                    >
+                      {showPassword ? (
+                        <EyeOff className="h-4 w-4" />
+                      ) : (
+                        <Eye className="h-4 w-4" />
+                      )}
+                    </button>
                   </div>
                 </div>
 
@@ -180,7 +240,7 @@ export function Login({ onLogin }: LoginProps) {
                     disabled={loading}
                   />
                   <Label htmlFor="remember-me" className="text-sm font-normal cursor-pointer select-none">
-                    Remember me
+                    {t("login.rememberMe")}
                   </Label>
                 </div>
               </>
@@ -189,29 +249,29 @@ export function Login({ onLogin }: LoginProps) {
                 <div className="bg-blue-500/10 border border-blue-500/20 rounded-lg p-3 flex items-start gap-2">
                   <Shield className="h-5 w-5 text-blue-500 flex-shrink-0 mt-0.5" />
                   <div>
-                    <p className="text-sm font-medium text-blue-500">Two-Factor Authentication</p>
-                    <p className="text-xs text-blue-500 mt-1">Enter the 6-digit code from your authentication app</p>
+                    <p className="text-sm font-medium text-blue-500">{t("login.twoFactorTitle")}</p>
+                    <p className="text-xs text-blue-500 mt-1">{t("login.twoFactorDescription")}</p>
                   </div>
                 </div>
 
                 <div className="space-y-2">
                   <Label htmlFor="totp-code" className="text-sm">
-                    Authentication Code
+                    {t("login.authenticationCode")}
                   </Label>
                   <Input
                     id="totp-code"
                     type="text"
                     placeholder="000000"
                     value={totpCode}
-                    onChange={(e) => setTotpCode(e.target.value.replace(/\D/g, "").slice(0, 6))}
+                    onChange={(e) => setTotpCode(e.target.value.toUpperCase().replace(/[^A-Z0-9-]/g, "").slice(0, 9))}
                     className="text-center text-lg tracking-widest font-mono text-base"
-                    maxLength={6}
+                    maxLength={9}
                     disabled={loading}
                     autoComplete="one-time-code"
                     autoFocus
                   />
                   <p className="text-xs text-muted-foreground text-center">
-                    You can also use a backup code (format: XXXX-XXXX)
+                    {t("login.backupCodeHint")}
                   </p>
                 </div>
 
@@ -226,18 +286,18 @@ export function Login({ onLogin }: LoginProps) {
                   }}
                   className="w-full"
                 >
-                  Back to login
+                  {t("login.backToLogin")}
                 </Button>
               </div>
             )}
 
             <Button type="submit" className="w-full bg-blue-500 hover:bg-blue-600" disabled={loading}>
-              {loading ? "Signing in..." : requiresTotp ? "Verify Code" : "Sign In"}
+              {loading ? t("login.signingIn") : requiresTotp ? t("login.verifyCode") : t("login.signIn")}
             </Button>
           </form>
         </div>
 
-        <p className="text-center text-sm text-muted-foreground">ProxMenux Monitor v1.0.2</p>
+        <p className="text-center text-sm text-muted-foreground">{t("login.version")}</p>
       </div>
     </div>
   )

AppImage/components/lxc-terminal-modal.tsx

@@ -0,0 +1,913 @@
+"use client"
+
+import type React from "react"
+import { useState, useEffect, useRef, useCallback, useMemo } from "react"
+import { Dialog, DialogContent, DialogTitle } from "@/components/ui/dialog"
+import { Button } from "@/components/ui/button"
+import {
+  Activity,
+  ArrowUp,
+  ArrowDown,
+  ArrowLeft,
+  ArrowRight,
+  CornerDownLeft,
+  GripHorizontal,
+  ChevronDown,
+  Search,
+  Send,
+  Lightbulb,
+  Terminal,
+  Trash2,
+  X,
+  Copy,
+  Clipboard,
+} from "lucide-react"
+import { copyTerminalSelection, pasteFromClipboard } from "@/lib/terminal-clipboard"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  DropdownMenuSeparator,
+  DropdownMenuLabel,
+} from "@/components/ui/dropdown-menu"
+import { DialogHeader, DialogDescription } from "@/components/ui/dialog"
+import { Input } from "@/components/ui/input"
+import { Dialog as SearchDialog, DialogContent as SearchDialogContent, DialogTitle as SearchDialogTitle } from "@/components/ui/dialog"
+import "xterm/css/xterm.css"
+import { API_PORT, fetchApi } from "@/lib/api-config"
+import { getTicketedWsUrl } from "@/lib/terminal-ws"
+import { useT } from "@/lib/i18n/provider"
+
+interface LxcTerminalModalProps {
+  open: boolean
+  onClose: () => void
+  vmid: number
+  vmName: string
+}
+
+interface CheatSheetResult {
+  command: string
+  description: string
+  examples: string[]
+}
+
+const LXC_COMMANDS = [
+  { cmd: "ls -la", descKey: "listFiles" },
+  { cmd: "cd /path/to/dir", descKey: "changeDirectory" },
+  { cmd: "cat filename", descKey: "displayFile" },
+  { cmd: "grep 'pattern' file", descKey: "searchPattern" },
+  { cmd: "find . -name 'file'", descKey: "findFiles" },
+  { cmd: "df -h", descKey: "diskUsage" },
+  { cmd: "du -sh *", descKey: "directorySizes" },
+  { cmd: "free -h", descKey: "memoryUsage" },
+  { cmd: "top", descKey: "runningProcesses" },
+  { cmd: "ps aux | grep process", descKey: "findProcess" },
+  { cmd: "systemctl status service", descKey: "serviceStatus" },
+  { cmd: "systemctl restart service", descKey: "restartService" },
+  { cmd: "apt update && apt upgrade", descKey: "updatePackages" },
+  { cmd: "apt install package", descKey: "installPackage" },
+  { cmd: "tail -f /var/log/syslog", descKey: "followLog" },
+  { cmd: "chmod 755 file", descKey: "changePermissions" },
+  { cmd: "chown user:group file", descKey: "changeOwner" },
+  { cmd: "tar -xzf file.tar.gz", descKey: "extractArchive" },
+  { cmd: "docker ps", descKey: "listContainers" },
+  { cmd: "docker images", descKey: "listImages" },
+  { cmd: "ip addr show", descKey: "showIpAddresses" },
+  { cmd: "ping host", descKey: "testConnectivity" },
+  { cmd: "curl -I url", descKey: "httpHeaders" },
+  { cmd: "history", descKey: "commandHistory" },
+  { cmd: "clear", descKey: "clearScreen" },
+] as const
+
+type LocalCommand = { cmd: string; desc: string }
+
+function getWebSocketUrl(): string {
+  if (typeof window === "undefined") {
+    return "ws://localhost:8008/ws/terminal"
+  }
+
+  const { protocol, hostname, port } = window.location
+  const isStandardPort = port === "" || port === "80" || port === "443"
+  const wsProtocol = protocol === "https:" ? "wss:" : "ws:"
+
+  if (isStandardPort) {
+    return `${wsProtocol}//${hostname}/ws/terminal`
+  } else {
+    return `${wsProtocol}//${hostname}:${API_PORT}/ws/terminal`
+  }
+}
+
+export function LxcTerminalModal({
+  open: isOpen,
+  onClose,
+  vmid,
+  vmName,
+}: LxcTerminalModalProps) {
+  const t = useT()
+  const termRef = useRef<any>(null)
+  const wsRef = useRef<WebSocket | null>(null)
+  const fitAddonRef = useRef<any>(null)
+  const terminalContainerRef = useRef<HTMLDivElement>(null)
+  const pingIntervalRef = useRef<ReturnType<typeof setInterval> | null>(null)
+
+  const [connectionStatus, setConnectionStatus] = useState<"connecting" | "online" | "offline">("connecting")
+  const [isMobile, setIsMobile] = useState(false)
+  const [isTablet, setIsTablet] = useState(false)
+  const isInsideLxcRef = useRef(false)
+  const outputBufferRef = useRef<string>("")
+
+  const [modalHeight, setModalHeight] = useState(500)
+  const [isResizing, setIsResizing] = useState(false)
+  const resizeBarRef = useRef<HTMLDivElement>(null)
+  const modalHeightRef = useRef(500)
+
+  // Search state
+  const [searchModalOpen, setSearchModalOpen] = useState(false)
+  const [searchQuery, setSearchQuery] = useState("")
+  const localCommands = useMemo<LocalCommand[]>(
+    () => LXC_COMMANDS.map((item) => ({ cmd: item.cmd, desc: t(`lxcTerminal.commands.${item.descKey}`) })),
+    [t],
+  )
+  const [filteredCommands, setFilteredCommands] = useState<LocalCommand[]>([])
+  const [isSearching, setIsSearching] = useState(false)
+  const [searchResults, setSearchResults] = useState<CheatSheetResult[]>([])
+  const [useOnline, setUseOnline] = useState(true)
+
+  useEffect(() => {
+    setFilteredCommands(localCommands)
+  }, [localCommands])
+
+  // Detect mobile/tablet
+  useEffect(() => {
+    const checkDevice = () => {
+      const width = window.innerWidth
+      setIsMobile(width < 640)
+      setIsTablet(width >= 640 && width < 1024)
+    }
+    checkDevice()
+    window.addEventListener("resize", checkDevice)
+    return () => window.removeEventListener("resize", checkDevice)
+  }, [])
+
+  // Cleanup on close
+  useEffect(() => {
+    if (!isOpen) {
+      if (pingIntervalRef.current) {
+        clearInterval(pingIntervalRef.current)
+        pingIntervalRef.current = null
+      }
+      if (wsRef.current) {
+        wsRef.current.close()
+        wsRef.current = null
+      }
+      if (termRef.current) {
+        termRef.current.dispose()
+        termRef.current = null
+      }
+      setConnectionStatus("connecting")
+      isInsideLxcRef.current = false
+      outputBufferRef.current = ""
+    }
+  }, [isOpen])
+
+  // Initialize terminal
+  useEffect(() => {
+    if (!isOpen) return
+
+    // `cancelled` short-circuits the async init if the modal closes
+    // before the dynamic xterm import resolves. Without this, we'd
+    // construct a Terminal instance, attach it to a now-stale ref, and
+    // open a WebSocket that nobody listens to. Audit Tier 6 — useEffect
+    // con `import("xterm")` sin cancelación.
+    let cancelled = false
+
+    // Small delay to ensure Dialog content is rendered
+    const initTimeout = setTimeout(() => {
+      if (cancelled || !terminalContainerRef.current) return
+      initTerminal()
+    }, 100)
+
+    const initTerminal = async () => {
+      const [TerminalClass, FitAddonClass] = await Promise.all([
+        import("xterm").then((mod) => mod.Terminal),
+        import("xterm-addon-fit").then((mod) => mod.FitAddon),
+      ])
+      if (cancelled) return
+
+      const fontSize = window.innerWidth < 768 ? 12 : 16
+
+      const term = new TerminalClass({
+        rendererType: "dom",
+        fontFamily: '"MesloLGS NF", "FiraCode Nerd Font", "JetBrainsMono Nerd Font", "Hack Nerd Font", "Symbols Nerd Font", "Courier", "Courier New", "Liberation Mono", "DejaVu Sans Mono", monospace',
+        fontSize: fontSize,
+        lineHeight: 1,
+        cursorBlink: true,
+        scrollback: 2000,
+        disableStdin: false,
+        customGlyphs: true,
+        fontWeight: "500",
+        fontWeightBold: "700",
+        theme: {
+          background: "#000000",
+          foreground: "#ffffff",
+          cursor: "#ffffff",
+          cursorAccent: "#000000",
+          black: "#2e3436",
+          red: "#cc0000",
+          green: "#4e9a06",
+          yellow: "#c4a000",
+          blue: "#3465a4",
+          magenta: "#75507b",
+          cyan: "#06989a",
+          white: "#d3d7cf",
+          brightBlack: "#555753",
+          brightRed: "#ef2929",
+          brightGreen: "#8ae234",
+          brightYellow: "#fce94f",
+          brightBlue: "#729fcf",
+          brightMagenta: "#ad7fa8",
+          brightCyan: "#34e2e2",
+          brightWhite: "#eeeeec",
+        },
+      })
+
+      const fitAddon = new FitAddonClass()
+      term.loadAddon(fitAddon)
+
+      if (terminalContainerRef.current) {
+        term.open(terminalContainerRef.current)
+        fitAddon.fit()
+      }
+
+      termRef.current = term
+      fitAddonRef.current = fitAddon
+
+      // Connect WebSocket to host terminal. We append a single-use ticket
+      // (`?ticket=...`) which the backend consumes on handshake — see
+      // lib/terminal-ws.ts and AppImage/scripts/flask_terminal_routes.py.
+      const wsUrl = getWebSocketUrl()
+      const ws = new WebSocket(await getTicketedWsUrl(wsUrl))
+      wsRef.current = ws
+      
+// Reset state for new connection
+  isInsideLxcRef.current = false
+  outputBufferRef.current = ""
+
+      ws.onopen = () => {
+        setConnectionStatus("online")
+
+        // Start heartbeat ping
+        pingIntervalRef.current = setInterval(() => {
+          if (ws.readyState === WebSocket.OPEN) {
+            ws.send(JSON.stringify({ type: 'ping' }))
+          } else {
+            if (pingIntervalRef.current) {
+              clearInterval(pingIntervalRef.current)
+            }
+          }
+        }, 25000)
+
+        // Sync terminal size
+        fitAddon.fit()
+        ws.send(JSON.stringify({
+          type: "resize",
+          cols: term.cols,
+          rows: term.rows,
+        }))
+        
+        // Auto-execute pct enter after connection is ready.
+        // The string is sent verbatim to the bash PTY, so a non-numeric
+        // `vmid` would land as shell input (e.g. `pct enter ; rm -rf /`).
+        // The prop is typed `number` but JSON / URL query injections can
+        // sneak strings in; validate as a defensive redundancy. Audit
+        // residual #lxc-terminal-vmid-injection.
+        setTimeout(() => {
+          if (ws.readyState !== WebSocket.OPEN) return
+          // Coerce + verify: must be a positive integer that round-trips
+          // through Number without losing fidelity.
+          const id = Number(vmid)
+          if (!Number.isInteger(id) || id <= 0 || id >= 1_000_000) {
+            term.writeln(`\r\n\x1b[31m[ERROR] ${t("lxcTerminal.errors.invalidVmid")}\x1b[0m`)
+            return
+          }
+          ws.send(`pct enter ${id}\r`)
+        }, 300)
+      }
+
+      ws.onerror = () => {
+        setConnectionStatus("offline")
+        term.writeln(`\r\n\x1b[31m[ERROR] ${t("terminal.websocketError")}\x1b[0m`)
+      }
+
+      ws.onclose = () => {
+        setConnectionStatus("offline")
+        if (pingIntervalRef.current) {
+          clearInterval(pingIntervalRef.current)
+        }
+        term.writeln(`\r\n\x1b[33m[INFO] ${t("terminal.connectionClosed")}\x1b[0m`)
+      }
+
+      term.onData((data) => {
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(data)
+        }
+      })
+      
+      ws.onmessage = (event) => {
+        // Filter out pong responses
+        if (event.data === '{"type": "pong"}' || event.data === '{"type":"pong"}') {
+          return
+        }
+        
+        // Helper to strip ANSI escape codes for pattern matching
+        const stripAnsi = (str: string) => str.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '')
+        
+        // Buffer output until we detect we're inside the LXC
+        // pct enter always enters directly without login prompt when run as root
+        if (!isInsideLxcRef.current) {
+          outputBufferRef.current += event.data
+          
+          const buffer = outputBufferRef.current
+          const cleanBuffer = stripAnsi(buffer)
+          
+          // Look for pct enter command followed by a new prompt
+          const pctEnterMatch = cleanBuffer.match(/pct enter (\d+)\r?\n/)
+          
+          if (pctEnterMatch) {
+            const afterPctEnter = cleanBuffer.substring(cleanBuffer.indexOf(pctEnterMatch[0]) + pctEnterMatch[0].length)
+            
+            // Extract the host name from the prompt BEFORE pct enter (e.g., "root@amd").
+            // Charset widened to accept dotted FQDNs (`proxmox.lan`) and unicode
+            // letters/numbers (host names like `próxmox` or non-Latin scripts).
+            // The previous `[a-zA-Z0-9_-]` truncated the hostname and the
+            // "are we inside the LXC?" comparison then misfired.
+            const hostPromptMatch = cleanBuffer.match(/@([\p{L}\p{N}._-]+).*pct enter/u)
+            const hostName = hostPromptMatch ? hostPromptMatch[1] : null
+
+            // Look for a new prompt after pct enter that ends with # or $
+            // This works for both bash (user@host:~#) and ash/Alpine ([user@host /]#)
+            const promptMatch = afterPctEnter.match(/[@\[]([\p{L}\p{N}._-]+)[^\r\n]*[#$]\s*$/u)
+            
+            if (promptMatch) {
+              const lxcHostname = promptMatch[1]
+              
+              // If we found a prompt with a DIFFERENT hostname than the Proxmox host,
+              // we're inside the LXC container
+              if (!hostName || lxcHostname !== hostName) {
+                isInsideLxcRef.current = true
+                
+                // Find the original prompt with ANSI codes to display it properly
+                const afterPctEnterWithAnsi = buffer.substring(buffer.indexOf('pct enter') + pctEnterMatch[0].length)
+                
+                // Write the LXC prompt (last line with # or $)
+                const lastPromptMatch = afterPctEnterWithAnsi.match(/[^\r\n]*[#$]\s*$/)
+                if (lastPromptMatch) {
+                  term.write(lastPromptMatch[0])
+                }
+                
+                // Detect if this is Alpine/ash shell by checking prompt format
+                // Alpine uses: [root@hostname ~]# or [root@hostname /]#
+                // Other distros use: root@hostname:/# or root@hostname:~#
+                const isAlpine = afterPctEnter.match(/\[[^\]]+@[^\]]+\s+[^\]]*\][#$]/)
+                
+                if (isAlpine) {
+                  // Send an extra Enter ONLY for Alpine containers (ash shell)
+                  // This forces the prompt to refresh properly
+                  setTimeout(() => {
+                    if (ws.readyState === WebSocket.OPEN) {
+                      ws.send('\r')
+                    }
+                  }, 100)
+                }
+                
+                return
+              }
+            }
+          }
+        } else {
+          // Already inside LXC, write directly
+          term.write(event.data)
+        }
+      }
+    }
+
+    return () => {
+      cancelled = true
+      clearTimeout(initTimeout)
+      if (pingIntervalRef.current) {
+        clearInterval(pingIntervalRef.current)
+      }
+      if (wsRef.current) {
+        wsRef.current.close()
+      }
+      if (termRef.current) {
+        termRef.current.dispose()
+      }
+    }
+  }, [isOpen, vmid, t])
+
+  // Resize handling
+  useEffect(() => {
+    if (termRef.current && fitAddonRef.current && isOpen) {
+      setTimeout(() => {
+        fitAddonRef.current?.fit()
+        if (wsRef.current?.readyState === WebSocket.OPEN) {
+          wsRef.current.send(JSON.stringify({
+            type: "resize",
+            cols: termRef.current.cols,
+            rows: termRef.current.rows,
+          }))
+        }
+      }, 100)
+    }
+  }, [modalHeight, isOpen])
+
+  // Resize bar handlers
+  const handleResizeStart = useCallback((e: React.MouseEvent | React.TouchEvent) => {
+    e.preventDefault()
+    setIsResizing(true)
+    modalHeightRef.current = modalHeight
+  }, [modalHeight])
+
+  useEffect(() => {
+    if (!isResizing) return
+
+    const handleMove = (e: MouseEvent | TouchEvent) => {
+      const clientY = 'touches' in e ? e.touches[0].clientY : e.clientY
+      const windowHeight = window.innerHeight
+      const newHeight = windowHeight - clientY - 20
+      const clampedHeight = Math.max(300, Math.min(windowHeight - 100, newHeight))
+      modalHeightRef.current = clampedHeight
+      setModalHeight(clampedHeight)
+    }
+
+    const handleEnd = () => {
+      setIsResizing(false)
+    }
+
+    document.addEventListener("mousemove", handleMove)
+    document.addEventListener("mouseup", handleEnd)
+    document.addEventListener("touchmove", handleMove)
+    document.addEventListener("touchend", handleEnd)
+
+    return () => {
+      document.removeEventListener("mousemove", handleMove)
+      document.removeEventListener("mouseup", handleEnd)
+      document.removeEventListener("touchmove", handleMove)
+      document.removeEventListener("touchend", handleEnd)
+    }
+  }, [isResizing])
+
+  // Send key helpers for mobile/tablet
+  const sendKey = useCallback((key: string) => {
+    if (wsRef.current?.readyState === WebSocket.OPEN) {
+      wsRef.current.send(key)
+    }
+  }, [])
+
+  const sendEsc = useCallback(() => sendKey("\x1b"), [sendKey])
+  const sendTab = useCallback(() => sendKey("\t"), [sendKey])
+  const sendArrowUp = useCallback(() => sendKey("\x1b[A"), [sendKey])
+  const sendArrowDown = useCallback(() => sendKey("\x1b[B"), [sendKey])
+  const sendArrowLeft = useCallback(() => sendKey("\x1b[D"), [sendKey])
+  const sendArrowRight = useCallback(() => sendKey("\x1b[C"), [sendKey])
+  const sendEnter = useCallback(() => sendKey("\r"), [sendKey])
+  const sendCtrlC = useCallback(() => sendKey("\x03"), [sendKey]) // Ctrl+C
+
+  // Mobile clipboard helpers — see lib/terminal-clipboard.ts for the rationale.
+  const handleCopy = useCallback(async () => {
+    await copyTerminalSelection(termRef.current)
+  }, [])
+  const handlePaste = useCallback(async () => {
+    await pasteFromClipboard(sendKey)
+  }, [sendKey])
+
+  // Search effect - debounced search with cheat.sh
+  useEffect(() => {
+    const searchCheatSh = async (query: string) => {
+      if (!query.trim()) {
+        setSearchResults([])
+        setFilteredCommands(localCommands)
+        return
+      }
+
+      try {
+        setIsSearching(true)
+        const searchEndpoint = `/api/terminal/search-command?q=${encodeURIComponent(query)}`
+        const data = await fetchApi<{ success: boolean; examples: any[] }>(searchEndpoint, {
+          method: "GET",
+          signal: AbortSignal.timeout(10000),
+        })
+
+        if (!data.success || !data.examples || data.examples.length === 0) {
+          throw new Error(t("terminal.noExamplesFound"))
+        }
+
+        const formattedResults: CheatSheetResult[] = data.examples.map((example: any) => ({
+          command: example.command,
+          description: example.description || "",
+          examples: [example.command],
+        }))
+
+        setUseOnline(true)
+        setSearchResults(formattedResults)
+      } catch (error) {
+        const filtered = localCommands.filter(
+          (item) =>
+            item.cmd.toLowerCase().includes(query.toLowerCase()) ||
+            item.desc.toLowerCase().includes(query.toLowerCase()),
+        )
+        setFilteredCommands(filtered)
+        setSearchResults([])
+        setUseOnline(false)
+      } finally {
+        setIsSearching(false)
+      }
+    }
+
+    const debounce = setTimeout(() => {
+      if (searchQuery && searchQuery.length >= 2) {
+        searchCheatSh(searchQuery)
+      } else {
+        setSearchResults([])
+        setFilteredCommands(localCommands)
+      }
+    }, 800)
+
+    return () => clearTimeout(debounce)
+  }, [searchQuery, localCommands, t])
+
+  const handleClear = useCallback(() => {
+    if (termRef.current) {
+      termRef.current.clear()
+    }
+  }, [])
+
+  const sendToTerminal = useCallback((command: string) => {
+    if (wsRef.current?.readyState === WebSocket.OPEN) {
+      wsRef.current.send(command)
+      setTimeout(() => {
+        setSearchModalOpen(false)
+      }, 100)
+    }
+  }, [])
+
+  const showMobileControls = isMobile || isTablet
+
+  return (
+    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent
+        className="max-w-4xl w-[95vw] p-0 gap-0 bg-black border-border overflow-hidden flex flex-col"
+        style={{ height: `${modalHeight}px` }}
+        hideClose
+      >
+        {/* Resize bar */}
+        <div
+          ref={resizeBarRef}
+          className="h-3 w-full cursor-ns-resize flex items-center justify-center bg-zinc-900 hover:bg-zinc-800 transition-colors touch-none"
+          onMouseDown={handleResizeStart}
+          onTouchStart={handleResizeStart}
+        >
+          <GripHorizontal className="h-4 w-4 text-zinc-500" />
+        </div>
+
+        {/* Header */}
+        <div className="flex items-center justify-between px-4 py-2 bg-zinc-900 border-b border-zinc-800">
+          <DialogTitle className="text-sm font-medium text-white">
+            {t("lxcTerminal.title", { name: vmName, id: vmid })}
+          </DialogTitle>
+          <div className="flex gap-2">
+            <Button
+              onClick={() => setSearchModalOpen(true)}
+              variant="outline"
+              size="sm"
+              disabled={connectionStatus !== "online"}
+              className="h-8 gap-2 bg-blue-600/20 hover:bg-blue-600/30 border-blue-600/50 text-blue-400 disabled:opacity-50"
+            >
+              <Search className="h-4 w-4" />
+              <span className="hidden sm:inline">{t("terminal.search")}</span>
+            </Button>
+            <Button
+              onClick={handleClear}
+              variant="outline"
+              size="sm"
+              disabled={connectionStatus !== "online"}
+              className="h-8 gap-2 bg-yellow-600/20 hover:bg-yellow-600/30 border-yellow-600/50 text-yellow-400 disabled:opacity-50"
+            >
+              <Trash2 className="h-4 w-4" />
+              <span className="hidden sm:inline">{t("terminal.clear")}</span>
+            </Button>
+          </div>
+        </div>
+
+        {/* Terminal container */}
+        <div className="flex-1 overflow-hidden bg-black p-1">
+          <div
+            ref={terminalContainerRef}
+            className="w-full h-full"
+            style={{ minHeight: "200px" }}
+          />
+        </div>
+
+        {/* Mobile/Tablet control buttons */}
+        {showMobileControls && (
+          <div className="px-2 py-2 bg-zinc-900 border-t border-zinc-800">
+            <div className="flex items-center justify-center gap-1.5">
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendEsc}
+                className="h-8 px-2 text-xs bg-zinc-800 border-zinc-700 text-zinc-300"
+              >
+                ESC
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendTab}
+                className="h-8 px-2 text-xs bg-zinc-800 border-zinc-700 text-zinc-300"
+              >
+                TAB
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendArrowUp}
+                className="h-8 w-8 p-0 bg-zinc-800 border-zinc-700"
+              >
+                <ArrowUp className="h-4 w-4" />
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendArrowDown}
+                className="h-8 w-8 p-0 bg-zinc-800 border-zinc-700"
+              >
+                <ArrowDown className="h-4 w-4" />
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendArrowLeft}
+                className="h-8 w-8 p-0 bg-zinc-800 border-zinc-700"
+              >
+                <ArrowLeft className="h-4 w-4" />
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendArrowRight}
+                className="h-8 w-8 p-0 bg-zinc-800 border-zinc-700"
+              >
+                <ArrowRight className="h-4 w-4" />
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendEnter}
+                className="h-8 px-2 text-xs bg-blue-600/20 border-blue-600/50 text-blue-400 hover:bg-blue-600/30"
+              >
+                <CornerDownLeft className="h-4 w-4 mr-1" />
+                Enter
+              </Button>
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    className="h-8 px-2 text-xs bg-zinc-800 border-zinc-700 text-zinc-300 gap-1"
+                  >
+                    Ctrl
+                    <ChevronDown className="h-3 w-3" />
+                  </Button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end" className="w-56">
+                  <DropdownMenuLabel className="text-xs text-muted-foreground">{t("scriptTerminal.controlSequences")}</DropdownMenuLabel>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuItem onSelect={() => sendKey("\x03")}>
+                    <span className="font-mono text-xs mr-2">Ctrl+C</span>
+                    <span className="text-muted-foreground text-xs">{t("scriptTerminal.cancelInterrupt")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => sendKey("\x18")}>
+                    <span className="font-mono text-xs mr-2">Ctrl+X</span>
+                    <span className="text-muted-foreground text-xs">{t("scriptTerminal.exitNano")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => sendKey("\x12")}>
+                    <span className="font-mono text-xs mr-2">Ctrl+R</span>
+                    <span className="text-muted-foreground text-xs">{t("scriptTerminal.searchHistory")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuLabel className="text-xs text-muted-foreground">{t("scriptTerminal.clipboard")}</DropdownMenuLabel>
+                  <DropdownMenuItem onSelect={() => { void handleCopy() }}>
+                    <Copy className="h-3.5 w-3.5 mr-2" />
+                    <span className="text-xs">{t("scriptTerminal.copySelection")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => { void handlePaste() }}>
+                    <Clipboard className="h-3.5 w-3.5 mr-2" />
+                    <span className="text-xs">{t("scriptTerminal.paste")}</span>
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </div>
+          </div>
+        )}
+
+        {/* Status bar at bottom */}
+        <div className="flex items-center justify-between px-4 py-2 bg-zinc-900 border-t border-zinc-800">
+          <div className="flex items-center gap-3">
+            <Activity className="h-5 w-5 text-blue-500" />
+            <div
+              className={`w-2 h-2 rounded-full ${
+                connectionStatus === "online"
+                  ? "bg-green-500"
+                  : connectionStatus === "connecting"
+                    ? "bg-yellow-500 animate-pulse"
+                    : "bg-red-500"
+              }`}
+            />
+            <span className="text-xs text-zinc-400">{t(`scriptTerminal.${connectionStatus}`)}</span>
+          </div>
+          <Button
+            onClick={onClose}
+            variant="outline"
+            size="sm"
+            className="h-8 gap-2 bg-red-600/20 hover:bg-red-600/30 border-red-600/50 text-red-400"
+          >
+            <X className="h-4 w-4" />
+            <span className="hidden sm:inline">{t("actions.close")}</span>
+          </Button>
+        </div>
+      </DialogContent>
+
+      {/* Search Commands Modal */}
+      <SearchDialog open={searchModalOpen} onOpenChange={setSearchModalOpen}>
+        <SearchDialogContent className="max-w-3xl max-h-[85vh] overflow-hidden flex flex-col">
+          <DialogHeader className="flex flex-row items-center justify-between space-y-0 pb-4 border-b border-zinc-800">
+            <SearchDialogTitle className="text-xl font-semibold">{t("terminal.searchCommands")}</SearchDialogTitle>
+            <div className="flex items-center gap-2">
+              <div
+                className={`w-2 h-2 rounded-full ${useOnline ? "bg-green-500" : "bg-red-500"}`}
+                title={useOnline ? t("terminal.onlineSource") : t("terminal.offlineSource")}
+              />
+            </div>
+          </DialogHeader>
+
+          <DialogDescription className="sr-only">{t("terminal.searchDescription")}</DialogDescription>
+
+          <div className="space-y-4">
+            <div className="relative">
+              <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-zinc-500" />
+              <Input
+                placeholder={t("terminal.searchPlaceholder")}
+                value={searchQuery}
+                onChange={(e) => setSearchQuery(e.target.value)}
+                className="pl-10 bg-zinc-900 border-zinc-700 focus:border-blue-500 focus:ring-1 focus:ring-blue-500 text-base"
+                autoCapitalize="none"
+                autoComplete="off"
+                autoCorrect="off"
+                spellCheck={false}
+              />
+            </div>
+
+            {isSearching && (
+              <div className="text-center py-4 text-zinc-400">
+                <div className="animate-spin inline-block w-6 h-6 border-2 border-current border-t-transparent rounded-full mb-2" />
+                <p className="text-sm">{t("terminal.searchingCheatSh")}</p>
+              </div>
+            )}
+
+            <div className="flex-1 overflow-y-auto space-y-2 pr-2 max-h-[50vh]">
+              {searchResults.length > 0 ? (
+                <>
+                  {searchResults.map((result, index) => (
+                    <div
+                      key={index}
+                      className="p-4 rounded-lg border border-zinc-700 bg-zinc-800/50 hover:border-zinc-600 transition-colors"
+                    >
+                      {result.description && (
+                        <p className="text-xs text-zinc-400 mb-2 leading-relaxed"># {result.description}</p>
+                      )}
+                      <div
+                        onClick={() => sendToTerminal(result.command)}
+                        className="flex items-start justify-between gap-2 cursor-pointer group hover:bg-zinc-800/50 rounded p-2 -m-2"
+                      >
+                        <code className="text-sm text-blue-400 font-mono break-all flex-1">{result.command}</code>
+                        <Send className="h-4 w-4 text-zinc-600 group-hover:text-blue-400 flex-shrink-0 mt-0.5 transition-colors" />
+                      </div>
+                    </div>
+                  ))}
+                  <div className="text-center py-2">
+                    <p className="text-xs text-zinc-500">
+                      <Lightbulb className="inline-block w-3 h-3 mr-1" />
+                      {t("terminal.poweredByCheatSh")}
+                    </p>
+                  </div>
+                </>
+              ) : filteredCommands.length > 0 && !useOnline ? (
+                filteredCommands.map((item, index) => (
+                  <div
+                    key={index}
+                    onClick={() => sendToTerminal(item.cmd)}
+                    className="p-3 rounded-lg border border-zinc-700 bg-zinc-800/50 hover:bg-zinc-800 hover:border-blue-500 cursor-pointer transition-colors"
+                  >
+                    <div className="flex items-start justify-between gap-2">
+                      <div className="flex-1 min-w-0">
+                        <code className="text-sm text-blue-400 font-mono break-all">{item.cmd}</code>
+                        <p className="text-xs text-zinc-400 mt-1">{item.desc}</p>
+                      </div>
+                      <Button
+                        onClick={(e) => {
+                          e.stopPropagation()
+                          sendToTerminal(item.cmd)
+                        }}
+                        size="sm"
+                        variant="ghost"
+                        className="shrink-0 h-7 px-2 text-xs"
+                      >
+                        <Send className="h-3 w-3 mr-1" />
+                        {t("terminal.send")}
+                      </Button>
+                    </div>
+                  </div>
+                ))
+              ) : !isSearching && !searchQuery && !useOnline ? (
+                localCommands.map((item, index) => (
+                  <div
+                    key={index}
+                    onClick={() => sendToTerminal(item.cmd)}
+                    className="p-3 rounded-lg border border-zinc-700 bg-zinc-800/50 hover:bg-zinc-800 hover:border-blue-500 cursor-pointer transition-colors"
+                  >
+                    <div className="flex items-start justify-between gap-2">
+                      <div className="flex-1 min-w-0">
+                        <code className="text-sm text-blue-400 font-mono break-all">{item.cmd}</code>
+                        <p className="text-xs text-zinc-400 mt-1">{item.desc}</p>
+                      </div>
+                      <Button
+                        onClick={(e) => {
+                          e.stopPropagation()
+                          sendToTerminal(item.cmd)
+                        }}
+                        size="sm"
+                        variant="ghost"
+                        className="shrink-0 h-7 px-2 text-xs"
+                      >
+                        <Send className="h-3 w-3 mr-1" />
+                        {t("terminal.send")}
+                      </Button>
+                    </div>
+                  </div>
+                ))
+              ) : !isSearching ? (
+                <div className="text-center py-12 space-y-4">
+                  {searchQuery ? (
+                    <>
+                      <Search className="w-12 h-12 text-zinc-600 mx-auto" />
+                      <div>
+                        <p className="text-zinc-400 font-medium">{t("terminal.noResults", { query: searchQuery })}</p>
+                        <p className="text-xs text-zinc-500 mt-1">{t("terminal.tryDifferentSearch")}</p>
+                      </div>
+                    </>
+                  ) : (
+                    <>
+                      <Terminal className="w-12 h-12 text-zinc-600 mx-auto" />
+                      <div>
+                        <p className="text-zinc-400 font-medium mb-2">{t("terminal.searchAnyCommand")}</p>
+                        <div className="text-sm text-zinc-500 space-y-1">
+                          <p>{t("terminal.trySearchingFor")}</p>
+                          <div className="flex flex-wrap justify-center gap-2 mt-2">
+                            {["tar", "grep", "docker", "systemctl", "curl"].map((cmd) => (
+                              <code
+                                key={cmd}
+                                onClick={() => setSearchQuery(cmd)}
+                                className="px-2 py-1 bg-zinc-800 rounded text-blue-400 cursor-pointer hover:bg-zinc-700"
+                              >
+                                {cmd}
+                              </code>
+                            ))}
+                          </div>
+                        </div>
+                      </div>
+                      {useOnline && (
+                        <div className="flex items-center justify-center gap-2 text-xs text-zinc-600 mt-4">
+                          <Lightbulb className="w-3 h-3" />
+                          <span>{t("terminal.poweredByCheatSh")}</span>
+                        </div>
+                      )}
+                    </>
+                  )}
+                </div>
+              ) : null}
+            </div>
+
+            {useOnline && searchResults.length > 0 && (
+              <div className="pt-2 border-t border-zinc-800 text-xs text-zinc-500 text-right">
+                <span className="text-zinc-600">{t("terminal.poweredByCheatSh")}</span>
+              </div>
+            )}
+          </div>
+        </SearchDialogContent>
+      </SearchDialog>
+    </Dialog>
+  )
+}

AppImage/components/lxc-update-detection.tsx

@@ -0,0 +1,233 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { Boxes, Info, Loader2, Settings2, CheckCircle2 } from "lucide-react"
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card"
+import { Badge } from "./ui/badge"
+import { fetchApi } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+
+interface DetectionResponse {
+  success: boolean
+  enabled?: boolean
+  message?: string
+  purged?: number
+}
+
+export function LxcUpdateDetection() {
+  const t = useT()
+  const [loading, setLoading] = useState(true)
+  const [saving, setSaving] = useState(false)
+  const [enabled, setEnabled] = useState<boolean>(true)
+  const [pending, setPending] = useState<boolean>(true)
+  const [editMode, setEditMode] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [saved, setSaved] = useState(false)
+  const [lastPurged, setLastPurged] = useState<number | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+    fetchApi<DetectionResponse>("/api/lxc-updates/detection")
+      .then(data => {
+        if (cancelled) return
+        if (data.success && typeof data.enabled === "boolean") {
+          setEnabled(data.enabled)
+          setPending(data.enabled)
+        } else {
+          setError(data.message || t("settings.lxcUpdateDetection.loadFailed"))
+        }
+      })
+      .catch(e => {
+        if (!cancelled) setError(t("settings.lxcUpdateDetection.loadFailed"))
+      })
+      .finally(() => {
+        if (!cancelled) setLoading(false)
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  const hasChanges = pending !== enabled
+
+  function handleEdit() {
+    setEditMode(true)
+    setError(null)
+    setSaved(false)
+    setLastPurged(null)
+  }
+
+  function handleCancel() {
+    setPending(enabled)
+    setEditMode(false)
+    setError(null)
+    setLastPurged(null)
+  }
+
+  async function handleSave() {
+    if (!hasChanges) {
+      setEditMode(false)
+      return
+    }
+    setSaving(true)
+    setError(null)
+    setSaved(false)
+    setLastPurged(null)
+    try {
+      const data = await fetchApi<DetectionResponse>("/api/lxc-updates/detection", {
+        method: "POST",
+        body: JSON.stringify({ enabled: pending }),
+      })
+      if (!data.success) {
+        setError(data.message || t("settings.lxcUpdateDetection.saveFailed"))
+        return
+      }
+      setEnabled(pending)
+      setEditMode(false)
+      setSaved(true)
+      setTimeout(() => setSaved(false), 3000)
+      if (!pending && typeof data.purged === "number" && data.purged > 0) {
+        setLastPurged(data.purged)
+      }
+      // Notify the Notifications section so it hides/shows the
+      // lxc_updates_available toggle in real time.
+      if (typeof window !== "undefined") {
+        window.dispatchEvent(
+          new CustomEvent("proxmenux:lxc-detection-changed", { detail: { enabled: pending } }),
+        )
+      }
+    } catch (e) {
+      setError(t("settings.lxcUpdateDetection.saveFailed"))
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <div className="flex items-start justify-between gap-3">
+          {/* Title row — flex-wrap so on narrow screens the badge can drop
+              under the title without dragging the icon along with it. The
+              icon stays on the same baseline as the title text on every
+              breakpoint thanks to `items-center` + leading-tight title. */}
+          <div className="flex items-center gap-2 flex-wrap min-w-0">
+            <Boxes className="h-5 w-5 text-purple-500 shrink-0" />
+            <CardTitle className="leading-tight">{t("settings.lxcUpdateDetection.title")}</CardTitle>
+            {enabled ? (
+              <Badge variant="outline" className="text-[10px] border-green-500/30 text-green-500">
+                {t("status.active")}
+              </Badge>
+            ) : (
+              <Badge variant="outline" className="text-[10px] border-muted-foreground/30 text-muted-foreground">
+                {t("status.disabled")}
+              </Badge>
+            )}
+          </div>
+          <div className="flex items-center gap-2 shrink-0">
+            {saved && (
+              <span className="flex items-center gap-1 text-xs text-green-500">
+                <CheckCircle2 className="h-3.5 w-3.5" />
+                {t("status.saved")}
+              </span>
+            )}
+            {error && !editMode && (
+              <span
+                className="flex items-center gap-1 text-xs text-red-500 max-w-[40ch] truncate"
+                title={error}
+              >
+                {t("status.saveFailed")}: {error}
+              </span>
+            )}
+            {editMode ? (
+              <>
+                <button
+                  className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors text-muted-foreground"
+                  onClick={handleCancel}
+                  disabled={saving}
+                >
+                  {t("actions.cancel")}
+                </button>
+                <button
+                  className="h-7 px-3 text-xs rounded-md bg-blue-600 hover:bg-blue-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1.5"
+                  onClick={handleSave}
+                  disabled={saving || !hasChanges}
+                >
+                  {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <CheckCircle2 className="h-3 w-3" />}
+                  {t("actions.save")}
+                </button>
+              </>
+            ) : (
+              <button
+                className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5"
+                onClick={handleEdit}
+                disabled={loading}
+              >
+                <Settings2 className="h-3 w-3" />
+                {t("actions.edit")}
+              </button>
+            )}
+          </div>
+        </div>
+        <CardDescription>
+          {t("settings.lxcUpdateDetection.descriptionStart")}{" "}
+          (<code>apt list --upgradable</code> / <code>apk list -u</code>)
+          {t("settings.lxcUpdateDetection.descriptionEnd")}
+        </CardDescription>
+      </CardHeader>
+
+      <CardContent
+        className={`space-y-5${
+          editMode
+            ? " bg-accent [&_input]:bg-background [&_textarea]:bg-background [&_[role=combobox]]:bg-background"
+            : ""
+        }`}
+      >
+        {/* ── Enable/Disable ── single-line label + toggle. The description
+            paragraph was removed because the CardDescription above already
+            covers the behaviour; on mobile that second paragraph forced
+            the icon to top-align and made the toggle wrap awkwardly. */}
+        <div className="flex items-center justify-between gap-3 py-2 px-1">
+          <div className="flex items-center gap-2 min-w-0">
+            <Boxes
+              className={`h-4 w-4 shrink-0 ${pending ? "text-purple-500" : "text-muted-foreground"}`}
+            />
+            <span className="text-sm font-medium truncate">{t("settings.lxcUpdateDetection.enableLabel")}</span>
+          </div>
+          <button
+            className={`relative w-10 h-5 rounded-full transition-colors shrink-0 ${
+              pending ? "bg-blue-600" : "bg-muted-foreground/20 border border-muted-foreground/40"
+            } ${!editMode ? "opacity-60 cursor-not-allowed" : "cursor-pointer"}`}
+            onClick={() => editMode && setPending(p => !p)}
+            disabled={!editMode || saving}
+            role="switch"
+            aria-checked={pending}
+            aria-label={t("settings.lxcUpdateDetection.enableLabel")}
+          >
+            <span
+              className={`absolute top-0.5 left-0.5 h-4 w-4 rounded-full bg-white shadow transition-transform ${
+                pending ? "translate-x-5" : "translate-x-0"
+              }`}
+            />
+          </button>
+        </div>
+
+        {lastPurged !== null && lastPurged > 0 && (
+          <div className="flex items-start gap-2 p-3 rounded-lg bg-muted/50 border border-border">
+            <Info className="h-3.5 w-3.5 text-blue-400 shrink-0 mt-0.5" />
+            <p className="text-[11px] text-muted-foreground leading-relaxed">
+              {t("settings.lxcUpdateDetection.purgedMessage", { count: lastPurged })}
+            </p>
+          </div>
+        )}
+
+        {error && editMode && (
+          <div className="flex items-start gap-2 p-3 rounded-lg bg-amber-500/10 border border-amber-500/30">
+            <Info className="h-3.5 w-3.5 text-amber-400 shrink-0 mt-0.5" />
+            <p className="text-[11px] text-amber-500 leading-relaxed break-all">{error}</p>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  )
+}

AppImage/components/metrics-dialog.tsx

@@ -6,6 +6,7 @@ import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@
 import { ArrowLeft, Loader2 } from "lucide-react"
 import { AreaChart, Area, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContainer, Legend } from "recharts"
 import { fetchApi } from "@/lib/api-config"
+import { useI18n } from "@/lib/i18n/provider"
 
 interface MetricsViewProps {
   vmid: number
@@ -15,12 +16,12 @@ interface MetricsViewProps {
 }
 
 const TIMEFRAME_OPTIONS = [
-  { value: "hour", label: "1 Hour" },
-  { value: "day", label: "24 Hours" },
-  { value: "week", label: "7 Days" },
-  { value: "month", label: "30 Days" },
-  { value: "year", label: "1 Year" },
-]
+  { value: "hour", labelKey: "vmMetrics.timeframes.hour" },
+  { value: "day", labelKey: "vmMetrics.timeframes.day" },
+  { value: "week", labelKey: "vmMetrics.timeframes.week" },
+  { value: "month", labelKey: "vmMetrics.timeframes.month" },
+  { value: "year", labelKey: "vmMetrics.timeframes.year" },
+] as const
 
 const CustomCPUTooltip = ({ active, payload, label }: any) => {
   if (active && payload && payload.length) {
@@ -103,6 +104,7 @@ const CustomNetworkTooltip = ({ active, payload, label }: any) => {
 }
 
 export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps) {
+  const { language, t } = useI18n()
   const [timeframe, setTimeframe] = useState("week")
   const [data, setData] = useState<any[]>([])
   const [loading, setLoading] = useState(false)
@@ -112,7 +114,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
 
   useEffect(() => {
     fetchMetrics()
-  }, [vmid, timeframe])
+  }, [vmid, timeframe, language])
 
   const fetchMetrics = async () => {
     setLoading(true)
@@ -126,19 +128,19 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
         let timeLabel = ""
 
         if (timeframe === "hour") {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             hour: "2-digit",
             minute: "2-digit",
             hour12: false,
           })
         } else if (timeframe === "day") {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             hour: "2-digit",
             minute: "2-digit",
             hour12: false,
           })
         } else if (timeframe === "week") {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             month: "short",
             day: "numeric",
             hour: "2-digit",
@@ -146,12 +148,12 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
             hour12: false,
           })
         } else if (timeframe === "month") {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             month: "short",
             day: "numeric",
           })
         } else {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             month: "short",
             year: "numeric",
           })
@@ -173,7 +175,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
 
       setData(transformedData)
     } catch (err: any) {
-      setError(err.message || "Error loading metrics")
+      setError(err.message || t("vmMetrics.errors.loading"))
     } finally {
       setLoading(false)
     }
@@ -203,7 +205,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
     if (data.length === 0) {
       return (
         <div className="flex items-center justify-center h-[400px]">
-          <p className="text-muted-foreground">No data available</p>
+          <p className="text-muted-foreground">{t("vmMetrics.noData")}</p>
         </div>
       )
     }
@@ -214,7 +216,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
       <div className="space-y-8">
         {/* CPU Chart */}
         <div>
-          <h3 className="text-lg font-semibold mb-4">CPU Usage</h3>
+          <h3 className="text-lg font-semibold mb-4">{t("vmMetrics.charts.cpu")}</h3>
           <ResponsiveContainer width="100%" height={300}>
             <AreaChart data={data} margin={{ bottom: 80 }}>
               <CartesianGrid strokeDasharray="3 3" stroke="currentColor" className="text-border" />
@@ -244,7 +246,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
                 strokeWidth={2}
                 fill="#3b82f6"
                 fillOpacity={0.3}
-                name="CPU %"
+                name={t("vmMetrics.series.cpu")}
               />
             </AreaChart>
           </ResponsiveContainer>
@@ -252,7 +254,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
 
         {/* Memory Chart */}
         <div>
-          <h3 className="text-lg font-semibold mb-4">Memory Usage</h3>
+          <h3 className="text-lg font-semibold mb-4">{t("vmMetrics.charts.memory")}</h3>
           <ResponsiveContainer width="100%" height={300}>
             <AreaChart data={data} margin={{ bottom: 80 }}>
               <CartesianGrid strokeDasharray="3 3" stroke="currentColor" className="text-border" />
@@ -282,7 +284,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
                 fill="#10b981"
                 fillOpacity={0.3}
                 strokeWidth={2}
-                name="Memory GB"
+                name={t("vmMetrics.series.memoryGb")}
               />
             </AreaChart>
           </ResponsiveContainer>
@@ -290,7 +292,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
 
         {/* Disk I/O Chart */}
         <div>
-          <h3 className="text-lg font-semibold mb-4">Disk I/O</h3>
+          <h3 className="text-lg font-semibold mb-4">{t("vmMetrics.charts.diskIo")}</h3>
           <ResponsiveContainer width="100%" height={300}>
             <AreaChart data={data} margin={{ bottom: 80 }}>
               <CartesianGrid strokeDasharray="3 3" stroke="currentColor" className="text-border" />
@@ -321,7 +323,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
                 fill="#10b981"
                 fillOpacity={0.3}
                 strokeWidth={2}
-                name="Read"
+                name={t("vmMetrics.series.read")}
                 hide={hiddenDiskLines.includes("diskread")}
               />
               <Area
@@ -331,7 +333,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
                 fill="#3b82f6"
                 fillOpacity={0.3}
                 strokeWidth={2}
-                name="Write"
+                name={t("vmMetrics.series.write")}
                 hide={hiddenDiskLines.includes("diskwrite")}
               />
             </AreaChart>
@@ -340,7 +342,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
 
         {/* Network I/O Chart */}
         <div>
-          <h3 className="text-lg font-semibold mb-4">Network I/O</h3>
+          <h3 className="text-lg font-semibold mb-4">{t("vmMetrics.charts.networkIo")}</h3>
           <ResponsiveContainer width="100%" height={300}>
             <AreaChart data={data} margin={{ bottom: 80 }}>
               <CartesianGrid strokeDasharray="3 3" stroke="currentColor" className="text-border" />
@@ -371,7 +373,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
                 fill="#10b981"
                 fillOpacity={0.3}
                 strokeWidth={2}
-                name="Download"
+                name={t("vmMetrics.series.download")}
                 hide={hiddenNetworkLines.includes("netin")}
               />
               <Area
@@ -381,7 +383,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
                 fill="#3b82f6"
                 fillOpacity={0.3}
                 strokeWidth={2}
-                name="Upload"
+                name={t("vmMetrics.series.upload")}
                 hide={hiddenNetworkLines.includes("netout")}
               />
             </AreaChart>
@@ -461,9 +463,9 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
               <ArrowLeft className="h-5 w-5" />
             </Button>
             <div>
-              <h2 className="text-xl font-semibold">Metrics - {vmName}</h2>
+              <h2 className="text-xl font-semibold">{t("vmMetrics.title", { name: vmName })}</h2>
               <p className="text-sm text-muted-foreground mt-1">
-                VMID: {vmid} • Type: {vmType.toUpperCase()}
+                VMID: {vmid} • {t("vmMetrics.type")}: {vmType.toUpperCase()}
               </p>
             </div>
           </div>
@@ -474,7 +476,7 @@ export function MetricsView({ vmid, vmName, vmType, onBack }: MetricsViewProps)
             <SelectContent>
               {TIMEFRAME_OPTIONS.map((option) => (
                 <SelectItem key={option.value} value={option.value}>
-                  {option.label}
+                  {t(option.labelKey)}
                 </SelectItem>
               ))}
             </SelectContent>

AppImage/components/nav-tab-order-card.tsx

@@ -0,0 +1,373 @@
+"use client"
+
+import React, { useState, useRef, useEffect } from "react"
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card"
+import {
+  Boxes,
+  Check,
+  ChevronDown,
+  DatabaseBackup,
+  GripVertical,
+  Grid3x3,
+  LayoutDashboard,
+  Layers,
+  RotateCcw,
+  Server,
+  Settings2,
+  Terminal,
+} from "lucide-react"
+import { useT } from "../lib/i18n/provider"
+import {
+  DEFAULT_TAB_ORDER,
+  useTabOrder,
+  type TabId,
+} from "../lib/tab-order"
+
+// Long-press activation on touch — matches the delay platform UIs
+// use so the user can still scroll a page that happens to start on a
+// tab handle.
+const TOUCH_ACTIVATION_MS = 250
+const TOUCH_TOLERANCE_PX = 5
+
+type TabMeta = {
+  id: TabId
+  Icon: React.ComponentType<{ className?: string }>
+  labelKey: string
+  hasDropdown: boolean
+}
+
+const META: Record<TabId, TabMeta> = {
+  overview: { id: "overview", Icon: LayoutDashboard, labelKey: "navigation.overview",        hasDropdown: false },
+  apps:     { id: "apps",     Icon: Grid3x3,         labelKey: "navigation.apps",            hasDropdown: false },
+  vms:      { id: "vms",      Icon: Boxes,           labelKey: "navigation.virtualMachines", hasDropdown: false },
+  node:     { id: "node",     Icon: Server,          labelKey: "navigation.node",            hasDropdown: true  },
+  backup:   { id: "backup",   Icon: DatabaseBackup,  labelKey: "navigation.backup",          hasDropdown: false },
+  terminal: { id: "terminal", Icon: Terminal,        labelKey: "navigation.terminal",        hasDropdown: false },
+  admin:    { id: "admin",    Icon: Settings2,       labelKey: "navigation.admin",           hasDropdown: true  },
+}
+
+// Sortable list built on Pointer Events. Mouse activates on move
+// (2px threshold to survive accidental clicks); touch activates on
+// long-press after 250ms unless the finger moves past 5px, which is
+// treated as a scroll intent and the drag is cancelled.
+export function NavTabOrderCard() {
+  const t = useT()
+  const { order: savedOrder, setOrder, reset, isCustom } = useTabOrder()
+  const [editMode, setEditMode] = useState(false)
+  const [draft, setDraft] = useState<TabId[]>(savedOrder)
+  const [saved, setSaved] = useState(false)
+
+  useEffect(() => {
+    if (!editMode) setDraft(savedOrder)
+  }, [savedOrder, editMode])
+
+  const handleCancel = () => {
+    setDraft(savedOrder)
+    setEditMode(false)
+  }
+  const handleSave = () => {
+    setOrder(draft)
+    setEditMode(false)
+    setSaved(true)
+    window.setTimeout(() => setSaved(false), 2000)
+  }
+  const handleReset = () => {
+    setDraft([...DEFAULT_TAB_ORDER])
+  }
+
+  const draftIsChanged =
+    draft.length !== savedOrder.length ||
+    draft.some((id, i) => id !== savedOrder[i])
+  const draftIsCustom =
+    draft.length !== DEFAULT_TAB_ORDER.length ||
+    draft.some((id, i) => id !== DEFAULT_TAB_ORDER[i])
+
+  return (
+    <Card>
+      <CardHeader>
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-2">
+            <Layers className="h-5 w-5 text-blue-500" />
+            <CardTitle>{t("settings.navOrder.title")}</CardTitle>
+          </div>
+          <div className="flex items-center gap-2">
+            {saved && (
+              <span className="flex items-center gap-1 text-xs text-green-500">
+                <Check className="h-3.5 w-3.5" />
+                {t("status.saved")}
+              </span>
+            )}
+            {editMode ? (
+              <>
+                <button
+                  className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors text-muted-foreground"
+                  onClick={handleCancel}
+                >
+                  {t("actions.cancel")}
+                </button>
+                <button
+                  className="h-7 px-3 text-xs rounded-md bg-blue-600 hover:bg-blue-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1.5"
+                  onClick={handleSave}
+                  disabled={!draftIsChanged}
+                >
+                  <Check className="h-3 w-3" />
+                  {t("actions.save")}
+                </button>
+              </>
+            ) : (
+              <button
+                className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5"
+                onClick={() => setEditMode(true)}
+              >
+                <Settings2 className="h-3 w-3" />
+                {t("actions.edit")}
+              </button>
+            )}
+          </div>
+        </div>
+        <CardDescription>{t("settings.navOrder.description")}</CardDescription>
+      </CardHeader>
+      <CardContent
+        className={
+          editMode
+            ? "bg-accent"
+            : undefined
+        }
+      >
+        <SortableList
+          items={editMode ? draft : savedOrder}
+          onReorder={setDraft}
+          editable={editMode}
+          t={t}
+        />
+        {editMode && (
+          <div className="mt-4 flex items-center justify-between">
+            <button
+              className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 text-muted-foreground disabled:opacity-50 disabled:pointer-events-none"
+              onClick={handleReset}
+              disabled={!draftIsCustom}
+            >
+              <RotateCcw className="h-3 w-3" />
+              {t("settings.navOrder.reset")}
+            </button>
+            <span className="text-[11px] text-muted-foreground">
+              {t("settings.navOrder.hint")}
+            </span>
+          </div>
+        )}
+        {!editMode && isCustom && (
+          <div className="mt-3 text-[11px] text-muted-foreground">
+            {t("settings.navOrder.customActive")}
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  )
+}
+
+// -----------------------------------------------------------------
+// SortableList
+// -----------------------------------------------------------------
+
+type DragState = {
+  fromIdx: number
+  pointerY: number
+  offsetY: number
+  itemHeight: number
+} | null
+
+function SortableList({
+  items,
+  onReorder,
+  editable,
+  t,
+}: {
+  items: TabId[]
+  onReorder: (next: TabId[]) => void
+  editable: boolean
+  t: (k: string) => string
+}) {
+  const [drag, setDrag] = useState<DragState>(null)
+  const [hoverIdx, setHoverIdx] = useState<number | null>(null)
+  const listRef = useRef<HTMLUListElement | null>(null)
+
+  const commit = (from: number, to: number) => {
+    if (from === to || to < 0 || to >= items.length) return
+    const next = items.slice()
+    const [moved] = next.splice(from, 1)
+    next.splice(to, 0, moved)
+    onReorder(next)
+  }
+
+  const handleDragMove = (clientY: number) => {
+    if (!drag || !listRef.current) return
+    const rows = Array.from(listRef.current.querySelectorAll<HTMLLIElement>("li[data-row]"))
+    let target = drag.fromIdx
+    for (let i = 0; i < rows.length; i++) {
+      const rect = rows[i].getBoundingClientRect()
+      const mid = rect.top + rect.height / 2
+      if (clientY < mid) { target = i; break }
+      target = i
+    }
+    setHoverIdx(target)
+    setDrag((d) => (d ? { ...d, pointerY: clientY } : d))
+  }
+
+  const handleDragEnd = () => {
+    if (drag && hoverIdx !== null) commit(drag.fromIdx, hoverIdx)
+    setDrag(null)
+    setHoverIdx(null)
+  }
+
+  return (
+    <ul
+      ref={listRef}
+      className="flex flex-col gap-1.5 select-none"
+      onPointerMove={(e) => { if (drag) handleDragMove(e.clientY) }}
+      onPointerUp={handleDragEnd}
+      onPointerCancel={handleDragEnd}
+    >
+      {items.map((id, idx) => {
+        const isDragging = drag?.fromIdx === idx
+        const meta = META[id]
+        return (
+          <SortableRow
+            key={id}
+            id={id}
+            idx={idx}
+            meta={meta}
+            label={t(meta.labelKey)}
+            editable={editable}
+            isDragging={!!isDragging}
+            hoverIdx={hoverIdx}
+            drag={drag}
+            onDragStart={(fromIdx, pointerY, offsetY, itemHeight) => {
+              setDrag({ fromIdx, pointerY, offsetY, itemHeight })
+              setHoverIdx(fromIdx)
+            }}
+          />
+        )
+      })}
+    </ul>
+  )
+}
+
+function SortableRow({
+  id,
+  idx,
+  meta,
+  label,
+  editable,
+  isDragging,
+  hoverIdx,
+  drag,
+  onDragStart,
+}: {
+  id: TabId
+  idx: number
+  meta: TabMeta
+  label: string
+  editable: boolean
+  isDragging: boolean
+  hoverIdx: number | null
+  drag: DragState
+  onDragStart: (fromIdx: number, pointerY: number, offsetY: number, itemHeight: number) => void
+}) {
+  const rowRef = useRef<HTMLLIElement | null>(null)
+  const longPressTimer = useRef<number | null>(null)
+  const pointerStart = useRef<{ x: number; y: number } | null>(null)
+  const activatedRef = useRef(false)
+
+  const cancelLongPress = () => {
+    if (longPressTimer.current !== null) {
+      window.clearTimeout(longPressTimer.current)
+      longPressTimer.current = null
+    }
+  }
+
+  const beginDrag = (clientY: number) => {
+    if (!rowRef.current) return
+    const rect = rowRef.current.getBoundingClientRect()
+    activatedRef.current = true
+    onDragStart(idx, clientY, clientY - rect.top, rect.height)
+  }
+
+  const handlePointerDown = (e: React.PointerEvent<HTMLLIElement>) => {
+    if (!editable) return
+    if (e.button !== undefined && e.button !== 0) return
+    pointerStart.current = { x: e.clientX, y: e.clientY }
+    activatedRef.current = false
+    if (e.pointerType === "touch") {
+      longPressTimer.current = window.setTimeout(() => {
+        longPressTimer.current = null
+        beginDrag(e.clientY)
+      }, TOUCH_ACTIVATION_MS)
+    } else {
+      // Mouse/pen: activate immediately on press.
+      beginDrag(e.clientY)
+    }
+    ;(e.currentTarget as HTMLLIElement).setPointerCapture(e.pointerId)
+  }
+
+  const handlePointerMove = (e: React.PointerEvent<HTMLLIElement>) => {
+    if (!editable) return
+    if (!activatedRef.current && pointerStart.current) {
+      const dx = e.clientX - pointerStart.current.x
+      const dy = e.clientY - pointerStart.current.y
+      if (Math.hypot(dx, dy) > TOUCH_TOLERANCE_PX) {
+        // Movement before activation → scroll intent on touch. Cancel
+        // the pending long-press so the page can scroll normally.
+        cancelLongPress()
+      }
+    }
+  }
+
+  const handlePointerUp = () => {
+    cancelLongPress()
+    pointerStart.current = null
+  }
+
+  // Simple drag visual: ghost the row being dragged, show a blue
+  // drop-line above or below the row the pointer is currently over.
+  // No item swap animation — commit on release.
+  const isTarget = drag && hoverIdx === idx && drag.fromIdx !== idx
+  const dropAbove = isTarget && drag!.fromIdx > idx
+  const dropBelow = isTarget && drag!.fromIdx < idx
+  const RowIcon = meta.Icon
+
+  return (
+    <li
+      ref={rowRef}
+      data-row
+      onPointerDown={handlePointerDown}
+      onPointerMove={handlePointerMove}
+      onPointerUp={handlePointerUp}
+      onPointerCancel={handlePointerUp}
+      className={[
+        "relative rounded-md border transition-colors",
+        editable
+          ? "bg-background border-border cursor-grab active:cursor-grabbing touch-none"
+          : "bg-card border-border/60",
+        isDragging ? "opacity-40" : "",
+      ].join(" ")}
+    >
+      {dropAbove && <div className="absolute -top-[3px] left-2 right-2 h-[2px] bg-blue-500 rounded-full pointer-events-none" />}
+      {dropBelow && <div className="absolute -bottom-[3px] left-2 right-2 h-[2px] bg-blue-500 rounded-full pointer-events-none" />}
+      <div className="flex items-center gap-3 p-2.5">
+        <GripVertical
+          className={
+            "h-4 w-4 flex-shrink-0 " +
+            (editable ? "text-muted-foreground" : "text-muted-foreground/40")
+          }
+        />
+        <RowIcon className="h-4 w-4 flex-shrink-0 text-blue-500" />
+        <div className="flex-1 min-w-0 flex items-center gap-2">
+          <span className="text-sm font-medium text-foreground">{label}</span>
+          {meta.hasDropdown && (
+            <ChevronDown className="h-3 w-3 text-muted-foreground/70" />
+          )}
+        </div>
+      </div>
+    </li>
+  )
+}

AppImage/components/network-card.tsx

@@ -6,6 +6,9 @@ import { Wifi, Zap } from 'lucide-react'
 import { useState, useEffect } from "react"
 import { fetchApi } from "../lib/api-config"
 import { formatNetworkTraffic, getNetworkUnit } from "../lib/format-network"
+import { useT } from "../lib/i18n/provider"
+
+type TFunction = (key: string, params?: Record<string, string | number>) => string
 
 interface NetworkCardProps {
   interface_: {
@@ -32,43 +35,51 @@ interface NetworkCardProps {
   onClick?: () => void
 }
 
-const getInterfaceTypeBadge = (type: string) => {
+const getInterfaceTypeBadge = (type: string, t: TFunction) => {
   switch (type) {
     case "physical":
-      return { color: "bg-blue-500/10 text-blue-500 border-blue-500/20", label: "Physical" }
+      return { color: "bg-blue-500/10 text-blue-500 border-blue-500/20", label: t("network.interfaceTypes.physical") }
     case "bridge":
-      return { color: "bg-green-500/10 text-green-500 border-green-500/20", label: "Bridge" }
+      return { color: "bg-green-500/10 text-green-500 border-green-500/20", label: t("network.interfaceTypes.bridge") }
     case "bond":
-      return { color: "bg-purple-500/10 text-purple-500 border-purple-500/20", label: "Bond" }
+      return { color: "bg-purple-500/10 text-purple-500 border-purple-500/20", label: t("network.interfaceTypes.bond") }
     case "vlan":
-      return { color: "bg-cyan-500/10 text-cyan-500 border-cyan-500/20", label: "VLAN" }
+      return { color: "bg-cyan-500/10 text-cyan-500 border-cyan-500/20", label: t("network.interfaceTypes.vlan") }
     case "vm_lxc":
-      return { color: "bg-orange-500/10 text-orange-500 border-orange-500/20", label: "Virtual" }
+      return { color: "bg-orange-500/10 text-orange-500 border-orange-500/20", label: t("network.interfaceTypes.virtual") }
     case "virtual":
-      return { color: "bg-orange-500/10 text-orange-500 border-orange-500/20", label: "Virtual" }
+      return { color: "bg-orange-500/10 text-orange-500 border-orange-500/20", label: t("network.interfaceTypes.virtual") }
     default:
-      return { color: "bg-gray-500/10 text-gray-500 border-gray-500/20", label: "Unknown" }
+      return { color: "bg-gray-500/10 text-gray-500 border-gray-500/20", label: t("common.unknown") }
   }
 }
 
-const getVMTypeBadge = (vmType: string | undefined) => {
+const getVMTypeBadge = (vmType: string | undefined, t: TFunction) => {
   if (vmType === "lxc") {
     return { color: "bg-cyan-500/10 text-cyan-500 border-cyan-500/20", label: "LXC" }
   } else if (vmType === "vm") {
     return { color: "bg-purple-500/10 text-purple-500 border-purple-500/20", label: "VM" }
   }
-  return { color: "bg-gray-500/10 text-gray-500 border-gray-500/20", label: "Unknown" }
+  return { color: "bg-gray-500/10 text-gray-500 border-gray-500/20", label: t("common.unknown") }
 }
 
-const formatSpeed = (speed: number): string => {
-  if (speed === 0) return "N/A"
+const formatInterfaceStatus = (status: string | undefined, t: TFunction): string => {
+  const normalized = (status || "").toLowerCase()
+  if (normalized === "up") return t("network.status.up")
+  if (normalized === "down") return t("network.status.down")
+  return status || t("common.unknown")
+}
+
+const formatSpeed = (speed: number, unavailable = "N/A"): string => {
+  if (speed === 0) return unavailable
   if (speed >= 1000) return `${(speed / 1000).toFixed(1)} Gbps`
   return `${speed} Mbps`
 }
 
 export function NetworkCard({ interface_, timeframe, onClick }: NetworkCardProps) {
-  const typeBadge = getInterfaceTypeBadge(interface_.type)
-  const vmTypeBadge = interface_.vm_type ? getVMTypeBadge(interface_.vm_type) : null
+  const t = useT()
+  const typeBadge = getInterfaceTypeBadge(interface_.type, t)
+  const vmTypeBadge = interface_.vm_type ? getVMTypeBadge(interface_.vm_type, t) : null
 
   const [networkUnit, setNetworkUnit] = useState<"Bytes" | "Bits">(getNetworkUnit())
 
@@ -109,7 +120,7 @@ export function NetworkCard({ interface_, timeframe, onClick }: NetworkCardProps
           })
         }
       } catch (error) {
-        console.error("[v0] Failed to fetch traffic data for card:", error)
+        console.error("Failed to fetch traffic data for card:", error)
         setTrafficData({ received: 0, sent: 0 })
       }
     }
@@ -125,17 +136,17 @@ export function NetworkCard({ interface_, timeframe, onClick }: NetworkCardProps
   const getTimeframeLabel = () => {
     switch (timeframe) {
       case "hour":
-        return "Last Hour"
+        return t("network.timeframes.last.hour")
       case "day":
-        return "Last 24 Hours"
+        return t("network.timeframes.last.day")
       case "week":
-        return "Last 7 Days"
+        return t("network.timeframes.last.week")
       case "month":
-        return "Last 30 Days"
+        return t("network.timeframes.last.month")
       case "year":
-        return "Last Year"
+        return t("network.timeframes.last.year")
       default:
-        return "Last 24 Hours"
+        return t("network.timeframes.last.day")
     }
   }
 
@@ -174,7 +185,7 @@ export function NetworkCard({ interface_, timeframe, onClick }: NetworkCardProps
                   : "bg-red-500/10 text-red-500 border-red-500/20"
               }
             >
-              {interface_.status.toUpperCase()}
+              {formatInterfaceStatus(interface_.status, t)}
             </Badge>
           </div>
 
@@ -182,22 +193,22 @@ export function NetworkCard({ interface_, timeframe, onClick }: NetworkCardProps
           <div className="grid grid-cols-2 md:grid-cols-4 gap-4 text-sm">
             <div>
               <div className="text-muted-foreground text-xs">
-                {interface_.type === "vm_lxc" ? "VMID" : "IP Address"}
+                {interface_.type === "vm_lxc" ? "VMID" : t("network.labels.ipAddress")}
               </div>
               <div className="font-medium text-foreground font-mono text-sm truncate">
                 {interface_.type === "vm_lxc"
-                  ? (interface_.vmid ?? "N/A")
+                  ? (interface_.vmid ?? t("common.notAvailable"))
                   : interface_.addresses.length > 0
                     ? interface_.addresses[0].ip
-                    : "N/A"}
+                    : t("common.notAvailable")}
               </div>
             </div>
 
             <div>
-              <div className="text-muted-foreground text-xs">Speed</div>
+              <div className="text-muted-foreground text-xs">{t("network.labels.speed")}</div>
               <div className="font-medium text-foreground flex items-center gap-1 text-xs">
                 <Zap className="h-3 w-3" />
-                {formatSpeed(interface_.speed)}
+                {formatSpeed(interface_.speed, t("common.notAvailable"))}
               </div>
             </div>
 

AppImage/components/network-traffic-chart.tsx

@@ -5,6 +5,7 @@ import { AreaChart, Area, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContai
 import { Loader2 } from 'lucide-react'
 import { fetchApi } from "../lib/api-config"
 import { getNetworkUnit } from "../lib/format-network"
+import { useT } from "../lib/i18n/provider"
 
 interface NetworkMetricsData {
   time: string
@@ -50,6 +51,7 @@ export function NetworkTrafficChart({
   refreshInterval = 60000,
   networkUnit: networkUnitProp, // Rename prop to avoid conflict
 }: NetworkTrafficChartProps) {
+  const t = useT()
   const [data, setData] = useState<NetworkMetricsData[]>([])
   const [loading, setLoading] = useState(true)
   const [error, setError] = useState<string | null>(null)
@@ -110,12 +112,11 @@ export function NetworkTrafficChart({
         ? `/api/network/${interfaceName}/metrics?timeframe=${timeframe}`
         : `/api/node/metrics?timeframe=${timeframe}`
 
-      console.log("[v0] Fetching network metrics from:", apiPath)
 
       const result = await fetchApi<any>(apiPath)
 
       if (!result.data || !Array.isArray(result.data)) {
-        throw new Error("Invalid data format received from server")
+        throw new Error(t("network.chart.invalidDataFormat"))
       }
 
       if (result.data.length === 0) {
@@ -207,8 +208,8 @@ export function NetworkTrafficChart({
         setIsInitialLoad(false)
       }
     } catch (err: any) {
-      console.error("[v0] Error fetching network metrics:", err)
-      setError(err.message || "Error loading metrics")
+      console.error("Error fetching network metrics:", err)
+      setError(err.message || t("network.chart.loadError"))
     } finally {
       setLoading(false)
     }
@@ -256,7 +257,7 @@ export function NetworkTrafficChart({
   if (error) {
     return (
       <div className="flex flex-col items-center justify-center h-[300px] gap-2">
-        <p className="text-muted-foreground text-sm">Network metrics not available yet</p>
+        <p className="text-muted-foreground text-sm">{t("overview.networkMetricsUnavailable")}</p>
         <p className="text-xs text-red-500">{error}</p>
       </div>
     )
@@ -265,7 +266,7 @@ export function NetworkTrafficChart({
   if (data.length === 0) {
     return (
       <div className="flex items-center justify-center h-[300px]">
-        <p className="text-muted-foreground text-sm">No network metrics available</p>
+        <p className="text-muted-foreground text-sm">{t("overview.noNetworkMetrics")}</p>
       </div>
     )
   }
@@ -296,7 +297,7 @@ export function NetworkTrafficChart({
           }}
           domain={[0, "auto"]}
         />
-        <Tooltip content={<CustomNetworkTooltip networkUnit={networkUnit} />} /> // Pass networkUnit to tooltip
+        <Tooltip content={<CustomNetworkTooltip networkUnit={networkUnit} />} />
         <Legend verticalAlign="top" height={36} content={renderLegend} />
         <Area
           type="monotone"
@@ -305,7 +306,7 @@ export function NetworkTrafficChart({
           strokeWidth={2}
           fill="#10b981"
           fillOpacity={0.3}
-          name="Received"
+          name={t("overview.receivedShort")}
           hide={!visibleLines.netIn}
           isAnimationActive={true}
           animationDuration={300}
@@ -318,7 +319,7 @@ export function NetworkTrafficChart({
           strokeWidth={2}
           fill="#3b82f6"
           fillOpacity={0.3}
-          name="Sent"
+          name={t("overview.sentShort")}
           hide={!visibleLines.netOut}
           isAnimationActive={true}
           animationDuration={300}

AppImage/components/node-metrics-charts.tsx

@@ -7,12 +7,13 @@ import { AreaChart, Area, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContai
 import { Loader2, TrendingUp, MemoryStick } from "lucide-react"
 import { useIsMobile } from "../hooks/use-mobile"
 import { fetchApi } from "@/lib/api-config"
+import { useI18n } from "../lib/i18n/provider"
 
 const TIMEFRAME_OPTIONS = [
-  { value: "hour", label: "1 Hour" },
-  { value: "day", label: "24 Hours" },
-  { value: "week", label: "7 Days" },
-  { value: "month", label: "30 Days" },
+  { value: "hour", labelKey: "overview.timeframes.hour" },
+  { value: "day", labelKey: "overview.timeframes.day" },
+  { value: "week", labelKey: "overview.timeframes.week" },
+  { value: "month", labelKey: "overview.timeframes.month" },
 ]
 
 interface NodeMetricsData {
@@ -66,11 +67,71 @@ const CustomMemoryTooltip = ({ active, payload, label }: any) => {
   return null
 }
 
+interface MetricsError {
+  headline: string
+  details?: string
+  suggestion?: string
+}
+
+// AVG / MAX / MIN chip row for the chart card headers. Values come
+// from the backend `period_stats` (calculated over the raw RRD points
+// BEFORE downsampling), not from the displayed chart points — that's
+// what makes a 1-minute CPU spike still appear in the 24h MAX even
+// though the chart shows 5-min bucket averages.
+//
+// Colour choice: all three values render in the same foreground tone.
+// The previous red(max)/green(min) scheme misread as severity (a
+// healthy 10 % CPU max showed in red and looked like an alert).
+//
+// Responsive: on ≥sm the chips sit to the right of the title; on
+// mobile they wrap below in their own row (the parent CardHeader uses
+// `flex-col sm:flex-row`). Smaller text + tabular-nums keeps the
+// chips compact enough that they don't crowd long titles.
+type PeriodStat = { avg: number; max: number; min: number } | null
+function ChartStatsHeader({
+  stats,
+  suffix = "",
+  labels,
+}: {
+  stats: PeriodStat
+  suffix?: string
+  labels: { avg: string; max: string; min: string }
+}) {
+  if (!stats) return null
+  const fmt = (n: number) => (n >= 100 ? n.toFixed(0) : n.toFixed(1))
+  return (
+    <div className="flex flex-wrap items-baseline gap-x-3 gap-y-1 text-sm tabular-nums">
+      <span>
+        <span className="font-semibold text-foreground">{fmt(stats.avg)}{suffix}</span>
+        <span className="ml-1 text-xs uppercase tracking-wide text-muted-foreground">{labels.avg}</span>
+      </span>
+      <span>
+        <span className="font-semibold text-foreground">{fmt(stats.max)}{suffix}</span>
+        <span className="ml-1 text-xs uppercase tracking-wide text-muted-foreground">{labels.max}</span>
+      </span>
+      <span>
+        <span className="font-semibold text-foreground">{fmt(stats.min)}{suffix}</span>
+        <span className="ml-1 text-xs uppercase tracking-wide text-muted-foreground">{labels.min}</span>
+      </span>
+    </div>
+  )
+}
+
+
 export function NodeMetricsCharts() {
+  const { language, t } = useI18n()
   const [timeframe, setTimeframe] = useState("day")
   const [data, setData] = useState<NodeMetricsData[]>([])
+  // period_stats from the backend — computed over the raw RRD points
+  // BEFORE the 5-min downsampling so the chart header's MAX/MIN
+  // captures real per-minute extremes (a 1-min CPU spike still shows
+  // up on the 24h view's MAX).
+  const [periodStats, setPeriodStats] = useState<{
+    cpu?: PeriodStat
+    memory_used?: PeriodStat
+  }>({})
   const [loading, setLoading] = useState(true)
-  const [error, setError] = useState<string | null>(null)
+  const [error, setError] = useState<MetricsError | null>(null)
   const isMobile = useIsMobile()
 
   const [visibleLines, setVisibleLines] = useState({
@@ -78,42 +139,35 @@ export function NodeMetricsCharts() {
     memory: { memoryTotal: true, memoryUsed: true, memoryZfsArc: true, memoryFree: true },
   })
 
+  // Check if ZFS ARC or Free memory have any non-zero values to decide if we should show them
+  const hasZfsArc = data.some(d => d.memoryZfsArc > 0)
+  const hasMemoryFree = data.some(d => d.memoryFree > 0)
+
   useEffect(() => {
-    console.log("[v0] NodeMetricsCharts component mounted")
     fetchMetrics()
-  }, [timeframe])
+  }, [timeframe, language])
 
   const fetchMetrics = async () => {
-    console.log("[v0] fetchMetrics called with timeframe:", timeframe)
     setLoading(true)
     setError(null)
 
     try {
       const result = await fetchApi<any>(`/api/node/metrics?timeframe=${timeframe}`)
 
-      console.log("[v0] Node metrics result:", result)
-      console.log("[v0] Result keys:", Object.keys(result))
-      console.log("[v0] Data array length:", result.data?.length || 0)
 
       if (!result.data || !Array.isArray(result.data)) {
-        console.error("[v0] Invalid data format - data is not an array:", result)
-        throw new Error("Invalid data format received from server")
+        console.error("Invalid data format - data is not an array:", result)
+        throw new Error(t("overview.invalidMetricsData"))
       }
 
       if (result.data.length === 0) {
-        console.warn("[v0] No data points received")
+        console.warn("No data points received")
         setData([])
         setLoading(false)
         return
       }
 
-      console.log("[v0] First data point sample:", result.data[0])
-      console.log("[v0] First data point loadavg field:", result.data[0]?.loadavg)
-      console.log("[v0] loadavg type:", typeof result.data[0]?.loadavg)
-      console.log("[v0] loadavg is array:", Array.isArray(result.data[0]?.loadavg))
       if (result.data[0]?.loadavg) {
-        console.log("[v0] loadavg length:", result.data[0].loadavg.length)
-        console.log("[v0] loadavg[0]:", result.data[0].loadavg[0])
       }
 
       const transformedData = result.data.map((item: any) => {
@@ -121,26 +175,26 @@ export function NodeMetricsCharts() {
         let timeLabel = ""
 
         if (timeframe === "hour") {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             hour: "2-digit",
             minute: "2-digit",
             hour12: false,
           })
         } else if (timeframe === "day") {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             hour: "2-digit",
             minute: "2-digit",
             hour12: false,
           })
         } else if (timeframe === "week") {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             month: "short",
             day: "numeric",
             hour: "2-digit",
             hour12: false,
           })
         } else {
-          timeLabel = date.toLocaleString("en-US", {
+          timeLabel = date.toLocaleString(language, {
             month: "short",
             day: "numeric",
           })
@@ -165,13 +219,20 @@ export function NodeMetricsCharts() {
       })
 
       setData(transformedData)
+      setPeriodStats(result.period_stats || {})
     } catch (err: any) {
-      console.error("[v0] Error fetching node metrics:", err)
-      console.error("[v0] Error message:", err.message)
-      console.error("[v0] Error stack:", err.stack)
-      setError(err.message || "Error loading metrics")
+      console.error("Error fetching node metrics:", err)
+      // fetchApi attaches the parsed JSON body to err.body. The metrics
+      // endpoint enriches 503 responses with `details` (Proxmox-side
+      // diagnostic) and `suggestion` (how to fix). Pull them through so
+      // the user sees actionable text instead of a bare "503".
+      const body = err?.body
+      setError({
+        headline: body?.error || err?.message || t("overview.metricsLoadError"),
+        details: body?.details,
+        suggestion: body?.suggestion,
+      })
     } finally {
-      console.log("[v0] fetchMetrics finally block - setting loading to false")
       setLoading(false)
     }
   }
@@ -194,6 +255,11 @@ export function NodeMetricsCharts() {
     return (
       <div className="flex justify-center gap-4 pb-2 flex-wrap">
         {payload.map((entry: any, index: number) => {
+          // For memory chart, hide ZFS ARC and Free from legend if they have no data
+          if (chartType === "memory") {
+            if (entry.dataKey === "memoryZfsArc" && !hasZfsArc) return null
+            if (entry.dataKey === "memoryFree" && !hasMemoryFree) return null
+          }
           const isVisible = visibleLines[chartType][entry.dataKey as keyof (typeof visibleLines)[typeof chartType]]
           return (
             <div
@@ -211,10 +277,8 @@ export function NodeMetricsCharts() {
     )
   }
 
-  console.log("[v0] Render state - loading:", loading, "error:", error, "data length:", data.length)
 
   if (loading) {
-    console.log("[v0] Rendering loading state")
     return (
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
         <Card className="bg-card border-border">
@@ -236,44 +300,54 @@ export function NodeMetricsCharts() {
   }
 
   if (error) {
-    console.log("[v0] Rendering error state:", error)
+    // Both panels carry the same error — render an identical card on
+    // each side. The headline is the short cause, the details block
+    // explains it's a Proxmox-host issue (not a Monitor bug), and the
+    // suggestion is the exact command the operator should run.
+    const errorCard = (
+      <Card className="bg-card border-border">
+        <CardContent className="p-6">
+          <div className="flex flex-col items-start justify-center h-[300px] gap-2 px-2 overflow-auto">
+            <p className="text-sm font-semibold text-red-400">{error.headline}</p>
+            {error.details && (
+              <p className="text-xs text-muted-foreground leading-relaxed">{error.details}</p>
+            )}
+            {error.suggestion && (
+              <div className="w-full mt-2">
+                <p className="text-[10px] uppercase tracking-wide text-muted-foreground mb-1">
+                  {t("overview.suggestedFix")}
+                </p>
+                <code className="block text-xs bg-background/60 border border-border rounded px-2 py-1.5 font-mono break-all">
+                  {error.suggestion}
+                </code>
+              </div>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+    )
     return (
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
-        <Card className="bg-card border-border">
-          <CardContent className="p-6">
-            <div className="flex flex-col items-center justify-center h-[300px] gap-2">
-              <p className="text-muted-foreground text-sm">Metrics data not available yet</p>
-              <p className="text-xs text-red-500">{error}</p>
-            </div>
-          </CardContent>
-        </Card>
-        <Card className="bg-card border-border">
-          <CardContent className="p-6">
-            <div className="flex flex-col items-center justify-center h-[300px] gap-2">
-              <p className="text-muted-foreground text-sm">Metrics data not available yet</p>
-              <p className="text-xs text-red-500">{error}</p>
-            </div>
-          </CardContent>
-        </Card>
+        {errorCard}
+        {errorCard}
       </div>
     )
   }
 
   if (data.length === 0) {
-    console.log("[v0] Rendering no data state")
     return (
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
         <Card className="bg-card border-border">
           <CardContent className="p-6">
             <div className="flex items-center justify-center h-[300px]">
-              <p className="text-muted-foreground text-sm">No metrics data available</p>
+              <p className="text-muted-foreground text-sm">{t("overview.noMetricsData")}</p>
             </div>
           </CardContent>
         </Card>
         <Card className="bg-card border-border">
           <CardContent className="p-6">
             <div className="flex items-center justify-center h-[300px]">
-              <p className="text-muted-foreground text-sm">No metrics data available</p>
+              <p className="text-muted-foreground text-sm">{t("overview.noMetricsData")}</p>
             </div>
           </CardContent>
         </Card>
@@ -281,7 +355,6 @@ export function NodeMetricsCharts() {
     )
   }
 
-  console.log("[v0] Rendering charts with", data.length, "data points")
 
   return (
     <div className="space-y-6">
@@ -294,7 +367,7 @@ export function NodeMetricsCharts() {
           <SelectContent>
             {TIMEFRAME_OPTIONS.map((option) => (
               <SelectItem key={option.value} value={option.value}>
-                {option.label}
+                {t(option.labelKey)}
               </SelectItem>
             ))}
           </SelectContent>
@@ -306,10 +379,21 @@ export function NodeMetricsCharts() {
         {/* CPU Usage + Load Average Chart */}
         <Card className="bg-card border-border">
           <CardHeader className="px-4 md:px-6">
-            <CardTitle className="text-foreground flex items-center">
-              <TrendingUp className="h-5 w-5 mr-2" />
-              CPU Usage & Load Average
-            </CardTitle>
+            <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2">
+              <CardTitle className="text-foreground flex items-center">
+                <TrendingUp className="h-5 w-5 mr-2" />
+                {t("overview.cpuUsageLoadAverage")}
+              </CardTitle>
+              <ChartStatsHeader
+                stats={periodStats.cpu ?? null}
+                suffix="%"
+                labels={{
+                  avg: t("overview.stats.avg"),
+                  max: t("overview.stats.max"),
+                  min: t("overview.stats.min"),
+                }}
+              />
+            </div>
           </CardHeader>
           <CardContent className="px-0 md:px-6">
             <ResponsiveContainer width="100%" height={300}>
@@ -342,7 +426,7 @@ export function NodeMetricsCharts() {
                   className="text-foreground"
                   tick={{ fill: "currentColor", fontSize: 12 }}
                   label={
-                    isMobile ? undefined : { value: "Load", angle: 90, position: "insideRight", fill: "currentColor" }
+                    isMobile ? undefined : { value: t("overview.loadAxis"), angle: 90, position: "insideRight", fill: "currentColor" }
                   }
                   domain={[0, "dataMax"]}
                 />
@@ -356,7 +440,7 @@ export function NodeMetricsCharts() {
                   strokeWidth={2}
                   fill="#3b82f6"
                   fillOpacity={0.3}
-                  name="CPU %"
+                  name={t("overview.cpuPercent")}
                   hide={!visibleLines.cpu.cpu}
                 />
                 <Area
@@ -367,7 +451,7 @@ export function NodeMetricsCharts() {
                   strokeWidth={2}
                   fill="#10b981"
                   fillOpacity={0.3}
-                  name="Load Avg"
+                  name={t("overview.loadAverage")}
                   hide={!visibleLines.cpu.load}
                 />
               </AreaChart>
@@ -378,10 +462,21 @@ export function NodeMetricsCharts() {
         {/* Memory Usage Chart */}
         <Card className="bg-card border-border">
           <CardHeader className="px-4 md:px-6">
-            <CardTitle className="text-foreground flex items-center">
-              <MemoryStick className="h-5 w-5 mr-2" />
-              Memory Usage
-            </CardTitle>
+            <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2">
+              <CardTitle className="text-foreground flex items-center">
+                <MemoryStick className="h-5 w-5 mr-2" />
+                {t("overview.memoryUsage")}
+              </CardTitle>
+              <ChartStatsHeader
+                stats={periodStats.memory_used ?? null}
+                suffix=" GB"
+                labels={{
+                  avg: t("overview.stats.avg"),
+                  max: t("overview.stats.max"),
+                  min: t("overview.stats.min"),
+                }}
+              />
+            </div>
           </CardHeader>
           <CardContent className="px-0 pr-2 md:px-6">
             <ResponsiveContainer width="100%" height={300}>
@@ -415,7 +510,7 @@ export function NodeMetricsCharts() {
                   strokeWidth={2}
                   fill="#3b82f6"
                   fillOpacity={0.1}
-                  name="Total"
+                  name={t("overview.total")}
                   hide={!visibleLines.memory.memoryTotal}
                 />
                 <Area
@@ -425,29 +520,35 @@ export function NodeMetricsCharts() {
                   strokeWidth={2}
                   fill="#10b981"
                   fillOpacity={0.3}
-                  name="Used"
+                  name={t("overview.used")}
                   hide={!visibleLines.memory.memoryUsed}
                 />
-                <Area
-                  type="monotone"
-                  dataKey="memoryZfsArc"
-                  stroke="#f59e0b"
-                  strokeWidth={2}
-                  fill="#f59e0b"
-                  fillOpacity={0.3}
-                  name="ZFS ARC"
-                  hide={!visibleLines.memory.memoryZfsArc}
-                />
-                <Area
-                  type="monotone"
-                  dataKey="memoryFree"
-                  stroke="#06b6d4"
-                  strokeWidth={2}
-                  fill="#06b6d4"
-                  fillOpacity={0.3}
-                  name="Available"
-                  hide={!visibleLines.memory.memoryFree}
-                />
+                {/* Only show ZFS ARC if there's data */}
+                {hasZfsArc && (
+                  <Area
+                    type="monotone"
+                    dataKey="memoryZfsArc"
+                    stroke="#f59e0b"
+                    strokeWidth={2}
+                    fill="#f59e0b"
+                    fillOpacity={0.3}
+                    name="ZFS ARC"
+                    hide={!visibleLines.memory.memoryZfsArc}
+                  />
+                )}
+                {/* Only show Free memory if there's data */}
+                {hasMemoryFree && (
+                  <Area
+                    type="monotone"
+                    dataKey="memoryFree"
+                    stroke="#06b6d4"
+                    strokeWidth={2}
+                    fill="#06b6d4"
+                    fillOpacity={0.3}
+                    name={t("overview.free")}
+                    hide={!visibleLines.memory.memoryFree}
+                  />
+                )}
               </AreaChart>
             </ResponsiveContainer>
           </CardContent>

AppImage/components/onboarding-carousel.tsx

@@ -20,11 +20,12 @@ import {
 } from "lucide-react"
 import Image from "next/image"
 import { Checkbox } from "./ui/checkbox"
+import { useT } from "../lib/i18n/provider"
 
 interface OnboardingSlide {
   id: number
-  title: string
-  description: string
+  titleKey: string
+  descriptionKey: string
   image?: string
   icon: React.ReactNode
   gradient: string
@@ -33,77 +34,70 @@ interface OnboardingSlide {
 const slides: OnboardingSlide[] = [
   {
     id: 0,
-    title: "Welcome to ProxMenux Monitor!",
-    description:
-      "Your new monitoring tool for Proxmox. Discover all the features that will help you manage and supervise your infrastructure efficiently.",
+    titleKey: "onboarding.slides.welcome.title",
+    descriptionKey: "onboarding.slides.welcome.description",
     icon: <Sparkles className="h-16 w-16" />,
     gradient: "from-blue-500 via-purple-500 to-pink-500",
   },
   {
     id: 1,
-    title: "System Overview",
-    description:
-      "Monitor your server's status in real-time: CPU, memory, temperature, system load and more. Everything in an intuitive and easy-to-understand dashboard.",
+    titleKey: "onboarding.slides.overview.title",
+    descriptionKey: "onboarding.slides.overview.description",
     image: "/images/onboarding/imagen1.png",
     icon: <LayoutDashboard className="h-12 w-12" />,
     gradient: "from-blue-500 to-cyan-500",
   },
   {
     id: 2,
-    title: "Storage Management",
-    description:
-      "Visualize the status of all your disks and volumes. Detailed information on capacity, usage, SMART health, temperature and performance of each storage device.",
+    titleKey: "onboarding.slides.storage.title",
+    descriptionKey: "onboarding.slides.storage.description",
     image: "/images/onboarding/imagen2.png",
     icon: <HardDrive className="h-12 w-12" />,
     gradient: "from-cyan-500 to-teal-500",
   },
   {
     id: 3,
-    title: "Network Metrics",
-    description:
-      "Monitor network traffic in real-time. Bandwidth statistics, active interfaces, transfer speeds and historical usage graphs.",
+    titleKey: "onboarding.slides.network.title",
+    descriptionKey: "onboarding.slides.network.description",
     image: "/images/onboarding/imagen3.png",
     icon: <Network className="h-12 w-12" />,
     gradient: "from-teal-500 to-green-500",
   },
   {
     id: 4,
-    title: "Virtual Machines & Containers",
-    description:
-      "Manage all your VMs and LXC containers from one place. Status, allocated resources, current usage and quick controls for each virtual machine.",
+    titleKey: "onboarding.slides.virtualMachines.title",
+    descriptionKey: "onboarding.slides.virtualMachines.description",
     image: "/images/onboarding/imagen4.png",
     icon: <Box className="h-12 w-12" />,
     gradient: "from-green-500 to-emerald-500",
   },
   {
     id: 5,
-    title: "Hardware Information",
-    description:
-      "Complete details of your server hardware: CPU, RAM, GPU, disks, network, UPS and more. Technical specifications, models, serial numbers and status of each component.",
+    titleKey: "onboarding.slides.hardware.title",
+    descriptionKey: "onboarding.slides.hardware.description",
     image: "/images/onboarding/imagen5.png",
     icon: <Cpu className="h-12 w-12" />,
     gradient: "from-emerald-500 to-blue-500",
   },
   {
     id: 6,
-    title: "System Logs",
-    description:
-      "Access system logs in real-time. Filter by event type, search for specific errors and keep complete track of your server activity. Download the displayed logs for further analysis.",
+    titleKey: "onboarding.slides.logs.title",
+    descriptionKey: "onboarding.slides.logs.description",
     image: "/images/onboarding/imagen6.png",
     icon: <FileText className="h-12 w-12" />,
     gradient: "from-blue-500 to-indigo-500",
   },
   {
     id: 7,
-    title: "Ready for the Future!",
-    description:
-      "ProxMenux Monitor is prepared to receive updates and improvements that will be added gradually, improving the user experience and being able to execute ProxMenux functions from the web panel.",
+    titleKey: "onboarding.slides.future.title",
+    descriptionKey: "onboarding.slides.future.description",
     icon: <Rocket className="h-16 w-16" />,
     gradient: "from-indigo-500 via-purple-500 to-pink-500",
   },
 ]
 
 export function OnboardingCarousel() {
+  const t = useT()
   const [open, setOpen] = useState(false)
   const [currentSlide, setCurrentSlide] = useState(0)
   const [direction, setDirection] = useState<"next" | "prev">("next")
@@ -155,11 +149,13 @@ export function OnboardingCarousel() {
   }
 
   const slide = slides[currentSlide]
+  const slideTitle = t(slide.titleKey)
+  const slideDescription = t(slide.descriptionKey)
 
   return (
     <Dialog open={open} onOpenChange={handleClose}>
       <DialogContent className="max-w-4xl p-0 gap-0 overflow-hidden border-0 bg-transparent">
-        <DialogTitle className="sr-only">ProxMenux Onboarding</DialogTitle>
+        <DialogTitle className="sr-only">{t("onboarding.dialogTitle")}</DialogTitle>
         <div className="relative bg-card rounded-lg overflow-hidden shadow-2xl">
           <Button
             variant="ghost"
@@ -181,7 +177,7 @@ export function OnboardingCarousel() {
                 <div className="relative w-full h-36 md:h-48 flex items-center justify-center px-4">
                   <Image
                     src={slide.image || "/placeholder.svg"}
-                    alt={slide.title}
+                    alt={slideTitle}
                     width={600}
                     height={400}
                     className="rounded-lg shadow-2xl object-cover max-h-36 md:max-h-48"
@@ -207,9 +203,9 @@ export function OnboardingCarousel() {
 
           <div className="p-4 md:p-8 space-y-3 md:space-y-6 max-h-[60vh] md:max-h-none overflow-y-auto">
             <div className="space-y-2 md:space-y-3">
-              <h2 className="text-xl md:text-3xl font-bold text-foreground text-balance">{slide.title}</h2>
+              <h2 className="text-xl md:text-3xl font-bold text-foreground text-balance">{slideTitle}</h2>
               <p className="text-sm md:text-lg text-muted-foreground leading-relaxed text-pretty">
-                {slide.description}
+                {slideDescription}
               </p>
             </div>
 
@@ -223,7 +219,7 @@ export function OnboardingCarousel() {
                       ? "w-8 h-2.5 bg-blue-500 shadow-lg shadow-blue-500/50"
                       : "w-2.5 h-2.5 bg-muted-foreground/60 hover:bg-muted-foreground/80 border border-muted-foreground/40"
                   }`}
-                  aria-label={`Go to slide ${index + 1}`}
+                  aria-label={t("onboarding.goToSlide", { number: index + 1 })}
                 />
               ))}
             </div>
@@ -236,7 +232,7 @@ export function OnboardingCarousel() {
                 className="gap-2 w-full sm:w-auto text-sm"
               >
                 <ChevronLeft className="h-4 w-4" />
-                Previous
+                {t("onboarding.previous")}
               </Button>
 
               <div className="flex gap-2 w-full sm:w-auto">
@@ -247,13 +243,13 @@ export function OnboardingCarousel() {
                       onClick={handleSkip}
                       className="flex-1 sm:flex-none bg-transparent text-sm"
                     >
-                      Skip
+                      {t("onboarding.skip")}
                     </Button>
                     <Button
                       onClick={handleNext}
                       className="gap-2 bg-blue-500 hover:bg-blue-600 flex-1 sm:flex-none text-sm"
                     >
-                      Next
+                      {t("onboarding.next")}
                       <ChevronRight className="h-4 w-4" />
                     </Button>
                   </>
@@ -262,7 +258,7 @@ export function OnboardingCarousel() {
                     onClick={handleNext}
                     className="gap-2 bg-gradient-to-r from-blue-500 to-purple-500 hover:from-blue-600 hover:to-purple-600 w-full sm:w-auto text-sm"
                   >
-                    Get Started!
+                    {t("onboarding.getStarted")}
                     <Sparkles className="h-4 w-4" />
                   </Button>
                 )}
@@ -279,7 +275,7 @@ export function OnboardingCarousel() {
                 htmlFor="dont-show-again"
                 className="text-xs md:text-sm text-muted-foreground hover:text-foreground transition-colors cursor-pointer select-none"
               >
-                Don't show this again
+                {t("onboarding.dontShowAgain")}
               </label>
             </div>
           </div>

AppImage/components/process-detail-modal.tsx

@@ -0,0 +1,289 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "./ui/dialog"
+import { Input } from "./ui/input"
+import { ScrollArea } from "./ui/scroll-area"
+import { Cpu, MemoryStick, Search } from "lucide-react"
+import { fetchApi } from "@/lib/api-config"
+import { ProcessInfoModal } from "./process-info-modal"
+import { useT } from "@/lib/i18n/provider"
+
+interface ProcessInfo {
+  pid: number
+  /** Parent process PID — equal to `pid` for process rows, different
+   *  for thread rows (CPU sort enumerates per-thread). The detail modal
+   *  always loads the parent, since /proc/<pid>/cmdline etc. only exist
+   *  at the process level. */
+  parent_pid?: number
+  user: string
+  cpu: number
+  /** CPU% averaged over the process's whole lifetime. Surfaces
+   *  long-running idle processes that consume a steady baseline but
+   *  don't spike during the 1-s sample window (an orphan `bash -s`
+   *  in a sleep-loop, a polling daemon, etc.). Only meaningful on
+   *  the CPU sort response. */
+  cpu_avg?: number
+  mem: number
+  rss_kb: number
+  command: string
+  /** Full command line. Used for filter matching and hover tooltips so
+   *  searching e.g. "proxmenux" finds a process whose short name is just
+   *  "python3" but whose cmdline is `python3 /.../proxmenux.py`. */
+  cmdline?: string
+}
+
+interface ProcessesResponse {
+  processes: ProcessInfo[]
+  sort: "cpu" | "mem"
+  captured_at: number
+}
+
+interface ProcessDetailModalProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  /** Which metric the parent card represents (drives default sort + emphasis) */
+  sort: "cpu" | "mem"
+}
+
+const REFRESH_MS = 3000
+// FETCH_LIMIT is how many rows the server returns. DISPLAY_LIMIT is what
+// the user actually sees when no filter is set. We over-fetch so the
+// filter can find processes that aren't in the top-N by metric — e.g.,
+// searching "proxmenux" in the Memory modal should find it even though
+// it's nowhere near the top 25 by RSS.
+const FETCH_LIMIT = 200
+const DISPLAY_LIMIT = 25
+
+const formatRss = (kb: number): string => {
+  if (kb >= 1024 * 1024) return `${(kb / 1024 / 1024).toFixed(2)} GB`
+  if (kb >= 1024) return `${(kb / 1024).toFixed(1)} MB`
+  return `${kb} KB`
+}
+
+export function ProcessDetailModal({ open, onOpenChange, sort }: ProcessDetailModalProps) {
+  const t = useT()
+  const [data, setData] = useState<ProcessesResponse | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [loading, setLoading] = useState(false)
+  const [filter, setFilter] = useState("")
+  const [selectedPid, setSelectedPid] = useState<number | null>(null)
+
+  const fetchProcesses = async (silent = false) => {
+    if (!silent) setLoading(true)
+    setError(null)
+    try {
+      const res = await fetchApi<ProcessesResponse>(`/api/processes?sort=${sort}&limit=${FETCH_LIMIT}`)
+      setData(res)
+    } catch (e: any) {
+      setError(e?.message || t("details.processes.loadFailed"))
+    } finally {
+      if (!silent) setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    if (!open) return
+    fetchProcesses()
+    const id = setInterval(() => fetchProcesses(true), REFRESH_MS)
+    return () => clearInterval(id)
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open, sort])
+
+  // Reset filter when dialog closes
+  useEffect(() => {
+    if (!open) setFilter("")
+  }, [open])
+
+  // When no filter is set, the user just wants the top N by metric
+  // (CPU usage or memory). When they type a query, they want EVERY
+  // match — including processes that aren't in the top N — which is
+  // why we over-fetch on the server.
+  const allMatches = (data?.processes ?? []).filter((p) => {
+    if (!filter) return true
+    const q = filter.toLowerCase()
+    return (
+      p.command.toLowerCase().includes(q) ||
+      (p.cmdline?.toLowerCase().includes(q) ?? false) ||
+      p.user.toLowerCase().includes(q) ||
+      String(p.pid).includes(q)
+    )
+  })
+  const filtered = filter ? allMatches : allMatches.slice(0, DISPLAY_LIMIT)
+
+  const Icon = sort === "cpu" ? Cpu : MemoryStick
+  const title = sort === "cpu" ? t("details.processes.topByCpu") : t("details.processes.topByMemory")
+  const description =
+    sort === "cpu"
+      ? t("details.processes.cpuDescription")
+      : t("details.processes.memoryDescription")
+
+  // Accent palette matched to the Overview cards: CPU Usage donut uses
+  // blue (#3b82f6), Memory cached uses rgba(99,102,241,0.55) — we keep
+  // the same hues so the modal feels like a continuation of the card.
+  const accent = sort === "cpu"
+    ? { dot: "#3b82f6", bar: "#3b82f6", text: "text-blue-500" }
+    : { dot: "#6366f1", bar: "#6366f1", text: "text-indigo-400" }
+
+  // Scale bars to the largest value in the (filtered) list so the visual
+  // ranking is preserved even when no process is near 100 %. CPU can
+  // exceed 100 % on multi-threaded apps — falling back to max=1 prevents
+  // a divide-by-zero when the list is empty.
+  const maxPrimary = Math.max(
+    1,
+    ...filtered.map((p) => (sort === "cpu" ? p.cpu : p.mem))
+  )
+
+  // Mobile drops PID + USER; desktop keeps the full 5-column layout.
+  // CPU and MEM columns are wider on desktop with a real gap between
+  // them so the two metrics don't feel glued together.
+  const gridCols =
+    "grid-cols-[minmax(0,1fr)_70px_90px] sm:grid-cols-[60px_96px_minmax(140px,1fr)_110px_120px]"
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={onOpenChange}>
+        <DialogContent
+          className="max-w-3xl"
+          /* Prevent Radix from focusing the search Input on open — the
+             auto-focus pops the on-screen keyboard on touch devices and
+             covers half the modal. The user can still tap the field to
+             start filtering. */
+          onOpenAutoFocus={(e) => e.preventDefault()}
+        >
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2">
+              <Icon className={`h-5 w-5 ${accent.text}`} />
+              {title}
+            </DialogTitle>
+            <DialogDescription className="text-xs">{description}</DialogDescription>
+          </DialogHeader>
+
+          <div className="relative mb-2">
+            <Search className="absolute left-2 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
+            <Input
+              placeholder={t("details.processes.filterPlaceholder")}
+              value={filter}
+              onChange={(e) => setFilter(e.target.value)}
+              className="pl-8 h-8 text-sm"
+            />
+          </div>
+
+          {error ? (
+            <div className="text-sm text-red-500 py-4">{error}</div>
+          ) : (
+            <ScrollArea className="h-[440px] border border-border rounded-md">
+              <div className="min-w-full">
+                {/* Sticky solid header so scrolled rows don't bleed through */}
+                <div
+                  className={`grid items-center gap-x-3 sm:gap-x-6 px-3 py-2 text-[10px] font-medium uppercase tracking-wider text-muted-foreground border-b border-border bg-card sticky top-0 z-10 ${gridCols}`}
+                >
+                  <div className="hidden sm:block">{t("details.processes.pid")}</div>
+                  <div className="hidden sm:block truncate">{t("details.processes.user")}</div>
+                  <div>{t("details.processes.command")}</div>
+                  <div className={`text-right ${sort === "cpu" ? accent.text : ""}`}>{t("details.processes.cpuPercent")}</div>
+                  <div className={`text-right ${sort === "mem" ? accent.text : ""}`}>
+                    {sort === "mem" ? t("details.processes.memory") : t("details.processes.memPercent")}
+                  </div>
+                </div>
+
+                {filtered.length === 0 && !loading ? (
+                  <div className="text-center py-8 text-sm text-muted-foreground">
+                    {t("details.processes.noMatches")}
+                  </div>
+                ) : (
+                  filtered.map((p) => {
+                    const primary = sort === "cpu" ? p.cpu : p.mem
+                    const barPct = Math.min(100, (primary / maxPrimary) * 100)
+                    return (
+                      <button
+                        key={p.pid}
+                        type="button"
+                        onClick={() => setSelectedPid(p.parent_pid ?? p.pid)}
+                        className={`w-full text-left grid items-center gap-x-3 sm:gap-x-6 px-3 py-2 border-b border-border/40 hover:bg-white/5 transition-colors ${gridCols}`}
+                      >
+                        <div className="hidden sm:flex font-mono text-xs items-center gap-1.5 min-w-0">
+                          <span
+                            className="w-1.5 h-1.5 rounded-full flex-shrink-0"
+                            style={{ background: accent.dot }}
+                          />
+                          <span className="truncate">{p.pid}</span>
+                        </div>
+                        <div className="hidden sm:block font-mono text-xs truncate" title={p.user}>{p.user}</div>
+                        <div className="font-mono text-xs truncate min-w-0 flex items-center gap-1.5" title={p.cmdline || p.command}>
+                          {/* Mobile only: keep the accent dot since PID column is gone */}
+                          <span
+                            className="sm:hidden w-1.5 h-1.5 rounded-full flex-shrink-0"
+                            style={{ background: accent.dot }}
+                          />
+                          <span className="truncate">{p.command}</span>
+                        </div>
+
+                        {/* Primary metric: value + sized progress bar in the accent colour */}
+                        {sort === "cpu" ? (
+                          <div className="flex flex-col items-end gap-1 min-w-0">
+                            <span className={`font-mono text-sm font-semibold ${accent.text}`}>{p.cpu.toFixed(1)}</span>
+                            {/* Show lifetime average only when it
+                                materially differs from the live
+                                sample (process consumes a steady
+                                baseline but was idle at sample time
+                                — orphaned bash loop, polling daemon).
+                                The 0.5 / 1.5x thresholds skip cases
+                                where avg and now match within sampler
+                                noise. */}
+                            {typeof p.cpu_avg === "number" && p.cpu_avg >= 0.5 && p.cpu_avg > p.cpu * 1.5 && (
+                              <span className="font-mono text-[10px] text-amber-400" title={t("details.processes.lifetimeAverageTitle")}>
+                                {t("details.processes.averageShort")} {p.cpu_avg.toFixed(1)}
+                              </span>
+                            )}
+                            <div className="w-full h-1 bg-muted rounded-full overflow-hidden">
+                              <div className="h-full rounded-full" style={{ width: `${barPct}%`, background: accent.bar }} />
+                            </div>
+                          </div>
+                        ) : (
+                          <div className="font-mono text-xs text-right text-muted-foreground">{p.cpu.toFixed(1)}</div>
+                        )}
+
+                        {/* Secondary column: mem % when CPU is primary, RSS when memory is primary */}
+                        {sort === "cpu" ? (
+                          <div className="font-mono text-xs text-right text-muted-foreground">{p.mem.toFixed(1)}</div>
+                        ) : (
+                          <div className="flex flex-col items-end gap-1 min-w-0">
+                            <span className={`font-mono text-sm font-semibold ${accent.text}`}>{formatRss(p.rss_kb)}</span>
+                            <div className="w-full h-1 bg-muted rounded-full overflow-hidden">
+                              <div className="h-full rounded-full" style={{ width: `${barPct}%`, background: accent.bar }} />
+                            </div>
+                          </div>
+                        )}
+                      </button>
+                    )
+                  })
+                )}
+              </div>
+            </ScrollArea>
+          )}
+
+          {data?.captured_at && (
+            <div className="text-[10px] text-muted-foreground text-right mt-1">
+              {t("details.processes.captured", { time: new Date(data.captured_at * 1000).toLocaleTimeString() })} · {filter
+                ? t(allMatches.length === 1 ? "details.processes.matchCount" : "details.processes.matchesCount", {
+                    count: allMatches.length,
+                    total: data.processes.length,
+                  })
+                : t("details.processes.topCount", {
+                    shown: filtered.length,
+                    total: data.processes.length,
+                  })}
+            </div>
+          )}
+        </DialogContent>
+      </Dialog>
+
+      <ProcessInfoModal
+        pid={selectedPid}
+        accent={accent}
+        onClose={() => setSelectedPid(null)}
+      />
+    </>
+  )
+}

AppImage/components/process-info-modal.tsx

@@ -0,0 +1,261 @@
+"use client"
+
+import { useEffect, useRef, useState } from "react"
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "./ui/dialog"
+import { ScrollArea } from "./ui/scroll-area"
+import { Activity, FileText, HardDrive, Clock, Info } from "lucide-react"
+import { fetchApi } from "@/lib/api-config"
+import { useI18n } from "../lib/i18n/provider"
+
+interface ProcessDetail {
+  pid: number
+  comm: string
+  cmdline: string
+  exe: string | null
+  cwd: string | null
+  state: string
+  ppid: number
+  parent_name: string | null
+  threads: number
+  vm_rss_kb: number
+  vm_size_kb: number
+  vm_swap_kb: number
+  user: string
+  group: string
+  uid: number
+  gid: number
+  start_time: string | null
+  elapsed: string | null
+  cpu: number
+  mem: number
+  io_read_bytes: number | null
+  io_write_bytes: number | null
+  fd_count: number | null
+  captured_at: number
+}
+
+interface ProcessInfoModalProps {
+  pid: number | null
+  accent: { dot: string; bar: string; text: string }
+  onClose: () => void
+}
+
+const REFRESH_MS = 3000
+
+const formatKb = (kb: number | null | undefined): string => {
+  if (kb == null) return "—"
+  if (kb >= 1024 * 1024) return `${(kb / 1024 / 1024).toFixed(2)} GB`
+  if (kb >= 1024) return `${(kb / 1024).toFixed(1)} MB`
+  return `${kb} KB`
+}
+
+const formatBytes = (b: number | null | undefined): string => {
+  if (b == null) return "—"
+  if (b >= 1024 * 1024 * 1024) return `${(b / 1024 / 1024 / 1024).toFixed(2)} GB`
+  if (b >= 1024 * 1024) return `${(b / 1024 / 1024).toFixed(1)} MB`
+  if (b >= 1024) return `${(b / 1024).toFixed(1)} KB`
+  return `${b} B`
+}
+
+// Linux process states from /proc/<pid>/status. The first char of `State:`
+// is the canonical letter — the rest of the field is a human label like
+// "(running)". We expand the bare letter to something readable.
+const stateLabel = (state: string, t: (key: string) => string): string => {
+  const rawLetter = (state || "").trim().charAt(0)
+  const letter = rawLetter.toUpperCase()
+  const map: Record<string, string> = {
+    R: "running",
+    S: "sleeping",
+    D: "diskWait",
+    Z: "zombie",
+    T: rawLetter === "t" ? "tracingStop" : "stopped",
+    X: "dead",
+    I: "idle",
+  }
+  const key = map[letter]
+  return key ? t(`details.processInfo.states.${key}`) : state || "—"
+}
+
+export function ProcessInfoModal({ pid, accent, onClose }: ProcessInfoModalProps) {
+  const { language, t } = useI18n()
+  const [data, setData] = useState<ProcessDetail | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [loading, setLoading] = useState(false)
+  const [exited, setExited] = useState(false)
+  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)
+  const open = pid != null
+
+  const stopPolling = () => {
+    if (intervalRef.current) {
+      clearInterval(intervalRef.current)
+      intervalRef.current = null
+    }
+  }
+
+  const fetchDetail = async (silent = false) => {
+    if (pid == null) return
+    if (!silent) setLoading(true)
+    setError(null)
+    try {
+      const res = await fetchApi<ProcessDetail>(`/api/processes/${pid}`)
+      setData(res)
+    } catch (e: any) {
+      // 404 = the process exited while the modal was open. Expected for
+      // short-lived helpers (pct exec, backup subprocesses, the `ps` snapshot
+      // itself). Keep the last good snapshot on screen, stop polling, and
+      // surface an info banner — NOT an error — so it doesn't look like a bug.
+      if (e?.message?.includes("404")) {
+        setExited(true)
+        stopPolling()
+      } else {
+        setError(t("details.processInfo.fetchFailed"))
+      }
+    } finally {
+      if (!silent) setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    if (pid == null) {
+      setData(null)
+      setError(null)
+      setExited(false)
+      stopPolling()
+      return
+    }
+    setExited(false)
+    fetchDetail()
+    intervalRef.current = setInterval(() => fetchDetail(true), REFRESH_MS)
+    return () => stopPolling()
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [pid])
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent className="max-w-2xl">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2 min-w-0">
+            <span
+              className="w-2 h-2 rounded-full flex-shrink-0"
+              style={{ background: accent.dot }}
+            />
+            <span className="truncate font-mono text-base">{data?.comm || t("details.processInfo.titleFallback")}</span>
+            <span className="text-xs text-muted-foreground font-mono flex-shrink-0">PID {pid}</span>
+          </DialogTitle>
+          <DialogDescription className="text-xs">
+            {exited
+              ? t("details.processInfo.descriptionExited", { pid: pid ?? "" })
+              : t("details.processInfo.descriptionLive", { pid: pid ?? "", seconds: REFRESH_MS / 1000 })}
+          </DialogDescription>
+        </DialogHeader>
+
+        {/* Info banner when the process has finished. Amber, not red — this is
+            expected behavior for short-lived processes, not an error. */}
+        {exited && (
+          <div className="flex items-start gap-2 px-3 py-2 rounded-md border border-amber-500/30 bg-amber-500/10 text-xs text-amber-300">
+            <Info className="h-4 w-4 flex-shrink-0 mt-0.5" />
+            <div>
+              <div className="font-medium text-amber-200">{t("details.processInfo.finishedTitle")}</div>
+              <div className="text-amber-300/80 mt-0.5">
+                {t("details.processInfo.finishedDescription")}
+              </div>
+            </div>
+          </div>
+        )}
+
+        {error && !data ? (
+          <div className="text-sm text-red-500 py-4">{error}</div>
+        ) : !data ? (
+          <div className="text-sm text-muted-foreground py-8 text-center">
+            {loading ? t("details.processInfo.loading") : "—"}
+          </div>
+        ) : (
+          <ScrollArea className={`max-h-[480px] pr-2 ${exited ? "opacity-75" : ""}`}>
+            <div className="space-y-4">
+              {/* Overview */}
+              <Section icon={<Activity className="h-4 w-4 text-blue-400" />} title={t("details.processInfo.sections.overview")}>
+                <Row label={t("details.processInfo.labels.state")} value={exited ? t("details.processInfo.states.exited") : stateLabel(data.state, t)} />
+                <Row label={t("details.processInfo.labels.parent")} value={data.parent_name ? `${data.parent_name} (PID ${data.ppid})` : `PID ${data.ppid}`} mono />
+                <Row label={t("details.processInfo.labels.threads")} value={String(data.threads)} mono />
+                <Row label={t("details.processInfo.labels.openFds")} value={data.fd_count != null ? String(data.fd_count) : "—"} mono />
+                <Row label={t("details.processInfo.labels.user")} value={`${data.user} (${data.uid})`} mono />
+                <Row label={t("details.processInfo.labels.group")} value={`${data.group} (${data.gid})`} mono />
+              </Section>
+
+              {/* Resources */}
+              <Section icon={<HardDrive className="h-4 w-4 text-amber-400" />} title={t("details.processInfo.sections.resources")}>
+                <Row label={t("details.processInfo.labels.cpu")} value={`${data.cpu.toFixed(1)} %`} mono valueClass={accent.text} />
+                <Row label={t("details.processInfo.labels.memory")} value={`${data.mem.toFixed(1)} %`} mono valueClass={accent.text} />
+                <Row label={t("details.processInfo.labels.residentRss")} value={formatKb(data.vm_rss_kb)} mono />
+                <Row label={t("details.processInfo.labels.virtualSize")} value={formatKb(data.vm_size_kb)} mono />
+                <Row label={t("details.processInfo.labels.swap")} value={formatKb(data.vm_swap_kb)} mono />
+                <Row label={t("details.processInfo.labels.ioRead")} value={formatBytes(data.io_read_bytes)} mono />
+                <Row label={t("details.processInfo.labels.ioWrite")} value={formatBytes(data.io_write_bytes)} mono />
+              </Section>
+
+              {/* Command */}
+              <Section icon={<FileText className="h-4 w-4 text-purple-400" />} title={t("details.processInfo.sections.command")}>
+                <Row label={t("details.processInfo.labels.name")} value={data.comm} mono />
+                <Row label={t("details.processInfo.labels.commandLine")} value={data.cmdline || data.comm} mono wrap />
+                <Row label={t("details.processInfo.labels.executable")} value={data.exe || "—"} mono wrap />
+                <Row label={t("details.processInfo.labels.workingDir")} value={data.cwd || "—"} mono wrap />
+              </Section>
+
+              {/* Times */}
+              <Section icon={<Clock className="h-4 w-4 text-emerald-400" />} title={t("details.processInfo.sections.lifetime")}>
+                <Row label={t("details.processInfo.labels.started")} value={data.start_time || "—"} mono />
+                <Row label={t("details.processInfo.labels.runningFor")} value={data.elapsed || "—"} mono />
+              </Section>
+            </div>
+          </ScrollArea>
+        )}
+
+        {data?.captured_at && (
+          <div className="text-[10px] text-muted-foreground text-right mt-1">
+            {exited ? t("details.processInfo.lastSeen") : t("details.processInfo.captured")}{" "}
+            {new Date(data.captured_at * 1000).toLocaleTimeString(language)}
+            {error ? ` · ${error}` : ""}
+          </div>
+        )}
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+function Section({ icon, title, children }: { icon: React.ReactNode; title: string; children: React.ReactNode }) {
+  return (
+    <div className="border border-border rounded-md overflow-hidden">
+      <div className="flex items-center gap-2 px-3 py-2 bg-card text-xs font-medium uppercase tracking-wider text-muted-foreground border-b border-border">
+        {icon}
+        {title}
+      </div>
+      <div className="divide-y divide-border/40">{children}</div>
+    </div>
+  )
+}
+
+function Row({
+  label,
+  value,
+  mono,
+  wrap,
+  valueClass,
+}: {
+  label: string
+  value: string
+  mono?: boolean
+  wrap?: boolean
+  valueClass?: string
+}) {
+  return (
+    <div className="grid grid-cols-[110px_minmax(0,1fr)] gap-2 px-3 py-1.5 text-xs">
+      <div className="text-muted-foreground">{label}</div>
+      <div
+        className={`${mono ? "font-mono" : ""} ${wrap ? "break-all" : "truncate"} ${valueClass || ""}`}
+        title={value}
+      >
+        {value}
+      </div>
+    </div>
+  )
+}

AppImage/components/profile.tsx

@@ -0,0 +1,465 @@
+"use client"
+
+import { useEffect, useRef, useState } from "react"
+import {
+  User as UserIcon,
+  Upload,
+  Trash2,
+  Loader2,
+  Check,
+  AlertCircle,
+  Shield,
+  Lock,
+  X,
+  Settings2,
+  CheckCircle2,
+} from "lucide-react"
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card"
+import { Button } from "./ui/button"
+import { Input } from "./ui/input"
+import { Label } from "./ui/label"
+import { fetchApi, getApiUrl, getAuthToken } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+
+interface ProfileData {
+  success: boolean
+  username?: string | null
+  display_name?: string | null
+  has_avatar?: boolean
+  avatar_mtime?: number | null
+  avatar_content_type?: string | null
+  message?: string
+}
+
+interface ProfileProps {
+  /** Optional navigation hook so the page can link to Security for
+   *  password / 2FA changes without redirecting through a URL. */
+  onOpenSecurity?: () => void
+}
+
+/**
+ * Profile page (Fase 2, v1.2.2).
+ *
+ * Lets the operator edit their **display name** and upload / remove
+ * their **avatar**. Username is read-only (changing it requires
+ * disabling and reconfiguring auth from Security). Password / 2FA
+ * are intentionally not editable from this page — those live in
+ * Security to keep the "account security" surface in one place.
+ *
+ * Layout: centered, two cards (Profile + Account security shortcut).
+ * Display name uses the same Edit / Save / Cancel pattern as the
+ * Health Thresholds / Notifications panels — read-only by default,
+ * the operator hits Edit to start typing.
+ */
+export function Profile({ onOpenSecurity }: ProfileProps) {
+  const t = useT()
+  const [profile, setProfile] = useState<ProfileData | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [error, setError] = useState<string | null>(null)
+
+  // Display name: read-only by default, editable after pressing Edit.
+  // Mirrors the editMode pattern used in HealthThresholds / Notifications
+  // so the operator never types into a field that isn't ready to be saved.
+  const [displayEditMode, setDisplayEditMode] = useState(false)
+  const [displayDraft, setDisplayDraft] = useState("")
+  const [savingDisplay, setSavingDisplay] = useState(false)
+  const [savedDisplay, setSavedDisplay] = useState(false)
+
+  // Avatar state.
+  const [uploadingAvatar, setUploadingAvatar] = useState(false)
+  const [avatarError, setAvatarError] = useState<string | null>(null)
+  const [avatarBlobUrl, setAvatarBlobUrl] = useState<string | null>(null)
+  const fileInputRef = useRef<HTMLInputElement>(null)
+
+  const loadProfile = async () => {
+    try {
+      const data = await fetchApi<ProfileData>("/api/auth/profile")
+      setProfile(data)
+      setDisplayDraft(data.display_name || "")
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    loadProfile()
+  }, [])
+
+  // Avatar fetch. Same blob-URL pattern as in AvatarMenu — the endpoint
+  // requires the Bearer header, which <img src=…> can't send. Plain
+  // `<img>` would render a broken image icon (the bug the user reported).
+  useEffect(() => {
+    let cancelled = false
+    let currentBlobUrl: string | null = null
+    if (profile?.has_avatar) {
+      const token = getAuthToken()
+      const url = `${getApiUrl("/api/auth/profile/avatar")}?v=${profile.avatar_mtime || ""}`
+      fetch(url, { headers: token ? { Authorization: `Bearer ${token}` } : {} })
+        .then(r => (r.ok ? r.blob() : null))
+        .then(blob => {
+          if (cancelled || !blob) return
+          currentBlobUrl = URL.createObjectURL(blob)
+          setAvatarBlobUrl(currentBlobUrl)
+        })
+        .catch(() => {
+          if (!cancelled) setAvatarBlobUrl(null)
+        })
+    } else {
+      setAvatarBlobUrl(null)
+    }
+    return () => {
+      cancelled = true
+      if (currentBlobUrl) URL.revokeObjectURL(currentBlobUrl)
+    }
+  }, [profile?.has_avatar, profile?.avatar_mtime])
+
+  const initial = (profile?.display_name || profile?.username || "U")
+    .trim()
+    .charAt(0)
+    .toUpperCase()
+
+  const hasDisplayChanges = displayDraft !== (profile?.display_name || "")
+
+  const handleEditDisplay = () => {
+    setDisplayEditMode(true)
+    setSavedDisplay(false)
+    setError(null)
+  }
+
+  const handleCancelDisplay = () => {
+    setDisplayDraft(profile?.display_name || "")
+    setDisplayEditMode(false)
+    setError(null)
+  }
+
+  const handleSaveDisplayName = async () => {
+    if (!hasDisplayChanges) {
+      setDisplayEditMode(false)
+      return
+    }
+    setSavingDisplay(true)
+    setError(null)
+    setSavedDisplay(false)
+    try {
+      const data = await fetchApi<ProfileData>("/api/auth/profile", {
+        method: "PUT",
+        body: JSON.stringify({ display_name: displayDraft }),
+      })
+      if (!data.success) {
+        setError(data.message || t("profilePage.errors.saveDisplayNameFailed"))
+        return
+      }
+      setProfile(data)
+      setDisplayEditMode(false)
+      setSavedDisplay(true)
+      setTimeout(() => setSavedDisplay(false), 2500)
+      if (typeof window !== "undefined") {
+        window.dispatchEvent(new CustomEvent("proxmenux:profile-changed"))
+      }
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setSavingDisplay(false)
+    }
+  }
+
+  const handleAvatarPick = () => fileInputRef.current?.click()
+
+  const handleAvatarFile = async (file: File) => {
+    setUploadingAvatar(true)
+    setAvatarError(null)
+    try {
+      const token = getAuthToken()
+      const headers: Record<string, string> = {}
+      if (token) headers["Authorization"] = `Bearer ${token}`
+      // Raw upload (Content-Type = the image's own MIME) — simpler than
+      // multipart and the backend handles both.
+      headers["Content-Type"] = file.type
+      const r = await fetch(getApiUrl("/api/auth/profile/avatar"), {
+        method: "POST",
+        headers,
+        body: file,
+      })
+      const data: ProfileData = await r.json().catch(() => ({ success: false }))
+      if (!r.ok || !data.success) {
+        setAvatarError(data.message || t("profilePage.errors.uploadFailed", { status: r.status }))
+        return
+      }
+      setProfile(data)
+      if (typeof window !== "undefined") {
+        window.dispatchEvent(new CustomEvent("proxmenux:profile-changed"))
+      }
+    } catch (e) {
+      setAvatarError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setUploadingAvatar(false)
+      // Reset the input so picking the same file twice in a row still
+      // fires the change event.
+      if (fileInputRef.current) fileInputRef.current.value = ""
+    }
+  }
+
+  const handleAvatarDelete = async () => {
+    setUploadingAvatar(true)
+    setAvatarError(null)
+    try {
+      const token = getAuthToken()
+      const headers: Record<string, string> = {}
+      if (token) headers["Authorization"] = `Bearer ${token}`
+      const r = await fetch(getApiUrl("/api/auth/profile/avatar"), {
+        method: "DELETE",
+        headers,
+      })
+      const data: ProfileData = await r.json().catch(() => ({ success: false }))
+      if (!r.ok || !data.success) {
+        setAvatarError(data.message || t("profilePage.errors.deleteFailed", { status: r.status }))
+        return
+      }
+      setProfile(data)
+      if (typeof window !== "undefined") {
+        window.dispatchEvent(new CustomEvent("proxmenux:profile-changed"))
+      }
+    } catch (e) {
+      setAvatarError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setUploadingAvatar(false)
+    }
+  }
+
+  if (loading) {
+    return (
+      <div className="max-w-2xl mx-auto">
+        <Card>
+          <CardContent className="p-8 flex items-center justify-center text-muted-foreground">
+            <Loader2 className="h-4 w-4 animate-spin mr-2" />
+            {t("profilePage.loading")}
+          </CardContent>
+        </Card>
+      </div>
+    )
+  }
+
+  if (error && !profile) {
+    return (
+      <div className="max-w-2xl mx-auto">
+        <Card>
+          <CardContent className="p-6">
+            <div className="flex items-start gap-2 text-red-500">
+              <AlertCircle className="h-5 w-5 shrink-0 mt-0.5" />
+              <div>
+                <div className="font-medium">{t("profilePage.loadFailed")}</div>
+                <div className="text-xs text-muted-foreground mt-1 break-all">{error}</div>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    )
+  }
+
+  return (
+    <div className="max-w-2xl mx-auto space-y-6">
+      <Card>
+        <CardHeader>
+          {/* Edit / Save / Cancel sit in the card header — same pattern
+              as Health Thresholds and Notifications. Avatar actions
+              (upload / remove) stay independent of editMode because
+              they're explicit one-shot actions, not field edits. */}
+          <div className="flex items-center justify-between gap-2 flex-wrap">
+            <div className="flex items-center gap-2">
+              <UserIcon className="h-5 w-5 text-cyan-500" />
+              <CardTitle>{t("profilePage.title")}</CardTitle>
+            </div>
+            <div className="flex items-center gap-2">
+              {savedDisplay && (
+                <span className="flex items-center gap-1 text-xs text-green-500">
+                  <Check className="h-3.5 w-3.5" />
+                  {t("status.saved")}
+                </span>
+              )}
+              {displayEditMode ? (
+                <>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    onClick={handleCancelDisplay}
+                    disabled={savingDisplay}
+                    className="h-7 text-xs"
+                  >
+                    {t("actions.cancel")}
+                  </Button>
+                  <Button
+                    size="sm"
+                    onClick={handleSaveDisplayName}
+                    disabled={savingDisplay || !hasDisplayChanges}
+                    className="h-7 text-xs bg-blue-600 hover:bg-blue-700"
+                  >
+                    {savingDisplay ? (
+                      <Loader2 className="h-3 w-3 mr-1.5 animate-spin" />
+                    ) : (
+                      <CheckCircle2 className="h-3 w-3 mr-1.5" />
+                    )}
+                    {t("actions.save")}
+                  </Button>
+                </>
+              ) : (
+                <Button
+                  variant="outline"
+                  size="sm"
+                  onClick={handleEditDisplay}
+                  className="h-7 text-xs"
+                >
+                  <Settings2 className="h-3 w-3 mr-1.5" />
+                  {t("actions.edit")}
+                </Button>
+              )}
+            </div>
+          </div>
+          <CardDescription>
+            {t("profilePage.description")}
+          </CardDescription>
+        </CardHeader>
+
+        <CardContent className="space-y-8">
+          {/* ─── Avatar section ──────────────────────────────────────
+              Big preview (160×160) so the operator can see the actual
+              image they uploaded. `object-cover` keeps the aspect
+              ratio and crops to fit the circle. */}
+          <div>
+            <Label className="text-sm">{t("profilePage.avatar.label")}</Label>
+            <div className="flex flex-col sm:flex-row items-start gap-6 mt-3">
+              <div className="relative shrink-0">
+                {avatarBlobUrl ? (
+                  // eslint-disable-next-line @next/next/no-img-element
+                  <img
+                    src={avatarBlobUrl}
+                    alt=""
+                    className="w-40 h-40 rounded-full object-cover border border-border bg-cyan-500/5"
+                  />
+                ) : (
+                  <span className="w-40 h-40 rounded-full bg-cyan-500/15 text-cyan-600 dark:text-cyan-300 flex items-center justify-center text-6xl font-semibold border border-border">
+                    {initial}
+                  </span>
+                )}
+                {uploadingAvatar && (
+                  <div className="absolute inset-0 rounded-full bg-black/50 flex items-center justify-center">
+                    <Loader2 className="h-6 w-6 animate-spin text-white" />
+                  </div>
+                )}
+              </div>
+              <div className="flex flex-col gap-2 min-w-0">
+                <input
+                  ref={fileInputRef}
+                  type="file"
+                  accept="image/png,image/jpeg,image/webp,image/gif"
+                  className="hidden"
+                  onChange={(e) => {
+                    const file = e.target.files?.[0]
+                    if (file) handleAvatarFile(file)
+                  }}
+                />
+                <Button
+                  variant="outline"
+                  size="sm"
+                  onClick={handleAvatarPick}
+                  disabled={uploadingAvatar}
+                  className="justify-start"
+                >
+                  <Upload className="h-3.5 w-3.5 mr-2" />
+                  {profile?.has_avatar ? t("profilePage.avatar.replace") : t("profilePage.avatar.upload")}
+                </Button>
+                {profile?.has_avatar && (
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    onClick={handleAvatarDelete}
+                    disabled={uploadingAvatar}
+                    className="justify-start text-red-500 hover:text-red-500 hover:bg-red-500/10"
+                  >
+                    <Trash2 className="h-3.5 w-3.5 mr-2" />
+                    {t("profilePage.avatar.remove")}
+                  </Button>
+                )}
+                <p className="text-[11px] text-muted-foreground leading-relaxed max-w-xs">
+                  {t("profilePage.avatar.hint")}
+                </p>
+              </div>
+            </div>
+            {avatarError && (
+              <div className="mt-3 text-xs text-red-500 flex items-start gap-1.5">
+                <X className="h-3.5 w-3.5 shrink-0 mt-0.5" />
+                <span className="break-all">{avatarError}</span>
+              </div>
+            )}
+          </div>
+
+          {/* ─── Username (read-only) ─── */}
+          <div>
+            <Label className="text-sm" htmlFor="profile-username">{t("profilePage.username.label")}</Label>
+            <Input
+              id="profile-username"
+              value={profile?.username || ""}
+              disabled
+              className="mt-2 max-w-sm disabled:opacity-100 disabled:cursor-default"
+            />
+            <p className="text-[11px] text-muted-foreground mt-1">
+              {t("profilePage.username.help")}
+            </p>
+          </div>
+
+          {/* ─── Display name (Edit controls live in the card header) ─── */}
+          <div>
+            <Label className="text-sm" htmlFor="profile-display">
+              {t("profilePage.displayName.label")} <span className="text-muted-foreground font-normal">{t("profilePage.displayName.optional")}</span>
+            </Label>
+            <Input
+              id="profile-display"
+              value={displayDraft}
+              onChange={(e) => setDisplayDraft(e.target.value)}
+              placeholder={profile?.username || t("profilePage.displayName.placeholder")}
+              maxLength={64}
+              disabled={!displayEditMode || savingDisplay}
+              className="mt-2 max-w-sm disabled:opacity-100 disabled:cursor-default"
+            />
+            <p className="text-[11px] text-muted-foreground mt-1">
+              {t("profilePage.displayName.help")}
+            </p>
+            {error && displayEditMode && (
+              <div className="mt-2 text-xs text-red-500 flex items-start gap-1.5">
+                <X className="h-3.5 w-3.5 shrink-0 mt-0.5" />
+                <span className="break-all">{error}</span>
+              </div>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* ─── Account security shortcut ─── */}
+      <Card>
+        <CardHeader>
+          <div className="flex items-center gap-2">
+            <Shield className="h-5 w-5 text-orange-500" />
+            <CardTitle>{t("profilePage.accountSecurity.title")}</CardTitle>
+          </div>
+          <CardDescription>
+            {t("profilePage.accountSecurity.description")}
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          {onOpenSecurity ? (
+            <Button variant="outline" onClick={onOpenSecurity}>
+              <Lock className="h-4 w-4 mr-2" />
+              {t("profilePage.accountSecurity.openSecurity")}
+            </Button>
+          ) : (
+            <p className="text-xs text-muted-foreground">
+              {t("profilePage.accountSecurity.fallback")}
+            </p>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  )
+}

AppImage/components/proxmox-dashboard.tsx

@@ -1,6 +1,7 @@
 "use client"
 
-import { useState, useEffect, useMemo, useCallback } from "react"
+import React, { useState, useEffect, useMemo, useCallback } from "react"
+import useSWR from "swr"
 import { Badge } from "./ui/badge"
 import { Button } from "./ui/button"
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "./ui/tabs"
@@ -8,14 +9,20 @@ import { SystemOverview } from "./system-overview"
 import { StorageOverview } from "./storage-overview"
 import { NetworkMetrics } from "./network-metrics"
 import { VirtualMachines } from "./virtual-machines"
+import { AppsDashboard } from "./apps-dashboard"
 import Hardware from "./hardware"
 import { SystemLogs } from "./system-logs"
 import { Settings } from "./settings"
+import { Security } from "./security"
+import { Profile } from "./profile"
+import { About } from "./about"
+import { HostBackup } from "./host-backup"
 import { OnboardingCarousel } from "./onboarding-carousel"
 import { HealthStatusModal } from "./health-status-modal"
 import { ReleaseNotesModal, useVersionCheck } from "./release-notes-modal"
 import { getApiUrl, fetchApi } from "../lib/api-config"
 import { TerminalPanel } from "./terminal-panel"
+import { AvatarMenu } from "./avatar-menu"
 import {
   RefreshCw,
   AlertTriangle,
@@ -26,15 +33,30 @@ import {
   LayoutDashboard,
   HardDrive,
   NetworkIcon,
-  Box,
+  Boxes,
+  Grid3x3,
   Cpu,
-  FileText,
+  ScrollText,
   SettingsIcon,
+  Settings2,
   Terminal,
+  ShieldCheck,
+  Info,
+  DatabaseBackup,
+  ChevronDown,
 } from "lucide-react"
 import Image from "next/image"
 import { ThemeToggle } from "./theme-toggle"
 import { Sheet, SheetContent, SheetTrigger } from "./ui/sheet"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "./ui/dropdown-menu"
+import { useT } from "../lib/i18n/provider"
+import { APP_VERSION } from "../lib/version"
+import { useTabOrder, firstActualTab, type TabId } from "../lib/tab-order"
 
 interface SystemStatus {
   status: "healthy" | "warning" | "critical"
@@ -63,7 +85,19 @@ interface FlaskSystemInfo {
   }
 }
 
+// Prefetch on dashboard mount: SWR caches by key across all
+// `useSWR` calls, so firing these here means the Apps tab finds the
+// data already resolved when it opens. Without this, the tab pays a
+// visible roundtrip on first render because VirtualMachines has been
+// warming /api/vms since page load but nobody was warming the custom
+// links endpoint.
+const _dashboardPrefetchFetcher = (url: string) => fetchApi(url)
+
 export function ProxmoxDashboard() {
+  const t = useT()
+  useSWR("/api/apps/custom-links", _dashboardPrefetchFetcher, { revalidateOnFocus: false })
+  useSWR("/api/apps/categories",   _dashboardPrefetchFetcher, { revalidateOnFocus: false })
+  const { order: tabOrder } = useTabOrder()
   const [systemStatus, setSystemStatus] = useState<SystemStatus>({
     status: "healthy",
     uptime: "Loading...",
@@ -76,17 +110,92 @@ export function ProxmoxDashboard() {
   const [componentKey, setComponentKey] = useState(0)
   const [mobileMenuOpen, setMobileMenuOpen] = useState(false)
   const [activeTab, setActiveTab] = useState("overview")
+  // On first mount, land on whatever the user's custom order says is
+  // the leading tab. localStorage isn't available during SSR so this
+  // runs post-hydration; the tiny flash is acceptable and matches the
+  // pattern next-themes uses for the same reason.
+  useEffect(() => {
+    setActiveTab(firstActualTab())
+  }, [])
+  const [infoCount, setInfoCount] = useState(0)
+  const [updateAvailable, setUpdateAvailable] = useState(false)
   const [showNavigation, setShowNavigation] = useState(true)
   const [lastScrollY, setLastScrollY] = useState(0)
   const [showHealthModal, setShowHealthModal] = useState(false)
   const { showReleaseNotes, setShowReleaseNotes } = useVersionCheck()
+  const displayServerName = systemStatus.serverName === "Loading..." ? t("app.loading") : systemStatus.serverName
+  const displayUptime = systemStatus.uptime === "Loading..." ? t("app.loading") : systemStatus.uptime || t("app.notAvailable")
+
+  // Category keys for health info count calculation
+  const HEALTH_CATEGORY_KEYS = [
+    { key: "cpu", category: "temperature" },
+    { key: "memory", category: "memory" },
+    { key: "storage", category: "storage" },
+    { key: "disks", category: "disks" },
+    { key: "network", category: "network" },
+    { key: "vms", category: "vms" },
+    { key: "services", category: "pve_services" },
+    { key: "logs", category: "logs" },
+    { key: "updates", category: "updates" },
+    { key: "security", category: "security" },
+  ]
+
+  // Fetch ProxMenux update status
+  const fetchUpdateStatus = useCallback(async () => {
+    try {
+      const response = await fetchApi("/api/proxmenux/update-status")
+      if (response?.success && response?.update_available) {
+        const { stable, beta } = response.update_available
+        setUpdateAvailable(stable || beta)
+      }
+    } catch (error) {
+      // Silently fail - updateAvailable will remain false
+    }
+  }, [])
+
+  // Fetch health info count independently (for initial load and refresh)
+  const fetchHealthInfoCount = useCallback(async () => {
+    try {
+      const response = await fetchApi("/api/health/full")
+      let calculatedInfoCount = 0
+      
+      if (response && response.health?.details) {
+        // Get categories that have dismissed items (these become INFO)
+        const customCats = new Set((response.custom_suppressions || []).map((cs: { category: string }) => cs.category))
+        const filteredDismissed = (response.dismissed || []).filter((item: { category: string }) => !customCats.has(item.category))
+        const categoriesWithDismissed = new Set<string>()
+        filteredDismissed.forEach((item: { category: string }) => {
+          const catMeta = HEALTH_CATEGORY_KEYS.find(c => c.category === item.category || c.key === item.category)
+          if (catMeta) {
+            categoriesWithDismissed.add(catMeta.key)
+          }
+        })
+        
+        // Count effective INFO categories (original INFO + OK categories with dismissed)
+        HEALTH_CATEGORY_KEYS.forEach(({ key }) => {
+          const cat = response.health.details[key as keyof typeof response.health.details]
+          if (cat) {
+            const originalStatus = cat.status?.toUpperCase()
+            // Count as INFO if: originally INFO OR (originally OK and has dismissed items)
+            if (originalStatus === "INFO" || (originalStatus === "OK" && categoriesWithDismissed.has(key))) {
+              calculatedInfoCount++
+            }
+          }
+        })
+      }
+      
+      setInfoCount(calculatedInfoCount)
+    } catch (error) {
+      // Silently fail - infoCount will remain at 0
+    }
+  }, [])
 
   const fetchSystemData = useCallback(async () => {
     try {
       const data: FlaskSystemInfo = await fetchApi("/api/system-info")
 
       const uptimeValue =
-        data.uptime && typeof data.uptime === "string" && data.uptime.trim() !== "" ? data.uptime : "N/A"
+        data.uptime && typeof data.uptime === "string" && data.uptime.trim() !== "" ? data.uptime : t("app.notAvailable")
 
       const backendStatus = data.health?.status?.toUpperCase() || "OK"
       let healthStatus: "healthy" | "warning" | "critical"
@@ -103,42 +212,48 @@ export function ProxmoxDashboard() {
         status: healthStatus,
         uptime: uptimeValue,
         lastUpdate: new Date().toLocaleTimeString("en-US", { hour12: false }),
-        serverName: data.hostname || "Unknown",
-        nodeId: data.node_id || "Unknown",
+        serverName: data.hostname || t("app.unknown"),
+        nodeId: data.node_id || t("app.unknown"),
       })
       setIsServerConnected(true)
     } catch (error) {
-      console.error("[v0] Failed to fetch system data from Flask server:", error)
+      // Expected to fail in v0 preview (no Flask server)
 
       setIsServerConnected(false)
       setSystemStatus((prev) => ({
         ...prev,
         status: "critical",
-        serverName: "Server Offline",
-        nodeId: "Server Offline",
-        uptime: "N/A",
+        serverName: t("app.serverOffline"),
+        nodeId: t("app.serverOffline"),
+        uptime: t("app.notAvailable"),
         lastUpdate: new Date().toLocaleTimeString("en-US", { hour12: false }),
       }))
     }
-  }, [])
+  }, [t])
 
   useEffect(() => {
-    // Siempre fetch inicial
-    fetchSystemData()
+  // Siempre fetch inicial
+  fetchSystemData()
+  fetchHealthInfoCount()
+  fetchUpdateStatus()
 
     // En overview: cada 30 segundos para actualización frecuente del estado de salud
     // En otras tabs: cada 60 segundos para reducir carga
     let interval: ReturnType<typeof setInterval> | null = null
+    let healthInterval: ReturnType<typeof setInterval> | null = null
     if (activeTab === "overview") {
       interval = setInterval(fetchSystemData, 30000) // 30 segundos
+      healthInterval = setInterval(fetchHealthInfoCount, 30000) // Also refresh info count
     } else {
       interval = setInterval(fetchSystemData, 60000) // 60 segundos
+      healthInterval = setInterval(fetchHealthInfoCount, 60000) // Also refresh info count
     }
 
     return () => {
       if (interval) clearInterval(interval)
+      if (healthInterval) clearInterval(healthInterval)
     }
-  }, [fetchSystemData, activeTab])
+  }, [fetchSystemData, fetchHealthInfoCount, fetchUpdateStatus, activeTab])
 
   useEffect(() => {
     const handleChangeTab = (event: CustomEvent) => {
@@ -153,10 +268,28 @@ export function ProxmoxDashboard() {
       window.removeEventListener("changeTab", handleChangeTab as EventListener)
     }
   }, [])
+  
+  // Auto-refresh terminal on mobile devices
+  // This fixes the issue where terminal doesn't connect properly on mobile/VPN
+  useEffect(() => {
+    if (activeTab === "terminal") {
+      const isMobileDevice = window.innerWidth < 768 || 
+        ('ontouchstart' in window && navigator.maxTouchPoints > 0)
+      
+      if (isMobileDevice) {
+        // Delay to allow initial connection attempt, then refresh to ensure proper connection
+        const timeoutId = setTimeout(() => {
+          setComponentKey(prev => prev + 1)
+        }, 500)
+        
+        return () => clearTimeout(timeoutId)
+      }
+    }
+  }, [activeTab])
 
   useEffect(() => {
     const handleHealthStatusUpdate = (event: CustomEvent) => {
-      const { status } = event.detail
+      const { status, infoCount: newInfoCount } = event.detail
       let healthStatus: "healthy" | "warning" | "critical"
 
       if (status === "CRITICAL") {
@@ -171,6 +304,11 @@ export function ProxmoxDashboard() {
         ...prev,
         status: healthStatus,
       }))
+      
+      // Update info count (INFO categories + dismissed items)
+      if (typeof newInfoCount === "number") {
+        setInfoCount(newInfoCount)
+      }
     }
 
     window.addEventListener("healthStatusUpdated", handleHealthStatusUpdate as EventListener)
@@ -183,13 +321,13 @@ export function ProxmoxDashboard() {
     if (
       systemStatus.serverName &&
       systemStatus.serverName !== "Loading..." &&
-      systemStatus.serverName !== "Server Offline"
+      systemStatus.serverName !== t("app.serverOffline")
     ) {
       document.title = `${systemStatus.serverName} - ProxMenux Monitor`
     } else {
       document.title = "ProxMenux Monitor"
     }
-  }, [systemStatus.serverName])
+  }, [systemStatus.serverName, t])
 
   useEffect(() => {
     let hideTimeout: ReturnType<typeof setTimeout> | null = null
@@ -251,24 +389,20 @@ export function ProxmoxDashboard() {
 
   const getActiveTabLabel = () => {
     switch (activeTab) {
-      case "overview":
-        return "Overview"
-      case "storage":
-        return "Storage"
-      case "network":
-        return "Network"
-      case "vms":
-        return "VMs & LXCs"
-      case "hardware":
-        return "Hardware"
-      case "terminal":
-        return "Terminal"
-      case "logs":
-        return "System Logs"
-      case "settings":
-        return "Settings"
-      default:
-        return "Navigation Menu"
+      case "overview":  return t("navigation.overview")
+      case "apps":      return t("navigation.apps")
+      case "vms":       return t("navigation.virtualMachines")
+      case "storage":   return t("navigation.storage")
+      case "network":   return t("navigation.network")
+      case "hardware":  return t("navigation.hardware")
+      case "backup":    return t("navigation.backup")
+      case "terminal":  return t("navigation.terminal")
+      case "logs":      return t("navigation.systemLogs")
+      case "security":  return t("navigation.security")
+      case "settings":  return t("navigation.settings")
+      case "about":     return t("navigation.about")
+      case "profile":   return t("navigation.profile")
+      default:          return t("navigation.menu")
     }
   }
 
@@ -282,13 +416,13 @@ export function ProxmoxDashboard() {
           <div className="container mx-auto">
             <div className="flex items-center space-x-2 text-red-500 mb-2">
               <XCircle className="h-5 w-5" />
-              <span className="font-medium">ProxMenux Server Connection Failed</span>
+              <span className="font-medium">{t("status.connectionFailed")}</span>
             </div>
             <div className="text-sm text-red-500/80 space-y-1 ml-7">
-              <p>• Check that the monitor.service is running correctly.</p>
-              <p>• The ProxMenux server should start automatically on port 8008</p>
+              <p>&bull; {t("status.checkService")}</p>
+              <p>&bull; {t("status.serverPort")}</p>
               <p>
-                • Try accessing:{" "}
+                &bull; {t("status.tryAccessing")}{" "}
                 <a href={getApiUrl("/api/health")} target="_blank" rel="noopener noreferrer" className="underline">
                   {getApiUrl("/api/health")}
                 </a>
@@ -309,14 +443,13 @@ export function ProxmoxDashboard() {
             <div className="flex items-center space-x-2 md:space-x-3 min-w-0">
               <div className="w-16 h-16 md:w-10 md:h-10 relative flex items-center justify-center bg-primary/10 flex-shrink-0">
                 <Image
-                  src="/images/proxmenux-logo.png"
+                  src={updateAvailable ? "/images/proxmenux_update-logo.png" : "/images/proxmenux-logo.png"}
                   alt="ProxMenux Logo"
                   width={64}
                   height={64}
                   className="object-contain md:w-10 md:h-10"
                   priority
                   onError={(e) => {
-                    console.log("[v0] Logo failed to load, using fallback icon")
                     const target = e.target as HTMLImageElement
                     target.style.display = "none"
                     const fallback = target.parentElement?.querySelector(".fallback-icon")
@@ -328,11 +461,11 @@ export function ProxmoxDashboard() {
                 <Server className="h-8 w-8 md:h-6 md:w-6 text-primary absolute fallback-icon hidden" />
               </div>
               <div className="min-w-0">
-                <h1 className="text-lg md:text-xl font-semibold text-foreground truncate">ProxMenux Monitor</h1>
-                <p className="text-xs md:text-sm text-muted-foreground">Proxmox System Dashboard</p>
+                <h1 className="text-lg md:text-xl font-semibold text-foreground truncate">{t("app.title")}</h1>
+                <p className="text-xs md:text-sm text-muted-foreground">{t("app.description")}</p>
                 <div className="lg:hidden flex items-center gap-1 text-xs text-muted-foreground mt-0.5">
                   <Server className="h-3 w-3" />
-                  <span className="truncate">Node: {systemStatus.serverName}</span>
+                  <span className="truncate">{t("status.node", { node: displayServerName })}</span>
                 </div>
               </div>
             </div>
@@ -342,17 +475,25 @@ export function ProxmoxDashboard() {
               <div className="flex items-center space-x-2">
                 <Server className="h-4 w-4 text-muted-foreground" />
                 <div className="text-sm">
-                  <div className="font-medium text-foreground">Node: {systemStatus.serverName}</div>
+                  <div className="font-medium text-foreground">{t("status.node", { node: displayServerName })}</div>
                 </div>
               </div>
 
-              <Badge variant="outline" className={statusColor}>
-                {statusIcon}
-                <span className="ml-1 capitalize">{systemStatus.status}</span>
-              </Badge>
+              <div className="flex items-center gap-2">
+                <Badge variant="outline" className={statusColor}>
+                  {statusIcon}
+                  <span className="ml-1">{t(`status.${systemStatus.status}`)}</span>
+                </Badge>
+                {systemStatus.status === "healthy" && infoCount > 0 && (
+                  <Badge variant="outline" className="bg-blue-500/10 text-blue-500 border-blue-500/20">
+                    <Info className="h-4 w-4" />
+                    <span className="ml-1">{infoCount} info</span>
+                  </Badge>
+                )}
+              </div>
 
               <div className="text-sm text-muted-foreground whitespace-nowrap">
-                Uptime: {systemStatus.uptime || "N/A"}
+                {t("status.uptime", { uptime: displayUptime })}
               </div>
 
               <Button
@@ -366,30 +507,41 @@ export function ProxmoxDashboard() {
                 className="border-border/50 bg-transparent hover:bg-secondary"
               >
                 <RefreshCw className={`h-4 w-4 mr-2 ${isRefreshing ? "animate-spin" : ""}`} />
-                Refresh
+                {t("actions.refresh")}
               </Button>
 
               <div onClick={(e) => e.stopPropagation()}>
                 <ThemeToggle />
               </div>
+
+              {/* User account dropdown — Fase 1 (v1.2.2). Self-hides
+                  when auth isn't enabled on this install. */}
+              <div onClick={(e) => e.stopPropagation()}>
+                <AvatarMenu
+                  size="lg"
+                  onOpenProfile={() => setActiveTab("profile")}
+                  onOpenSecurity={() => setActiveTab("security")}
+                />
+              </div>
             </div>
 
-            {/* Mobile Actions */}
-            <div className="flex lg:hidden items-center gap-2">
-              <Badge variant="outline" className={`${statusColor} text-xs px-2`}>
-                {statusIcon}
-                <span className="ml-1 capitalize hidden sm:inline">{systemStatus.status}</span>
-              </Badge>
-
+            {/* Mobile Actions — variant D approved in demo:
+                 • Top-right: Refresh + Theme + Avatar (all with border)
+                 • Bottom row (under Node line): badges left-aligned with
+                   the Node text column, Uptime right-aligned in the same
+                   horizontal line. No extra row for Uptime so the
+                   header doesn't grow vertically. */}
+            <div className="flex lg:hidden items-center gap-1.5 shrink-0">
               <Button
-                variant="ghost"
+                variant="outline"
                 size="sm"
                 onClick={(e) => {
                   e.stopPropagation()
                   refreshData()
                 }}
                 disabled={isRefreshing}
-                className="h-8 w-8 p-0"
+                className="h-8 w-8 p-0 border-border/50 bg-transparent hover:bg-secondary"
+                aria-label={t("actions.refresh")}
               >
                 <RefreshCw className={`h-4 w-4 ${isRefreshing ? "animate-spin" : ""}`} />
               </Button>
@@ -397,78 +549,163 @@ export function ProxmoxDashboard() {
               <div onClick={(e) => e.stopPropagation()}>
                 <ThemeToggle />
               </div>
+
+              <div onClick={(e) => e.stopPropagation()}>
+                <AvatarMenu
+                  size="lg"
+                  onOpenProfile={() => setActiveTab("profile")}
+                  onOpenSecurity={() => setActiveTab("security")}
+                />
+              </div>
             </div>
           </div>
 
-          {/* Mobile Server Info */}
-          <div className="lg:hidden mt-2 flex items-center justify-end text-xs text-muted-foreground">
-            <span className="whitespace-nowrap">Uptime: {systemStatus.uptime || "N/A"}</span>
+          {/* Mobile bottom row — badges (left, aligned with the title
+              column via pl-[3.25rem] = w-16 logo + space-x-2 gap-ish)
+              and Uptime (right). The pl matches the mobile logo width
+              + the parent flex gap so the badges sit visually under
+              "Node: amd", not flush against the screen edge. */}
+          <div className="lg:hidden mt-2 flex items-center justify-between gap-2 pl-[4.5rem]">
+            <div className="flex items-center gap-1.5">
+              <Badge variant="outline" className={`${statusColor} text-xs px-2`}>
+                {statusIcon}
+                <span className="ml-1">{t(`status.${systemStatus.status}`)}</span>
+              </Badge>
+              {systemStatus.status === "healthy" && infoCount > 0 && (
+                <Badge variant="outline" className="bg-blue-500/10 text-blue-500 border-blue-500/20 text-xs px-2">
+                  <Info className="h-3 w-3" />
+                  <span className="ml-1">{infoCount}</span>
+                </Badge>
+              )}
+            </div>
+            <span className="text-xs text-muted-foreground whitespace-nowrap">
+              {t("status.uptime", { uptime: displayUptime })}
+            </span>
           </div>
         </div>
       </header>
 
       <div
         className={`sticky z-40 bg-background
-          top-[120px] md:top-[76px]
-          transition-all duration-700 ease-[cubic-bezier(0.4,0,0.2,1)]
+          top-[120px] lg:top-[76px]
+          transition-all duration-700 ease-in-out
           ${showNavigation ? "translate-y-0 opacity-100" : "-translate-y-[120%] opacity-0 pointer-events-none"}
         `}
       >
-        <div className="container mx-auto px-4 md:px-6 pt-4 md:pt-6">
+        <div className="container mx-auto px-4 lg:px-6 pt-4 lg:pt-6">
           <Tabs value={activeTab} onValueChange={setActiveTab} className="space-y-0">
-            <TabsList className="hidden md:grid w-full grid-cols-8 bg-card border border-border">
-              <TabsTrigger
-                value="overview"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Overview
-              </TabsTrigger>
-              <TabsTrigger
-                value="storage"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Storage
-              </TabsTrigger>
-              <TabsTrigger
-                value="network"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Network
-              </TabsTrigger>
-              <TabsTrigger
-                value="vms"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                VMs & LXCs
-              </TabsTrigger>
-              <TabsTrigger
-                value="hardware"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Hardware
-              </TabsTrigger>
-              <TabsTrigger
-                value="logs"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                System Logs
-              </TabsTrigger>
-              <TabsTrigger
-                value="terminal"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Terminal
-              </TabsTrigger>
-              <TabsTrigger
-                value="settings"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Settings
-              </TabsTrigger>
-            </TabsList>
+            {/* Sprint 13D nav redesign — 6 top-level slots in usage order:
+                Overview · VMs & LXCs · Node ⌄ · Backup · Terminal · Admin ⌄
+                Node groups Storage / Network / Hardware (3 sub-items).
+                Admin groups System Logs / Security / Settings / About
+                (will split when RBAC arrives in 1.5.0).
+                Backup is direct now (only Host Backup); becomes a dropdown
+                when VM/LXC centralised backup ships. */}
+            {(() => {
+              const triggerActiveClass =
+                "data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
+              // Each dropdown lists its children in the order they
+              // render. When one of them is the active tab, the dropdown
+              // trigger swaps its label + icon to that child — same
+              // pattern macOS Settings uses inside a category: the
+              // crumb shows where you are, the chevron tells you the
+              // siblings are one click away.
+              const NODE_ITEMS = [
+                { value: "storage",  label: t("navigation.storage"),  Icon: HardDrive,   default: false },
+                { value: "network",  label: t("navigation.network"),  Icon: NetworkIcon, default: false },
+                { value: "hardware", label: t("navigation.hardware"), Icon: Cpu,         default: false },
+              ]
+              const ADMIN_ITEMS = [
+                { value: "logs",     label: t("navigation.systemLogs"), Icon: ScrollText,  default: false },
+                { value: "security", label: t("navigation.security"),   Icon: ShieldCheck, default: false },
+                { value: "settings", label: t("navigation.settings"),   Icon: SettingsIcon, default: false },
+                { value: "about",    label: t("navigation.about"),      Icon: Info,        default: false },
+              ]
+              const activeNodeItem  = NODE_ITEMS.find(i => i.value === activeTab)
+              const activeAdminItem = ADMIN_ITEMS.find(i => i.value === activeTab)
+              const isNodeActive    = activeNodeItem !== undefined
+              const isAdminActive   = activeAdminItem !== undefined
+              // The trigger label + icon shown on the bar. When a child
+              // is active we surface IT; otherwise the group default.
+              const NodeTriggerIcon  = activeNodeItem ? activeNodeItem.Icon  : Server
+              const NodeTriggerLabel = activeNodeItem ? activeNodeItem.label : t("navigation.node")
+              const AdminTriggerIcon  = activeAdminItem ? activeAdminItem.Icon  : Settings2
+              const AdminTriggerLabel = activeAdminItem ? activeAdminItem.label : t("navigation.admin")
+              // Dropdown trigger styling: parity with TabsTrigger so the
+              // parent visibly carries the "I'm the selected section"
+              // signal when any of its children is the active tab —
+              // same blue background + white text + rounded as a direct
+              // tab. Without this the user lands on Storage and the
+              // entire top bar looks idle.
+              const dropdownBtnClass = (active: boolean) =>
+                `inline-flex items-center justify-center whitespace-nowrap px-3 py-1.5 text-sm font-medium ring-offset-background transition-all focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 ${
+                  active
+                    ? "bg-blue-500 text-white rounded-md"
+                    : "text-muted-foreground hover:text-foreground rounded-sm"
+                }`
+
+              // Data-driven TabsList: iterate over the user's saved
+              // top-level order. Each slot is either a direct tab or a
+              // dropdown group (Node/Admin). The internal items of a
+              // dropdown are never reordered by the user — a grouped
+              // slot moves as a unit.
+              const renderDirect = (
+                value: string,
+                Icon: React.ComponentType<{ className?: string }>,
+                label: string,
+              ) => (
+                <TabsTrigger key={value} value={value} className={triggerActiveClass}>
+                  <Icon className="mr-2 h-4 w-4" />
+                  {label}
+                </TabsTrigger>
+              )
+              const renderDropdown = (
+                key: string,
+                items: { value: string; label: string; Icon: React.ComponentType<{ className?: string }> }[],
+                active: boolean,
+                TriggerIcon: React.ComponentType<{ className?: string }>,
+                triggerLabel: string,
+              ) => (
+                <DropdownMenu key={key}>
+                  <DropdownMenuTrigger className={dropdownBtnClass(active)}>
+                    <TriggerIcon className="mr-2 h-4 w-4" />
+                    {triggerLabel}
+                    <ChevronDown className="ml-1.5 h-3 w-3 opacity-70" />
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="center" className="min-w-[180px]">
+                    {items.map(({ value, label, Icon }) => (
+                      <DropdownMenuItem
+                        key={value}
+                        onClick={() => setActiveTab(value)}
+                        className={activeTab === value ? "bg-blue-500/10 text-blue-500" : ""}
+                      >
+                        <Icon className="mr-2 h-4 w-4" />
+                        {label}
+                      </DropdownMenuItem>
+                    ))}
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              )
+              const renderTop = (id: TabId) => {
+                switch (id) {
+                  case "overview": return renderDirect("overview", LayoutDashboard, t("navigation.overview"))
+                  case "apps":     return renderDirect("apps",     Grid3x3,         t("navigation.apps"))
+                  case "vms":      return renderDirect("vms",      Boxes,           t("navigation.virtualMachines"))
+                  case "backup":   return renderDirect("backup",   DatabaseBackup,  t("navigation.backup"))
+                  case "terminal": return renderDirect("terminal", Terminal,        t("navigation.terminal"))
+                  case "node":     return renderDropdown("node",  NODE_ITEMS,  isNodeActive,  NodeTriggerIcon,  NodeTriggerLabel)
+                  case "admin":    return renderDropdown("admin", ADMIN_ITEMS, isAdminActive, AdminTriggerIcon, AdminTriggerLabel)
+                }
+              }
+              return (
+                <TabsList className="hidden lg:grid w-full grid-cols-7 bg-card border border-border">
+                  {tabOrder.map(renderTop)}
+                </TabsList>
+              )
+            })()}
 
             <Sheet open={mobileMenuOpen} onOpenChange={setMobileMenuOpen}>
-              <div className="md:hidden">
+              <div className="lg:hidden">
                 <SheetTrigger asChild>
                   <Button
                     variant="outline"
@@ -482,128 +719,70 @@ export function ProxmoxDashboard() {
                 </SheetTrigger>
               </div>
               <SheetContent side="top" className="bg-card border-border">
-                <div className="flex flex-col gap-2 mt-4">
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("overview")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "overview"
+                {(() => {
+                  // Sheet items mirror the desktop layout: 6 sections,
+                  // with two of them (Node, Admin) collapsing into a
+                  // header + nested items. Direct tabs (Overview, VMs,
+                  // Backup, Terminal) sit at the top level.
+                  const select = (v: string) => {
+                    setActiveTab(v)
+                    setMobileMenuOpen(false)
+                  }
+                  const itemClass = (active: boolean) =>
+                    `w-full justify-start gap-3 ${
+                      active
                         ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
                         : ""
-                    }`}
-                  >
-                    <LayoutDashboard className="h-5 w-5" />
-                    <span>Overview</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("storage")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "storage"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <HardDrive className="h-5 w-5" />
-                    <span>Storage</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("network")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "network"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <NetworkIcon className="h-5 w-5" />
-                    <span>Network</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("vms")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "vms"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <Box className="h-5 w-5" />
-                    <span>VMs & LXCs</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("hardware")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "hardware"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <Cpu className="h-5 w-5" />
-                    <span>Hardware</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("logs")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "logs"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <FileText className="h-5 w-5" />
-                    <span>System Logs</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("terminal")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "terminal"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <Terminal className="h-5 w-5" />
-                    <span>Terminal</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("settings")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "settings"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <SettingsIcon className="h-5 w-5" />
-                    <span>Settings</span>
-                  </Button>
-                </div>
+                    }`
+                  // Mobile sheet honours the same user-defined
+                  // top-level order as the desktop TabsList. Grouped
+                  // slots (Node/Admin) expand their child items
+                  // inline right after their position — the group
+                  // still moves as a unit, but children stay grouped.
+                  const btn = (
+                    value: string,
+                    Icon: React.ComponentType<{ className?: string }>,
+                    label: string,
+                  ) => (
+                    <Button
+                      key={value}
+                      variant="ghost"
+                      onClick={() => select(value)}
+                      className={itemClass(activeTab === value)}
+                    >
+                      <Icon className="h-5 w-5" />
+                      <span>{label}</span>
+                    </Button>
+                  )
+                  return (
+                    <div className="flex flex-col gap-1 mt-4">
+                      {tabOrder.map((id): React.ReactNode => {
+                        switch (id) {
+                          case "overview": return btn("overview", LayoutDashboard, t("navigation.overview"))
+                          case "apps":     return btn("apps",     Grid3x3,         t("navigation.apps"))
+                          case "vms":      return btn("vms",      Boxes,           t("navigation.virtualMachines"))
+                          case "backup":   return btn("backup",   DatabaseBackup,  t("navigation.backup"))
+                          case "terminal": return btn("terminal", Terminal,        t("navigation.terminal"))
+                          case "node": return (
+                            <React.Fragment key="node">
+                              {btn("storage",  HardDrive,   t("navigation.storage"))}
+                              {btn("network",  NetworkIcon, t("navigation.network"))}
+                              {btn("hardware", Cpu,         t("navigation.hardware"))}
+                            </React.Fragment>
+                          )
+                          case "admin": return (
+                            <React.Fragment key="admin">
+                              {btn("logs",     ScrollText,  t("navigation.systemLogs"))}
+                              {btn("security", ShieldCheck, t("navigation.security"))}
+                              {btn("settings", SettingsIcon, t("navigation.settings"))}
+                              {btn("about",    Info,         t("navigation.about"))}
+                            </React.Fragment>
+                          )
+                        }
+                      })}
+                    </div>
+                  )
+                })()}
               </SheetContent>
             </Sheet>
           </Tabs>
@@ -611,11 +790,30 @@ export function ProxmoxDashboard() {
       </div>
 
       <div className="container mx-auto px-4 md:px-6 py-4 md:py-6">
-        <Tabs value={activeTab} onValueChange={setActiveTab} className="space-y-4 md:space-y-6">
-          <TabsContent value="overview" className="space-y-4 md:space-y-6 mt-0">
+        {/* No `space-y-*` here: only one TabsContent is visible at a
+            time, but Overview stays force-mounted (hidden) as the
+            first child, so every OTHER active tab used to inherit an
+            extra top margin from the space-y utility — pushing the
+            page content further from the nav than on Overview.
+            Vertical spacing INSIDE each tab lives on its own
+            TabsContent's `space-y-*`. */}
+        <Tabs value={activeTab} onValueChange={setActiveTab} className="space-y-0">
+          {/* forceMount so SystemOverview mounts at dashboard load and
+              never gets torn down when the user visits another tab.
+              Without this, every return to Overview re-fires ~7 fetches
+              (system, vms, storage, proxmox-storage, network, node
+              metrics, network chart) and the user waited for the
+              cascade to complete each time. With forceMount, the
+              5 s / 59 s refresh intervals keep the data fresh in the
+              background — reopening the tab is instant. */}
+          <TabsContent value="overview" forceMount className="space-y-4 md:space-y-6 mt-0 data-[state=inactive]:hidden">
             <SystemOverview key={`overview-${componentKey}`} />
           </TabsContent>
 
+          <TabsContent value="apps" className="space-y-4 md:space-y-6 mt-0">
+            <AppsDashboard key={`apps-${componentKey}`} />
+          </TabsContent>
+
           <TabsContent value="storage" className="space-y-4 md:space-y-6 mt-0">
             <StorageOverview key={`storage-${componentKey}`} />
           </TabsContent>
@@ -624,7 +822,13 @@ export function ProxmoxDashboard() {
             <NetworkMetrics key={`network-${componentKey}`} />
           </TabsContent>
 
-          <TabsContent value="vms" className="space-y-4 md:space-y-6 mt-0">
+          {/* forceMount so the modal-data prefetcher (inside VirtualMachines)
+              starts warming caches from the moment the dashboard loads,
+              not the first time the user clicks the VMs tab. Kept
+              visually hidden with data-attribute selector when the tab
+              is inactive — mount cost is ~zero (no polling loop that
+              other components run). */}
+          <TabsContent value="vms" forceMount className="space-y-4 md:space-y-6 mt-0 data-[state=inactive]:hidden">
             <VirtualMachines key={`vms-${componentKey}`} />
           </TabsContent>
 
@@ -636,17 +840,39 @@ export function ProxmoxDashboard() {
             <SystemLogs key={`logs-${componentKey}`} />
           </TabsContent>
 
+          <TabsContent value="backup" className="space-y-4 md:space-y-6 mt-0">
+            <HostBackup key={`backup-${componentKey}`} />
+          </TabsContent>
+
           <TabsContent value="terminal" className="mt-0">
             <TerminalPanel key={`terminal-${componentKey}`} />
           </TabsContent>
 
+          <TabsContent value="security" className="space-y-4 md:space-y-6 mt-0">
+            <Security key={`security-${componentKey}`} />
+          </TabsContent>
+
+          {/* Profile tab — not surfaced in the top tabs nav. The only
+              entry point is the avatar dropdown in the header (View
+              profile). v1.2.2 Fase 2. */}
+          <TabsContent value="profile" className="space-y-4 md:space-y-6 mt-0">
+            <Profile
+              key={`profile-${componentKey}`}
+              onOpenSecurity={() => setActiveTab("security")}
+            />
+          </TabsContent>
+
           <TabsContent value="settings" className="space-y-4 md:space-y-6 mt-0">
             <Settings />
           </TabsContent>
+
+          <TabsContent value="about" className="space-y-4 md:space-y-6 mt-0">
+            <About />
+          </TabsContent>
         </Tabs>
 
         <footer className="mt-8 md:mt-12 pt-4 md:pt-6 border-t border-border text-center text-xs md:text-sm text-muted-foreground">
-          <p className="font-medium mb-2">ProxMenux Monitor v1.0.2</p>
+          <p className="font-medium mb-2">ProxMenux Monitor v{APP_VERSION}</p>
           <p>
             <a
               href="https://ko-fi.com/macrimi"
@@ -654,7 +880,7 @@ export function ProxmoxDashboard() {
               rel="noopener noreferrer"
               className="text-blue-500 hover:text-blue-600 hover:underline transition-colors"
             >
-              Support and contribute to the project
+              {t("app.supportProject")}
             </a>
           </p>
         </footer>

AppImage/components/pwa-install-prompt.tsx

@@ -0,0 +1,239 @@
+"use client"
+
+import { useCallback, useEffect, useState } from "react"
+import { Plus, Share, X } from "lucide-react"
+import { useT } from "../lib/i18n/provider"
+
+// ==========================================================
+// PwaInstallPrompt
+// ==========================================================
+// Bottom-sheet shown on mobile when the Monitor is opened in
+// a browser (not launched as an installed PWA). Two variants:
+//   iOS Safari  → manual 3-step instructions
+//   Android     → generic "browser menu → Add to Home Screen"
+//
+// No `beforeinstallprompt` handling: capturing the event to
+// drive a custom Install button interacts badly with Chrome's
+// own "Add to Home Screen" menu — Chromium degrades the manual
+// path to a plain shortcut when a page has intercepted the
+// event but hasn't yet called `prompt()`. Installation goes
+// through the browser's own menu entry and produces a real PWA.
+//
+// Never shown on desktop, or when already running standalone.
+// Dismissal options:
+//   "Not now"          → temporary, hidden for 30 days
+//   "Don't show again" → permanent (no expiry)
+//   Backdrop / X       → session-only dismiss (reappears on
+//                        the next page load)
+// ==========================================================
+
+const DISMISSED_FOREVER_KEY = "proxmenux-install-dismissed"
+const DISMISSED_UNTIL_KEY = "proxmenux-install-dismissed-until"
+const NOT_NOW_DAYS = 30
+
+function isMobileDevice(): boolean {
+  if (typeof window === "undefined") return false
+  // Prefer feature detection (coarse pointer + touch) over UA sniffing,
+  // and fall back to UA for the corner case where a mobile browser
+  // reports fine pointer under a desktop-mode toggle.
+  const coarse = window.matchMedia("(pointer: coarse)").matches
+  const ua = navigator.userAgent
+  const uaMobile = /Android|iPhone|iPad|iPod|Mobile|Opera Mini|BlackBerry|IEMobile/i.test(ua)
+  return coarse || uaMobile
+}
+
+function isStandalone(): boolean {
+  if (typeof window === "undefined") return false
+  const displayModeStandalone = window.matchMedia("(display-mode: standalone)").matches
+  const iosStandalone = (window.navigator as Navigator & { standalone?: boolean }).standalone === true
+  return displayModeStandalone || iosStandalone
+}
+
+function isIOS(): boolean {
+  if (typeof window === "undefined") return false
+  const ua = navigator.userAgent
+  // iPadOS 13+ reports as MacIntel — detect that too when maxTouchPoints > 1.
+  const iPadMasqueradingAsMac =
+    ua.includes("Macintosh") && (navigator as Navigator & { maxTouchPoints?: number }).maxTouchPoints! > 1
+  return /iPhone|iPad|iPod/i.test(ua) || iPadMasqueradingAsMac
+}
+
+export function PwaInstallPrompt() {
+  const t = useT()
+  const [open, setOpen] = useState(false)
+  const [platform, setPlatform] = useState<"ios" | "android" | null>(null)
+
+  useEffect(() => {
+    if (typeof window === "undefined") return
+    if (!isMobileDevice() || isStandalone()) return
+
+    try {
+      if (localStorage.getItem(DISMISSED_FOREVER_KEY) === "1") return
+      const untilRaw = localStorage.getItem(DISMISSED_UNTIL_KEY)
+      if (untilRaw) {
+        const until = Number.parseInt(untilRaw, 10)
+        // Corrupt / non-numeric values fall through and the prompt shows,
+        // which is the safe default.
+        if (Number.isFinite(until) && until > Date.now()) return
+      }
+    } catch {
+      // localStorage unavailable (private mode etc.) — treat as not dismissed.
+    }
+
+    setPlatform(isIOS() ? "ios" : "android")
+    setOpen(true)
+  }, [])
+
+  const handleNotNow = useCallback(() => {
+    try {
+      const until = Date.now() + NOT_NOW_DAYS * 24 * 60 * 60 * 1000
+      localStorage.setItem(DISMISSED_UNTIL_KEY, String(until))
+    } catch {
+      // Best-effort; if localStorage fails the user will see the prompt
+      // again next visit, which is the safe default.
+    }
+    setOpen(false)
+  }, [])
+
+  const handleNeverAgain = useCallback(() => {
+    try {
+      localStorage.setItem(DISMISSED_FOREVER_KEY, "1")
+    } catch {
+      // Best-effort; if localStorage fails the user will see the prompt
+      // again next visit, which is the safe default.
+    }
+    setOpen(false)
+  }, [])
+
+  const handleClose = useCallback(() => {
+    // Session-only dismiss: closing via X or backdrop does NOT persist,
+    // so the prompt reappears on the next page load. Users who want to
+    // silence it for longer must use "Not now" (30 d) or "Don't show again".
+    setOpen(false)
+  }, [])
+
+  if (!open || !platform) return null
+
+  return (
+    <div
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="pwa-install-title"
+      className="fixed inset-0 z-[100] flex items-end justify-center bg-black/60 backdrop-blur-sm animate-in fade-in duration-200"
+      onClick={(e) => {
+        if (e.target === e.currentTarget) handleClose()
+      }}
+    >
+      <div
+        className="w-full max-w-md rounded-t-2xl bg-background text-foreground shadow-2xl border-t border-border animate-in slide-in-from-bottom duration-300"
+        style={{ paddingBottom: "max(1.25rem, env(safe-area-inset-bottom))" }}
+      >
+        <div className="relative px-5 pt-5">
+          <div className="mx-auto mb-3 h-1 w-10 rounded-full bg-border" aria-hidden="true" />
+          {/* Hardened close button — the X wasn't reliably closing
+              the sheet on iOS/Android. Fixes:
+                * `stopPropagation` so the click never bubbles up to
+                  the backdrop handler (which was seeing the target
+                  and might have been running its own logic against
+                  the same tap on some mobile browsers).
+                * `z-10` puts it above any sibling absolute layers
+                  (drag handle, headings) in case one silently ate
+                  the tap.
+                * 40 × 40 hit area — comfortable Apple/Google minimum
+                  for a touch target; the 32 × 32 we had was fine on
+                  desktop but easy to miss with a thumb.
+                * `onPointerDown` as a secondary handler covers the
+                  iOS Safari case where a fast tap on a nested
+                  `<button>` inside a `role="dialog"` can lose the
+                  click event to the parent overlay. */}
+          <button
+            type="button"
+            onClick={(e) => { e.stopPropagation(); handleClose() }}
+            onPointerDown={(e) => { e.stopPropagation() }}
+            aria-label={t("actions.close")}
+            className="absolute right-2 top-2 z-10 flex h-10 w-10 items-center justify-center rounded-full text-muted-foreground hover:bg-muted active:bg-muted transition-colors touch-manipulation"
+          >
+            <X className="h-5 w-5" />
+          </button>
+
+          <div className="mb-4 flex items-start gap-3.5">
+            <div className="flex h-[52px] w-[52px] shrink-0 items-center justify-center rounded-xl bg-muted p-1 shadow-md">
+              <img src="/icon.svg" alt="ProxMenux Monitor" className="h-full w-full object-contain" />
+            </div>
+            <div className="flex-1 min-w-0">
+              <h3 id="pwa-install-title" className="text-[17px] font-bold leading-tight tracking-tight text-foreground">
+                {t("pwaInstall.title")}
+              </h3>
+              <p className="mt-1 text-[13px] leading-snug text-muted-foreground">
+                {platform === "ios"
+                  ? t("pwaInstall.iosDescription")
+                  : t("pwaInstall.androidDescription")}
+              </p>
+            </div>
+          </div>
+
+          {platform === "ios" ? (
+            <ol className="mb-4 flex flex-col gap-2" role="list">
+              <li className="flex items-center gap-3 rounded-xl bg-primary/10 px-3.5 py-3 text-[13.5px] leading-tight">
+                <span className="flex h-[22px] w-[22px] shrink-0 items-center justify-center rounded-full bg-primary text-[11px] font-bold text-primary-foreground">
+                  1
+                </span>
+                <span>
+                  {t("pwaInstall.ios.stepShareBefore")}{" "}
+                  <span className="inline-flex items-center gap-1 font-semibold text-primary">
+                    <Share className="h-4 w-4" aria-hidden="true" />
+                    {t("pwaInstall.ios.share")}
+                  </span>{" "}
+                  {t("pwaInstall.ios.stepShareAfter")}
+                </span>
+              </li>
+              <li className="flex items-center gap-3 rounded-xl bg-primary/10 px-3.5 py-3 text-[13.5px] leading-tight">
+                <span className="flex h-[22px] w-[22px] shrink-0 items-center justify-center rounded-full bg-primary text-[11px] font-bold text-primary-foreground">
+                  2
+                </span>
+                <span>
+                  {t("pwaInstall.ios.stepChooseBefore")}{" "}
+                  <span className="inline-flex items-center gap-1 font-semibold text-primary">
+                    <Plus className="h-4 w-4" aria-hidden="true" />
+                    {t("pwaInstall.addToHomeScreen")}
+                  </span>
+                </span>
+              </li>
+              <li className="flex items-center gap-3 rounded-xl bg-primary/10 px-3.5 py-3 text-[13.5px] leading-tight">
+                <span className="flex h-[22px] w-[22px] shrink-0 items-center justify-center rounded-full bg-primary text-[11px] font-bold text-primary-foreground">
+                  3
+                </span>
+                <span>
+                  {t("pwaInstall.ios.stepConfirmBefore")} <b>{t("pwaInstall.ios.add")}</b> {t("pwaInstall.ios.stepConfirmAfter")}
+                </span>
+              </li>
+            </ol>
+          ) : (
+            <div className="mb-4 rounded-lg border border-border bg-muted/50 px-3.5 py-3 text-[13px] leading-relaxed text-muted-foreground">
+              {t("pwaInstall.android.stepOpenMenu")} <b className="text-foreground">⋮</b> →{" "}
+              <b className="text-foreground">{t("pwaInstall.addToHomeScreen")}</b> → {t("pwaInstall.android.stepConfirm")}{" "}
+              <b className="text-foreground">{t("pwaInstall.android.install")}</b>.
+            </div>
+          )}
+
+          <div className="mt-1 flex flex-col gap-1 border-t border-border pt-3">
+            <button
+              type="button"
+              onClick={handleNotNow}
+              className="rounded-lg py-2.5 text-center text-[13.5px] font-semibold text-muted-foreground hover:bg-muted transition-colors"
+            >
+              {t("pwaInstall.notNow")}
+            </button>
+            <button
+              type="button"
+              onClick={handleNeverAgain}
+              className="rounded-lg py-2.5 text-center text-[13.5px] font-semibold text-amber-700 dark:text-amber-500 hover:bg-muted transition-colors"
+            >
+              {t("pwaInstall.neverAgain")}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}

AppImage/components/pwa-register.tsx

@@ -0,0 +1,21 @@
+"use client"
+
+import { useEffect } from "react"
+
+// Unregister any Service Worker on this origin at mount. A SW here
+// interacts badly with mobile battery throttling behind reverse
+// proxies. `sw.js` is kept for a future PWA-offline revisit.
+export function PwaRegister() {
+  useEffect(() => {
+    if (typeof window === "undefined") return
+    if (!("serviceWorker" in navigator)) return
+    navigator.serviceWorker
+      .getRegistrations()
+      .then((regs) => {
+        if (regs.length === 0) return
+        return Promise.all(regs.map((r) => r.unregister()))
+      })
+      .catch(() => {})
+  }, [])
+  return null
+}

AppImage/components/release-notes-modal.tsx

@@ -3,10 +3,10 @@
 import { useState, useEffect } from "react"
 import { Button } from "./ui/button"
 import { Dialog, DialogContent, DialogTitle } from "./ui/dialog"
-import { X, Sparkles, Link2, Shield, Zap, HardDrive, Gauge, Wrench, Settings } from "lucide-react"
+import { X, Sparkles, Thermometer, Activity, HardDrive, Shield, Globe, Cpu, Zap, Sliders, Wrench, RefreshCw, Server, BellOff, Bell, Calendar, DatabaseBackup, Smartphone, Languages } from "lucide-react"
 import { Checkbox } from "./ui/checkbox"
-
-const APP_VERSION = "1.0.2" // Sync with AppImage/package.json
+import { useT } from "../lib/i18n/provider"
+import { APP_VERSION } from "../lib/version"
 
 interface ReleaseNote {
   date: string
@@ -18,6 +18,233 @@ interface ReleaseNote {
 }
 
 export const CHANGELOG: Record<string, ReleaseNote> = {
+  "1.2.5": {
+    date: "September 1, 2026",
+    changes: {
+      added: [
+        "New top-level Apps dashboard — a single launcher for every Web Link across the node. LXC-registered apps and user-defined Custom Web Links share the same grid with category badges, search, sort by name/id/category, and one-click deep-links back to the guest modal (LXC cards land on App, VM cards on Status).",
+        "Application detection catalog with over 380 tracked workloads, generated live from the community-scripts source across seven detector methods (file, binary, dpkg, apk, Python, Docker exec, Docker label). Primary and fallback detectors cover both new and historical LXC layouts.",
+        "App tab inside every VM & LXC modal — register the apps installed in a container, capture their weblinks, and get notifications when a new upstream version ships. Cold-start Docker detection now correctly promotes Docker as the parent workload before the daemon finishes booting.",
+        "Reworked LXC Updates tab — apply OS packages and registered-app updates from a single button, schedule a recurring auto-update job, and cover Docker end to end (Engine + per-image on the same 24-hour rolling cycle as OS packages, with a 'Check now' action for on-demand digest comparison).",
+        "The Monitor now speaks 8 languages: English, Spanish, German, French, Italian, Portuguese, Swedish and Slovak. Thanks to @vaso73 for building the i18n scaffolding.",
+        "Navigation order — a new Settings card lets each user reorder the seven top-level tabs by drag and drop. Grouped slots (Node, Admin) move as a single unit; the first slot in the saved order becomes the tab the Monitor opens on. Mouse and touch supported.",
+        "Custom Web Links — persistent sidecar at /etc/proxmenux/custom_links.json for URLs that don't live inside a registered LXC app. Editor takes name, URL, optional logo, category and optional binding to a specific VM or LXC.",
+        "NVIDIA — multi-GPU passthrough by exact BDF ownership so a multi-GPU host can pass one card to a VM and keep the other operational on the host or in LXCs. Kernel + branch + GPU-aware version picker (#298).",
+        "Pushover joins Telegram, Gotify, Discord, Email and Apprise as a native notification channel — user/API key, device and sound selectors, priority 0 for regular messages, optional priority 1 for CRITICAL events. Suggested by @benginx (#308).",
+        "Host backup/restore continuity — ProxMenux configuration and independent backups survive a full Proxmox restore (#317, reported by @tropicaljoe).",
+        "Hardware temperature sensor identity — storage temperatures now identify the physical drive (NVMe namespace, model, serial) instead of the generic hwmon label. HDD/SSD classification follows the block device rotational flag (#315, suggested by @Dark-Witcher).",
+        "Post-install — precise rollback for every registered flow and Debian 13 readiness.",
+        "First-time visitors on Android and iOS Safari now see an in-app install prompt for adding the Monitor to their home screen as a PWA.",
+      ],
+      changed: [
+        "Memory & Swap health check now signals real memory pressure — CRITICAL fires only when swap file is nearly full AND available RAM is genuinely tight (both editable in Settings → Health thresholds). The old swap-only signal was noisy on hosts where Linux proactively swaps out inactive pages.",
+        "Faster page loads and smoother navigation across the dashboard. Overview opens instantly and the VMs & LXCs page never flashes 'Loading…' between guest modals again.",
+        "Long backup jobs no longer time out. VM and LXC backups launched from the Monitor now run in the background until they naturally finish, so a 30-minute PBS backup completes the same as a 10-second local one.",
+        "VMs running the QEMU Guest Agent now report real used / total disk figures on the dashboard, instead of the '0 GB' that PVE returns for guest-managed filesystems.",
+        "App tab cache stays warm across every action. Successful add / edit / check / dismiss / delete operations write the returned sidecar directly into both backend and shared frontend caches; post-update scans revalidate in the background while the last valid content stays visible.",
+        "Docker cards on the Apps dashboard resolve their update state per image, not per Docker Engine. The purple update arrow only lights up when that specific image has an upstream update.",
+        "ZFS ARC sizing under memory pressure and OOM diagnostics reworked (credit: LeidenSpain).",
+      ],
+      fixed: [
+        "Fix #309 — Proxmox storage availability: false critical alerts for iSCSI storages with maxdisk=0.",
+        "HID USB device class no longer reads as 'escondido' (past tense of 'to hide') in Spanish, German, French, Italian and Portuguese — the acronym is now preserved.",
+        "The Memory & Swap health card is dismissable like every other category (RAM usage and Swap usage sub-checks carry the dismissable flag).",
+        "Regenerated Proxmox VE Helper-Scripts updaters remain available after an app update (both historical wrappers and the current generated entrypoint are recognised).",
+      ],
+    },
+  },
+  "1.2.4.1-beta": {
+    date: "August 17, 2026",
+    changes: {
+      added: [
+        "The Monitor now speaks 8 languages: English, Spanish, German, French, Italian, Portuguese, Swedish and Slovak. Huge thanks to @vaso73 for building the i18n scaffolding that made this possible.",
+        "New App tab inside the VM & LXC modal — especially for LXCs. Register the apps installed in a container, capture their weblinks, and get notifications when a new upstream version ships.",
+        "Reworked Updates tab for LXCs: apply OS packages and registered-app updates from a single button, and schedule a recurring auto-update job that checks the container's OS and its tracked app on every run.",
+        "First-time visitors on Android and iOS Safari now see an in-app install prompt with clear steps for adding the Monitor to their home screen as a PWA.",
+      ],
+      changed: [
+        "Faster page loads and smoother navigation across the dashboard. Overview opens instantly and the VMs & LXCs page never flashes 'Loading…' between guest modals again.",
+        "Long backup jobs no longer time out. VM and LXC backups launched from the Monitor now run in the background until they naturally finish, so a 30-minute PBS backup completes the same as a 10-second local one.",
+        "VMs running the QEMU Guest Agent (qemu-guest-agent) now report real used / total disk figures on the dashboard, instead of the '0 GB' that PVE returns for guest-managed filesystems.",
+      ],
+    },
+  },
+  "1.2.3": {
+    date: "July 15, 2026",
+    changes: {
+      added: [
+        "Backups integrated in the Monitor — a new first-class section to create, schedule and restore host backups against Local, PBS or Borg destinations from the Web dashboard. Jobs run on a proper systemd timer or attach to an existing PVE vzdump job with retention live-inherited from the parent. Encrypted PBS backups store a paired recovery blob next to each snapshot so a fresh install can always get the key back. After a reboot the tab shows a real-time restore progress card with milestones, per-component status (NVIDIA, Intel GPU tools, Coral, AMD tools), boot sanity warnings and a rollback delta listing anything on the host that wasn't in the backup.",
+        "Network Flow diagram — a new live topology view on the Network tab showing NICs → host → bridges → LXCs / VMs with animated rx / tx pulses on every internal link, so the operator can see in real time how traffic distributes inside the host and which guests are pulling or pushing data.",
+        "Physical Disks and Physical Interfaces cards redesigned — clearer per-item presentation on the Storage and Network tabs. USB-NVMe / USB-SATA enclosures reporting removable=0 (ASMedia, JMicron, Realtek, ASM105x) now walk sysfs to detect USB attachment, so the -d snt* pass-through is tried and the drive's real model, serial, temperature, power-on hours and health surface — instead of the bridge's chatter.",
+        "Richer notifications out of the box — for users not running an AI agent, the templated body now identifies the affected object (which storage, which interface, which container), surfaces the top offenders with an \"…and N more\" tail when the list is long, and preserves the same identity in the recovery message. Users with AI enrichment enabled continue to get their tailored rewrite on top of this improved base.",
+      ],
+      changed: [
+        "Redesigned cards across Overview, VM / LXC, Storage and Network — layouts reworked for faster reading and denser, more practical information: key numbers surface at a glance, grouped by relevance, and the responsive grid now behaves cleanly from a phone up to an ultrawide.",
+        "Health Monitor Thresholds — the Settings panel that controls per-category Warning and Critical levels (CPU, memory, temperature, storage, disks, ...) was reworked with clearer visual grouping and inline hints, so tuning a threshold now takes a couple of clicks instead of scrolling through a wall of numbers.",
+      ],
+    },
+  },
+  "1.2.2": {
+    date: "May 31, 2026",
+    changes: {
+      added: [
+        "Health Monitor Thresholds - Per-category Warning and Critical levels for CPU, memory, temperature, storage, disks and more, configurable from Settings. The same numbers also feed the colour ranges of every widget (storage bars, CPU/memory rings, temperature chips), so a colour anywhere in the Monitor maps to a definite range relative to the configured pair",
+        "Per-error dismiss duration - The Dismiss button on each Health Monitor alert now opens a small dropdown with three options: 24 hours, 7 days, or Permanently. Permanent dismisses persist with suppression_hours = -1, never re-emit and are marked with a distinct amber Permanent badge so the operator knows the alert is intentionally silenced",
+        "Active Suppressions panel in Settings - New section inside Settings -> Health Monitor (below the per-category suppression durations) that lists every currently-dismissed alert, time-limited and permanent. Each row carries the error_key, category, severity, when it was dismissed, plus a Re-enable button gated by Edit mode. Permanent dismisses can only be reverted from here",
+        "Apprise notification channel - Full feature parity with native channels: the Apprise tab now exposes the same per-event toggles, Quiet Hours and Daily Digest controls as Telegram / Gotify / Discord / Email. One Apprise URL talks to ~80 notification services (Pushover, ntfy, Slack, Matrix, mailto, signal, ...) without ProxMenux needing a dedicated adapter for each",
+        "LXC update detection - New dedicated Settings section with a single toggle that gates the per-CT apt list --upgradable / apk list -u scan end-to-end. The checker now reads the mtime of the CT's package-manager metadata and refreshes it via pct exec if it is older than 24 h, so long-running appliance CTs whose caches were months stale finally surface their real upstream backlog",
+        "Disk I/O severity tiers - Sliding 24 h window classifies dmesg ATA / SCSI errors into silent (0-10), WARNING (11-100) and CRITICAL (100+ or any hard error like UNC / Buffer I/O / Sense Key Hardware Error), so quiet days stay quiet and a single Buffer I/O event still pages immediately",
+        "Quiet Hours buffering - Events suppressed during a channel's quiet window are now persisted to SQLite and released as a grouped summary when the window closes, instead of being silently dropped",
+        "Post-install function update detection - The Monitor tracks installed ProxMenux optimizations (Log2Ram, Memory Settings, System Limits, Logrotate, ...) and notifies when a newer version of any of them is available, with one-click apply from Settings",
+        "NVIDIA driver update notifications - Kernel-aware detection of newer compatible driver versions, surfaced in the Hardware tab and as notifications when an upstream build is published",
+        "Coral TPU installer - Uninstall path mirroring the NVIDIA flow, and registry-driven update notifications for both the PCIe gasket-dkms driver (tracked against feranick/gasket-driver) and the USB libedgetpu1 runtime",
+        "Secure Gateway update flow - One-click Tailscale update from Settings with Last-checked / Installed / Latest indicators and notification when a new version is available",
+        "Helper-Scripts menu - Richer context and useful information for each entry, making it easier to know what every script does before running it",
+      ],
+      changed: [
+        "AI Enhancement section in Notifications - Rewritten from a muted uppercase row to a normal-case foreground label with a Sparkles icon and a persistent badge (green Active when AI is enabled, neutral Optional when it isn't) so the feature is discoverable regardless of state",
+        "Disk temperature monitoring - Improved readings, smarter caching across SMART probes and a redesigned history modal that opens at 24 h by default with min / avg / max statistics",
+        "VM and LXC modal - Expanded with additional information so a single panel covers data you previously had to look up across multiple tabs",
+        "Page load - Faster first paint and lighter network usage on the Overview, Storage and Hardware tabs",
+        "Security improvements - Tighter authentication checks across notification, scripts and terminal endpoints, plus a more conservative default policy for new installs",
+        "POST /api/health/acknowledge accepts an optional suppression_hours body field - positive integer in hours, -1 for permanent. Omitting it preserves the previous behaviour (uses the category default). New endpoint POST /api/health/un-acknowledge {error_key} reverses a dismiss",
+        "Burst aggregation wording - Burst summaries now report only the additional events that arrived after the initial individual alert, so the operator no longer sees the first event counted twice",
+        "Known-error classifier - Word-boundary regex on ATA / UNC patterns so kernel messages like nvidia_uvm:FatalError are no longer misclassified as ATA cable issues",
+        "Resolved notifications severity matches the user-visible severity instead of the silently escalated value the DB may carry during the 24 h same-key cooldown",
+        "log2ram apply path - The auto / update flow now restarts log2ram after writing the new size, so a configured 512M actually takes effect on the running tmpfs",
+        "VM / CT control errors - Failed start / stop / restart now surfaces the real pvesh stderr (e.g. \"no space left on device\") in the UI toast and fires a vm_fail / ct_fail notification, instead of a bare 500 INTERNAL SERVER ERROR",
+        "Mobile design of Quiet Hours / Daily Digest - Time inputs are now full-height with inline labels instead of the cramped grid layout that overflowed on narrow screens",
+        "Health Monitor dismissed annotation - When an alert is acknowledged with suppression_hours = -1, the dashboard payload tags the check with permanent: true alongside dismissed: true so the UI can render the Permanent badge separately from the standard time-limited Dismissed badge",
+      ],
+      fixed: [
+        "Terminal modals on HTTPS hosts - Every terminal modal (dashboard terminal, LXC terminal, script terminal) used to fail with WebSocket connection error on hosts with HTTPS enabled. Root cause: the gevent + SSL path stacked geventwebsocket's WebSocketHandler on top of flask-sock's protocol implementation, so the server emitted two consecutive HTTP/1.1 101 Switching Protocols headers and the browser closed the connection as a corrupt frame. Dropping handler_class=WebSocketHandler restores a single 101 response",
+        "Health Monitor kernel updates on PVE 9.x (#208) - The System Updates -> Kernel / PVE row used to report \"Kernel/PVE up to date\" even when an update for the running kernel was waiting upstream. Three combined fixes: (a) the kernel-package prefix list now includes proxmox-kernel-* and proxmox-firmware-* (PVE 9.x ships kernels under proxmox-kernel-, not pve-kernel- as in 7.x / 8.x), (b) the dry-run switched from apt-get upgrade --dry-run to apt-get dist-upgrade --dry-run so kernel updates packaged as new installs are visible, (c) the categoriser now reads uname -r and flags an update as a running-kernel update when the package matches the running release",
+        "NVIDIA installer - The version menu now respects the running kernel compatibility window, only offering driver branches that won't fail to compile",
+        "NVIDIA installer on Alpine LXC - Container-side userspace install reworked so it succeeds on Alpine hosts, and free-space detection works reliably across all storage layouts",
+        "NVIDIA installer with NVENC patch - When the host has the NVENC patch applied, the version menu narrows to drivers supported by the patch so reinstalling never silently loses it",
+        "Webhook URL - PVE notification webhook now follows the active SSL state automatically, switching between http and https when you toggle HTTPS in the panel",
+        "ATA disk error not recorded - disk_observations is now written before the SMART gate, so transient errors that don't yet trip SMART still build the per-disk history",
+        "Quiet Hours toggle not persisting - get_settings now returns the per-channel quiet_* / digest_* fields so the toggle state reloads correctly after a refresh",
+        "Frontend 401 cascade - Login screen no longer swallows the 401 forever after a brief stale-token state",
+        "Apprise URL section - Mobile overflow - On narrow viewports the Apprise URL row used to break the layout. The placeholder is now a single concise example (tgram://bottoken/ChatID), the URL input enforces min-w-0 / flex-1 / shrink-0 on its children, and the examples paragraph uses break-all min-w-0 so it wraps cleanly on any width",
+        "Apprise channel rejected by backend with HTTP 400 - The notifications-test validator's hard-coded channel whitelist (used by POST /api/notifications/test and the history filter) was missing 'apprise', so every Apprise test or send returned 400 \"Invalid channel\" before the library was even invoked. The whitelist is now derived live from notification_channels.CHANNEL_TYPES, so adding a new channel implementation cannot silently regress this validator again",
+        "Apprise error reporting - When a destination (jsons://, ntfy://, slack://, ...) returns a non-2xx response, the channel now captures Apprise's internal logger during notify() and surfaces the real HTTP status plus the destination's response body (capped at 300 chars) instead of the opaque \"Apprise rejected the notification (transport failure)\" message",
+        "fail2ban-client subprocess storm - The cache wrapper around _f2b_get_banned_ips() only updated its timestamp on success, so on hosts where fail2ban-client returned ENOENT (binary not installed) the function fell through the cache check on every single HTTP request and fired 250+ failed execve calls in a 10-minute window. shutil.which('fail2ban-client') is now resolved once at module load and the cache timestamp is updated unconditionally",
+        "smartctl scheduler collision - Disk SMART temperature polling, CPU temperature read and latency probe used to fire at the same offset within each minute, producing a measurable CPU / IO spike when all subprocesses spawned together. The polls are now staggered (latency, then CPU temperature, then disk SMART) while preserving the per-disk 60 s cadence",
+        "LXC inventory subprocess - The mount monitor used to call `lxc-info -n <vmid> -p` for every running CT just to get its PID. It now reads /proc/<lxc-start-pid>/task/<lxc-start-pid>/children directly and falls back to lxc-info only when /proc reads fail, eliminating one subprocess per CT per scan cycle",
+        "Browser-translated terminal pages - The terminal panel used to lose its WebSocket connection when the user enabled the browser's auto-translate feature, because the translator moved DOM nodes that React still held refs to. Added translate=\"no\" on the terminal container divs so the translator skips the embedded tty entirely",
+        "Active Suppressions Save not activating after Re-enable - The Re-enable button used to fire the API call immediately without touching pendingChanges, so the Health Monitor Save button never registered the action. Re-enables are now queued (visual: green border + strike-through on the row + button label changes to Undo) and applied atomically when the user clicks Save, alongside any per-category dropdown changes",
+        "Active Suppressions stale after dashboard Dismiss - Dismissing an alert from the Health Monitor modal while the Settings page was already open did not refresh the Active Suppressions list. The dashboard now dispatches a `health-suppression-changed` browser event on every dismiss / un-dismiss; the Settings page listens for it (plus window focus and document visibilitychange) and re-fetches the active set",
+      ],
+    },
+  },
+  "1.2.1.4-beta": {
+    date: "May 30, 2026",
+    changes: {
+      added: [
+        "Per-error dismiss duration - The Dismiss button on each Health Monitor alert now opens a small dropdown with three options: 24 hours, 7 days, or Permanently. The 24h / 7d paths behave like the existing time-limited dismiss (the alert reappears after the window expires). Permanent dismisses persist with suppression_hours = -1 in the persistence DB, never re-emit, never re-notify, and are marked with a distinct amber Permanent badge in the Health Monitor so the operator knows the alert is intentionally silenced",
+        "Active Suppressions panel in Settings - New section inside Settings -> Health Monitor (below the per-category suppression durations) that lists every currently-dismissed alert, both time-limited (with countdown) and permanent. Each row carries the error_key, category, severity, when it was dismissed, and a Re-enable button that clears the acknowledgment so the alert can fire again on the next scan. The Re-enable button is gated by the Health Monitor Edit mode (same gating as the rest of the Health settings) — toggle Edit at the top of the page first, then the buttons become active. Permanent dismisses can only be reverted from here, time-limited ones can also be force-revived if you don't want to wait for the countdown",
+        "Apprise channel - per-event toggles, Quiet Hours and Daily Digest - The Apprise tab now exposes the same Notification Categories block, per-event sub-toggles, Quiet Hours and Daily Digest controls as Telegram / Gotify / Discord / Email. The backend already supported per-channel filtering for Apprise via the generic channel_overrides logic; the UI just wasn't surfacing it",
+      ],
+      changed: [
+        "POST /api/health/acknowledge accepts an optional suppression_hours body field - positive integer for the dismiss duration in hours, -1 for permanent. Omitting the field preserves the previous behaviour (uses the category's configured default). New endpoint POST /api/health/un-acknowledge {error_key} reverses a dismiss (used by Settings -> Active Suppressions and by future automations)",
+        "Health Monitor dismissed annotation - When an alert is currently acknowledged with suppression_hours = -1, the dashboard payload now tags the check with permanent: true alongside dismissed: true so the UI can render the Permanent badge separately from the standard time-limited Dismissed badge",
+      ],
+      fixed: [
+        "Apprise URL section - Mobile overflow - On narrow viewports the Apprise URL row used to break the design: the placeholder packed four full example URLs into one line and the inline <code> examples in the description had no break-all rule, so the section pushed past the right edge of the viewport. The placeholder is now a single concise example (tgram://bottoken/ChatID), the URL input wrapper enforces min-w-0 / flex-1 / shrink-0 on its children, and the examples paragraph uses break-all min-w-0 so it wraps cleanly on any width",
+      ],
+    },
+  },
+  "1.2.1.3-beta": {
+    date: "May 22, 2026",
+    changes: {
+      added: [
+        "LXC Update Detection - A new dedicated section in Settings (between Health Monitor Thresholds and Notifications) with a single toggle that gates the per-CT apt list --upgradable / apk list -u scan end-to-end. Default ON. When OFF the scan stops entirely (no pct exec calls), every type=lxc entry is purged from the managed-installs registry immediately, and the matching notification toggle in Notifications -> Services disappears from the UI while preserving its stored preference",
+        "LXC update checker auto-refresh - The checker now reads the mtime of the CT's package-manager metadata cache and runs apt-get update / apk update from outside via pct exec if it is older than 24h, with a 60s timeout and silent failure. Long-running appliance CTs whose caches were months stale now surface their real upstream backlog (a Debian 12 CT with a 524-day-old cache went from \"0 updates\" to \"117 (12 security)\" on lab hardware)",
+      ],
+      changed: [
+        "AI Enhancement section in Notifications - Rewritten from a muted uppercase row that testers consistently scrolled past, to a normal-case foreground label with a leading Sparkles icon and a persistent badge (green Active when AI is enabled, neutral Optional when it isn't) so the feature is visible regardless of state",
+      ],
+      fixed: [
+        "Terminal modals on HTTPS hosts - Every terminal modal (dashboard terminal, LXC terminal, script terminal) used to fail with WebSocket connection error on hosts with HTTPS enabled. Root cause: the gevent+SSL path stacked geventwebsocket's WebSocketHandler on top of flask-sock's protocol implementation, so the server emitted two consecutive HTTP/1.1 101 Switching Protocols headers and the browser closed the connection as a corrupt frame. Dropping handler_class=WebSocketHandler restores a single 101 response and lets the handshake complete normally",
+        "Health Monitor kernel updates on PVE 9.x (#208) - The System Updates -> Kernel/PVE row reported \"Kernel/PVE up to date\" on PVE 9.x hosts even when an update for the running kernel was waiting upstream. Three combined fixes: (a) the kernel-package prefix list now includes proxmox-kernel-* and proxmox-firmware-* (PVE 9.x ships kernels under proxmox-kernel-, not pve-kernel- as in 7.x/8.x), (b) the dry-run switched from apt-get upgrade --dry-run to apt-get dist-upgrade --dry-run so kernel updates packaged as new installs are visible at all, (c) the categoriser now reads uname -r and flags an update as a running-kernel update when the package matches the running release exactly or its branch meta-package (e.g. proxmox-kernel-6.14 for a host on 6.14.11-4-pve). The row text now distinguishes \"Running kernel update available (reboot required)\" from \"N kernel update(s) available (none for running kernel)\"",
+      ],
+    },
+  },
+  "1.2.1.2-beta": {
+    date: "May 20, 2026",
+    changes: {
+      added: [
+        "Coral TPU installer - Uninstall path mirroring the NVIDIA flow, and registry-driven update notifications for both the PCIe gasket-dkms driver (tracked against feranick/gasket-driver) and the USB libedgetpu1 runtime (tracked via apt)",
+        "Disk I/O severity tiers - Sliding 24h window classifies dmesg ATA/SCSI errors into silent (0-10), WARNING (11-100) and CRITICAL (100+ or any hard error like UNC / Buffer I/O / Sense Key Hardware Error), so quiet days stay quiet and a single Buffer I/O event still pages immediately",
+        "Quiet Hours buffering - Events suppressed during a channel's quiet window are now persisted to SQLite and released as a grouped summary when the window closes, instead of being silently dropped",
+      ],
+      changed: [
+        "Burst aggregation wording - Burst summaries now report only the additional events that arrived after the initial individual alert, so the operator no longer sees the first event counted twice (\"+N more X in window\" instead of the old \"N X in window\" overlap)",
+        "Known-error classifier - Word-boundary regex on ATA/UNC patterns so kernel messages like nvidia_uvm:FatalError are no longer misclassified as ATA cable issues",
+        "Health journal context - Excludes proxmenux-monitor.service systemd lines so internal watchdog SIGKILLs no longer leak into the body of unrelated kernel events",
+        "Resolved notifications severity - The \"previous severity\" now matches the severity the user actually saw in the notification, not whatever escalated value silently landed in the DB during the 24h same-key cooldown",
+        "log2ram apply path - The auto/update flow now restarts log2ram after writing the new size, so a configured 512M actually takes effect on the running tmpfs (previously left at 128M until a manual restart)",
+        "VM/CT control errors - Failed start/stop/restart now surfaces the real pvesh stderr (e.g. \"no space left on device\") in the UI toast and fires a vm_fail / ct_fail notification, instead of a bare 500 INTERNAL SERVER ERROR",
+        "Mobile design of Quiet Hours / Daily Digest - Time inputs are now full-height with inline labels instead of the cramped grid layout that overflowed on narrow screens",
+      ],
+      fixed: [
+        "ATA disk error not recorded - disk_observations is now written before the SMART gate, so transient errors that don't yet trip SMART still build the per-disk history",
+        "Quiet Hours toggle not persisting - get_settings now returns the per-channel quiet_*/digest_* fields so the toggle's state reloads correctly after a refresh",
+        "Frontend 401 cascade - Login screen no longer swallows the 401 forever after a brief stale-token state; the dedup flag is cleared on mount and on successful login",
+      ],
+    },
+  },
+  "1.2.1.1-beta": {
+    date: "May 9, 2026",
+    changes: {
+      added: [
+        "Post-install function update detection - The Monitor now tracks installed ProxMenux optimizations (Log2Ram, Memory Settings, System Limits, Logrotate...) and notifies when a newer version of any of them is available, with one-click apply",
+        "Health Monitor Thresholds - Per-category warning and critical levels for CPU, memory, temperature, storage and more, configurable from Settings",
+        "NVIDIA driver update notifications - Kernel-aware detection of new compatible driver versions, surfaced in the Hardware tab and as notifications when a newer build is published upstream",
+        "Secure Gateway update flow - One-click Tailscale update from Settings with Last-checked / Installed / Latest indicators and notification when a new version is available",
+        "Helper-Scripts menu - Richer context and useful information for each entry, making it easier to know what every script does before running it",
+      ],
+      changed: [
+        "Disk temperature monitoring - Improved readings, smarter caching across SMART probes and a redesigned history modal that opens at 24h by default with min/avg/max statistics",
+        "VM and LXC modal - Expanded with additional information so a single panel covers the data you previously had to look up across multiple tabs",
+        "Page load - Faster first paint and lighter network usage on the Overview, Storage and Hardware tabs",
+        "Security improvements - Tighter authentication checks across notification, scripts and terminal endpoints, plus a more conservative default policy for new installs",
+      ],
+      fixed: [
+        "NVIDIA installer - The version menu now respects the running kernel compatibility window, only offering driver branches that won't fail to compile",
+        "NVIDIA installer on Alpine LXC - Container-side userspace install reworked so it succeeds on Alpine hosts, and free-space detection works reliably across all storage layouts",
+        "NVIDIA installer with NVENC patch - When the host has the NVENC patch applied, the version menu narrows to drivers supported by the patch so reinstalling never silently loses it",
+        "Webhook URL - PVE notification webhook now follows the active SSL state automatically, switching between http and https when you toggle HTTPS in the panel",
+      ],
+    },
+  },
+  "1.1.2-beta": {
+    date: "March 18, 2026",
+    changes: {
+      added: [
+        "Temperature & Latency Charts - Real-time visual monitoring with interactive graphs",
+        "WebSocket Terminal - Direct access to Proxmox host and LXC containers terminal",
+        "AI-Enhanced Notifications - Intelligent message formatting with multi-provider support (OpenAI, Groq, Anthropic, Ollama)",
+        "Security Section - Comprehensive security settings for ProxMenux and Proxmox",
+        "VPN Integration - Easy Tailscale VPN installation and configuration",
+        "GPU Scripts - Installation utilities for Intel, AMD and NVIDIA drivers",
+        "Disk Observations System - Track and document disk health observations over time",
+        "Enhanced Health Monitor - Configurable monitoring with advanced settings panel",
+      ],
+      changed: [
+        "Improved overall performance with optimized data fetching",
+        "Notifications now support rich formatting with contextual emojis",
+        "Health monitor now configurable from Settings section",
+        "Better Proxmox service name translation for non-expert users",
+      ],
+      fixed: [
+        "Fixed notification message truncation for large backup reports",
+        "Improved disk error deduplication to prevent repeated alerts",
+        "Corrected AI provider base URL handling for OpenAI-compatible APIs",
+      ],
+    },
+  },
   "1.0.1": {
     date: "November 11, 2025",
     changes: {
@@ -25,23 +252,16 @@ export const CHANGELOG: Record<string, ReleaseNote> = {
         "Proxy Support - Access ProxMenux through reverse proxies with full functionality",
         "Authentication System - Secure your dashboard with password protection",
         "PCIe Link Speed Detection - View NVMe drive connection speeds and detect performance issues",
-        "Enhanced Storage Display - Better formatting for disk sizes (auto-converts GB to TB when needed)",
-        "SATA/SAS Information - View detailed interface information for all storage devices",
         "Two-Factor Authentication (2FA) - Enhanced security with TOTP support",
         "Health Monitoring System - Comprehensive system health checks with dismissible warnings",
-        "Release Notes Modal - Automatic notification of new features and improvements",
       ],
       changed: [
         "Optimized VM & LXC page - Reduced CPU usage by 85% through intelligent caching",
         "Storage metrics now separate local and remote storage for clarity",
-        "Update warnings now appear only after 365 days instead of 30 days",
-        "API intervals staggered to distribute server load (23s and 37s)",
       ],
       fixed: [
         "Fixed dark mode text contrast issues in various components",
         "Corrected storage calculation discrepancies between Overview and Storage pages",
-        "Resolved JSON stringify error in VM control actions",
-        "Improved IP address fetching for LXC containers",
       ],
     },
   },
@@ -61,43 +281,78 @@ export const CHANGELOG: Record<string, ReleaseNote> = {
   },
 }
 
+// Each feature carries an i18n key so translations live in the
+// common.json catalogs and the modal renders in the user's chosen
+// locale. `text` is the English source of truth — it's what the
+// build-i18n-messages workflow feeds to Google Translate for locales
+// that haven't been curated by hand.
 const CURRENT_VERSION_FEATURES = [
   {
-    icon: <Link2 className="h-5 w-5" />,
-    text: "Proxy Support - Access ProxMenux through reverse proxies with full functionality",
+    icon: <Sparkles className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.appsDashboard",
+    text: "New top-level Apps dashboard — a single launcher for every Web Link across the node. LXC-registered apps and user-defined Custom Web Links share the same grid with category badges, search, and one-click deep-links back to the guest modal.",
   },
   {
-    icon: <Shield className="h-5 w-5" />,
-    text: "Two-Factor Authentication (2FA) - Enhanced security with TOTP support for login protection",
+    icon: <Cpu className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.lxcAppsUpdates",
+    text: "App tab inside every LXC modal registers installed apps, captures weblinks and tracks upstream versions. Reworked Updates tab applies OS packages and app updates from a single button; Docker Engine and per-image tracking follow the same 24-hour cycle, with a 'Check now' action on demand.",
   },
   {
     icon: <Zap className="h-5 w-5" />,
-    text: "Performance Improvements - Optimized loading times and reduced CPU usage across the application",
+    key: "releaseNotes.currentFeatures.appCatalog",
+    text: "New application detection catalog with over 380 tracked workloads, generated live from community-scripts across seven detector methods (file, binary, dpkg, apk, Python, Docker exec, Docker label). Primary and fallback detectors cover both new and historical LXC layouts.",
   },
   {
-    icon: <HardDrive className="h-5 w-5" />,
-    text: "Storage Enhancements - Improved disk space consumption display with local and remote storage separation",
+    icon: <Languages className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.multilingual",
+    text: "The Monitor now speaks 8 languages: English, Spanish, German, French, Italian, Portuguese, Swedish and Slovak. Huge thanks to @vaso73 for building the i18n scaffolding that made this possible.",
   },
   {
-    icon: <Gauge className="h-5 w-5" />,
-    text: "PCIe Link Speed Detection - View NVMe drive connection speeds and identify performance bottlenecks",
-  },
-  {
-    icon: <Wrench className="h-5 w-5" />,
-    text: "Hardware Page Improvements - Enhanced hardware information display with detailed PCIe and interface data",
-  },
-  {
-    icon: <Settings className="h-5 w-5" />,
-    text: "New Settings Page - Centralized configuration for authentication, optimizations, and system preferences",
+    icon: <Server className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.nvidiaMultiGpu",
+    text: "NVIDIA driver lifecycle moves to per-BDF ownership so a multi-GPU host can pass one card to a VM and keep the other operational on the host or in LXCs, plus a kernel + branch + GPU-aware version picker (#298).",
   },
 ]
 
+// Turn any "@handle" mention inside a release-notes string into a
+// link to that GitHub profile. Applied to every feature bullet so a
+// contributor shout-out reads as a real link without needing rich
+// i18n formatting. Only matches `@` followed by a valid GitHub
+// username (letters/digits/hyphen, no consecutive hyphens, 1-39
+// chars) so unrelated punctuation stays untouched.
+function linkifyGithubMentions(text: string): (string | JSX.Element)[] {
+  const parts: (string | JSX.Element)[] = []
+  const re = /@([A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?)/g
+  let cursor = 0
+  let m: RegExpExecArray | null
+  let idx = 0
+  while ((m = re.exec(text)) !== null) {
+    if (m.index > cursor) parts.push(text.slice(cursor, m.index))
+    const handle = m[1]
+    parts.push(
+      <a
+        key={`gh-${idx++}`}
+        href={`https://github.com/${handle}`}
+        target="_blank"
+        rel="noopener noreferrer"
+        className="text-orange-500 hover:text-orange-400 underline underline-offset-2"
+      >
+        @{handle}
+      </a>,
+    )
+    cursor = m.index + m[0].length
+  }
+  if (cursor < text.length) parts.push(text.slice(cursor))
+  return parts
+}
+
 interface ReleaseNotesModalProps {
   open: boolean
   onClose: () => void
 }
 
 export function ReleaseNotesModal({ open, onClose }: ReleaseNotesModalProps) {
+  const t = useT()
   const [dontShowAgain, setDontShowAgain] = useState(false)
 
   const handleClose = () => {
@@ -110,7 +365,7 @@ export function ReleaseNotesModal({ open, onClose }: ReleaseNotesModalProps) {
   return (
     <Dialog open={open} onOpenChange={handleClose}>
       <DialogContent className="max-w-2xl max-h-[85vh] p-0 gap-0 border-0 bg-transparent">
-        <DialogTitle className="sr-only">Release Notes - Version {APP_VERSION}</DialogTitle>
+        <DialogTitle className="sr-only">{t("releaseNotes.dialogTitle", { version: APP_VERSION })}</DialogTitle>
         <div className="relative bg-card rounded-lg shadow-2xl h-full flex flex-col max-h-[85vh]">
           <Button
             variant="ghost"
@@ -136,10 +391,10 @@ export function ReleaseNotesModal({ open, onClose }: ReleaseNotesModalProps) {
           <div className="flex-1 overflow-y-auto p-6 md:p-8 space-y-4 md:space-y-6 min-h-0">
             <div className="space-y-2">
               <h2 className="text-xl md:text-2xl font-bold text-foreground text-balance">
-                What's New in Version {APP_VERSION}
+                {t("releaseNotes.title", { version: APP_VERSION })}
               </h2>
               <p className="text-sm text-muted-foreground leading-relaxed">
-                We've added exciting new features and improvements to make ProxMenux Monitor even better!
+                {t("releaseNotes.intro")}
               </p>
             </div>
 
@@ -150,7 +405,9 @@ export function ReleaseNotesModal({ open, onClose }: ReleaseNotesModalProps) {
                   className="flex items-start gap-2 md:gap-3 p-3 rounded-lg bg-muted/50 border border-border/50 hover:bg-muted/70 transition-colors"
                 >
                   <div className="text-orange-500 mt-0.5 flex-shrink-0">{feature.icon}</div>
-                  <p className="text-xs md:text-sm text-foreground leading-relaxed">{feature.text}</p>
+                  <p className="text-xs md:text-sm text-foreground leading-relaxed">
+                    {linkifyGithubMentions(t(feature.key))}
+                  </p>
                 </div>
               ))}
             </div>
@@ -163,7 +420,7 @@ export function ReleaseNotesModal({ open, onClose }: ReleaseNotesModalProps) {
                 className="w-full bg-gradient-to-r from-amber-500 to-orange-500 hover:from-amber-600 hover:to-orange-600"
               >
                 <Sparkles className="h-4 w-4 mr-2" />
-                Got it!
+                {t("releaseNotes.gotIt")}
               </Button>
 
               <div className="flex items-center justify-center gap-2">
@@ -176,7 +433,7 @@ export function ReleaseNotesModal({ open, onClose }: ReleaseNotesModalProps) {
                   htmlFor="dont-show-version-again"
                   className="text-xs md:text-sm text-muted-foreground hover:text-foreground transition-colors cursor-pointer select-none"
                 >
-                  Don't show again for this version
+                  {t("releaseNotes.dontShowAgain")}
                 </label>
               </div>
             </div>

AppImage/components/restore-progress-card.tsx

@@ -0,0 +1,723 @@
+"use client"
+
+// Live inline card + detail modal for the post-boot restore.
+//
+// apply_cluster_postboot.sh writes /var/lib/proxmenux/restore-state.json
+// as it works through the milestones (apply cluster config, initramfs,
+// grub, per-component reinstalls, sanity check, finalize). The Flask
+// endpoints /api/host-backups/restore/{status,dismiss,history,log}
+// expose that state to this component. While the restore is running we
+// poll every 2s; once it's terminal (complete|failed) we back off to
+// 30s so the card can still be re-opened as a summary. Once the
+// operator hits Dismiss the card collapses and the History button
+// keeps the run browsable.
+
+import { useMemo, useState } from "react"
+import useSWR from "swr"
+import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
+import { Button } from "./ui/button"
+import { Badge } from "./ui/badge"
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+  DialogFooter,
+} from "./ui/dialog"
+import { ScrollArea } from "./ui/scroll-area"
+import {
+  Loader2,
+  CheckCircle2,
+  XCircle,
+  AlertTriangle,
+  History,
+  RotateCcw,
+  ChevronRight,
+  Cpu,
+  FileText,
+  ArrowDownAZ,
+  Filter,
+} from "lucide-react"
+import { fetchApi } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+
+// ── Shape contracts with the backend ──────────────────────────
+
+interface RestoreComponent {
+  name: string
+  status: "installing" | "ok" | "failed"
+  log: string
+  exit_code?: string
+}
+
+interface RestoreSummary {
+  hostname: string
+  guests: string
+  stubs: string
+  stale_nodes: string
+  components: string
+  duration: string
+}
+
+interface RestoreRollback {
+  vms_to_remove?: string[]
+  lxcs_to_remove?: string[]
+  components_to_uninstall?: string[]
+}
+
+interface DataPoolsImport {
+  ok: string[]
+  forced: string[]
+  partial: string[]
+  missing: string[]
+  failed: string[]
+  finished_at?: string
+  log_path?: string
+}
+
+interface RestoreState {
+  status: "running" | "complete" | "failed"
+  started_at: string
+  finished_at: string | null
+  current_step: string
+  steps_done: number
+  steps_total: number
+  log_path: string
+  components: RestoreComponent[]
+  rollback_delta: RestoreRollback
+  sanity_warnings: string[]
+  summary: RestoreSummary | null
+  acknowledged: boolean
+  duration?: string
+  data_pools_import?: DataPoolsImport
+}
+
+interface HistoryEntry {
+  file: string
+  mtime: number
+  status: string
+  started_at: string | null
+  finished_at: string | null
+  duration: string | null
+}
+
+const fetcher = (url: string) => fetchApi(url)
+
+const COMPONENT_LABEL: Record<string, string> = {
+  nvidia_driver: "NVIDIA driver",
+  amdgpu_top: "amdgpu_top",
+  intel_gpu_tools: "Intel GPU tools",
+  coral_driver: "Google Coral TPU driver",
+}
+
+const formatComponent = (name: string) => COMPONENT_LABEL[name] ?? name
+
+const formatIso = (iso: string | null | undefined) => {
+  if (!iso) return "—"
+  try {
+    return new Date(iso).toLocaleString()
+  } catch {
+    return iso
+  }
+}
+
+type Translator = ReturnType<typeof useT>
+
+const formatRelative = (iso: string, t: Translator) => {
+  try {
+    const then = new Date(iso).getTime()
+    const now = Date.now()
+    const diff = Math.max(0, Math.round((now - then) / 1000))
+    if (diff < 60) return t("restoreProgress.time.secondsAgo", { count: diff })
+    if (diff < 3600) return t("restoreProgress.time.minutesAgo", { count: Math.round(diff / 60) })
+    if (diff < 86400) return t("restoreProgress.time.hoursAgo", { count: Math.round(diff / 3600) })
+    return t("restoreProgress.time.daysAgo", { count: Math.round(diff / 86400) })
+  } catch {
+    return iso
+  }
+}
+
+// Rough time-remaining estimate derived from steps_done + elapsed.
+// Best-effort: at step 0 there's no data yet, so it returns
+// "estimating time…". After the run is terminal, "—". The output is
+// a full phrase so the caller doesn't have to add suffix words that
+// only make sense on some branches.
+const computeEta = (state: RestoreState, t: Translator): string => {
+  if (state.status !== "running") return "—"
+  if (!state.steps_done || state.steps_done <= 0) return t("restoreProgress.time.estimating")
+  const elapsedSec = Math.max(1, Math.round((Date.now() - new Date(state.started_at).getTime()) / 1000))
+  const perStep = elapsedSec / state.steps_done
+  const remaining = Math.max(0, state.steps_total - state.steps_done)
+  const eta = Math.round(perStep * remaining)
+  if (eta < 60) return t("restoreProgress.time.secondsLeft", { count: eta })
+  if (eta < 3600) return t("restoreProgress.time.minutesLeft", { count: Math.round(eta / 60) })
+  return t("restoreProgress.time.hoursLeft", { count: Math.round(eta / 3600) })
+}
+
+// ── Small building blocks ─────────────────────────────────────
+
+const StatusBadge: React.FC<{ status: string }> = ({ status }) => {
+  const t = useT()
+  if (status === "running")
+    return (
+      <Badge className="bg-blue-500/10 border-blue-500/40 text-blue-300 gap-1">
+        <Loader2 className="h-3 w-3 animate-spin" />
+        {t("restoreProgress.status.running")}
+      </Badge>
+    )
+  if (status === "complete")
+    return (
+      <Badge className="bg-emerald-500/10 border-emerald-500/40 text-emerald-400 gap-1">
+        <CheckCircle2 className="h-3 w-3" />
+        {t("restoreProgress.status.complete")}
+      </Badge>
+    )
+  if (status === "failed")
+    return (
+      <Badge className="bg-red-500/10 border-red-500/40 text-red-400 gap-1">
+        <XCircle className="h-3 w-3" />
+        {t("restoreProgress.status.failed")}
+      </Badge>
+    )
+  return <Badge variant="outline">{status}</Badge>
+}
+
+const ComponentStatusIcon: React.FC<{ status: string }> = ({ status }) => {
+  if (status === "installing")
+    return <Loader2 className="h-3.5 w-3.5 animate-spin text-blue-400" />
+  if (status === "ok")
+    return <CheckCircle2 className="h-3.5 w-3.5 text-emerald-400" />
+  return <XCircle className="h-3.5 w-3.5 text-red-400" />
+}
+
+// ── Log viewer ────────────────────────────────────────────────
+
+const LogViewer: React.FC<{ path: string | null; historyOnly?: boolean }> = ({ path, historyOnly }) => {
+  const t = useT()
+  const [filter, setFilter] = useState<"all" | "issues">("all")
+  const swrKey = path
+    ? `/api/host-backups/restore/log?filter=${filter}&tail=600${historyOnly ? `&path=${encodeURIComponent(path)}` : ""}`
+    : null
+  const { data, isLoading } = useSWR<{ lines: string[]; total_lines: number; path: string | null }>(
+    swrKey,
+    fetcher,
+    { refreshInterval: historyOnly ? 0 : 4000 },
+  )
+
+  return (
+    <div className="space-y-2">
+      <div className="flex items-center justify-between text-xs">
+        <div className="flex items-center gap-1 text-muted-foreground">
+          <FileText className="h-3.5 w-3.5" />
+          {path ?? t("restoreProgress.log.noLog")}
+        </div>
+        <div className="flex items-center gap-1">
+          <Button
+            size="sm"
+            variant={filter === "all" ? "default" : "outline"}
+            className="h-6 px-2 text-xs"
+            onClick={() => setFilter("all")}
+          >
+            <ArrowDownAZ className="h-3 w-3 mr-1" />
+            {t("restoreProgress.log.full")}
+          </Button>
+          <Button
+            size="sm"
+            variant={filter === "issues" ? "default" : "outline"}
+            className="h-6 px-2 text-xs"
+            onClick={() => setFilter("issues")}
+          >
+            <Filter className="h-3 w-3 mr-1" />
+            {t("restoreProgress.log.issuesOnly")}
+          </Button>
+        </div>
+      </div>
+      <ScrollArea className="h-72 rounded-md border border-border bg-black/40">
+        <pre className="p-3 text-xs text-muted-foreground whitespace-pre-wrap font-mono leading-relaxed">
+          {isLoading ? t("app.loading") : (data?.lines?.join("\n") || t("restoreProgress.log.noOutput"))}
+        </pre>
+      </ScrollArea>
+    </div>
+  )
+}
+
+// ── Rollback delta widget ─────────────────────────────────────
+
+const RollbackDelta: React.FC<{ delta: RestoreRollback | undefined }> = ({ delta }) => {
+  const t = useT()
+  const vms = delta?.vms_to_remove ?? []
+  const lxcs = delta?.lxcs_to_remove ?? []
+  const comps = delta?.components_to_uninstall ?? []
+  if (!vms.length && !lxcs.length && !comps.length) {
+    return (
+      <div className="text-xs text-muted-foreground">
+        {t("restoreProgress.rollback.empty")}
+      </div>
+    )
+  }
+  const Row: React.FC<{ label: string; items: string[]; cmd: (id: string) => string }> = ({ label, items, cmd }) =>
+    items.length === 0 ? null : (
+      <div className="space-y-1">
+        <div className="text-xs font-medium text-muted-foreground">{label}</div>
+        <div className="flex flex-wrap gap-1.5">
+          {items.map((id) => (
+            <Badge key={id} variant="outline" className="font-mono text-xs">
+              {id}
+            </Badge>
+          ))}
+        </div>
+        {items.length > 0 && (
+          <details className="text-xs">
+            <summary className="cursor-pointer text-muted-foreground hover:text-foreground">
+              {t("restoreProgress.rollback.showCleanup")}
+            </summary>
+            <pre className="mt-1 p-2 rounded-md bg-black/40 text-xs text-muted-foreground font-mono">
+              {items.map(cmd).join("\n")}
+            </pre>
+          </details>
+        )}
+      </div>
+    )
+
+  return (
+    <div className="space-y-3">
+      <div className="text-xs text-muted-foreground">
+        {t("restoreProgress.rollback.description")}
+      </div>
+      <Row
+        label={t("restoreProgress.rollback.vms")}
+        items={vms}
+        cmd={(id) => `qm stop ${id} 2>/dev/null; qm destroy ${id} --purge`}
+      />
+      <Row
+        label={t("restoreProgress.rollback.lxcs")}
+        items={lxcs}
+        cmd={(id) => `pct stop ${id} 2>/dev/null; pct destroy ${id} --purge`}
+      />
+      <Row
+        label={t("restoreProgress.rollback.components")}
+        items={comps}
+        cmd={(name) => t("restoreProgress.rollback.uninstallComponentCommand", { name })}
+      />
+    </div>
+  )
+}
+
+// ── Detail modal ──────────────────────────────────────────────
+
+const RestoreDetailModal: React.FC<{
+  open: boolean
+  onClose: () => void
+  state: RestoreState
+  historyMode?: boolean
+}> = ({ open, onClose, state, historyMode }) => {
+  const t = useT()
+  const progressPct = state.steps_total > 0 ? Math.round((state.steps_done / state.steps_total) * 100) : 0
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => !v && onClose()}>
+      <DialogContent className="max-w-3xl">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <RotateCcw className="h-5 w-5 text-blue-500" />
+            {t("restoreProgress.title")}
+            <StatusBadge status={state.status} />
+          </DialogTitle>
+          <DialogDescription>
+            {t("restoreProgress.startedAt", { time: formatIso(state.started_at) })}
+            {state.finished_at ? ` · ${t("restoreProgress.finishedAt", { time: formatIso(state.finished_at) })}` : ""}
+            {state.summary?.duration ? ` · ${state.summary.duration}` : ""}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="space-y-1">
+            <div className="flex justify-between text-xs text-muted-foreground">
+              <span>{state.current_step || "—"}</span>
+              <span>
+                {t("restoreProgress.steps", { done: state.steps_done, total: state.steps_total })}
+                {state.status === "running" && ` · ${computeEta(state, t)}`}
+              </span>
+            </div>
+            <div className="h-2 rounded-full bg-muted overflow-hidden">
+              <div
+                className={`h-full transition-all duration-500 ${
+                  state.status === "failed" ? "bg-red-500" : state.status === "complete" ? "bg-emerald-500" : "bg-blue-500"
+                }`}
+                style={{ width: `${progressPct}%` }}
+              />
+            </div>
+          </div>
+
+          {state.components.length > 0 && (
+            <div className="space-y-2">
+              <div className="text-sm font-medium flex items-center gap-2">
+                <Cpu className="h-4 w-4" />
+                {t("restoreProgress.sections.components")}
+              </div>
+              <div className="space-y-1.5">
+                {state.components.map((c) => (
+                  <div
+                    key={c.name}
+                    className="flex items-center justify-between rounded-md border border-border bg-muted/30 px-3 py-2 text-xs"
+                  >
+                    <div className="flex items-center gap-2">
+                      <ComponentStatusIcon status={c.status} />
+                      <span className="font-medium">{formatComponent(c.name)}</span>
+                      <span className="text-muted-foreground">{t(`restoreProgress.componentStatus.${c.status}`)}</span>
+                      {c.exit_code && <span className="text-red-400">{t("restoreProgress.exitCode", { code: c.exit_code })}</span>}
+                    </div>
+                    {c.log && <span className="text-muted-foreground font-mono">{c.log}</span>}
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
+
+          {state.sanity_warnings.length > 0 && (
+            <div className="space-y-2">
+              <div className="text-sm font-medium flex items-center gap-2 text-amber-400">
+                <AlertTriangle className="h-4 w-4" />
+                {t("restoreProgress.sections.bootWarnings")}
+              </div>
+              <ul className="list-disc list-inside text-xs text-muted-foreground space-y-1">
+                {state.sanity_warnings.map((w) => (
+                  <li key={w}>{w}</li>
+                ))}
+              </ul>
+            </div>
+          )}
+
+          {state.data_pools_import && <DataPoolsBlock section={state.data_pools_import} />}
+
+          <div className="space-y-2">
+            <div className="text-sm font-medium">{t("restoreProgress.sections.rollbackDelta")}</div>
+            <RollbackDelta delta={state.rollback_delta} />
+          </div>
+
+          <div className="space-y-2">
+            <div className="text-sm font-medium">{t("restoreProgress.sections.log")}</div>
+            <LogViewer path={state.log_path} historyOnly={historyMode} />
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={onClose}>
+            {t("actions.close")}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+// Rendered inside RestoreDetailModal — one row per outcome category
+// (imported / forced / partial skip / missing skip / failed).
+const DataPoolsBlock: React.FC<{ section: DataPoolsImport }> = ({ section }) => {
+  const t = useT()
+  const total =
+    section.ok.length +
+    section.forced.length +
+    section.partial.length +
+    section.missing.length +
+    section.failed.length
+  if (total === 0) return null
+
+  const Row: React.FC<{
+    label: string
+    tone: "ok" | "warn" | "info" | "error"
+    items: string[]
+    help?: string
+  }> = ({ label, tone, items, help }) => {
+    if (items.length === 0) return null
+    const toneClass =
+      tone === "ok"
+        ? "text-emerald-400"
+        : tone === "warn"
+          ? "text-amber-400"
+          : tone === "error"
+            ? "text-red-400"
+            : "text-blue-400"
+    return (
+      <div className="rounded-md border border-border bg-muted/30 px-3 py-2 text-xs">
+        <div className={`font-medium ${toneClass} flex items-center gap-2`}>
+          {tone === "ok" && <CheckCircle2 className="h-3.5 w-3.5" />}
+          {tone === "warn" && <AlertTriangle className="h-3.5 w-3.5" />}
+          {tone === "error" && <XCircle className="h-3.5 w-3.5" />}
+          {tone === "info" && <CheckCircle2 className="h-3.5 w-3.5" />}
+          <span>{label}</span>
+          <span className="text-muted-foreground">({items.length})</span>
+        </div>
+        <div className="mt-1 font-mono text-muted-foreground break-all">{items.join(", ")}</div>
+        {help && <div className="mt-1 text-muted-foreground">{help}</div>}
+      </div>
+    )
+  }
+
+  return (
+      <div className="space-y-2">
+      <div className="text-sm font-medium flex items-center gap-2">
+        <Cpu className="h-4 w-4" />
+        {t("restoreProgress.dataPools.title")}
+      </div>
+      <div className="space-y-1.5">
+        <Row label={t("restoreProgress.dataPools.imported")} tone="ok" items={section.ok} />
+        <Row
+          label={t("restoreProgress.dataPools.importedForced")}
+          tone="info"
+          items={section.forced}
+          help={t("restoreProgress.dataPools.importedForcedHelp")}
+        />
+        <Row
+          label={t("restoreProgress.dataPools.skippedPartial")}
+          tone="warn"
+          items={section.partial}
+          help={t("restoreProgress.dataPools.skippedPartialHelp")}
+        />
+        <Row
+          label={t("restoreProgress.dataPools.skippedMissing")}
+          tone="warn"
+          items={section.missing}
+          help={t("restoreProgress.dataPools.skippedMissingHelp")}
+        />
+        <Row
+          label={t("restoreProgress.dataPools.importFailed")}
+          tone="error"
+          items={section.failed}
+          help={t("restoreProgress.dataPools.importFailedHelp")}
+        />
+      </div>
+      {section.log_path && (
+        <div className="text-xs text-muted-foreground font-mono">{t("restoreProgress.dataPools.logPath", { path: section.log_path })}</div>
+      )}
+    </div>
+  )
+}
+
+// ── History browser modal ─────────────────────────────────────
+
+const RestoreHistoryModal: React.FC<{ open: boolean; onClose: () => void }> = ({ open, onClose }) => {
+  const t = useT()
+  const { data } = useSWR<{ entries: HistoryEntry[] }>(open ? "/api/host-backups/restore/history" : null, fetcher)
+  const [detailFile, setDetailFile] = useState<string | null>(null)
+  const { data: detailResp } = useSWR<{ state: RestoreState }>(
+    detailFile ? `/api/host-backups/restore/history?file=${encodeURIComponent(detailFile)}` : null,
+    fetcher,
+  )
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={(v) => !v && onClose()}>
+        <DialogContent className="max-w-2xl">
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2">
+              <History className="h-5 w-5" />
+              {t("restoreProgress.history.title")}
+            </DialogTitle>
+            <DialogDescription>
+              {t("restoreProgress.history.description")}
+            </DialogDescription>
+          </DialogHeader>
+
+          <ScrollArea className="h-96">
+            <div className="space-y-1.5">
+              {(data?.entries ?? []).length === 0 ? (
+                <div className="text-sm text-muted-foreground py-6 text-center">{t("restoreProgress.history.empty")}</div>
+              ) : (
+                (data?.entries ?? []).map((e) => (
+                  <button
+                    key={e.file}
+                    onClick={() => setDetailFile(e.file)}
+                    className="w-full flex items-center justify-between rounded-md border border-border bg-muted/30 hover:bg-muted px-3 py-2 text-xs text-left"
+                  >
+                    <div className="flex items-center gap-2">
+                      <StatusBadge status={e.status} />
+                      <span className="text-muted-foreground">
+                        {e.started_at ? formatIso(e.started_at) : formatIso(new Date(e.mtime * 1000).toISOString())}
+                      </span>
+                      {e.duration && <span className="text-muted-foreground">· {e.duration}</span>}
+                    </div>
+                    <ChevronRight className="h-4 w-4 text-muted-foreground" />
+                  </button>
+                ))
+              )}
+            </div>
+          </ScrollArea>
+
+          <DialogFooter>
+            <Button variant="outline" onClick={onClose}>
+              {t("actions.close")}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+
+      {detailFile && detailResp?.state && (
+        <RestoreDetailModal
+          open={!!detailFile}
+          onClose={() => setDetailFile(null)}
+          state={detailResp.state}
+          historyMode
+        />
+      )}
+    </>
+  )
+}
+
+// ── Main inline card ──────────────────────────────────────────
+
+export const RestoreProgressCard: React.FC = () => {
+  const t = useT()
+  const { data, mutate } = useSWR<{ state: RestoreState | null }>(
+    "/api/host-backups/restore/status",
+    fetcher,
+    {
+      refreshInterval: (latest) => (latest?.state?.status === "running" ? 2000 : 30000),
+      revalidateOnFocus: true,
+    },
+  )
+  const [detailOpen, setDetailOpen] = useState(false)
+  const [historyOpen, setHistoryOpen] = useState(false)
+  const [dismissing, setDismissing] = useState(false)
+
+  const state = data?.state ?? null
+  const progressPct = useMemo(() => {
+    if (!state || state.steps_total <= 0) return 0
+    return Math.round((state.steps_done / state.steps_total) * 100)
+  }, [state])
+
+  const dismiss = async () => {
+    if (!state) return
+    setDismissing(true)
+    try {
+      await fetchApi("/api/host-backups/restore/dismiss", { method: "POST" })
+      await mutate()
+    } finally {
+      setDismissing(false)
+    }
+  }
+
+  // Hidden entirely when: no restore run has ever happened, OR the
+  // last run is terminal AND acknowledged. History button is still
+  // reachable from the main card header (rendered elsewhere).
+  if (!state) return null
+  if (state.status !== "running" && state.acknowledged) {
+    return (
+      <div className="flex justify-end">
+        <Button variant="ghost" size="sm" onClick={() => setHistoryOpen(true)}>
+          <History className="h-3.5 w-3.5 mr-1" />
+          {t("restoreProgress.history.title")}
+        </Button>
+        <RestoreHistoryModal open={historyOpen} onClose={() => setHistoryOpen(false)} />
+      </div>
+    )
+  }
+
+  const hasWarnings = state.sanity_warnings.length > 0
+  const pools = state.data_pools_import
+  const poolCount =
+    (pools?.ok.length ?? 0) +
+    (pools?.forced.length ?? 0) +
+    (pools?.partial.length ?? 0) +
+    (pools?.missing.length ?? 0) +
+    (pools?.failed.length ?? 0)
+  const poolWarnings = (pools?.partial.length ?? 0) + (pools?.missing.length ?? 0) + (pools?.failed.length ?? 0)
+  const barColor =
+    state.status === "failed" ? "bg-red-500" : state.status === "complete" ? "bg-emerald-500" : "bg-blue-500"
+
+  return (
+    <>
+      <Card className="bg-card border-border">
+        <CardHeader className="pb-3">
+          <div className="flex flex-wrap items-center justify-between gap-2">
+            <CardTitle className="text-base font-semibold flex items-center gap-2">
+              <RotateCcw
+                className={`h-5 w-5 ${state.status === "running" ? "text-blue-500 animate-spin" : "text-blue-500"}`}
+              />
+              {t("restoreProgress.title")}
+              <StatusBadge status={state.status} />
+              {hasWarnings && (
+                <Badge variant="outline" className="text-amber-400 border-amber-500/40 bg-amber-500/10 gap-1">
+                  <AlertTriangle className="h-3 w-3" />
+                  {t("restoreProgress.badges.bootWarnings", { count: state.sanity_warnings.length })}
+                </Badge>
+              )}
+              {poolCount > 0 && (
+                <Badge
+                  variant="outline"
+                  className={
+                    poolWarnings > 0
+                      ? "text-amber-400 border-amber-500/40 bg-amber-500/10 gap-1"
+                      : "text-emerald-400 border-emerald-500/40 bg-emerald-500/10 gap-1"
+                  }
+                >
+                  <Cpu className="h-3 w-3" />
+                  {t("restoreProgress.badges.zfsPools", { count: poolCount })}
+                  {poolWarnings > 0 && ` · ${t("restoreProgress.badges.needAttention", { count: poolWarnings })}`}
+                </Badge>
+              )}
+            </CardTitle>
+            <div className="flex items-center gap-2">
+              <Button size="sm" variant="outline" onClick={() => setDetailOpen(true)}>
+                {t("restoreProgress.actions.details")}
+              </Button>
+              <Button size="sm" variant="ghost" onClick={() => setHistoryOpen(true)}>
+                <History className="h-3.5 w-3.5 mr-1" />
+                {t("restoreProgress.actions.history")}
+              </Button>
+              {state.status !== "running" && (
+                <Button size="sm" onClick={dismiss} disabled={dismissing}>
+                  {dismissing ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : t("restoreProgress.actions.dismiss")}
+                </Button>
+              )}
+            </div>
+          </div>
+        </CardHeader>
+        <CardContent className="space-y-3">
+          <div className="space-y-1">
+            <div className="flex justify-between text-xs text-muted-foreground">
+              <span className="truncate">
+                {state.current_step || "—"} · {t("restoreProgress.startedRelative", { time: formatRelative(state.started_at, t) })}
+              </span>
+              <span>
+                {t("restoreProgress.steps", { done: state.steps_done, total: state.steps_total })}
+                {state.status === "running" && ` · ${computeEta(state, t)}`}
+                {state.summary?.duration && state.status !== "running" && ` · ${state.summary.duration}`}
+              </span>
+            </div>
+            <div className="h-2 rounded-full bg-muted overflow-hidden">
+              <div className={`h-full transition-all duration-500 ${barColor}`} style={{ width: `${progressPct}%` }} />
+            </div>
+          </div>
+
+          {state.summary && (
+            <div className="grid grid-cols-2 md:grid-cols-4 gap-2 text-xs">
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">{t("restoreProgress.summary.guests")}</div>
+                <div className="font-medium">{state.summary.guests}</div>
+              </div>
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">{t("restoreProgress.summary.bindMountStubs")}</div>
+                <div className="font-medium">{state.summary.stubs}</div>
+              </div>
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">{t("restoreProgress.summary.staleNodesCleaned")}</div>
+                <div className="font-medium">{state.summary.stale_nodes}</div>
+              </div>
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">{t("restoreProgress.summary.components")}</div>
+                <div className="font-medium">{state.summary.components}</div>
+              </div>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+
+      <RestoreDetailModal open={detailOpen} onClose={() => setDetailOpen(false)} state={state} />
+      <RestoreHistoryModal open={historyOpen} onClose={() => setHistoryOpen(false)} />
+    </>
+  )
+}
+
+export default RestoreProgressCard

AppImage/components/script-terminal-modal.tsx

@@ -15,9 +15,23 @@ import {
   ArrowRight,
   CornerDownLeft,
   GripHorizontal,
+  ChevronDown,
+  Copy,
+  Clipboard,
 } from "lucide-react"
+import { copyTerminalSelection, pasteFromClipboard } from "@/lib/terminal-clipboard"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  DropdownMenuSeparator,
+  DropdownMenuLabel,
+} from "@/components/ui/dropdown-menu"
 import "xterm/css/xterm.css"
 import { API_PORT } from "@/lib/api-config"
+import { getTicketedWsUrl } from "@/lib/terminal-ws"
+import { useT } from "../lib/i18n/provider"
 
 interface WebInteraction {
   type: "yesno" | "menu" | "msgbox" | "input" | "inputbox"
@@ -34,6 +48,16 @@ interface ScriptTerminalModalProps {
   scriptPath: string
   title: string
   description: string
+  scriptName?: string
+  params?: Record<string, string>
+  completedSuccessfullyMessage?: string
+  completedWithErrorMessage?: (exitCode: number) => string
+  // Optional callback fired when the script's WebSocket closes
+  // (script_runner sends an exit code and then closes). Lets the
+  // parent auto-dismiss the modal — used by host-backup's Restore
+  // flow so "Press Enter to close" in the bash script actually
+  // closes the modal without an extra click. Other callers ignore.
+  onComplete?: (exitCode?: number) => void
 }
 
 export function ScriptTerminalModal({
@@ -42,9 +66,18 @@ export function ScriptTerminalModal({
   scriptPath,
   title,
   description,
+  params = { EXECUTION_MODE: "web" },
+  completedSuccessfullyMessage,
+  completedWithErrorMessage,
+  onComplete,
 }: ScriptTerminalModalProps) {
+  const t = useT()
   const termRef = useRef<any>(null)
   const wsRef = useRef<WebSocket | null>(null)
+  // Mirrors `isOpen` for use inside async closures (initializeTerminal)
+  // after dynamic imports resolve — captures the latest value without
+  // re-binding the closure.
+  const isOpenRef = useRef<boolean>(false)
   const fitAddonRef = useRef<any>(null)
   const sessionIdRef = useRef<string>(Math.random().toString(36).substring(2, 8))
 
@@ -56,6 +89,7 @@ export function ScriptTerminalModal({
   const reconnectTimeoutRef = useRef<NodeJS.Timeout | null>(null)
   const reconnectAttemptsRef = useRef(0)
   const keepAliveIntervalRef = useRef<NodeJS.Timeout | null>(null)
+  const completionReceivedRef = useRef(false)
   const [isMobile, setIsMobile] = useState(false)
   const [isTablet, setIsTablet] = useState(false)
 
@@ -67,7 +101,28 @@ export function ScriptTerminalModal({
   const resizeBarRef = useRef<HTMLDivElement>(null)
   const modalHeightRef = useRef(600)
 
+  const getCompletionMessage = useCallback(
+    (exitCode: number) =>
+      exitCode === 0
+        ? (completedSuccessfullyMessage ?? t("scriptTerminal.completedSuccessfully"))
+        : (completedWithErrorMessage?.(exitCode) ?? t("scriptTerminal.completedWithError", { code: exitCode })),
+    [completedSuccessfullyMessage, completedWithErrorMessage, t],
+  )
+
   const terminalContainerRef = useRef<HTMLDivElement>(null)
+  const paramsRef = useRef(params)
+  
+  // Keep paramsRef updated with latest params
+  useEffect(() => {
+    paramsRef.current = params
+  }, [params])
+
+  // Same trick for onComplete — we want the latest callback inside
+  // the ws.onclose handler without re-running the connection effect.
+  const onCompleteRef = useRef<((exitCode?: number) => void) | undefined>(undefined)
+  useEffect(() => {
+    onCompleteRef.current = onComplete
+  }, [onComplete])
 
   const attemptReconnect = useCallback(() => {
     if (!isOpen || isComplete || reconnectAttemptsRef.current >= 3) {
@@ -81,14 +136,15 @@ export function ScriptTerminalModal({
       clearTimeout(reconnectTimeoutRef.current)
     }
 
-    reconnectTimeoutRef.current = setTimeout(() => {
+    reconnectTimeoutRef.current = setTimeout(async () => {
       if (wsRef.current?.readyState !== WebSocket.OPEN && termRef.current) {
         if (wsRef.current) {
           wsRef.current.close()
         }
 
         const wsUrl = getScriptWebSocketUrl(sessionIdRef.current)
-        const ws = new WebSocket(wsUrl)
+        // Single-use auth ticket appended as ?ticket=... — see lib/terminal-ws.ts.
+        const ws = new WebSocket(await getTicketedWsUrl(wsUrl))
         wsRef.current = ws
 
         ws.onopen = () => {
@@ -104,13 +160,11 @@ export function ScriptTerminalModal({
             }
           }, 30000)
 
-          const initMessage = {
-            script_path: scriptPath,
-            params: {
-              EXECUTION_MODE: "web",
-            },
-          }
-          ws.send(JSON.stringify(initMessage))
+const initMessage = {
+          script_path: scriptPath,
+          params: paramsRef.current,
+        }
+        ws.send(JSON.stringify(initMessage))
 
           setTimeout(() => {
             if (fitAddonRef.current && termRef.current && ws.readyState === WebSocket.OPEN) {
@@ -122,6 +176,28 @@ export function ScriptTerminalModal({
         }
 
         ws.onmessage = (event) => {
+          // Filter out pong responses from heartbeat
+          if (event.data === '{"type": "pong"}' || event.data === '{"type":"pong"}') {
+            return
+          }
+
+          // The PTY worker always emits this final line.  Treat it as a
+          // completion fallback because some WebSocket servers tear down the
+          // connection before the following structured message is flushed.
+          const exitMatch = typeof event.data === "string"
+            ? event.data.match(/\[Script exited with code (-?\d+)\]/)
+            : null
+          if (exitMatch) {
+            const exitCode = Number(exitMatch[1])
+            termRef.current?.write(event.data)
+            completionReceivedRef.current = true
+            setIsComplete(true)
+            termRef.current?.writeln(`\x1b[${exitCode === 0 ? "32" : "31"}m${getCompletionMessage(exitCode)}\x1b[0m`)
+            onCompleteRef.current?.(exitCode)
+            if (ws.readyState === WebSocket.OPEN) ws.close(1000, "script complete")
+            return
+          }
+          
           try {
             const msg = JSON.parse(event.data)
             if (msg.type === "web_interaction" && msg.interaction) {
@@ -143,6 +219,15 @@ export function ScriptTerminalModal({
               termRef.current?.writeln(`\x1b[31m${msg.message}\x1b[0m`)
               return
             }
+            if (msg.type === "script_complete") {
+              const exitCode = Number(msg.exit_code ?? 1)
+              completionReceivedRef.current = true
+              setIsComplete(true)
+              termRef.current?.writeln(`\x1b[${exitCode === 0 ? "32" : "31"}m${getCompletionMessage(exitCode)}\x1b[0m`)
+              onCompleteRef.current?.(exitCode)
+              if (ws.readyState === WebSocket.OPEN) ws.close(1000, "script complete")
+              return
+            }
           } catch {}
           termRef.current?.write(event.data)
           setIsWaitingNextInteraction(false)
@@ -153,6 +238,9 @@ export function ScriptTerminalModal({
 
         ws.onerror = () => {
           setConnectionStatus("offline")
+          if (!completionReceivedRef.current) {
+            termRef.current?.writeln(`\x1b[31m${t("scriptTerminal.websocketError")}\x1b[0m`)
+          }
         }
 
         ws.onclose = (event) => {
@@ -161,15 +249,19 @@ export function ScriptTerminalModal({
             clearInterval(keepAliveIntervalRef.current)
             keepAliveIntervalRef.current = null
           }
+          if (completionReceivedRef.current) {
+            return
+          }
           if (!isComplete && reconnectAttemptsRef.current < 3) {
             reconnectTimeoutRef.current = setTimeout(attemptReconnect, 2000)
           } else {
             setIsComplete(true)
+            onCompleteRef.current?.(-1)
           }
         }
       }
     }, 1000)
-  }, [isOpen, isComplete, scriptPath])
+  }, [isOpen, isComplete, scriptPath, getCompletionMessage, t])
 
   const sendKey = useCallback((key: string) => {
     if (!termRef.current) return
@@ -192,17 +284,24 @@ export function ScriptTerminalModal({
   }, [])
 
   const initializeTerminal = async () => {
+    // Snapshot the open-state at call time. After the dynamic xterm
+    // imports resolve, bail out if the modal has since been closed —
+    // otherwise we attach a Terminal to a stale ref and open a WS that
+    // nobody reads. Audit Tier 6 — useEffect con `import("xterm")` sin
+    // cancelación.
+    const wasOpenAtCall = isOpenRef.current
     const [TerminalClass, FitAddonClass] = await Promise.all([
       import("xterm").then((mod) => mod.Terminal),
       import("xterm-addon-fit").then((mod) => mod.FitAddon),
       import("xterm/css/xterm.css"),
     ])
+    if (!wasOpenAtCall || !isOpenRef.current) return
 
     const fontSize = window.innerWidth < 768 ? 12 : 16
 
     const term = new TerminalClass({
       rendererType: "dom",
-      fontFamily: '"Courier", "Courier New", "Liberation Mono", "DejaVu Sans Mono", monospace',
+      fontFamily: '"MesloLGS NF", "FiraCode Nerd Font", "JetBrainsMono Nerd Font", "Hack Nerd Font", "Symbols Nerd Font", "Courier", "Courier New", "Liberation Mono", "DejaVu Sans Mono", monospace',
       fontSize: fontSize,
       lineHeight: 1,
       cursorBlink: true,
@@ -247,11 +346,17 @@ export function ScriptTerminalModal({
     setTimeout(() => {
       if (fitAddonRef.current && termRef.current) {
         fitAddonRef.current.fit()
+        // Send the keyboard to the xterm instance so any --yesno /
+        // --menu the script opens receives Enter / arrow keys
+        // directly. Without this the modal's Close button (or any
+        // other focusable descendant) intercepts the keystrokes.
+        termRef.current.focus()
       }
     }, 100)
 
     const wsUrl = getScriptWebSocketUrl(sessionIdRef.current)
-    const ws = new WebSocket(wsUrl)
+    // Single-use auth ticket appended as ?ticket=... — see lib/terminal-ws.ts.
+    const ws = new WebSocket(await getTicketedWsUrl(wsUrl))
     wsRef.current = ws
 
     ws.onopen = () => {
@@ -268,11 +373,8 @@ export function ScriptTerminalModal({
 
       const initMessage = {
         script_path: scriptPath,
-        params: {
-          EXECUTION_MODE: "web",
-        },
+        params: paramsRef.current,
       }
-
       ws.send(JSON.stringify(initMessage))
 
       setTimeout(() => {
@@ -291,6 +393,28 @@ export function ScriptTerminalModal({
     }
 
     ws.onmessage = (event) => {
+      // Filter out pong responses from heartbeat - don't display in terminal
+      if (event.data === '{"type": "pong"}' || event.data === '{"type":"pong"}') {
+        return
+      }
+
+      // See the reconnect handler above.  The exit line is guaranteed to be
+      // sent with the PTY output and is therefore a robust fallback when a
+      // final JSON frame is lost during server-side socket teardown.
+      const exitMatch = typeof event.data === "string"
+        ? event.data.match(/\[Script exited with code (-?\d+)\]/)
+        : null
+      if (exitMatch) {
+        const exitCode = Number(exitMatch[1])
+        term.write(event.data)
+        completionReceivedRef.current = true
+        setIsComplete(true)
+        term.writeln(`\x1b[${exitCode === 0 ? "32" : "31"}m${getCompletionMessage(exitCode)}\x1b[0m`)
+        onCompleteRef.current?.(exitCode)
+        if (ws.readyState === WebSocket.OPEN) ws.close(1000, "script complete")
+        return
+      }
+      
       try {
         const msg = JSON.parse(event.data)
 
@@ -314,6 +438,15 @@ export function ScriptTerminalModal({
           term.writeln(`\x1b[31m${msg.message}\x1b[0m`)
           return
         }
+        if (msg.type === "script_complete") {
+          const exitCode = Number(msg.exit_code ?? 1)
+          completionReceivedRef.current = true
+          setIsComplete(true)
+          term.writeln(`\x1b[${exitCode === 0 ? "32" : "31"}m${getCompletionMessage(exitCode)}\x1b[0m`)
+          onCompleteRef.current?.(exitCode)
+          if (ws.readyState === WebSocket.OPEN) ws.close(1000, "script complete")
+          return
+        }
       } catch {
         // Not JSON, es output normal de terminal
       }
@@ -328,26 +461,36 @@ export function ScriptTerminalModal({
 
     ws.onerror = (error) => {
       setConnectionStatus("offline")
-      term.writeln("\x1b[31mWebSocket error occurred\x1b[0m")
+      if (!completionReceivedRef.current) {
+        term.writeln(`\x1b[31m${t("scriptTerminal.websocketError")}\x1b[0m`)
+      }
     }
 
     ws.onclose = (event) => {
       setConnectionStatus("offline")
-      term.writeln("\x1b[33mConnection closed\x1b[0m")
+      if (!completionReceivedRef.current) {
+        term.writeln(`\x1b[33m${t("scriptTerminal.connectionClosed")}\x1b[0m`)
+      }
 
       if (keepAliveIntervalRef.current) {
         clearInterval(keepAliveIntervalRef.current)
         keepAliveIntervalRef.current = null
       }
 
-      if (!isComplete) {
+      if (!completionReceivedRef.current && !isComplete) {
         setIsComplete(true)
+        onCompleteRef.current?.(-1)
       }
     }
 
+    // Read `wsRef.current` inside the handler so reconnect (which swaps
+    // `wsRef.current` to a fresh WebSocket) doesn't leave us writing to the
+    // dead closure-captured `ws`. Without this fix, after reconnect the
+    // user's stdin disappears into the void. Audit residual #8.
     term.onData((data) => {
-      if (ws.readyState === WebSocket.OPEN) {
-        ws.send(data)
+      const live = wsRef.current
+      if (live && live.readyState === WebSocket.OPEN) {
+        live.send(data)
       }
     })
 
@@ -387,6 +530,7 @@ export function ScriptTerminalModal({
   }
 
   useEffect(() => {
+    isOpenRef.current = isOpen
     const savedHeight = localStorage.getItem("scriptModalHeight")
     if (savedHeight) {
       const height = Number.parseInt(savedHeight, 10)
@@ -422,6 +566,7 @@ export function ScriptTerminalModal({
 
       sessionIdRef.current = Math.random().toString(36).substring(2, 8)
       reconnectAttemptsRef.current = 0
+      completionReceivedRef.current = false
       setIsComplete(false)
       setInteractionInput("")
       setCurrentInteraction(null)
@@ -601,6 +746,14 @@ export function ScriptTerminalModal({
     }
   }
 
+  // Mobile clipboard helpers — see lib/terminal-clipboard.ts.
+  const handleCopy = async () => {
+    await copyTerminalSelection(termRef.current)
+  }
+  const handlePaste = async () => {
+    await pasteFromClipboard(sendCommand)
+  }
+
   return (
     <>
       <Dialog open={isOpen} onOpenChange={onClose}>
@@ -612,6 +765,13 @@ export function ScriptTerminalModal({
           }}
           onInteractOutside={(e) => e.preventDefault()}
           onEscapeKeyDown={(e) => e.preventDefault()}
+          // Radix defaults to focusing the first focusable descendant
+          // when a Dialog opens — that used to land on the Close button
+          // and every Enter/Space keystroke intended for the shell
+          // dialogs INSIDE the terminal would close the modal instead.
+          // Preempting the auto-focus lets the xterm focus() call in
+          // initializeTerminal below own the keyboard from the start.
+          onOpenAutoFocus={(e) => e.preventDefault()}
           hideClose
         >
           <DialogTitle className="sr-only">{title}</DialogTitle>
@@ -630,7 +790,7 @@ export function ScriptTerminalModal({
               <div className="absolute inset-0 flex items-center justify-center bg-black/50 backdrop-blur-sm">
                 <div className="flex flex-col items-center gap-3">
                   <Loader2 className="h-8 w-8 animate-spin text-blue-500" />
-                  <p className="text-sm text-muted-foreground">Processing...</p>
+                  <p className="text-sm text-muted-foreground">{t("scriptTerminal.processing")}</p>
                 </div>
               </div>
             )}
@@ -641,13 +801,13 @@ export function ScriptTerminalModal({
               ref={resizeBarRef}
               onMouseDown={handleResizeStart}
               onTouchStart={handleResizeStart}
-              className={`h-2 w-full cursor-row-resize transition-colors flex items-center justify-center group relative ${
+              className={`h-4 w-full cursor-row-resize transition-colors flex items-center justify-center group relative ${
                 isResizing ? "bg-blue-500" : "bg-zinc-800 hover:bg-blue-600"
               }`}
               style={{ touchAction: "none" }}
             >
               <GripHorizontal
-                className={`h-4 w-4 transition-colors pointer-events-none ${
+                className={`h-5 w-5 transition-colors pointer-events-none ${
                   isResizing ? "text-white" : "text-zinc-600 group-hover:text-white"
                 }`}
               />
@@ -736,22 +896,49 @@ export function ScriptTerminalModal({
                 }}
                 variant="outline"
                 size="sm"
-                className="h-8 px-2.5 text-xs bg-zinc-800 hover:bg-zinc-700 border-zinc-700 text-white"
+                className="h-8 px-2.5 text-xs bg-blue-600/20 hover:bg-blue-600/30 border-blue-600/50 text-blue-400"
               >
-                <CornerDownLeft className="h-4 w-4" />
-              </Button>
-              <Button
-                onPointerDown={(e) => {
-                  e.preventDefault()
-                  e.stopPropagation()
-                  sendCommand("\x03")
-                }}
-                variant="outline"
-                size="sm"
-                className="h-8 px-2 text-xs bg-zinc-800 hover:bg-zinc-700 border-zinc-700 text-white min-w-[65px]"
-              >
-                CTRL+C
+                <CornerDownLeft className="h-4 w-4 mr-1" />
+                Enter
               </Button>
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    className="h-8 px-2 text-xs bg-zinc-800 hover:bg-zinc-700 border-zinc-700 text-white min-w-[65px] gap-1"
+                  >
+                    Ctrl
+                    <ChevronDown className="h-3 w-3" />
+                  </Button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end" className="w-56">
+                  <DropdownMenuLabel className="text-xs text-muted-foreground">{t("scriptTerminal.controlSequences")}</DropdownMenuLabel>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuItem onSelect={() => sendCommand("\x03")}>
+                    <span className="font-mono text-xs mr-2">Ctrl+C</span>
+                    <span className="text-muted-foreground text-xs">{t("scriptTerminal.cancelInterrupt")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => sendCommand("\x18")}>
+                    <span className="font-mono text-xs mr-2">Ctrl+X</span>
+                    <span className="text-muted-foreground text-xs">{t("scriptTerminal.exitNano")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => sendCommand("\x12")}>
+                    <span className="font-mono text-xs mr-2">Ctrl+R</span>
+                    <span className="text-muted-foreground text-xs">{t("scriptTerminal.searchHistory")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuLabel className="text-xs text-muted-foreground">{t("scriptTerminal.clipboard")}</DropdownMenuLabel>
+                  <DropdownMenuItem onSelect={() => { void handleCopy() }}>
+                    <Copy className="h-3.5 w-3.5 mr-2" />
+                    <span className="text-xs">{t("scriptTerminal.copySelection")}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => { void handlePaste() }}>
+                    <Clipboard className="h-3.5 w-3.5 mr-2" />
+                    <span className="text-xs">{t("scriptTerminal.paste")}</span>
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
             </div>
           )}
 
@@ -768,27 +955,27 @@ export function ScriptTerminalModal({
                 }`}
                 title={
                   connectionStatus === "online"
-                    ? "Connected"
+                    ? t("scriptTerminal.connected")
                     : connectionStatus === "connecting"
-                      ? "Connecting"
-                      : "Disconnected"
+                      ? t("scriptTerminal.connecting")
+                      : t("scriptTerminal.disconnected")
                 }
               ></div>
               <span className="text-xs text-muted-foreground">
                 {connectionStatus === "online"
-                  ? "Online"
+                  ? t("scriptTerminal.online")
                   : connectionStatus === "connecting"
-                    ? "Connecting..."
-                    : "Offline"}
+                    ? t("scriptTerminal.connectingStatus")
+                    : t("scriptTerminal.offline")}
               </span>
             </div>
 
             <Button
               onClick={handleCloseModal}
               variant="outline"
-              className="bg-red-600 hover:bg-red-700 border-red-500 text-white"
+              className="bg-red-600/20 hover:bg-red-600/30 border-red-600/50 text-red-400"
             >
-              Close
+              {t("actions.close")}
             </Button>
           </div>
         </DialogContent>
@@ -804,12 +991,19 @@ export function ScriptTerminalModal({
           >
             <DialogTitle>{currentInteraction.title}</DialogTitle>
             <div className="space-y-4">
-              <p
-                className="whitespace-pre-wrap"
-                dangerouslySetInnerHTML={{
-                  __html: currentInteraction.message.replace(/\\n/g, "<br/>").replace(/\n/g, "<br/>"),
-                }}
-              />
+              {/*
+                Render the interaction message as plain text. The message
+                comes through the WebSocket from a script running as root —
+                a script bug or compromised author could embed `<script>` or
+                `<img onerror=...>` and run JS in the admin's browser, leaking
+                the JWT and any keys held in React state. `whitespace-pre-wrap`
+                already preserves the `\n` formatting we previously emulated
+                via `<br/>`, so we don't need any HTML conversion. See audit
+                Tier 2 #17b.
+              */}
+              <p className="whitespace-pre-wrap break-words">
+                {currentInteraction.message.replace(/\\n/g, "\n")}
+              </p>
 
               {currentInteraction.type === "yesno" && (
                 <div className="flex gap-2">
@@ -817,14 +1011,14 @@ export function ScriptTerminalModal({
                     onClick={() => handleInteractionResponse("yes")}
                     className="flex-1 bg-blue-600 hover:bg-blue-700 text-white transition-all duration-150"
                   >
-                    Yes
+                    {t("scriptTerminal.yes")}
                   </Button>
                   <Button
                     onClick={() => handleInteractionResponse("cancel")}
                     variant="outline"
                     className="flex-1 hover:bg-red-600 hover:text-white hover:border-red-600 transition-all duration-150"
                   >
-                    Cancel
+                    {t("actions.cancel")}
                   </Button>
                 </div>
               )}
@@ -847,14 +1041,14 @@ export function ScriptTerminalModal({
                     variant="outline"
                     className="w-full hover:bg-red-600 hover:text-white hover:border-red-600 transition-all duration-150"
                   >
-                    Cancel
+                    {t("actions.cancel")}
                   </Button>
                 </div>
               )}
 
               {(currentInteraction.type === "input" || currentInteraction.type === "inputbox") && (
                 <div className="space-y-2">
-                  <Label>Your input:</Label>
+                  <Label>{t("scriptTerminal.yourInput")}</Label>
                   <Input
                     value={interactionInput}
                     onChange={(e) => setInteractionInput(e.target.value)}
@@ -871,14 +1065,14 @@ export function ScriptTerminalModal({
                       onClick={() => handleInteractionResponse(interactionInput)}
                       className="flex-1 bg-blue-600 hover:bg-blue-700 transition-all duration-150"
                     >
-                      Submit
+                      {t("scriptTerminal.submit")}
                     </Button>
                     <Button
                       onClick={() => handleInteractionResponse("cancel")}
                       variant="outline"
                       className="flex-1 hover:bg-red-600 hover:text-white hover:border-red-600 transition-all duration-150"
                     >
-                      Cancel
+                      {t("actions.cancel")}
                     </Button>
                   </div>
                 </div>
@@ -890,14 +1084,14 @@ export function ScriptTerminalModal({
                     onClick={() => handleInteractionResponse("ok")}
                     className="flex-1 bg-blue-600 hover:bg-blue-700 transition-all duration-150"
                   >
-                    OK
+                    {t("scriptTerminal.ok")}
                   </Button>
                   <Button
                     onClick={() => handleInteractionResponse("cancel")}
                     variant="outline"
                     className="flex-1 hover:bg-red-600 hover:text-white hover:border-red-600 transition-all duration-150"
                   >
-                    Cancel
+                    {t("actions.cancel")}
                   </Button>
                 </div>
               )}

AppImage/components/sidebar.tsx

@@ -1,6 +1,7 @@
 "use client"
 
 import { LayoutDashboard, HardDrive, Network, Server, Cpu, FileText, SettingsIcon, Terminal } from "lucide-react"
+import { useT } from "../lib/i18n/provider"
 
 const menuItems = [
   { name: "Overview", href: "/", icon: LayoutDashboard },
@@ -14,6 +15,8 @@ const menuItems = [
 ]
 
 const Sidebar = ({ currentPath, setOpen }) => {
+  const t = useT()
+
   const handleNavigation = (tabName: string) => {
     // Dispatch custom event to change tab in dashboard
     const event = new CustomEvent("changeTab", { detail: { tab: tabName } })
@@ -32,7 +35,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <LayoutDashboard className="h-5 w-5" />
-        <span>Overview</span>
+        <span>{t("navigation.overview")}</span>
       </button>
 
       <button
@@ -44,7 +47,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <HardDrive className="h-5 w-5" />
-        <span>Storage</span>
+        <span>{t("navigation.storage")}</span>
       </button>
 
       <button
@@ -56,7 +59,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <Network className="h-5 w-5" />
-        <span>Network</span>
+        <span>{t("navigation.network")}</span>
       </button>
 
       <button
@@ -68,7 +71,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <Server className="h-5 w-5" />
-        <span>VMs & LXCs</span>
+        <span>{t("navigation.virtualMachines")}</span>
       </button>
 
       <button
@@ -80,7 +83,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <Cpu className="h-5 w-5" />
-        <span>Hardware</span>
+        <span>{t("navigation.hardware")}</span>
       </button>
 
       <button
@@ -92,7 +95,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <FileText className="h-5 w-5" />
-        <span>System Logs</span>
+        <span>{t("navigation.systemLogs")}</span>
       </button>
 
       <button
@@ -104,7 +107,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <Terminal className="h-5 w-5" />
-        <span>Terminal</span>
+        <span>{t("navigation.terminal")}</span>
       </button>
 
       <button
@@ -116,7 +119,7 @@ const Sidebar = ({ currentPath, setOpen }) => {
         }`}
       >
         <SettingsIcon className="h-5 w-5" />
-        <span>Settings</span>
+        <span>{t("navigation.settings")}</span>
       </button>
     </div>
   )

AppImage/components/storage-metrics.tsx

@@ -28,7 +28,6 @@ interface DiskInfo {
 
 const fetchStorageData = async (): Promise<StorageData | null> => {
   try {
-    console.log("[v0] Fetching storage data from Flask server...")
     const response = await fetch("/api/storage", {
       method: "GET",
       headers: {
@@ -42,10 +41,9 @@ const fetchStorageData = async (): Promise<StorageData | null> => {
     }
 
     const data = await response.json()
-    console.log("[v0] Successfully fetched storage data from Flask:", data)
     return data
   } catch (error) {
-    console.error("[v0] Failed to fetch storage data from Flask server:", error)
+    console.error("Failed to fetch storage data from Flask server:", error)
     return null
   }
 }
@@ -110,7 +108,7 @@ export function StorageMetrics() {
   return (
     <div className="space-y-6">
       {/* Storage Overview Cards */}
-      <div className="grid grid-cols-2 lg:grid-cols-4 gap-3 lg:gap-6">
+      <div className="grid grid-cols-2 xl:grid-cols-4 gap-3 xl:gap-6">
         <Card className="bg-card border-border">
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">Total Storage</CardTitle>

AppImage/components/system-overview.tsx

@@ -4,19 +4,33 @@ import { useState, useEffect } from "react"
 import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
 import { Progress } from "./ui/progress"
 import { Badge } from "./ui/badge"
-import { Cpu, MemoryStick, Thermometer, Server, Zap, AlertCircle, HardDrive, Network } from "lucide-react"
+import { Cpu, MemoryStick, Thermometer, Server, Zap, AlertCircle, HardDrive, Network, ChevronRight } from "lucide-react"
 import { NodeMetricsCharts } from "./node-metrics-charts"
 import { NetworkTrafficChart } from "./network-traffic-chart"
+import { TemperatureDetailModal } from "./temperature-detail-modal"
+import { ProcessDetailModal } from "./process-detail-modal"
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
 import { fetchApi } from "../lib/api-config"
 import { formatNetworkTraffic, getNetworkUnit } from "../lib/format-network"
+import { formatStorage } from "../lib/utils"
+import { useT } from "../lib/i18n/provider"
+import { Area, AreaChart, ResponsiveContainer } from "recharts"
+
+interface TempDataPoint {
+  timestamp: number
+  value: number
+}
 
 interface SystemData {
   cpu_usage: number
+  cpu_user?: number  // preview restyle
+  cpu_system?: number  // preview restyle
   memory_usage: number
   memory_total: number
   memory_used: number
+  memory_cached?: number  // preview restyle
   temperature: number
+  temperature_sparkline?: TempDataPoint[]
   uptime: string
   load_average: number[]
   hostname: string
@@ -102,9 +116,9 @@ const fetchSystemData = async (retries = 3, delayMs = 500): Promise<SystemData |
     try {
       const data = await fetchApi<SystemData>("/api/system")
       return data
-    } catch (error) {
+    } catch {
       if (attempt === retries - 1) {
-        console.error("[v0] Failed to fetch system data after retries:", error)
+        // Silent fail - API not available (expected in preview environment)
         return null
       }
       // Wait before retry
@@ -118,8 +132,8 @@ const fetchVMData = async (): Promise<VMData[]> => {
   try {
     const data = await fetchApi<any>("/api/vms")
     return Array.isArray(data) ? data : data.vms || []
-  } catch (error) {
-    console.error("[v0] Failed to fetch VM data:", error)
+  } catch {
+    // Silent fail - API not available
     return []
   }
 }
@@ -128,8 +142,7 @@ const fetchStorageData = async (): Promise<StorageData | null> => {
   try {
     const data = await fetchApi<StorageData>("/api/storage/summary")
     return data
-  } catch (error) {
-    console.log("[v0] Storage API not available (this is normal if not configured)")
+  } catch {
     return null
   }
 }
@@ -138,18 +151,16 @@ const fetchNetworkData = async (): Promise<NetworkData | null> => {
   try {
     const data = await fetchApi<NetworkData>("/api/network/summary")
     return data
-  } catch (error) {
-    console.log("[v0] Network API not available (this is normal if not configured)")
+  } catch {
     return null
   }
 }
 
-const fetchProxmoxStorageData = async (): Promise<ProxmoxStorageData | null> => {
+const fetchProxmoxStorageData = async (): Promise<ProxmoxStorage[] | null> => {
   try {
-    const data = await fetchApi<ProxmoxStorageData>("/api/proxmox-storage")
+    const data = await fetchApi<ProxmoxStorage[]>("/api/proxmox-storage")
     return data
-  } catch (error) {
-    console.log("[v0] Proxmox storage API not available")
+  } catch {
     return null
   }
 }
@@ -161,6 +172,7 @@ const getUnitsSettings = (): "Bytes" | "Bits" => {
 }
 
 export function SystemOverview() {
+  const t = useT()
   const [systemData, setSystemData] = useState<SystemData | null>(null)
   const [vmData, setVmData] = useState<VMData[]>([])
   const [storageData, setStorageData] = useState<StorageData | null>(null)
@@ -177,6 +189,9 @@ export function SystemOverview() {
   const [networkTimeframe, setNetworkTimeframe] = useState("day")
   const [networkTotals, setNetworkTotals] = useState<{ received: number; sent: number }>({ received: 0, sent: 0 })
   const [networkUnit, setNetworkUnit] = useState<"Bytes" | "Bits">("Bytes") // Added networkUnit state
+  const [tempModalOpen, setTempModalOpen] = useState(false)
+  const [cpuProcModalOpen, setCpuProcModalOpen] = useState(false)
+  const [memProcModalOpen, setMemProcModalOpen] = useState(false)
 
   useEffect(() => {
     const fetchAllData = async () => {
@@ -192,7 +207,7 @@ export function SystemOverview() {
       setHasAttemptedLoad(true)
 
       if (!systemResult) {
-        setError("Flask server not available. Please ensure the server is running.")
+        setError(t("overview.errors.serverUnavailableDescription"))
         return
       }
 
@@ -215,7 +230,7 @@ export function SystemOverview() {
     const systemInterval = setInterval(async () => {
       const data = await fetchSystemData()
       if (data) setSystemData(data)
-    }, 9000)
+    }, 5000)
 
     const vmInterval = setInterval(async () => {
       const data = await fetchVMData()
@@ -248,23 +263,17 @@ export function SystemOverview() {
       clearInterval(networkInterval)
       window.removeEventListener("networkUnitChanged" as any, handleUnitChange)
     }
-  }, [])
+  }, [t])
 
   if (!hasAttemptedLoad || loadingStates.system) {
     return (
-      <div className="space-y-6">
-        <div className="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-4 gap-6">
-          {[...Array(4)].map((_, i) => (
-            <Card key={i} className="bg-card border-border animate-pulse">
-              <CardContent className="p-6">
-                <div className="h-4 bg-muted rounded w-1/2 mb-4"></div>
-                <div className="h-8 bg-muted rounded w-3/4 mb-2"></div>
-                <div className="h-2 bg-muted rounded w-full mb-2"></div>
-                <div className="h-3 bg-muted rounded w-2/3"></div>
-              </CardContent>
-            </Card>
-          ))}
+      <div className="flex flex-col items-center justify-center min-h-[400px] gap-4">
+        <div className="relative">
+          <div className="h-12 w-12 rounded-full border-2 border-muted"></div>
+          <div className="absolute inset-0 h-12 w-12 rounded-full border-2 border-transparent border-t-primary animate-spin"></div>
         </div>
+        <div className="text-sm font-medium text-foreground">{t("overview.loadingTitle")}</div>
+        <p className="text-xs text-muted-foreground">{t("overview.loadingDescription")}</p>
       </div>
     )
   }
@@ -277,9 +286,9 @@ export function SystemOverview() {
             <div className="flex items-center gap-3 text-red-600">
               <AlertCircle className="h-6 w-6" />
               <div>
-                <div className="font-semibold text-lg mb-1">Flask Server Not Available</div>
+                <div className="font-semibold text-lg mb-1">{t("overview.errors.serverUnavailableTitle")}</div>
                 <div className="text-sm">
-                  {error || "Unable to connect to the Flask server. Please ensure the server is running and try again."}
+                  {error || t("overview.errors.serverUnavailableDescription")}
                 </div>
               </div>
             </div>
@@ -298,14 +307,14 @@ export function SystemOverview() {
   }
 
   const getTemperatureStatus = (temp: number) => {
-    if (temp === 0) return { status: "N/A", color: "bg-gray-500/10 text-gray-500 border-gray-500/20" }
-    if (temp < 60) return { status: "Normal", color: "bg-green-500/10 text-green-500 border-green-500/20" }
-    if (temp < 75) return { status: "Warm", color: "bg-yellow-500/10 text-yellow-500 border-yellow-500/20" }
-    return { status: "Hot", color: "bg-red-500/10 text-red-500 border-red-500/20" }
+    if (temp === 0) return { status: t("app.notAvailable"), color: "bg-gray-500/10 text-gray-500 border-gray-500/20" }
+    if (temp < 60) return { status: t("status.normal"), color: "bg-green-500/10 text-green-500 border-green-500/20" }
+    if (temp < 75) return { status: t("status.warm"), color: "bg-yellow-500/10 text-yellow-500 border-yellow-500/20" }
+    return { status: t("status.hot"), color: "bg-red-500/10 text-red-500 border-red-500/20" }
   }
 
   const formatUptime = (seconds: number) => {
-    if (!seconds || seconds === 0) return "Stopped"
+    if (!seconds || seconds === 0) return t("status.stopped")
     const days = Math.floor(seconds / 86400)
     const hours = Math.floor((seconds % 86400) / 3600)
     const minutes = Math.floor((seconds % 3600) / 60)
@@ -315,6 +324,19 @@ export function SystemOverview() {
     return `${minutes}m`
   }
 
+  const formatSystemUptime = (uptime: string) => {
+    const trimmed = uptime?.trim()
+    if (!trimmed) return t("app.unknown")
+
+    const dayMatch = trimmed.match(/^(\d+)\s+days?,\s*(.+)$/)
+    if (!dayMatch) return trimmed
+
+    const days = Number(dayMatch[1])
+    const dayKey = days === 1 ? "dayOne" : days >= 2 && days <= 4 ? "dayFew" : "dayMany"
+
+    return `${t(`overview.uptimeDuration.${dayKey}`, { count: days })}, ${dayMatch[2]}`
+  }
+
   const formatBytes = (bytes: number) => {
     return (bytes / 1024 ** 3).toFixed(2)
   }
@@ -339,40 +361,14 @@ export function SystemOverview() {
 
   const getLoadStatus = (load: number, cores: number) => {
     if (load < cores) {
-      return { status: "Normal", color: "bg-green-500/10 text-green-500 border-green-500/20" }
+      return { status: t("status.normal"), color: "bg-green-500/10 text-green-500 border-green-500/20" }
     } else if (load < cores * 1.5) {
-      return { status: "Moderate", color: "bg-yellow-500/10 text-yellow-500 border-yellow-500/20" }
+      return { status: t("status.moderate"), color: "bg-yellow-500/10 text-yellow-500 border-yellow-500/20" }
     } else {
-      return { status: "High", color: "bg-red-500/10 text-red-500 border-red-500/20" }
+      return { status: t("status.high"), color: "bg-red-500/10 text-red-500 border-red-500/20" }
     }
   }
 
-  const systemAlerts = []
-  if (systemData.available_updates && systemData.available_updates > 0) {
-    systemAlerts.push({
-      type: "warning",
-      message: `${systemData.available_updates} updates available`,
-    })
-  }
-  if (vmStats.stopped > 0) {
-    systemAlerts.push({
-      type: "info",
-      message: `${vmStats.stopped} VM${vmStats.stopped > 1 ? "s" : ""} stopped`,
-    })
-  }
-  if (systemData.temperature > 75) {
-    systemAlerts.push({
-      type: "warning",
-      message: "High temperature detected",
-    })
-  }
-  if (localStorage && localStorage.percent > 90) {
-    systemAlerts.push({
-      type: "warning",
-      message: "System storage almost full",
-    })
-  }
-
   const loadStatus = getLoadStatus(systemData.load_average[0], systemData.cpu_cores || 8)
 
   const getTimeframeLabel = (timeframe: string): string => {
@@ -394,90 +390,217 @@ export function SystemOverview() {
 
   return (
     <div className="space-y-6">
-      <div className="grid grid-cols-2 lg:grid-cols-4 gap-3 lg:gap-6">
-        <Card className="bg-card border-border">
+      <div className="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-4 gap-3 xl:gap-6">
+        {/* ── CPU Usage (preview restyle v2: tamaño igual a System Info, bars más anchas) ── */}
+        <Card
+          className="bg-card border-border cursor-pointer hover:bg-white/5 transition-colors"
+          onClick={() => setCpuProcModalOpen(true)}
+          title={t("overview.topProcessesCpu")}
+        >
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
-            <CardTitle className="text-sm font-medium text-muted-foreground">CPU Usage</CardTitle>
-            <Cpu className="h-4 w-4 text-muted-foreground" />
+            <CardTitle className="text-sm font-medium text-muted-foreground">{t("overview.cpuUsage")}</CardTitle>
+            <div className="flex items-center gap-1 text-muted-foreground">
+              <Cpu className="h-4 w-4" />
+              <ChevronRight className="h-4 w-4 opacity-60" />
+            </div>
           </CardHeader>
           <CardContent>
-            <div className="text-xl lg:text-2xl font-bold text-foreground">{systemData.cpu_usage}%</div>
-            <Progress value={systemData.cpu_usage} className="mt-2 [&>div]:bg-blue-500" />
-            <p className="text-xs text-muted-foreground mt-2">Real-time usage</p>
+            <div className="flex items-center gap-4">
+              <svg viewBox="0 0 36 36" className="w-[72px] h-[72px] flex-shrink-0">
+                <circle cx="18" cy="18" r="15.9155" fill="none" stroke="rgba(99,102,241,0.15)" strokeWidth="3"/>
+                <circle cx="18" cy="18" r="15.9155" fill="none" stroke="#3b82f6" strokeWidth="3"
+                        strokeDasharray={`${systemData.cpu_usage} 100`} strokeLinecap="round"
+                        style={{ transform: 'rotate(-90deg)', transformOrigin: '50% 50%' }}/>
+                <text x="18" y="19.5" textAnchor="middle" fontSize="10" fontWeight="700" fill="currentColor">{Math.round(systemData.cpu_usage)}%</text>
+              </svg>
+              <div className="flex-1 space-y-2 min-w-0">
+                <div>
+                  <div className="flex items-center justify-between text-sm">
+                  <span className="text-muted-foreground">{t("overview.user")}</span>
+                  <span className="font-medium font-mono whitespace-nowrap">{systemData.cpu_user !== undefined ? `${Math.round(systemData.cpu_user)}%` : '—'}</span>
+                  </div>
+                  <div className="mt-1 h-1.5 bg-muted rounded-full overflow-hidden">
+                    <div className="h-full bg-blue-500 rounded-full" style={{ width: `${systemData.cpu_user ?? 0}%` }}/>
+                  </div>
+                </div>
+                <div>
+                  <div className="flex items-center justify-between text-sm">
+                  <span className="text-muted-foreground">{t("overview.system")}</span>
+                  <span className="font-medium font-mono whitespace-nowrap">{systemData.cpu_system !== undefined ? `${Math.round(systemData.cpu_system)}%` : '—'}</span>
+                  </div>
+                  <div className="mt-1 h-1.5 bg-muted rounded-full overflow-hidden">
+                    <div className="h-full rounded-full" style={{ width: `${systemData.cpu_system ?? 0}%`, background: 'rgba(99,102,241,0.55)' }}/>
+                  </div>
+                </div>
+                <div className="flex items-center justify-between text-sm">
+                  <span className="text-muted-foreground">{t("overview.cores")}</span>
+                  <span className="font-medium font-mono whitespace-nowrap">{systemData.cpu_cores ?? '—'}{systemData.cpu_threads ? `/${systemData.cpu_threads}` : ''}</span>
+                </div>
+              </div>
+            </div>
           </CardContent>
         </Card>
 
-        <Card className="bg-card border-border">
+        {/* ── Memory (preview restyle v2: tamaño igual a System Info, bars más anchas) ── */}
+        <Card
+          className="bg-card border-border cursor-pointer hover:bg-white/5 transition-colors"
+          onClick={() => setMemProcModalOpen(true)}
+          title={t("overview.topProcessesMemory")}
+        >
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
-            <CardTitle className="text-sm font-medium text-muted-foreground">Memory Usage</CardTitle>
-            <MemoryStick className="h-4 w-4 text-muted-foreground" />
+            <CardTitle className="text-sm font-medium text-muted-foreground">{t("overview.memory")}</CardTitle>
+            <div className="flex items-center gap-1 text-muted-foreground">
+              <MemoryStick className="h-4 w-4" />
+              <ChevronRight className="h-4 w-4 opacity-60" />
+            </div>
           </CardHeader>
           <CardContent>
-            <div className="text-xl lg:text-2xl font-bold text-foreground">{systemData.memory_used.toFixed(1)} GB</div>
-            <Progress value={systemData.memory_usage} className="mt-2 [&>div]:bg-blue-500" />
-            <p className="text-xs text-muted-foreground mt-2">
-              <span className="text-green-500 font-medium">{systemData.memory_usage.toFixed(1)}%</span> of{" "}
-              {systemData.memory_total} GB
-            </p>
+            <div className="flex items-center gap-4">
+              <svg viewBox="0 0 36 36" className="w-[72px] h-[72px] flex-shrink-0">
+                <circle cx="18" cy="18" r="15.9155" fill="none" stroke="rgba(99,102,241,0.15)" strokeWidth="3"/>
+                <circle cx="18" cy="18" r="15.9155" fill="none" stroke="#3b82f6" strokeWidth="3"
+                        strokeDasharray={`${systemData.memory_usage} 100`} strokeLinecap="round"
+                        style={{ transform: 'rotate(-90deg)', transformOrigin: '50% 50%' }}/>
+                <text x="18" y="19.5" textAnchor="middle" fontSize="10" fontWeight="700" fill="currentColor">{Math.round(systemData.memory_usage)}%</text>
+              </svg>
+              <div className="flex-1 space-y-2 min-w-0">
+                <div>
+                  <div className="flex items-center justify-between text-sm">
+                  <span className="text-muted-foreground">{t("overview.used")}</span>
+                  <span className="font-medium font-mono whitespace-nowrap">{systemData.memory_used.toFixed(1)}</span>
+                  </div>
+                  <div className="mt-1 h-1.5 bg-muted rounded-full overflow-hidden">
+                    <div className="h-full bg-blue-500 rounded-full" style={{ width: `${systemData.memory_usage}%` }}/>
+                  </div>
+                </div>
+                <div>
+                  <div className="flex items-center justify-between text-sm">
+                  <span className="text-muted-foreground">{t("overview.cached")}</span>
+                  <span className="font-medium font-mono whitespace-nowrap">{systemData.memory_cached !== undefined ? systemData.memory_cached.toFixed(1) : '—'}</span>
+                  </div>
+                  <div className="mt-1 h-1.5 bg-muted rounded-full overflow-hidden">
+                    <div className="h-full rounded-full" style={{ width: `${systemData.memory_cached !== undefined && systemData.memory_total > 0 ? (systemData.memory_cached / systemData.memory_total) * 100 : 0}%`, background: 'rgba(99,102,241,0.55)' }}/>
+                  </div>
+                </div>
+                <div className="flex items-center justify-between text-sm">
+                  <span className="text-muted-foreground">{t("overview.total")}</span>
+                  <span className="font-medium font-mono whitespace-nowrap">{systemData.memory_total.toFixed(0)} GB</span>
+                </div>
+              </div>
+            </div>
           </CardContent>
         </Card>
 
+        {/* ── Active VM & LXC (preview restyle v2: pills mismo tamaño que "X running") ── */}
         <Card className="bg-card border-border">
-          <CardHeader>
-            <CardTitle className="text-foreground flex items-center">
-              <Server className="h-5 w-5 mr-2" />
-              Active VM & LXC
-            </CardTitle>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+            <CardTitle className="text-sm font-medium text-muted-foreground">{t("overview.activeVmLxc")}</CardTitle>
+            <Server className="h-4 w-4 text-muted-foreground" />
           </CardHeader>
           <CardContent>
             {loadingStates.vms ? (
               <div className="space-y-2 animate-pulse">
-                <div className="h-8 bg-muted rounded w-12"></div>
-                <div className="h-5 bg-muted rounded w-24"></div>
-                <div className="h-4 bg-muted rounded w-32"></div>
+                <div className="h-10 bg-muted rounded w-20"></div>
+                <div className="h-5 bg-muted rounded w-32"></div>
               </div>
             ) : (
               <>
-                <div className="text-xl lg:text-2xl font-bold text-foreground">{vmStats.running}</div>
-                <div className="mt-2 flex flex-wrap gap-1">
+                <div className="flex items-end justify-between">
+                  <div>
+                    <span className="text-4xl font-bold leading-none text-foreground">{vmStats.running}</span>
+                    <span className="text-lg font-medium ml-1 text-muted-foreground">/ {vmStats.vms + vmStats.lxc}</span>
+                  </div>
                   <Badge variant="outline" className="bg-green-500/10 text-green-500 border-green-500/20">
-                    {vmStats.running} Running
+                    {t("overview.runningCount", { count: vmStats.running })}
                   </Badge>
+                </div>
+                <div className="mt-3 flex gap-1 flex-wrap">
+                  <Badge variant="outline" className="bg-green-500/10 text-green-500 border-green-500/20">
+                    {t("overview.vmsCount", { count: vmStats.vms })}
+                  </Badge>
+                  <Badge variant="outline" className="bg-blue-500/10 text-blue-500 border-blue-500/20">{vmStats.lxc} LXC</Badge>
                   {vmStats.stopped > 0 && (
-                    <Badge variant="outline" className="bg-red-500/10 text-red-500 border-red-500/20">
-                      {vmStats.stopped} Stopped
+                    <Badge variant="outline" className="bg-muted text-muted-foreground border-border">
+                      {t("overview.stoppedCount", { count: vmStats.stopped })}
                     </Badge>
                   )}
                 </div>
-                <p className="text-xs text-muted-foreground mt-2">
-                  Total: {vmStats.vms} VMs, {vmStats.lxc} LXC
-                </p>
               </>
             )}
           </CardContent>
         </Card>
 
-        <Card className="bg-card border-border">
+        <Card 
+          className={`bg-card border-border ${systemData.temperature > 0 ? "cursor-pointer hover:bg-white/5 transition-colors" : ""}`}
+          onClick={() => systemData.temperature > 0 && setTempModalOpen(true)}
+        >
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
-            <CardTitle className="text-sm font-medium text-muted-foreground">Temperature</CardTitle>
-            <Thermometer className="h-4 w-4 text-muted-foreground" />
+            <CardTitle className="text-sm font-medium text-muted-foreground">{t("overview.temperature")}</CardTitle>
+            <div className="flex items-center gap-1 text-muted-foreground">
+              <Thermometer className="h-4 w-4" />
+              {systemData.temperature > 0 && (
+                <ChevronRight className="h-4 w-4 opacity-60" />
+              )}
+            </div>
           </CardHeader>
           <CardContent>
-            <div className="text-xl lg:text-2xl font-bold text-foreground">
-              {systemData.temperature === 0 ? "N/A" : `${systemData.temperature}°C`}
-            </div>
-            <div className="flex items-center mt-2">
-              <Badge variant="outline" className={tempStatus.color}>
+            <div className="flex items-center justify-between">
+              <span className="text-xl lg:text-2xl font-bold text-foreground">
+                {systemData.temperature === 0 ? t("app.notAvailable") : `${Math.round(systemData.temperature * 10) / 10}°C`}
+              </span>
+              <Badge variant="outline" className={`${tempStatus.color}`}>
                 {tempStatus.status}
               </Badge>
             </div>
-            <p className="text-xs text-muted-foreground mt-2">
-              {systemData.temperature === 0 ? "No sensor available" : "Live temperature reading"}
-            </p>
+            {systemData.temperature > 0 && systemData.temperature_sparkline && systemData.temperature_sparkline.length > 1 ? (
+              <div className="mt-2 h-10">
+                <ResponsiveContainer width="100%" height="100%">
+                  <AreaChart data={systemData.temperature_sparkline} margin={{ top: 0, right: 0, left: 0, bottom: 0 }}>
+                    <defs>
+                      <linearGradient id="tempSparkGradient" x1="0" y1="0" x2="0" y2="1">
+                        <stop offset="0%" stopColor={systemData.temperature >= 75 ? "#ef4444" : systemData.temperature >= 60 ? "#f59e0b" : "#22c55e"} stopOpacity={0.3} />
+                        <stop offset="100%" stopColor={systemData.temperature >= 75 ? "#ef4444" : systemData.temperature >= 60 ? "#f59e0b" : "#22c55e"} stopOpacity={0} />
+                      </linearGradient>
+                    </defs>
+                    <Area
+                      type="monotone"
+                      dataKey="value"
+                      stroke={systemData.temperature >= 75 ? "#ef4444" : systemData.temperature >= 60 ? "#f59e0b" : "#22c55e"}
+                      strokeWidth={1.5}
+                      fill="url(#tempSparkGradient)"
+                      dot={false}
+                      isAnimationActive={false}
+                    />
+                  </AreaChart>
+                </ResponsiveContainer>
+              </div>
+            ) : (
+              <p className="text-xs text-muted-foreground mt-2">
+                {systemData.temperature === 0 ? t("overview.noSensorAvailable") : t("overview.collectingData")}
+              </p>
+            )}
           </CardContent>
         </Card>
       </div>
 
+      <TemperatureDetailModal
+        open={tempModalOpen}
+        onOpenChange={setTempModalOpen}
+        liveTemperature={systemData.temperature}
+      />
+
+      <ProcessDetailModal
+        open={cpuProcModalOpen}
+        onOpenChange={setCpuProcModalOpen}
+        sort="cpu"
+      />
+
+      <ProcessDetailModal
+        open={memProcModalOpen}
+        onOpenChange={setMemProcModalOpen}
+        sort="mem"
+      />
+
       <NodeMetricsCharts />
 
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
@@ -485,7 +608,7 @@ export function SystemOverview() {
           <CardHeader>
             <CardTitle className="text-foreground flex items-center">
               <HardDrive className="h-5 w-5 mr-2" />
-              Storage Overview
+              {t("overview.storageOverview")}
             </CardTitle>
           </CardHeader>
           <CardContent>
@@ -506,9 +629,9 @@ export function SystemOverview() {
                   return totalCapacity > 0 ? (
                     <div className="space-y-2 pb-4 border-b-2 border-border">
                       <div className="flex justify-between items-center">
-                        <span className="text-sm font-medium text-foreground">Total Node Capacity:</span>
+                        <span className="text-sm font-medium text-foreground">{t("overview.totalNodeCapacity")}</span>
                         <span className="text-lg font-bold text-foreground">
-                          {formatNetworkTraffic(totalCapacity, "Bytes")}
+                          {formatStorage(totalCapacity)}
                         </span>
                       </div>
                       <Progress
@@ -518,15 +641,15 @@ export function SystemOverview() {
                       <div className="flex justify-between items-center mt-1">
                         <div className="flex items-center gap-3">
                           <span className="text-xs text-muted-foreground">
-                            Used:{" "}
+                            {t("overview.used")}:{" "}
                             <span className="font-semibold text-foreground">
-                              {formatNetworkTraffic(totalUsed, "Bytes")}
+                              {formatStorage(totalUsed)}
                             </span>
                           </span>
                           <span className="text-xs text-muted-foreground">
-                            Free:{" "}
+                            {t("overview.free")}:{" "}
                             <span className="font-semibold text-green-500">
-                              {formatNetworkTraffic(totalAvailable, "Bytes")}
+                              {formatStorage(totalAvailable)}
                             </span>
                           </span>
                         </div>
@@ -538,73 +661,73 @@ export function SystemOverview() {
 
                 <div className="space-y-2 pb-3 border-b border-border">
                   <div className="flex justify-between items-center">
-                    <span className="text-sm text-muted-foreground">Total Capacity:</span>
+                    <span className="text-sm text-muted-foreground">{t("overview.totalCapacity")}</span>
                     <span className="text-lg font-semibold text-foreground">{storageData.total} TB</span>
                   </div>
                   <div className="flex justify-between items-center">
-                    <span className="text-sm text-muted-foreground">Physical Disks:</span>
+                    <span className="text-sm text-muted-foreground">{t("overview.physicalDisks")}</span>
                     <span className="text-sm font-semibold text-foreground">
-                      {storageData.disk_count} disk{storageData.disk_count !== 1 ? "s" : ""}
+                      {storageData.disk_count} {storageData.disk_count === 1 ? t("overview.diskSingular") : t("overview.diskPlural")}
                     </span>
                   </div>
                 </div>
 
                 {vmLxcStorages && vmLxcStorages.length > 0 ? (
                   <div className="space-y-2 pb-3 border-b border-border">
-                    <div className="text-xs font-medium text-muted-foreground mb-2">VM/LXC Storage</div>
+                    <div className="text-xs font-medium text-muted-foreground mb-2">{t("overview.vmLxcStorage")}</div>
                     <div className="flex justify-between items-center">
-                      <span className="text-xs text-muted-foreground">Used:</span>
+                      <span className="text-xs text-muted-foreground">{t("overview.used")}:</span>
                       <span className="text-sm font-semibold text-foreground">
-                        {formatNetworkTraffic(vmLxcStorageUsed, "Bytes")}
+                        {formatStorage(vmLxcStorageUsed)}
                       </span>
                     </div>
                     <div className="flex justify-between items-center">
-                      <span className="text-xs text-muted-foreground">Available:</span>
+                      <span className="text-xs text-muted-foreground">{t("overview.available")}:</span>
                       <span className="text-sm font-semibold text-green-500">
-                        {formatNetworkTraffic(vmLxcStorageAvailable, "Bytes")}
+                        {formatStorage(vmLxcStorageAvailable)}
                       </span>
                     </div>
                     <Progress value={vmLxcStoragePercent} className="mt-2 [&>div]:bg-blue-500" />
                     <div className="flex justify-between items-center mt-1">
                       <span className="text-xs text-muted-foreground">
-                        {formatNetworkTraffic(vmLxcStorageUsed, "Bytes")} /{" "}
-                        {formatNetworkTraffic(vmLxcStorageTotal, "Bytes")}
+                        {formatStorage(vmLxcStorageUsed)} /{" "}
+                        {formatStorage(vmLxcStorageTotal)}
                       </span>
                       <span className="text-xs text-muted-foreground">{vmLxcStoragePercent.toFixed(1)}%</span>
                     </div>
                     {vmLxcStorages.length > 1 && (
                       <div className="text-xs text-muted-foreground mt-1">
-                        {vmLxcStorages.length} storage volume{vmLxcStorages.length > 1 ? "s" : ""}
+                        {vmLxcStorages.length} {vmLxcStorages.length === 1 ? t("overview.storageVolumeSingular") : t("overview.storageVolumePlural")}
                       </div>
                     )}
                   </div>
                 ) : (
                   <div className="space-y-2 pb-3 border-b border-border">
-                    <div className="text-xs font-medium text-muted-foreground mb-2">VM/LXC Storage</div>
-                    <div className="text-center py-4 text-muted-foreground text-sm">No VM/LXC storage configured</div>
+                    <div className="text-xs font-medium text-muted-foreground mb-2">{t("overview.vmLxcStorage")}</div>
+                    <div className="text-center py-4 text-muted-foreground text-sm">{t("overview.noVmLxcStorage")}</div>
                   </div>
                 )}
 
                 {localStorage && (
                   <div className="space-y-2">
-                    <div className="text-xs font-medium text-muted-foreground mb-2">Local Storage (System)</div>
+                    <div className="text-xs font-medium text-muted-foreground mb-2">{t("overview.localStorageSystem")}</div>
                     <div className="flex justify-between items-center">
-                      <span className="text-xs text-muted-foreground">Used:</span>
+                      <span className="text-xs text-muted-foreground">{t("overview.used")}:</span>
                       <span className="text-sm font-semibold text-foreground">
-                        {formatNetworkTraffic(localStorage.used, "Bytes")}
+                        {formatStorage(localStorage.used)}
                       </span>
                     </div>
                     <div className="flex justify-between items-center">
-                      <span className="text-xs text-muted-foreground">Available:</span>
+                      <span className="text-xs text-muted-foreground">{t("overview.available")}:</span>
                       <span className="text-sm font-semibold text-green-500">
-                        {formatNetworkTraffic(localStorage.available, "Bytes")}
+                        {formatStorage(localStorage.available)}
                       </span>
                     </div>
                     <Progress value={localStorage.percent} className="mt-2 [&>div]:bg-purple-500" />
                     <div className="flex justify-between items-center mt-1">
                       <span className="text-xs text-muted-foreground">
-                        {formatNetworkTraffic(localStorage.used, "Bytes")} /{" "}
-                        {formatNetworkTraffic(localStorage.total, "Bytes")}
+                        {formatStorage(localStorage.used)} /{" "}
+                        {formatStorage(localStorage.total)}
                       </span>
                       <span className="text-xs text-muted-foreground">{localStorage.percent.toFixed(1)}%</span>
                     </div>
@@ -612,7 +735,7 @@ export function SystemOverview() {
                 )}
               </div>
             ) : (
-              <div className="text-center py-8 text-muted-foreground">Storage data not available</div>
+              <div className="text-center py-8 text-muted-foreground">{t("overview.storageDataUnavailable")}</div>
             )}
           </CardContent>
         </Card>
@@ -622,18 +745,18 @@ export function SystemOverview() {
             <CardTitle className="text-foreground flex items-center justify-between">
               <div className="flex items-center">
                 <Network className="h-5 w-5 mr-2" />
-                Network Overview
+                {t("overview.networkOverview")}
               </div>
               <Select value={networkTimeframe} onValueChange={setNetworkTimeframe}>
                 <SelectTrigger className="w-28 h-8 text-xs">
                   <SelectValue />
                 </SelectTrigger>
                 <SelectContent>
-                  <SelectItem value="hour">1 Hour</SelectItem>
-                  <SelectItem value="day">24 Hours</SelectItem>
-                  <SelectItem value="week">7 Days</SelectItem>
-                  <SelectItem value="month">30 Days</SelectItem>
-                  <SelectItem value="year">1 Year</SelectItem>
+                  <SelectItem value="hour">{t("overview.timeframes.hour")}</SelectItem>
+                  <SelectItem value="day">{t("overview.timeframes.day")}</SelectItem>
+                  <SelectItem value="week">{t("overview.timeframes.week")}</SelectItem>
+                  <SelectItem value="month">{t("overview.timeframes.month")}</SelectItem>
+                  <SelectItem value="year">{t("overview.timeframes.year")}</SelectItem>
                 </SelectContent>
               </Select>
             </CardTitle>
@@ -648,7 +771,7 @@ export function SystemOverview() {
             ) : networkData ? (
               <div className="space-y-4">
                 <div className="flex justify-between items-center pb-3 border-b border-border">
-                  <span className="text-sm text-muted-foreground">Active Interfaces:</span>
+                  <span className="text-sm text-muted-foreground">{t("overview.activeInterfaces")}</span>
                   <span className="text-lg font-semibold text-foreground">
                     {(networkData.physical_active_count || 0) + (networkData.bridge_active_count || 0)}
                   </span>
@@ -690,7 +813,7 @@ export function SystemOverview() {
 
                 <div className="pt-2 border-t border-border space-y-2">
                   <div className="flex justify-between items-center">
-                    <span className="text-sm text-muted-foreground">Received:</span>
+                    <span className="text-sm text-muted-foreground">{t("overview.received")}</span>
                     <span className="text-lg font-semibold text-green-500 flex items-center gap-1">
                       ↓{" "}
                       {networkUnit === "Bytes"
@@ -700,7 +823,7 @@ export function SystemOverview() {
                     </span>
                   </div>
                   <div className="flex justify-between items-center">
-                    <span className="text-sm text-muted-foreground">Sent:</span>
+                    <span className="text-sm text-muted-foreground">{t("overview.sent")}</span>
                     <span className="text-lg font-semibold text-blue-500 flex items-center gap-1">
                       ↑{" "}
                       {networkUnit === "Bytes"
@@ -720,7 +843,7 @@ export function SystemOverview() {
                 </div>
               </div>
             ) : (
-              <div className="text-center py-8 text-muted-foreground">Network data not available</div>
+              <div className="text-center py-8 text-muted-foreground">{t("overview.networkDataUnavailable")}</div>
             )}
           </CardContent>
         </Card>
@@ -731,27 +854,27 @@ export function SystemOverview() {
           <CardHeader>
             <CardTitle className="text-foreground flex items-center">
               <Server className="h-5 w-5 mr-2" />
-              System Information
+              {t("overview.systemInformation")}
             </CardTitle>
           </CardHeader>
           <CardContent className="space-y-3">
             <div className="flex justify-between">
-              <span className="text-muted-foreground">Uptime:</span>
-              <span className="text-foreground">{systemData.uptime}</span>
+              <span className="text-muted-foreground">{t("overview.uptime")}</span>
+              <span className="text-foreground">{formatSystemUptime(systemData.uptime)}</span>
             </div>
             <div className="flex justify-between">
-              <span className="text-muted-foreground">Proxmox Version:</span>
+              <span className="text-muted-foreground">{t("overview.proxmoxVersion")}</span>
               <span className="text-foreground">{systemData.proxmox_version || "N/A"}</span>
             </div>
             <div className="flex justify-between">
-              <span className="text-muted-foreground">Kernel:</span>
+              <span className="text-muted-foreground">{t("overview.kernel")}</span>
               <span className="text-foreground font-mono text-sm">{systemData.kernel_version || "Linux"}</span>
             </div>
             {systemData.available_updates !== undefined && systemData.available_updates > 0 && (
               <div className="flex justify-between">
-                <span className="text-muted-foreground">Available Updates:</span>
+                <span className="text-muted-foreground">{t("overview.availableUpdates")}</span>
                 <Badge variant="outline" className="bg-yellow-500/10 text-yellow-500 border-yellow-500/20">
-                  {systemData.available_updates} packages
+                  {systemData.available_updates} {t("overview.packages")}
                 </Badge>
               </div>
             )}
@@ -762,13 +885,13 @@ export function SystemOverview() {
           <CardHeader>
             <CardTitle className="text-foreground flex items-center">
               <Zap className="h-5 w-5 mr-2" />
-              System Overview
+              {t("overview.systemOverview")}
             </CardTitle>
           </CardHeader>
           <CardContent className="space-y-4">
             <div className="flex justify-between items-center pb-3 border-b border-border">
               <div className="flex flex-col">
-                <span className="text-sm text-muted-foreground">Load Average (1m):</span>
+                <span className="text-sm text-muted-foreground">{t("overview.loadAverage1m")}</span>
               </div>
               <div className="flex items-center gap-2">
                 <span className="text-lg font-semibold text-foreground font-mono">
@@ -781,17 +904,17 @@ export function SystemOverview() {
             </div>
 
             <div className="flex justify-between items-center pb-3 border-b border-border">
-              <span className="text-sm text-muted-foreground">CPU Threads:</span>
+              <span className="text-sm text-muted-foreground">{t("overview.cpuThreads")}</span>
               <span className="text-lg font-semibold text-foreground">{systemData.cpu_threads || "N/A"}</span>
             </div>
 
             <div className="flex justify-between items-center pb-3 border-b border-border">
-              <span className="text-sm text-muted-foreground">Physical Disks:</span>
+              <span className="text-sm text-muted-foreground">{t("overview.physicalDisks")}</span>
               <span className="text-lg font-semibold text-foreground">{storageData?.disk_count || "N/A"}</span>
             </div>
 
             <div className="flex justify-between items-center">
-              <span className="text-sm text-muted-foreground">Network Interfaces:</span>
+              <span className="text-sm text-muted-foreground">{t("overview.networkInterfaces")}</span>
               <span className="text-lg font-semibold text-foreground">
                 {networkData?.physical_total_count || networkData?.physical_interfaces?.length || "N/A"}
               </span>

AppImage/components/temperature-detail-modal.tsx

@@ -0,0 +1,247 @@
+"use client"
+
+import { useState, useEffect } from "react"
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "./ui/dialog"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
+import { Badge } from "./ui/badge"
+import { Thermometer, TrendingDown, TrendingUp, Minus } from "lucide-react"
+import { AreaChart, Area, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContainer } from "recharts"
+import { useIsMobile } from "../hooks/use-mobile"
+import { fetchApi } from "@/lib/api-config"
+import { useT } from "@/lib/i18n/provider"
+
+const TIMEFRAME_OPTIONS = [
+  { value: "hour", labelKey: "overview.timeframes.hour" },
+  { value: "day", labelKey: "overview.timeframes.day" },
+  { value: "week", labelKey: "overview.timeframes.week" },
+  { value: "month", labelKey: "overview.timeframes.month" },
+]
+
+interface TempHistoryPoint {
+  timestamp: number
+  value: number
+  min?: number
+  max?: number
+}
+
+interface TempStats {
+  min: number
+  max: number
+  avg: number
+  current: number
+}
+
+interface TemperatureDetailModalProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  liveTemperature?: number
+}
+
+const CustomTooltip = ({ active, payload, label }: any) => {
+  if (active && payload && payload.length) {
+    return (
+      <div className="bg-gray-900/95 backdrop-blur-sm border border-gray-700 rounded-lg p-3 shadow-xl">
+        <p className="text-sm font-semibold text-white mb-2">{label}</p>
+        <div className="space-y-1.5">
+          {payload.map((entry: any, index: number) => (
+            <div key={index} className="flex items-center gap-2">
+              <div className="w-2.5 h-2.5 rounded-full flex-shrink-0" style={{ backgroundColor: entry.color }} />
+              <span className="text-xs text-gray-300 min-w-[60px]">{entry.name}:</span>
+              <span className="text-sm font-semibold text-white">{entry.value}°C</span>
+            </div>
+          ))}
+        </div>
+      </div>
+    )
+  }
+  return null
+}
+
+const getStatusColor = (temp: number) => {
+  if (temp >= 75) return "#ef4444"
+  if (temp >= 60) return "#f59e0b"
+  return "#22c55e"
+}
+
+const getStatusInfo = (temp: number) => {
+  if (temp === 0) return { status: "N/A", color: "bg-gray-500/10 text-gray-500 border-gray-500/20" }
+  if (temp < 60) return { status: "Normal", color: "bg-green-500/10 text-green-500 border-green-500/20" }
+  if (temp < 75) return { status: "Warm", color: "bg-yellow-500/10 text-yellow-500 border-yellow-500/20" }
+  return { status: "Hot", color: "bg-red-500/10 text-red-500 border-red-500/20" }
+}
+
+export function TemperatureDetailModal({ open, onOpenChange, liveTemperature }: TemperatureDetailModalProps) {
+  const t = useT()
+  // Default to 24 h — matches the disk temperature modal and is the
+  // useful timeframe for spotting trends; the 1-h view rarely tells
+  // you anything that the live reading doesn't already show.
+  const [timeframe, setTimeframe] = useState("day")
+  const [data, setData] = useState<TempHistoryPoint[]>([])
+  const [stats, setStats] = useState<TempStats>({ min: 0, max: 0, avg: 0, current: 0 })
+  const [loading, setLoading] = useState(true)
+  const isMobile = useIsMobile()
+
+  useEffect(() => {
+    if (open) {
+      fetchHistory()
+    }
+  }, [open, timeframe])
+
+  const fetchHistory = async () => {
+    setLoading(true)
+    try {
+      const result = await fetchApi<{ data: TempHistoryPoint[]; stats: TempStats }>(
+        `/api/temperature/history?timeframe=${timeframe}`
+      )
+      if (result && result.data) {
+        setData(result.data)
+        setStats(result.stats)
+      }
+    } catch (err) {
+      console.error("Failed to fetch temperature history:", err)
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  const formatTime = (timestamp: number) => {
+    const date = new Date(timestamp * 1000)
+    if (timeframe === "hour") {
+      return date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })
+    } else if (timeframe === "day") {
+      return date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })
+    } else {
+      return date.toLocaleDateString([], { month: "short", day: "numeric", hour: "2-digit", minute: "2-digit" })
+    }
+  }
+
+  const chartData = data.map((d) => ({
+    ...d,
+    time: formatTime(d.timestamp),
+  }))
+
+  // Use live temperature from the overview card (real-time) instead of last DB record
+  const currentTemp = liveTemperature && liveTemperature > 0 ? Math.round(liveTemperature * 10) / 10 : stats.current
+  const currentStatus = getStatusInfo(currentTemp)
+  const chartColor = getStatusColor(currentTemp)
+
+  // Calculate Y axis domain based on plotted data values only.
+  // Stats cards already show the real historical min/max separately.
+  // Using only graphed values keeps the chart readable and avoids
+  // large empty gaps caused by momentary spikes that get averaged out.
+  const values = data.map((d) => d.value)
+  const yMin = values.length > 0 ? Math.max(0, Math.floor(Math.min(...values) - 3)) : 0
+  const yMax = values.length > 0 ? Math.ceil(Math.max(...values) + 3) : 100
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-3xl bg-card border-border px-3 sm:px-6">
+        <DialogHeader>
+          <div className="flex items-center justify-between pr-6">
+            <DialogTitle className="text-foreground flex items-center gap-2">
+              <Thermometer className="h-5 w-5" />
+              {t("details.temperature.title")}
+            </DialogTitle>
+            <Select value={timeframe} onValueChange={setTimeframe}>
+              <SelectTrigger className="w-[130px] bg-card border-border">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {TIMEFRAME_OPTIONS.map((opt) => (
+                  <SelectItem key={opt.value} value={opt.value}>
+                    {t(opt.labelKey)}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+        </DialogHeader>
+
+        {/* Stats bar */}
+        <div className="grid grid-cols-2 sm:grid-cols-4 gap-2 sm:gap-3">
+          <div className={`rounded-lg p-3 text-center ${currentStatus.color}`}>
+            <div className="text-xs opacity-80 mb-1">{t("details.temperature.current")}</div>
+            <div className="text-lg font-bold">{currentTemp}°C</div>
+          </div>
+          <div className="bg-muted/50 rounded-lg p-3 text-center">
+            <div className="text-xs text-muted-foreground mb-1 flex items-center justify-center gap-1">
+              <TrendingDown className="h-3 w-3" /> {t("details.temperature.min")}
+            </div>
+            <div className="text-lg font-bold text-green-500">{stats.min}°C</div>
+          </div>
+          <div className="bg-muted/50 rounded-lg p-3 text-center">
+            <div className="text-xs text-muted-foreground mb-1 flex items-center justify-center gap-1">
+              <Minus className="h-3 w-3" /> {t("details.temperature.avg")}
+            </div>
+            <div className="text-lg font-bold text-foreground">{stats.avg}°C</div>
+          </div>
+          <div className="bg-muted/50 rounded-lg p-3 text-center">
+            <div className="text-xs text-muted-foreground mb-1 flex items-center justify-center gap-1">
+              <TrendingUp className="h-3 w-3" /> {t("details.temperature.max")}
+            </div>
+            <div className="text-lg font-bold text-red-500">{stats.max}°C</div>
+          </div>
+        </div>
+
+        {/* Chart */}
+        <div className="h-[300px] lg:h-[350px]">
+          {loading ? (
+            <div className="h-full flex items-center justify-center">
+              <div className="space-y-3 w-full animate-pulse">
+                <div className="h-4 bg-muted rounded w-1/4 mx-auto" />
+                <div className="h-[250px] bg-muted/50 rounded" />
+              </div>
+            </div>
+          ) : chartData.length === 0 ? (
+            <div className="h-full flex items-center justify-center text-muted-foreground">
+              <div className="text-center">
+                <Thermometer className="h-8 w-8 mx-auto mb-2 opacity-50" />
+                <p>{t("details.temperature.noData")}</p>
+                <p className="text-sm mt-1">{t("details.temperature.collectionHint")}</p>
+              </div>
+            </div>
+          ) : (
+            <ResponsiveContainer width="100%" height="100%">
+              <AreaChart data={chartData} margin={{ top: 10, right: 10, left: 0, bottom: 0 }}>
+                <defs>
+                  <linearGradient id="tempGradient" x1="0" y1="0" x2="0" y2="1">
+                    <stop offset="0%" stopColor={chartColor} stopOpacity={0.3} />
+                    <stop offset="100%" stopColor={chartColor} stopOpacity={0.02} />
+                  </linearGradient>
+                </defs>
+                <CartesianGrid strokeDasharray="3 3" stroke="currentColor" className="text-border" />
+                <XAxis
+                  dataKey="time"
+                  stroke="currentColor"
+                  className="text-foreground"
+                  tick={{ fill: "currentColor", fontSize: isMobile ? 10 : 12 }}
+                  interval="preserveStartEnd"
+                  minTickGap={isMobile ? 40 : 60}
+                />
+                <YAxis
+                  domain={[yMin, yMax]}
+                  stroke="currentColor"
+                  className="text-foreground"
+                  tick={{ fill: "currentColor", fontSize: isMobile ? 10 : 12 }}
+                  tickFormatter={(v) => `${v}°`}
+                  width={isMobile ? 40 : 45}
+                />
+                <Tooltip content={<CustomTooltip />} />
+                <Area
+                  type="monotone"
+                  dataKey="value"
+                  name={t("details.temperature.seriesName")}
+                  stroke={chartColor}
+                  strokeWidth={2}
+                  fill="url(#tempGradient)"
+                  dot={false}
+                  activeDot={{ r: 4, fill: chartColor, stroke: "#fff", strokeWidth: 2 }}
+                />
+              </AreaChart>
+            </ResponsiveContainer>
+          )}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}

AppImage/components/terminal-panel.tsx

@@ -3,6 +3,7 @@
 import type React from "react"
 import { useEffect, useRef, useState } from "react"
 import { API_PORT, fetchApi } from "@/lib/api-config" // Unificando importaciones de api-config en una sola línea con alias @/
+import { getTicketedWsUrl } from "@/lib/terminal-ws"
 import {
   Activity,
   Trash2,
@@ -15,12 +16,25 @@ import {
   AlignJustify,
   Grid2X2,
   GripHorizontal,
+  ChevronDown,
+  Copy,
+  Clipboard,
 } from "lucide-react"
+import { copyTerminalSelection, pasteFromClipboard } from "@/lib/terminal-clipboard"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  DropdownMenuSeparator,
+  DropdownMenuLabel,
+} from "@/components/ui/dropdown-menu"
 import { Button } from "@/components/ui/button"
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "@/components/ui/dialog"
 import { Input } from "@/components/ui/input"
 import { Tabs, TabsList, TabsTrigger, TabsContent } from "@/components/ui/tabs"
 import type { CheatSheetResult } from "@/lib/cheat-sheet-result" // Declare CheatSheetResult here
+import { useT } from "@/lib/i18n/provider"
 
 type TerminalPanelProps = {
   websocketUrl?: string
@@ -34,6 +48,7 @@ interface TerminalInstance {
   ws: WebSocket | null
   isConnected: boolean
   fitAddon: any // Added fitAddon to TerminalInstance
+  pingInterval?: ReturnType<typeof setInterval> | null // Heartbeat interval to keep connection alive
 }
 
 function getWebSocketUrl(): string {
@@ -64,74 +79,30 @@ function getApiUrl(endpoint?: string): string {
 }
 
 const proxmoxCommands = [
-  { cmd: "pvesh get /nodes", desc: "List all Proxmox nodes" },
-  { cmd: "pvesh get /nodes/{node}/qemu", desc: "List VMs on a node" },
-  { cmd: "pvesh get /nodes/{node}/lxc", desc: "List LXC containers on a node" },
-  { cmd: "pvesh get /nodes/{node}/storage", desc: "List storage on a node" },
-  { cmd: "pvesh get /nodes/{node}/network", desc: "List network interfaces" },
-  { cmd: "qm list", desc: "List all QEMU/KVM virtual machines" },
-  { cmd: "qm start <vmid>", desc: "Start a virtual machine" },
-  { cmd: "qm stop <vmid>", desc: "Stop a virtual machine" },
-  { cmd: "qm shutdown <vmid>", desc: "Shutdown a virtual machine gracefully" },
-  { cmd: "qm status <vmid>", desc: "Show VM status" },
-  { cmd: "qm config <vmid>", desc: "Show VM configuration" },
-  { cmd: "qm snapshot <vmid> <snapname>", desc: "Create VM snapshot" },
-  { cmd: "pct list", desc: "List all LXC containers" },
-  { cmd: "pct start <vmid>", desc: "Start LXC container" },
-  { cmd: "pct stop <vmid>", desc: "Stop LXC container" },
-  { cmd: "pct enter <vmid>", desc: "Enter LXC container console" },
-  { cmd: "pct config <vmid>", desc: "Show container configuration" },
-  { cmd: "pvesm status", desc: "Show storage status" },
-  { cmd: "pvesm list <storage>", desc: "List storage content" },
-  { cmd: "pveperf", desc: "Test Proxmox system performance" },
-  { cmd: "pveversion", desc: "Show Proxmox VE version" },
-  { cmd: "systemctl status pve-cluster", desc: "Check cluster status" },
-  { cmd: "pvecm status", desc: "Show cluster status" },
-  { cmd: "pvecm nodes", desc: "List cluster nodes" },
-  { cmd: "zpool status", desc: "Show ZFS pool status" },
-  { cmd: "zpool list", desc: "List all ZFS pools" },
-  { cmd: "zfs list", desc: "List all ZFS datasets" },
-  { cmd: "ls -la", desc: "List all files with details" },
-  { cmd: "cd /path/to/dir", desc: "Change directory" },
-  { cmd: "mkdir dirname", desc: "Create new directory" },
-  { cmd: "rm -rf dirname", desc: "Remove directory recursively" },
-  { cmd: "cp source dest", desc: "Copy files or directories" },
-  { cmd: "mv source dest", desc: "Move or rename files" },
-  { cmd: "cat filename", desc: "Display file contents" },
-  { cmd: "grep 'pattern' file", desc: "Search for pattern in file" },
-  { cmd: "find . -name 'file'", desc: "Find files by name" },
-  { cmd: "chmod 755 file", desc: "Change file permissions" },
-  { cmd: "chown user:group file", desc: "Change file owner" },
-  { cmd: "tar -xzf file.tar.gz", desc: "Extract tar.gz archive" },
-  { cmd: "tar -czf archive.tar.gz dir/", desc: "Create tar.gz archive" },
-  { cmd: "df -h", desc: "Show disk usage" },
-  { cmd: "du -sh *", desc: "Show directory sizes" },
-  { cmd: "free -h", desc: "Show memory usage" },
-  { cmd: "top", desc: "Show running processes" },
-  { cmd: "ps aux | grep process", desc: "Find running process" },
-  { cmd: "kill -9 PID", desc: "Force kill process" },
-  { cmd: "systemctl status service", desc: "Check service status" },
-  { cmd: "systemctl start service", desc: "Start a service" },
-  { cmd: "systemctl stop service", desc: "Stop a service" },
-  { cmd: "systemctl restart service", desc: "Restart a service" },
-  { cmd: "apt update && apt upgrade", desc: "Update Debian/Ubuntu packages" },
-  { cmd: "apt install package", desc: "Install package on Debian/Ubuntu" },
-  { cmd: "apt remove package", desc: "Remove package" },
-  { cmd: "docker ps", desc: "List running containers" },
-  { cmd: "docker images", desc: "List Docker images" },
-  { cmd: "docker exec -it container bash", desc: "Enter container shell" },
-  { cmd: "ip addr show", desc: "Show IP addresses" },
-  { cmd: "ping host", desc: "Test network connectivity" },
-  { cmd: "curl -I url", desc: "Get HTTP headers" },
-  { cmd: "wget url", desc: "Download file from URL" },
-  { cmd: "ssh user@host", desc: "Connect via SSH" },
-  { cmd: "scp file user@host:/path", desc: "Copy file via SSH" },
-  { cmd: "tail -f /var/log/syslog", desc: "Follow log file in real-time" },
-  { cmd: "history", desc: "Show command history" },
-  { cmd: "clear", desc: "Clear terminal screen" },
+  "pvesh get /nodes", "pvesh get /nodes/{node}/qemu", "pvesh get /nodes/{node}/lxc",
+  "pvesh get /nodes/{node}/storage", "pvesh get /nodes/{node}/network", "qm list",
+  "qm start <vmid>", "qm stop <vmid>", "qm shutdown <vmid>", "qm status <vmid>",
+  "qm config <vmid>", "qm snapshot <vmid> <snapname>", "pct list", "pct start <vmid>",
+  "pct stop <vmid>", "pct enter <vmid>", "pct config <vmid>", "pvesm status",
+  "pvesm list <storage>", "pveperf", "pveversion", "systemctl status pve-cluster",
+  "pvecm status", "pvecm nodes", "zpool status", "zpool list", "zfs list", "ls -la",
+  "cd /path/to/dir", "mkdir dirname", "rm -rf dirname", "cp source dest", "mv source dest",
+  "cat filename", "grep 'pattern' file", "find . -name 'file'", "chmod 755 file",
+  "chown user:group file", "tar -xzf file.tar.gz", "tar -czf archive.tar.gz dir/", "df -h",
+  "du -sh *", "free -h", "top", "ps aux | grep process", "kill -9 PID",
+  "systemctl status service", "systemctl start service", "systemctl stop service",
+  "systemctl restart service", "apt update && apt upgrade", "apt install package",
+  "apt remove package", "docker ps", "docker images", "docker exec -it container bash",
+  "ip addr show", "ping host", "curl -I url", "wget url", "ssh user@host",
+  "scp file user@host:/path", "tail -f /var/log/syslog", "history", "clear",
 ]
 
 export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onClose }) => {
+  const t = useT()
+  const localizedCommands = proxmoxCommands.map((cmd, index) => ({
+    cmd,
+    desc: t(`terminal.commandDescriptions.${index}`),
+  }))
   const [terminals, setTerminals] = useState<TerminalInstance[]>([])
   const [activeTerminalId, setActiveTerminalId] = useState<string>("")
   const [layout, setLayout] = useState<"single" | "grid">("grid")
@@ -140,12 +111,15 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
   const [terminalHeight, setTerminalHeight] = useState<number>(500) // altura por defecto en px
   const [searchModalOpen, setSearchModalOpen] = useState(false)
   const [searchQuery, setSearchQuery] = useState("")
-  const [filteredCommands, setFilteredCommands] = useState<Array<{ cmd: string; desc: string }>>(proxmoxCommands)
+  const [filteredCommands, setFilteredCommands] = useState<Array<{ cmd: string; desc: string }>>(localizedCommands)
   const [isSearching, setIsSearching] = useState(false)
   const [searchResults, setSearchResults] = useState<CheatSheetResult[]>([])
   const [useOnline, setUseOnline] = useState(true)
 
   const containerRefs = useRef<{ [key: string]: HTMLDivElement | null }>({})
+  // Per-terminal reconnect attempt count + last-fired timestamp for the
+  // exponential backoff in the visibilitychange handler.
+  const reconnectAttemptsRef = useRef<{ [key: string]: { attempts: number; lastAt: number } }>({})
 
   useEffect(() => {
     const updateDeviceType = () => {
@@ -171,6 +145,43 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
     }
   }, [])
 
+  // Handle page visibility change for automatic reconnection when user returns
+  // This is especially important for mobile/tablet devices (iPad) where switching apps
+  // puts the browser tab in background and may close WebSocket connections
+  //
+  // Per-terminal exponential backoff (2s, 4s, 8s, ..., capped at 60s) so a
+  // server-side outage doesn't get hammered every time the user switches
+  // tabs. `reconnectAttemptsRef` survives re-renders and tracks attempts +
+  // last-fired timestamps. The success path in `reconnectTerminal.onopen`
+  // resets the counter back to 0.
+  useEffect(() => {
+    const handleVisibilityChange = () => {
+      if (document.visibilityState !== 'visible') return
+      const now = Date.now()
+      terminals.forEach((terminal) => {
+        if (!(terminal.ws && terminal.ws.readyState !== WebSocket.OPEN && terminal.term)) {
+          return
+        }
+        const state = reconnectAttemptsRef.current[terminal.id] || { attempts: 0, lastAt: 0 }
+        const backoffMs = Math.min(60000, 2000 * Math.pow(2, state.attempts))
+        if (now - state.lastAt < backoffMs) {
+          return
+        }
+        reconnectAttemptsRef.current[terminal.id] = {
+          attempts: state.attempts + 1,
+          lastAt: now,
+        }
+        reconnectTerminal(terminal.id)
+      })
+    }
+
+    document.addEventListener('visibilitychange', handleVisibilityChange)
+
+    return () => {
+      document.removeEventListener('visibilitychange', handleVisibilityChange)
+    }
+  }, [terminals])
+
   const handleResizeStart = (e: React.MouseEvent | React.TouchEvent) => {
     // Bloquear solo en pantallas muy pequeñas (móviles)
     if (window.innerWidth < 640 && !isTablet) {
@@ -218,7 +229,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
     const searchCheatSh = async (query: string) => {
       if (!query.trim()) {
         setSearchResults([])
-        setFilteredCommands(proxmoxCommands)
+        setFilteredCommands(localizedCommands)
         return
       }
 
@@ -233,10 +244,9 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
         })
 
         if (!data.success || !data.examples || data.examples.length === 0) {
-          throw new Error("No examples found")
+          throw new Error(t("terminal.noExamplesFound"))
         }
 
-        console.log("[v0] Received parsed examples from server:", data.examples.length)
 
         const formattedResults: CheatSheetResult[] = data.examples.map((example: any) => ({
           command: example.command,
@@ -247,8 +257,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
         setUseOnline(true)
         setSearchResults(formattedResults)
       } catch (error) {
-        console.log("[v0] Error fetching from cheat.sh proxy, using offline commands:", error)
-        const filtered = proxmoxCommands.filter(
+        const filtered = localizedCommands.filter(
           (item) =>
             item.cmd.toLowerCase().includes(query.toLowerCase()) ||
             item.desc.toLowerCase().includes(query.toLowerCase()),
@@ -266,12 +275,94 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
         searchCheatSh(searchQuery)
       } else {
         setSearchResults([])
-        setFilteredCommands(proxmoxCommands)
+        setFilteredCommands(localizedCommands)
       }
     }, 800)
 
     return () => clearTimeout(debounce)
-  }, [searchQuery])
+  }, [searchQuery, t])
+
+  // Function to reconnect a terminal when connection is lost
+  // This is called when page visibility changes (user returns from another app)
+  const reconnectTerminal = async (terminalId: string) => {
+    const terminal = terminals.find(t => t.id === terminalId)
+    if (!terminal || !terminal.term) return
+    
+    // Show reconnecting message
+    terminal.term.writeln(`\r\n\x1b[33m[INFO] ${t("terminal.reconnecting")}\x1b[0m`)
+
+    const wsUrl = websocketUrl || getWebSocketUrl()
+    // Append the single-use auth ticket so the backend handshake can validate.
+    const ws = new WebSocket(await getTicketedWsUrl(wsUrl))
+    
+    ws.onopen = () => {
+      // Successful connect — reset backoff state for this terminal.
+      reconnectAttemptsRef.current[terminalId] = { attempts: 0, lastAt: 0 }
+      // Clear any existing ping interval
+      if (terminal.pingInterval) {
+        clearInterval(terminal.pingInterval)
+      }
+      
+      // Start heartbeat ping every 25 seconds to keep connection alive
+      const pingInterval = setInterval(() => {
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify({ type: 'ping' }))
+        } else {
+          clearInterval(pingInterval)
+        }
+      }, 25000)
+      
+      setTerminals((prev) =>
+        prev.map((t) => (t.id === terminalId ? { ...t, isConnected: true, ws, pingInterval } : t))
+      )
+      terminal.term.writeln(`\r\n\x1b[32m[INFO] ${t("terminal.reconnected")}\x1b[0m`)
+      
+      // Sync terminal size
+      if (terminal.fitAddon) {
+        try {
+          terminal.fitAddon.fit()
+          ws.send(JSON.stringify({
+            type: 'resize',
+            cols: terminal.term.cols,
+            rows: terminal.term.rows,
+          }))
+        } catch (err) {
+          console.warn('[Terminal] resize on reconnect failed:', err)
+        }
+      }
+    }
+    
+    ws.onmessage = (event) => {
+      // Filter out pong responses from heartbeat - don't display in terminal
+      if (event.data === '{"type": "pong"}' || event.data === '{"type":"pong"}') {
+        return
+      }
+      terminal.term.write(event.data)
+    }
+    
+    ws.onerror = () => {
+      terminal.term.writeln(`\r\n\x1b[31m[ERROR] ${t("terminal.reconnectionFailed")}\x1b[0m`)
+    }
+    
+    ws.onclose = () => {
+      setTerminals((prev) => prev.map((t) => {
+        if (t.id === terminalId) {
+          if (t.pingInterval) {
+            clearInterval(t.pingInterval)
+          }
+          return { ...t, isConnected: false, pingInterval: null }
+        }
+        return t
+      }))
+      terminal.term.writeln(`\r\n\x1b[33m[INFO] ${t("terminal.connectionClosed")}\x1b[0m`)
+    }
+    
+    terminal.term.onData((data: string) => {
+      if (ws.readyState === WebSocket.OPEN) {
+        ws.send(data)
+      }
+    })
+  }
 
   const addNewTerminal = () => {
     if (terminals.length >= 4) return
@@ -281,11 +372,12 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
       ...prev,
       {
         id: newId,
-        title: `Terminal ${prev.length + 1}`,
+        title: t("terminal.terminalTitle", { number: prev.length + 1 }),
         term: null,
         ws: null,
         isConnected: false,
         fitAddon: null, // Added fitAddon initialization
+        pingInterval: null, // Added pingInterval initialization
       },
     ])
     setActiveTerminalId(newId)
@@ -294,6 +386,10 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
   const closeTerminal = (id: string) => {
     const terminal = terminals.find((t) => t.id === id)
     if (terminal) {
+      // Clear heartbeat interval
+      if (terminal.pingInterval) {
+        clearInterval(terminal.pingInterval)
+      }
       if (terminal.ws) {
         terminal.ws.close()
       }
@@ -314,12 +410,18 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
   }
 
   useEffect(() => {
-    terminals.forEach((terminal) => {
-      const container = containerRefs.current[terminal.id]
-      if (!terminal.term && container) {
-        initializeTerminal(terminal, container)
-      }
-    })
+    // Small delay to ensure DOM refs are available after state update
+    // This fixes the issue where first terminal doesn't connect on mobile/VPN
+    const timer = setTimeout(() => {
+      terminals.forEach((terminal) => {
+        const container = containerRefs.current[terminal.id]
+        if (!terminal.term && container) {
+          initializeTerminal(terminal, container)
+        }
+      })
+    }, 50)
+    
+    return () => clearTimeout(timer)
   }, [terminals, isMobile])
 
   useEffect(() => {
@@ -356,11 +458,22 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
       import("xterm/css/xterm.css"),
     ]).then(([Terminal, FitAddon]) => [Terminal, FitAddon])
 
+    // After the (potentially slow) dynamic import, verify the container
+    // is still the one we were given. If the user removed the terminal
+    // tab while xterm was loading, the original `container` element is
+    // detached and `containerRefs.current[terminal.id]` is gone — bail
+    // out to avoid attaching to a stale DOM node + opening an orphan
+    // WebSocket. Audit Tier 6 — `import("xterm")` sin cancelación.
+    if (containerRefs.current[terminal.id] !== container) return
+
     const fontSize = window.innerWidth < 768 ? 12 : 16
 
     const term = new TerminalClass({
       rendererType: "dom",
-      fontFamily: '"Courier", "Courier New", "Liberation Mono", "DejaVu Sans Mono", monospace',
+      // Issue #182: prepend common Nerd Font families so users who already
+      // have one installed see Starship/atuin/ble.sh icons render. Falls
+      // back to Courier if no NF is present.
+      fontFamily: '"MesloLGS NF", "FiraCode Nerd Font", "JetBrainsMono Nerd Font", "Hack Nerd Font", "Symbols Nerd Font", "Courier", "Courier New", "Liberation Mono", "DejaVu Sans Mono", monospace',
       fontSize: fontSize,
       lineHeight: 1,
       cursorBlink: true,
@@ -401,7 +514,23 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
     fitAddon.fit()
 
     const wsUrl = websocketUrl || getWebSocketUrl()
-    const ws = new WebSocket(wsUrl)
+
+    // Connection with timeout for VPN/mobile (15 seconds)
+    const connectionTimeout = 15000
+    let connectionTimedOut = false
+
+    // Single-use auth ticket appended as ?ticket=... — see lib/terminal-ws.ts.
+    const ws = new WebSocket(await getTicketedWsUrl(wsUrl))
+    
+    // Set connection timeout
+    const timeoutId = setTimeout(() => {
+      if (ws.readyState !== WebSocket.OPEN) {
+        connectionTimedOut = true
+        ws.close()
+        term.writeln(`\x1b[31m[ERROR] ${t("terminal.connectionTimeout")}\x1b[0m`)
+        term.writeln(`\x1b[33m[TIP] ${t("terminal.vpnTip")}\x1b[0m`)
+      }
+    }, connectionTimeout)
 
     const syncSizeWithBackend = () => {
       try {
@@ -423,25 +552,66 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
     }
 
     ws.onopen = () => {
+      // Clear connection timeout - we're connected!
+      clearTimeout(timeoutId)
+      
+      // Start heartbeat ping every 25 seconds to keep connection alive
+      // This prevents disconnection when switching apps on mobile/tablet (iPad)
+      const pingInterval = setInterval(() => {
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify({ type: 'ping' }))
+        } else {
+          clearInterval(pingInterval)
+        }
+      }, 25000)
+      
       setTerminals((prev) =>
-        prev.map((t) => (t.id === terminal.id ? { ...t, isConnected: true, term, ws, fitAddon } : t)),
+        prev.map((t) => (t.id === terminal.id ? { ...t, isConnected: true, term, ws, fitAddon, pingInterval } : t)),
       )
       syncSizeWithBackend()
     }
 
     ws.onmessage = (event) => {
+      // Filter out pong responses from heartbeat - don't display in terminal
+      if (event.data === '{"type": "pong"}' || event.data === '{"type":"pong"}') {
+        return
+      }
       term.write(event.data)
     }
 
     ws.onerror = (error) => {
-      console.error("[v0] TerminalPanel: WebSocket error:", error)
-      setTerminals((prev) => prev.map((t) => (t.id === terminal.id ? { ...t, isConnected: false } : t)))
-      term.writeln("\r\n\x1b[31m[ERROR] WebSocket connection error\x1b[0m")
+      clearTimeout(timeoutId)
+      console.error("TerminalPanel: WebSocket error:", error)
+      setTerminals((prev) => prev.map((t) => {
+        if (t.id === terminal.id) {
+          if (t.pingInterval) {
+            clearInterval(t.pingInterval)
+          }
+          return { ...t, isConnected: false, pingInterval: null }
+        }
+        return t
+      }))
+      // Only show error if not already shown by timeout
+      if (!connectionTimedOut) {
+        term.writeln(`\r\n\x1b[31m[ERROR] ${t("terminal.websocketError")}\x1b[0m`)
+      }
     }
 
     ws.onclose = () => {
-      setTerminals((prev) => prev.map((t) => (t.id === terminal.id ? { ...t, isConnected: false } : t)))
-      term.writeln("\r\n\x1b[33m[INFO] Connection closed\x1b[0m")
+      clearTimeout(timeoutId)
+      setTerminals((prev) => prev.map((t) => {
+        if (t.id === terminal.id) {
+          if (t.pingInterval) {
+            clearInterval(t.pingInterval)
+          }
+          return { ...t, isConnected: false, pingInterval: null }
+        }
+        return t
+      }))
+      // Only show close message if not already shown by timeout
+      if (!connectionTimedOut) {
+        term.writeln(`\r\n\x1b[33m[INFO] ${t("terminal.connectionClosed")}\x1b[0m`)
+      }
     }
 
     term.onData((data) => {
@@ -518,8 +688,10 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
     }
   }
 
-  const handleClose = () => {
+const handleClose = () => {
     terminals.forEach((terminal) => {
+      // Clear heartbeat interval
+      if (terminal.pingInterval) clearInterval(terminal.pingInterval)
       if (terminal.ws) terminal.ws.close()
       if (terminal.term) terminal.term.dispose()
     })
@@ -550,6 +722,29 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
     }
   }
 
+  // Mobile clipboard helpers — desktop users have ctrl/cmd shortcuts via xterm,
+  // but on touch devices xterm's selection / clipboard isn't reachable from the
+  // OS clipboard manager so we expose explicit Copy / Paste buttons.
+  const handleCopy = async (e?: React.MouseEvent | React.TouchEvent) => {
+    if (e) {
+      e.preventDefault()
+      e.stopPropagation()
+    }
+    const activeTerminal = terminals.find((t) => t.id === activeTerminalId)
+    await copyTerminalSelection(activeTerminal?.term)
+  }
+
+  const handlePaste = async (e?: React.MouseEvent | React.TouchEvent) => {
+    if (e) {
+      e.preventDefault()
+      e.stopPropagation()
+    }
+    const activeTerminal = terminals.find((t) => t.id === activeTerminalId)
+    if (!activeTerminal?.ws || activeTerminal.ws.readyState !== WebSocket.OPEN) return
+    const ws = activeTerminal.ws
+    await pasteFromClipboard((text) => ws.send(text))
+  }
+  
   const getLayoutClass = () => {
     const count = terminals.length
     if (isMobile || count === 1) return "grid grid-cols-1"
@@ -578,9 +773,9 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
           <Activity className="h-5 w-5 text-blue-500" />
           <div
             className={`w-2 h-2 rounded-full ${activeTerminal?.isConnected ? "bg-green-500" : "bg-red-500"}`}
-            title={activeTerminal?.isConnected ? "Connected" : "Disconnected"}
+            title={activeTerminal?.isConnected ? t("terminal.connected") : t("terminal.disconnected")}
           ></div>
-          <span className="text-xs text-zinc-500">{terminals.length} / 4 terminals</span>
+          <span className="text-xs text-zinc-500">{t("terminal.terminalCount", { count: terminals.length })}</span>
         </div>
 
         <div className="flex gap-2">
@@ -591,7 +786,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                 variant="outline"
                 size="sm"
                 className={`h-8 px-2 ${layout === "single" ? "bg-blue-500/20 border-blue-500" : ""}`}
-                title="Vista apilada (filas)"
+                title={t("terminal.stackedLayout")}
               >
                 <AlignJustify className="h-4 w-4" />
               </Button>
@@ -600,7 +795,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                 variant="outline"
                 size="sm"
                 className={`h-8 px-2 ${layout === "grid" ? "bg-blue-500/20 border-blue-500" : ""}`}
-                title="Vista cuadrícula 2x2"
+                title={t("terminal.gridLayout")}
               >
                 <Grid2X2 className="h-4 w-4" />
               </Button>
@@ -611,39 +806,39 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
             variant="outline"
             size="sm"
             disabled={terminals.length >= 4}
-            className="h-8 gap-2 bg-green-600 hover:bg-green-700 border-green-500 text-white disabled:opacity-50"
+            className="h-8 gap-2 bg-green-600/20 hover:bg-green-600/30 border-green-600/50 text-green-400 disabled:opacity-50"
           >
             <Plus className="h-4 w-4" />
-            <span className="hidden sm:inline">New</span>
+            <span className="hidden sm:inline">{t("terminal.new")}</span>
           </Button>
           <Button
             onClick={() => setSearchModalOpen(true)}
             variant="outline"
             size="sm"
             disabled={!activeTerminal?.isConnected}
-            className="h-8 gap-2 bg-blue-600 hover:bg-blue-700 border-blue-500 text-white disabled:opacity-50"
+            className="h-8 gap-2 bg-blue-600/20 hover:bg-blue-600/30 border-blue-600/50 text-blue-400 disabled:opacity-50"
           >
             <Search className="h-4 w-4" />
-            <span className="hidden sm:inline">Search</span>
+            <span className="hidden sm:inline">{t("terminal.search")}</span>
           </Button>
           <Button
             onClick={handleClear}
             variant="outline"
             size="sm"
             disabled={!activeTerminal?.isConnected}
-            className="h-8 gap-2 bg-yellow-600 hover:bg-yellow-700 border-yellow-500 text-white disabled:opacity-50"
+            className="h-8 gap-2 bg-yellow-600/20 hover:bg-yellow-600/30 border-yellow-600/50 text-yellow-400 disabled:opacity-50"
           >
             <Trash2 className="h-4 w-4" />
-            <span className="hidden sm:inline">Clear</span>
+            <span className="hidden sm:inline">{t("terminal.clear")}</span>
           </Button>
           <Button
             onClick={handleClose}
             variant="outline"
             size="sm"
-            className="h-8 gap-2 bg-red-600 hover:bg-red-700 border-red-500 text-white"
+            className="h-8 gap-2 bg-red-600/20 hover:bg-red-600/30 border-red-600/50 text-red-400"
           >
             <X className="h-4 w-4" />
-            <span className="hidden sm:inline">Close</span>
+            <span className="hidden sm:inline">{t("actions.close")}</span>
           </Button>
         </div>
       </div>
@@ -686,6 +881,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                 <div
                   ref={(el) => (containerRefs.current[terminal.id] = el)}
                   className="w-full h-full flex-1 bg-black overflow-hidden"
+                  translate="no"
                 />
               </TabsContent>
             ))}
@@ -718,6 +914,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                   ref={(el) => (containerRefs.current[terminal.id] = el)}
                   onClick={() => setActiveTerminalId(terminal.id)}
                   className="flex-1 w-full max-w-full bg-black overflow-hidden cursor-pointer"
+                  translate="no"
                   data-terminal-container
                 />
               </div>
@@ -738,7 +935,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
       )}
 
       {(isMobile || isTablet) && (
-        <div className="flex flex-wrap gap-1.5 justify-center items-center px-1 bg-zinc-900 text-sm rounded-b-md border-t border-zinc-700 py-1.5">
+        <div className="flex gap-1.5 justify-center items-center px-1 bg-zinc-900 text-sm rounded-b-md border-t border-zinc-700 py-1.5">
           <Button
             onPointerDown={(e) => {
               e.preventDefault()
@@ -819,44 +1016,70 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
             }}
             variant="outline"
             size="sm"
-            className="h-8 px-3 text-xs"
+            className="h-8 px-2 text-xs bg-blue-600/20 hover:bg-blue-600/30 border-blue-600/50 text-blue-400"
           >
-            ↵
-          </Button>
-          <Button
-            onPointerDown={(e) => {
-              e.preventDefault()
-              e.stopPropagation()
-              sendSequence("\x03", e)
-            }}
-            variant="outline"
-            size="sm"
-            className="h-8 px-2 text-xs"
-          >
-            CTRL+C
+            ↵ Enter
           </Button>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button
+                variant="outline"
+                size="sm"
+                className="h-8 px-2 text-xs gap-1 bg-transparent"
+              >
+                Ctrl
+                <ChevronDown className="h-3 w-3" />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" className="w-56">
+              <DropdownMenuLabel className="text-xs text-muted-foreground">{t("scriptTerminal.controlSequences")}</DropdownMenuLabel>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem onSelect={() => sendSequence("\x03")}>
+                <span className="font-mono text-xs mr-2">Ctrl+C</span>
+                <span className="text-muted-foreground text-xs">{t("scriptTerminal.cancelInterrupt")}</span>
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={() => sendSequence("\x18")}>
+                <span className="font-mono text-xs mr-2">Ctrl+X</span>
+                <span className="text-muted-foreground text-xs">{t("scriptTerminal.exitNano")}</span>
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={() => sendSequence("\x12")}>
+                <span className="font-mono text-xs mr-2">Ctrl+R</span>
+                <span className="text-muted-foreground text-xs">{t("scriptTerminal.searchHistory")}</span>
+              </DropdownMenuItem>
+              <DropdownMenuSeparator />
+              <DropdownMenuLabel className="text-xs text-muted-foreground">{t("scriptTerminal.clipboard")}</DropdownMenuLabel>
+              <DropdownMenuItem onSelect={() => { void handleCopy() }}>
+                <Copy className="h-3.5 w-3.5 mr-2" />
+                <span className="text-xs">{t("scriptTerminal.copySelection")}</span>
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={() => { void handlePaste() }}>
+                <Clipboard className="h-3.5 w-3.5 mr-2" />
+                <span className="text-xs">{t("scriptTerminal.paste")}</span>
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
       )}
 
       <Dialog open={searchModalOpen} onOpenChange={setSearchModalOpen}>
         <DialogContent className="max-w-3xl max-h-[85vh] overflow-hidden flex flex-col">
           <DialogHeader className="flex flex-row items-center justify-between space-y-0 pb-4 border-b border-zinc-800">
-            <DialogTitle className="text-xl font-semibold">Search Commands</DialogTitle>
+            <DialogTitle className="text-xl font-semibold">{t("terminal.searchCommands")}</DialogTitle>
             <div className="flex items-center gap-2">
               <div
                 className={`w-2 h-2 rounded-full ${useOnline ? "bg-green-500" : "bg-red-500"}`}
-                title={useOnline ? "Online - Using cheat.sh API" : "Offline - Using local commands"}
+                title={useOnline ? t("terminal.onlineSource") : t("terminal.offlineSource")}
               />
             </div>
           </DialogHeader>
 
-          <DialogDescription className="sr-only">Search for Linux and Proxmox commands</DialogDescription>
+          <DialogDescription className="sr-only">{t("terminal.searchDescription")}</DialogDescription>
 
           <div className="space-y-4">
             <div className="relative">
               <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-zinc-500" />
               <Input
-                placeholder="Search commands... (e.g., tar, docker, qm, systemctl)"
+                placeholder={t("terminal.searchPlaceholder")}
                 value={searchQuery}
                 onChange={(e) => setSearchQuery(e.target.value)}
                 className="pl-10 bg-zinc-900 border-zinc-700 focus:border-blue-500 focus:ring-1 focus:ring-blue-500 text-base"
@@ -870,7 +1093,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
             {isSearching && (
               <div className="text-center py-4 text-zinc-400">
                 <div className="animate-spin inline-block w-6 h-6 border-2 border-current border-t-transparent rounded-full mb-2" />
-                <p className="text-sm">Searching cheat.sh...</p>
+                <p className="text-sm">{t("terminal.searchingCheatSh")}</p>
               </div>
             )}
 
@@ -898,7 +1121,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                   <div className="text-center py-2">
                     <p className="text-xs text-zinc-500">
                       <Lightbulb className="inline-block w-3 h-3 mr-1" />
-                      Powered by cheat.sh
+                      {t("terminal.poweredByCheatSh")}
                     </p>
                   </div>
                 </>
@@ -924,13 +1147,13 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                         className="shrink-0 h-7 px-2 text-xs"
                       >
                         <Send className="h-3 w-3 mr-1" />
-                        Send
+                        {t("terminal.send")}
                       </Button>
                     </div>
                   </div>
                 ))
               ) : !isSearching && !searchQuery && !useOnline ? (
-                proxmoxCommands.map((item, index) => (
+                localizedCommands.map((item, index) => (
                   <div
                     key={index}
                     onClick={() => sendToActiveTerminal(item.cmd)}
@@ -951,7 +1174,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                         className="shrink-0 h-7 px-2 text-xs"
                       >
                         <Send className="h-3 w-3 mr-1" />
-                        Send
+                        {t("terminal.send")}
                       </Button>
                     </div>
                   </div>
@@ -962,17 +1185,17 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                     <>
                       <Search className="w-12 h-12 text-zinc-600 mx-auto" />
                       <div>
-                        <p className="text-zinc-400 font-medium">No results found for "{searchQuery}"</p>
-                        <p className="text-xs text-zinc-500 mt-1">Try a different command or check your spelling</p>
+                        <p className="text-zinc-400 font-medium">{t("terminal.noResults", { query: searchQuery })}</p>
+                        <p className="text-xs text-zinc-500 mt-1">{t("terminal.tryDifferentSearch")}</p>
                       </div>
                     </>
                   ) : (
                     <>
                       <Terminal className="w-12 h-12 text-zinc-600 mx-auto" />
                       <div>
-                        <p className="text-zinc-400 font-medium mb-2">Search for any command</p>
+                        <p className="text-zinc-400 font-medium mb-2">{t("terminal.searchAnyCommand")}</p>
                         <div className="text-sm text-zinc-500 space-y-1">
-                          <p>Try searching for:</p>
+                          <p>{t("terminal.trySearchingFor")}</p>
                           <div className="flex flex-wrap justify-center gap-2 mt-2">
                             {["tar", "grep", "docker", "qm", "systemctl"].map((cmd) => (
                               <code
@@ -989,7 +1212,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
                       {useOnline && (
                         <div className="flex items-center justify-center gap-2 text-xs text-zinc-600 mt-4">
                           <Lightbulb className="w-3 h-3" />
-                          <span>Powered by cheat.sh</span>
+                          <span>{t("terminal.poweredByCheatSh")}</span>
                         </div>
                       )}
                     </>
@@ -998,13 +1221,11 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
               ) : null}
             </div>
 
-            <div className="pt-2 border-t border-zinc-800 flex items-center justify-between text-xs text-zinc-500">
-              <div className="flex items-center gap-2">
-                <Lightbulb className="w-3 h-3" />
-                <span>Tip: Search for any Linux command or Proxmox commands (qm, pct, zpool)</span>
+            {useOnline && searchResults.length > 0 && (
+              <div className="pt-2 border-t border-zinc-800 text-xs text-zinc-500 text-right">
+                <span className="text-zinc-600">{t("terminal.poweredByCheatSh")}</span>
               </div>
-              {useOnline && searchResults.length > 0 && <span className="text-zinc-600">Powered by cheat.sh</span>}
-            </div>
+            )}
           </div>
         </DialogContent>
       </Dialog>

AppImage/components/theme-toggle.tsx

@@ -4,8 +4,10 @@ import { useTheme } from "next-themes"
 import { useEffect, useState } from "react"
 
 import { Button } from "./ui/button"
+import { useT } from "../lib/i18n/provider"
 
 export function ThemeToggle() {
+  const t = useT()
   const { theme, setTheme } = useTheme()
   const [mounted, setMounted] = useState(false)
 
@@ -14,9 +16,7 @@ export function ThemeToggle() {
   }, [])
 
   const handleThemeToggle = () => {
-    console.log("[v0] Current theme:", theme)
     const newTheme = theme === "light" ? "dark" : "light"
-    console.log("[v0] Switching to theme:", newTheme)
     setTheme(newTheme)
   }
 
@@ -24,7 +24,7 @@ export function ThemeToggle() {
     return (
       <Button variant="outline" size="sm" className="border-border bg-transparent w-9 h-9">
         <Sun className="h-4 w-4" />
-        <span className="sr-only">Toggle theme</span>
+        <span className="sr-only">{t("actions.toggleTheme")}</span>
       </Button>
     )
   }
@@ -33,7 +33,7 @@ export function ThemeToggle() {
     <Button variant="outline" size="sm" onClick={handleThemeToggle} className="border-border bg-transparent w-9 h-9">
       <Sun className="h-4 w-4 rotate-0 scale-100 transition-all dark:-rotate-90 dark:scale-0" />
       <Moon className="absolute h-4 w-4 rotate-90 scale-0 transition-all dark:rotate-0 dark:scale-100" />
-      <span className="sr-only">Toggle theme</span>
+      <span className="sr-only">{t("actions.toggleTheme")}</span>
     </Button>
   )
 }

AppImage/components/two-factor-setup.tsx

@@ -6,6 +6,7 @@ import { Input } from "./ui/input"
 import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "./ui/dialog"
 import { AlertCircle, CheckCircle, Copy, Shield, Check } from "lucide-react"
 import { getApiUrl } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
 
 interface TwoFactorSetupProps {
   open: boolean
@@ -14,6 +15,8 @@ interface TwoFactorSetupProps {
 }
 
 export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps) {
+  const t = useT()
+  const tf = (key: string) => t(`securityPage.twoFactorSetup.${key}`)
   const [step, setStep] = useState(1)
   const [qrCode, setQrCode] = useState("")
   const [secret, setSecret] = useState("")
@@ -41,7 +44,7 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
       const data = await response.json()
 
       if (!response.ok) {
-        throw new Error(data.message || "Failed to setup 2FA")
+        throw new Error(data.message || tf("setupFailed"))
       }
 
       setQrCode(data.qr_code)
@@ -49,7 +52,7 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
       setBackupCodes(data.backup_codes)
       setStep(2)
     } catch (err) {
-      setError(err instanceof Error ? err.message : "Failed to setup 2FA")
+      setError(err instanceof Error ? err.message : tf("setupFailed"))
     } finally {
       setLoading(false)
     }
@@ -57,7 +60,7 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
 
   const handleVerify = async () => {
     if (!verificationCode || verificationCode.length !== 6) {
-      setError("Please enter a 6-digit code")
+      setError(tf("enterSixDigitCode"))
       return
     }
 
@@ -78,19 +81,81 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
       const data = await response.json()
 
       if (!response.ok) {
-        throw new Error(data.message || "Invalid verification code")
+        throw new Error(data.message || tf("invalidCode"))
       }
 
       setStep(3)
     } catch (err) {
-      setError(err instanceof Error ? err.message : "Verification failed")
+      setError(err instanceof Error ? err.message : tf("verificationFailed"))
     } finally {
       setLoading(false)
     }
   }
 
-  const copyToClipboard = (text: string, type: "secret" | "codes") => {
-    navigator.clipboard.writeText(text)
+  const copyToClipboard = async (text: string, type: "secret" | "codes") => {
+    let ok = false
+
+    // Path 1: modern Clipboard API. Only works on HTTPS / localhost.
+    try {
+      if (navigator.clipboard?.writeText) {
+        await navigator.clipboard.writeText(text)
+        ok = true
+      }
+    } catch {
+      // fall through
+    }
+
+    // Path 2: legacy execCommand. Picky — some browsers (iOS Safari
+    // especially) refuse to copy from an element placed off-screen
+    // (`left: -9999px`), which is the previous version's mistake.
+    // Keep the textarea inside the viewport but visually invisible.
+    if (!ok) {
+      const textarea = document.createElement("textarea")
+      textarea.value = text
+      textarea.style.position = "fixed"
+      textarea.style.top = "0"
+      textarea.style.left = "0"
+      textarea.style.width = "2em"
+      textarea.style.height = "2em"
+      textarea.style.padding = "0"
+      textarea.style.border = "none"
+      textarea.style.outline = "none"
+      textarea.style.boxShadow = "none"
+      textarea.style.background = "transparent"
+      textarea.style.opacity = "0"
+      textarea.setAttribute("readonly", "")
+      textarea.setAttribute("aria-hidden", "true")
+      document.body.appendChild(textarea)
+      try {
+        textarea.focus()
+        textarea.select()
+        textarea.setSelectionRange(0, text.length)
+        ok = document.execCommand("copy")
+      } catch {
+        ok = false
+      } finally {
+        document.body.removeChild(textarea)
+      }
+    }
+
+    // Path 3: last-resort window.prompt — ugly but unblockable. The
+    // user can select+copy from the prompt manually. This guarantees
+    // they can finish the 2FA setup even on plain-HTTP Monitor where
+    // both the Clipboard API and execCommand may be locked down.
+    if (!ok) {
+      try {
+        window.prompt(tf("copyPrompt"), text)
+        ok = true
+      } catch {
+        // ignore
+      }
+    }
+
+    if (!ok) {
+      console.error("Failed to copy to clipboard")
+      return
+    }
+
     if (type === "secret") {
       setCopiedSecret(true)
       setTimeout(() => setCopiedSecret(false), 2000)
@@ -121,9 +186,9 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
         <DialogHeader>
           <DialogTitle className="flex items-center gap-2">
             <Shield className="h-5 w-5 text-blue-500" />
-            Setup Two-Factor Authentication
+            {tf("title")}
           </DialogTitle>
-          <DialogDescription>Add an extra layer of security to your account</DialogDescription>
+          <DialogDescription>{tf("description")}</DialogDescription>
         </DialogHeader>
 
         {error && (
@@ -137,22 +202,21 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
           <div className="space-y-4">
             <div className="bg-blue-500/10 border border-blue-500/20 rounded-lg p-4">
               <p className="text-sm text-blue-500">
-                Two-factor authentication (2FA) adds an extra layer of security by requiring a code from your
-                authentication app in addition to your password.
+                {tf("intro")}
               </p>
             </div>
 
             <div className="space-y-2">
-              <h4 className="font-medium">You will need:</h4>
+              <h4 className="font-medium">{tf("youWillNeed")}</h4>
               <ul className="text-sm text-muted-foreground space-y-1 list-disc list-inside">
-                <li>An authentication app (Google Authenticator, Authy, etc.)</li>
-                <li>Scan a QR code or enter a key manually</li>
-                <li>Store backup codes securely</li>
+                <li>{tf("needApp")}</li>
+                <li>{tf("needQrOrKey")}</li>
+                <li>{tf("needBackupCodes")}</li>
               </ul>
             </div>
 
             <Button onClick={handleSetupStart} className="w-full bg-blue-500 hover:bg-blue-600" disabled={loading}>
-              {loading ? "Starting..." : "Start Setup"}
+              {loading ? tf("starting") : tf("startSetup")}
             </Button>
           </div>
         )}
@@ -160,24 +224,24 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
         {step === 2 && (
           <div className="space-y-4">
             <div className="space-y-2">
-              <h4 className="font-medium">1. Scan the QR code</h4>
-              <p className="text-sm text-muted-foreground">Open your authentication app and scan this QR code</p>
+              <h4 className="font-medium">{tf("scanTitle")}</h4>
+              <p className="text-sm text-muted-foreground">{tf("scanDescription")}</p>
               {qrCode && (
                 <div className="flex justify-center p-4 bg-white rounded-lg">
-                  <img src={qrCode || "/placeholder.svg"} alt="QR Code" width={200} height={200} className="rounded" />
+                  <img src={qrCode || "/placeholder.svg"} alt={tf("qrCodeAlt")} width={200} height={200} className="rounded" />
                 </div>
               )}
             </div>
 
             <div className="space-y-2">
-              <h4 className="font-medium">Or enter the key manually:</h4>
+              <h4 className="font-medium">{tf("manualKey")}</h4>
               <div className="flex gap-2">
                 <Input value={secret} readOnly className="font-mono text-sm" />
                 <Button
                   variant="outline"
                   size="icon"
                   onClick={() => copyToClipboard(secret, "secret")}
-                  title="Copy key"
+                  title={tf("copyKey")}
                 >
                   {copiedSecret ? <Check className="h-4 w-4 text-green-500" /> : <Copy className="h-4 w-4" />}
                 </Button>
@@ -185,8 +249,8 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
             </div>
 
             <div className="space-y-2">
-              <h4 className="font-medium">2. Enter the verification code</h4>
-              <p className="text-sm text-muted-foreground">Enter the 6-digit code that appears in your app</p>
+              <h4 className="font-medium">{tf("verifyTitle")}</h4>
+              <p className="text-sm text-muted-foreground">{tf("verifyDescription")}</p>
               <Input
                 type="text"
                 placeholder="000000"
@@ -200,10 +264,10 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
 
             <div className="flex gap-2">
               <Button onClick={handleVerify} className="flex-1 bg-blue-500 hover:bg-blue-600" disabled={loading}>
-                {loading ? "Verifying..." : "Verify and Enable"}
+                {loading ? tf("verifying") : tf("verifyAndEnable")}
               </Button>
               <Button onClick={handleClose} variant="outline" className="flex-1 bg-transparent" disabled={loading}>
-                Cancel
+                {t("actions.cancel")}
               </Button>
             </div>
           </div>
@@ -214,30 +278,29 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
             <div className="bg-green-500/10 border border-green-500/20 rounded-lg p-4 flex items-start gap-2">
               <CheckCircle className="h-5 w-5 text-green-500 flex-shrink-0 mt-0.5" />
               <div>
-                <p className="font-medium text-green-500">2FA Enabled Successfully</p>
+                <p className="font-medium text-green-500">{tf("enabledTitle")}</p>
                 <p className="text-sm text-green-500 mt-1">
-                  Your account is now protected with two-factor authentication
+                  {tf("enabledDescription")}
                 </p>
               </div>
             </div>
 
             <div className="space-y-2">
-              <h4 className="font-medium text-orange-500">Important: Save your backup codes</h4>
+              <h4 className="font-medium text-orange-500">{tf("saveCodesTitle")}</h4>
               <p className="text-sm text-muted-foreground">
-                These codes will allow you to access your account if you lose access to your authentication app. Store
-                them in a safe place.
+                {tf("saveCodesDescription")}
               </p>
 
               <div className="bg-muted/50 rounded-lg p-4 space-y-2">
                 <div className="flex justify-between items-center mb-2">
-                  <span className="text-sm font-medium">Backup Codes</span>
+                  <span className="text-sm font-medium">{tf("backupCodes")}</span>
                   <Button variant="outline" size="sm" onClick={() => copyToClipboard(backupCodes.join("\n"), "codes")}>
                     {copiedCodes ? (
                       <Check className="h-4 w-4 text-green-500 mr-2" />
                     ) : (
                       <Copy className="h-4 w-4 mr-2" />
                     )}
-                    Copy All
+                    {tf("copyAll")}
                   </Button>
                 </div>
                 <div className="grid grid-cols-2 gap-2">
@@ -251,7 +314,7 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
             </div>
 
             <Button onClick={handleFinish} className="w-full bg-blue-500 hover:bg-blue-600">
-              Finish
+              {tf("finish")}
             </Button>
           </div>
         )}

AppImage/components/ui/dialog.tsx

@@ -4,6 +4,7 @@ import * as React from "react"
 import * as DialogPrimitive from "@radix-ui/react-dialog"
 import { X } from "lucide-react"
 
+import { useT } from "@/lib/i18n/provider"
 import { cn } from "@/lib/utils"
 
 const Dialog = DialogPrimitive.Root
@@ -34,28 +35,32 @@ const DialogContent = React.forwardRef<
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Content> & {
     hideClose?: boolean
   }
->(({ className, children, hideClose, ...props }, ref) => (
-  <DialogPortal>
-    <DialogOverlay />
-    <DialogPrimitive.Content
-      ref={ref}
-      className={cn(
-        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 border bg-background p-6 shadow-lg duration-200 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[state=closed]:slide-out-to-left-1/2 data-[state=closed]:slide-out-to-top-[48%] data-[state=open]:slide-in-from-left-1/2 data-[state=open]:slide-in-from-top-[48%] rounded-lg",
-        className,
-      )}
-      aria-describedby={props["aria-describedby"] || undefined}
-      {...props}
-    >
-      {children}
-      {!hideClose && (
-        <DialogPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-accent data-[state=open]:text-muted-foreground">
-          <X className="h-4 w-4" />
-          <span className="sr-only">Close</span>
-        </DialogPrimitive.Close>
-      )}
-    </DialogPrimitive.Content>
-  </DialogPortal>
-))
+>(({ className, children, hideClose, ...props }, ref) => {
+  const t = useT()
+
+  return (
+    <DialogPortal>
+      <DialogOverlay />
+      <DialogPrimitive.Content
+        ref={ref}
+        className={cn(
+          "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 border bg-background p-6 shadow-lg duration-200 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[state=closed]:slide-out-to-left-1/2 data-[state=closed]:slide-out-to-top-[48%] data-[state=open]:slide-in-from-left-1/2 data-[state=open]:slide-in-from-top-[48%] rounded-lg",
+          className,
+        )}
+        aria-describedby={props["aria-describedby"] || undefined}
+        {...props}
+      >
+        {children}
+        {!hideClose && (
+          <DialogPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-accent data-[state=open]:text-muted-foreground">
+            <X className="h-4 w-4" />
+            <span className="sr-only">{t("actions.close")}</span>
+          </DialogPrimitive.Close>
+        )}
+      </DialogPrimitive.Content>
+    </DialogPortal>
+  )
+})
 DialogContent.displayName = DialogPrimitive.Content.displayName
 
 const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (

AppImage/components/ui/dropdown-menu.tsx

@@ -0,0 +1,257 @@
+'use client'
+
+import * as React from 'react'
+import * as DropdownMenuPrimitive from '@radix-ui/react-dropdown-menu'
+import { CheckIcon, ChevronRightIcon, CircleIcon } from 'lucide-react'
+
+import { cn } from '@/lib/utils'
+
+function DropdownMenu({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
+  return <DropdownMenuPrimitive.Root data-slot="dropdown-menu" {...props} />
+}
+
+function DropdownMenuPortal({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>) {
+  return (
+    <DropdownMenuPrimitive.Portal data-slot="dropdown-menu-portal" {...props} />
+  )
+}
+
+function DropdownMenuTrigger({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>) {
+  return (
+    <DropdownMenuPrimitive.Trigger
+      data-slot="dropdown-menu-trigger"
+      {...props}
+    />
+  )
+}
+
+function DropdownMenuContent({
+  className,
+  sideOffset = 4,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Content>) {
+  return (
+    <DropdownMenuPrimitive.Portal>
+      <DropdownMenuPrimitive.Content
+        data-slot="dropdown-menu-content"
+        sideOffset={sideOffset}
+        className={cn(
+          'bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 max-h-[var(--radix-dropdown-menu-content-available-height)] min-w-[8rem] origin-[var(--radix-dropdown-menu-content-transform-origin)] overflow-x-hidden overflow-y-auto rounded-md border p-1 shadow-md',
+          className,
+        )}
+        {...props}
+      />
+    </DropdownMenuPrimitive.Portal>
+  )
+}
+
+function DropdownMenuGroup({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Group>) {
+  return (
+    <DropdownMenuPrimitive.Group data-slot="dropdown-menu-group" {...props} />
+  )
+}
+
+function DropdownMenuItem({
+  className,
+  inset,
+  variant = 'default',
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Item> & {
+  inset?: boolean
+  variant?: 'default' | 'destructive'
+}) {
+  return (
+    <DropdownMenuPrimitive.Item
+      data-slot="dropdown-menu-item"
+      data-inset={inset}
+      data-variant={variant}
+      className={cn(
+        "focus:bg-accent focus:text-accent-foreground data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 dark:data-[variant=destructive]:focus:bg-destructive/20 data-[variant=destructive]:focus:text-destructive data-[variant=destructive]:*:[svg]:!text-destructive [&_svg:not([class*='text-'])]:text-muted-foreground relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-none select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 data-[inset]:pl-8 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    />
+  )
+}
+
+function DropdownMenuCheckboxItem({
+  className,
+  children,
+  checked,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.CheckboxItem>) {
+  return (
+    <DropdownMenuPrimitive.CheckboxItem
+      data-slot="dropdown-menu-checkbox-item"
+      className={cn(
+        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-sm py-1.5 pr-2 pl-8 text-sm outline-none select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      checked={checked}
+      {...props}
+    >
+      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
+        <DropdownMenuPrimitive.ItemIndicator>
+          <CheckIcon className="size-4" />
+        </DropdownMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </DropdownMenuPrimitive.CheckboxItem>
+  )
+}
+
+function DropdownMenuRadioGroup({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>) {
+  return (
+    <DropdownMenuPrimitive.RadioGroup
+      data-slot="dropdown-menu-radio-group"
+      {...props}
+    />
+  )
+}
+
+function DropdownMenuRadioItem({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioItem>) {
+  return (
+    <DropdownMenuPrimitive.RadioItem
+      data-slot="dropdown-menu-radio-item"
+      className={cn(
+        "focus:bg-accent focus:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-sm py-1.5 pr-2 pl-8 text-sm outline-none select-none data-[disabled]:pointer-events-none data-[disabled]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      <span className="pointer-events-none absolute left-2 flex size-3.5 items-center justify-center">
+        <DropdownMenuPrimitive.ItemIndicator>
+          <CircleIcon className="size-2 fill-current" />
+        </DropdownMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </DropdownMenuPrimitive.RadioItem>
+  )
+}
+
+function DropdownMenuLabel({
+  className,
+  inset,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Label> & {
+  inset?: boolean
+}) {
+  return (
+    <DropdownMenuPrimitive.Label
+      data-slot="dropdown-menu-label"
+      data-inset={inset}
+      className={cn(
+        'px-2 py-1.5 text-sm font-medium data-[inset]:pl-8',
+        className,
+      )}
+      {...props}
+    />
+  )
+}
+
+function DropdownMenuSeparator({
+  className,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>) {
+  return (
+    <DropdownMenuPrimitive.Separator
+      data-slot="dropdown-menu-separator"
+      className={cn('bg-border -mx-1 my-1 h-px', className)}
+      {...props}
+    />
+  )
+}
+
+function DropdownMenuShortcut({
+  className,
+  ...props
+}: React.ComponentProps<'span'>) {
+  return (
+    <span
+      data-slot="dropdown-menu-shortcut"
+      className={cn(
+        'text-muted-foreground ml-auto text-xs tracking-widest',
+        className,
+      )}
+      {...props}
+    />
+  )
+}
+
+function DropdownMenuSub({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
+  return <DropdownMenuPrimitive.Sub data-slot="dropdown-menu-sub" {...props} />
+}
+
+function DropdownMenuSubTrigger({
+  className,
+  inset,
+  children,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.SubTrigger> & {
+  inset?: boolean
+}) {
+  return (
+    <DropdownMenuPrimitive.SubTrigger
+      data-slot="dropdown-menu-sub-trigger"
+      data-inset={inset}
+      className={cn(
+        'focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground flex cursor-default items-center rounded-sm px-2 py-1.5 text-sm outline-none select-none data-[inset]:pl-8',
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      <ChevronRightIcon className="ml-auto size-4" />
+    </DropdownMenuPrimitive.SubTrigger>
+  )
+}
+
+function DropdownMenuSubContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>) {
+  return (
+    <DropdownMenuPrimitive.SubContent
+      data-slot="dropdown-menu-sub-content"
+      className={cn(
+        'bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 min-w-[8rem] origin-[var(--radix-dropdown-menu-content-transform-origin)] overflow-hidden rounded-md border p-1 shadow-lg',
+        className,
+      )}
+      {...props}
+    />
+  )
+}
+
+export {
+  DropdownMenu,
+  DropdownMenuPortal,
+  DropdownMenuTrigger,
+  DropdownMenuContent,
+  DropdownMenuGroup,
+  DropdownMenuLabel,
+  DropdownMenuItem,
+  DropdownMenuCheckboxItem,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuShortcut,
+  DropdownMenuSub,
+  DropdownMenuSubTrigger,
+  DropdownMenuSubContent,
+}

AppImage/components/ui/input.tsx

@@ -9,7 +9,14 @@ const Input = React.forwardRef<HTMLInputElement, InputProps>(({ className, type,
     <input
       type={type}
       className={cn(
-        "flex h-10 w-full rounded-lg border border-input bg-background px-4 py-2 text-sm shadow-sm transition-all file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 hover:border-ring/50",
+        // The previous focus style was `ring-2 ring-ring ring-offset-2`, which
+        // painted a 2px white ring with a 2px gap outside the border. Inside a
+        // ScrollArea or any container with `overflow-hidden` the ring's left
+        // edge got clipped and the result looked broken. We replace it with a
+        // 1px blue ring + matching border so a focused input now sits at the
+        // same visual weight as the colored card selectors used elsewhere
+        // (Backend picker, etc.).
+        "flex h-10 w-full rounded-lg border border-input bg-background px-4 py-2 text-sm shadow-sm transition-all file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground placeholder:opacity-40 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-blue-500 focus-visible:border-blue-500 disabled:cursor-not-allowed disabled:opacity-50 hover:border-ring/50",
         className,
       )}
       ref={ref}

AppImage/components/ui/sheet.tsx

@@ -5,6 +5,7 @@ import * as DialogPrimitive from "@radix-ui/react-dialog"
 import { cva, type VariantProps } from "class-variance-authority"
 import { X } from "lucide-react"
 
+import { useT } from "@/lib/i18n/provider"
 import { cn } from "@/lib/utils"
 
 const Sheet = DialogPrimitive.Root
@@ -54,18 +55,22 @@ interface SheetContentProps
     VariantProps<typeof sheetVariants> {}
 
 const SheetContent = React.forwardRef<React.ElementRef<typeof DialogPrimitive.Content>, SheetContentProps>(
-  ({ side = "right", className, children, ...props }, ref) => (
-    <SheetPortal>
-      <SheetOverlay />
-      <DialogPrimitive.Content ref={ref} className={cn(sheetVariants({ side }), className)} {...props}>
-        {children}
-        <DialogPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-secondary">
-          <X className="h-4 w-4" />
-          <span className="sr-only">Close</span>
-        </DialogPrimitive.Close>
-      </DialogPrimitive.Content>
-    </SheetPortal>
-  ),
+  ({ side = "right", className, children, ...props }, ref) => {
+    const t = useT()
+
+    return (
+      <SheetPortal>
+        <SheetOverlay />
+        <DialogPrimitive.Content ref={ref} className={cn(sheetVariants({ side }), className)} {...props}>
+          {children}
+          <DialogPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-secondary">
+            <X className="h-4 w-4" />
+            <span className="sr-only">{t("actions.close")}</span>
+          </DialogPrimitive.Close>
+        </DialogPrimitive.Content>
+      </SheetPortal>
+    )
+  },
 )
 SheetContent.displayName = DialogPrimitive.Content.displayName
 

AppImage/components/ui/switch.tsx

@@ -0,0 +1,29 @@
+"use client"
+
+import * as React from "react"
+import * as SwitchPrimitives from "@radix-ui/react-switch"
+
+import { cn } from "@/lib/utils"
+
+const Switch = React.forwardRef<
+  React.ElementRef<typeof SwitchPrimitives.Root>,
+  React.ComponentPropsWithoutRef<typeof SwitchPrimitives.Root>
+>(({ className, ...props }, ref) => (
+  <SwitchPrimitives.Root
+    className={cn(
+      "peer inline-flex h-5 w-9 shrink-0 cursor-pointer items-center rounded-full border-2 border-transparent shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=unchecked]:bg-slate-300 dark:data-[state=unchecked]:bg-slate-600",
+      className
+    )}
+    {...props}
+    ref={ref}
+  >
+    <SwitchPrimitives.Thumb
+      className={cn(
+        "pointer-events-none block h-4 w-4 rounded-full bg-white shadow-lg ring-0 transition-transform data-[state=checked]:translate-x-4 data-[state=unchecked]:translate-x-0"
+      )}
+    />
+  </SwitchPrimitives.Root>
+))
+Switch.displayName = SwitchPrimitives.Root.displayName
+
+export { Switch }

AppImage/components/ui/textarea.tsx

@@ -0,0 +1,24 @@
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+export interface TextareaProps
+  extends React.TextareaHTMLAttributes<HTMLTextAreaElement> {}
+
+const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
+  ({ className, ...props }, ref) => {
+    return (
+      <textarea
+        className={cn(
+          "flex min-h-[80px] w-full rounded-md border border-input bg-background px-3 py-2 text-sm placeholder:text-muted-foreground placeholder:opacity-40 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-blue-500 focus-visible:border-blue-500 disabled:cursor-not-allowed disabled:opacity-50",
+          className
+        )}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Textarea.displayName = "Textarea"
+
+export { Textarea }

AppImage/config/verified_ai_models.json

@@ -0,0 +1,129 @@
+{
+  "_description": "Verified AI models for ProxMenux notifications. Only models listed here will be shown to users. Models are tested to work with the chat/completions API format.",
+  "_updated": "2026-09-02",
+  "_verifier": "Refreshed with tools/ai-models-verifier (private). Re-run before each ProxMenux release to keep the list current. The verifier and ProxMenux share the same reasoning/thinking-model handlers so their verdicts stay aligned with runtime behaviour.",
+  "groq": {
+    "models": [
+      "allam-2-7b",
+      "qwen/qwen3.8-27b",
+      "openai/gpt-oss-20b",
+      "groq/compound-mini"
+    ],
+    "recommended": "openai/gpt-oss-20b",
+    "_note": "Verified 2026-09-02 with the Groq API. 4 of 12 tested pass. `llama-3.3-70b-versatile` no longer served by Groq. Recommended kept as `openai/gpt-oss-20b` (english-capable) — `allam-2-7b` is fastest but Arabic-focused; add manually if serving Arabic notifications."
+  },
+  "gemini": {
+    "models": [
+      "gemini-2.5-flash-lite",
+      "gemini-3.1-flash-lite",
+      "gemini-3.5-flash-lite",
+      "gemini-3.1-flash-lite-preview",
+      "gemini-flash-lite-latest",
+      "gemini-2.5-flash",
+      "gemini-3-flash-preview",
+      "gemini-3.5-flash"
+    ],
+    "recommended": "gemini-2.5-flash-lite",
+    "_deprecated": [
+      "gemini-2.0-flash",
+      "gemini-2.0-flash-lite",
+      "gemini-1.5-flash",
+      "gemini-1.0-pro",
+      "gemini-pro"
+    ],
+    "_note": "Verified 2026-09-02. gemini-flash-lite-latest passes consistently but gemini-2.5-flash-lite remains recommended because 'latest' aliases can drift. gemini-3.1-flash-lite is the stable successor to 3-flash-preview. Pro variants continue to reject thinkingBudget=0 and are overkill for notification translation."
+  },
+  "openai": {
+    "models": [
+      "gpt-4.1-nano-2025-04-14",
+      "gpt-4.1-nano",
+      "gpt-4.1-2025-04-14",
+      "gpt-4.1",
+      "gpt-4o-2024-11-20",
+      "gpt-4o-2024-05-13",
+      "gpt-4o-mini",
+      "gpt-3.5-turbo-16k",
+      "gpt-4o-mini-2024-07-18",
+      "gpt-5-nano",
+      "gpt-3.5-turbo-1106",
+      "gpt-3.5-turbo-0125",
+      "gpt-5-nano-2025-08-07",
+      "gpt-4.1-mini",
+      "gpt-4.1-mini-2025-04-14",
+      "gpt-3.5-turbo",
+      "gpt-4o",
+      "gpt-4o-2024-08-06",
+      "gpt-4",
+      "gpt-4-turbo",
+      "gpt-4-turbo-2024-04-09",
+      "gpt-4-0613"
+    ],
+    "recommended": "gpt-4.1-nano",
+    "_note": "Verified 2026-09-02 with the OpenAI API — 22 of 74 tested pass. Includes stable aliases (gpt-4.1-nano, gpt-4o-mini, ...), dated snapshots for pinning (gpt-4o-2024-11-20, gpt-4.1-nano-2025-04-14) and legacy families (gpt-3.5-turbo, gpt-4) for cost-optimised use cases. Recommended kept as `gpt-4.1-nano` (stable alias, 1.39s)."
+  },
+  "anthropic": {
+    "models": [
+      "claude-haiku-4-5-20251001",
+      "claude-opus-4-8",
+      "claude-sonnet-4-5-20250929",
+      "claude-opus-4-5-20251101",
+      "claude-opus-4-7",
+      "claude-sonnet-4-6",
+      "claude-fable-5",
+      "claude-fable-5-1",
+      "claude-opus-4-6"
+    ],
+    "recommended": "claude-haiku-4-5-20251001",
+    "_note": "Verified 2026-09-02 — 9 of 11 tested pass. The `claude-haiku-4-5` alias no longer resolves upstream; the working snapshot is `claude-haiku-4-5-20251001` — used as recommended (2.89s). Full family surfaced: haiku/sonnet/opus/fable across generations 4.5/4.6/4.7/4.8/5."
+  },
+  "openrouter": {
+    "models": [
+      "google/gemini-2.5-flash-lite",
+      "google/gemini-3.5-flash-lite",
+      "amazon/nova-pro-v1",
+      "mistralai/mistral-medium-3",
+      "google/gemini-2.5-flash",
+      "amazon/nova-lite-v1",
+      "openai/gpt-5.4-mini",
+      "openai/gpt-4o-mini",
+      "openai/gpt-4.1",
+      "perplexity/sonar",
+      "meta-llama/llama-4-scout",
+      "x-ai/grok-4.20",
+      "google/gemini-3-flash-preview",
+      "meta-llama/llama-4-maverick",
+      "perplexity/sonar-pro",
+      "openai/gpt-4.1-nano",
+      "anthropic/claude-haiku-4.5",
+      "mistralai/mistral-large-2512",
+      "meta-llama/llama-3.1-70b-instruct",
+      "qwen/qwen3-235b-a22b-2507",
+      "moonshotai/kimi-k2",
+      "anthropic/claude-opus-4.8",
+      "meta-llama/llama-3.3-70b-instruct",
+      "openai/gpt-5.1",
+      "anthropic/claude-sonnet-5",
+      "mistralai/mistral-small-3.2-24b-instruct",
+      "cohere/command-a",
+      "x-ai/grok-4.3",
+      "anthropic/claude-sonnet-4.6",
+      "deepseek/deepseek-v3.2",
+      "openai/gpt-oss-120b",
+      "meta-llama/llama-3.1-8b-instruct",
+      "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free",
+      "nvidia/nemotron-3-super-120b-a12b:free",
+      "google/gemma-4-26b-a4b-it:free",
+      "nvidia/nemotron-nano-12b-v2-vl:free",
+      "nvidia/nemotron-3-nano-30b-a3b:free",
+      "poolside/laguna-s-2.1:free",
+      "openai/gpt-oss-20b:free"
+    ],
+    "recommended": "meta-llama/llama-3.3-70b-instruct",
+    "_note": "Curated manually from the 249+ models OpenRouter serves — the auto-verifier passes ~200 today but only a subset are practical for notification translation. Includes the 11 previously-curated paid models plus 22 new mainstream additions (gpt-5.1, claude-opus-4.8, sonnet-5, grok-4.3/4.20, kimi-k2, deepseek-v3.2, nova, cohere-a, sonar, ...) and 6 `:free` variants re-added manually — the free tier is intentionally supported per user request even though today's rate limits blocked some of them from passing the test."
+  },
+  "ollama": {
+    "_note": "Ollama models are local, we don't filter them. User manages their own models.",
+    "models": [],
+    "recommended": ""
+  }
+}

AppImage/lib/api-config.ts

@@ -19,29 +19,19 @@ export const API_PORT = process.env.NEXT_PUBLIC_API_PORT || "8008"
  */
 export function getApiBaseUrl(): string {
   if (typeof window === "undefined") {
-    console.log("[v0] getApiBaseUrl: Running on server (SSR)")
     return ""
   }
 
   const { protocol, hostname, port } = window.location
 
-  console.log("[v0] getApiBaseUrl - protocol:", protocol, "hostname:", hostname, "port:", port)
-
   // If accessing via standard ports (80/443) or no port, assume we're behind a proxy
   // In this case, use relative URLs so the proxy handles routing
   const isStandardPort = port === "" || port === "80" || port === "443"
 
-  console.log("[v0] getApiBaseUrl - isStandardPort:", isStandardPort)
-
   if (isStandardPort) {
-    // Behind a proxy - use relative URL
-    console.log("[v0] getApiBaseUrl: Detected proxy access, using relative URLs")
     return ""
   } else {
-    // Direct access - use explicit API port
-    const baseUrl = `${protocol}//${hostname}:${API_PORT}`
-    console.log("[v0] getApiBaseUrl: Direct access detected, using:", baseUrl)
-    return baseUrl
+    return `${protocol}//${hostname}:${API_PORT}`
   }
 }
 
@@ -69,12 +59,7 @@ export function getAuthToken(): string | null {
   if (typeof window === "undefined") {
     return null
   }
-  const token = localStorage.getItem("proxmenux-auth-token")
-  console.log(
-    "[v0] getAuthToken called:",
-    token ? `Token found (length: ${token.length})` : "No token found in localStorage",
-  )
-  return token
+  return localStorage.getItem("proxmenux-auth-token")
 }
 
 /**
@@ -96,31 +81,108 @@ export async function fetchApi<T>(endpoint: string, options?: RequestInit): Prom
 
   if (token) {
     headers["Authorization"] = `Bearer ${token}`
-    console.log("[v0] fetchApi:", endpoint, "- Authorization header ADDED")
-  } else {
-    console.log("[v0] fetchApi:", endpoint, "- NO TOKEN - Request will fail if endpoint is protected")
   }
 
-  try {
-    const response = await fetch(url, {
-      ...options,
-      headers,
-      cache: "no-store",
-    })
-
-    console.log("[v0] fetchApi:", endpoint, "- Response status:", response.status)
+  const response = await fetch(url, {
+    ...options,
+    headers,
+    cache: "no-store",
+  })
 
     if (!response.ok) {
       if (response.status === 401) {
-        console.error("[v0] fetchApi: 401 UNAUTHORIZED -", endpoint, "- Token present:", !!token)
+        // Token is missing, expired, or signed under a previous JWT_SECRET
+        // (rotated per-install). Drop the stale token and force a single
+        // reload so the page-level auth gate (`app/page.tsx`) can render
+        // <Login> instead of cascading 401s from every authenticated
+        // component on mount.
+        //
+        // Only react when we actually had a token to invalidate. A 401
+        // without any token in localStorage means the caller is the
+        // Login screen itself, or a leftover fetch from a recently
+        // unmounted Dashboard — reloading there does nothing but waste
+        // the user's keystrokes and can leave the cascade flag set
+        // forever, swallowing the very 401 that we'd want to recover
+        // from after a successful re-login. The fix: bail out early
+        // if we have no token to invalidate.
+        if (typeof window !== "undefined") {
+          let hadToken = false
+          try {
+            hadToken = !!localStorage.getItem("proxmenux-auth-token")
+          } catch {
+            // private browsing — assume yes so we attempt recovery.
+            hadToken = true
+          }
+          if (!hadToken) {
+            throw new Error(`Unauthorized: ${endpoint}`)
+          }
+          try {
+            localStorage.removeItem("proxmenux-auth-token")
+          } catch {
+            // localStorage might be unavailable in private browsing — ignore.
+          }
+          try {
+            if (!sessionStorage.getItem("proxmenux-auth-401-handled")) {
+              sessionStorage.setItem("proxmenux-auth-401-handled", "1")
+              window.location.reload()
+            }
+          } catch {
+            // sessionStorage unavailable — fall back to a plain reload.
+            window.location.reload()
+          }
+        }
         throw new Error(`Unauthorized: ${endpoint}`)
       }
+      // Try to surface the backend's JSON error payload instead of a
+      // bare `500 INTERNAL SERVER ERROR`. The Flask routes consistently
+      // return `{error: "..."}` on failure (e.g. /api/vms/<id>/control
+      // includes the pvesh stderr — telling the user "no space left on
+      // device" is infinitely more useful than the raw status text).
+      //
+      // We also attach the FULL parsed JSON body to the thrown Error
+      // as `.body` so callers that want the optional `details` /
+      // `suggestion` fields (e.g. /api/node/metrics) can render them
+      // without re-fetching. Callers that just read `err.message`
+      // keep working exactly as before.
+      try {
+        const ct = response.headers.get("content-type") || ""
+        if (ct.includes("application/json")) {
+          const body = await response.json()
+          const detail =
+            (body && (body.error || body.message)) || ""
+          if (detail) {
+            const e: Error & { body?: unknown; status?: number } = new Error(detail)
+            e.body = body
+            e.status = response.status
+            throw e
+          }
+        }
+      } catch (parseErr) {
+        // Backend-supplied detail (the explicit `throw new Error(detail)`
+        // above) MUST propagate so the UI shows "path does not exist…"
+        // instead of the generic "API request failed: 400 BAD REQUEST".
+        // Only swallow when the JSON itself failed to parse — that's a
+        // real SyntaxError and falling through to the generic message
+        // is the right behaviour there.
+        if (!(parseErr instanceof SyntaxError)) {
+          throw parseErr
+        }
+      }
       throw new Error(`API request failed: ${response.status} ${response.statusText}`)
     }
 
-    return response.json()
-  } catch (error) {
-    console.error("[v0] fetchApi error for", endpoint, ":", error)
-    throw error
-  }
+    // Check content type to ensure we're getting JSON
+    const contentType = response.headers.get("content-type")
+    if (!contentType || !contentType.includes("application/json")) {
+      const text = await response.text()
+      console.error("fetchApi: Expected JSON but got:", contentType, "- Body preview:", text.substring(0, 200))
+      throw new Error(`Expected JSON response but got ${contentType || "unknown content type"}`)
+    }
+
+    try {
+      return await response.json()
+    } catch (jsonError) {
+      console.error("fetchApi: JSON parse error for", endpoint, "-", jsonError)
+      throw new Error(`Invalid JSON response from ${endpoint}`)
+    }
 }

AppImage/lib/category-color.ts

@@ -0,0 +1,87 @@
+// Deterministic OKLCH colouring for category badges. Shared between
+// the Apps dashboard and the LXC App tab so both surfaces show the
+// exact same colour for a given category name.
+//
+// Hue exclusions
+// --------------
+// Two bands are skipped because their meaning is already reserved by
+// the rest of the Monitor and a chip in those hues on the same view
+// would be visually confusing:
+//   * 260–319°  purple/violet — "update available" (ArrowUpCircle)
+//   * 340–19°   red           — error / danger signal
+// Green and yellow ARE used elsewhere for health status, but only as
+// tiny dots in other views — a chip in those hues on an app card
+// carries no false meaning, so they stay in the allowed range.
+//
+// Allowed ranges after the exclusions:
+//   [20, 260) ∪ [320, 340)  = 240° + 20° = 260° of usable hues.
+
+import { useEffect, useState } from "react"
+
+export function hueForCategory(text: string): number {
+  let hash = 5381
+  for (let i = 0; i < text.length; i++) {
+    hash = ((hash << 5) + hash + text.charCodeAt(i)) | 0
+  }
+  const raw = Math.abs(hash) % 260
+  if (raw < 240) return 20 + raw          // 0-239 → 20-259 (orange..blue)
+  return 320 + (raw - 240)                // 240-259 → 320-339 (pink/magenta)
+}
+
+// OKLCH is perceptually uniform — L=0.80 looks equally bright for a
+// blue and a yellow. HSL fails this because eyes weight green/yellow
+// more, so the same L% renders visually darker for blues.
+export function categoryChipStyle(text: string, isLight: boolean): {
+  backgroundColor: string
+  color: string
+  borderColor: string
+} {
+  const h = hueForCategory(text)
+  if (isLight) {
+    return {
+      backgroundColor: `oklch(0.55 0.20 ${h} / 0.14)`,
+      color: `oklch(0.42 0.19 ${h})`,
+      borderColor: `oklch(0.55 0.20 ${h} / 0.5)`,
+    }
+  }
+  return {
+    backgroundColor: `oklch(0.60 0.16 ${h} / 0.18)`,
+    color: `oklch(0.80 0.16 ${h})`,
+    borderColor: `oklch(0.60 0.16 ${h} / 0.55)`,
+  }
+}
+
+// Read the effective theme from next-themes' hooks on <html>:
+// `class="dark|light"` (Tailwind class strategy) or `data-theme`.
+// Falls back to the OS setting when the user hasn't chosen one.
+export function readIsLightTheme(): boolean {
+  if (typeof window === "undefined" || typeof document === "undefined") return false
+  const el = document.documentElement
+  if (el.classList.contains("dark")) return false
+  if (el.classList.contains("light")) return true
+  const attr = el.getAttribute("data-theme")
+  if (attr === "light") return true
+  if (attr === "dark") return false
+  return window.matchMedia("(prefers-color-scheme: light)").matches
+}
+
+// React hook — recomputes when the user toggles theme or the OS pref
+// flips. Watches <html>'s attributes (data-theme + class) and the
+// system media query. Used by any component that renders category
+// chips so they stay legible after a theme change.
+export function useIsLightTheme(): boolean {
+  const [isLight, setIsLight] = useState<boolean>(false)
+  useEffect(() => {
+    const update = () => setIsLight(readIsLightTheme())
+    update()
+    const mq = window.matchMedia("(prefers-color-scheme: light)")
+    const observer = new MutationObserver(update)
+    observer.observe(document.documentElement, {
+      attributes: true,
+      attributeFilter: ["data-theme", "class"],
+    })
+    mq.addEventListener("change", update)
+    return () => { observer.disconnect(); mq.removeEventListener("change", update) }
+  }, [])
+  return isLight
+}

AppImage/lib/disk-type.ts

@@ -0,0 +1,30 @@
+// Shared classifier for physical-disk type. Lives here because the
+// Storage page and the Hardware page used to ship their own copies
+// and silently drifted — old SSDs (e.g. OCZ-SOLID2) that don't expose
+// a SMART rotation rate fell through Hardware's HDD-as-default branch
+// and got mislabelled, while the Storage page got it right.
+//
+// Backend convention for `rotation_rate`:
+//   undefined / null / 0  → SSD (no platters reported)
+//   -1                     → HDD detected via /sys rotational flag,
+//                            but the drive doesn't expose RPM
+//   > 0                    → HDD with known RPM
+//   string "Solid State"   → SSD (smartctl wording on a few vendors)
+
+export type DiskType = "NVMe" | "SSD" | "HDD"
+
+export function getDiskType(
+  diskName: string,
+  rotationRate: number | string | null | undefined,
+): DiskType {
+  if (diskName.startsWith("nvme")) return "NVMe"
+  if (rotationRate === -1) return "HDD"
+  if (typeof rotationRate === "string") {
+    if (rotationRate.includes("Solid State")) return "SSD"
+    const parsed = Number.parseInt(rotationRate, 10)
+    if (Number.isNaN(parsed) || parsed === 0) return "SSD"
+    return "HDD"
+  }
+  if (rotationRate == null || rotationRate === 0) return "SSD"
+  return "HDD"
+}

AppImage/lib/health-thresholds.ts

@@ -0,0 +1,147 @@
+// Shared accessor for the user-configurable health thresholds.
+//
+// The backend exposes the full tree at `GET /api/health/thresholds`.
+// Several frontend components need *just* the disk-temperature pair
+// per drive class to color badges, chart bands, and SVG bands in the
+// SMART report — copy-pasting the numbers around led to two
+// inconsistent versions diverging from the backend (see Sprint 14.5).
+//
+// This module memoises the last fetched payload (TTL 30s) and exposes:
+//
+//   * `getDiskTempThresholdsSync(diskType)` — synchronous read with a
+//     conservative fallback to the backend defaults. Safe to call from
+//     anywhere, including a render path that can't await.
+//   * `loadDiskTempThresholds()` — async fetch + cache update. Returns
+//     the cached map; call once on mount of any component that uses
+//     the sync getter to ensure the cache is warm.
+//   * `useDiskTempThresholds()` — React hook that fires the fetch on
+//     mount, re-renders when fresh data arrives, and returns the
+//     current map (defaults until the first fetch lands).
+//
+// The cache is shared across components so opening multiple disk
+// modals in quick succession doesn't re-hit the API for each.
+
+import { useEffect, useState } from "react"
+import { fetchApi } from "./api-config"
+
+export type DiskClass = "HDD" | "SSD" | "NVMe" | "SAS"
+
+export interface DiskTempThreshold {
+  warn: number
+  hot: number
+}
+
+export type DiskTempMap = Record<DiskClass, DiskTempThreshold>
+
+// Fallback values when the API hasn't responded yet (or fails). These
+// match the recommended defaults baked into `health_thresholds.py`.
+// Keeping them duplicated here is intentional: the alternative is
+// blocking every render until the API comes back, which is worse UX.
+export const DEFAULT_DISK_TEMP: DiskTempMap = {
+  HDD: { warn: 60, hot: 65 },
+  SSD: { warn: 70, hot: 75 },
+  NVMe: { warn: 80, hot: 85 },
+  SAS: { warn: 55, hot: 65 },
+}
+
+const CACHE_TTL_MS = 30_000
+
+// Module-level cache — shared by every component that imports this.
+let cached: DiskTempMap = DEFAULT_DISK_TEMP
+let cachedAt = 0
+let inflight: Promise<DiskTempMap> | null = null
+
+// Subscribers are notified when a fresh fetch lands, so the
+// `useDiskTempThresholds` hook can re-render. Plain JS pub/sub —
+// nothing fancier needed here.
+const subscribers = new Set<(map: DiskTempMap) => void>()
+
+interface ApiThresholdsResponse {
+  success: boolean
+  thresholds?: {
+    disk_temperature?: {
+      hdd?: { warning?: { value: number }; critical?: { value: number } }
+      ssd?: { warning?: { value: number }; critical?: { value: number } }
+      nvme?: { warning?: { value: number }; critical?: { value: number } }
+      sas?: { warning?: { value: number }; critical?: { value: number } }
+    }
+  }
+}
+
+function pick(node: any, key: string, fallback: number): number {
+  const v = node?.[key]?.value
+  return typeof v === "number" && isFinite(v) ? v : fallback
+}
+
+function parse(payload: ApiThresholdsResponse): DiskTempMap {
+  const dt = payload?.thresholds?.disk_temperature
+  if (!dt) return { ...DEFAULT_DISK_TEMP }
+  return {
+    HDD: {
+      warn: pick(dt.hdd, "warning", DEFAULT_DISK_TEMP.HDD.warn),
+      hot: pick(dt.hdd, "critical", DEFAULT_DISK_TEMP.HDD.hot),
+    },
+    SSD: {
+      warn: pick(dt.ssd, "warning", DEFAULT_DISK_TEMP.SSD.warn),
+      hot: pick(dt.ssd, "critical", DEFAULT_DISK_TEMP.SSD.hot),
+    },
+    NVMe: {
+      warn: pick(dt.nvme, "warning", DEFAULT_DISK_TEMP.NVMe.warn),
+      hot: pick(dt.nvme, "critical", DEFAULT_DISK_TEMP.NVMe.hot),
+    },
+    SAS: {
+      warn: pick(dt.sas, "warning", DEFAULT_DISK_TEMP.SAS.warn),
+      hot: pick(dt.sas, "critical", DEFAULT_DISK_TEMP.SAS.hot),
+    },
+  }
+}
+
+export async function loadDiskTempThresholds(force = false): Promise<DiskTempMap> {
+  const now = Date.now()
+  if (!force && cachedAt && now - cachedAt < CACHE_TTL_MS) return cached
+  if (inflight) return inflight
+  inflight = (async () => {
+    try {
+      const res = await fetchApi<ApiThresholdsResponse>("/api/health/thresholds")
+      if (res?.success) {
+        cached = parse(res)
+        cachedAt = Date.now()
+        subscribers.forEach((cb) => cb(cached))
+      }
+    } catch {
+      // Leave previous cache in place; defaults are good enough.
+    } finally {
+      inflight = null
+    }
+    return cached
+  })()
+  return inflight
+}
+
+export function getDiskTempThresholdsSync(diskType: string | undefined): DiskTempThreshold {
+  const t = (diskType || "").toUpperCase()
+  if (t === "HDD") return cached.HDD
+  if (t === "SSD") return cached.SSD
+  if (t === "NVME") return cached.NVMe
+  if (t === "SAS") return cached.SAS
+  // Unknown class — assume SSD-ish numbers (mid-range).
+  return cached.SSD
+}
+
+/** React hook: triggers a load on mount, re-renders on cache update. */
+export function useDiskTempThresholds(): DiskTempMap {
+  const [map, setMap] = useState<DiskTempMap>(cached)
+  useEffect(() => {
+    let alive = true
+    const sub = (m: DiskTempMap) => { if (alive) setMap(m) }
+    subscribers.add(sub)
+    loadDiskTempThresholds().then((m) => { if (alive) setMap(m) })
+    return () => { alive = false; subscribers.delete(sub) }
+  }, [])
+  return map
+}
+
+/** Imperative invalidate — call after the user saves new thresholds. */
+export function invalidateDiskTempThresholdsCache() {
+  cachedAt = 0
+}

AppImage/lib/i18n/languages.ts

@@ -0,0 +1,40 @@
+export const LANGUAGE_STORAGE_KEY = "proxmenux-ui-language"
+export const DEFAULT_LANGUAGE = "en"
+
+export type LanguageCode = "en" | "es" | "fr" | "de" | "it" | "pt" | "sk" | "sv"
+
+export type LanguageStatus = "complete" | "partial" | "needs-translation"
+
+export interface SupportedLanguage {
+  code: LanguageCode
+  englishName: string
+  nativeName: string
+  status: LanguageStatus
+}
+
+export const SUPPORTED_LANGUAGES: SupportedLanguage[] = [
+  { code: "en", englishName: "English", nativeName: "English", status: "complete" },
+  { code: "de", englishName: "German", nativeName: "Deutsch", status: "complete" },
+  { code: "es", englishName: "Spanish", nativeName: "Español", status: "complete" },
+  { code: "fr", englishName: "French", nativeName: "Français", status: "complete" },
+  { code: "it", englishName: "Italian", nativeName: "Italiano", status: "complete" },
+  { code: "pt", englishName: "Portuguese", nativeName: "Português", status: "complete" },
+  { code: "sk", englishName: "Slovak", nativeName: "Slovenčina", status: "complete" },
+  { code: "sv", englishName: "Swedish", nativeName: "Svenska", status: "complete" },
+]
+
+export function isSupportedLanguage(value: string | null | undefined): value is LanguageCode {
+  return SUPPORTED_LANGUAGES.some((language) => language.code === value)
+}
+
+export function detectBrowserLanguage(): LanguageCode {
+  if (typeof navigator === "undefined") return DEFAULT_LANGUAGE
+
+  const candidates = [navigator.language, ...(navigator.languages || [])]
+  for (const candidate of candidates) {
+    const code = candidate?.split("-")[0]?.toLowerCase()
+    if (isSupportedLanguage(code)) return code
+  }
+
+  return DEFAULT_LANGUAGE
+}

AppImage/lib/i18n/provider.tsx

@@ -0,0 +1,135 @@
+"use client"
+
+import React, { createContext, useCallback, useContext, useEffect, useMemo, useState } from "react"
+import enMessages from "../../messages/en/common.json"
+import deMessages from "../../messages/de/common.json"
+import esMessages from "../../messages/es/common.json"
+import frMessages from "../../messages/fr/common.json"
+import itMessages from "../../messages/it/common.json"
+import ptMessages from "../../messages/pt/common.json"
+import skMessages from "../../messages/sk/common.json"
+import svMessages from "../../messages/sv/common.json"
+import {
+  DEFAULT_LANGUAGE,
+  LANGUAGE_STORAGE_KEY,
+  type LanguageCode,
+  SUPPORTED_LANGUAGES,
+  detectBrowserLanguage,
+  isSupportedLanguage,
+} from "./languages"
+
+type MessageTree = Record<string, unknown>
+type TranslationParams = Record<string, string | number>
+
+const MESSAGE_CATALOG: Record<LanguageCode, MessageTree> = {
+  en: enMessages as MessageTree,
+  de: deMessages as MessageTree,
+  es: esMessages as MessageTree,
+  fr: frMessages as MessageTree,
+  it: itMessages as MessageTree,
+  pt: ptMessages as MessageTree,
+  sk: skMessages as MessageTree,
+  sv: svMessages as MessageTree,
+}
+
+interface I18nContextValue {
+  language: LanguageCode
+  setLanguage: (language: LanguageCode) => void
+  t: (key: string, params?: TranslationParams) => string
+}
+
+const I18nContext = createContext<I18nContextValue | null>(null)
+
+function getInitialLanguage(): LanguageCode {
+  if (typeof window === "undefined") return DEFAULT_LANGUAGE
+
+  try {
+    const stored = window.localStorage.getItem(LANGUAGE_STORAGE_KEY)
+    if (isSupportedLanguage(stored)) return stored
+  } catch {
+    // localStorage may be unavailable in private browsing.
+  }
+
+  return detectBrowserLanguage()
+}
+
+function getMessage(messages: MessageTree, key: string): string | undefined {
+  const value = key.split(".").reduce<unknown>((cursor, segment) => {
+    if (!cursor || typeof cursor !== "object") return undefined
+    return (cursor as Record<string, unknown>)[segment]
+  }, messages)
+
+  return typeof value === "string" ? value : undefined
+}
+
+function interpolate(template: string, params?: TranslationParams): string {
+  if (!params) return template
+
+  return template.replace(/\{(\w+)\}/g, (match, name) => {
+    const value = params[name]
+    return value === undefined ? match : String(value)
+  })
+}
+
+export function I18nProvider({ children }: { children: React.ReactNode }) {
+  const [language, setLanguageState] = useState<LanguageCode>(DEFAULT_LANGUAGE)
+  const [isHydrated, setIsHydrated] = useState(false)
+
+  useEffect(() => {
+    setLanguageState(getInitialLanguage())
+    setIsHydrated(true)
+  }, [])
+
+  useEffect(() => {
+    if (!isHydrated) return
+
+    document.documentElement.lang = language
+    try {
+      window.localStorage.setItem(LANGUAGE_STORAGE_KEY, language)
+    } catch {
+      // Best-effort; the in-memory language still works for this session.
+    }
+  }, [isHydrated, language])
+
+  useEffect(() => {
+    const onStorage = (event: StorageEvent) => {
+      if (event.key === LANGUAGE_STORAGE_KEY && isSupportedLanguage(event.newValue)) {
+        setLanguageState(event.newValue)
+      }
+    }
+
+    window.addEventListener("storage", onStorage)
+    return () => window.removeEventListener("storage", onStorage)
+  }, [])
+
+  const setLanguage = useCallback((nextLanguage: LanguageCode) => {
+    setLanguageState(nextLanguage)
+  }, [])
+
+  const t = useCallback(
+    (key: string, params?: TranslationParams) => {
+      const localized = getMessage(MESSAGE_CATALOG[language], key)
+      const fallback = getMessage(MESSAGE_CATALOG.en, key)
+      return interpolate(localized ?? fallback ?? key, params)
+    },
+    [language],
+  )
+
+  const value = useMemo<I18nContextValue>(() => ({ language, setLanguage, t }), [language, setLanguage, t])
+
+  return <I18nContext.Provider value={value}>{children}</I18nContext.Provider>
+}
+
+export function useI18n() {
+  const context = useContext(I18nContext)
+  if (!context) {
+    throw new Error("useI18n must be used within I18nProvider")
+  }
+  return context
+}
+
+export function useT() {
+  return useI18n().t
+}
+
+export { SUPPORTED_LANGUAGES }

AppImage/lib/lxc-apps-cache.ts

@@ -0,0 +1,89 @@
+// Shared cross-component cache for the LXC App-tab payload
+// (registered sidecar + cached detection suggestions). Used by both
+// virtual-machines.tsx (which prefetches on modal open and on hover)
+// and lxc-app-panel.tsx (which reads the cache first and only fetches
+// if empty). The in-flight promise map dedups concurrent requests: if
+// the parent already fired a prefetch, the panel awaits the SAME
+// promise instead of duplicating the request against the backend —
+// no more racing fetches on tab switch during a slow first visit.
+
+import { fetchApi } from "./api-config"
+
+export type LxcAppsBundle = {
+  sidecar: any
+  suggestions: any | null
+}
+
+const dataCache = new Map<number, LxcAppsBundle>()
+const inFlight = new Map<number, Promise<LxcAppsBundle | null>>()
+const cacheRevision = new Map<number, number>()
+
+export function getLxcAppsCached(vmid: number): LxcAppsBundle | undefined {
+  return dataCache.get(vmid)
+}
+
+// Write-through after a successful App/Updates mutation.  The API returns the
+// complete sidecar, so evicting this entry would throw away newer data and
+// make the App tab flash "Loading applications..." on its next mount.  Keep
+// the already-fetched suggestions unless the caller explicitly replaces them.
+export function setLxcAppsCached(
+  vmid: number,
+  sidecar: any,
+  suggestions?: any | null,
+): LxcAppsBundle {
+  cacheRevision.set(vmid, (cacheRevision.get(vmid) || 0) + 1)
+  const current = dataCache.get(vmid)
+  const bundle: LxcAppsBundle = {
+    sidecar,
+    suggestions: suggestions === undefined
+      ? (current?.suggestions ?? null)
+      : suggestions,
+  }
+  dataCache.set(vmid, bundle)
+  return bundle
+}
+
+export function fetchLxcApps(vmid: number): Promise<LxcAppsBundle | null> {
+  const existing = inFlight.get(vmid)
+  if (existing) return existing
+  const startedRevision = cacheRevision.get(vmid) || 0
+  const p = Promise.all([
+    fetchApi(`/api/vms/${vmid}/apps`).catch(() => null) as Promise<any>,
+    fetchApi(`/api/vms/${vmid}/apps/suggestions`).catch(() => null) as Promise<any>,
+  ])
+    .then(([sc, sug]) => {
+      if (!sc) return null
+      const bundle: LxcAppsBundle = { sidecar: sc, suggestions: sug }
+      // A successful write may have completed while these GETs were in
+      // flight. Never let that older response overwrite the mutation result.
+      if ((cacheRevision.get(vmid) || 0) !== startedRevision) {
+        return dataCache.get(vmid) ?? null
+      }
+      dataCache.set(vmid, bundle)
+      return bundle
+    })
+    .finally(() => {
+      inFlight.delete(vmid)
+    })
+  inFlight.set(vmid, p)
+  return p
+}
+
+export function invalidateLxcApps(vmid: number): void {
+  cacheRevision.set(vmid, (cacheRevision.get(vmid) || 0) + 1)
+  dataCache.delete(vmid)
+}
+
+// Seed the cache from the bulk modal-cache endpoint. Both registered
+// apps and startup detection suggestions are already in memory, so
+// opening the App tab never starts a discovery scan.
+export function seedLxcAppsCache(
+  vmid: number,
+  sidecar: any,
+  suggestions?: any | null,
+): void {
+  if (!sidecar) return
+  const existing = dataCache.get(vmid)
+  if (existing) return  // per-panel fetch already ran, don't overwrite
+  dataCache.set(vmid, { sidecar, suggestions: suggestions ?? null })
+}

AppImage/lib/pve-tag-color.ts

@@ -0,0 +1,79 @@
+// Proxmox VE tag color scheme — 1:1 port of the algorithm in
+// proxmoxlib.js (`Proxmox.Utils.stringToRGB` +
+// `Proxmox.Utils.getTextContrastClass`). Same input → same color
+// as the PVE web UI, so tags render identically in both places.
+
+export type TagColor = {
+  bg: string      // css `background-color`
+  fg: string      // css `color` — auto-picked for contrast (SAPC)
+  border: string  // css `border-color`
+}
+
+// Verbatim port of stringToRGB from proxmoxlib.js. The `+ 'prox'`
+// suffix, the `<< 5` hash, and the `alpha=0.7 / bg=255` blend
+// keep the output in the [76.5, 255] range per channel — that's
+// why every PVE tag is a "washed" bright color instead of a raw
+// hash-hue.
+function stringToRGB(input: string): [number, number, number] {
+  let hash = 0
+  if (!input) return [255, 255, 255]
+  const source = input + "prox"
+  for (let i = 0; i < source.length; i++) {
+    // eslint-disable-next-line no-bitwise
+    hash = source.charCodeAt(i) + ((hash << 5) - hash)
+    // eslint-disable-next-line no-bitwise
+    hash = hash & hash
+  }
+  const alpha = 0.7
+  const bg = 255
+  return [
+    // eslint-disable-next-line no-bitwise
+    (hash & 255) * alpha + bg * (1 - alpha),
+    // eslint-disable-next-line no-bitwise
+    ((hash >> 8) & 255) * alpha + bg * (1 - alpha),
+    // eslint-disable-next-line no-bitwise
+    ((hash >> 16) & 255) * alpha + bg * (1 - alpha),
+  ]
+}
+
+// SAPC-based light/dark text picker — verbatim port of
+// getTextContrastClass. Same tag → same text color as PVE.
+function getTextContrastClass(rgb: [number, number, number]): "light" | "dark" {
+  const blkThrs = 0.022
+  const blkClmp = 1.414
+  const r = (rgb[0] / 255) ** 2.4
+  const g = (rgb[1] / 255) ** 2.4
+  const b = (rgb[2] / 255) ** 2.4
+  let bg = r * 0.2126729 + g * 0.7151522 + b * 0.072175
+  bg = bg > blkThrs ? bg : bg + (blkThrs - bg) ** blkClmp
+  const contrastLight = bg ** 0.65 - 1
+  const contrastDark = bg ** 0.56 - 0.046134502
+  return Math.abs(contrastLight) >= Math.abs(contrastDark) ? "light" : "dark"
+}
+
+function rgbToCss(rgb: [number, number, number]): string {
+  return `rgb(${Math.round(rgb[0])}, ${Math.round(rgb[1])}, ${Math.round(rgb[2])})`
+}
+
+export function tagToColor(tag: string): TagColor {
+  const rgb = stringToRGB(tag)
+  const bg = rgbToCss(rgb)
+  const fg = getTextContrastClass(rgb) === "light" ? "#ffffff" : "#000000"
+  return { bg, fg, border: bg }
+}
+
+// Split a PVE tags string into an array. PVE separators are ';' and
+// ',' (both accepted); whitespace around tokens is stripped and
+// empty tokens dropped.
+export function parseTags(raw: string | null | undefined): string[] {
+  if (!raw) return []
+  return raw
+    .split(/[;,]/)
+    .map((t) => t.trim())
+    .filter(Boolean)
+}
+
+// Join back into the canonical PVE format (';' separator).
+export function stringifyTags(tags: string[]): string {
+  return tags.map((t) => t.trim()).filter(Boolean).join(";")
+}

AppImage/lib/storage-usage-color.ts

@@ -0,0 +1,48 @@
+// Shared usage-bar palette for storage capacity widgets. Extracted
+// so the Storage page (overview cards + per-storage rows) and the
+// Backups page (Available Archives → per-archive capacity bar) flag
+// a full datastore with the same colour. Previously the Backups bar
+// was hard-coded to blue, so a 100%-full PBS-Cloud appeared in red
+// on Storage and in blue on Backups — same datastore, two different
+// signals.
+//
+// Thresholds: < 75 % blue (normal — no alert), 75–89 % amber,
+// ≥ 90 % red. Matches the Storage page palette: the normal state
+// stays on the project's brand blue and only switches to amber/red
+// when the operator should look at it. Green is reserved for OK
+// signals where green has meaning (SMART status, wear level), not
+// for ambient bars.
+
+export type UsageBarColor = {
+  /** Inline `background` value for SVG / style={} consumers. */
+  hex: string
+  /** Tailwind `bg-*` class for div consumers. */
+  bgClass: string
+  /** Tailwind `text-*` class for "Free" / counters that should
+   *  share the urgency signal. */
+  textClass: string
+}
+
+const BLUE: UsageBarColor = {
+  hex: "#3b82f6",
+  bgClass: "bg-blue-500",
+  // No text-blue override for the "Free" counter — at normal usage
+  // the foreground colour reads better than tinted text.
+  textClass: "",
+}
+const AMBER: UsageBarColor = {
+  hex: "#f59e0b",
+  bgClass: "bg-amber-500",
+  textClass: "text-amber-400",
+}
+const RED: UsageBarColor = {
+  hex: "#ef4444",
+  bgClass: "bg-red-500",
+  textClass: "text-red-400",
+}
+
+export function getStorageUsageColor(percent: number): UsageBarColor {
+  if (percent >= 90) return RED
+  if (percent >= 75) return AMBER
+  return BLUE
+}

AppImage/lib/tab-order.ts

@@ -0,0 +1,132 @@
+import { useEffect, useState, useCallback } from "react"
+
+// Persistent top-level tab order for the Monitor dashboard.
+//
+// Only the seven top-level slots are user-orderable; the internal
+// items of the Node and Admin dropdowns keep their canonical order —
+// grouped items move as a single unit.
+
+export type TabId = "overview" | "apps" | "vms" | "node" | "backup" | "terminal" | "admin"
+
+export const DEFAULT_TAB_ORDER: TabId[] = [
+  "overview",
+  "apps",
+  "vms",
+  "node",
+  "backup",
+  "terminal",
+  "admin",
+]
+
+const STORAGE_KEY = "proxmenux-nav-order"
+const CHANGE_EVENT = "proxmenux-nav-order-changed"
+
+function isTabId(v: unknown): v is TabId {
+  return typeof v === "string" && (DEFAULT_TAB_ORDER as string[]).includes(v)
+}
+
+// Read + normalise: unknown ids are dropped, missing ones are
+// appended in their default position so a future release adding a
+// new tab still surfaces it for users with a stored order.
+export function readTabOrder(): TabId[] {
+  if (typeof window === "undefined") return DEFAULT_TAB_ORDER
+  try {
+    const raw = window.localStorage.getItem(STORAGE_KEY)
+    if (!raw) return DEFAULT_TAB_ORDER
+    const parsed = JSON.parse(raw)
+    if (!Array.isArray(parsed)) return DEFAULT_TAB_ORDER
+    const seen = new Set<TabId>()
+    const clean: TabId[] = []
+    for (const item of parsed) {
+      if (isTabId(item) && !seen.has(item)) {
+        clean.push(item)
+        seen.add(item)
+      }
+    }
+    for (const id of DEFAULT_TAB_ORDER) {
+      if (!seen.has(id)) clean.push(id)
+    }
+    return clean
+  } catch {
+    return DEFAULT_TAB_ORDER
+  }
+}
+
+export function writeTabOrder(order: TabId[]): void {
+  if (typeof window === "undefined") return
+  try {
+    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(order))
+    window.dispatchEvent(new CustomEvent(CHANGE_EVENT))
+  } catch {
+    // Storage full / disabled — the in-memory state still updates.
+  }
+}
+
+// Map a top-level slot id to the concrete `activeTab` value the
+// Tabs component uses. Direct tabs pass through; grouped slots
+// (Node/Admin) resolve to the first child in the dropdown so the
+// dashboard lands on a real tab, not a group header.
+const GROUP_FIRST_CHILD: Record<TabId, string> = {
+  overview: "overview",
+  apps:     "apps",
+  vms:      "vms",
+  node:     "storage",
+  backup:   "backup",
+  terminal: "terminal",
+  admin:    "logs",
+}
+
+export function firstActualTab(order: TabId[] = readTabOrder()): string {
+  const head = order[0]
+  return (head && GROUP_FIRST_CHILD[head]) || "overview"
+}
+
+export function resetTabOrder(): void {
+  if (typeof window === "undefined") return
+  try {
+    window.localStorage.removeItem(STORAGE_KEY)
+    window.dispatchEvent(new CustomEvent(CHANGE_EVENT))
+  } catch {
+    // ignore
+  }
+}
+
+// Hook that keeps every consumer in sync. Firing a custom event on
+// write means the Settings card and the top navigation update in the
+// same tick without prop-drilling.
+export function useTabOrder(): {
+  order: TabId[]
+  setOrder: (next: TabId[]) => void
+  reset: () => void
+  isCustom: boolean
+} {
+  const [order, setOrderState] = useState<TabId[]>(DEFAULT_TAB_ORDER)
+
+  useEffect(() => {
+    setOrderState(readTabOrder())
+    const onChange = () => setOrderState(readTabOrder())
+    window.addEventListener(CHANGE_EVENT, onChange)
+    window.addEventListener("storage", (e) => {
+      if (e.key === STORAGE_KEY) onChange()
+    })
+    return () => {
+      window.removeEventListener(CHANGE_EVENT, onChange)
+    }
+  }, [])
+
+  const setOrder = useCallback((next: TabId[]) => {
+    writeTabOrder(next)
+    setOrderState(next)
+  }, [])
+
+  const reset = useCallback(() => {
+    resetTabOrder()
+    setOrderState(DEFAULT_TAB_ORDER)
+  }, [])
+
+  const isCustom =
+    order.length !== DEFAULT_TAB_ORDER.length ||
+    order.some((id, idx) => id !== DEFAULT_TAB_ORDER[idx])
+
+  return { order, setOrder, reset, isCustom }
+}

AppImage/lib/terminal-clipboard.ts

@@ -0,0 +1,127 @@
+/**
+ * Clipboard helpers for the web terminals.
+ *
+ * Mobile browsers (iOS Safari, Android Chrome) don't expose xterm.js's text
+ * selection / clipboard the same way desktop does, and the mobile toolbar
+ * around our terminals doesn't include explicit copy/paste keys. The helpers
+ * below give the toolbar a robust path that:
+ *   - Uses the modern async Clipboard API on HTTPS / localhost.
+ *   - Falls back to a hidden <textarea> + document.execCommand on plain HTTP
+ *     (where the async API is gated by the secure-context requirement).
+ *   - Surfaces a user-visible cue (no toast manager in this stack yet) by
+ *     returning a result the caller can react to.
+ */
+
+// xterm.js is imported dynamically by the terminal components and the
+// `term` field is typed `any` there. We mirror that here with a minimal
+// structural type so this helper has no hard dependency on @xterm/xterm.
+type XtermLike = { getSelection?: () => string }
+
+export type ClipboardResult = {
+  ok: boolean
+  /** Bytes / chars copied (only meaningful on copy). */
+  length?: number
+  /** Best-effort error string for logging — never surfaced verbatim to the user. */
+  error?: string
+}
+
+/**
+ * Copies the current xterm selection to the clipboard. If there is no active
+ * selection, returns ok=false with length=0 so the caller can decide whether to
+ * show a "select text first" hint.
+ */
+export async function copyTerminalSelection(term: XtermLike | null | undefined): Promise<ClipboardResult> {
+  const text = term?.getSelection?.() ?? ""
+  if (!text) {
+    return { ok: false, length: 0, error: "no-selection" }
+  }
+  return copyText(text)
+}
+
+/**
+ * Reads text from the clipboard and feeds it to the terminal via `sendFn`.
+ * The `sendFn` is the WebSocket sender (or any fn that takes a string and
+ * pushes it to the remote PTY). Any newlines remain intact so that pasting
+ * a multi-line block triggers as Enter on each line — same as desktop xterm.
+ *
+ * Mobile users on plain HTTP (the common case for this dashboard — accessed
+ * via `http://<host>:8008` from an iPad/phone on the LAN) hit two layers of
+ * blocking:
+ *   1. `window.isSecureContext` is false on plain HTTP, so the legacy code
+ *      skipped the async API and surfaced a silent error.
+ *   2. There is no `execCommand('paste')` equivalent that works portably.
+ *
+ * The fix here:
+ *   - Attempt `navigator.clipboard.readText()` even when not secure-context;
+ *     many modern browsers permit it on localhost/LAN with user gesture, and
+ *     when they don't they throw, which falls through cleanly.
+ *   - If that fails / returns empty, fall back to `window.prompt()`. The
+ *     native prompt accepts a long-press paste from the OS clipboard on
+ *     every mobile platform, so the user can finish the paste manually
+ *     with one extra tap. Empty / cancelled prompt returns ok=false.
+ */
+export async function pasteFromClipboard(
+  sendFn: (text: string) => void,
+): Promise<ClipboardResult> {
+  // Path 1 — async Clipboard API. Try regardless of `isSecureContext` so
+  // browsers that allow it on LAN-HTTP (Chrome on Android, Firefox) can
+  // succeed. Throws on iOS Safari / strict configurations — we fall through.
+  try {
+    if (typeof navigator !== "undefined" && navigator.clipboard?.readText) {
+      const text = await navigator.clipboard.readText()
+      if (text) {
+        sendFn(text)
+        return { ok: true, length: text.length }
+      }
+    }
+  } catch {
+    // Permission denied / not focused / insecure context — fall through to prompt().
+  }
+
+  // Path 2 — `window.prompt()` fallback. Universally supported, accepts a
+  // long-press paste from the system clipboard, and works over plain HTTP.
+  // This is the path mobile users without HTTPS rely on.
+  try {
+    const text = typeof window !== "undefined"
+      ? window.prompt("Paste content for the terminal:", "")
+      : null
+    if (text) {
+      sendFn(text)
+      return { ok: true, length: text.length }
+    }
+    return { ok: false, error: "user-cancelled" }
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : "prompt-failed" }
+  }
+}
+
+async function copyText(text: string): Promise<ClipboardResult> {
+  // Preferred path: async Clipboard API on HTTPS / localhost.
+  try {
+    if (typeof navigator !== "undefined" && navigator.clipboard && window.isSecureContext) {
+      await navigator.clipboard.writeText(text)
+      return { ok: true, length: text.length }
+    }
+  } catch {
+    // fall through
+  }
+  // Legacy fallback: hidden textarea + execCommand("copy"). Works on plain HTTP
+  // where the async API is blocked by the secure-context gate.
+  try {
+    const textarea = document.createElement("textarea")
+    textarea.value = text
+    textarea.style.position = "fixed"
+    textarea.style.left = "-9999px"
+    textarea.style.top = "-9999px"
+    textarea.style.opacity = "0"
+    textarea.readOnly = true
+    document.body.appendChild(textarea)
+    textarea.focus()
+    textarea.select()
+    const ok = document.execCommand("copy")
+    document.body.removeChild(textarea)
+    return ok ? { ok: true, length: text.length } : { ok: false, error: "execCommand-failed" }
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : "fallback-failed" }
+  }
+}

AppImage/lib/terminal-ws.ts

@@ -0,0 +1,47 @@
+/**
+ * Helpers for opening WebSocket connections that require a single-use ticket.
+ *
+ * The browser WebSocket API does not allow custom request headers, so the JWT
+ * Bearer token used for REST calls cannot be sent on the handshake. Instead we
+ * POST to /api/terminal/ticket (which does require the Bearer token), receive
+ * a one-shot ticket with TTL ~5s, and append it to the WebSocket URL as a
+ * query parameter. The backend consumes the ticket atomically on handshake.
+ *
+ * See AppImage/scripts/flask_terminal_routes.py — `_issue_terminal_ticket`,
+ * `_consume_terminal_ticket`, `_ws_auth_check`.
+ */
+
+import { fetchApi } from "@/lib/api-config"
+
+type TicketResponse = {
+  success?: boolean
+  ticket?: string
+  ttl_seconds?: number
+}
+
+/**
+ * Fetch a one-shot terminal ticket from the backend. Returns the ticket string
+ * or null if the call fails. Callers should treat null as "open without ticket"
+ * — the backend's _ws_auth_check still accepts unticketed handshakes when auth
+ * is disabled or declined, so a fresh-install / no-auth setup keeps working.
+ */
+export async function fetchTerminalTicket(): Promise<string | null> {
+  try {
+    const res = await fetchApi<TicketResponse>("/api/terminal/ticket", { method: "POST" })
+    return typeof res?.ticket === "string" && res.ticket.length > 0 ? res.ticket : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Take a base WebSocket URL (e.g. "ws://host:8008/ws/terminal") and return a
+ * URL with `?ticket=<value>` appended. If the ticket fetch fails the original
+ * URL is returned unchanged so the handshake can still succeed in unauth mode.
+ */
+export async function getTicketedWsUrl(baseUrl: string): Promise<string> {
+  const ticket = await fetchTerminalTicket()
+  if (!ticket) return baseUrl
+  const sep = baseUrl.includes("?") ? "&" : "?"
+  return `${baseUrl}${sep}ticket=${encodeURIComponent(ticket)}`
+}

AppImage/lib/utils.ts

@@ -19,3 +19,20 @@ export function formatStorage(sizeInGB: number): string {
     return `${tb % 1 === 0 ? tb.toFixed(0) : tb.toFixed(1)} TB`
   }
 }
+
+// Byte-aware formatter. Scales B → KB → MB → GB → TB. Use when the
+// raw value comes in bytes (log file sizes from os.path.getsize(),
+// PBS / Borg datastore capacity reported by the backend in bytes).
+// The Backups page used to ship its own copy that capped at GB, so a
+// 7 TB datastore showed up as "7311.55 GB" — extracted here so it
+// can't drift again.
+export function formatBytes(n: number): string {
+  if (!Number.isFinite(n) || n < 0) return "—"
+  if (n < 1024) return `${n} B`
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`
+  if (n < 1024 * 1024 * 1024) return `${(n / (1024 * 1024)).toFixed(1)} MB`
+  if (n < 1024 * 1024 * 1024 * 1024) {
+    return `${(n / (1024 * 1024 * 1024)).toFixed(2)} GB`
+  }
+  return `${(n / (1024 * 1024 * 1024 * 1024)).toFixed(2)} TB`
+}

AppImage/lib/version.ts

@@ -0,0 +1,11 @@
+// Single source of truth for the app version displayed inside the
+// Monitor. Every component that renders the version (dashboard footer,
+// SMART report footer, release-notes modal…) imports from here so a
+// version bump only has to be applied once per file lane:
+//
+//   1. AppImage/lib/version.ts       ← this file
+//   2. AppImage/package.json         ← npm/Next.js metadata
+//   3. beta_version.txt              ← bash pipeline (build_appimage.sh)
+//
+// Keep the three in sync on every bump.
+export const APP_VERSION = "1.2.5"

AppImage/messages/README.md

@@ -0,0 +1,10 @@
+# Monitor dashboard translations
+
+The ProxMenux Monitor dashboard uses a small client-side i18n layer.
+
+- English (`en`) is the source language and the runtime fallback.
+- Eight locales are shipped and fully populated end-to-end: `en`, `de`, `es`, `fr`, `it`, `pt`, `sk`, `sv`. Non-English catalogs started from an automated bootstrap and are being polished as native speakers pass through them.
+
+To improve a translation, edit the values in your locale's `common.json` — keep placeholders such as `{uptime}`, `{vmid}` or `{count}` unchanged, and don't translate brand or product names (`ProxMenux Monitor`, `Proxmox Backup Server`, `Secure Gateway`, `Tailscale`, etc.). Missing keys fall back to English at runtime, so a partial refresh is always safe to merge.
+
+To add a new locale, see [§11 → Adding a new locale](../../CONTRIBUTING.md#adding-a-new-locale) in the Contributing Guide.