feat(payments): fix Polar webhook + pre-fill checkout email

- Fix customer email path: was data.customer_email, is actually data.customer.email per Polar v1 API schema - Add resolveUser() helper: tries polar_customer_id → email → external_id - Add subscription.active and subscription.canceled event handling - Handle order.created for fast-path pro upgrade on purchase - Profile page: fetch user email + polarCustomerId from PocketBase - Profile page: pre-fill ?customer_email= on checkout links - Profile page: link to polar.sh/purchases for existing customers
fix(infra): fix libretranslate healthcheck; fix scrollbar-none css
2026-03-31 23:11:34 +05:00 · 2026-03-31 22:36:19 +05:00 · 2026-03-31 22:33:39 +05:00 · 2026-03-31 21:59:58 +05:00 · 2026-03-31 18:53:58 +05:00 · 2026-03-31 18:26:32 +05:00
41 changed files with 732 additions and 148 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,8 @@

 # ── Compiled binaries ──────────────────────────────────────────────────────────
 backend/bin/
+backend/backend
+backend/runner

 # ── Environment & secrets ──────────────────────────────────────────────────────
 # Secrets are managed by Doppler — never commit .env files.
--- a/6
+++ b/6
@@ -58,9 +58,9 @@

 	# ── Redis TCP proxy via layer4 ────────────────────────────────────────────
 	# Exposes prod Redis over TLS for Asynq job enqueueing from the homelab runner.
-	# Listens on :6380 (all interfaces). TLS is terminated here using the cert
+	# Listens on :6380 (all interfaces). TLS is terminated here using the cert
 	# for redis.libnovel.cc; traffic is proxied to the local Redis sidecar.
-	# Requires the caddy-l4 module in the custom Caddy build.
+	# Requires the caddy-l4 module in the custom Caddy build.
 	layer4 {
 		:6380 {
 			route {
@@ -73,7 +73,7 @@
 				}
 				proxy {
 					upstream redis:6379
-				}
+				}
 			}
 		}
 	}
--- a/backend/backend
+++ b/backend/backend
--- a/backend/cmd/backend/main.go
+++ b/backend/cmd/backend/main.go
@@ -134,7 +134,7 @@ func run() error {
 		if parseErr != nil {
 			return fmt.Errorf("parse REDIS_ADDR: %w", parseErr)
 		}
-		asynqProducer := asynqqueue.NewProducer(store, redisOpt)
+		asynqProducer := asynqqueue.NewProducer(store, redisOpt, log)
 		defer asynqProducer.Close() //nolint:errcheck
 		producer = asynqProducer
 		log.Info("backend: asynq task dispatch enabled", "addr", cfg.Redis.Addr)
--- a/backend/internal/asynqqueue/producer.go
+++ b/backend/internal/asynqqueue/producer.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"

 	"github.com/hibiken/asynq"
 	"github.com/libnovel/backend/internal/taskqueue"
@@ -14,13 +15,15 @@ import (
 type Producer struct {
 	pb     taskqueue.Producer // underlying PocketBase producer
 	client *asynq.Client
+	log    *slog.Logger
 }

 // NewProducer wraps an existing PocketBase Producer with Asynq dispatch.
-func NewProducer(pb taskqueue.Producer, redisOpt asynq.RedisConnOpt) *Producer {
+func NewProducer(pb taskqueue.Producer, redisOpt asynq.RedisConnOpt, log *slog.Logger) *Producer {
 	return &Producer{
 		pb:     pb,
 		client: asynq.NewClient(redisOpt),
+		log:    log,
 	}
 }

@@ -49,7 +52,9 @@ func (p *Producer) CreateScrapeTask(ctx context.Context, kind, targetURL string,
 	}
 	if err := p.enqueue(ctx, taskType, payload); err != nil {
 		// Non-fatal: PB record exists; runner will pick it up on next poll.
-		return id, fmt.Errorf("asynq enqueue scrape (task still in PB): %w", err)
+		p.log.Warn("asynq enqueue scrape failed (task still in PB, runner will poll)",
+			"task_id", id, "err", err)
+		return id, nil
 	}
 	return id, nil
 }
@@ -68,7 +73,10 @@ func (p *Producer) CreateAudioTask(ctx context.Context, slug string, chapter int
 		Voice:    voice,
 	}
 	if err := p.enqueue(ctx, TypeAudioGenerate, payload); err != nil {
-		return id, fmt.Errorf("asynq enqueue audio (task still in PB): %w", err)
+		// Non-fatal: PB record exists; runner will pick it up on next poll.
+		p.log.Warn("asynq enqueue audio failed (task still in PB, runner will poll)",
+			"task_id", id, "err", err)
+		return id, nil
 	}
 	return id, nil
 }
--- a/backend/internal/config/config.go
+++ b/backend/internal/config/config.go
@@ -203,6 +203,11 @@ func Load() Config {
 			URL: envOr("POCKET_TTS_URL", ""),
 		},

+		LibreTranslate: LibreTranslate{
+			URL:    envOr("LIBRETRANSLATE_URL", ""),
+			APIKey: envOr("LIBRETRANSLATE_API_KEY", ""),
+		},
+
 		HTTP: HTTP{
 			Addr: envOr("BACKEND_HTTP_ADDR", ":8080"),
 		},
--- a/backend/runner
+++ b/backend/runner
--- a/caddy/errors/404.html
+++ b/caddy/errors/404.html
@@ -3,7 +3,7 @@
 <head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>404 — Page Not Found — LibNovel</title>
+  <title>404 — Page Not Found — libnovel</title>
  <style>
    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

@@ -27,11 +27,10 @@
    .logo {
      font-size: 1.125rem;
      font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
      letter-spacing: -0.02em;
      text-decoration: none;
    }
-    .logo span { color: #f59e0b; }

    main {
      flex: 1;
@@ -114,7 +113,7 @@
 <body>

  <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
  </header>

  <main>
--- a/caddy/errors/500.html
+++ b/caddy/errors/500.html
@@ -3,7 +3,8 @@
 <head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>500 — Internal Error — LibNovel</title>
+  <title>500 — Internal Error — libnovel</title>
+  <meta http-equiv="refresh" content="20">
  <style>
    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

@@ -27,11 +28,10 @@
    .logo {
      font-size: 1.125rem;
      font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
      letter-spacing: -0.02em;
      text-decoration: none;
    }
-    .logo span { color: #f59e0b; }

    main {
      flex: 1;
@@ -147,7 +147,7 @@
 <body>

  <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
  </header>

  <main>
--- a/caddy/errors/502.html
+++ b/caddy/errors/502.html
@@ -3,7 +3,8 @@
 <head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>502 — Service Unavailable — LibNovel</title>
+  <title>502 — Service Unavailable — libnovel</title>
+  <meta http-equiv="refresh" content="20">
  <style>
    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

@@ -27,11 +28,10 @@
    .logo {
      font-size: 1.125rem;
      font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
      letter-spacing: -0.02em;
      text-decoration: none;
    }
-    .logo span { color: #f59e0b; }

    main {
      flex: 1;
@@ -126,7 +126,7 @@
 <body>

  <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
  </header>

  <main>
--- a/caddy/errors/503.html
+++ b/caddy/errors/503.html
@@ -3,7 +3,8 @@
 <head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Under Maintenance — LibNovel</title>
+  <title>Under Maintenance — libnovel</title>
+  <meta http-equiv="refresh" content="30">
  <style>
    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

@@ -28,11 +29,10 @@
    .logo {
      font-size: 1.125rem;
      font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
      letter-spacing: -0.02em;
      text-decoration: none;
    }
-    .logo span { color: #f59e0b; }

    /* ── Main ── */
    main {
@@ -129,7 +129,7 @@
 <body>

  <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
  </header>

  <main>
--- a/caddy/errors/504.html
+++ b/caddy/errors/504.html
@@ -3,7 +3,8 @@
 <head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>504 — Gateway Timeout — LibNovel</title>
+  <title>504 — Gateway Timeout — libnovel</title>
+  <meta http-equiv="refresh" content="20">
  <style>
    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

@@ -27,11 +28,10 @@
    .logo {
      font-size: 1.125rem;
      font-weight: 700;
-      color: #e4e4e7;
+      color: #f59e0b;
      letter-spacing: -0.02em;
      text-decoration: none;
    }
-    .logo span { color: #f59e0b; }

    main {
      flex: 1;
@@ -126,7 +126,7 @@
 <body>

  <header>
-    <a class="logo" href="/">Lib<span>Novel</span></a>
+    <a class="logo" href="/">libnovel</a>
  </header>

  <main>
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -126,6 +126,26 @@ services:
      timeout: 5s
      retries: 5

+  # ─── Redis (Asynq task queue — accessed locally by backend, remotely by homelab runner) ──
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: >
+      redis-server
+      --appendonly yes
+      --requirepass "${REDIS_PASSWORD}"
+    # No public port — backend reaches it via internal network.
+    # Homelab runner reaches it via Caddy TLS proxy on :6380 → redis:6379.
+    expose:
+      - "6379"
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
  # ─── Backend API ──────────────────────────────────────────────────────────────
  backend:
    image: kalekber/libnovel-backend:${GIT_TAG:-latest}
@@ -151,6 +171,8 @@ services:
        condition: service_healthy
      valkey:
        condition: service_healthy
+      redis:
+        condition: service_healthy
    # No public port — all traffic is routed via Caddy.
    expose:
      - "8080"
@@ -164,10 +186,9 @@ services:
      GLITCHTIP_DSN: "${GLITCHTIP_DSN}"
      OTEL_EXPORTER_OTLP_ENDPOINT: "${OTEL_EXPORTER_OTLP_ENDPOINT}"
      OTEL_SERVICE_NAME: "backend"
-      # Asynq task queue — backend enqueues jobs to homelab Redis via Caddy TLS proxy.
-      # Set to "rediss://:password@redis.libnovel.cc:6380" in Doppler prd config.
-      # Leave empty to fall back to PocketBase polling.
-      REDIS_ADDR: "${REDIS_ADDR}"
+      # Asynq task queue — backend enqueues jobs to local Redis sidecar.
+      # Homelab runner connects to the same Redis via Caddy TLS proxy on :6380.
+      REDIS_ADDR: "redis:6379"
      REDIS_PASSWORD: "${REDIS_PASSWORD}"
    healthcheck:
      test: ["CMD", "/healthcheck", "http://localhost:8080/health"]
@@ -269,6 +290,7 @@ services:
      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
      AUTH_SECRET: "${AUTH_SECRET}"
+      DEBUG_LOGIN_TOKEN: "${DEBUG_LOGIN_TOKEN}"
      PUBLIC_MINIO_PUBLIC_URL: "${MINIO_PUBLIC_ENDPOINT}"
      # Valkey
      VALKEY_ADDR: "valkey:6379"
@@ -382,12 +404,10 @@ services:
      - "80:80"
      - "443:443"
      - "443:443/udp" # HTTP/3 (QUIC)
-      - "6380:6380"   # Redis TCP proxy (TLS) for homelab → Asynq
+      - "6380:6380"   # Redis TCP proxy (TLS) for homelab runner → Asynq
    environment:
      DOMAIN: "${DOMAIN}"
      CADDY_ACME_EMAIL: "${CADDY_ACME_EMAIL}"
-      # Homelab Redis address — Caddy TCP-proxies inbound :6380 to this.
-      HOMELAB_REDIS_ADDR: "${HOMELAB_REDIS_ADDR:?HOMELAB_REDIS_ADDR required for Redis TCP proxy}"
    env_file:
      - path: ./crowdsec/.crowdsec.env
        required: false
@@ -421,6 +441,7 @@ volumes:
  pb_data:
  meili_data:
  valkey_data:
+  redis_data:
  caddy_data:
  caddy_config:
  caddy_logs:
--- a/homelab/docker-compose.yml
+++ b/homelab/docker-compose.yml
@@ -289,6 +289,48 @@ services:
      timeout: 5s
      retries: 5

+  # ── Redis (Asynq task queue) ────────────────────────────────────────────────
+  # Dedicated Redis instance for Asynq job dispatch.
+  # The prod backend enqueues jobs via redis.libnovel.cc:6380 (Caddy TLS proxy →
+  # host:6379). The runner reads from this instance directly on the Docker network.
+  # Port is bound to 0.0.0.0:6379 so the Caddy layer4 proxy on prod can reach it.
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # ── LibreTranslate ──────────────────────────────────────────────────────────
+  # Self-hosted machine translation. Runner connects via http://libretranslate:5000.
+  # Only English → configured target languages are loaded to save RAM.
+  libretranslate:
+    image: libretranslate/libretranslate:latest
+    restart: unless-stopped
+    environment:
+      LT_API_KEYS: "true"
+      LT_API_KEYS_DB_PATH: "/app/db/api_keys.db"
+      LT_LOAD_ONLY: "en,ru,id,pt,fr"
+      LT_DISABLE_WEB_UI: "true"
+      LT_UPDATE_MODELS: "false"
+    expose:
+      - "5000"
+    volumes:
+      - libretranslate_data:/app/db
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:5000/languages"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
  # ── Valkey ──────────────────────────────────────────────────────────────────
  # Used by GlitchTip for task queuing.
  valkey:
@@ -469,6 +511,8 @@ services:

 volumes:
  postgres_data:
+  redis_data:
+  libretranslate_data:
  valkey_data:
  uptime_kuma_data:
  gotify_data:
--- a/homelab/runner/docker-compose.yml
+++ b/homelab/runner/docker-compose.yml
@@ -11,25 +11,10 @@
 #   - MEILI_URL               → https://search.libnovel.cc (Caddy-proxied)
 #   - VALKEY_ADDR             → unset (not exposed publicly)
 #   - RUNNER_SKIP_INITIAL_CATALOGUE_REFRESH=true
-#   - Redis service for Asynq task queue (local to homelab, exposed to prod via Caddy TCP proxy)
+#   - REDIS_ADDR              → rediss://redis.libnovel.cc:6380 (prod Redis via Caddy TLS proxy)
 #   - LibreTranslate service for machine translation (internal network only)

 services:
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    volumes:
-      - redis_data:/data
-    command: >
-      redis-server
-      --appendonly yes
-      --requirepass "${REDIS_PASSWORD}"
-    healthcheck:
-      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
  libretranslate:
    image: libretranslate/libretranslate:latest
    restart: unless-stopped
@@ -44,7 +29,7 @@ services:
      - libretranslate_models:/home/libretranslate/.local/share/argos-translate
      - libretranslate_db:/app/db
    healthcheck:
-      test: ["CMD-SHELL", "curl -sf http://localhost:5000/languages || exit 1"]
+      test: ["CMD", "python3", "-c", "import urllib.request,sys; urllib.request.urlopen('http://localhost:5000/languages'); sys.exit(0)"]
      interval: 30s
      timeout: 10s
      retries: 5
@@ -55,8 +40,6 @@ services:
    restart: unless-stopped
    stop_grace_period: 135s
    depends_on:
-      redis:
-        condition: service_healthy
      libretranslate:
        condition: service_healthy
    environment:
@@ -91,9 +74,10 @@ services:
      LIBRETRANSLATE_URL: "http://libretranslate:5000"
      LIBRETRANSLATE_API_KEY: "${LIBRETRANSLATE_API_KEY}"

-      # ── Asynq / Redis (local service) ───────────────────────────────────────
-      # The runner connects to the local Redis sidecar.
-      REDIS_ADDR: "redis:6379"
+      # ── Asynq / Redis (prod Redis via Caddy TLS proxy) ──────────────────────
+      # The runner connects to prod Redis over TLS: rediss://redis.libnovel.cc:6380.
+      # Caddy on prod terminates TLS and proxies to the local redis:6379 sidecar.
+      REDIS_ADDR: "${REDIS_ADDR}"
      REDIS_PASSWORD: "${REDIS_PASSWORD}"

      # ── Runner tuning ───────────────────────────────────────────────────────
@@ -117,6 +101,5 @@ services:
      retries: 3

 volumes:
-  redis_data:
  libretranslate_models:
  libretranslate_db:
--- a/ui/messages/en.json
+++ b/ui/messages/en.json
@@ -357,6 +357,16 @@

  "admin_pages_label": "Pages",
  "admin_tools_label": "Tools",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Audio",
+  "admin_nav_translation": "Translation",
+  "admin_nav_changelog": "Changelog",
+  "admin_nav_feedback": "Feedback",
+  "admin_nav_errors": "Errors",
+  "admin_nav_analytics": "Analytics",
+  "admin_nav_logs": "Logs",
+  "admin_nav_uptime": "Uptime",
+  "admin_nav_push": "Push",

  "admin_scrape_status_idle": "Idle",
  "admin_scrape_status_running": "Running",
--- a/ui/messages/fr.json
+++ b/ui/messages/fr.json
@@ -357,6 +357,16 @@

  "admin_pages_label": "Pages",
  "admin_tools_label": "Outils",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Audio",
+  "admin_nav_translation": "Traduction",
+  "admin_nav_changelog": "Modifications",
+  "admin_nav_feedback": "Retours",
+  "admin_nav_errors": "Erreurs",
+  "admin_nav_analytics": "Analytique",
+  "admin_nav_logs": "Journaux",
+  "admin_nav_uptime": "Disponibilité",
+  "admin_nav_push": "Notifications",

  "admin_scrape_status_idle": "Inactif",
  "admin_scrape_full_catalogue": "Catalogue complet",
--- a/ui/messages/id.json
+++ b/ui/messages/id.json
@@ -357,6 +357,16 @@

  "admin_pages_label": "Halaman",
  "admin_tools_label": "Alat",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Audio",
+  "admin_nav_translation": "Terjemahan",
+  "admin_nav_changelog": "Perubahan",
+  "admin_nav_feedback": "Masukan",
+  "admin_nav_errors": "Kesalahan",
+  "admin_nav_analytics": "Analitik",
+  "admin_nav_logs": "Log",
+  "admin_nav_uptime": "Uptime",
+  "admin_nav_push": "Notifikasi",

  "admin_scrape_status_idle": "Menunggu",
  "admin_scrape_full_catalogue": "Katalog penuh",
--- a/ui/messages/pt.json
+++ b/ui/messages/pt.json
@@ -357,6 +357,16 @@

  "admin_pages_label": "Páginas",
  "admin_tools_label": "Ferramentas",
+  "admin_nav_scrape": "Scrape",
+  "admin_nav_audio": "Áudio",
+  "admin_nav_translation": "Tradução",
+  "admin_nav_changelog": "Alterações",
+  "admin_nav_feedback": "Feedback",
+  "admin_nav_errors": "Erros",
+  "admin_nav_analytics": "Análise",
+  "admin_nav_logs": "Logs",
+  "admin_nav_uptime": "Uptime",
+  "admin_nav_push": "Notificações",

  "admin_scrape_status_idle": "Ocioso",
  "admin_scrape_full_catalogue": "Catálogo completo",
--- a/ui/messages/ru.json
+++ b/ui/messages/ru.json
@@ -357,6 +357,16 @@

  "admin_pages_label": "Страницы",
  "admin_tools_label": "Инструменты",
+  "admin_nav_scrape": "Скрейпинг",
+  "admin_nav_audio": "Аудио",
+  "admin_nav_translation": "Перевод",
+  "admin_nav_changelog": "Изменения",
+  "admin_nav_feedback": "Отзывы",
+  "admin_nav_errors": "Ошибки",
+  "admin_nav_analytics": "Аналитика",
+  "admin_nav_logs": "Логи",
+  "admin_nav_uptime": "Мониторинг",
+  "admin_nav_push": "Уведомления",

  "admin_scrape_status_idle": "Ожидание",
  "admin_scrape_full_catalogue": "Полный каталог",
--- a/ui/src/app.css
+++ b/ui/src/app.css
@@ -147,6 +147,15 @@ html {
 	margin: 2em 0;
 }

+/* ── Hide scrollbars (used on horizontal carousels) ────────────────── */
+.scrollbar-none {
+	scrollbar-width: none;       /* Firefox */
+	-ms-overflow-style: none;    /* IE / Edge legacy */
+}
+.scrollbar-none::-webkit-scrollbar {
+	display: none;               /* Chrome / Safari / WebKit */
+}
+
 /* ── Navigation progress bar ───────────────────────────────────────── */
@keyframes progress-bar {
 	0%   { width: 0%; opacity: 1; }
--- a/ui/src/lib/paraglide/messages/_index.js
+++ b/ui/src/lib/paraglide/messages/_index.js
@@ -328,6 +328,16 @@ export * from './user_following_label.js'
 export * from './user_no_books.js'
 export * from './admin_pages_label.js'
 export * from './admin_tools_label.js'
+export * from './admin_nav_scrape.js'
+export * from './admin_nav_audio.js'
+export * from './admin_nav_translation.js'
+export * from './admin_nav_changelog.js'
+export * from './admin_nav_feedback.js'
+export * from './admin_nav_errors.js'
+export * from './admin_nav_analytics.js'
+export * from './admin_nav_logs.js'
+export * from './admin_nav_uptime.js'
+export * from './admin_nav_push.js'
 export * from './admin_scrape_status_idle.js'
 export * from './admin_scrape_full_catalogue.js'
 export * from './admin_scrape_single_book.js'
--- a/ui/src/lib/paraglide/messages/admin_nav_analytics.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_analytics.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_AnalyticsInputs */
+
+const en_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Analytics`);
+const ru_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Аналитика`);
+const id_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Analitik`);
+const pt_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Análise`);
+const fr_admin_nav_analytics = (_inputs = {}) => /** @type {LocalizedString} */ (`Analytique`);
+
+export const admin_nav_analytics = /** @type {((inputs?: Admin_Nav_AnalyticsInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_AnalyticsInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_analytics(inputs)
+	if (locale === "ru") return ru_admin_nav_analytics(inputs)
+	if (locale === "id") return id_admin_nav_analytics(inputs)
+	if (locale === "pt") return pt_admin_nav_analytics(inputs)
+	return fr_admin_nav_analytics(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_audio.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_audio.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_AudioInputs */
+
+const en_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Audio`);
+const ru_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Аудио`);
+const id_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Audio`);
+const pt_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Áudio`);
+const fr_admin_nav_audio = (_inputs = {}) => /** @type {LocalizedString} */ (`Audio`);
+
+export const admin_nav_audio = /** @type {((inputs?: Admin_Nav_AudioInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_AudioInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_audio(inputs)
+	if (locale === "ru") return ru_admin_nav_audio(inputs)
+	if (locale === "id") return id_admin_nav_audio(inputs)
+	if (locale === "pt") return pt_admin_nav_audio(inputs)
+	return fr_admin_nav_audio(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_changelog.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_changelog.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_ChangelogInputs */
+
+const en_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Changelog`);
+const ru_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Изменения`);
+const id_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Perubahan`);
+const pt_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Alterações`);
+const fr_admin_nav_changelog = (_inputs = {}) => /** @type {LocalizedString} */ (`Modifications`);
+
+export const admin_nav_changelog = /** @type {((inputs?: Admin_Nav_ChangelogInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_ChangelogInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_changelog(inputs)
+	if (locale === "ru") return ru_admin_nav_changelog(inputs)
+	if (locale === "id") return id_admin_nav_changelog(inputs)
+	if (locale === "pt") return pt_admin_nav_changelog(inputs)
+	return fr_admin_nav_changelog(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_errors.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_errors.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_ErrorsInputs */
+
+const en_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Errors`);
+const ru_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Ошибки`);
+const id_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Kesalahan`);
+const pt_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Erros`);
+const fr_admin_nav_errors = (_inputs = {}) => /** @type {LocalizedString} */ (`Erreurs`);
+
+export const admin_nav_errors = /** @type {((inputs?: Admin_Nav_ErrorsInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_ErrorsInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_errors(inputs)
+	if (locale === "ru") return ru_admin_nav_errors(inputs)
+	if (locale === "id") return id_admin_nav_errors(inputs)
+	if (locale === "pt") return pt_admin_nav_errors(inputs)
+	return fr_admin_nav_errors(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_feedback.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_feedback.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_FeedbackInputs */
+
+const en_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Feedback`);
+const ru_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Отзывы`);
+const id_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Masukan`);
+const pt_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Feedback`);
+const fr_admin_nav_feedback = (_inputs = {}) => /** @type {LocalizedString} */ (`Retours`);
+
+export const admin_nav_feedback = /** @type {((inputs?: Admin_Nav_FeedbackInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_FeedbackInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_feedback(inputs)
+	if (locale === "ru") return ru_admin_nav_feedback(inputs)
+	if (locale === "id") return id_admin_nav_feedback(inputs)
+	if (locale === "pt") return pt_admin_nav_feedback(inputs)
+	return fr_admin_nav_feedback(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_logs.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_logs.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_LogsInputs */
+
+const en_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Logs`);
+const ru_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Логи`);
+const id_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Log`);
+const pt_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Logs`);
+const fr_admin_nav_logs = (_inputs = {}) => /** @type {LocalizedString} */ (`Journaux`);
+
+export const admin_nav_logs = /** @type {((inputs?: Admin_Nav_LogsInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_LogsInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_logs(inputs)
+	if (locale === "ru") return ru_admin_nav_logs(inputs)
+	if (locale === "id") return id_admin_nav_logs(inputs)
+	if (locale === "pt") return pt_admin_nav_logs(inputs)
+	return fr_admin_nav_logs(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_push.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_push.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_PushInputs */
+
+const en_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Push`);
+const ru_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Уведомления`);
+const id_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Notifikasi`);
+const pt_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Notificações`);
+const fr_admin_nav_push = (_inputs = {}) => /** @type {LocalizedString} */ (`Notifications`);
+
+export const admin_nav_push = /** @type {((inputs?: Admin_Nav_PushInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_PushInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_push(inputs)
+	if (locale === "ru") return ru_admin_nav_push(inputs)
+	if (locale === "id") return id_admin_nav_push(inputs)
+	if (locale === "pt") return pt_admin_nav_push(inputs)
+	return fr_admin_nav_push(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_scrape.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_scrape.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_ScrapeInputs */
+
+const en_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+const ru_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Скрейпинг`);
+const id_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+const pt_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+const fr_admin_nav_scrape = (_inputs = {}) => /** @type {LocalizedString} */ (`Scrape`);
+
+export const admin_nav_scrape = /** @type {((inputs?: Admin_Nav_ScrapeInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_ScrapeInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_scrape(inputs)
+	if (locale === "ru") return ru_admin_nav_scrape(inputs)
+	if (locale === "id") return id_admin_nav_scrape(inputs)
+	if (locale === "pt") return pt_admin_nav_scrape(inputs)
+	return fr_admin_nav_scrape(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_translation.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_translation.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_TranslationInputs */
+
+const en_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Translation`);
+const ru_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Перевод`);
+const id_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Terjemahan`);
+const pt_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Tradução`);
+const fr_admin_nav_translation = (_inputs = {}) => /** @type {LocalizedString} */ (`Traduction`);
+
+export const admin_nav_translation = /** @type {((inputs?: Admin_Nav_TranslationInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_TranslationInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_translation(inputs)
+	if (locale === "ru") return ru_admin_nav_translation(inputs)
+	if (locale === "id") return id_admin_nav_translation(inputs)
+	if (locale === "pt") return pt_admin_nav_translation(inputs)
+	return fr_admin_nav_translation(inputs)
+});
--- a/ui/src/lib/paraglide/messages/admin_nav_uptime.js
+++ b/ui/src/lib/paraglide/messages/admin_nav_uptime.js
@@ -0,0 +1,21 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Admin_Nav_UptimeInputs */
+
+const en_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Uptime`);
+const ru_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Мониторинг`);
+const id_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Uptime`);
+const pt_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Uptime`);
+const fr_admin_nav_uptime = (_inputs = {}) => /** @type {LocalizedString} */ (`Disponibilité`);
+
+export const admin_nav_uptime = /** @type {((inputs?: Admin_Nav_UptimeInputs, options?: { locale?: "en" | "ru" | "id" | "pt" | "fr" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Admin_Nav_UptimeInputs, { locale?: "en" | "ru" | "id" | "pt" | "fr" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_admin_nav_uptime(inputs)
+	if (locale === "ru") return ru_admin_nav_uptime(inputs)
+	if (locale === "id") return id_admin_nav_uptime(inputs)
+	if (locale === "pt") return pt_admin_nav_uptime(inputs)
+	return fr_admin_nav_uptime(inputs)
+});
--- a/ui/src/lib/server/polar.ts
+++ b/ui/src/lib/server/polar.ts
@@ -9,12 +9,16 @@
 * Product IDs (Polar dashboard):
 *   Monthly : 1376fdf5-b6a9-492b-be70-7c905131c0f9
 *   Annual  : b6190307-79aa-4905-80c8-9ed941378d21
+ *
+ * Webhook event data shapes (Polar v1 API):
+ *   subscription.*  → data.customer_id, data.product_id, data.status, data.customer.email
+ *   order.created   → data.customer_id, data.product_id, data.customer.email, data.billing_reason
 */

 import { createHmac, timingSafeEqual } from 'node:crypto';
 import { env } from '$env/dynamic/private';
 import { log } from '$lib/server/logger';
-import { getUserById, getUserByPolarCustomerId, patchUser } from '$lib/server/pocketbase';
+import { getUserByPolarCustomerId, patchUser } from '$lib/server/pocketbase';

 export const POLAR_PRO_PRODUCT_IDS = new Set([
 	'1376fdf5-b6a9-492b-be70-7c905131c0f9', // monthly
@@ -55,41 +59,69 @@ export function verifyPolarWebhook(rawBody: string, signatureHeader: string): bo

 // ─── Subscription event handler ───────────────────────────────────────────────

+interface PolarCustomer {
+	email?: string;
+	external_id?: string; // our app_users.id if set on the customer
+}
+
 interface PolarSubscription {
 	id: string;
-	status: string; // "active" | "canceled" | "past_due" | "unpaid" | "incomplete" | ...
+	status: string; // "active" | "canceled" | "past_due" | "unpaid" | ...
 	product_id: string;
 	customer_id: string;
-	customer_email?: string;
-	user_id?: string; // Polar user id (not our user id)
+	customer?: PolarCustomer; // nested object — email lives here
+}
+
+/**
+ * Resolve the app_user for a Polar customer.
+ * Priority: polar_customer_id → email → customer.external_id (our user ID)
+ */
+async function resolveUser(customer_id: string, customer?: PolarCustomer) {
+	const { getUserByEmail, getUserById } = await import('$lib/server/pocketbase');
+
+	// 1. By stored polar_customer_id (fastest on repeat events)
+	const byCustomerId = await getUserByPolarCustomerId(customer_id).catch(() => null);
+	if (byCustomerId) return byCustomerId;
+
+	// 2. By email (most common first-time path)
+	const email = customer?.email;
+	if (email) {
+		const byEmail = await getUserByEmail(email).catch(() => null);
+		if (byEmail) return byEmail;
+	}
+
+	// 3. By external_id = our user ID (if set via Polar API on customer creation)
+	const externalId = customer?.external_id;
+	if (externalId) {
+		const byId = await getUserById(externalId).catch(() => null);
+		if (byId) return byId;
+	}
+
+	return null;
 }

 /**
 * Handle a Polar subscription event.
- * Finds the matching app_user by email and updates role + polar fields.
+ * Finds the matching app_user and updates role + polar fields.
 */
 export async function handleSubscriptionEvent(
 	eventType: string,
 	subscription: PolarSubscription
 ): Promise<void> {
-	const { id: subId, status, product_id, customer_id, customer_email } = subscription;
+	const { id: subId, status, product_id, customer_id, customer } = subscription;

-	log.info('polar', 'subscription event', { eventType, subId, status, product_id, customer_email });
+	log.info('polar', 'subscription event', {
+		eventType, subId, status, product_id,
+		customer_email: customer?.email
+	});

-	if (!customer_email) {
-		log.warn('polar', 'subscription event missing customer_email — cannot match user', { subId });
-		return;
-	}
-
-	// Find user by their polar_customer_id first (faster on repeat events), then by email
-	let user = await getUserByPolarCustomerId(customer_id).catch(() => null);
-	if (!user) {
-		const { getUserByEmail } = await import('$lib/server/pocketbase');
-		user = await getUserByEmail(customer_email).catch(() => null);
-	}
+	const user = await resolveUser(customer_id, customer);

 	if (!user) {
-		log.warn('polar', 'no app_user found for polar customer', { customer_email, customer_id });
+		log.warn('polar', 'no app_user found for polar customer', {
+			customer_email: customer?.email,
+			customer_id
+		});
 		return;
 	}

@@ -103,5 +135,60 @@ export async function handleSubscriptionEvent(
 		polar_subscription_id: isActive ? subId : ''
 	});

-	log.info('polar', 'user role updated', { userId: user.id, username: user.username, newRole, status });
+	log.info('polar', 'user role updated', {
+		userId: user.id, username: user.username, newRole, status
+	});
+}
+
+// ─── Order event handler ──────────────────────────────────────────────────────
+
+interface PolarOrder {
+	id: string;
+	status: string;
+	billing_reason: string; // "purchase" | "subscription_create" | "subscription_cycle" | "subscription_update"
+	product_id: string | null;
+	customer_id: string;
+	subscription_id: string | null;
+	customer?: PolarCustomer;
+}
+
+/**
+ * Handle order.created — used for initial subscription purchases.
+ * We only act on subscription_create billing_reason to avoid double-processing
+ * (subscription.active will also fire, but this ensures we catch edge cases).
+ */
+export async function handleOrderCreated(order: PolarOrder): Promise<void> {
+	const { id: orderId, billing_reason, product_id, customer_id, customer } = order;
+
+	log.info('polar', 'order.created', { orderId, billing_reason, product_id, customer_email: customer?.email });
+
+	// Only handle new subscription purchases here; renewals are handled by subscription.updated
+	if (billing_reason !== 'purchase' && billing_reason !== 'subscription_create') {
+		log.debug('polar', 'order.created — skipping non-purchase billing_reason', { billing_reason });
+		return;
+	}
+
+	if (!product_id || !POLAR_PRO_PRODUCT_IDS.has(product_id)) {
+		log.debug('polar', 'order.created — product not a pro product', { product_id });
+		return;
+	}
+
+	const user = await resolveUser(customer_id, customer);
+	if (!user) {
+		log.warn('polar', 'order.created — no app_user found', {
+			customer_email: customer?.email, customer_id
+		});
+		return;
+	}
+
+	// Only upgrade if not already pro/admin — subscription.active will do a full sync too
+	if (user.role !== 'pro' && user.role !== 'admin') {
+		await patchUser(user.id, {
+			role: 'pro',
+			polar_customer_id: customer_id
+		});
+		log.info('polar', 'order.created — user upgraded to pro', {
+			userId: user.id, username: user.username
+		});
+	}
 }
--- a/ui/src/routes/+layout.svelte
+++ b/ui/src/routes/+layout.svelte
@@ -20,6 +20,7 @@
 	// Desktop dropdown menus
 	let userMenuOpen = $state(false);
 	let langMenuOpen = $state(false);
+	let themeMenuOpen = $state(false);

 	const THEMES = [
 		{ id: 'amber',       color: '#f59e0b' },
@@ -316,38 +317,52 @@
 				{m.nav_feedback()}
 			</a>

-				<div class="ml-auto flex items-center gap-2">
-					<!-- Theme dots (desktop) -->
-					<div class="hidden sm:flex items-center gap-1 mr-1">
-						{#each THEMES as t, i}
-							{#if i === 3}
-								<span class="w-px h-3 bg-(--color-border) mx-0.5"></span>
-							{/if}
-							<button
-								type="button"
-								onclick={() => { currentTheme = t.id; }}
-								title={t.id}
-								class="w-3.5 h-3.5 rounded-full border-2 transition-all {currentTheme === t.id ? 'border-(--color-text) scale-110' : t.light ? 'border-(--color-border) opacity-70 hover:opacity-100' : 'border-transparent opacity-50 hover:opacity-100'}"
-								style="background: {t.color};"
-							></button>
-						{/each}
-					</div>
+			<div class="ml-auto flex items-center gap-2">
+				<!-- Theme dropdown (desktop) -->
+				<div class="hidden sm:block relative">
+					<button
+						type="button"
+						onclick={() => { themeMenuOpen = !themeMenuOpen; langMenuOpen = false; userMenuOpen = false; }}
+						title="Theme"
+						class="flex items-center justify-center w-7 h-7 rounded transition-colors {themeMenuOpen ? 'bg-(--color-surface-2)' : 'hover:bg-(--color-surface-2)'}"
+					>
+						<span
+							class="w-3.5 h-3.5 rounded-full border-2 border-(--color-text) shrink-0"
+							style="background: {THEMES.find(t => t.id === currentTheme)?.color ?? '#f59e0b'};"
+						></span>
+					</button>
+					{#if themeMenuOpen}
+						<div class="absolute right-0 top-full mt-1 bg-(--color-surface-2) border border-(--color-border) rounded-lg shadow-xl py-2 px-2.5 z-50">
+							<div class="flex items-center gap-1.5">
+								{#each THEMES as t, i}
+									{#if i === 3}
+										<span class="w-px h-3 bg-(--color-border) mx-0.5"></span>
+									{/if}
+									<button
+										type="button"
+										onclick={() => { currentTheme = t.id; themeMenuOpen = false; }}
+										title={t.id}
+										class="w-4 h-4 rounded-full border-2 transition-all {currentTheme === t.id ? 'border-(--color-text) scale-110' : t.light ? 'border-(--color-border) opacity-70 hover:opacity-100' : 'border-transparent opacity-50 hover:opacity-100'}"
+										style="background: {t.color};"
+									></button>
+								{/each}
+							</div>
+						</div>
+					{/if}
+				</div>

-					<!-- Language dropdown (desktop) -->
-					<div class="hidden sm:block relative">
-						<button
-							type="button"
-							onclick={() => { langMenuOpen = !langMenuOpen; userMenuOpen = false; }}
-							class="flex items-center gap-1 px-2 py-1 rounded text-xs font-mono transition-colors {langMenuOpen ? 'bg-(--color-surface-2) text-(--color-text)' : 'text-(--color-muted) hover:bg-(--color-surface-2) hover:text-(--color-text)'}"
-						>
-							<svg class="w-3.5 h-3.5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-								<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/>
-							</svg>
-							{getLocale().toUpperCase()}
-							<svg class="w-3 h-3 shrink-0 transition-transform {langMenuOpen ? 'rotate-180' : ''}" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-								<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
-							</svg>
-						</button>
+				<!-- Language dropdown (desktop) -->
+				<div class="hidden sm:block relative">
+					<button
+						type="button"
+						onclick={() => { langMenuOpen = !langMenuOpen; userMenuOpen = false; themeMenuOpen = false; }}
+						class="flex items-center gap-1 px-2 py-1 rounded text-xs font-mono transition-colors {langMenuOpen ? 'bg-(--color-surface-2) text-(--color-text)' : 'text-(--color-muted) hover:bg-(--color-surface-2) hover:text-(--color-text)'}"
+					>
+						<svg class="w-3.5 h-3.5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+							<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/>
+						</svg>
+						{getLocale().toUpperCase()}
+					</button>
 						{#if langMenuOpen}
 							<div class="absolute right-0 top-full mt-1 bg-(--color-surface-2) border border-(--color-border) rounded-lg shadow-xl py-1 z-50 min-w-[80px]">
 								{#each locales as locale}
@@ -372,20 +387,17 @@
 						{/if}
 					</div>

-					<!-- User menu dropdown (desktop) -->
-					<div class="hidden sm:block relative">
-						<button
-							type="button"
-							onclick={() => { userMenuOpen = !userMenuOpen; langMenuOpen = false; }}
-							class="flex items-center gap-1.5 pl-1.5 pr-2 py-1 rounded transition-colors {userMenuOpen ? 'bg-(--color-surface-2)' : 'hover:bg-(--color-surface-2)'}"
-						>
-							<span class="w-6 h-6 rounded-full bg-(--color-brand)/20 text-(--color-brand) text-xs font-bold flex items-center justify-center shrink-0">
-								{data.user.username[0].toUpperCase()}
-							</span>
-							<svg class="w-3 h-3 text-(--color-muted) transition-transform {userMenuOpen ? 'rotate-180' : ''}" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-								<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
-							</svg>
-						</button>
+				<!-- User menu dropdown (desktop) -->
+				<div class="hidden sm:block relative">
+					<button
+						type="button"
+						onclick={() => { userMenuOpen = !userMenuOpen; langMenuOpen = false; themeMenuOpen = false; }}
+						class="flex items-center gap-1.5 pl-1.5 pr-1.5 py-1 rounded transition-colors {userMenuOpen ? 'bg-(--color-surface-2)' : 'hover:bg-(--color-surface-2)'}"
+					>
+						<span class="w-6 h-6 rounded-full bg-(--color-brand)/20 text-(--color-brand) text-xs font-bold flex items-center justify-center shrink-0">
+							{data.user.username[0].toUpperCase()}
+						</span>
+					</button>
 						{#if userMenuOpen}
 							<div class="absolute right-0 top-full mt-1 bg-(--color-surface-2) border border-(--color-border) rounded-lg shadow-xl py-1 z-50 min-w-[170px]">
 								<a
--- a/ui/src/routes/admin/+layout.server.ts
+++ b/ui/src/routes/admin/+layout.server.ts
@@ -0,0 +1,8 @@
+import { redirect } from '@sveltejs/kit';
+import type { LayoutServerLoad } from './$types';
+
+export const load: LayoutServerLoad = async ({ locals }) => {
+	if (locals.user?.role !== 'admin') {
+		redirect(302, '/');
+	}
+};
--- a/ui/src/routes/admin/+layout.svelte
+++ b/ui/src/routes/admin/+layout.svelte
@@ -3,30 +3,48 @@
 	import * as m from '$lib/paraglide/messages.js';

 	const internalLinks = [
-		{ href: '/admin/scrape', label: 'Scrape' },
-		{ href: '/admin/audio', label: 'Audio' },
-		{ href: '/admin/translation', label: 'Translation' },
-		{ href: '/admin/changelog', label: 'Changelog' }
+		{ href: '/admin/scrape', label: () => m.admin_nav_scrape() },
+		{ href: '/admin/audio', label: () => m.admin_nav_audio() },
+		{ href: '/admin/translation', label: () => m.admin_nav_translation() },
+		{ href: '/admin/changelog', label: () => m.admin_nav_changelog() }
 	];

 	const externalLinks = [
-		{ href: 'https://feedback.libnovel.cc', label: 'Feedback' },
-		{ href: 'https://errors.libnovel.cc', label: 'Errors' },
-		{ href: 'https://analytics.libnovel.cc', label: 'Analytics' },
-		{ href: 'https://logs.libnovel.cc', label: 'Logs' },
-		{ href: 'https://uptime.libnovel.cc', label: 'Uptime' },
-		{ href: 'https://push.libnovel.cc', label: 'Push' }
+		{ href: 'https://feedback.libnovel.cc', label: () => m.admin_nav_feedback() },
+		{ href: 'https://errors.libnovel.cc', label: () => m.admin_nav_errors() },
+		{ href: 'https://analytics.libnovel.cc', label: () => m.admin_nav_analytics() },
+		{ href: 'https://logs.libnovel.cc', label: () => m.admin_nav_logs() },
+		{ href: 'https://uptime.libnovel.cc', label: () => m.admin_nav_uptime() },
+		{ href: 'https://push.libnovel.cc', label: () => m.admin_nav_push() }
 	];

 	interface Props {
 		children?: import('svelte').Snippet;
 	}
 	let { children }: Props = $props();
+
+	let sidebarOpen = $state(false);
 </script>

+<!-- Mobile sidebar overlay -->
+{#if sidebarOpen}
+	<button
+		class="fixed inset-0 z-40 bg-black/50 md:hidden"
+		onclick={() => (sidebarOpen = false)}
+		aria-label="Close sidebar"
+	></button>
+{/if}
+
 <div class="flex min-h-[calc(100vh-4rem)] gap-0">
 	<!-- Sidebar -->
-	<aside class="w-48 shrink-0 border-r border-(--color-border) px-3 py-6 flex flex-col gap-6">
+	<aside
+		class="
+			fixed top-0 left-0 h-full z-50 w-56 shrink-0 border-r border-(--color-border) px-3 py-6 flex flex-col gap-6
+			bg-(--color-surface) transition-transform duration-200
+			{sidebarOpen ? 'translate-x-0' : '-translate-x-full'}
+			md:relative md:translate-x-0 md:w-48 md:z-auto md:top-auto md:h-auto
+		"
+	>
 		<!-- Internal pages -->
 		<div>
 			<p class="px-2 mb-2 text-xs font-semibold text-(--color-muted) uppercase tracking-widest">{m.admin_pages_label()}</p>
@@ -34,12 +52,13 @@
 				{#each internalLinks as link}
 					<a
 						href={link.href}
+						onclick={() => (sidebarOpen = false)}
 						class="px-2 py-1.5 rounded-md text-sm font-medium transition-colors
 							{page.url.pathname.startsWith(link.href)
 								? 'bg-(--color-surface-2) text-(--color-text)'
 								: 'text-(--color-muted) hover:bg-(--color-surface-2)/60 hover:text-(--color-text)'}"
 					>
-						{link.label}
+					{link.label()}
 					</a>
 				{/each}
 			</nav>
@@ -56,7 +75,7 @@
 						rel="noopener noreferrer"
 						class="px-2 py-1.5 rounded-md text-sm font-medium text-(--color-muted) hover:bg-(--color-surface-2)/60 hover:text-(--color-text) transition-colors flex items-center justify-between"
 					>
-						{link.label}
+						{link.label()}
 						<svg class="w-3 h-3 shrink-0 opacity-50" fill="none" stroke="currentColor" viewBox="0 0 24 24">
 							<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
 								d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" />
@@ -68,7 +87,19 @@
 	</aside>

 	<!-- Main content -->
-	<main class="flex-1 min-w-0 px-8 py-6">
+	<main class="flex-1 min-w-0 px-4 py-6 md:px-8">
+		<!-- Mobile nav toggle -->
+		<button
+			onclick={() => (sidebarOpen = true)}
+			class="md:hidden mb-4 flex items-center gap-2 text-sm text-(--color-muted) hover:text-(--color-text) transition-colors"
+			aria-label="Open navigation"
+		>
+			<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+				<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16" />
+			</svg>
+			Admin menu
+		</button>
+
 		{@render children?.()}
 	</main>
 </div>
--- a/ui/src/routes/admin/+page.server.ts
+++ b/ui/src/routes/admin/+page.server.ts
@@ -0,0 +1,6 @@
+import { redirect } from '@sveltejs/kit';
+import type { PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async () => {
+	redirect(302, '/admin/scrape');
+};
--- a/ui/src/routes/api/auth/debug-login/+server.ts
+++ b/ui/src/routes/api/auth/debug-login/+server.ts
@@ -0,0 +1,73 @@
+import { redirect, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { getUserByUsername, createUserSession } from '$lib/server/pocketbase';
+import { createAuthToken } from '../../../../hooks.server';
+import { env } from '$env/dynamic/private';
+import { log } from '$lib/server/logger';
+import { randomBytes } from 'node:crypto';
+
+const AUTH_COOKIE = 'libnovel_auth';
+const ONE_YEAR = 60 * 60 * 24 * 365;
+
+/**
+ * GET /api/auth/debug-login?token=<DEBUG_LOGIN_TOKEN>&username=<username>
+ *
+ * One-shot debug bypass: verifies a shared secret token, then mints a real
+ * auth cookie for the given user (defaults to the first admin account) and
+ * redirects to /.
+ *
+ * Requires DEBUG_LOGIN_TOKEN env var to be set. Disabled (404) when the var
+ * is absent or empty.
+ */
+export const GET: RequestHandler = async ({ url, cookies, request }) => {
+	const debugToken = env.DEBUG_LOGIN_TOKEN ?? '';
+	if (!debugToken) {
+		error(404, 'Not found');
+	}
+
+	const provided = url.searchParams.get('token') ?? '';
+	// Constant-time comparison to prevent timing attacks
+	if (provided.length !== debugToken.length) {
+		log.warn('api/auth/debug-login', 'bad token attempt');
+		error(401, 'Invalid token');
+	}
+	let diff = 0;
+	for (let i = 0; i < debugToken.length; i++) {
+		diff |= provided.charCodeAt(i) ^ debugToken.charCodeAt(i);
+	}
+	if (diff !== 0) {
+		log.warn('api/auth/debug-login', 'bad token attempt');
+		error(401, 'Invalid token');
+	}
+
+	const username = url.searchParams.get('username') ?? 'kamil_alekber_2e99';
+	const user = await getUserByUsername(username);
+	if (!user) {
+		error(404, `User '${username}' not found`);
+	}
+
+	const authSessionId = randomBytes(16).toString('hex');
+	const userAgent = request.headers.get('user-agent') ?? '';
+	const ip =
+		request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??
+		request.headers.get('x-real-ip') ??
+		'debug';
+
+	createUserSession(user.id, authSessionId, userAgent, ip).catch((e) =>
+		log.warn('api/auth/debug-login', 'createUserSession failed (non-fatal)', { err: String(e) })
+	);
+
+	const token = createAuthToken(user.id, user.username, user.role ?? 'user', authSessionId);
+
+	cookies.set(AUTH_COOKIE, token, {
+		path: '/',
+		httpOnly: true,
+		sameSite: 'lax',
+		maxAge: ONE_YEAR
+	});
+
+	log.info('api/auth/debug-login', 'debug login used', { username: user.username, ip });
+
+	const next = url.searchParams.get('next') ?? '/';
+	redirect(302, next);
+};
--- a/ui/src/routes/api/webhooks/polar/+server.ts
+++ b/ui/src/routes/api/webhooks/polar/+server.ts
@@ -1,12 +1,20 @@
 import type { RequestHandler } from './$types';
 import { log } from '$lib/server/logger';
-import { verifyPolarWebhook, handleSubscriptionEvent } from '$lib/server/polar';
+import { verifyPolarWebhook, handleSubscriptionEvent, handleOrderCreated } from '$lib/server/polar';

 /**
 * POST /api/webhooks/polar
 *
 * Receives Polar subscription lifecycle events and syncs user roles in PocketBase.
 * Signature is verified via HMAC-SHA256 before any processing.
+ *
+ * Handled events:
+ *   subscription.created  — new subscription (status may be "active" or "trialing")
+ *   subscription.active   — subscription became active (e.g. after payment)
+ *   subscription.updated  — catch-all: cancellations, renewals, plan changes
+ *   subscription.canceled — cancel_at_period_end=true, still active until period end
+ *   subscription.revoked  — access ended, downgrade to free
+ *   order.created         — purchase / subscription_create: fast-path upgrade
 */
 export const POST: RequestHandler = async ({ request }) => {
 	const rawBody = await request.text();
@@ -30,14 +38,15 @@ export const POST: RequestHandler = async ({ request }) => {
 	try {
 		switch (type) {
 			case 'subscription.created':
+			case 'subscription.active':
 			case 'subscription.updated':
+			case 'subscription.canceled':
 			case 'subscription.revoked':
-				await handleSubscriptionEvent(type, data as unknown as Parameters<typeof handleSubscriptionEvent>[1]);
+				await handleSubscriptionEvent(type, data as Parameters<typeof handleSubscriptionEvent>[1]);
 				break;

 			case 'order.created':
-				// One-time purchases — no role change needed for now
-				log.info('polar', 'order.created (no action)', { orderId: data.id });
+				await handleOrderCreated(data as Parameters<typeof handleOrderCreated>[0]);
 				break;

 			default:
--- a/ui/src/routes/profile/+page.server.ts
+++ b/ui/src/routes/profile/+page.server.ts
@@ -10,24 +10,31 @@ export const load: PageServerLoad = async ({ locals }) => {
 	}

 	let sessions: Awaited<ReturnType<typeof listUserSessions>> = [];
-	try {
-		sessions = await listUserSessions(locals.user.id);
-	} catch (e) {
-		log.warn('profile', 'listUserSessions failed (non-fatal)', { err: String(e) });
-	}
+	let email: string | null = null;
+	let polarCustomerId: string | null = null;

 	// Fetch avatar — MinIO first, fall back to OAuth provider picture
 	let avatarUrl: string | null = null;
 	try {
 		const record = await getUserByUsername(locals.user.username);
 		avatarUrl = await resolveAvatarUrl(locals.user.id, record?.avatar_url);
+		email = record?.email ?? null;
+		polarCustomerId = record?.polar_customer_id ?? null;
 	} catch (e) {
 		log.warn('profile', 'avatar fetch failed (non-fatal)', { err: String(e) });
 	}

+	try {
+		sessions = await listUserSessions(locals.user.id);
+	} catch (e) {
+		log.warn('profile', 'listUserSessions failed (non-fatal)', { err: String(e) });
+	}
+
 	return {
 		user: locals.user,
 		avatarUrl,
+		email,
+		polarCustomerId,
 		sessions: sessions.map((s) => ({
 			id: s.id,
 			user_agent: s.user_agent,
--- a/ui/src/routes/profile/+page.svelte
+++ b/ui/src/routes/profile/+page.svelte
@@ -9,6 +9,16 @@

 	let { data, form }: { data: PageData; form: ActionData } = $props();

+	// ── Polar checkout URLs (pre-fill email when available) ──────────────────────
+	const emailParam = data.email ? `?customer_email=${encodeURIComponent(data.email)}` : '';
+	const checkoutMonthly = `https://buy.polar.sh/libnovel/1376fdf5-b6a9-492b-be70-7c905131c0f9${emailParam}`;
+	const checkoutAnnual  = `https://buy.polar.sh/libnovel/b6190307-79aa-4905-80c8-9ed941378d21${emailParam}`;
+	// Customer portal: if user already has a Polar customer ID, link to their portal;
+	// otherwise fall back to the org page
+	const manageUrl = data.polarCustomerId
+		? `https://polar.sh/purchases`
+		: `https://polar.sh/libnovel`;
+
 	// ── Avatar ───────────────────────────────────────────────────────────────────
 	let avatarUrl = $state<string | null>(untrack(() => data.avatarUrl ?? null));
 	let avatarUploading = $state(false);
@@ -288,12 +298,12 @@
 			<p class="text-sm font-medium text-(--color-text) mb-1">{m.profile_upgrade_heading()}</p>
 			<p class="text-sm text-(--color-muted) mb-4">{m.profile_upgrade_desc()}</p>
 			<div class="flex flex-wrap gap-3">
-				<a href="https://buy.polar.sh/libnovel/1376fdf5-b6a9-492b-be70-7c905131c0f9" target="_blank" rel="noopener noreferrer"
+				<a href={checkoutMonthly} target="_blank" rel="noopener noreferrer"
 					class="inline-flex items-center gap-2 px-4 py-2 rounded-lg bg-(--color-brand) text-(--color-surface) font-semibold text-sm hover:bg-(--color-brand-dim) transition-colors">
 					<svg class="w-4 h-4 shrink-0" fill="currentColor" viewBox="0 0 24 24"><path d="M11.99 2C6.47 2 2 6.48 2 12s4.47 10 9.99 10C17.52 22 22 17.52 22 12S17.52 2 11.99 2zm4.24 16L12 15.45 7.77 18l1.12-4.81-3.73-3.23 4.92-.42L12 5l1.92 4.53 4.92.42-3.73 3.23L16.23 18z"/></svg>
 					{m.profile_upgrade_monthly()}
 				</a>
-				<a href="https://buy.polar.sh/libnovel/b6190307-79aa-4905-80c8-9ed941378d21" target="_blank" rel="noopener noreferrer"
+				<a href={checkoutAnnual} target="_blank" rel="noopener noreferrer"
 					class="inline-flex items-center gap-2 px-4 py-2 rounded-lg border border-(--color-brand) text-(--color-brand) font-semibold text-sm hover:bg-(--color-brand)/10 transition-colors">
 					{m.profile_upgrade_annual()}
 					<span class="text-xs font-bold px-1.5 py-0.5 rounded bg-(--color-brand)/15 text-(--color-brand) border border-(--color-brand)/30">–33%</span>
@@ -307,7 +317,7 @@
 			<p class="text-sm font-medium text-(--color-text)">{m.profile_pro_active()}</p>
 			<p class="text-sm text-(--color-muted) mt-0.5">{m.profile_pro_perks()}</p>
 		</div>
-		<a href="https://polar.sh/libnovel" target="_blank" rel="noopener noreferrer"
+		<a href={manageUrl} target="_blank" rel="noopener noreferrer"
 			class="shrink-0 inline-flex items-center gap-1.5 text-sm font-medium text-(--color-brand) hover:underline">
 			{m.profile_manage_subscription()}
 			<svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/></svg>
Author	SHA1	Message	Date
Admin	68ea2d2808	feat(payments): fix Polar webhook + pre-fill checkout email Some checks failed CI / Backend (pull_request) Successful in 26s Details CI / UI (pull_request) Failing after 24s Details CI / Backend (push) Successful in 26s Details Release / Check ui (push) Failing after 16s Details Release / Docker / ui (push) Has been skipped Details CI / UI (push) Failing after 31s Details Release / Test backend (push) Successful in 41s Details Release / Docker / caddy (push) Successful in 33s Details Release / Docker / runner (push) Successful in 2m58s Details Release / Docker / backend (push) Successful in 3m43s Details Release / Gitea Release (push) Has been skipped Details - Fix customer email path: was data.customer_email, is actually data.customer.email per Polar v1 API schema - Add resolveUser() helper: tries polar_customer_id → email → external_id - Add subscription.active and subscription.canceled event handling - Handle order.created for fast-path pro upgrade on purchase - Profile page: fetch user email + polarCustomerId from PocketBase - Profile page: pre-fill ?customer_email= on checkout links - Profile page: link to polar.sh/purchases for existing customers	2026-03-31 23:11:34 +05:00
Admin	7b1df9b592	fix(infra): fix libretranslate healthcheck; fix scrollbar-none css All checks were successful CI / Backend (push) Successful in 25s Details Release / Test backend (push) Successful in 24s Details CI / UI (push) Successful in 51s Details Release / Check ui (push) Successful in 29s Details CI / UI (pull_request) Successful in 27s Details CI / Backend (pull_request) Successful in 44s Details Release / Docker / caddy (push) Successful in 54s Details Release / Docker / ui (push) Successful in 2m4s Details Release / Docker / runner (push) Successful in 2m56s Details Release / Docker / backend (push) Successful in 3m23s Details Release / Gitea Release (push) Successful in 12s Details	2026-03-31 22:36:19 +05:00
Admin	f4089fe111	fix(admin): add layout guard and redirect /admin to /admin/scrape All checks were successful CI / Backend (push) Successful in 45s Details CI / UI (push) Successful in 56s Details Release / Check ui (push) Successful in 26s Details Release / Test backend (push) Successful in 39s Details CI / Backend (pull_request) Successful in 24s Details Release / Docker / caddy (push) Successful in 48s Details CI / UI (pull_request) Successful in 40s Details Release / Docker / runner (push) Successful in 2m52s Details Release / Docker / backend (push) Successful in 3m27s Details Release / Docker / ui (push) Successful in 3m38s Details Release / Gitea Release (push) Successful in 14s Details - Add +layout.server.ts to enforce admin role check at layout level, preventing 404 on /admin and protecting all sub-routes centrally - Add +page.server.ts to redirect /admin → /admin/scrape (was 404)	2026-03-31 22:33:39 +05:00
Admin	87b5ad1460	feat(auth): add debug-login bypass endpoint secured by DEBUG_LOGIN_TOKEN All checks were successful CI / Backend (push) Successful in 43s Details CI / UI (push) Successful in 1m10s Details Release / Check ui (push) Successful in 26s Details Release / Test backend (push) Successful in 41s Details CI / Backend (pull_request) Successful in 25s Details Release / Docker / caddy (push) Successful in 47s Details CI / UI (pull_request) Successful in 41s Details Release / Docker / ui (push) Successful in 2m32s Details Release / Docker / backend (push) Successful in 3m57s Details Release / Docker / runner (push) Successful in 4m8s Details Release / Gitea Release (push) Successful in 12s Details	2026-03-31 21:59:58 +05:00
Admin	168cb52ed0	fix(admin): use --color-surface for drawer bg (--color-bg was undefined) Some checks failed CI / Backend (push) Successful in 43s Details CI / UI (push) Successful in 58s Details Release / Check ui (push) Successful in 26s Details Release / Test backend (push) Successful in 38s Details Release / Docker / caddy (push) Successful in 45s Details CI / Backend (pull_request) Successful in 26s Details Release / Docker / ui (push) Failing after 10s Details CI / UI (pull_request) Successful in 42s Details Release / Docker / runner (push) Failing after 19s Details Release / Docker / backend (push) Successful in 1m42s Details Release / Gitea Release (push) Has been skipped Details Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-31 18:53:58 +05:00
Admin	e1621a3ec2	fix(infra): move Redis to prod, fix LibreTranslate config loading All checks were successful CI / Backend (push) Successful in 46s Details CI / UI (push) Successful in 52s Details Release / Docker / caddy (push) Successful in 34s Details Release / Test backend (push) Successful in 48s Details Release / Check ui (push) Successful in 49s Details CI / Backend (pull_request) Successful in 25s Details CI / UI (pull_request) Successful in 56s Details Release / Docker / runner (push) Successful in 1m46s Details Release / Docker / ui (push) Successful in 2m30s Details Release / Docker / backend (push) Successful in 2m47s Details Release / Gitea Release (push) Successful in 13s Details - Add Redis sidecar to prod docker-compose; backend connects locally (redis:6379) - Caddy layer4 now proxies redis.libnovel.cc:6380 → local redis:6379 (not homelab LAN) - Remove HOMELAB_REDIS_ADDR; homelab runner connects out to prod Redis via rediss:// - Remove local Redis from homelab runner compose; drop redis_data volume - Fix config.Load() missing LibreTranslate section — LIBRETRANSLATE_URL was never read	2026-03-31 18:26:32 +05:00
Admin	10c7a48bc6	fix(admin): move mobile nav toggle into content area to avoid z-index conflict Some checks failed CI / Backend (push) Successful in 43s Details CI / UI (push) Successful in 59s Details Release / Test backend (push) Successful in 37s Details Release / Check ui (push) Successful in 27s Details Release / Docker / caddy (push) Failing after 39s Details CI / UI (pull_request) Successful in 25s Details CI / Backend (pull_request) Successful in 44s Details Release / Docker / ui (push) Successful in 2m5s Details Release / Docker / runner (push) Successful in 2m27s Details Release / Docker / backend (push) Successful in 3m12s Details Release / Gitea Release (push) Has been skipped Details The fixed top bar was hidden behind the main site navbar (z-50). Replace with an inline 'Admin menu' button at the top of the content. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-31 17:07:28 +05:00
Admin	8b597c0bd2	fix(caddy): fix logo branding on all error pages All checks were successful Release / Test backend (push) Successful in 23s Details CI / Backend (push) Successful in 41s Details CI / UI (push) Successful in 49s Details Release / Check ui (push) Successful in 27s Details CI / UI (pull_request) Successful in 27s Details CI / Backend (pull_request) Successful in 47s Details Release / Docker / caddy (push) Successful in 1m7s Details Release / Docker / backend (push) Successful in 1m48s Details Release / Docker / ui (push) Successful in 2m2s Details Release / Docker / runner (push) Successful in 3m9s Details Release / Gitea Release (push) Successful in 13s Details Match main site logo style: lowercase 'libnovel' in full brand amber. Add meta http-equiv refresh fallback for 5xx pages. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-31 16:39:38 +05:00
Admin	28cafe2aa8	fix(admin): make sidebar responsive on mobile with slide-out drawer All checks were successful CI / Backend (push) Successful in 50s Details CI / UI (push) Successful in 25s Details Release / Test backend (push) Successful in 39s Details Release / Docker / caddy (push) Successful in 32s Details Release / Check ui (push) Successful in 47s Details CI / UI (pull_request) Successful in 27s Details CI / Backend (pull_request) Successful in 43s Details Release / Docker / runner (push) Successful in 2m1s Details Release / Docker / ui (push) Successful in 2m30s Details Release / Docker / backend (push) Successful in 3m3s Details Release / Gitea Release (push) Successful in 13s Details Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-31 16:33:17 +05:00
Admin	65f0425b61	fix(i18n): add _inputs param to admin_nav paraglide inner functions; exclude Go binaries from git All checks were successful Release / Test backend (push) Successful in 43s Details Release / Check ui (push) Successful in 25s Details CI / Backend (push) Successful in 26s Details Release / Docker / caddy (push) Successful in 47s Details CI / Backend (pull_request) Successful in 28s Details CI / UI (push) Successful in 54s Details CI / UI (pull_request) Successful in 40s Details Release / Docker / backend (push) Successful in 2m1s Details Release / Docker / ui (push) Successful in 2m14s Details Release / Docker / runner (push) Successful in 3m37s Details Release / Gitea Release (push) Successful in 22s Details The admin_nav_* message files generated by paraglide used 0-param inner functions but called them with inputs, causing 50 svelte-check type errors. Add _inputs = {} to each inner locale function to match the call signature. Also adds backend/backend and backend/runner to .gitignore — binaries are built inside Dockerfile and should never be committed.	2026-03-31 10:53:44 +05:00
Admin	4e70a2981d	fix(pipeline): add redis+libretranslate to homelab, make Asynq enqueue errors non-fatal Some checks failed CI / Backend (pull_request) Successful in 35s Details CI / UI (push) Failing after 37s Details CI / Backend (push) Successful in 53s Details CI / UI (pull_request) Failing after 27s Details - homelab/docker-compose.yml: add redis:7-alpine service (port 6379 bound to host so Caddy TLS proxy on prod can reach it), add libretranslate service, add redis_data and libretranslate_data volumes - asynqqueue/producer.go: Asynq enqueue failures are now logged as warnings instead of returned as errors — PB record already exists so runner picks it up via poll - backend/main.go: pass logger to NewProducer Root cause: Redis was not reachable at 192.168.0.109:6379 because the redis container had no host port binding. Caddy TLS proxy terminates TLS but could not TCP-connect to the backend Redis.	2026-03-31 10:18:13 +05:00
Admin	004cb95e56	feat(i18n): translate admin sidebar nav labels (pages + tools) Some checks failed CI / Backend (pull_request) Successful in 49s Details CI / UI (pull_request) Failing after 23s Details Release / Test backend (push) Successful in 30s Details CI / Backend (push) Successful in 1m0s Details CI / UI (push) Failing after 45s Details Release / Check ui (push) Failing after 19s Details Release / Docker / ui (push) Has been skipped Details Release / Docker / caddy (push) Successful in 1m21s Details Release / Docker / runner (push) Successful in 2m40s Details Release / Docker / backend (push) Successful in 3m28s Details Release / Gitea Release (push) Has been skipped Details	2026-03-31 00:42:32 +05:00
Admin	aca649039c	feat(ui): replace theme dots with dropdown, remove chevrons from lang and profile buttons Some checks failed CI / Backend (pull_request) Successful in 56s Details CI / UI (pull_request) Successful in 29s Details Release / Test backend (push) Successful in 27s Details CI / Backend (push) Successful in 45s Details CI / UI (push) Successful in 52s Details Release / Check ui (push) Successful in 29s Details Release / Docker / caddy (push) Successful in 58s Details Release / Docker / backend (push) Successful in 3m33s Details Release / Docker / ui (push) Successful in 1m52s Details Release / Docker / runner (push) Failing after 11s Details Release / Gitea Release (push) Has been skipped Details	2026-03-31 00:20:06 +05:00