feat(auth): add debug-login bypass endpoint secured by DEBUG_LOGIN_TOKEN

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -6,6 +6,8 @@
 
 # ── Compiled binaries ──────────────────────────────────────────────────────────
 backend/bin/
+backend/backend
+backend/runner
 
 # ── Environment & secrets ──────────────────────────────────────────────────────
 # Secrets are managed by Doppler — never commit .env files.

Caddyfile

@@ -58,16 +58,22 @@
 
 	# ── Redis TCP proxy via layer4 ────────────────────────────────────────────
 	# Exposes prod Redis over TLS for Asynq job enqueueing from the homelab runner.
-	# Listens on :6380 (all interfaces). TLS is terminated here using the cert
+	# Listens on :6380 (all interfaces). TLS is terminated here using the cert
 	# for redis.libnovel.cc; traffic is proxied to the local Redis sidecar.
-	# Requires the caddy-l4 module in the custom Caddy build.
+	# Requires the caddy-l4 module in the custom Caddy build.
 	layer4 {
 		:6380 {
 			route {
 				tls {
-				proxy {
+					connection_policy {
+						match {
+							sni redis.libnovel.cc
+						}
+					}
+				}
+				proxy {
 					upstream redis:6379
-				}
+				}
 			}
 		}
 	}
@@ -274,3 +280,12 @@ search.libnovel.cc {
 	reverse_proxy meilisearch:7700
 }
 
+# ── Redis TLS cert anchor ─────────────────────────────────────────────────────
+# This virtual host exists solely so Caddy obtains and caches a TLS certificate
+# for redis.libnovel.cc.  The layer4 block above uses that cert to terminate TLS
+# on :6380 (Asynq job-queue channel from prod → homelab Redis).
+# The HTTP route itself just returns 404 — no real traffic expected here.
+redis.libnovel.cc {
+	respond 404
+}
+}

backend/cmd/backend/main.go

@@ -134,7 +134,7 @@ func run() error {
 		if parseErr != nil {
 			return fmt.Errorf("parse REDIS_ADDR: %w", parseErr)
 		}
-		asynqProducer := asynqqueue.NewProducer(store, redisOpt)
+		asynqProducer := asynqqueue.NewProducer(store, redisOpt, log)
 		defer asynqProducer.Close() //nolint:errcheck
 		producer = asynqProducer
 		log.Info("backend: asynq task dispatch enabled", "addr", cfg.Redis.Addr)

backend/internal/asynqqueue/producer.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 
 	"github.com/hibiken/asynq"
 	"github.com/libnovel/backend/internal/taskqueue"
@@ -14,13 +15,15 @@ import (
 type Producer struct {
 	pb     taskqueue.Producer // underlying PocketBase producer
 	client *asynq.Client
+	log    *slog.Logger
 }
 
 // NewProducer wraps an existing PocketBase Producer with Asynq dispatch.
-func NewProducer(pb taskqueue.Producer, redisOpt asynq.RedisConnOpt) *Producer {
+func NewProducer(pb taskqueue.Producer, redisOpt asynq.RedisConnOpt, log *slog.Logger) *Producer {
 	return &Producer{
 		pb:     pb,
 		client: asynq.NewClient(redisOpt),
+		log:    log,
 	}
 }
 
@@ -49,7 +52,9 @@ func (p *Producer) CreateScrapeTask(ctx context.Context, kind, targetURL string,
 	}
 	if err := p.enqueue(ctx, taskType, payload); err != nil {
 		// Non-fatal: PB record exists; runner will pick it up on next poll.
-		return id, fmt.Errorf("asynq enqueue scrape (task still in PB): %w", err)
+		p.log.Warn("asynq enqueue scrape failed (task still in PB, runner will poll)",
+			"task_id", id, "err", err)
+		return id, nil
 	}
 	return id, nil
 }
@@ -68,7 +73,10 @@ func (p *Producer) CreateAudioTask(ctx context.Context, slug string, chapter int
 		Voice:    voice,
 	}
 	if err := p.enqueue(ctx, TypeAudioGenerate, payload); err != nil {
-		return id, fmt.Errorf("asynq enqueue audio (task still in PB): %w", err)
+		// Non-fatal: PB record exists; runner will pick it up on next poll.
+		p.log.Warn("asynq enqueue audio failed (task still in PB, runner will poll)",
+			"task_id", id, "err", err)
+		return id, nil
 	}
 	return id, nil
 }

backend/internal/config/config.go

@@ -203,6 +203,11 @@ func Load() Config {
 			URL: envOr("POCKET_TTS_URL", ""),
 		},
 
+		LibreTranslate: LibreTranslate{
+			URL:    envOr("LIBRETRANSLATE_URL", ""),
+			APIKey: envOr("LIBRETRANSLATE_API_KEY", ""),
+		},
+
 		HTTP: HTTP{
 			Addr: envOr("BACKEND_HTTP_ADDR", ":8080"),
 		},

caddy/errors/404.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>404 — Page Not Found — LibNovel</title>
+  <title>404 — Page Not Found — libnovel</title>
   <style>
     *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
 
@@ -27,11 +27,10 @@
     .logo {
       font-size: 1.125rem;
       font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
       letter-spacing: -0.02em;
       text-decoration: none;
     }
-    .logo span { color: #f59e0b; }
 
     main {
       flex: 1;
@@ -114,7 +113,7 @@
 <body>
 
   <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
   </header>
 
   <main>

caddy/errors/500.html

@@ -3,7 +3,8 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>500 — Internal Error — LibNovel</title>
+  <title>500 — Internal Error — libnovel</title>
+  <meta http-equiv="refresh" content="20">
   <style>
     *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
 
@@ -27,11 +28,10 @@
     .logo {
       font-size: 1.125rem;
       font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
       letter-spacing: -0.02em;
       text-decoration: none;
     }
-    .logo span { color: #f59e0b; }
 
     main {
       flex: 1;
@@ -147,7 +147,7 @@
 <body>
 
   <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
   </header>
 
   <main>

caddy/errors/502.html

@@ -3,7 +3,8 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>502 — Service Unavailable — LibNovel</title>
+  <title>502 — Service Unavailable — libnovel</title>
+  <meta http-equiv="refresh" content="20">
   <style>
     *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
 
@@ -27,11 +28,10 @@
     .logo {
       font-size: 1.125rem;
       font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
       letter-spacing: -0.02em;
       text-decoration: none;
     }
-    .logo span { color: #f59e0b; }
 
     main {
       flex: 1;
@@ -126,7 +126,7 @@
 <body>
 
   <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
   </header>
 
   <main>

caddy/errors/503.html

@@ -3,7 +3,8 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Under Maintenance — LibNovel</title>
+  <title>Under Maintenance — libnovel</title>
+  <meta http-equiv="refresh" content="30">
   <style>
     *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
 
@@ -28,11 +29,10 @@
     .logo {
       font-size: 1.125rem;
       font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
       letter-spacing: -0.02em;
       text-decoration: none;
     }
-    .logo span { color: #f59e0b; }
 
     /* ── Main ── */
     main {
@@ -129,7 +129,7 @@
 <body>
 
   <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
   </header>
 
   <main>

caddy/errors/504.html

@@ -3,7 +3,8 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>504 — Gateway Timeout — LibNovel</title>
+  <title>504 — Gateway Timeout — libnovel</title>
+  <meta http-equiv="refresh" content="20">
   <style>
     *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
 
@@ -27,11 +28,10 @@
     .logo {
       font-size: 1.125rem;
       font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
       letter-spacing: -0.02em;
       text-decoration: none;
     }
-    .logo span { color: #f59e0b; }
 
     main {
       flex: 1;
@@ -126,7 +126,7 @@
 <body>
 
   <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
   </header>
 
   <main>

docker-compose.yml

@@ -126,6 +126,26 @@ services:
       timeout: 5s
       retries: 5
 
+  # ─── Redis (Asynq task queue — accessed locally by backend, remotely by homelab runner) ──
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: >
+      redis-server
+      --appendonly yes
+      --requirepass "${REDIS_PASSWORD}"
+    # No public port — backend reaches it via internal network.
+    # Homelab runner reaches it via Caddy TLS proxy on :6380 → redis:6379.
+    expose:
+      - "6379"
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
   # ─── Backend API ──────────────────────────────────────────────────────────────
   backend:
     image: kalekber/libnovel-backend:${GIT_TAG:-latest}
@@ -151,6 +171,8 @@ services:
         condition: service_healthy
       valkey:
         condition: service_healthy
+      redis:
+        condition: service_healthy
     # No public port — all traffic is routed via Caddy.
     expose:
       - "8080"
@@ -164,10 +186,9 @@ services:
       GLITCHTIP_DSN: "${GLITCHTIP_DSN}"
       OTEL_EXPORTER_OTLP_ENDPOINT: "${OTEL_EXPORTER_OTLP_ENDPOINT}"
       OTEL_SERVICE_NAME: "backend"
-      # Asynq task queue — backend enqueues jobs to homelab Redis via Caddy TLS proxy.
-      # Set to "rediss://:password@redis.libnovel.cc:6380" in Doppler prd config.
-      # Leave empty to fall back to PocketBase polling.
-      REDIS_ADDR: "${REDIS_ADDR}"
+      # Asynq task queue — backend enqueues jobs to local Redis sidecar.
+      # Homelab runner connects to the same Redis via Caddy TLS proxy on :6380.
+      REDIS_ADDR: "redis:6379"
       REDIS_PASSWORD: "${REDIS_PASSWORD}"
     healthcheck:
       test: ["CMD", "/healthcheck", "http://localhost:8080/health"]
@@ -269,6 +290,7 @@ services:
       POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
       POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
       AUTH_SECRET: "${AUTH_SECRET}"
+      DEBUG_LOGIN_TOKEN: "${DEBUG_LOGIN_TOKEN}"
       PUBLIC_MINIO_PUBLIC_URL: "${MINIO_PUBLIC_ENDPOINT}"
       # Valkey
       VALKEY_ADDR: "valkey:6379"
@@ -382,12 +404,10 @@ services:
       - "80:80"
       - "443:443"
       - "443:443/udp" # HTTP/3 (QUIC)
-      - "6380:6380"   # Redis TCP proxy (TLS) for homelab → Asynq
+      - "6380:6380"   # Redis TCP proxy (TLS) for homelab runner → Asynq
     environment:
       DOMAIN: "${DOMAIN}"
       CADDY_ACME_EMAIL: "${CADDY_ACME_EMAIL}"
-      # Homelab Redis address — Caddy TCP-proxies inbound :6380 to this.
-      HOMELAB_REDIS_ADDR: "${HOMELAB_REDIS_ADDR:?HOMELAB_REDIS_ADDR required for Redis TCP proxy}"
     env_file:
       - path: ./crowdsec/.crowdsec.env
         required: false
@@ -421,6 +441,7 @@ volumes:
   pb_data:
   meili_data:
   valkey_data:
+  redis_data:
   caddy_data:
   caddy_config:
   caddy_logs:

homelab/docker-compose.yml

@@ -58,6 +58,14 @@ services:
       VALKEY_ADDR: ""
       GODEBUG: "preferIPv4=1"
 
+      # ── LibreTranslate (internal Docker network) ──────────────────────────
+      LIBRETRANSLATE_URL: "http://libretranslate:5000"
+      LIBRETRANSLATE_API_KEY: "${LIBRETRANSLATE_API_KEY}"
+
+      # ── Asynq / Redis ─────────────────────────────────────────────────────
+      REDIS_ADDR: "redis:6379"
+      REDIS_PASSWORD: "${REDIS_PASSWORD}"
+
       KOKORO_URL: "http://kokoro-fastapi:8880"
       KOKORO_VOICE: "${KOKORO_VOICE}"
 
@@ -67,6 +75,7 @@ services:
       RUNNER_POLL_INTERVAL: "${RUNNER_POLL_INTERVAL}"
       RUNNER_MAX_CONCURRENT_SCRAPE: "${RUNNER_MAX_CONCURRENT_SCRAPE}"
       RUNNER_MAX_CONCURRENT_AUDIO: "${RUNNER_MAX_CONCURRENT_AUDIO}"
+      RUNNER_MAX_CONCURRENT_TRANSLATION: "${RUNNER_MAX_CONCURRENT_TRANSLATION}"
       RUNNER_TIMEOUT: "${RUNNER_TIMEOUT}"
       RUNNER_METRICS_ADDR: "${RUNNER_METRICS_ADDR}"
       RUNNER_SKIP_INITIAL_CATALOGUE_REFRESH: "true"
@@ -280,6 +289,48 @@ services:
       timeout: 5s
       retries: 5
 
+  # ── Redis (Asynq task queue) ────────────────────────────────────────────────
+  # Dedicated Redis instance for Asynq job dispatch.
+  # The prod backend enqueues jobs via redis.libnovel.cc:6380 (Caddy TLS proxy →
+  # host:6379). The runner reads from this instance directly on the Docker network.
+  # Port is bound to 0.0.0.0:6379 so the Caddy layer4 proxy on prod can reach it.
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # ── LibreTranslate ──────────────────────────────────────────────────────────
+  # Self-hosted machine translation. Runner connects via http://libretranslate:5000.
+  # Only English → configured target languages are loaded to save RAM.
+  libretranslate:
+    image: libretranslate/libretranslate:latest
+    restart: unless-stopped
+    environment:
+      LT_API_KEYS: "true"
+      LT_API_KEYS_DB_PATH: "/app/db/api_keys.db"
+      LT_LOAD_ONLY: "en,ru,id,pt,fr"
+      LT_DISABLE_WEB_UI: "true"
+      LT_UPDATE_MODELS: "false"
+    expose:
+      - "5000"
+    volumes:
+      - libretranslate_data:/app/db
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:5000/languages"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
   # ── Valkey ──────────────────────────────────────────────────────────────────
   # Used by GlitchTip for task queuing.
   valkey:
@@ -460,6 +511,8 @@ services:
 
 volumes:
   postgres_data:
+  redis_data:
+  libretranslate_data:
   valkey_data:
   uptime_kuma_data:
   gotify_data:

homelab/runner/docker-compose.yml

@@ -11,25 +11,10 @@
 #   - MEILI_URL               → https://search.libnovel.cc (Caddy-proxied)
 #   - VALKEY_ADDR             → unset (not exposed publicly)
 #   - RUNNER_SKIP_INITIAL_CATALOGUE_REFRESH=true
-#   - Redis service for Asynq task queue (local to homelab, exposed to prod via Caddy TCP proxy)
+#   - REDIS_ADDR              → rediss://redis.libnovel.cc:6380 (prod Redis via Caddy TLS proxy)
 #   - LibreTranslate service for machine translation (internal network only)
 
 services:
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    volumes:
-      - redis_data:/data
-    command: >
-      redis-server
-      --appendonly yes
-      --requirepass "${REDIS_PASSWORD}"
-    healthcheck:
-      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
   libretranslate:
     image: libretranslate/libretranslate:latest
     restart: unless-stopped
@@ -55,8 +40,6 @@ services:
     restart: unless-stopped
     stop_grace_period: 135s
     depends_on:
-      redis:
-        condition: service_healthy
       libretranslate:
         condition: service_healthy
     environment:
@@ -91,9 +74,10 @@ services:
       LIBRETRANSLATE_URL: "http://libretranslate:5000"
       LIBRETRANSLATE_API_KEY: "${LIBRETRANSLATE_API_KEY}"
 
-      # ── Asynq / Redis (local service) ───────────────────────────────────────
-      # The runner connects to the local Redis sidecar.
-      REDIS_ADDR: "redis:6379"
+      # ── Asynq / Redis (prod Redis via Caddy TLS proxy) ──────────────────────
+      # The runner connects to prod Redis over TLS: rediss://redis.libnovel.cc:6380.
+      # Caddy on prod terminates TLS and proxies to the local redis:6379 sidecar.
+      REDIS_ADDR: "${REDIS_ADDR}"
       REDIS_PASSWORD: "${REDIS_PASSWORD}"
 
       # ── Runner tuning ───────────────────────────────────────────────────────
@@ -117,6 +101,5 @@ services:
       retries: 3
 
 volumes:
-  redis_data:
   libretranslate_models:
   libretranslate_db:

ui/messages/en.json

@@ -357,6 +357,16 @@
 
   "admin_pages_label": "Pages",
   "admin_tools_label": "Tools",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Audio",
+  "admin_nav_translation": "Translation",
+  "admin_nav_changelog": "Changelog",
+  "admin_nav_feedback": "Feedback",
+  "admin_nav_errors": "Errors",
+  "admin_nav_analytics": "Analytics",
+  "admin_nav_logs": "Logs",
+  "admin_nav_uptime": "Uptime",
+  "admin_nav_push": "Push",
 
   "admin_scrape_status_idle": "Idle",
   "admin_scrape_status_running": "Running",

ui/messages/fr.json

@@ -357,6 +357,16 @@
 
   "admin_pages_label": "Pages",
   "admin_tools_label": "Outils",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Audio",
+  "admin_nav_translation": "Traduction",
+  "admin_nav_changelog": "Modifications",
+  "admin_nav_feedback": "Retours",
+  "admin_nav_errors": "Erreurs",
+  "admin_nav_analytics": "Analytique",
+  "admin_nav_logs": "Journaux",
+  "admin_nav_uptime": "Disponibilité",
+  "admin_nav_push": "Notifications",
 
   "admin_scrape_status_idle": "Inactif",
   "admin_scrape_full_catalogue": "Catalogue complet",

ui/messages/id.json

@@ -357,6 +357,16 @@
 
   "admin_pages_label": "Halaman",
   "admin_tools_label": "Alat",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Audio",
+  "admin_nav_translation": "Terjemahan",
+  "admin_nav_changelog": "Perubahan",
+  "admin_nav_feedback": "Masukan",
+  "admin_nav_errors": "Kesalahan",
+  "admin_nav_analytics": "Analitik",
+  "admin_nav_logs": "Log",
+  "admin_nav_uptime": "Uptime",
+  "admin_nav_push": "Notifikasi",
 
   "admin_scrape_status_idle": "Menunggu",
   "admin_scrape_full_catalogue": "Katalog penuh",

ui/messages/pt.json

@@ -357,6 +357,16 @@
 
   "admin_pages_label": "Páginas",
   "admin_tools_label": "Ferramentas",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Áudio",
+  "admin_nav_translation": "Tradução",
+  "admin_nav_changelog": "Alterações",
+  "admin_nav_feedback": "Feedback",
+  "admin_nav_errors": "Erros",
+  "admin_nav_analytics": "Análise",
+  "admin_nav_logs": "Logs",
+  "admin_nav_uptime": "Uptime",
+  "admin_nav_push": "Notificações",
 
   "admin_scrape_status_idle": "Ocioso",
   "admin_scrape_full_catalogue": "Catálogo completo",

ui/messages/ru.json

@@ -357,6 +357,16 @@
 
   "admin_pages_label": "Страницы",
   "admin_tools_label": "Инструменты",
+  "admin_nav_scrape": "Скрейпинг",
+  "admin_nav_audio": "Аудио",
+  "admin_nav_translation": "Перевод",
+  "admin_nav_changelog": "Изменения",
+  "admin_nav_feedback": "Отзывы",
+  "admin_nav_errors": "Ошибки",
+  "admin_nav_analytics": "Аналитика",
+  "admin_nav_logs": "Логи",
+  "admin_nav_uptime": "Мониторинг",
+  "admin_nav_push": "Уведомления",
 
   "admin_scrape_status_idle": "Ожидание",
   "admin_scrape_full_catalogue": "Полный каталог",

ui/src/lib/paraglide/messages/_index.js

@@ -328,6 +328,16 @@ export * from './user_following_label.js'
 export * from './user_no_books.js'
 export * from './admin_pages_label.js'
 export * from './admin_tools_label.js'
+export * from './admin_nav_scrape.js'
+export * from './admin_nav_audio.js'
+export * from './admin_nav_translation.js'
+export * from './admin_nav_changelog.js'
+export * from './admin_nav_feedback.js'
+export * from './admin_nav_errors.js'
+export * from './admin_nav_analytics.js'
+export * from './admin_nav_logs.js'
+export * from './admin_nav_uptime.js'
+export * from './admin_nav_push.js'
 export * from './admin_scrape_status_idle.js'
 export * from './admin_scrape_full_catalogue.js'
 export * from './admin_scrape_single_book.js'

ui/src/lib/paraglide/messages/admin_nav_analytics.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_AnalyticsInputs */
+
+const en_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Analytics`);
+const ru_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Аналитика`);
+const id_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Analitik`);
+const pt_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Análise`);
+const fr_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Analytique`);
+
+export const admin_nav_analytics = /** @type {((inputs?: Admin_Nav_AnalyticsInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_AnalyticsInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_analytics(inputs)
+	if (locale === "ru") return ru_admin_nav_analytics(inputs)
+	if (locale === "id") return id_admin_nav_analytics(inputs)
+	if (locale === "pt") return pt_admin_nav_analytics(inputs)
+	return fr_admin_nav_analytics(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_audio.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_AudioInputs */
+
+const en_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Audio`);
+const ru_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Аудио`);
+const id_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Audio`);
+const pt_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Áudio`);
+const fr_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Audio`);
+
+export const admin_nav_audio = /** @type {((inputs?: Admin_Nav_AudioInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_AudioInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_audio(inputs)
+	if (locale === "ru") return ru_admin_nav_audio(inputs)
+	if (locale === "id") return id_admin_nav_audio(inputs)
+	if (locale === "pt") return pt_admin_nav_audio(inputs)
+	return fr_admin_nav_audio(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_changelog.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_ChangelogInputs */
+
+const en_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Changelog`);
+const ru_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Изменения`);
+const id_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Perubahan`);
+const pt_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Alterações`);
+const fr_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Modifications`);
+
+export const admin_nav_changelog = /** @type {((inputs?: Admin_Nav_ChangelogInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_ChangelogInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_changelog(inputs)
+	if (locale === "ru") return ru_admin_nav_changelog(inputs)
+	if (locale === "id") return id_admin_nav_changelog(inputs)
+	if (locale === "pt") return pt_admin_nav_changelog(inputs)
+	return fr_admin_nav_changelog(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_errors.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_ErrorsInputs */
+
+const en_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Errors`);
+const ru_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Ошибки`);
+const id_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Kesalahan`);
+const pt_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Erros`);
+const fr_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Erreurs`);
+
+export const admin_nav_errors = /** @type {((inputs?: Admin_Nav_ErrorsInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_ErrorsInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_errors(inputs)
+	if (locale === "ru") return ru_admin_nav_errors(inputs)
+	if (locale === "id") return id_admin_nav_errors(inputs)
+	if (locale === "pt") return pt_admin_nav_errors(inputs)
+	return fr_admin_nav_errors(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_feedback.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_FeedbackInputs */
+
+const en_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Feedback`);
+const ru_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Отзывы`);
+const id_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Masukan`);
+const pt_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Feedback`);
+const fr_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Retours`);
+
+export const admin_nav_feedback = /** @type {((inputs?: Admin_Nav_FeedbackInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_FeedbackInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_feedback(inputs)
+	if (locale === "ru") return ru_admin_nav_feedback(inputs)
+	if (locale === "id") return id_admin_nav_feedback(inputs)
+	if (locale === "pt") return pt_admin_nav_feedback(inputs)
+	return fr_admin_nav_feedback(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_logs.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_LogsInputs */
+
+const en_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Logs`);
+const ru_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Логи`);
+const id_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Log`);
+const pt_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Logs`);
+const fr_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Journaux`);
+
+export const admin_nav_logs = /** @type {((inputs?: Admin_Nav_LogsInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_LogsInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_logs(inputs)
+	if (locale === "ru") return ru_admin_nav_logs(inputs)
+	if (locale === "id") return id_admin_nav_logs(inputs)
+	if (locale === "pt") return pt_admin_nav_logs(inputs)
+	return fr_admin_nav_logs(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_push.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_PushInputs */
+
+const en_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Push`);
+const ru_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Уведомления`);
+const id_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Notifikasi`);
+const pt_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Notificações`);
+const fr_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Notifications`);
+
+export const admin_nav_push = /** @type {((inputs?: Admin_Nav_PushInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_PushInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_push(inputs)
+	if (locale === "ru") return ru_admin_nav_push(inputs)
+	if (locale === "id") return id_admin_nav_push(inputs)
+	if (locale === "pt") return pt_admin_nav_push(inputs)
+	return fr_admin_nav_push(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_scrape.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_ScrapeInputs */
+
+const en_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+const ru_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Скрейпинг`);
+const id_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+const pt_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+const fr_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+
+export const admin_nav_scrape = /** @type {((inputs?: Admin_Nav_ScrapeInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_ScrapeInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_scrape(inputs)
+	if (locale === "ru") return ru_admin_nav_scrape(inputs)
+	if (locale === "id") return id_admin_nav_scrape(inputs)
+	if (locale === "pt") return pt_admin_nav_scrape(inputs)
+	return fr_admin_nav_scrape(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_translation.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_TranslationInputs */
+
+const en_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Translation`);
+const ru_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Перевод`);
+const id_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Terjemahan`);
+const pt_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Tradução`);
+const fr_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Traduction`);
+
+export const admin_nav_translation = /** @type {((inputs?: Admin_Nav_TranslationInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_TranslationInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_translation(inputs)
+	if (locale === "ru") return ru_admin_nav_translation(inputs)
+	if (locale === "id") return id_admin_nav_translation(inputs)
+	if (locale === "pt") return pt_admin_nav_translation(inputs)
+	return fr_admin_nav_translation(inputs)
+});

ui/src/lib/paraglide/messages/admin_nav_uptime.js

@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_UptimeInputs */
+
+const en_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Uptime`);
+const ru_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Мониторинг`);
+const id_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Uptime`);
+const pt_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Uptime`);
+const fr_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Disponibilité`);
+
+export const admin_nav_uptime = /** @type {((inputs?: Admin_Nav_UptimeInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_UptimeInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_uptime(inputs)
+	if (locale === "ru") return ru_admin_nav_uptime(inputs)
+	if (locale === "id") return id_admin_nav_uptime(inputs)
+	if (locale === "pt") return pt_admin_nav_uptime(inputs)
+	return fr_admin_nav_uptime(inputs)
+});

ui/src/routes/+layout.svelte

@@ -20,6 +20,7 @@
 	// Desktop dropdown menus
 	let userMenuOpen = $state(false);
 	let langMenuOpen = $state(false);
+	let themeMenuOpen = $state(false);
 
 	const THEMES = [
 		{ id: 'amber',       color: '#f59e0b' },
@@ -316,38 +317,52 @@
 				{m.nav_feedback()}
 			</a>
 
-				<div class="ml-auto flex items-center gap-2">
-					<!-- Theme dots (desktop) -->
-					<div class="hidden sm:flex items-center gap-1 mr-1">
-						{#each THEMES as t, i}
-							{#if i === 3}
-								<span class="w-px h-3 bg-(--color-border) mx-0.5"></span>
-							{/if}
-							<button
-								type="button"
-								onclick={() => { currentTheme = t.id; }}
-								title={t.id}
-								class="w-3.5 h-3.5 rounded-full border-2 transition-all {currentTheme === t.id ? 'border-(--color-text) scale-110' : t.light ? 'border-(--color-border) opacity-70 hover:opacity-100' : 'border-transparent opacity-50 hover:opacity-100'}"
-								style="background: {t.color};"
-							></button>
-						{/each}
-					</div>
+			<div class="ml-auto flex items-center gap-2">
+				<!-- Theme dropdown (desktop) -->
+				<div class="hidden sm:block relative">
+					<button
+						type="button"
+						onclick={() => { themeMenuOpen = !themeMenuOpen; langMenuOpen = false; userMenuOpen = false; }}
+						title="Theme"
+						class="flex items-center justify-center w-7 h-7 rounded transition-colors {themeMenuOpen ? 'bg-(--color-surface-2)' : 'hover:bg-(--color-surface-2)'}"
+					>
+						<span
+							class="w-3.5 h-3.5 rounded-full border-2 border-(--color-text) shrink-0"
+							style="background: {THEMES.find(t => t.id === currentTheme)?.color ?? '#f59e0b'};"
+						></span>
+					</button>
+					{#if themeMenuOpen}
+						<div class="absolute right-0 top-full mt-1 bg-(--color-surface-2) border border-(--color-border) rounded-lg shadow-xl py-2 px-2.5 z-50">
+							<div class="flex items-center gap-1.5">
+								{#each THEMES as t, i}
+									{#if i === 3}
+										<span class="w-px h-3 bg-(--color-border) mx-0.5"></span>
+									{/if}
+									<button
+										type="button"
+										onclick={() => { currentTheme = t.id; themeMenuOpen = false; }}
+										title={t.id}
+										class="w-4 h-4 rounded-full border-2 transition-all {currentTheme === t.id ? 'border-(--color-text) scale-110' : t.light ? 'border-(--color-border) opacity-70 hover:opacity-100' : 'border-transparent opacity-50 hover:opacity-100'}"
+										style="background: {t.color};"
+									></button>
+								{/each}
+							</div>
+						</div>
+					{/if}
+				</div>
 
-					<!-- Language dropdown (desktop) -->
-					<div class="hidden sm:block relative">
-						<button
-							type="button"
-							onclick={() => { langMenuOpen = !langMenuOpen; userMenuOpen = false; }}
-							class="flex items-center gap-1 px-2 py-1 rounded text-xs font-mono transition-colors {langMenuOpen ? 'bg-(--color-surface-2) text-(--color-text)' : 'text-(--color-muted) hover:bg-(--color-surface-2) hover:text-(--color-text)'}"
-						>
-							<svg class="w-3.5 h-3.5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-								<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/>
-							</svg>
-							{getLocale().toUpperCase()}
-							<svg class="w-3 h-3 shrink-0 transition-transform {langMenuOpen ? 'rotate-180' : ''}" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-								<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
-							</svg>
-						</button>
+				<!-- Language dropdown (desktop) -->
+				<div class="hidden sm:block relative">
+					<button
+						type="button"
+						onclick={() => { langMenuOpen = !langMenuOpen; userMenuOpen = false; themeMenuOpen = false; }}
+						class="flex items-center gap-1 px-2 py-1 rounded text-xs font-mono transition-colors {langMenuOpen ? 'bg-(--color-surface-2) text-(--color-text)' : 'text-(--color-muted) hover:bg-(--color-surface-2) hover:text-(--color-text)'}"
+					>
+						<svg class="w-3.5 h-3.5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+							<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/>
+						</svg>
+						{getLocale().toUpperCase()}
+					</button>
 						{#if langMenuOpen}
 							<div class="absolute right-0 top-full mt-1 bg-(--color-surface-2) border border-(--color-border) rounded-lg shadow-xl py-1 z-50 min-w-[80px]">
 								{#each locales as locale}
@@ -372,20 +387,17 @@
 						{/if}
 					</div>
 
-					<!-- User menu dropdown (desktop) -->
-					<div class="hidden sm:block relative">
-						<button
-							type="button"
-							onclick={() => { userMenuOpen = !userMenuOpen; langMenuOpen = false; }}
-							class="flex items-center gap-1.5 pl-1.5 pr-2 py-1 rounded transition-colors {userMenuOpen ? 'bg-(--color-surface-2)' : 'hover:bg-(--color-surface-2)'}"
-						>
-							<span class="w-6 h-6 rounded-full bg-(--color-brand)/20 text-(--color-brand) text-xs font-bold flex items-center justify-center shrink-0">
-								{data.user.username[0].toUpperCase()}
-							</span>
-							<svg class="w-3 h-3 text-(--color-muted) transition-transform {userMenuOpen ? 'rotate-180' : ''}" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-								<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
-							</svg>
-						</button>
+				<!-- User menu dropdown (desktop) -->
+				<div class="hidden sm:block relative">
+					<button
+						type="button"
+						onclick={() => { userMenuOpen = !userMenuOpen; langMenuOpen = false; themeMenuOpen = false; }}
+						class="flex items-center gap-1.5 pl-1.5 pr-1.5 py-1 rounded transition-colors {userMenuOpen ? 'bg-(--color-surface-2)' : 'hover:bg-(--color-surface-2)'}"
+					>
+						<span class="w-6 h-6 rounded-full bg-(--color-brand)/20 text-(--color-brand) text-xs font-bold flex items-center justify-center shrink-0">
+							{data.user.username[0].toUpperCase()}
+						</span>
+					</button>
 						{#if userMenuOpen}
 							<div class="absolute right-0 top-full mt-1 bg-(--color-surface-2) border border-(--color-border) rounded-lg shadow-xl py-1 z-50 min-w-[170px]">
 								<a

ui/src/routes/admin/+layout.svelte

@@ -3,30 +3,48 @@
 	import * as m from '$lib/paraglide/messages.js';
 
 	const internalLinks = [
-		{ href: '/admin/scrape', label: 'Scrape' },
-		{ href: '/admin/audio', label: 'Audio' },
-		{ href: '/admin/translation', label: 'Translation' },
-		{ href: '/admin/changelog', label: 'Changelog' }
+		{ href: '/admin/scrape', label: () => m.admin_nav_scrape() },
+		{ href: '/admin/audio', label: () => m.admin_nav_audio() },
+		{ href: '/admin/translation', label: () => m.admin_nav_translation() },
+		{ href: '/admin/changelog', label: () => m.admin_nav_changelog() }
 	];
 
 	const externalLinks = [
-		{ href: 'https://feedback.libnovel.cc', label: 'Feedback' },
-		{ href: 'https://errors.libnovel.cc', label: 'Errors' },
-		{ href: 'https://analytics.libnovel.cc', label: 'Analytics' },
-		{ href: 'https://logs.libnovel.cc', label: 'Logs' },
-		{ href: 'https://uptime.libnovel.cc', label: 'Uptime' },
-		{ href: 'https://push.libnovel.cc', label: 'Push' }
+		{ href: 'https://feedback.libnovel.cc', label: () => m.admin_nav_feedback() },
+		{ href: 'https://errors.libnovel.cc', label: () => m.admin_nav_errors() },
+		{ href: 'https://analytics.libnovel.cc', label: () => m.admin_nav_analytics() },
+		{ href: 'https://logs.libnovel.cc', label: () => m.admin_nav_logs() },
+		{ href: 'https://uptime.libnovel.cc', label: () => m.admin_nav_uptime() },
+		{ href: 'https://push.libnovel.cc', label: () => m.admin_nav_push() }
 	];
 
 	interface Props {
 		children?: import('svelte').Snippet;
 	}
 	let { children }: Props = $props();
+
+	let sidebarOpen = $state(false);
 </script>
 
+<!-- Mobile sidebar overlay -->
+{#if sidebarOpen}
+	<button
+		class="fixed inset-0 z-40 bg-black/50 md:hidden"
+		onclick={() => (sidebarOpen = false)}
+		aria-label="Close sidebar"
+	></button>
+{/if}
+
 <div class="flex min-h-[calc(100vh-4rem)] gap-0">
 	<!-- Sidebar -->
-	<aside class="w-48 shrink-0 border-r border-(--color-border) px-3 py-6 flex flex-col gap-6">
+	<aside
+		class="
+			fixed top-0 left-0 h-full z-50 w-56 shrink-0 border-r border-(--color-border) px-3 py-6 flex flex-col gap-6
+			bg-(--color-surface) transition-transform duration-200
+			{sidebarOpen ? 'translate-x-0' : '-translate-x-full'}
+			md:relative md:translate-x-0 md:w-48 md:z-auto md:top-auto md:h-auto
+		"
+	>
 		<!-- Internal pages -->
 		<div>
 			<p class="px-2 mb-2 text-xs font-semibold text-(--color-muted) uppercase tracking-widest">{m.admin_pages_label()}</p>
@@ -34,12 +52,13 @@
 				{#each internalLinks as link}
 					<a
 						href={link.href}
+						onclick={() => (sidebarOpen = false)}
 						class="px-2 py-1.5 rounded-md text-sm font-medium transition-colors
 							{page.url.pathname.startsWith(link.href)
 								? 'bg-(--color-surface-2) text-(--color-text)'
 								: 'text-(--color-muted) hover:bg-(--color-surface-2)/60 hover:text-(--color-text)'}"
 					>
-						{link.label}
+					{link.label()}
 					</a>
 				{/each}
 			</nav>
@@ -56,7 +75,7 @@
 						rel="noopener noreferrer"
 						class="px-2 py-1.5 rounded-md text-sm font-medium text-(--color-muted) hover:bg-(--color-surface-2)/60 hover:text-(--color-text) transition-colors flex items-center justify-between"
 					>
-						{link.label}
+						{link.label()}
 						<svg class="w-3 h-3 shrink-0 opacity-50" fill="none" stroke="currentColor" viewBox="0 0 24 24">
 							<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
 								d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" />
@@ -68,7 +87,19 @@
 	</aside>
 
 	<!-- Main content -->
-	<main class="flex-1 min-w-0 px-8 py-6">
+	<main class="flex-1 min-w-0 px-4 py-6 md:px-8">
+		<!-- Mobile nav toggle -->
+		<button
+			onclick={() => (sidebarOpen = true)}
+			class="md:hidden mb-4 flex items-center gap-2 text-sm text-(--color-muted) hover:text-(--color-text) transition-colors"
+			aria-label="Open navigation"
+		>
+			<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+				<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16" />
+			</svg>
+			Admin menu
+		</button>
+
 		{@render children?.()}
 	</main>
 </div>

ui/src/routes/api/auth/debug-login/+server.ts

@@ -0,0 +1,73 @@
+import { redirect, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { getUserByUsername, createUserSession } from '$lib/server/pocketbase';
+import { createAuthToken } from '../../../../hooks.server';
+import { env } from '$env/dynamic/private';
+import { log } from '$lib/server/logger';
+import { randomBytes } from 'node:crypto';
+
+const AUTH_COOKIE = 'libnovel_auth';
+const ONE_YEAR = 60 * 60 * 24 * 365;
+
+/**
+ * GET /api/auth/debug-login?token=<DEBUG_LOGIN_TOKEN>&username=<username>
+ *
+ * One-shot debug bypass: verifies a shared secret token, then mints a real
+ * auth cookie for the given user (defaults to the first admin account) and
+ * redirects to /.
+ *
+ * Requires DEBUG_LOGIN_TOKEN env var to be set. Disabled (404) when the var
+ * is absent or empty.
+ */
+export const GET: RequestHandler = async ({ url, cookies, request }) => {
+	const debugToken = env.DEBUG_LOGIN_TOKEN ?? '';
+	if (!debugToken) {
+		error(404, 'Not found');
+	}
+
+	const provided = url.searchParams.get('token') ?? '';
+	// Constant-time comparison to prevent timing attacks
+	if (provided.length !== debugToken.length) {
+		log.warn('api/auth/debug-login', 'bad token attempt');
+		error(401, 'Invalid token');
+	}
+	let diff = 0;
+	for (let i = 0; i < debugToken.length; i++) {
+		diff |= provided.charCodeAt(i) ^ debugToken.charCodeAt(i);
+	}
+	if (diff !== 0) {
+		log.warn('api/auth/debug-login', 'bad token attempt');
+		error(401, 'Invalid token');
+	}
+
+	const username = url.searchParams.get('username') ?? 'kamil_alekber_2e99';
+	const user = await getUserByUsername(username);
+	if (!user) {
+		error(404, `User '${username}' not found`);
+	}
+
+	const authSessionId = randomBytes(16).toString('hex');
+	const userAgent = request.headers.get('user-agent') ?? '';
+	const ip =
+		request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??
+		request.headers.get('x-real-ip') ??
+		'debug';
+
+	createUserSession(user.id, authSessionId, userAgent, ip).catch((e) =>
+		log.warn('api/auth/debug-login', 'createUserSession failed (non-fatal)', { err: String(e) })
+	);
+
+	const token = createAuthToken(user.id, user.username, user.role ?? 'user', authSessionId);
+
+	cookies.set(AUTH_COOKIE, token, {
+		path: '/',
+		httpOnly: true,
+		sameSite: 'lax',
+		maxAge: ONE_YEAR
+	});
+
+	log.info('api/auth/debug-login', 'debug login used', { username: user.username, ip });
+
+	const next = url.searchParams.get('next') ?? '/';
+	redirect(302, next);
+};