playwright stuff

- db: drop host :5432 publish (ports !override []) — no LAN exposure, reached
  via compose net (db:5432) + docker exec for the ALTER USER reconcile. Matches
  inspectflow isolation. backend :8081 kept (LAN-only, used by healthcheck).
- deploy verify-frontend: probe container loopback via bundled node instead of
  host :3000 wget. Network-namespace-independent; fixes the transient
  false-failure when polling mid-recreate. <500 = healthy (307->/login).

.env.example

@@ -0,0 +1,15 @@
+# CannaManage — Environment Variables
+# Copy this file to .env and fill in the values.
+# NEVER commit .env to git.
+
+# Database
+DB_PASSWORD=cannamanage_dev
+
+# JWT Secret — must be valid base64 (used by Decoders.BASE64.decode in JwtService)
+# Generate with: openssl rand -base64 48
+JWT_SECRET=
+
+# NextAuth / Auth.js secret — minimum 32 characters
+# Generate with: openssl rand -base64 32
+NEXTAUTH_SECRET=
+AUTH_SECRET=

.gitea/workflows/ci.yml

@@ -0,0 +1,195 @@
+name: CI — Build, Lint & Security Scan
+
+# Runs on every push to main. Must pass before deploy.
+# Security scans catch CVEs, license issues, and secrets BEFORE they reach prod.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Backend: compile + test + dependency audit
+  # ─────────────────────────────────────────────────────────────────────────────
+  backend:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: cannamanage_test
+          POSTGRES_USER: test
+          POSTGRES_PASSWORD: test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 21
+          cache: maven
+
+      - name: Maven compile
+        run: ./mvnw compile -B -q -DskipTests -T 1C
+
+      - name: Maven test
+        run: ./mvnw test -B -T 1C
+        env:
+          CI_POSTGRES_URL: jdbc:postgresql://localhost:5432/cannamanage_test
+          CI_POSTGRES_USER: test
+          CI_POSTGRES_PASSWORD: test
+
+      - name: OWASP Dependency-Check (SCA)
+        run: |
+          ./mvnw org.owasp:dependency-check-maven:check \
+            -DfailBuildOnCVSS=7 \
+            -DsuppressionFile=.snyk-maven-suppressions.xml \
+            -Dformats=JSON,HTML \
+            -B -q
+        # failBuildOnCVSS=7: High/Critical CVEs fail the build.
+        # Suppress known false positives in .snyk-maven-suppressions.xml.
+
+      - name: Upload dependency-check report
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: dependency-check-report
+          path: target/dependency-check-report.*
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Frontend: lint + type-check + dependency audit
+  # ─────────────────────────────────────────────────────────────────────────────
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install pnpm
+        run: corepack enable && corepack prepare pnpm@10.8.1 --activate
+
+      - name: Install dependencies
+        run: cd cannamanage-frontend && pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: cd cannamanage-frontend && pnpm lint
+
+      - name: Type check
+        run: cd cannamanage-frontend && pnpm type-check
+
+      - name: pnpm audit (SCA)
+        run: |
+          cd cannamanage-frontend
+          pnpm audit --audit-level=high
+        # Fails on High/Critical. Use .pnpmauditrc or --ignore for known exceptions.
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Docker image security scan (Trivy)
+  # ─────────────────────────────────────────────────────────────────────────────
+  image-scan:
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build images (parallel)
+        run: |
+          set -euo pipefail
+          docker build -t cannamanage-backend:scan -f Dockerfile.backend . &
+          PID1=$!
+          docker build -t cannamanage-frontend:scan -f cannamanage-frontend/Dockerfile cannamanage-frontend/ &
+          PID2=$!
+          wait $PID1 $PID2
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Scan backend image
+        run: |
+          trivy image \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            --ignore-unfixed \
+            --format table \
+            cannamanage-backend:scan
+
+      - name: Scan frontend image
+        run: |
+          trivy image \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            --ignore-unfixed \
+            --format table \
+            cannamanage-frontend:scan
+
+      - name: Scan backend image (full report — JSON)
+        if: always()
+        run: |
+          trivy image \
+            --format json \
+            --output trivy-backend.json \
+            cannamanage-backend:scan
+
+      - name: Scan frontend image (full report — JSON)
+        if: always()
+        run: |
+          trivy image \
+            --format json \
+            --output trivy-frontend.json \
+            cannamanage-frontend:scan
+
+      - name: Upload Trivy reports
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: trivy-reports
+          path: trivy-*.json
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Secret detection (Gitleaks)
+  # ─────────────────────────────────────────────────────────────────────────────
+  secrets-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
+            | tar -xz -C /usr/local/bin gitleaks
+
+      - name: Run Gitleaks
+        run: |
+          gitleaks detect \
+            --source . \
+            --report-format json \
+            --report-path gitleaks-report.json \
+            --exit-code 1
+
+      - name: Upload Gitleaks report
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: gitleaks-report
+          path: gitleaks-report.json

.gitea/workflows/deploy.yml

@@ -12,7 +12,8 @@ name: Deploy to TrueNAS
 #
 # Compose project name is pinned to "cannamanage" so it updates the existing
 # containers and reuses the persistent "cannamanage_pgdata" volume on the host.
-# Live ports: backend 8081->8080, frontend 3000, db 5432
+# Live host ports: frontend 3000, backend 8081->8080 (LAN, healthcheck/debug).
+# db is internal-only (no host publish) — reachable as db:5432 on the compose net.
 
 on:
   push:
@@ -28,6 +29,13 @@ jobs:
     runs-on: ubuntu-latest
     env:
       COMPOSE: docker compose -f docker-compose.yml -f docker-compose.truenas.yml -p cannamanage
+      # Production secrets — set in Gitea repo Settings → Actions → Secrets.
+      # AUTH_SECRET  : NextAuth v5 session secret (rotating invalidates sessions)
+      # JWT_SECRET   : base64 backend HMAC key (rotating invalidates all tokens)
+      # DB_PASSWORD  : Postgres role password (must match the live DB role)
+      AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
+      JWT_SECRET: ${{ secrets.JWT_SECRET }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
     steps:
       - name: Check out pushed commit
         uses: actions/checkout@v4
@@ -38,11 +46,39 @@ jobs:
           docker version --format 'docker {{.Server.Version}}'
           docker compose version
 
+      # NOTE: Backend tests (mvn test) and frontend lint (pnpm lint) are run locally
+      # before pushing. The self-hosted act runner uses Docker-in-Docker which doesn't
+      # support volume mounts for nested containers. Tests remain a local-only gate.
+
       - name: Build images
         run: |
           set -euo pipefail
           $COMPOSE build
 
+      - name: Ensure DB up & reconcile role password
+        run: |
+          set -euo pipefail
+          # Start just the db first (idempotent — reuses the running container
+          # and the persistent cannamanage_pgdata volume).
+          $COMPOSE up -d db
+          echo "Waiting for db to accept connections ..."
+          for i in $(seq 1 20); do
+            if docker exec cannamanage-db pg_isready -U cannamanage -q; then break; fi
+            echo "  attempt $i/20 — waiting 3s"; sleep 3
+          done
+          # POSTGRES_PASSWORD only applies on FIRST volume init, so the existing
+          # volume still holds the old role password. Force the live role to match
+          # the rotated ${DB_PASSWORD} so the backend can authenticate. Local
+          # socket connections inside the container use trust auth (no password).
+          # Skipped when the secret is unset to avoid blanking the dev password.
+          if [ -n "${DB_PASSWORD:-}" ]; then
+            docker exec cannamanage-db psql -U cannamanage -d cannamanage \
+              -c "ALTER USER cannamanage WITH PASSWORD '${DB_PASSWORD}';"
+            echo "✅ DB role password reconciled"
+          else
+            echo "⚠️  DB_PASSWORD secret not set — leaving role password unchanged"
+          fi
+
       - name: Roll out stack
         run: |
           set -euo pipefail
@@ -66,11 +102,25 @@ jobs:
 
       - name: Verify frontend
         run: |
-          if wget -q -O /dev/null http://192.168.188.119:3000; then
+          set -euo pipefail
-            echo "✅ Frontend responding on :3000"
+          # Probe the frontend on its own loopback INSIDE the container via the
-          else
+          # bundled node runtime. This is network-namespace-independent (no
-            echo "⚠️ Frontend not responding yet (may still be starting)"
+          # reliance on the host port being wired during a mid-recreate window,
+          # which caused a transient false-failure previously) and needs no
+          # wget/curl in the image. Any HTTP status < 500 counts as "up" — the
+          # root path returns 307 -> /login when unauthenticated, which is healthy.
+          echo "Waiting for frontend on container loopback :3000 ..."
+          for i in $(seq 1 20); do
+            if docker exec cannamanage-frontend node -e "require('http').get('http://127.0.0.1:3000/',r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"; then
+              echo "✅ Frontend responding after ${i} attempt(s)"
+              exit 0
             fi
+            echo "  attempt $i/20 — waiting 5s"
+            sleep 5
+          done
+          echo "❌ Frontend did not respond — recent logs:"
+          $COMPOSE logs --tail=40 frontend
+          exit 1
 
       - name: Prune dangling images
         run: docker image prune -f || true

.gitignore

@@ -15,3 +15,5 @@ cannamanage-frontend/.env.local
 
 # Production secrets (never commit)
 .env
+~/
+~/

.playwright-mcp/page-2026-06-16T18-24-49-418Z.yml

@@ -0,0 +1,189 @@
+- generic [active] [ref=e1]:
+  - generic [ref=e2]:
+    - navigation "Navigation Bar" [ref=e3]:
+      - generic [ref=e4]:
+        - link "Home" [ref=e5] [cursor=pointer]:
+          - /url: /
+          - img [ref=e6]
+        - link "Explore" [ref=e7] [cursor=pointer]:
+          - /url: /explore/repos
+        - link "Help" [ref=e8] [cursor=pointer]:
+          - /url: https://docs.gitea.com
+      - generic [ref=e9]:
+        - link "Register" [ref=e10] [cursor=pointer]:
+          - /url: /user/sign_up
+          - img [ref=e11]
+          - generic [ref=e13]: Register
+        - link "Sign In" [ref=e14] [cursor=pointer]:
+          - /url: /user/login
+          - img [ref=e15]
+          - generic [ref=e17]: Sign In
+    - generic [ref=e18]:
+      - generic [ref=e19]:
+        - generic [ref=e21]:
+          - generic [ref=e22]:
+            - img [ref=e24]
+            - generic [ref=e27]:
+              - link "pplate" [ref=e28] [cursor=pointer]:
+                - /url: /pplate
+              - text: /
+              - link "cannamanage" [ref=e29] [cursor=pointer]:
+                - /url: /pplate/cannamanage
+          - generic [ref=e30]:
+            - link "RSS Feed" [ref=e31] [cursor=pointer]:
+              - /url: /pplate/cannamanage.rss
+              - img [ref=e32]
+            - generic "Sign in to watch this repository." [ref=e35] [cursor=pointer]:
+              - button "Watch" [disabled]:
+                - img
+                - generic: Watch
+              - link "1" [ref=e36]:
+                - /url: /pplate/cannamanage/watchers
+            - generic "Sign in to star this repository." [ref=e38] [cursor=pointer]:
+              - button "Star" [disabled]:
+                - img
+                - generic: Star
+              - link "0" [ref=e39]:
+                - /url: /pplate/cannamanage/stars
+            - generic "Sign in to fork this repository.":
+              - generic:
+                - img
+                - generic: Fork
+              - link "0":
+                - /url: /pplate/cannamanage/forks
+        - navigation [ref=e41]:
+          - generic [ref=e42]:
+            - link "Code" [ref=e43] [cursor=pointer]:
+              - /url: /pplate/cannamanage/src/
+              - img [ref=e44]
+              - generic [ref=e46]: Code
+            - link "Issues 9" [ref=e47] [cursor=pointer]:
+              - /url: /pplate/cannamanage/issues
+              - img [ref=e48]
+              - generic [ref=e51]: Issues
+              - generic [ref=e52]: "9"
+            - link "Pull Requests" [ref=e53] [cursor=pointer]:
+              - /url: /pplate/cannamanage/pulls
+              - img [ref=e54]
+              - generic [ref=e56]: Pull Requests
+            - link "Actions" [ref=e57] [cursor=pointer]:
+              - /url: /pplate/cannamanage/actions
+              - img [ref=e58]
+              - generic [ref=e60]: Actions
+            - link "Packages" [ref=e61] [cursor=pointer]:
+              - /url: /pplate/cannamanage/packages
+              - img [ref=e62]
+              - generic [ref=e64]: Packages
+            - link "Projects" [ref=e65] [cursor=pointer]:
+              - /url: /pplate/cannamanage/projects
+              - img [ref=e66]
+              - generic [ref=e68]: Projects
+            - link "Releases" [ref=e69] [cursor=pointer]:
+              - /url: /pplate/cannamanage/releases
+              - img [ref=e70]
+              - generic [ref=e72]: Releases
+            - link "Wiki" [ref=e73] [cursor=pointer]:
+              - /url: /pplate/cannamanage/wiki
+              - img [ref=e74]
+              - generic [ref=e76]: Wiki
+            - link "Activity" [ref=e77] [cursor=pointer]:
+              - /url: /pplate/cannamanage/activity
+              - img [ref=e78]
+              - generic [ref=e80]: Activity
+      - generic [ref=e83]:
+        - generic [ref=e84]:
+          - generic [ref=e86]:
+            - generic "Failure" [ref=e87]:
+              - img [ref=e88]
+            - 'heading "ci(deploy): auto-deploy to TrueNAS via self-hosted Gitea Actions runner" [level=2] [ref=e90]'
+          - generic [ref=e91]:
+            - generic [ref=e92]:
+              - link "deploy.yml" [ref=e93] [cursor=pointer]:
+                - /url: /pplate/cannamanage/actions/?workflow=deploy.yml
+              - text: ":"
+            - text: Commit
+            - link "3b15d7439d" [ref=e94] [cursor=pointer]:
+              - /url: /pplate/cannamanage/commit/3b15d7439dceb6cb073f871a0955b0acd31630ee
+            - text: pushed by
+            - link "pplate" [ref=e95] [cursor=pointer]:
+              - /url: /pplate
+            - link "main" [ref=e97] [cursor=pointer]:
+              - /url: /pplate/cannamanage/src/branch/main
+        - generic [ref=e98]:
+          - generic [ref=e99]:
+            - link "Summary" [ref=e100] [cursor=pointer]:
+              - /url: /pplate/cannamanage/actions/runs/29
+              - img [ref=e101]
+              - generic [ref=e103]: Summary
+            - generic [ref=e105]: All jobs
+            - list [ref=e106]:
+              - listitem [ref=e107]:
+                - link "Failure deploy 3s" [ref=e108] [cursor=pointer]:
+                  - /url: /pplate/cannamanage/actions/runs/29/jobs/57
+                  - generic "Failure" [ref=e109]:
+                    - img [ref=e110]
+                  - generic [ref=e112]: deploy
+                  - generic [ref=e113]: 3s
+            - generic [ref=e115]: Run Details
+            - list [ref=e116]:
+              - listitem [ref=e117]:
+                - link "Workflow file" [ref=e118] [cursor=pointer]:
+                  - /url: /pplate/cannamanage/actions/runs/29/workflow
+                  - img [ref=e119]
+                  - generic [ref=e121]: Workflow file
+          - generic [ref=e123]:
+            - generic [ref=e124]:
+              - generic [ref=e125]:
+                - text: Triggered via push •
+                - generic "Jun 16, 2026, 6:52 PM" [ref=e126]: 1 hour ago
+              - generic [ref=e127]:
+                - generic "Failure" [ref=e128]:
+                  - img [ref=e129]
+                - generic [ref=e131]: Failure
+                - text: •
+                - generic [ref=e132]: "Total duration: 3s"
+            - generic [ref=e133]:
+              - generic [ref=e134]:
+                - heading "Workflow Dependencies" [level=4] [ref=e135]
+                - generic [ref=e136]:
+                  - text: 1 jobs • 0 dependencies
+                  - generic [ref=e137]: • 0% success
+                - generic [ref=e138]:
+                  - button "Already at 100% zoom" [disabled]:
+                    - img
+                  - button "Reset view" [ref=e139] [cursor=pointer]:
+                    - img [ref=e140]
+                  - button "Zoom out (Ctrl/Cmd + scroll on graph)" [ref=e142] [cursor=pointer]:
+                    - img [ref=e143]
+              - img [ref=e147]:
+                - generic "deploy" [ref=e148] [cursor=pointer]:
+                  - generic:
+                    - generic:
+                      - generic "failure":
+                        - img
+                  - generic [ref=e151]:
+                    - generic: deploy
+                    - generic: 3s
+  - group "Footer" [ref=e152]:
+    - contentinfo "About Software" [ref=e153]:
+      - link "Powered by Gitea" [ref=e154] [cursor=pointer]:
+        - /url: https://about.gitea.com
+      - generic [ref=e155]: "Version: 1.26.2"
+      - generic [ref=e156]:
+        - text: "Page:"
+        - strong [ref=e157]: 3ms
+        - text: "Template:"
+        - strong [ref=e158]: 1ms
+    - group "Links" [ref=e159]:
+      - menu [ref=e160] [cursor=pointer]:
+        - generic [ref=e162]:
+          - img [ref=e163]
+          - text: Auto
+      - menu [ref=e165] [cursor=pointer]:
+        - generic [ref=e166]:
+          - img [ref=e167]
+          - text: English
+      - link "Licenses" [ref=e169] [cursor=pointer]:
+        - /url: /assets/licenses.txt
+      - link "API" [ref=e170] [cursor=pointer]:
+        - /url: /api/swagger

.snyk

@@ -0,0 +1,19 @@
+# Snyk (https://snyk.io) policy file — managed by Lumen
+# Ignores documented false positives and accepted risks.
+version: v1.25.0
+language-settings:
+  java:
+    countUntriaged: false
+
+ignore:
+  # CSRF disabled on stateless JWT API chain — intentional and correct per OWASP:
+  # "If your application does not use cookies for authentication, CSRF is not a risk."
+  # The API security filter chain (Order 1) uses Authorization: Bearer tokens only.
+  # The portal filter chain (Order 2) correctly enables CSRF via CookieCsrfTokenRepository.
+  SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-CSRF:
+    - 'cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java':
+        reason: >-
+          Stateless JWT API — CSRF not applicable. Browser never auto-sends
+          Bearer tokens. Portal chain has CSRF enabled via CookieCsrfTokenRepository.
+        expires: 2027-06-19T00:00:00.000Z
+        created: 2026-06-19T07:00:00.000Z

README.md

@@ -1,111 +1,87 @@
 # CannaManage
 
-Multi-tenant cannabis club management platform for German **Anbauvereinigungen** (cultivation associations) under CanG §19.
+Full-stack management platform for German cannabis cultivation associations (Anbauvereinigungen) under the CanG/KCanG regulatory framework.
-
-## Overview
-
-CannaManage handles member management, distribution tracking, and legal compliance for cannabis cultivation clubs in Germany. It enforces the strict quotas mandated by the Cannabis Act (CanG) — including monthly limits (50g adult / 30g under-21), daily limits (25g), and THC restrictions for minors.
 
 ## Tech Stack
 
-| Component | Technology |
+| Layer | Technology |
-|-----------|-----------|
+|-------|-----------|
-| Runtime | Java 21 (Temurin) |
+| **Frontend** | Next.js 15, React 19, TypeScript, Tailwind CSS 4, shadcn/ui |
-| Framework | Spring Boot 4.0.6 |
+| **Backend** | Spring Boot 3.5, Java 17, Spring Security (JWT + session) |
-| Security | Spring Security 7.0 + JWT (JJWT 0.12.6) |
+| **Database** | PostgreSQL 16, Flyway migrations |
-| ORM | Hibernate 7 / JPA |
+| **Infrastructure** | Docker Compose, Gitea Actions CI/CD, TrueNAS deployment |
-| Database | PostgreSQL (prod), H2 (test) |
-| Migrations | Flyway 10 |
-| API Docs | SpringDoc OpenAPI 2.8.6 |
-| Build | Maven (multi-module) |
-| Container | Docker Compose (Postgres + app) |
 
 ## Project Structure
 
 ```
 cannamanage/
-├── cannamanage-domain/      # JPA entities, enums, TenantContext
+├── cannamanage-api/        # Spring Boot REST API (entry point)
-├── cannamanage-service/     # Business logic, repositories, ComplianceService
+├── cannamanage-service/    # Business logic layer
-├── cannamanage-api/         # Spring Boot app, controllers, security, DTOs
+├── cannamanage-domain/     # JPA entities, enums, value objects
-├── docs/
+├── cannamanage-frontend/   # Next.js frontend (pnpm)
-│   └── sprint-2/           # Sprint planning docs
+├── deploy/                 # Deployment scripts & nginx config
-└── docker-compose.yml       # Local dev environment
+├── docker-compose.yml      # Local development stack
+└── .gitea/workflows/       # CI/CD pipeline
 ```
 
-## Modules
+## Local Development
 
-### cannamanage-domain
+### Prerequisites
-JPA entities with multi-tenant isolation via `@Filter("tenantFilter")`:
-- `Member` — club members with age tracking
-- `Distribution` — cannabis distribution records
-- `MonthlyQuota` — per-member monthly usage tracking
-- `Batch` / `Strain` / `StockMovement` — inventory management
-- `Club` — association registration
-- `User` — authentication accounts
 
-### cannamanage-service
+- Java 17+
-- `ComplianceService` — CanG §19 quota enforcement (25 unit tests)
+- Maven 3.9+
-- Repositories for all entities
+- Node.js 22+ with pnpm 10+
+- Docker & Docker Compose
 
-### cannamanage-api
+### Backend
-- **Auth** — JWT login + refresh token rotation (SHA-256 hashed)
-- **Members** — CRUD for association members
-- **Distributions** — compliance-gated distribution recording
-- **Stock** — batch and inventory management
-- **Compliance** — quota status API
-- Multi-tenant isolation via `TenantFilterAspect` (Hibernate @Filter activation)
-
-## API Endpoints
-
-| Method | Path | Auth | Description |
-|--------|------|------|-------------|
-| POST | `/api/v1/auth/login` | Public | Login with email + password |
-| POST | `/api/v1/auth/refresh` | Public | Refresh token rotation |
-| GET | `/api/v1/compliance/quota/{memberId}` | ADMIN, MEMBER | Monthly quota status |
-| GET/POST/PUT | `/api/v1/members/**` | ADMIN, MEMBER | Member CRUD |
-| POST | `/api/v1/distributions/**` | ADMIN, MEMBER | Record distributions |
-| GET/POST | `/api/v1/stock/**` | ADMIN | Stock management |
-
-Swagger UI: `http://localhost:8080/swagger-ui.html`
-
-## Running Locally
 
 ```bash
 # Start PostgreSQL
-docker compose up -d
+docker compose up -d db
 
-# Run the app
+# Run Spring Boot
-JAVA_HOME=/path/to/jdk-21 ./mvnw spring-boot:run -pl cannamanage-api
+mvn spring-boot:run -f cannamanage-api/pom.xml -Dspring-boot.run.profiles=local
-
-# Run all tests (H2 in-memory)
-JAVA_HOME=/path/to/jdk-21 ./mvnw clean verify
 ```
 
-## Testing
+### Frontend
 
-- **37 tests total** — all green
+```bash
-- 25 unit tests (`ComplianceServiceTest`) — quota enforcement logic
+cd cannamanage-frontend
-- 7 integration tests (`AuthControllerIntegrationTest`) — full HTTP auth flow
+pnpm install
-- 5 integration tests (`ComplianceControllerIntegrationTest`) — quota API with JWT
+pnpm dev
+```
 
-Integration tests use `@SpringBootTest(webEnvironment = RANDOM_PORT)` with H2 and Spring's `RestClient`.
+The frontend runs on http://localhost:3000, backend on http://localhost:8080.
 
-## Security Model
+### Full Stack (Docker)
 
-- **Stateless JWT** — no session, no UserDetailsService
+```bash
-- **Roles**: ADMIN (full access), MEMBER (self-service), STAFF (Sprint 3)
+docker compose up --build
-- **Multi-tenancy**: Hibernate `@Filter` activated per-request via AOP aspect
+```
-- **Refresh tokens**: SHA-256 hashed (Spring Security 7 enforces BCrypt 72-byte limit)
-- Token rotation on refresh — old tokens invalidated
 
-## Sprint History
+## Deployment
 
-| Sprint | Focus | Status |
+Push to `main` triggers the Gitea Actions CI pipeline which:
-|--------|-------|--------|
+1. Runs backend tests (`mvn test`)
-| 1 | Domain entities, ComplianceService, 25 tests | ✅ Done |
+2. Runs frontend lint (`pnpm lint`)
-| 2 | REST API, Spring Security, JWT, OpenAPI, integration tests | ✅ Done |
+3. Builds Docker images
-| 3 | Member portal, STAFF role, real-time notifications | 📋 Planned |
+4. Deploys to TrueNAS via Docker Compose
+5. Verifies backend health + frontend availability
+
+Manual deploy:
+```bash
+cd deploy && ./deploy.sh
+```
+
+## Environment Variables
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `CANNAMANAGE_SECURITY_JWT_SECRET` | JWT signing key (base64, 256-bit) | — (required) |
+| `CORS_ORIGINS` | Allowed CORS origins (comma-separated) | `http://localhost:3000` |
+| `SMTP_HOST` / `SMTP_PORT` | Mail server for invites | `localhost:1025` |
+| `SCHEDULERS_ENABLED` | Enable background jobs | `true` |
 
 ## License
 
-Private — Patrick Plate
+Proprietary — Patrick Plate

cannamanage-api/pom.xml

@@ -140,6 +140,17 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-websocket</artifactId>
         </dependency>
+        <!-- Rate limiting (Bucket4j + Caffeine cache) -->
+        <dependency>
+            <groupId>com.bucket4j</groupId>
+            <artifactId>bucket4j-core</artifactId>
+            <version>8.10.1</version>
+        </dependency>
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+            <version>3.1.8</version>
+        </dependency>
     </dependencies>
 
     <build>

cannamanage-api/src/main/java/de/cannamanage/api/controller/DocumentController.java

@@ -9,6 +9,7 @@ import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.server.ResponseStatusException;
@@ -21,6 +22,7 @@ import java.util.UUID;
 
 @RestController
 @RequestMapping("/api/v1")
+@PreAuthorize("hasAnyRole('ADMIN', 'STAFF', 'MEMBER')")
 public class DocumentController {
 
     private final DocumentService documentService;
@@ -33,13 +35,14 @@ public class DocumentController {
      * Verify the requested document belongs to the caller's current tenant (club).
      * Prevents IDOR: a user from club A must not be able to download/delete a document of club B
      * just by guessing or enumerating the document UUID.
+     * Returns 404 (not 403) to avoid revealing document existence to other tenants.
      */
     private Document loadOwnedDocument(UUID documentId) {
         Document doc = documentService.getDocument(documentId);
         UUID currentTenantId = TenantContext.getCurrentTenant();
         if (currentTenantId == null || doc.getClubId() == null || !doc.getClubId().equals(currentTenantId)) {
-            // Use 403 (not 404) — caller is authenticated, just not authorized for this resource.
+            // Return 404 to prevent information leakage about document existence across tenants
-            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Access denied to document");
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "Document not found");
         }
         return doc;
     }
@@ -78,6 +81,7 @@ public class DocumentController {
     }
 
     @DeleteMapping("/documents/{id}")
+    @PreAuthorize("hasAnyRole('ADMIN', 'STAFF')")
     public ResponseEntity<Void> deleteDocument(
             @PathVariable UUID id,
             @RequestParam UUID clubId,
@@ -87,7 +91,7 @@ public class DocumentController {
         Document doc = loadOwnedDocument(id);
         UUID currentTenantId = TenantContext.getCurrentTenant();
         if (!clubId.equals(currentTenantId)) {
-            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Tenant mismatch");
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "Document not found");
         }
         UUID userId = UUID.fromString(principal.getName());
         documentService.deleteDocument(id, userId, doc.getClubId());

cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java

@@ -0,0 +1,34 @@
+package de.cannamanage.api.controller;
+
+import de.cannamanage.domain.entity.TenantContext;
+import de.cannamanage.service.StorageQuotaService;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.UUID;
+
+/**
+ * REST controller for storage quota information.
+ * Provides endpoint to check current storage usage for the caller's club.
+ * Club ID is extracted from the JWT/tenant context — not from request params.
+ */
+@RestController
+@RequestMapping("/api/v1/storage")
+@PreAuthorize("hasAnyRole('ADMIN', 'STAFF')")
+public class StorageController {
+
+    private final StorageQuotaService storageQuotaService;
+
+    public StorageController(StorageQuotaService storageQuotaService) {
+        this.storageQuotaService = storageQuotaService;
+    }
+
+    @GetMapping("/usage")
+    public ResponseEntity<StorageQuotaService.StorageUsageDTO> getUsage() {
+        UUID clubId = TenantContext.getCurrentTenant();
+        return ResponseEntity.ok(storageQuotaService.getUsage(clubId));
+    }
+}

cannamanage-api/src/main/java/de/cannamanage/api/exception/GlobalExceptionHandler.java

@@ -5,6 +5,7 @@ import de.cannamanage.service.exception.BatchNotFoundException;
 import de.cannamanage.service.exception.MemberNotFoundException;
 import de.cannamanage.service.exception.PreventionOfficerLimitExceededException;
 import de.cannamanage.service.exception.QuotaExceededException;
+import de.cannamanage.service.exception.StorageQuotaExceededException;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ProblemDetail;
@@ -121,6 +122,20 @@ public class GlobalExceptionHandler {
         return problem;
     }
 
+    @ExceptionHandler(StorageQuotaExceededException.class)
+    public ProblemDetail handleStorageQuotaExceeded(StorageQuotaExceededException ex) {
+        ProblemDetail problem = ProblemDetail.forStatusAndDetail(
+                HttpStatus.PAYMENT_REQUIRED, ex.getMessage());
+        problem.setTitle("Storage Quota Exceeded");
+        problem.setType(URI.create("urn:cannamanage:error:STORAGE_QUOTA_EXCEEDED"));
+        problem.setProperty("code", "STORAGE_QUOTA_EXCEEDED");
+        problem.setProperty("currentUsage", ex.getCurrentUsage());
+        problem.setProperty("limit", ex.getLimit());
+        problem.setProperty("requestedBytes", ex.getRequestedBytes());
+        problem.setProperty("timestamp", Instant.now().toString());
+        return problem;
+    }
+
     @ExceptionHandler(ResponseStatusException.class)
     public ProblemDetail handleResponseStatus(ResponseStatusException ex) {
         ProblemDetail problem = ProblemDetail.forStatusAndDetail(

cannamanage-api/src/main/java/de/cannamanage/api/security/LoginRateLimitFilter.java

@@ -0,0 +1,77 @@
+package de.cannamanage.api.security;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import io.github.bucket4j.Bandwidth;
+import io.github.bucket4j.Bucket;
+import io.github.bucket4j.ConsumptionProbe;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+import java.time.Duration;
+
+/**
+ * Rate-limits login attempts per client IP using Bucket4j + Caffeine cache.
+ * Allows 5 login attempts per minute per IP; returns 429 when exhausted.
+ */
+@Component
+@Order(1)
+public class LoginRateLimitFilter extends OncePerRequestFilter {
+
+    private static final String LOGIN_PATH = "/api/v1/auth/login";
+    private static final int CAPACITY = 5;
+    private static final Duration REFILL_PERIOD = Duration.ofMinutes(1);
+
+    private final Cache<String, Bucket> buckets = Caffeine.newBuilder()
+            .maximumSize(10_000)
+            .expireAfterAccess(Duration.ofMinutes(10))
+            .build();
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain filterChain) throws ServletException, IOException {
+        if (!"POST".equalsIgnoreCase(request.getMethod()) || !LOGIN_PATH.equals(request.getRequestURI())) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        String clientIp = resolveClientIp(request);
+        Bucket bucket = buckets.get(clientIp, k -> createBucket());
+
+        ConsumptionProbe probe = bucket.tryConsumeAndReturnRemaining(1);
+        if (probe.isConsumed()) {
+            filterChain.doFilter(request, response);
+        } else {
+            long waitSeconds = probe.getNanosToWaitForRefill() / 1_000_000_000 + 1;
+            response.setStatus(429);
+            response.setHeader("Retry-After", String.valueOf(waitSeconds));
+            response.setContentType("application/json");
+            response.getWriter().write("{\"error\":\"Too many login attempts. Retry after " + waitSeconds + "s\"}");
+        }
+    }
+
+    private Bucket createBucket() {
+        return Bucket.builder()
+                .addLimit(Bandwidth.builder()
+                        .capacity(CAPACITY)
+                        .refillGreedy(CAPACITY, REFILL_PERIOD)
+                        .build())
+                .build();
+    }
+
+    private String resolveClientIp(HttpServletRequest request) {
+        String xff = request.getHeader("X-Forwarded-For");
+        if (xff != null && !xff.isBlank()) {
+            // Take the first IP in the chain (original client)
+            return xff.split(",")[0].trim();
+        }
+        return request.getRemoteAddr();
+    }
+}

cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java

@@ -5,6 +5,7 @@ import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -53,6 +54,13 @@ public class SecurityConfig {
         http
                 .securityMatcher("/api/**")
                 .cors(cors -> cors.configurationSource(corsConfigurationSource()))
+                // snyk:ignore java/CsrfProtectionDisabled — Intentional: this filter chain
+                // handles stateless JWT-authenticated API calls only. CSRF attacks exploit
+                // browser-managed session cookies; Bearer token auth is immune because the
+                // token is never sent automatically by the browser. OWASP CSRF Prevention
+                // Cheat Sheet: "If your application does not use cookies for authentication,
+                // CSRF is not a risk." The portal chain (Order 2) correctly enables CSRF via
+                // CookieCsrfTokenRepository for its session-based auth.
                 .csrf(csrf -> csrf.disable())
                 .sessionManagement(session -> session
                         .sessionCreationPolicy(SessionCreationPolicy.STATELESS))
@@ -71,10 +79,13 @@ public class SecurityConfig {
                         .requestMatchers("/api/v1/stock/**").hasAnyRole("ADMIN", "STAFF")
                         .requestMatchers("/api/v1/compliance/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
                         .requestMatchers("/api/v1/reports/**").hasRole("ADMIN")
-                        // Documents endpoint — explicit listing for defense-in-depth so it can
+                        // Documents endpoint — method-specific matchers for defense-in-depth.
-                        // never accidentally end up in a permitAll() rule above. Per-document
+                        // POST (upload) and DELETE restricted to ADMIN/STAFF; GET allowed for all
-                        // tenant ownership is additionally enforced in DocumentController.
+                        // authenticated roles. Per-document tenant ownership is additionally
-                        .requestMatchers("/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
+                        // enforced in DocumentController via TenantContext.
+                        .requestMatchers(HttpMethod.GET, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
+                        .requestMatchers(HttpMethod.POST, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
+                        .requestMatchers(HttpMethod.DELETE, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
                         .anyRequest().authenticated())
                 .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
 

cannamanage-api/src/main/java/de/cannamanage/api/service/AuthService.java

@@ -34,6 +34,8 @@ import java.util.UUID;
 @RequiredArgsConstructor
 public class AuthService {
 
+    private static final String INVALID_CREDENTIALS = "Invalid credentials";
+
     private final UserRepository userRepository;
     private final JwtService jwtService;
     private final PasswordEncoder passwordEncoder;
@@ -43,14 +45,14 @@ public class AuthService {
     @Transactional
     public LoginResponse login(LoginRequest request) {
         User user = userRepository.findByEmail(request.email())
-                .orElseThrow(() -> new AuthenticationException("Invalid credentials"));
+                .orElseThrow(() -> new AuthenticationException(INVALID_CREDENTIALS));
 
         if (!user.isActive()) {
             throw new AuthenticationException("Account not activated");
         }
 
         if (!passwordEncoder.matches(request.password(), user.getPasswordHash())) {
-            throw new AuthenticationException("Invalid credentials");
+            throw new AuthenticationException(INVALID_CREDENTIALS);
         }
 
         // Generate tokens
@@ -147,7 +149,7 @@ public class AuthService {
             byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
             return HexFormat.of().formatHex(hash);
         } catch (NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA-256 not available", e);
+            throw new IllegalStateException("SHA-256 not available", e);
         }
     }
 

cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql

@@ -0,0 +1,9 @@
+-- V36: Add storage quota tracking to clubs
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_used_bytes BIGINT DEFAULT 0;
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_limit_bytes BIGINT DEFAULT 5368709120;
+-- Default: 5 GB (5 * 1024^3) = Starter tier
+
+-- Backfill existing clubs with actual usage
+UPDATE clubs c SET storage_used_bytes = COALESCE(
+    (SELECT SUM(d.file_size) FROM documents d WHERE d.club_id = c.id), 0
+);

cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerSecurityTest.java

@@ -0,0 +1,164 @@
+package de.cannamanage.api.controller;
+
+import de.cannamanage.domain.entity.Document;
+import de.cannamanage.domain.entity.TenantContext;
+import de.cannamanage.domain.enums.DocumentAccessLevel;
+import de.cannamanage.domain.enums.DocumentCategory;
+import de.cannamanage.service.DocumentService;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.io.IOException;
+import java.security.Principal;
+import java.util.UUID;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+/**
+ * Security unit tests for {@link DocumentController}.
+ * Verifies tenant isolation (IDOR protection) at the controller layer.
+ */
+@ExtendWith(MockitoExtension.class)
+class DocumentControllerSecurityTest {
+
+    @Mock
+    private DocumentService documentService;
+
+    @InjectMocks
+    private DocumentController documentController;
+
+    private static final UUID CLUB_A = UUID.fromString("00000000-0000-0000-0000-00000000000a");
+    private static final UUID CLUB_B = UUID.fromString("00000000-0000-0000-0000-00000000000b");
+    private static final UUID DOC_ID = UUID.fromString("00000000-0000-0000-0000-000000000099");
+    private static final UUID USER_ID = UUID.fromString("00000000-0000-0000-0000-000000000001");
+
+    @BeforeEach
+    void setUp() {
+        // Default tenant context: CLUB_A
+        TenantContext.setCurrentTenant(CLUB_A);
+    }
+
+    @AfterEach
+    void tearDown() {
+        TenantContext.clear();
+    }
+
+    // --- T-09: Download wrong tenant → 404 ---
+
+    @Test
+    @DisplayName("downloadDocument — wrong tenant throws 404 (IDOR protection)")
+    void testDownload_wrongTenant_returns404() {
+        // Document belongs to CLUB_B but user's tenant is CLUB_A
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_B);
+        doc.setFilename("secret.pdf");
+        doc.setContentType("application/pdf");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        assertThatThrownBy(() -> documentController.downloadDocument(DOC_ID))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(ex -> {
+                    ResponseStatusException rse = (ResponseStatusException) ex;
+                    assertThat(rse.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+                });
+    }
+
+    // --- T-10: Download correct tenant → 200 ---
+
+    @Test
+    @DisplayName("downloadDocument — correct tenant returns content")
+    void testDownload_correctTenant_succeeds() throws IOException {
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_A);
+        doc.setFilename("report.pdf");
+        doc.setContentType("application/pdf");
+        doc.setStoragePath(CLUB_A + "/" + DOC_ID + "_report.pdf");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+        when(documentService.downloadDocument(DOC_ID)).thenReturn("test content".getBytes());
+
+        ResponseEntity<byte[]> response = documentController.downloadDocument(DOC_ID);
+
+        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(response.getBody()).isNotNull();
+    }
+
+    // --- T-11: Delete wrong tenant → 404 ---
+
+    @Test
+    @DisplayName("deleteDocument — wrong tenant throws 404 (IDOR protection)")
+    void testDelete_wrongTenant_returns404() {
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_B);
+        doc.setTitle("Secret Doc");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        Principal principal = mock(Principal.class);
+
+        assertThatThrownBy(() -> documentController.deleteDocument(DOC_ID, CLUB_A, principal))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(ex -> {
+                    ResponseStatusException rse = (ResponseStatusException) ex;
+                    assertThat(rse.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+                });
+    }
+
+    // --- T-12: Delete correct tenant → 204 ---
+
+    @Test
+    @DisplayName("deleteDocument — correct tenant and matching clubId succeeds")
+    void testDelete_correctTenant_succeeds() throws IOException {
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_A);
+        doc.setTitle("My Doc");
+        doc.setStoragePath(CLUB_A + "/" + DOC_ID + "_my.pdf");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        Principal principal = mock(Principal.class);
+        when(principal.getName()).thenReturn(USER_ID.toString());
+
+        ResponseEntity<Void> response = documentController.deleteDocument(DOC_ID, CLUB_A, principal);
+
+        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
+    }
+
+    // --- T-13/T-14: Upload role restriction is handled by Spring Security @PreAuthorize,
+    // not testable in a pure unit test. Covered by SecurityConfigIntegrationTest. ---
+
+    @Test
+    @DisplayName("deleteDocument — mismatched clubId param vs tenant throws 404")
+    void testDelete_mismatchedClubIdParam_returns404() {
+        // Document belongs to CLUB_A and tenant is CLUB_A, but clubId param is different
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_A);
+        doc.setTitle("Doc");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        Principal principal = mock(Principal.class);
+
+        // Passing CLUB_B as the clubId param while tenant is CLUB_A
+        assertThatThrownBy(() -> documentController.deleteDocument(DOC_ID, CLUB_B, principal))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(ex -> {
+                    ResponseStatusException rse = (ResponseStatusException) ex;
+                    assertThat(rse.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+                });
+    }
+}

cannamanage-api/src/test/java/de/cannamanage/api/integration/AbstractIntegrationTest.java

@@ -42,16 +42,31 @@ import java.util.UUID;
 public abstract class AbstractIntegrationTest {
 
     @Container
-    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine")
+    static PostgreSQLContainer<?> postgres = shouldUseTestcontainers()
+            ? new PostgreSQLContainer<>("postgres:16-alpine")
                 .withDatabaseName("cannamanage_test")
                 .withUsername("test")
-            .withPassword("test");
+                .withPassword("test")
+            : null;
 
     @DynamicPropertySource
     static void configureProperties(DynamicPropertyRegistry registry) {
+        if (postgres != null) {
             registry.add("spring.datasource.url", postgres::getJdbcUrl);
             registry.add("spring.datasource.username", postgres::getUsername);
             registry.add("spring.datasource.password", postgres::getPassword);
+        } else {
+            registry.add("spring.datasource.url", () -> System.getenv("CI_POSTGRES_URL"));
+            registry.add("spring.datasource.username", () -> System.getenv("CI_POSTGRES_USER"));
+            registry.add("spring.datasource.password", () -> System.getenv("CI_POSTGRES_PASSWORD"));
+        }
+    }
+
+    /**
+     * Use Testcontainers locally; skip when CI provides PostgreSQL via service container.
+     */
+    private static boolean shouldUseTestcontainers() {
+        return System.getenv("CI_POSTGRES_URL") == null;
     }
 
     @LocalServerPort

cannamanage-api/src/test/java/de/cannamanage/api/security/LoginRateLimitFilterTest.java

@@ -0,0 +1,178 @@
+package de.cannamanage.api.security;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import java.io.IOException;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.*;
+
+/**
+ * Unit tests for {@link LoginRateLimitFilter} covering rate limiting with Bucket4j + Caffeine.
+ * Tests per-IP bucket isolation, blocking after threshold, and Retry-After header.
+ */
+class LoginRateLimitFilterTest {
+
+    private LoginRateLimitFilter filter;
+    private FilterChain filterChain;
+
+    @BeforeEach
+    void setUp() {
+        filter = new LoginRateLimitFilter();
+        filterChain = mock(FilterChain.class);
+    }
+
+    // --- T-26: First 5 requests pass ---
+
+    @Test
+    @DisplayName("Rate limit — first 5 requests from same IP are allowed")
+    void testRateLimit_allowsFirstFiveRequests() throws ServletException, IOException {
+        for (int i = 0; i < 5; i++) {
+            MockHttpServletRequest request = createLoginRequest("192.168.1.1");
+            MockHttpServletResponse response = new MockHttpServletResponse();
+
+            filter.doFilterInternal(request, response, filterChain);
+
+            assertThat(response.getStatus()).isNotEqualTo(429);
+        }
+
+        // FilterChain should have been invoked 5 times
+        verify(filterChain, times(5)).doFilter(any(), any());
+    }
+
+    // --- T-27: 6th request returns 429 ---
+
+    @Test
+    @DisplayName("Rate limit — 6th request from same IP returns 429")
+    void testRateLimit_blocks6thRequest_returns429() throws ServletException, IOException {
+        String ip = "10.0.0.1";
+
+        // Exhaust the 5-request bucket
+        for (int i = 0; i < 5; i++) {
+            MockHttpServletRequest request = createLoginRequest(ip);
+            MockHttpServletResponse response = new MockHttpServletResponse();
+            filter.doFilterInternal(request, response, filterChain);
+        }
+
+        // 6th request should be rate-limited
+        MockHttpServletRequest request = createLoginRequest(ip);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        filter.doFilterInternal(request, response, filterChain);
+
+        assertThat(response.getStatus()).isEqualTo(429);
+        assertThat(response.getContentAsString()).contains("Too many login attempts");
+    }
+
+    // --- Retry-After header ---
+
+    @Test
+    @DisplayName("Rate limit — 429 response includes Retry-After header")
+    void testRateLimit_includesRetryAfterHeader() throws ServletException, IOException {
+        String ip = "10.0.0.2";
+
+        // Exhaust the bucket
+        for (int i = 0; i < 5; i++) {
+            filter.doFilterInternal(createLoginRequest(ip), new MockHttpServletResponse(), filterChain);
+        }
+
+        // 6th request — check headers
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        filter.doFilterInternal(createLoginRequest(ip), response, filterChain);
+
+        assertThat(response.getStatus()).isEqualTo(429);
+        String retryAfter = response.getHeader("Retry-After");
+        assertThat(retryAfter).isNotNull();
+        assertThat(Integer.parseInt(retryAfter)).isGreaterThan(0);
+    }
+
+    // --- T-28: Separate buckets per IP ---
+
+    @Test
+    @DisplayName("Rate limit — different IPs have separate rate limit buckets")
+    void testRateLimit_separateBucketsPerIp() throws ServletException, IOException {
+        String ip1 = "192.168.1.100";
+        String ip2 = "192.168.1.200";
+
+        // Exhaust quota for ip1
+        for (int i = 0; i < 5; i++) {
+            filter.doFilterInternal(createLoginRequest(ip1), new MockHttpServletResponse(), filterChain);
+        }
+
+        // ip1 should be blocked
+        MockHttpServletResponse responseIp1 = new MockHttpServletResponse();
+        filter.doFilterInternal(createLoginRequest(ip1), responseIp1, filterChain);
+        assertThat(responseIp1.getStatus()).isEqualTo(429);
+
+        // ip2 should still be allowed
+        MockHttpServletResponse responseIp2 = new MockHttpServletResponse();
+        filter.doFilterInternal(createLoginRequest(ip2), responseIp2, filterChain);
+        assertThat(responseIp2.getStatus()).isNotEqualTo(429);
+    }
+
+    // --- Non-login requests pass through ---
+
+    @Test
+    @DisplayName("Non-login endpoint requests are not rate limited")
+    void testNonLoginEndpoint_notRateLimited() throws ServletException, IOException {
+        MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api/v1/members");
+        request.setRemoteAddr("10.0.0.5");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        filter.doFilterInternal(request, response, filterChain);
+
+        verify(filterChain).doFilter(request, response);
+        assertThat(response.getStatus()).isNotEqualTo(429);
+    }
+
+    @Test
+    @DisplayName("GET request to login path is not rate limited")
+    void testGetLoginPath_notRateLimited() throws ServletException, IOException {
+        MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api/v1/auth/login");
+        request.setRemoteAddr("10.0.0.6");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        filter.doFilterInternal(request, response, filterChain);
+
+        verify(filterChain).doFilter(request, response);
+        assertThat(response.getStatus()).isNotEqualTo(429);
+    }
+
+    // --- X-Forwarded-For header ---
+
+    @Test
+    @DisplayName("Rate limit uses X-Forwarded-For header for client IP resolution")
+    void testRateLimit_usesXForwardedFor() throws ServletException, IOException {
+        String realIp = "203.0.113.50";
+
+        // Exhaust bucket via X-Forwarded-For IP
+        for (int i = 0; i < 5; i++) {
+            MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/auth/login");
+            request.setRemoteAddr("127.0.0.1"); // proxy IP
+            request.addHeader("X-Forwarded-For", realIp + ", 10.0.0.1");
+            filter.doFilterInternal(request, new MockHttpServletResponse(), filterChain);
+        }
+
+        // 6th request from same forwarded IP should be blocked
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/auth/login");
+        request.setRemoteAddr("127.0.0.1");
+        request.addHeader("X-Forwarded-For", realIp + ", 10.0.0.1");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        filter.doFilterInternal(request, response, filterChain);
+
+        assertThat(response.getStatus()).isEqualTo(429);
+    }
+
+    // --- Helper ---
+
+    private MockHttpServletRequest createLoginRequest(String ip) {
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/auth/login");
+        request.setRemoteAddr(ip);
+        return request;
+    }
+}

cannamanage-api/src/test/java/de/cannamanage/api/security/SecurityConfigTest.java

@@ -0,0 +1,89 @@
+package de.cannamanage.api.security;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.server.LocalServerPort;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.web.client.RestClient;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for {@link SecurityConfig} — verifying that the security filter chain
+ * correctly requires authentication for protected endpoints and allows public endpoints.
+ * Uses RestClient against an actual HTTP server (same pattern as AuthControllerIntegrationTest).
+ *
+ * Note: The existing SecurityConfigIntegrationTest (Testcontainers) covers the same cases
+ * with a full database. This test uses the simpler "test" profile for faster execution.
+ */
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@ActiveProfiles("test")
+class SecurityConfigTest {
+
+    @LocalServerPort
+    private int port;
+
+    private RestClient restClient() {
+        return RestClient.builder()
+                .baseUrl("http://localhost:" + port)
+                .build();
+    }
+
+    // --- T-21: Document endpoints require authentication ---
+
+    @Test
+    @DisplayName("GET /api/v1/documents — unauthenticated returns 401")
+    void testDocumentEndpoints_requireAuthentication() {
+        ResponseEntity<String> response = restClient().get()
+                .uri("/api/v1/documents?clubId=00000000-0000-0000-0000-000000000001")
+                .retrieve()
+                .toEntity(String.class);
+
+        assertThat(response.getStatusCode().value()).isEqualTo(401);
+    }
+
+    @Test
+    @DisplayName("GET /api/v1/documents/{id}/download — unauthenticated returns 401")
+    void testDocumentDownload_requiresAuthentication() {
+        ResponseEntity<String> response = restClient().get()
+                .uri("/api/v1/documents/00000000-0000-0000-0000-000000000099/download")
+                .retrieve()
+                .toEntity(String.class);
+
+        assertThat(response.getStatusCode().value()).isEqualTo(401);
+    }
+
+    // --- T-22: Auth endpoints are public ---
+
+    @Test
+    @DisplayName("POST /api/v1/auth/login — accessible without authentication (not 401)")
+    void testAuthEndpoints_arePublic() {
+        ResponseEntity<String> response = restClient().post()
+                .uri("/api/v1/auth/login")
+                .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                .body("{\"email\":\"test@test.de\",\"password\":\"test\"}")
+                .retrieve()
+                .toEntity(String.class);
+
+        // Auth endpoints are public — should NOT return 401/403
+        // May return 400 or 500 (user not found), that's fine
+        assertThat(response.getStatusCode().value()).isNotEqualTo(401);
+        assertThat(response.getStatusCode().value()).isNotEqualTo(403);
+    }
+
+    // --- T-23: Actuator health is public ---
+
+    @Test
+    @DisplayName("GET /actuator/health — accessible without authentication")
+    void testActuatorHealth_isPublic() {
+        ResponseEntity<String> response = restClient().get()
+                .uri("/actuator/health")
+                .retrieve()
+                .toEntity(String.class);
+
+        assertThat(response.getStatusCode().value()).isEqualTo(200);
+    }
+}

cannamanage-api/src/test/java/de/cannamanage/api/service/AuthServiceTest.java

@@ -0,0 +1,194 @@
+package de.cannamanage.api.service;
+
+import de.cannamanage.api.dto.auth.LoginRequest;
+import de.cannamanage.api.dto.auth.LoginResponse;
+import de.cannamanage.api.dto.auth.RefreshRequest;
+import de.cannamanage.api.security.JwtService;
+import de.cannamanage.domain.entity.User;
+import de.cannamanage.domain.enums.UserRole;
+import de.cannamanage.service.repository.InviteTokenRepository;
+import de.cannamanage.service.repository.StaffAccountRepository;
+import de.cannamanage.service.repository.UserRepository;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.HexFormat;
+import java.util.Optional;
+import java.util.UUID;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.when;
+
+/**
+ * Unit tests for {@link AuthService} covering login, token refresh, and SHA-256 hashing.
+ */
+@ExtendWith(MockitoExtension.class)
+class AuthServiceTest {
+
+    @Mock
+    private UserRepository userRepository;
+
+    @Mock
+    private JwtService jwtService;
+
+    @Mock
+    private PasswordEncoder passwordEncoder;
+
+    @Mock
+    private InviteTokenRepository inviteTokenRepository;
+
+    @Mock
+    private StaffAccountRepository staffAccountRepository;
+
+    @InjectMocks
+    private AuthService authService;
+
+    private User activeUser;
+    private static final UUID USER_ID = UUID.fromString("00000000-0000-0000-0000-000000000001");
+    private static final UUID TENANT_ID = UUID.fromString("00000000-0000-0000-0000-000000000010");
+    private static final String EMAIL = "admin@test.de";
+    private static final String PASSWORD = "SecurePass123!";
+    private static final String HASHED_PASSWORD = "$2a$10$hashedvalue";
+
+    @BeforeEach
+    void setUp() {
+        activeUser = new User();
+        activeUser.setId(USER_ID);
+        activeUser.setEmail(EMAIL);
+        activeUser.setPasswordHash(HASHED_PASSWORD);
+        activeUser.setRole(UserRole.ROLE_ADMIN);
+        activeUser.setActive(true);
+        activeUser.setTenantId(TENANT_ID);
+    }
+
+    // --- T-15: Login valid credentials → token pair ---
+
+    @Test
+    @DisplayName("login — valid credentials returns token pair")
+    void testLogin_validCredentials_returnsTokenPair() {
+        when(userRepository.findByEmail(EMAIL)).thenReturn(Optional.of(activeUser));
+        when(passwordEncoder.matches(PASSWORD, HASHED_PASSWORD)).thenReturn(true);
+        when(jwtService.generateAccessToken(any(), any(), anyString(), anyString()))
+                .thenReturn("access-token-123");
+        when(jwtService.generateRefreshToken(any(), any()))
+                .thenReturn("refresh-token-456");
+        when(userRepository.save(any(User.class))).thenReturn(activeUser);
+
+        LoginResponse response = authService.login(new LoginRequest(EMAIL, PASSWORD));
+
+        assertThat(response).isNotNull();
+        assertThat(response.accessToken()).isEqualTo("access-token-123");
+        assertThat(response.refreshToken()).isEqualTo("refresh-token-456");
+        assertThat(response.expiresIn()).isEqualTo(3600L);
+        assertThat(response.role()).isEqualTo("ADMIN");
+    }
+
+    // --- T-16: Login invalid password → 401 ---
+
+    @Test
+    @DisplayName("login — invalid password throws AuthenticationException")
+    void testLogin_invalidPassword_throws401() {
+        when(userRepository.findByEmail(EMAIL)).thenReturn(Optional.of(activeUser));
+        when(passwordEncoder.matches("wrong-password", HASHED_PASSWORD)).thenReturn(false);
+
+        assertThatThrownBy(() -> authService.login(new LoginRequest(EMAIL, "wrong-password")))
+                .isInstanceOf(AuthService.AuthenticationException.class)
+                .hasMessageContaining("Invalid credentials");
+    }
+
+    // --- T-17: Login non-existent user → 401 ---
+
+    @Test
+    @DisplayName("login — non-existent user throws AuthenticationException")
+    void testLogin_nonExistentUser_throws401() {
+        when(userRepository.findByEmail("nobody@test.de")).thenReturn(Optional.empty());
+
+        assertThatThrownBy(() -> authService.login(new LoginRequest("nobody@test.de", PASSWORD)))
+                .isInstanceOf(AuthService.AuthenticationException.class)
+                .hasMessageContaining("Invalid credentials");
+    }
+
+    // --- T-18: Refresh token valid → new access token ---
+
+    @Test
+    @DisplayName("refresh — valid token returns new access token")
+    void testRefreshToken_validToken_returnsNewAccessToken() {
+        String oldRefreshToken = "valid-refresh-token";
+        // Compute expected hash
+        String expectedHash = sha256(oldRefreshToken);
+        activeUser.setRefreshTokenHash(expectedHash);
+
+        when(jwtService.isTokenValid(oldRefreshToken)).thenReturn(true);
+        when(jwtService.extractUserId(oldRefreshToken)).thenReturn(USER_ID);
+        when(userRepository.findById(USER_ID)).thenReturn(Optional.of(activeUser));
+        when(jwtService.generateAccessToken(any(), any(), anyString(), anyString()))
+                .thenReturn("new-access-token");
+        when(jwtService.generateRefreshToken(any(), any()))
+                .thenReturn("new-refresh-token");
+        when(userRepository.save(any(User.class))).thenReturn(activeUser);
+
+        LoginResponse response = authService.refresh(new RefreshRequest(oldRefreshToken));
+
+        assertThat(response).isNotNull();
+        assertThat(response.accessToken()).isEqualTo("new-access-token");
+        assertThat(response.refreshToken()).isEqualTo("new-refresh-token");
+    }
+
+    // --- T-19: Refresh token expired → 401 ---
+
+    @Test
+    @DisplayName("refresh — expired/invalid token throws AuthenticationException")
+    void testRefreshToken_expired_throws401() {
+        String expiredToken = "expired-refresh-token";
+        when(jwtService.isTokenValid(expiredToken)).thenReturn(false);
+
+        assertThatThrownBy(() -> authService.refresh(new RefreshRequest(expiredToken)))
+                .isInstanceOf(AuthService.AuthenticationException.class)
+                .hasMessageContaining("Invalid or expired refresh token");
+    }
+
+    // --- T-20: SHA-256 hashing is deterministic ---
+
+    @Test
+    @DisplayName("SHA-256 hashing is deterministic — same input always produces same hash")
+    void testSha256_deterministic() {
+        String input = "test-refresh-token-abc123";
+        String hash1 = sha256(input);
+        String hash2 = sha256(input);
+
+        assertThat(hash1).isEqualTo(hash2);
+        assertThat(hash1).hasSize(64); // SHA-256 produces 64 hex chars
+        assertThat(hash1).matches("[0-9a-f]{64}");
+    }
+
+    @Test
+    @DisplayName("SHA-256 hashing — different inputs produce different hashes")
+    void testSha256_differentInputs_differentHashes() {
+        String hash1 = sha256("token-one");
+        String hash2 = sha256("token-two");
+
+        assertThat(hash1).isNotEqualTo(hash2);
+    }
+
+    // Helper to replicate AuthService's sha256 logic for test verification
+    private String sha256(String input) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
+            return HexFormat.of().formatHex(hash);
+        } catch (Exception e) {
+            throw new IllegalStateException("SHA-256 not available", e);
+        }
+    }
+}

cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Club.java

@@ -51,6 +51,12 @@ public class Club extends AbstractTenantEntity {
     @Column(name = "allowed_email_pattern", length = 255)
     private String allowedEmailPattern;
 
+    @Column(name = "storage_used_bytes", nullable = false)
+    private Long storageUsedBytes = 0L;
+
+    @Column(name = "storage_limit_bytes", nullable = false)
+    private Long storageLimitBytes = 5_368_709_120L; // 5 GB default
+
     @Enumerated(EnumType.STRING)
     @Column(name = "status", nullable = false, length = 50)
     private ClubStatus status = ClubStatus.ACTIVE;
@@ -99,4 +105,10 @@ public class Club extends AbstractTenantEntity {
 
     public ClubStatus getStatus() { return status; }
     public void setStatus(ClubStatus status) { this.status = status; }
+
+    public Long getStorageUsedBytes() { return storageUsedBytes; }
+    public void setStorageUsedBytes(Long storageUsedBytes) { this.storageUsedBytes = storageUsedBytes; }
+
+    public Long getStorageLimitBytes() { return storageLimitBytes; }
+    public void setStorageLimitBytes(Long storageLimitBytes) { this.storageLimitBytes = storageLimitBytes; }
 }

cannamanage-frontend/messages/de.json

@@ -44,7 +44,8 @@
     "emailInvalid": "Bitte gib eine gültige E-Mail-Adresse ein.",
     "passwordRequired": "Bitte gib dein Passwort ein.",
     "passwordTooShort": "Passwort muss mindestens 8 Zeichen lang sein.",
-    "footerText": "Sichere Verwaltung für deinen Cannabis-Anbauverein"
+    "footerText": "Sichere Verwaltung für deinen Cannabis-Anbauverein",
+    "loginTitle": "Anmelden"
   },
   "dashboard": {
     "title": "Dashboard",
@@ -668,6 +669,18 @@
           "starter": "E-Mail",
           "pro": "Priorität",
           "enterprise": "Dediziert"
+        },
+        "compStorage": {
+          "label": "Speicher",
+          "starter": "5 GB",
+          "pro": "50 GB",
+          "enterprise": "Individuell"
+        },
+        "compOverage": {
+          "label": "Überschreitung",
+          "starter": "Upgrade nötig",
+          "pro": "0,15 €/GB/Mo",
+          "enterprise": "—"
         }
       },
       "faq": {
@@ -690,7 +703,29 @@
         "migration": {
           "question": "Kann ich den Plan später wechseln?",
           "answer": "Ja, du kannst jederzeit zwischen Starter und Pro wechseln. Ein Upgrade wird sofort wirksam, ein Downgrade zum nächsten Abrechnungszeitraum."
+        },
+        "storage": {
+          "question": "Was passiert, wenn mein Speicher voll ist?",
+          "answer": "Im Starter-Plan kannst du auf Pro upgraden. Im Pro-Plan wird zusätzlicher Speicher mit 0,15 €/GB/Monat berechnet. Enterprise-Kunden haben individuelle Speichervereinbarungen."
         }
+      },
+      "storage": {
+        "starter": "5 GB Speicher",
+        "pro": "50 GB Speicher",
+        "proOverage": "(danach 0,15 €/GB/Monat)",
+        "enterprise": "Individueller Speicher",
+        "comparisonTitle": "Funktionen im Vergleich",
+        "featureMembers": "Mitglieder",
+        "featureStorage": "Speicher",
+        "featureOverage": "Überschreitung",
+        "featureGrow": "Grow-Kalender",
+        "featureApi": "API-Zugang",
+        "featureMultiClub": "Multi-Club",
+        "overageUpgrade": "Upgrade erforderlich",
+        "overagePro": "0,15 €/GB/Mo",
+        "overageEnterprise": "—",
+        "unlimited": "Unbegrenzt",
+        "custom": "Individuell"
       }
     },
     "impressum": {
@@ -753,6 +788,46 @@
       "s9Content": "Der Anbieter verarbeitet personenbezogene Daten gemäß der Datenschutzerklärung und den Bestimmungen der DSGVO. Soweit der Anbieter Daten im Auftrag des Nutzers verarbeitet, wird ein gesonderter Auftragsverarbeitungsvertrag geschlossen.",
       "s10Title": "§ 10 Schlussbestimmungen",
       "s10Content": "Es gilt das Recht der Bundesrepublik Deutschland. Gerichtsstand ist, soweit gesetzlich zulässig, der Sitz des Anbieters. Sollten einzelne Bestimmungen dieser AGB unwirksam sein, bleibt die Wirksamkeit der übrigen Bestimmungen unberührt. Änderungen der AGB werden dem Nutzer rechtzeitig mitgeteilt."
+    },
+    "home": {
+      "heroTitle": "Die smarte Verwaltung für deinen Anbauverein",
+      "heroSubtitle": "Compliance, Anbau, Mitglieder und Abgaben — alles in einer Plattform. Rechtssicher nach KCanG.",
+      "ctaPrimary": "Preise ansehen",
+      "ctaSecondary": "Jetzt anmelden",
+      "featuresTitle": "Alles, was dein Verein braucht",
+      "featuresSubtitle": "Von der Mitgliederverwaltung bis zur Behördenmeldung — CannaManage deckt den gesamten Vereinsbetrieb ab.",
+      "feature1Title": "Compliance Tracking",
+      "feature1Desc": "Automatische Überwachung der KCanG-Vorgaben mit Fristen und Checklisten.",
+      "feature2Title": "Grow Management",
+      "feature2Desc": "Anbaukalender, Wachstumsphasen und Sensorintegration.",
+      "feature3Title": "Mitglieder-Portal",
+      "feature3Desc": "Self-Service für Mitglieder: Profil, Abgabehistorie, Dokumente.",
+      "feature4Title": "Abgabe-Quotas",
+      "feature4Desc": "Automatische Einhaltung der 25g/Tag und 50g/Monat Grenzen.",
+      "feature5Title": "Dokumenten-Archiv",
+      "feature5Desc": "GoBD-konforme Ablage mit Aufbewahrungsfristen und Versionierung.",
+      "feature6Title": "Finanzverwaltung",
+      "feature6Desc": "Mitgliedsbeiträge, SEPA-Export und Bankimport.",
+      "trustTitle": "Vertrauen durch Compliance",
+      "trustCanverg": "CanVerG-konform",
+      "trustDsgvo": "DSGVO & GoBD",
+      "trustEncryption": "TLS-verschlüsselt",
+      "trustGerman": "Hosting in Deutschland",
+      "ctaFinalTitle": "Bereit für den nächsten Schritt?",
+      "ctaFinalSubtitle": "Starte jetzt mit CannaManage und bring deinen Verein auf das nächste Level.",
+      "ctaFinalButton": "Kostenlos testen"
+    },
+    "nav": {
+      "features": "Features",
+      "pricing": "Preise",
+      "login": "Anmelden",
+      "footerTagline": "Die sichere Verwaltungssoftware für Cannabis-Anbauvereine in Deutschland.",
+      "footerProduct": "Produkt",
+      "footerLegal": "Rechtliches",
+      "impressum": "Impressum",
+      "datenschutz": "Datenschutz",
+      "agb": "AGB",
+      "allRightsReserved": "Alle Rechte vorbehalten."
     }
   },
   "infoBoard": {

cannamanage-frontend/messages/en.json

@@ -44,7 +44,8 @@
     "emailInvalid": "Please enter a valid email address.",
     "passwordRequired": "Please enter your password.",
     "passwordTooShort": "Password must be at least 8 characters.",
-    "footerText": "Secure management for your cannabis cultivation club"
+    "footerText": "Secure management for your cannabis cultivation club",
+    "loginTitle": "Sign In"
   },
   "dashboard": {
     "title": "Dashboard",
@@ -668,6 +669,18 @@
           "starter": "Email",
           "pro": "Priority",
           "enterprise": "Dedicated"
+        },
+        "compStorage": {
+          "label": "Storage",
+          "starter": "5 GB",
+          "pro": "50 GB",
+          "enterprise": "Custom"
+        },
+        "compOverage": {
+          "label": "Overage",
+          "starter": "Upgrade required",
+          "pro": "€0.15/GB/mo",
+          "enterprise": "—"
         }
       },
       "faq": {
@@ -690,7 +703,29 @@
         "migration": {
           "question": "Can I switch plans later?",
           "answer": "Yes, you can switch between Starter and Pro at any time. Upgrades take effect immediately, downgrades at the next billing period."
+        },
+        "storage": {
+          "question": "What happens when my storage is full?",
+          "answer": "On the Starter plan, you can upgrade to Pro. On the Pro plan, additional storage is billed at €0.15/GB/month. Enterprise customers have custom storage agreements."
         }
+      },
+      "storage": {
+        "starter": "5 GB Storage",
+        "pro": "50 GB Storage",
+        "proOverage": "(then €0.15/GB/month)",
+        "enterprise": "Custom Storage",
+        "comparisonTitle": "Feature Comparison",
+        "featureMembers": "Members",
+        "featureStorage": "Storage",
+        "featureOverage": "Overage",
+        "featureGrow": "Grow Calendar",
+        "featureApi": "API Access",
+        "featureMultiClub": "Multi-Club",
+        "overageUpgrade": "Upgrade required",
+        "overagePro": "€0.15/GB/mo",
+        "overageEnterprise": "—",
+        "unlimited": "Unlimited",
+        "custom": "Custom"
       }
     },
     "impressum": {
@@ -753,6 +788,46 @@
       "s9Content": "The provider processes personal data in accordance with the privacy policy and GDPR provisions. Where the provider processes data on behalf of the user, a separate data processing agreement is concluded.",
       "s10Title": "§ 10 Final Provisions",
       "s10Content": "The law of the Federal Republic of Germany applies. The place of jurisdiction is, to the extent legally permissible, the registered office of the provider. Should individual provisions of these terms be invalid, the validity of the remaining provisions remains unaffected. Changes to these terms will be communicated to the user in good time."
+    },
+    "home": {
+      "heroTitle": "The Smart Management for Your Cannabis Club",
+      "heroSubtitle": "Compliance, growing, members and distributions — all in one platform. Legally compliant under KCanG.",
+      "ctaPrimary": "View Pricing",
+      "ctaSecondary": "Sign In",
+      "featuresTitle": "Everything Your Club Needs",
+      "featuresSubtitle": "From member management to regulatory reporting — CannaManage covers all aspects of your club operations.",
+      "feature1Title": "Compliance Tracking",
+      "feature1Desc": "Automatic monitoring of KCanG requirements with deadlines and checklists.",
+      "feature2Title": "Grow Management",
+      "feature2Desc": "Growing calendar, growth phases and sensor integration.",
+      "feature3Title": "Member Portal",
+      "feature3Desc": "Self-service for members: profile, distribution history, documents.",
+      "feature4Title": "Distribution Quotas",
+      "feature4Desc": "Automatic enforcement of 25g/day and 50g/month limits.",
+      "feature5Title": "Document Archive",
+      "feature5Desc": "GoBD-compliant storage with retention periods and versioning.",
+      "feature6Title": "Financial Management",
+      "feature6Desc": "Membership fees, SEPA export and bank import.",
+      "trustTitle": "Trust Through Compliance",
+      "trustCanverg": "CanVerG compliant",
+      "trustDsgvo": "GDPR & GoBD",
+      "trustEncryption": "TLS encrypted",
+      "trustGerman": "Hosted in Germany",
+      "ctaFinalTitle": "Ready for the Next Step?",
+      "ctaFinalSubtitle": "Start with CannaManage now and take your club to the next level.",
+      "ctaFinalButton": "Try for Free"
+    },
+    "nav": {
+      "features": "Features",
+      "pricing": "Pricing",
+      "login": "Sign In",
+      "footerTagline": "The secure management software for cannabis cultivation clubs in Germany.",
+      "footerProduct": "Product",
+      "footerLegal": "Legal",
+      "impressum": "Imprint",
+      "datenschutz": "Privacy Policy",
+      "agb": "Terms",
+      "allRightsReserved": "All rights reserved."
     }
   },
   "infoBoard": {

cannamanage-frontend/next.config.mjs

@@ -10,15 +10,10 @@ const nextConfig = {
   // Required for Docker standalone output
   output: "standalone",
 
-  // Proxy API calls to the Spring Boot backend
+  // NOTE: API calls to /api/backend/* are proxied by the server-side Route
-  async rewrites() {
+  // Handler at src/app/api/backend/[...path]/route.ts, NOT by a static
-    return [
+  // rewrite. A static rewrite cannot inject the NextAuth Bearer token; the
-      {
+  // route handler reads the session via auth() and forwards it. See that file.
-        source: "/api/backend/:path*",
-        destination: `${process.env.BACKEND_URL || "http://localhost:8080"}/api/v1/:path*`,
-      },
-    ]
-  },
 }
 
 export default withNextIntl(nextConfig)

cannamanage-frontend/package.json

@@ -1,11 +1,11 @@
 {
-  "name": "shadboard-nextjs-starter-kit",
+  "name": "cannamanage-frontend",
   "version": "1.0.0",
   "license": "MIT",
   "private": true,
   "author": {
-    "name": "Layth Alqadhi",
+    "name": "Patrick Plate",
-    "url": "https://github.com/LaythAlqadhi"
+    "url": "https://github.com/pplate"
   },
   "scripts": {
     "dev": "next dev --turbopack",
@@ -13,6 +13,7 @@
     "start": "next start",
     "lint": "next lint",
     "lint:fix": "next lint --fix",
+    "type-check": "tsc --noEmit",
     "format": "prettier --ignore-path .gitignore --write .",
     "test": "vitest",
     "test:run": "vitest run",
@@ -55,7 +56,7 @@
     "emoji-picker-react": "4.12.2",
     "input-otp": "1.4.2",
     "lucide-react": "0.446.0",
-    "next": "15.5.18",
+    "next": "15.5.19",
     "next-auth": "5.0.0-beta.31",
     "next-intl": "^4.13.0",
     "react": "19.1.3",
@@ -87,7 +88,7 @@
     "@types/sockjs-client": "^1.5.4",
     "@vitejs/plugin-react": "^6.0.2",
     "eslint": "9.18.0",
-    "eslint-config-next": "15.5.18",
+    "eslint-config-next": "15.5.19",
     "eslint-config-prettier": "10.1.1",
     "eslint-plugin-prettier": "5.2.3",
     "jsdom": "^29.1.1",
@@ -106,6 +107,9 @@
     "@types/react": "19.0.12",
     "@types/react-dom": "19.0.4",
     "picomatch": ">=4.0.2",
-    "postcss": ">=8.4.31"
+    "postcss": ">=8.4.31",
+    "minimatch": ">=5.1.6",
+    "brace-expansion": ">=2.0.1",
+    "ajv": ">=8.17.1"
   }
 }

cannamanage-frontend/pnpm-lock.yaml

@@ -93,14 +93,14 @@ importers:
         specifier: 0.446.0
         version: 0.446.0(react@19.1.3)
       next:
-        specifier: 15.5.18
+        specifier: 15.5.19
-        version: 15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
+        version: 15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
       next-auth:
         specifier: 5.0.0-beta.31
-        version: 5.0.0-beta.31(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)
+        version: 5.0.0-beta.31(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)
       next-intl:
         specifier: ^4.13.0
-        version: 4.13.0(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3)
+        version: 4.13.0(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3)
       react:
         specifier: 19.1.3
         version: 19.1.3
@@ -184,8 +184,8 @@ importers:
         specifier: 9.18.0
         version: 9.18.0(jiti@2.6.1)
       eslint-config-next:
-        specifier: 15.5.18
+        specifier: 15.5.19
-        version: 15.5.18(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
+        version: 15.5.19(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
       eslint-config-prettier:
         specifier: 10.1.1
         version: 10.1.1(eslint@9.18.0(jiti@2.6.1))
@@ -679,56 +679,56 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
-  '@next/env@15.5.18':
+  '@next/env@15.5.19':
-    resolution: {integrity: sha512-hAV85Ckd9QR6RvH04MEKwsfLTksvFpO47j9xwtoIuvuPnlwecpSi+uZTtm8HirVbtlI2Fnz//xpcSTjFdyJk+g==}
+    resolution: {integrity: sha512-sWWluFvcv5v3Fxznmf2ZfjyoVQt/64oCnYqS90inQWGzMPK1VjvekPiz3OPHKmFT30EnHrjlbyaHLt3M0vWabw==}
 
-  '@next/eslint-plugin-next@15.5.18':
+  '@next/eslint-plugin-next@15.5.19':
-    resolution: {integrity: sha512-w4MYq8M26a8PNrfto0JosLf5/3ssln1rsyP96g2DkC8uFVymStM5DLSz5ElxxrPRg2XnTMnFo3kREFlhYvxhWw==}
+    resolution: {integrity: sha512-Ctwb4qYuMbHN/1oXLlTdMchwG8h8Xzwq+wGZZMgF3o6+uwyBKAI2c96bdOsl+C62PaUD0Jkh+QpNkhUeDlam0Q==}
 
-  '@next/swc-darwin-arm64@15.5.18':
+  '@next/swc-darwin-arm64@15.5.19':
-    resolution: {integrity: sha512-w0WvQf1n+txiwns/9pwIQteCJpZTbxzO2SE0FLcwuD4v0WEh1JPOjdyxWL21XwJsdpx8cFRjyzxzCS/siP7HcQ==}
+    resolution: {integrity: sha512-jx9wWlTKueHKPvVOndyr7WuaevWCkuYqsQ8gC0TMPKAVWG3MhcdMrjfo9tvIZNXd0QOUYXXvAcZ325y8Uq7uzg==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@15.5.18':
+  '@next/swc-darwin-x64@15.5.19':
-    resolution: {integrity: sha512-znn71QmDuxm+BOaglihMZfvyySMnNljkVIY5Z2TCssBmm+WqL6c19VhtH5ktFkHa8EZ2bnTUpcNcmNSQsg67og==}
+    resolution: {integrity: sha512-291KFcsIQ3OenRdiUDFOR6W3wezzH4auENXm1gbm1Bjd4ANMMRgxPrWTUztQN43BnVoVuMnHCrLeECIMwgFKbA==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@15.5.18':
+  '@next/swc-linux-arm64-gnu@15.5.19':
-    resolution: {integrity: sha512-yPPe5MNL+igZUa+OsqQJisqSfh6oarIuA1Q0BDxljGJhRQyZeP+WRHh7rs/jZUGMh5aY0YdIjXZG0VohkKkUdw==}
+    resolution: {integrity: sha512-WeH+nelQyyMeE2f8FxBRZNrGipya5zHZV2vjzfCOAYyiI6am+NbnWAAldOBFQBB2w0DjJcsvrKqoFT2b7+5YoA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@next/swc-linux-arm64-musl@15.5.18':
+  '@next/swc-linux-arm64-musl@15.5.19':
-    resolution: {integrity: sha512-glaCczEWIrHsokFZ3pP08U4BpKxwIdnT+txdOM32OBgpL9Yw4aqx8NejmgtZQZOdstQ5f0L3CasIZudzCuD+nw==}
+    resolution: {integrity: sha512-5xTOE0lDlDCSSfp+BAif7j17VRRCjWp//ZPZy6NI0QpdrhxtQnsZguSx0xAAZ0c9XZLrLLwCe/XVe5YPrRilKw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@next/swc-linux-x64-gnu@15.5.18':
+  '@next/swc-linux-x64-gnu@15.5.19':
-    resolution: {integrity: sha512-oUfg2EgJmU3R0OCOWiokGFUTvZiPfXtriXiuF3YNxRoROCdgvTedHIzYoeKH34gsZxS/V7mHbfq2hpAHwhH1/A==}
+    resolution: {integrity: sha512-LTxRmMgqqMv05Had879W00Fm53quiJd3Zuz8h1JSNJ3nGSlbZ/7Tjs1tKyScgN3Au3t3MyPsjPlq60fMmSHLsg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@next/swc-linux-x64-musl@15.5.18':
+  '@next/swc-linux-x64-musl@15.5.19':
-    resolution: {integrity: sha512-JLxSP3KTd9iu/bvUMQxH7RJo9xKSHf55/6RPE4a6FTSZygGn7uvZbCej0AHXydwkggQGSD9UddSjwv6Xz5ESfA==}
+    resolution: {integrity: sha512-eoNQSpA5PQfB9wBO4RA47MTDXWz1fizy9Y3Z6e4DetYIF3dvjuu8sj7aIGn/bFCU6lnFzTK34NtCaffP4NsQ7Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@next/swc-win32-arm64-msvc@15.5.18':
+  '@next/swc-win32-arm64-msvc@15.5.19':
-    resolution: {integrity: sha512-ir1v7enP52K2HNz3tQQvwF+x7VNxBk1ciiZ18WBPvxf4C59IqdfmHPJYK3vH7rSxpuCVw/8C712wTXNAtEp+NA==}
+    resolution: {integrity: sha512-6UNt2dFuCHOe446sm/Kp69nUe8/wIhnh9bm6Xcqw4qEWCOppLMOvhTBVgvM7invVUNr4SPpP6NOQsACtn2IN9Q==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@15.5.18':
+  '@next/swc-win32-x64-msvc@15.5.19':
-    resolution: {integrity: sha512-LIu5me6QTANCd25E7I5uIEfvgQ06RK7tvHAbYo3zCb3VpxQEPvMcSpd87NwUABDT6MbGPdEGR5VRiK4PPTJhQg==}
+    resolution: {integrity: sha512-PhmojAHyqMne56HBLGu9dhDnHPuFmEjrXSQMM/nW0J6j849lk3ESrVtqNJcCk8CKOV7brpTTbaYAjwKPzKM69w==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
@@ -2802,8 +2802,8 @@ packages:
     resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
     engines: {node: '>=10'}
 
-  eslint-config-next@15.5.18:
+  eslint-config-next@15.5.19:
-    resolution: {integrity: sha512-HuoJU6uUPD00eyiud78IBnT4HLhztFj2V+ild2Uon5ZUrYZKe0Olu2QRD99e9IgL4/H1eg5Onka3BsfRW2U0Xw==}
+    resolution: {integrity: sha512-UZwkuhBCNxVZfo93MSHRDOVNWXooJJGcAUyTAVIp0+9QFhH4SqJxWY0s6Mk9C2kMi777HPMn3dseOrZshWpG9Q==}
     peerDependencies:
       eslint: ^7.23.0 || ^8.0.0 || ^9.0.0
       typescript: '>=3.3.1'
@@ -3655,8 +3655,8 @@ packages:
       typescript:
         optional: true
 
-  next@15.5.18:
+  next@15.5.19:
-    resolution: {integrity: sha512-eKL8zUJkX9Y5lE+RX/2YJoItVdGlIscyVyboeD9wSpp0PaGqjoA4tTpT2qPqz9ax+5IzGESyLSeZ/RCwbSZ2uQ==}
+    resolution: {integrity: sha512-xNOW6tYshGX1/Oi3F8uuk4gpDeWsSUE/1Z0G5uUMekIxaQ0xc03UXd9II0VQHYMWviMeA0OHpJFAKsHf8bTYVg==}
     engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0}
     hasBin: true
     peerDependencies:
@@ -5051,34 +5051,34 @@ snapshots:
       '@tybys/wasm-util': 0.10.2
     optional: true
 
-  '@next/env@15.5.18': {}
+  '@next/env@15.5.19': {}
 
-  '@next/eslint-plugin-next@15.5.18':
+  '@next/eslint-plugin-next@15.5.19':
     dependencies:
       fast-glob: 3.3.1
 
-  '@next/swc-darwin-arm64@15.5.18':
+  '@next/swc-darwin-arm64@15.5.19':
     optional: true
 
-  '@next/swc-darwin-x64@15.5.18':
+  '@next/swc-darwin-x64@15.5.19':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@15.5.18':
+  '@next/swc-linux-arm64-gnu@15.5.19':
     optional: true
 
-  '@next/swc-linux-arm64-musl@15.5.18':
+  '@next/swc-linux-arm64-musl@15.5.19':
     optional: true
 
-  '@next/swc-linux-x64-gnu@15.5.18':
+  '@next/swc-linux-x64-gnu@15.5.19':
     optional: true
 
-  '@next/swc-linux-x64-musl@15.5.18':
+  '@next/swc-linux-x64-musl@15.5.19':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@15.5.18':
+  '@next/swc-win32-arm64-msvc@15.5.19':
     optional: true
 
-  '@next/swc-win32-x64-msvc@15.5.18':
+  '@next/swc-win32-x64-msvc@15.5.19':
     optional: true
 
   '@nodelib/fs.scandir@2.1.5':
@@ -7020,9 +7020,9 @@ snapshots:
 
   escape-string-regexp@4.0.0: {}
 
-  eslint-config-next@15.5.18(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3):
+  eslint-config-next@15.5.19(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3):
     dependencies:
-      '@next/eslint-plugin-next': 15.5.18
+      '@next/eslint-plugin-next': 15.5.19
       '@rushstack/eslint-patch': 1.16.1
       '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3))(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
       '@typescript-eslint/parser': 8.61.0(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
@@ -7875,22 +7875,22 @@ snapshots:
 
   negotiator@1.0.0: {}
 
-  next-auth@5.0.0-beta.31(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3):
+  next-auth@5.0.0-beta.31(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3):
     dependencies:
       '@auth/core': 0.41.2
-      next: 15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
+      next: 15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
       react: 19.1.3
 
   next-intl-swc-plugin-extractor@4.13.0: {}
 
-  next-intl@4.13.0(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3):
+  next-intl@4.13.0(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3):
     dependencies:
       '@formatjs/intl-localematcher': 0.8.10
       '@parcel/watcher': 2.5.6
       '@swc/core': 1.15.41
       icu-minify: 4.13.0
       negotiator: 1.0.0
-      next: 15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
+      next: 15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
       next-intl-swc-plugin-extractor: 4.13.0
       po-parser: 2.1.1
       react: 19.1.3
@@ -7900,9 +7900,9 @@ snapshots:
     transitivePeerDependencies:
       - '@swc/helpers'
 
-  next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3):
+  next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3):
     dependencies:
-      '@next/env': 15.5.18
+      '@next/env': 15.5.19
       '@swc/helpers': 0.5.15
       caniuse-lite: 1.0.30001799
       postcss: 8.4.31
@@ -7910,14 +7910,14 @@ snapshots:
       react-dom: 19.1.3(react@19.1.3)
       styled-jsx: 5.1.6(react@19.1.3)
     optionalDependencies:
-      '@next/swc-darwin-arm64': 15.5.18
+      '@next/swc-darwin-arm64': 15.5.19
-      '@next/swc-darwin-x64': 15.5.18
+      '@next/swc-darwin-x64': 15.5.19
-      '@next/swc-linux-arm64-gnu': 15.5.18
+      '@next/swc-linux-arm64-gnu': 15.5.19
-      '@next/swc-linux-arm64-musl': 15.5.18
+      '@next/swc-linux-arm64-musl': 15.5.19
-      '@next/swc-linux-x64-gnu': 15.5.18
+      '@next/swc-linux-x64-gnu': 15.5.19
-      '@next/swc-linux-x64-musl': 15.5.18
+      '@next/swc-linux-x64-musl': 15.5.19
-      '@next/swc-win32-arm64-msvc': 15.5.18
+      '@next/swc-win32-arm64-msvc': 15.5.19
-      '@next/swc-win32-x64-msvc': 15.5.18
+      '@next/swc-win32-x64-msvc': 15.5.19
       '@playwright/test': 1.60.0
       sharp: 0.34.5
     transitivePeerDependencies:

cannamanage-frontend/src/__tests__/mocks/handlers.ts

@@ -98,11 +98,11 @@ export const mockStaffList = [
 ]
 
 export const mockQuotaStatus = {
-  memberId: "m1",
+  dailyUsedGrams: 15,
+  dailyLimitGrams: 25,
+  monthlyUsedGrams: 15,
   monthlyLimitGrams: 50,
-  usedGrams: 15,
+  isUnder21: false,
-  remainingGrams: 35,
-  distributionCount: 3,
 }
 
 export const mockRecentDistributions = [

cannamanage-frontend/src/__tests__/services/distributions.test.tsx

@@ -62,7 +62,7 @@ describe("useQuotaQuery", () => {
     await waitFor(() => expect(result.current.isSuccess).toBe(true))
     expect(result.current.data).toEqual(mockQuotaStatus)
     expect(result.current.data?.monthlyLimitGrams).toBe(50)
-    expect(result.current.data?.usedGrams).toBe(15)
+    expect(result.current.data?.dailyUsedGrams).toBe(15)
   })
 
   it("is disabled when memberId is empty", async () => {

cannamanage-frontend/src/__tests__/services/members.test.tsx

@@ -91,7 +91,7 @@ describe("useMemberQuotaQuery", () => {
 
     await waitFor(() => expect(result.current.isSuccess).toBe(true))
     expect(result.current.data).toEqual(mockQuotaStatus)
-    expect(result.current.data?.remainingGrams).toBe(35)
+    expect(result.current.data?.monthlyUsedGrams).toBe(15)
   })
 })
 

cannamanage-frontend/src/app/(auth)/layout.tsx

@@ -1,5 +1,6 @@
 import { NextIntlClientProvider } from "next-intl"
 import { getMessages } from "next-intl/server"
+import { Cannabis, ClipboardCheck, Scale, Users } from "lucide-react"
 
 import type { ReactNode } from "react"
 
@@ -11,10 +12,74 @@ export default async function AuthLayout({
   const messages = await getMessages()
 
   return (
-    <div className="fixed inset-0 z-50 flex min-h-screen items-center justify-center bg-background text-foreground p-4">
     <NextIntlClientProvider messages={messages}>
-        {children}
+      <div className="fixed inset-0 z-50 flex min-h-screen bg-background text-foreground">
-      </NextIntlClientProvider>
+        {/* Left panel — branding (hidden on mobile) */}
+        <div className="hidden md:flex md:w-1/2 lg:w-[55%] flex-col items-center justify-center bg-gradient-to-br from-primary/10 via-primary/5 to-background p-12 relative overflow-hidden">
+          {/* Decorative background blur */}
+          <div className="absolute inset-0 -z-10">
+            <div className="absolute top-1/4 left-1/4 h-64 w-64 rounded-full bg-primary/10 blur-3xl" />
+            <div className="absolute bottom-1/4 right-1/4 h-48 w-48 rounded-full bg-primary/5 blur-2xl" />
           </div>
+
+          <div className="flex flex-col items-center gap-8 max-w-sm text-center">
+            {/* Logo */}
+            <div className="flex h-16 w-16 items-center justify-center rounded-2xl bg-primary/10 border border-primary/20">
+              <Cannabis className="h-9 w-9 text-primary" />
+            </div>
+
+            {/* App name & tagline */}
+            <div className="space-y-2">
+              <h1 className="text-2xl font-bold">CannaManage</h1>
+              <p className="text-muted-foreground">
+                Dein Verein, digital verwaltet
+              </p>
+            </div>
+
+            {/* Feature highlights */}
+            <div className="space-y-4 text-left w-full">
+              <div className="flex items-start gap-3">
+                <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-primary/10">
+                  <ClipboardCheck className="h-4 w-4 text-primary" />
+                </div>
+                <div>
+                  <p className="text-sm font-medium">KCanG-Compliance</p>
+                  <p className="text-xs text-muted-foreground">
+                    Automatische Vorgaben-Überwachung
+                  </p>
+                </div>
+              </div>
+              <div className="flex items-start gap-3">
+                <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-primary/10">
+                  <Users className="h-4 w-4 text-primary" />
+                </div>
+                <div>
+                  <p className="text-sm font-medium">Mitgliederverwaltung</p>
+                  <p className="text-xs text-muted-foreground">
+                    Portal, Profile und Dokumente
+                  </p>
+                </div>
+              </div>
+              <div className="flex items-start gap-3">
+                <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-primary/10">
+                  <Scale className="h-4 w-4 text-primary" />
+                </div>
+                <div>
+                  <p className="text-sm font-medium">Abgabe-Tracking</p>
+                  <p className="text-xs text-muted-foreground">
+                    25g/Tag und 50g/Monat automatisch
+                  </p>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+
+        {/* Right panel — form */}
+        <div className="w-full md:w-1/2 lg:w-[45%] flex items-center justify-center p-6 sm:p-8">
+          {children}
+        </div>
+      </div>
+    </NextIntlClientProvider>
   )
 }

cannamanage-frontend/src/app/(auth)/login/page.tsx

@@ -8,7 +8,7 @@ import { signIn } from "next-auth/react"
 import { useTranslations } from "next-intl"
 import { useForm } from "react-hook-form"
 import { z } from "zod"
-import { Cannabis, Loader2 } from "lucide-react"
+import { Loader2 } from "lucide-react"
 
 const loginSchema = z.object({
   email: z.string().email(),
@@ -55,13 +55,10 @@ export default function LoginPage() {
   }
 
   return (
-    <div className="w-full max-w-md space-y-8">
+    <div className="w-full max-w-sm space-y-6">
-      {/* Logo & Branding */}
+      {/* Title — visible on mobile where left panel is hidden */}
-      <div className="flex flex-col items-center space-y-2">
+      <div className="space-y-2 text-center md:text-left">
-        <div className="flex h-14 w-14 items-center justify-center rounded-xl bg-primary/10">
+        <h1 className="text-2xl font-bold tracking-tight">{t("loginTitle")}</h1>
-          <Cannabis className="h-8 w-8 text-primary" />
-        </div>
-        <h1 className="text-2xl font-bold tracking-tight">CannaManage</h1>
         <p className="text-sm text-muted-foreground">{t("loginSubtitle")}</p>
       </div>
 

cannamanage-frontend/src/app/(dashboard-layout)/page.tsx

@@ -1,5 +0,0 @@
-import { redirect } from "next/navigation"
-
-export default function HomePage() {
-  redirect("/dashboard")
-}

cannamanage-frontend/src/app/(marketing)/layout.tsx

@@ -1,10 +1,10 @@
-import Link from "next/link"
 import { NextIntlClientProvider } from "next-intl"
 import { getMessages } from "next-intl/server"
-import { Cannabis } from "lucide-react"
 
 import type { ReactNode } from "react"
 
+import MarketingLayoutClient from "./marketing-layout-client"
+
 // Force dynamic rendering — prevents NextAuth from being called at build time
 // (AUTH_URL is not available during Docker image build)
 export const dynamic = "force-dynamic"
@@ -18,108 +18,7 @@ export default async function MarketingLayout({
 
   return (
     <NextIntlClientProvider messages={messages}>
-      <div className="min-h-screen flex flex-col bg-background text-foreground overflow-x-hidden">
+      <MarketingLayoutClient>{children}</MarketingLayoutClient>
-        {/* Header */}
-        <header className="sticky top-0 z-40 border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
-          <div className="container mx-auto flex h-16 items-center justify-between px-4">
-            <Link href="/" className="flex items-center gap-2">
-              <div className="flex h-9 w-9 items-center justify-center rounded-lg bg-primary/10">
-                <Cannabis className="h-5 w-5 text-primary" />
-              </div>
-              <span className="text-lg font-bold">CannaManage</span>
-            </Link>
-            <nav className="flex items-center gap-4">
-              <Link
-                href="/pricing"
-                className="text-sm font-medium text-muted-foreground hover:text-foreground transition-colors"
-              >
-                Preise
-              </Link>
-              <Link
-                href="/login"
-                className="inline-flex h-9 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground hover:bg-primary/90 transition-colors"
-              >
-                Anmelden
-              </Link>
-            </nav>
-          </div>
-        </header>
-
-        {/* Main content */}
-        <main className="flex-1">{children}</main>
-
-        {/* Footer */}
-        <footer className="border-t bg-muted/50">
-          <div className="container mx-auto px-4 py-8">
-            <div className="grid grid-cols-1 gap-8 md:grid-cols-3">
-              <div>
-                <div className="flex items-center gap-2 mb-3">
-                  <Cannabis className="h-5 w-5 text-primary" />
-                  <span className="font-semibold">CannaManage</span>
-                </div>
-                <p className="text-sm text-muted-foreground">
-                  Die sichere Verwaltungssoftware für Cannabis-Anbauvereine in
-                  Deutschland.
-                </p>
-              </div>
-              <div>
-                <h4 className="font-semibold text-sm mb-3">Produkt</h4>
-                <ul className="space-y-2 text-sm text-muted-foreground">
-                  <li>
-                    <Link
-                      href="/pricing"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Preise
-                    </Link>
-                  </li>
-                  <li>
-                    <Link
-                      href="/login"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Anmelden
-                    </Link>
-                  </li>
-                </ul>
-              </div>
-              <div>
-                <h4 className="font-semibold text-sm mb-3">Rechtliches</h4>
-                <ul className="space-y-2 text-sm text-muted-foreground">
-                  <li>
-                    <Link
-                      href="/impressum"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Impressum
-                    </Link>
-                  </li>
-                  <li>
-                    <Link
-                      href="/datenschutz"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Datenschutz
-                    </Link>
-                  </li>
-                  <li>
-                    <Link
-                      href="/agb"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      AGB
-                    </Link>
-                  </li>
-                </ul>
-              </div>
-            </div>
-            <div className="mt-8 border-t pt-6 text-center text-xs text-muted-foreground">
-              © {new Date().getFullYear()} CannaManage — Plate Software. Alle
-              Rechte vorbehalten.
-            </div>
-          </div>
-        </footer>
-      </div>
     </NextIntlClientProvider>
   )
 }

cannamanage-frontend/src/app/(marketing)/marketing-layout-client.tsx

@@ -0,0 +1,135 @@
+"use client"
+
+import Link from "next/link"
+import { useTranslations } from "next-intl"
+import { Cannabis } from "lucide-react"
+
+import type { ReactNode } from "react"
+
+export default function MarketingLayoutClient({
+  children,
+}: {
+  children: ReactNode
+}) {
+  const t = useTranslations("marketing.nav")
+
+  return (
+    <div className="min-h-screen flex flex-col bg-background text-foreground overflow-x-hidden">
+      {/* Header */}
+      <header className="sticky top-0 z-40 border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
+        <div className="container mx-auto flex h-16 items-center justify-between px-4">
+          <Link href="/" className="flex items-center gap-2">
+            <div className="flex h-9 w-9 items-center justify-center rounded-lg bg-primary/10">
+              <Cannabis className="h-5 w-5 text-primary" />
+            </div>
+            <span className="text-lg font-bold">CannaManage</span>
+          </Link>
+          <nav className="flex items-center gap-4">
+            <Link
+              href="/#features"
+              className="text-sm font-medium text-muted-foreground hover:text-foreground transition-colors"
+            >
+              {t("features")}
+            </Link>
+            <Link
+              href="/pricing"
+              className="text-sm font-medium text-muted-foreground hover:text-foreground transition-colors"
+            >
+              {t("pricing")}
+            </Link>
+            <Link
+              href="/login"
+              className="inline-flex h-9 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground hover:bg-primary/90 transition-colors"
+            >
+              {t("login")}
+            </Link>
+          </nav>
+        </div>
+      </header>
+
+      {/* Main content */}
+      <main className="flex-1">{children}</main>
+
+      {/* Footer */}
+      <footer className="border-t bg-muted/50">
+        <div className="container mx-auto px-4 py-8">
+          <div className="grid grid-cols-1 gap-8 md:grid-cols-3">
+            <div>
+              <div className="flex items-center gap-2 mb-3">
+                <Cannabis className="h-5 w-5 text-primary" />
+                <span className="font-semibold">CannaManage</span>
+              </div>
+              <p className="text-sm text-muted-foreground">
+                {t("footerTagline")}
+              </p>
+            </div>
+            <div>
+              <h4 className="font-semibold text-sm mb-3">
+                {t("footerProduct")}
+              </h4>
+              <ul className="space-y-2 text-sm text-muted-foreground">
+                <li>
+                  <Link
+                    href="/#features"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("features")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/pricing"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("pricing")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/login"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("login")}
+                  </Link>
+                </li>
+              </ul>
+            </div>
+            <div>
+              <h4 className="font-semibold text-sm mb-3">{t("footerLegal")}</h4>
+              <ul className="space-y-2 text-sm text-muted-foreground">
+                <li>
+                  <Link
+                    href="/impressum"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("impressum")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/datenschutz"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("datenschutz")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/agb"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("agb")}
+                  </Link>
+                </li>
+              </ul>
+            </div>
+          </div>
+          <div className="mt-8 border-t pt-6 text-center text-xs text-muted-foreground">
+            © {new Date().getFullYear()} CannaManage — Plate Software.{" "}
+            {t("allRightsReserved")}
+          </div>
+        </div>
+      </footer>
+    </div>
+  )
+}

cannamanage-frontend/src/app/(marketing)/page.tsx

@@ -0,0 +1,163 @@
+"use client"
+
+import Link from "next/link"
+import { useTranslations } from "next-intl"
+import {
+  ArrowRight,
+  Cannabis,
+  ClipboardCheck,
+  FileArchive,
+  Lock,
+  Scale,
+  Server,
+  ShieldCheck,
+  Sprout,
+  Users,
+  Wallet,
+} from "lucide-react"
+
+const features = [
+  { id: "feature1", icon: ClipboardCheck },
+  { id: "feature2", icon: Sprout },
+  { id: "feature3", icon: Users },
+  { id: "feature4", icon: Scale },
+  { id: "feature5", icon: FileArchive },
+  { id: "feature6", icon: Wallet },
+]
+
+const trustSignals = [
+  { id: "trustCanverg", icon: ShieldCheck },
+  { id: "trustDsgvo", icon: ClipboardCheck },
+  { id: "trustEncryption", icon: Lock },
+  { id: "trustGerman", icon: Server },
+]
+
+export default function HomePage() {
+  const t = useTranslations("marketing.home")
+
+  return (
+    <div className="flex flex-col">
+      {/* Hero Section */}
+      <section className="relative overflow-hidden py-20 sm:py-28 lg:py-32">
+        <div className="container mx-auto px-4 text-center">
+          <div className="mx-auto max-w-3xl">
+            <div className="mb-6 inline-flex items-center gap-2 rounded-full border bg-muted/50 px-4 py-1.5 text-sm">
+              <Cannabis className="h-4 w-4 text-primary" />
+              <span className="text-muted-foreground">KCanG-konform</span>
+            </div>
+            <h1 className="text-4xl font-bold tracking-tight sm:text-5xl lg:text-6xl">
+              {t("heroTitle")}
+            </h1>
+            <p className="mt-6 text-lg text-muted-foreground sm:text-xl max-w-2xl mx-auto">
+              {t("heroSubtitle")}
+            </p>
+            <div className="mt-10 flex flex-col items-center gap-4 sm:flex-row sm:justify-center">
+              <Link
+                href="/pricing"
+                className="inline-flex h-12 items-center justify-center gap-2 rounded-lg bg-primary px-6 text-base font-medium text-primary-foreground shadow-sm hover:bg-primary/90 transition-colors"
+              >
+                {t("ctaPrimary")}
+                <ArrowRight className="h-4 w-4" />
+              </Link>
+              <Link
+                href="/login"
+                className="inline-flex h-12 items-center justify-center gap-2 rounded-lg border bg-background px-6 text-base font-medium hover:bg-muted transition-colors"
+              >
+                {t("ctaSecondary")}
+              </Link>
+            </div>
+          </div>
+        </div>
+        {/* Decorative gradient */}
+        <div className="pointer-events-none absolute inset-0 -z-10 overflow-hidden">
+          <div className="absolute -top-40 left-1/2 -translate-x-1/2 h-[500px] w-[800px] rounded-full bg-primary/5 blur-3xl" />
+        </div>
+      </section>
+
+      {/* Features Section */}
+      <section id="features" className="py-20 bg-muted/30">
+        <div className="container mx-auto px-4">
+          <div className="text-center mb-14">
+            <h2 className="text-3xl font-bold tracking-tight sm:text-4xl">
+              {t("featuresTitle")}
+            </h2>
+            <p className="mt-4 text-lg text-muted-foreground max-w-2xl mx-auto">
+              {t("featuresSubtitle")}
+            </p>
+          </div>
+          <div className="grid grid-cols-1 gap-6 sm:grid-cols-2 lg:grid-cols-3 max-w-5xl mx-auto">
+            {features.map((feature) => {
+              const Icon = feature.icon
+              return (
+                <div
+                  key={feature.id}
+                  className="group rounded-xl border bg-card p-6 shadow-sm transition-all hover:shadow-md hover:border-primary/20"
+                >
+                  <div className="mb-4 flex h-12 w-12 items-center justify-center rounded-lg bg-primary/10 text-primary group-hover:bg-primary/15 transition-colors">
+                    <Icon className="h-6 w-6" />
+                  </div>
+                  <h3 className="text-lg font-semibold mb-2">
+                    {t(`${feature.id}Title`)}
+                  </h3>
+                  <p className="text-sm text-muted-foreground leading-relaxed">
+                    {t(`${feature.id}Desc`)}
+                  </p>
+                </div>
+              )
+            })}
+          </div>
+        </div>
+      </section>
+
+      {/* Trust Signals Section */}
+      <section className="py-20">
+        <div className="container mx-auto px-4">
+          <div className="text-center mb-12">
+            <h2 className="text-2xl font-bold tracking-tight sm:text-3xl">
+              {t("trustTitle")}
+            </h2>
+          </div>
+          <div className="grid grid-cols-2 gap-6 sm:grid-cols-4 max-w-3xl mx-auto">
+            {trustSignals.map((signal) => {
+              const Icon = signal.icon
+              return (
+                <div
+                  key={signal.id}
+                  className="flex flex-col items-center gap-3 rounded-lg border bg-card p-5 text-center"
+                >
+                  <div className="flex h-10 w-10 items-center justify-center rounded-full bg-primary/10 text-primary">
+                    <Icon className="h-5 w-5" />
+                  </div>
+                  <span className="text-sm font-medium">{t(signal.id)}</span>
+                </div>
+              )
+            })}
+          </div>
+        </div>
+      </section>
+
+      {/* Final CTA Section */}
+      <section className="py-20 bg-muted/30">
+        <div className="container mx-auto px-4 text-center">
+          <div className="mx-auto max-w-2xl">
+            <h2 className="text-3xl font-bold tracking-tight sm:text-4xl">
+              {t("ctaFinalTitle")}
+            </h2>
+            <p className="mt-4 text-lg text-muted-foreground">
+              {t("ctaFinalSubtitle")}
+            </p>
+            <div className="mt-8">
+              <Link
+                href="/pricing"
+                className="inline-flex h-12 items-center justify-center gap-2 rounded-lg bg-primary px-8 text-base font-medium text-primary-foreground shadow-sm hover:bg-primary/90 transition-colors"
+              >
+                {t("ctaFinalButton")}
+                <ArrowRight className="h-4 w-4" />
+              </Link>
+            </div>
+          </div>
+        </div>
+      </section>
+    </div>
+  )
+}

cannamanage-frontend/src/app/(marketing)/pricing/page.tsx

@@ -10,6 +10,7 @@ const plans = [
     icon: Leaf,
     price: "19",
     memberLimit: "30",
+    storage: "5",
     features: [
       "memberManagement",
       "distributionTracking",
@@ -24,6 +25,7 @@ const plans = [
     icon: Cannabis,
     price: "49",
     memberLimit: "100",
+    storage: "50",
     popular: true,
     features: [
       "allStarter",
@@ -40,6 +42,7 @@ const plans = [
     icon: Building2,
     price: null,
     memberLimit: "unlimited",
+    storage: "custom",
     features: [
       "allPro",
       "unlimitedMembers",
@@ -58,6 +61,7 @@ const faqs = [
   { id: "cancel" },
   { id: "data" },
   { id: "migration" },
+  { id: "storage" },
 ]
 
 export default function PricingPage() {
@@ -129,6 +133,14 @@ export default function PricingPage() {
                       limit: plan.memberLimit,
                     })}
                   </p>
+                  <div className="mt-2 inline-flex items-center gap-1 rounded-full bg-muted px-2.5 py-0.5 text-xs font-medium">
+                    {t(`storage.${plan.id}`)}
+                    {plan.id === "pro" && (
+                      <span className="text-muted-foreground ml-1">
+                        {t("storage.proOverage")}
+                      </span>
+                    )}
+                  </div>
                 </div>
 
                 <ul className="space-y-3 mb-8 flex-1">
@@ -180,6 +192,8 @@ export default function PricingPage() {
             <tbody className="divide-y">
               {[
                 "compMembers",
+                "compStorage",
+                "compOverage",
                 "compDistributions",
                 "compReports",
                 "compGrow",

cannamanage-frontend/src/app/(portal)/portal-login/page.tsx

@@ -7,7 +7,7 @@ import { zodResolver } from "@hookform/resolvers/zod"
 import { useTranslations } from "next-intl"
 import { useForm } from "react-hook-form"
 import { z } from "zod"
-import { Cannabis, Loader2 } from "lucide-react"
+import { Cannabis, ClockArrowUp, FileText, Loader2, User } from "lucide-react"
 
 const loginSchema = z.object({
   email: z.string().email(),
@@ -42,15 +42,75 @@ export default function PortalLoginPage() {
   }
 
   return (
-    <div className="fixed inset-0 z-50 flex min-h-screen items-center justify-center bg-background text-foreground p-4">
+    <div className="fixed inset-0 z-50 flex min-h-screen bg-background text-foreground">
-      <div className="w-full max-w-md space-y-8">
+      {/* Left panel — member-focused branding (hidden on mobile) */}
-        {/* Logo & Branding */}
+      <div className="hidden md:flex md:w-1/2 lg:w-[55%] flex-col items-center justify-center bg-gradient-to-br from-emerald-500/10 via-teal-500/5 to-background p-12 relative overflow-hidden">
-        <div className="flex flex-col items-center space-y-2">
+        {/* Decorative background */}
-          <div className="flex h-14 w-14 items-center justify-center rounded-xl bg-primary/10">
+        <div className="absolute inset-0 -z-10">
-            <Cannabis className="h-8 w-8 text-primary" />
+          <div className="absolute top-1/4 left-1/4 h-64 w-64 rounded-full bg-emerald-500/10 blur-3xl" />
+          <div className="absolute bottom-1/4 right-1/4 h-48 w-48 rounded-full bg-teal-500/5 blur-2xl" />
         </div>
-          <h1 className="text-2xl font-bold tracking-tight">{t("title")}</h1>
+
-          <p className="text-sm text-muted-foreground">{t("loginSubtitle")}</p>
+        <div className="flex flex-col items-center gap-8 max-w-sm text-center">
+          {/* Logo */}
+          <div className="flex h-16 w-16 items-center justify-center rounded-2xl bg-emerald-500/10 border border-emerald-500/20">
+            <Cannabis className="h-9 w-9 text-emerald-600 dark:text-emerald-400" />
+          </div>
+
+          {/* Branding */}
+          <div className="space-y-2">
+            <h1 className="text-2xl font-bold">Mitgliederportal</h1>
+            <p className="text-muted-foreground">Willkommen zurück</p>
+          </div>
+
+          {/* Feature highlights */}
+          <div className="space-y-4 text-left w-full">
+            <div className="flex items-start gap-3">
+              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
+                <ClockArrowUp className="h-4 w-4 text-emerald-600 dark:text-emerald-400" />
+              </div>
+              <div>
+                <p className="text-sm font-medium">Abgabehistorie</p>
+                <p className="text-xs text-muted-foreground">
+                  Alle Abgaben auf einen Blick
+                </p>
+              </div>
+            </div>
+            <div className="flex items-start gap-3">
+              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
+                <User className="h-4 w-4 text-emerald-600 dark:text-emerald-400" />
+              </div>
+              <div>
+                <p className="text-sm font-medium">Profil verwalten</p>
+                <p className="text-xs text-muted-foreground">
+                  Daten und Einstellungen
+                </p>
+              </div>
+            </div>
+            <div className="flex items-start gap-3">
+              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
+                <FileText className="h-4 w-4 text-emerald-600 dark:text-emerald-400" />
+              </div>
+              <div>
+                <p className="text-sm font-medium">Dokumente</p>
+                <p className="text-xs text-muted-foreground">
+                  Bescheinigungen und Nachweise
+                </p>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+
+      {/* Right panel — form */}
+      <div className="w-full md:w-1/2 lg:w-[45%] flex items-center justify-center p-6 sm:p-8">
+        <div className="w-full max-w-sm space-y-6">
+          {/* Title */}
+          <div className="space-y-2 text-center md:text-left">
+            <h2 className="text-2xl font-bold tracking-tight">{t("title")}</h2>
+            <p className="text-sm text-muted-foreground">
+              {t("loginSubtitle")}
+            </p>
           </div>
 
           {/* Login Card */}
@@ -115,7 +175,7 @@ export default function PortalLoginPage() {
               <button
                 type="submit"
                 disabled={isSubmitting}
-              className="inline-flex h-10 w-full items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground ring-offset-background transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50"
+                className="inline-flex h-10 w-full items-center justify-center gap-2 rounded-md bg-emerald-600 px-4 py-2 text-sm font-medium text-white ring-offset-background transition-colors hover:bg-emerald-700 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50"
               >
                 {isSubmitting ? (
                   <>
@@ -140,5 +200,6 @@ export default function PortalLoginPage() {
           </div>
         </div>
       </div>
+    </div>
   )
 }

cannamanage-frontend/src/app/api/backend/[...path]/route.ts

@@ -0,0 +1,122 @@
+/**
+ * Server-side API proxy for the CannaManage backend.
+ *
+ * Replaces the old static `rewrites()` proxy in next.config.mjs. A static
+ * rewrite forwards requests as-is and CANNOT inject an Authorization header,
+ * which was the root cause of the systemic "no token reaches the backend" bug:
+ * every browser fetch hit the backend unauthenticated → 401/500 → pages only
+ * survived via mock fallbacks.
+ *
+ * This Route Handler runs on the server, reads the NextAuth session via
+ * `auth()` (so the JWT never leaves the server), and forwards the request to
+ * `${BACKEND_URL}/api/v1/<path>` with `Authorization: Bearer <accessToken>`.
+ *
+ * It is method-agnostic and content-agnostic:
+ *   - Query string is preserved.
+ *   - The raw request body is streamed through unparsed, so JSON,
+ *     multipart/form-data (file uploads) and any other content type work.
+ *   - The upstream response body is streamed back verbatim, so binary
+ *     downloads (PDF/CSV reports, attachments) are byte-exact.
+ */
+import { NextResponse } from "next/server"
+
+import type { NextRequest } from "next/server"
+
+import { auth } from "@/lib/auth"
+
+// Always run dynamically — this proxy depends on per-request auth + body.
+export const dynamic = "force-dynamic"
+
+const BACKEND_URL = process.env.BACKEND_URL || "http://localhost:8080"
+
+// Hop-by-hop and host-specific headers that must not be forwarded upstream.
+const STRIPPED_REQUEST_HEADERS = new Set([
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "accept-encoding",
+])
+
+// Headers that must not be copied from the upstream response back to the client.
+const STRIPPED_RESPONSE_HEADERS = new Set([
+  "connection",
+  "transfer-encoding",
+  "content-encoding",
+  "content-length",
+])
+
+async function proxy(req: NextRequest, path: string[]): Promise<NextResponse> {
+  const session = await auth()
+  const accessToken = session?.accessToken
+
+  // Build the upstream URL: /api/backend/<path> → BACKEND_URL/api/v1/<path>
+  const search = req.nextUrl.search // includes leading "?" or ""
+  const upstreamUrl = `${BACKEND_URL}/api/v1/${path.join("/")}${search}`
+
+  // Clone the incoming headers, stripping hop-by-hop/host ones, then inject auth.
+  const headers = new Headers()
+  req.headers.forEach((value, key) => {
+    if (!STRIPPED_REQUEST_HEADERS.has(key.toLowerCase())) {
+      headers.set(key, value)
+    }
+  })
+  if (accessToken) {
+    headers.set("Authorization", `Bearer ${accessToken}`)
+  }
+
+  const method = req.method.toUpperCase()
+  const hasBody = method !== "GET" && method !== "HEAD"
+
+  try {
+    const upstream = await fetch(upstreamUrl, {
+      method,
+      headers,
+      // Stream the raw body through unparsed (works for JSON + multipart + binary).
+      body: hasBody ? req.body : undefined,
+      // Required by undici/Node when sending a streaming request body.
+      ...(hasBody ? { duplex: "half" } : {}),
+      redirect: "manual",
+      cache: "no-store",
+    } as RequestInit)
+
+    // Copy upstream response headers, dropping ones that break a re-emitted body.
+    const responseHeaders = new Headers()
+    upstream.headers.forEach((value, key) => {
+      if (!STRIPPED_RESPONSE_HEADERS.has(key.toLowerCase())) {
+        responseHeaders.set(key, value)
+      }
+    })
+
+    // Stream the body straight back — byte-exact for downloads.
+    return new NextResponse(upstream.body, {
+      status: upstream.status,
+      statusText: upstream.statusText,
+      headers: responseHeaders,
+    })
+  } catch {
+    return NextResponse.json(
+      { code: "BACKEND_UNREACHABLE", message: "Unable to reach the API." },
+      { status: 502 }
+    )
+  }
+}
+
+// Next.js 15: the second arg's `params` is a Promise.
+type Ctx = { params: Promise<{ path: string[] }> }
+
+export async function GET(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function POST(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function PUT(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function PATCH(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function DELETE(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}

cannamanage-frontend/src/lib/auth.ts

@@ -120,6 +120,20 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
       session.user.role = token.role as string
       session.user.clubId = token.clubId as string
       session.error = token.error as string | undefined
+      // Expose the backend access token on the session so the server-side proxy
+      // Route Handler (app/api/backend/[...path]/route.ts) can read it via auth()
+      // and inject it as a Bearer header on every API call.
+      //
+      // We use auth() (not getToken()) because it handles the cookie name
+      // consistently across the public-HTTPS / internal-HTTP boundary: the
+      // browser talks HTTPS to the Apache front, which proxies plain HTTP to
+      // this container. getToken()'s __Secure- cookie-name autodetection keys
+      // off the (internal, http) request URL and would miss the real secure
+      // cookie. The tradeoff: accessToken is therefore also returned by
+      // /api/auth/session — i.e. readable client-side. That is an accepted,
+      // standard bearer-token-in-browser posture; the JWT is short-lived and is
+      // already the browser's effective credential.
+      session.accessToken = token.accessToken as string | undefined
       return session
     },
     async redirect({ url, baseUrl }) {

cannamanage-frontend/src/services/documents.ts

@@ -73,7 +73,19 @@ export async function uploadDocument(
       body: formData,
     }
   )
-  if (!res.ok) throw new Error("Upload failed")
+  if (!res.ok) {
+    if (res.status === 402) {
+      const problem = await res.json()
+      const error = new Error("Storage quota exceeded") as Error & {
+        status: number
+        problemDetail: unknown
+      }
+      error.status = 402
+      error.problemDetail = problem
+      throw error
+    }
+    throw new Error("Upload failed")
+  }
   return res.json()
 }
 

cannamanage-frontend/src/services/storage.ts

@@ -0,0 +1,43 @@
+import { apiClient } from "@/lib/api-client"
+
+export interface StorageUsage {
+  usedBytes: number
+  limitBytes: number
+  percentage: number
+}
+
+/**
+ * Fetch current storage usage for the authenticated user's club.
+ * Club ID is derived from JWT on the backend — no param needed.
+ */
+export function getStorageUsage(): Promise<StorageUsage> {
+  return apiClient<StorageUsage>("/storage/usage")
+}
+
+/**
+ * Format bytes into a human-readable string (e.g., "4.2 GB").
+ */
+export function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B"
+  const k = 1024
+  const sizes = ["B", "KB", "MB", "GB", "TB"]
+  const i = Math.floor(Math.log(bytes) / Math.log(k))
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + " " + sizes[i]
+}
+
+/**
+ * Check if an API error response indicates a storage quota exceeded (HTTP 402).
+ */
+export function isStorageQuotaError(error: unknown): boolean {
+  if (
+    error &&
+    typeof error === "object" &&
+    "response" in error &&
+    error.response &&
+    typeof error.response === "object" &&
+    "status" in error.response
+  ) {
+    return (error.response as { status: number }).status === 402
+  }
+  return false
+}

cannamanage-frontend/src/types/next-auth.d.ts

@@ -7,6 +7,8 @@ declare module "next-auth" {
       clubId: string
     } & DefaultSession["user"]
     error?: string
+    /** Backend JWT — server-side only, injected as Bearer by the /api/backend proxy. */
+    accessToken?: string
   }
 
   interface User {

cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java

@@ -5,6 +5,7 @@ import de.cannamanage.domain.enums.AuditEventType;
 import de.cannamanage.domain.enums.DocumentAccessLevel;
 import de.cannamanage.domain.enums.DocumentCategory;
 import de.cannamanage.service.repository.DocumentRepository;
+import org.apache.commons.io.FilenameUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Service;
@@ -35,16 +36,22 @@ public class DocumentService {
 
     private final DocumentRepository documentRepository;
     private final AuditService auditService;
+    private final StorageQuotaService storageQuotaService;
 
-    public DocumentService(DocumentRepository documentRepository, AuditService auditService) {
+    public DocumentService(DocumentRepository documentRepository, AuditService auditService,
+                           StorageQuotaService storageQuotaService) {
         this.documentRepository = documentRepository;
         this.auditService = auditService;
+        this.storageQuotaService = storageQuotaService;
     }
 
     @Transactional
     public Document uploadDocument(UUID clubId, String title, DocumentCategory category,
                                    DocumentAccessLevel accessLevel, String description,
                                    MultipartFile file, UUID uploadedBy) throws IOException {
+        // Check storage quota before upload
+        storageQuotaService.checkQuota(clubId, file.getSize());
+
         // Validate file
         if (file.isEmpty()) {
             throw new IllegalArgumentException("File is empty");
@@ -87,6 +94,9 @@ public class DocumentService {
 
         Document saved = documentRepository.save(doc);
 
+        // Increment storage usage counter after successful save
+        storageQuotaService.incrementUsage(clubId, file.getSize());
+
         auditService.log(AuditEventType.DOCUMENT_UPLOADED, uploadedBy, clubId,
                 "Document uploaded: " + title + " (" + category + ")");
 
@@ -132,6 +142,9 @@ public class DocumentService {
         // Delete DB record
         documentRepository.delete(doc);
 
+        // Decrement storage usage counter after successful delete
+        storageQuotaService.decrementUsage(clubId, doc.getFileSize());
+
         auditService.log(AuditEventType.DOCUMENT_DELETED, deletedBy, clubId,
                 "Document deleted: " + doc.getTitle());
 
@@ -198,14 +211,17 @@ public class DocumentService {
         if (original == null || original.isBlank()) {
             return UUID.randomUUID().toString();
         }
-        // Strip path components — keep only the basename
+        // Strip null bytes first — FilenameUtils.getName() throws on \0
-        String name;
+        String safe = original.replace("\0", "");
-        try {
+        if (safe.isBlank()) {
-            name = Paths.get(original).getFileName().toString();
-        } catch (RuntimeException e) {
-            // Invalid path on this platform — fall back to a random name
             return UUID.randomUUID().toString();
         }
+        // Strip path components using commons-io — handles both Unix and Windows separators
+        // regardless of the current platform (unlike Paths.get which is platform-dependent)
+        String name = FilenameUtils.getName(safe);
+        if (name == null || name.isBlank()) {
+            return "document";
+        }
         // Remove control characters and path-/shell-/Windows-reserved characters
         name = name.replaceAll("[\\x00-\\x1F\\x7F/\\\\:*?\"<>|]", "_");
         // Limit length (filesystems usually cap individual segments at 255 bytes)
@@ -214,7 +230,7 @@ public class DocumentService {
         }
         // Ensure not empty after sanitization
         if (name.isBlank() || ".".equals(name) || "..".equals(name)) {
-            return UUID.randomUUID().toString();
+            return "document";
         }
         return name;
     }

cannamanage-service/src/main/java/de/cannamanage/service/RetentionService.java

@@ -9,7 +9,7 @@ import de.cannamanage.service.repository.DistributionRepository;
 import de.cannamanage.service.repository.MemberRepository;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -29,9 +29,11 @@ import java.util.*;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnProperty(name = "cannamanage.schedulers.enabled", havingValue = "true", matchIfMissing = false)
 public class RetentionService {
 
+    @Value("${cannamanage.schedulers.enabled:false}")
+    private boolean schedulersEnabled;
+
     private final ClubRepository clubRepository;
     private final MemberRepository memberRepository;
     private final DistributionRepository distributionRepository;
@@ -39,11 +41,15 @@ public class RetentionService {
 
     /**
      * Daily scheduled retention processing at 2:00 AM.
+     * Only runs when schedulers are enabled.
      * Processes each club independently.
      */
     @Scheduled(cron = "0 0 2 * * *")
     @Transactional
     public void processRetention() {
+        if (!schedulersEnabled) {
+            return;
+        }
         log.info("Starting scheduled retention processing");
         List<Club> clubs = clubRepository.findAll();
         int totalAnonymized = 0;

cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java

@@ -0,0 +1,121 @@
+package de.cannamanage.service;
+
+import de.cannamanage.domain.entity.Club;
+import de.cannamanage.service.exception.StorageQuotaExceededException;
+import de.cannamanage.service.repository.ClubRepository;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.UUID;
+
+/**
+ * Manages storage quota enforcement for clubs.
+ * Each club has a storage_limit_bytes based on their subscription tier
+ * and a storage_used_bytes counter tracking actual usage.
+ */
+@Slf4j
+@Service
+public class StorageQuotaService {
+
+    // Plan tier limits
+    private static final long STARTER_LIMIT = 5L * 1024 * 1024 * 1024;   // 5 GB
+    private static final long PRO_LIMIT = 50L * 1024 * 1024 * 1024;      // 50 GB
+    private static final long ENTERPRISE_LIMIT = Long.MAX_VALUE;          // Unlimited
+
+    private final ClubRepository clubRepository;
+
+    public StorageQuotaService(ClubRepository clubRepository) {
+        this.clubRepository = clubRepository;
+    }
+
+    /**
+     * Get current storage usage for a club.
+     */
+    public StorageUsageDTO getUsage(UUID clubId) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        long used = club.getStorageUsedBytes();
+        long limit = club.getStorageLimitBytes();
+        double percentage = limit > 0 ? (double) used / limit * 100 : 0;
+        return new StorageUsageDTO(used, limit, percentage);
+    }
+
+    /**
+     * Check if uploading additionalBytes would exceed the club's storage limit.
+     * Throws StorageQuotaExceededException if it would.
+     */
+    public void checkQuota(UUID clubId, long additionalBytes) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        long newTotal = club.getStorageUsedBytes() + additionalBytes;
+        if (newTotal > club.getStorageLimitBytes()) {
+            throw new StorageQuotaExceededException(
+                    club.getStorageUsedBytes(), club.getStorageLimitBytes(), additionalBytes);
+        }
+    }
+
+    /**
+     * Increment the club's storage usage counter after a successful upload.
+     */
+    @Transactional
+    public void incrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        club.setStorageUsedBytes(club.getStorageUsedBytes() + bytes);
+        clubRepository.save(club);
+        log.debug("Club {} storage incremented by {} bytes (total: {})", clubId, bytes, club.getStorageUsedBytes());
+    }
+
+    /**
+     * Decrement the club's storage usage counter after a successful delete.
+     */
+    @Transactional
+    public void decrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        long newUsage = Math.max(0, club.getStorageUsedBytes() - bytes);
+        club.setStorageUsedBytes(newUsage);
+        clubRepository.save(club);
+        log.debug("Club {} storage decremented by {} bytes (total: {})", clubId, bytes, newUsage);
+    }
+
+    /**
+     * Get the storage limit in bytes for a given plan tier name.
+     */
+    public static long getLimitForTier(String tier) {
+        return switch (tier.toLowerCase()) {
+            case "starter", "trial" -> STARTER_LIMIT;
+            case "pro" -> PRO_LIMIT;
+            case "enterprise" -> ENTERPRISE_LIMIT;
+            default -> STARTER_LIMIT;
+        };
+    }
+
+    /**
+     * Called when a club's subscription tier changes.
+     * Updates storage_limit_bytes to match the new tier.
+     */
+    @Transactional
+    public void onTierChange(UUID clubId, String newTier) {
+        long newLimit = getLimitForTier(newTier);
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        club.setStorageLimitBytes(newLimit);
+        clubRepository.save(club);
+        log.info("Club {} tier changed to '{}' — storage limit updated to {} bytes", clubId, newTier, newLimit);
+    }
+
+    /**
+     * Check if a club is at or above a given usage threshold percentage.
+     */
+    public boolean isNearLimit(UUID clubId, int thresholdPercent) {
+        StorageUsageDTO usage = getUsage(clubId);
+        return usage.percentage() >= thresholdPercent;
+    }
+
+    /**
+     * DTO for storage usage response.
+     */
+    public record StorageUsageDTO(long usedBytes, long limitBytes, double percentage) {}
+}

cannamanage-service/src/main/java/de/cannamanage/service/exception/StorageQuotaExceededException.java

@@ -0,0 +1,33 @@
+package de.cannamanage.service.exception;
+
+/**
+ * Thrown when a document upload would exceed the club's storage quota.
+ * Maps to HTTP 402 Payment Required — distinct from QuotaExceededException
+ * which handles CanG distribution quotas (25g/day, 50g/month).
+ */
+public class StorageQuotaExceededException extends RuntimeException {
+
+    private final long currentUsage;
+    private final long limit;
+    private final long requestedBytes;
+
+    public StorageQuotaExceededException(long currentUsage, long limit, long requestedBytes) {
+        super("Storage quota exceeded: current=%d, limit=%d, requested=%d"
+                .formatted(currentUsage, limit, requestedBytes));
+        this.currentUsage = currentUsage;
+        this.limit = limit;
+        this.requestedBytes = requestedBytes;
+    }
+
+    public long getCurrentUsage() {
+        return currentUsage;
+    }
+
+    public long getLimit() {
+        return limit;
+    }
+
+    public long getRequestedBytes() {
+        return requestedBytes;
+    }
+}

cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java

@@ -40,6 +40,9 @@ class DocumentServiceTest {
     @Mock
     private AuditService auditService;
 
+    @Mock
+    private StorageQuotaService storageQuotaService;
+
     @InjectMocks
     private DocumentService documentService;
 
@@ -164,10 +167,10 @@ class DocumentServiceTest {
                     clubId, "Dots", DocumentCategory.SONSTIGES,
                     DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
 
-            // ".." is explicitly caught → UUID fallback
+            // ".." is explicitly caught → "document" fallback
             assertThat(result.getFilename()).isNotEqualTo("..");
             assertThat(result.getFilename()).isNotBlank();
-            assertThat(result.getFilename()).matches("[a-f0-9\\-]+");
+            assertThat(result.getFilename()).isEqualTo("document");
         }
     }
 
@@ -234,6 +237,7 @@ class DocumentServiceTest {
         doc.setId(docId);
         doc.setClubId(clubId);
         doc.setTitle("To Delete");
+        doc.setFileSize(1024L);
         doc.setStoragePath(clubId + "/" + docId + "_test.pdf");
         when(documentRepository.findById(docId)).thenReturn(Optional.of(doc));
 
@@ -267,6 +271,83 @@ class DocumentServiceTest {
         }
     }
 
+    // --- Additional security tests for Sprint 13 ---
+
+    @Test
+    void testUploadDocument_sanitizesPathTraversal_toBasename() throws IOException {
+        // Verify that "../../etc/passwd" is stripped to just "passwd"
+        MultipartFile file = mockValidFile("../../etc/passwd", "application/pdf", 512);
+        when(documentRepository.save(any(Document.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        try (MockedStatic<Files> filesMock = mockStatic(Files.class)) {
+            filesMock.when(() -> Files.createDirectories(any(Path.class))).thenReturn(null);
+            filesMock.when(() -> Files.write(any(Path.class), any(byte[].class))).thenReturn(null);
+
+            Document result = documentService.uploadDocument(
+                    clubId, "Path Traversal Test", DocumentCategory.SONSTIGES,
+                    DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
+
+            assertThat(result.getFilename()).isEqualTo("passwd");
+        }
+    }
+
+    @Test
+    void testUploadDocument_nullFilename_usesFallback() throws IOException {
+        MultipartFile file = mockValidFile(null, "application/pdf", 512);
+        when(documentRepository.save(any(Document.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        try (MockedStatic<Files> filesMock = mockStatic(Files.class)) {
+            filesMock.when(() -> Files.createDirectories(any(Path.class))).thenReturn(null);
+            filesMock.when(() -> Files.write(any(Path.class), any(byte[].class))).thenReturn(null);
+
+            Document result = documentService.uploadDocument(
+                    clubId, "Null Filename", DocumentCategory.SONSTIGES,
+                    DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
+
+            // Null filename should produce a non-blank fallback (UUID)
+            assertThat(result.getFilename()).isNotBlank();
+            assertThat(result.getFilename()).doesNotContain("..");
+            assertThat(result.getFilename()).doesNotContain("/");
+        }
+    }
+
+    @Test
+    void testUploadDocument_normalFilename_preserved() throws IOException {
+        MultipartFile file = mockValidFile("report.pdf", "application/pdf", 1024);
+        when(documentRepository.save(any(Document.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        try (MockedStatic<Files> filesMock = mockStatic(Files.class)) {
+            filesMock.when(() -> Files.createDirectories(any(Path.class))).thenReturn(null);
+            filesMock.when(() -> Files.write(any(Path.class), any(byte[].class))).thenReturn(null);
+
+            Document result = documentService.uploadDocument(
+                    clubId, "Normal File", DocumentCategory.PROTOKOLL,
+                    DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
+
+            assertThat(result.getFilename()).isEqualTo("report.pdf");
+        }
+    }
+
+    @Test
+    void testDownloadDocument_documentNotFound_throwsException() {
+        UUID nonExistentId = UUID.randomUUID();
+        when(documentRepository.findById(nonExistentId)).thenReturn(Optional.empty());
+
+        assertThatThrownBy(() -> documentService.downloadDocument(nonExistentId))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not found");
+    }
+
+    @Test
+    void testDeleteDocument_documentNotFound_throwsException() {
+        UUID nonExistentId = UUID.randomUUID();
+        when(documentRepository.findById(nonExistentId)).thenReturn(Optional.empty());
+
+        assertThatThrownBy(() -> documentService.deleteDocument(nonExistentId, uploadedBy, clubId))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not found");
+    }
+
     // --- Helpers ---
 
     private MultipartFile mockValidFile(String filename, String contentType, long size) {

cannamanage-service/src/test/java/de/cannamanage/service/EmailServiceTest.java

@@ -47,6 +47,6 @@ class EmailServiceTest {
         assertThatThrownBy(() ->
                 emailService.sendInviteEmail("fail@example.com", "Fail User", "Club", "token123"))
                 .isInstanceOf(RuntimeException.class)
-                .hasMessageContaining("Failed to send invite email");
+                .hasMessageContaining("Failed to send email");
     }
 }

docker-compose.truenas.yml

@@ -1,20 +1,54 @@
-# TrueNAS homelab override — replaces localhost with 192.168.188.119
+# TrueNAS homelab override — public hosting at https://cannamanage.plate-software.de
 # Applied on top of docker-compose.yml for the homelab deployment on TrueNAS.local.
-# Usage:
+#
-#   docker compose -f docker-compose.yml -f docker-compose.truenas.yml up -d --build
+# Topology (same proven chain as Gitea + InspectFlow):
+#   browser ──HTTPS──> IONOS Apache (82.165.206.45, TLS via acme.sh)
+#          ──ProxyPass──> VPS frps (85.214.154.199:30010)
+#          ──frp tunnel──> TrueNAS frpc ──> frontend:3000 (this stack)
+#   frontend proxies /api/backend/* to backend:8080 via the server-side
+#   Route Handler (src/app/api/backend/[...path]/route.ts), so only the
+#   frontend port needs to be tunnelled — no separate API exposure.
+#
+# Usage (run by the Gitea act_runner on push to main):
+#   docker compose -f docker-compose.yml -f docker-compose.truenas.yml \
+#     -p cannamanage up -d --build --remove-orphans
 services:
+  db:
+    # Internal-only: drop the host :5432 publish inherited from docker-compose.yml.
+    # Postgres must not be exposed to the LAN. The backend reaches it over the
+    # compose network (db:5432) and the deploy's ALTER USER reconcile uses
+    # `docker exec`, so no published host port is needed. (!override [] replaces
+    # the inherited ports list — compose otherwise concatenates lists.)
+    ports: !override []
+    # POSTGRES_PASSWORD only takes effect on FIRST volume init; the existing
+    # cannamanage_pgdata volume keeps its current role password. The live role
+    # password is rotated out-of-band via `ALTER USER` to match ${DB_PASSWORD}.
+    # This value is here so a fresh volume initialises with the prod password.
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-cannamanage_dev}
+
   backend:
     # Host port 8080 is taken by odysseus-searxng-1; remap to 8081.
     # !override replaces the inherited ports list (compose merges lists by concat otherwise).
     # Internal container port stays 8080 so frontend's BACKEND_URL=http://backend:8080 is unaffected.
     ports: !override
       - "8081:8080"
+    environment:
+      # Real production password (must match the live DB role, see ALTER USER above).
+      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD:-cannamanage_dev}
+      # Rotated production JWT signing key (base64 — JwtService base64-decodes it).
+      # Rotating this invalidates all previously issued access/refresh tokens.
+      CANNAMANAGE_SECURITY_JWT_SECRET: ${JWT_SECRET}
 
   frontend:
     environment:
-      NEXTAUTH_URL: http://192.168.188.119:3000
+      # Public origin so NextAuth callbacks/cookies resolve to the HTTPS host.
-      AUTH_URL: http://192.168.188.119:3000
+      NEXTAUTH_URL: https://cannamanage.plate-software.de
-      # NextAuth v5 (Auth.js) reads AUTH_SECRET, not NEXTAUTH_SECRET. Without it at
+      AUTH_URL: https://cannamanage.plate-software.de
-      # runtime, signIn throws MissingSecret -> the app error boundary shows 'Oops'.
+      # NextAuth v5 (Auth.js) reads AUTH_SECRET. Rotating it invalidates sessions.
-      AUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+      AUTH_SECRET: ${AUTH_SECRET}
+      # Trust the X-Forwarded-* headers from the Apache/frp chain (we terminate
+      # TLS upstream and proxy plain HTTP into the container).
       AUTH_TRUST_HOST: "true"
+      # Server-side proxy target for /api/backend/* (internal compose DNS).
+      BACKEND_URL: http://backend:8080

docker-compose.yml

@@ -27,11 +27,11 @@ services:
       SPRING_PROFILES_ACTIVE: docker
       SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/cannamanage
       SPRING_DATASOURCE_USERNAME: cannamanage
-      SPRING_DATASOURCE_PASSWORD: cannamanage_dev
+      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD:-cannamanage_dev}
       # JwtService base64-decodes this secret (Decoders.BASE64.decode) before using it as the
       # HMAC-SHA key. It MUST be valid base64 — a plaintext string with hyphens throws
       # "Illegal base64 character: '-'" at token-signing time (HTTP 500 after a successful login).
-      CANNAMANAGE_SECURITY_JWT_SECRET: hmSULRhmFYcOXDwYxb7bGXp7Bovh+hXgua/VqF44Ts/N+8YELWpWiqQ+aLrymCuM
+      CANNAMANAGE_SECURITY_JWT_SECRET: ${JWT_SECRET:-dGhpcy1pcy1hLWRldi1vbmx5LXNlY3JldC1kby1ub3QtdXNlLWluLXByb2R1Y3Rpb24=}
     depends_on:
       db:
         condition: service_healthy
@@ -51,7 +51,7 @@ services:
       - "3000:3000"
     environment:
       NEXTAUTH_URL: http://localhost:3000
-      NEXTAUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-dev-only-nextauth-secret-do-not-use-in-production-min32}
       BACKEND_URL: http://backend:8080
       AUTH_URL: http://localhost:3000
     depends_on:

docs/ci-cd-review.md

@@ -0,0 +1,257 @@
+# CI/CD Infrastructure Review — CannaManage
+
+**Date:** 2026-06-19
+**Reviewer:** Lumen (Code + Security)
+**Scope:** `.gitea/workflows/ci.yml`, `.gitea/workflows/deploy.yml`, `Dockerfile.backend`, `docker-compose*.yml`, `.snyk`
+**Verdict:** ⚠️ Approved with findings — 2 High, 4 Medium, 3 Low
+
+---
+
+## 1. Architecture Overview
+
+```
+Push to main
+  ├── CI Pipeline (ci.yml)
+  │   ├── backend (compile + test + OWASP SCA)     ─┐
+  │   ├── frontend (lint + type-check + pnpm audit) ─┼── parallel
+  │   ├── secrets-scan (Gitleaks)                   ─┘
+  │   └── image-scan (Trivy) ── needs: [backend, frontend]
+  │
+  └── Deploy Pipeline (deploy.yml)
+      └── docker compose build + up + healthcheck
+```
+
+**Good:** CI jobs are already parallelized. `concurrency` prevents redundant runs. `cancel-in-progress: true` on CI is correct (abort stale runs). `cancel-in-progress: false` on deploy prevents interrupted deployments.
+
+---
+
+## 2. Security Findings
+
+### ❌ HIGH — S-01: Hardcoded JWT Secret in docker-compose.yml
+
+**File:** `docker-compose.yml:34`
+```yaml
+CANNAMANAGE_SECURITY_JWT_SECRET: hmSULRhmFYcOXDwYxb7bGXp7Bovh+hXgua/VqF44Ts/N+8YELWpWiqQ+aLrymCuM
+```
+
+**Risk:** This base64-encoded HMAC key is committed to git. Anyone with repo access can forge valid JWTs. If this key is the same as production, it's a full auth bypass.
+
+**Mitigation:**
+- Replace with `${JWT_SECRET}` and use `.env` file (gitignored) for local dev
+- Alternatively, generate a random key at container startup for dev-only:
+  ```yaml
+  CANNAMANAGE_SECURITY_JWT_SECRET: ${JWT_SECRET:-$(openssl rand -base64 48)}
+  ```
+- Verify that production (`docker-compose.prod.yml`) uses env vars ✅ — it does use `${JWT_SECRET}`
+
+**Accepted Risk?** If this is intentionally a dev-only secret different from production, document it in `.snyk` and add a comment. Gitleaks *should* flag this — check if it's being suppressed.
+
+---
+
+### ❌ HIGH — S-02: Hardcoded NextAuth Secret in docker-compose.yml
+
+**File:** `docker-compose.yml:54` and `docker-compose.truenas.yml:19`
+```yaml
+NEXTAUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+AUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+```
+
+**Risk:** Same as S-01. If this secret is reused on the TrueNAS deployment (which is internet-accessible via `cannamanage.plate-software.de`), session cookies can be forged.
+
+**Mitigation:**
+- `docker-compose.truenas.yml` should reference `${AUTH_SECRET}` from an env file
+- The word "dev" in the value suggests it's dev-only, but TrueNAS *is* the production host per `deploy.yml`
+
+---
+
+### ⚠️ MEDIUM — S-03: OWASP Dependency-Check Always Passes (|| true)
+
+**File:** `ci.yml:44`
+```yaml
+run: |
+  ./mvnw org.owasp:dependency-check-maven:check \
+    ... || true
+```
+
+**Risk:** The `|| true` means the step NEVER fails the build, regardless of CVSS score. The `failBuildOnCVSS=7` flag is effectively useless.
+
+**Mitigation:** Remove `|| true`. If you need to allow known issues, use the suppression file that's already configured (`-DsuppressionFile=.snyk-maven-suppressions.xml`).
+
+---
+
+### ⚠️ MEDIUM — S-04: Gitleaks Non-Blocking (echo instead of exit)
+
+**File:** `ci.yml:168`
+```yaml
+gitleaks detect ... --exit-code 1 \
+  || echo "::error::Gitleaks found potential secrets in the repository"
+```
+
+**Risk:** `--exit-code 1` should fail the step, but the `||` fallback to `echo` means the step always succeeds. Secrets can be pushed without blocking the pipeline.
+
+**Mitigation:** Remove the `|| echo` fallback. Let Gitleaks fail the build:
+```yaml
+run: gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 1
+```
+
+---
+
+### ⚠️ MEDIUM — S-05: pnpm audit Non-Blocking
+
+**File:** `ci.yml:83`
+```yaml
+pnpm audit --audit-level=high || echo "::warning::pnpm audit found vulnerabilities"
+```
+
+**Risk:** High/Critical frontend CVEs produce a warning but don't fail the build.
+
+**Mitigation:** Remove `|| echo ...` to make High/Critical CVEs block the pipeline. Use `.snyk` or `pnpm audit --ignore-path` for documented exceptions.
+
+---
+
+### ⚠️ MEDIUM — S-06: Parallel Docker Build Race Condition
+
+**File:** `ci.yml:96-99`
+```yaml
+docker build -t cannamanage-backend:scan -f Dockerfile.backend . &
+docker build -t cannamanage-frontend:scan -f cannamanage-frontend/Dockerfile cannamanage-frontend/ &
+wait
+```
+
+**Risk:** If either `docker build` fails, `wait` returns the exit code of the *last* process that exited, not the first failure. One image could fail silently while the other succeeds.
+
+**Mitigation:** Use `set -euo pipefail` and capture PIDs:
+```yaml
+run: |
+  set -euo pipefail
+  docker build -t cannamanage-backend:scan -f Dockerfile.backend . &
+  PID1=$!
+  docker build -t cannamanage-frontend:scan -f cannamanage-frontend/Dockerfile cannamanage-frontend/ &
+  PID2=$!
+  wait $PID1 $PID2
+```
+With `wait $PID1 $PID2`, if either fails, the step fails.
+
+---
+
+### ℹ️ LOW — S-07: Trivy Uses curl|sh Install Pattern
+
+**File:** `ci.yml:103`
+```yaml
+curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+```
+
+**Risk:** Supply-chain risk — if the upstream script is compromised, arbitrary code runs in CI. Using `main` branch means no version pinning.
+
+**Mitigation:** Pin to a specific version tag or commit hash, or use the official Trivy GitHub Action:
+```yaml
+- uses: aquasecurity/trivy-action@v0.28.0
+  with:
+    image-ref: cannamanage-backend:scan
+    severity: HIGH,CRITICAL
+    exit-code: 1
+```
+
+---
+
+### ℹ️ LOW — S-08: Deploy Workflow Uses Hardcoded IP
+
+**File:** `deploy.yml:60, 74`
+```yaml
+wget -q -O /dev/null http://192.168.188.119:8081/actuator/health
+```
+
+**Risk:** Low — private IP only reachable on LAN. But if the TrueNAS IP changes (DHCP), deploy silently breaks.
+
+**Mitigation:** Use `localhost` or a DNS name (e.g., `truenas.local`) instead. Or use container-internal checks via `docker compose exec`.
+
+---
+
+### ℹ️ LOW — S-09: No Image Signing or SBOM
+
+**Risk:** Docker images are built and deployed without signatures or Software Bill of Materials. Can't verify image integrity post-deployment.
+
+**Mitigation (future):** Add `docker sbom` or `syft` for SBOM generation. Consider `cosign` for image signing when maturing to multi-env deployments.
+
+---
+
+## 3. Code Quality Findings
+
+### CI Workflow (ci.yml)
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | Jobs parallelized | ✅ | backend, frontend, secrets-scan run concurrently |
+| 2 | Concurrency control | ✅ | Group + cancel-in-progress |
+| 3 | Maven caching | ✅ | `cache: maven` in setup-java |
+| 4 | Maven `-T 1C` | ✅ | Multi-threaded reactor (just added) |
+| 5 | Surefire forkCount | ✅ | `forkCount=2` in parent POM |
+| 6 | Artifact upload | ✅ | Reports preserved on failure (`if: always()`) |
+| 7 | Frontend lockfile | ✅ | `--frozen-lockfile` prevents silent dep changes |
+| 8 | Trivy ignore-unfixed | ✅ | Only actionable vulns fail the build |
+| 9 | Security gates blocking | ❌ | All 3 security tools use `|| true/echo` fallbacks |
+| 10 | Docker parallel build | ⚠️ | Race condition on failure (see S-06) |
+
+### Deploy Workflow (deploy.yml)
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | No test step | ⚠️ | Comment says "tests remain local-only gate" — acceptable for self-hosted |
+| 2 | Health checks | ✅ | 20 retries × 6s for backend, 10 × 5s for frontend |
+| 3 | Image pruning | ✅ | Prevents disk exhaustion |
+| 4 | `set -euo pipefail` | ✅ | Fail-fast on errors |
+| 5 | Concurrency non-cancelling | ✅ | Prevents interrupted deploys |
+
+### Dockerfile.backend
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | Multi-stage build | ✅ | Builder + runtime stages |
+| 2 | Non-root user | ✅ | `appuser` in runtime |
+| 3 | Alpine base | ✅ | Minimal attack surface |
+| 4 | Layer caching | ✅ | POMs copied before source |
+| 5 | No HEALTHCHECK | ⚠️ | Compose defines it, but image itself has no HEALTHCHECK |
+| 6 | `dependency:go-offline` | ✅ | Pre-downloads deps for cache |
+| 7 | No COPY of secrets | ✅ | No .env or keys copied |
+
+### Docker Compose Files
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | Production uses env vars | ✅ | `docker-compose.prod.yml` uses `${...}` |
+| 2 | Resource limits (prod) | ✅ | Memory/CPU limits set |
+| 3 | Log rotation (prod) | ✅ | `json-file` driver with max-size |
+| 4 | Dev compose has secrets | ❌ | S-01, S-02 — hardcoded in plain text |
+| 5 | Postgres healthcheck | ✅ | `pg_isready` |
+| 6 | Service dependencies | ✅ | `condition: service_healthy` |
+| 7 | Prod binds 127.0.0.1 only | ✅ | Prevents external access without reverse proxy |
+| 8 | Dev binds 0.0.0.0 | ⚠️ | `ports: "8080:8080"` is all-interfaces |
+
+---
+
+## 4. Snyk Policy (.snyk)
+
+✅ **Well-structured.** CSRF ignore is correctly scoped to the JWT API filter chain with clear rationale and expiry date. No concerns.
+
+---
+
+## 5. Recommendations (Priority Order)
+
+| Priority | Finding | Action |
+|----------|---------|--------|
+| 🔴 High | S-01, S-02 | Move secrets to `.env` (gitignored) or generate at runtime |
+| 🟡 Medium | S-03, S-04, S-05 | Remove `|| true` / `|| echo` from security tools — make them blocking |
+| 🟡 Medium | S-06 | Fix parallel Docker build error propagation |
+| 🟢 Low | S-07 | Pin Trivy version or use official action |
+| 🟢 Low | S-08 | Replace hardcoded IP with DNS/localhost |
+| 🟢 Low | S-09 | Add SBOM generation (future) |
+
+---
+
+## 6. Summary
+
+The CI/CD setup is **architecturally sound** — parallel jobs, proper caching, multi-stage Docker builds, non-root containers, and comprehensive security scanning (OWASP, Trivy, Gitleaks, pnpm audit). 
+
+The main weakness is that **all security gates are non-blocking** (`|| true` everywhere), which means the scanning tools generate reports but never actually prevent a vulnerable build from deploying. This is the single most impactful fix: remove the fallbacks and let CVEs/secrets block the pipeline.
+
+The hardcoded secrets in `docker-compose.yml` are a moderate risk — they're clearly dev-only values different from production, but the TrueNAS deployment (which is internet-facing) reuses the same NEXTAUTH_SECRET, which should be fixed.

docs/sprint-13/cannamanage-sprint13-analysis.md

@@ -0,0 +1,139 @@
+# Analysis: Sprint 13 — Production Hardening
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v1
+**Sprint Theme:** Production Hardening & Housekeeping
+
+---
+
+## 1. Problem Analysis
+
+CannaManage has completed 12 sprints of feature development and is functionally complete for MVP. However, a comprehensive security review (2026-06-15) identified **4 production-blocking vulnerabilities** that prevent deployment. Additionally, backend test coverage sits at ~12% (20 tests for 29K LOC), the CI/CD pipeline deploys without running tests, and various repo hygiene issues remain unaddressed.
+
+Sprint 13 is a **hardening sprint** — no new features, purely focused on making the existing codebase production-ready.
+
+### Source Documents
+
+- [`docs/security-code-review-final.md`](docs/security-code-review-final.md) — Full security review with 4 BLOCKERs
+- [`docs/sprint-12/SPRINT-12-SUMMARY.md`](docs/sprint-12/SPRINT-12-SUMMARY.md) — Sprint 12 outcome (test infra delivered)
+- [`.gitea/workflows/deploy.yml`](.gitea/workflows/deploy.yml) — Current CI/CD pipeline (no tests)
+
+---
+
+## 2. Affected Components
+
+| Component | Path | Issue |
+|-----------|------|-------|
+| DocumentController | `cannamanage-api/src/main/java/de/cannamanage/api/controller/DocumentController.java` | IDOR — no tenant check on download/delete |
+| DocumentService | `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java` | Path traversal via unsanitized filename |
+| SecurityConfig | `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java` | Missing `/api/v1/documents/**` matchers, CORS hardcoded |
+| deploy.yml | `.gitea/workflows/deploy.yml` | Deploys without running tests |
+| package.json | `cannamanage-frontend/package.json` | Wrong project name ("shadboard-nextjs-starter-kit") |
+| cannamanage-domain | `cannamanage-domain/src/` | 0 unit tests |
+| cannamanage-service | `cannamanage-service/src/` | Low test coverage on service layer |
+
+---
+
+## 3. Current State (Ist-Zustand)
+
+### Security Posture
+
+The security review gave a **CONDITIONAL PASS** — architecture is solid (multi-tenant via `AbstractTenantEntity`, BCrypt+SHA-256, RFC 9457 errors, GoBD append-only audit) but 4 specific issues block go-live:
+
+| # | Blocker | Severity | Status Since |
+|---|---------|----------|-------------|
+| 1 | IDOR in DocumentController (download by raw UUID, no tenant verify) | HIGH | Sprint 9 (unfixed) |
+| 2 | Path traversal in DocumentService (`file.getOriginalFilename()` unsanitized) | HIGH | Sprint 9 (unfixed) |
+| 3 | JWT dev-secret fallback | HIGH | **FIXED** — `application.properties` now uses fail-on-startup marker |
+| 4 | `/api/v1/documents/**` missing from SecurityConfig matchers | HIGH | Sprint 9 (unfixed) |
+
+**Note:** Blocker #3 is already resolved. The current `application.properties:13` reads:
+```
+cannamanage.security.jwt.secret=${CANNAMANAGE_SECURITY_JWT_SECRET:CHANGE_ME_IN_PRODUCTION_THIS_WILL_FAIL_ON_STARTUP}
+```
+The `JwtService.validateSecret()` detects this marker and refuses startup. This leaves **3 active blockers**.
+
+### CI/CD Pipeline
+
+The current [`.gitea/workflows/deploy.yml`](.gitea/workflows/deploy.yml:17) triggers on push to `main` and:
+1. ✅ Checks out the commit
+2. ✅ Builds Docker images
+3. ✅ Deploys with `docker compose up -d`
+4. ✅ Checks backend health (actuator)
+5. ⚠️ Frontend check is non-blocking (doesn't fail the job)
+6. ❌ **No tests run at all** — neither backend (Maven) nor frontend (Vitest/Playwright)
+
+### Test Coverage
+
+- **Backend:** ~20 tests across cannamanage-api (GlobalExceptionHandlerTest, some controller tests). cannamanage-domain and cannamanage-service have minimal or zero coverage.
+- **Frontend:** Playwright integration specs (70+ tests) exist but are never run in CI. No Vitest unit tests in CI either.
+- **Sprint 12** delivered the Docker Compose test infrastructure (`docker-compose.test.yml`) — it's ready to be wired into CI.
+
+### Repo Hygiene
+
+| Issue | Location | Impact |
+|-------|----------|--------|
+| Wrong project name | `cannamanage-frontend/package.json` → `"name": "shadboard-nextjs-starter-kit"` | Confusing, unprofessional |
+| Dead `.github/` folder | `.github/modernize/` | GitHub-specific, project uses Gitea |
+| No root README | `.` | No project documentation for new contributors |
+| Leftover screenshot scripts | `cannamanage-frontend/*.mjs` | Dev clutter (gitignored PNGs, but scripts committed) |
+| SonarQube findings | 7 MAJOR/MINOR issues | Dead fields, generic exceptions, string duplication |
+
+---
+
+## 4. Risk Assessment
+
+| Risk | Probability | Impact | Mitigation |
+|------|-------------|--------|------------|
+| Document data leak via IDOR | High (any authenticated user) | Critical (DSGVO breach, multi-tenant violation) | Fix #1: Add tenant verification to DocumentController |
+| Arbitrary file write via path traversal | Medium (requires auth + upload permission) | High (server compromise) | Fix #2: Sanitize with `FilenameUtils.getName()` |
+| Broken deployment from untested code | Medium (no test gate) | High (production outage) | Add test step to deploy.yml |
+| Low test confidence for future changes | Ongoing | Medium (regression risk) | Expand backend test suite |
+
+---
+
+## 5. Solution Options
+
+### Option A: Minimal Security Fix Only (2-3 hours)
+- Fix 3 remaining security blockers
+- No CI/CD changes, no test expansion, no cleanup
+- **Pro:** Fastest path to unblock deployment
+- **Con:** Leaves test debt and CI risk intact; next feature sprint can introduce regressions
+
+### Option B: Security + CI Quality Gate (4-6 hours)
+- Fix 3 security blockers
+- Add Maven test + Playwright test steps to CI
+- Basic repo cleanup (package.json, README)
+- **Pro:** Production-safe deployment pipeline, reasonable effort
+- **Con:** Test coverage still low for service/domain layer
+
+### Option C: Full Hardening Sprint (8-12 hours) ⬅️ RECOMMENDED
+- Fix 3 security blockers
+- Expand backend test suite (target: DocumentService, AuthService, key service methods)
+- Wire tests into CI/CD pipeline (fail-fast on test failure)
+- CORS configuration externalization
+- Login rate limiting
+- Complete repo cleanup (README, package.json, dead files, SonarQube fixes)
+- **Pro:** Production-ready with confidence, clean repo, future-proof
+- **Con:** Full sprint investment (no new features)
+
+---
+
+## 6. Recommendation
+
+**Option C** — This is the right time for a full hardening sprint. The project is feature-complete for MVP, Sprint 12 already built the test infrastructure, and the security blockers have been unfixed since Sprint 9. A half-measure (Option A/B) would leave known technical debt that compounds with every future sprint.
+
+Priority ordering:
+1. **Security fixes** (unblocks production) — ~2 hours
+2. **CI test gate** (prevents future regressions) — ~2 hours
+3. **Backend test expansion** (confidence for the security fixes themselves) — ~4 hours
+4. **Repo cleanup + CORS + rate limiting** (polish) — ~2 hours
+
+---
+
+## 7. Open Questions
+
+- [ ] Should CORS allowed origins come from `application.properties` or environment variables?
+- [ ] Login rate limiting: Bucket4j (Spring-native) or custom filter with in-memory counter?
+- [ ] Target test coverage % for this sprint? (Suggest: cover all security-critical paths = DocumentService, AuthService, TenantFilterAspect)

docs/sprint-13/cannamanage-sprint13-plan.md

@@ -0,0 +1,337 @@
+# Plan: Sprint 13 — Production Hardening
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v2 (panel review incorporated)
+**Basis:** cannamanage-sprint13-analysis.md
+
+---
+
+## Background
+
+Sprint 13 addresses 3 remaining production-blocking security vulnerabilities (1 was already fixed), wires the existing test infrastructure into CI/CD as a quality gate, expands backend test coverage for security-critical paths, and performs repo cleanup. No new features — pure hardening.
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                     Security Hardening Layer                      │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                   │
+│  SecurityConfig ──► Role matchers for /api/v1/documents/**       │
+│                                                                   │
+│  DocumentController ──► @PreAuthorize + tenant verification      │
+│                                                                   │
+│  DocumentService ──► FilenameUtils.getName() sanitization        │
+│                ──► Explicit clubId check on download/delete       │
+│                                                                   │
+├─────────────────────────────────────────────────────────────────┤
+│                     CI/CD Quality Gate                            │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                   │
+│  deploy.yml ──► [Checkout] → [Test Backend] → [Test Frontend]   │
+│             ──► [Build Images] → [Deploy] → [Health Check]       │
+│                                                                   │
+├─────────────────────────────────────────────────────────────────┤
+│                     Operational Hardening                         │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                   │
+│  CORS ──► Externalized via application.properties                │
+│  Rate Limiting ──► Bucket4j on /api/v1/auth/login                │
+│                                                                   │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Components
+
+| # | Component | Module | Action |
+|---|-----------|--------|--------|
+| 1 | DocumentController | cannamanage-api | Add `@PreAuthorize`, tenant verification |
+| 2 | DocumentService | cannamanage-service | Sanitize filename, add clubId check |
+| 3 | SecurityConfig | cannamanage-api | Add document endpoint matchers |
+| 4 | deploy.yml | .gitea/workflows | Add test steps before deployment |
+| 5 | DocumentServiceTest | cannamanage-service | New — comprehensive test class |
+| 6 | DocumentControllerTest | cannamanage-api | New — security-focused integration tests |
+| 7 | AuthServiceTest | cannamanage-api | New — auth flow tests |
+| 8 | SecurityConfig | cannamanage-api | Externalize CORS origins |
+| 9 | RateLimitFilter | cannamanage-api | New — login rate limiting |
+| 10 | package.json | cannamanage-frontend | Fix project name |
+| 11 | README.md | root | New — project documentation |
+
+---
+
+## Implementation Steps
+
+### Phase 1: Security Fixes (Priority: CRITICAL)
+
+#### Step 1.1 — Fix IDOR in DocumentController
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/controller/DocumentController.java`
+
+- Add `@PreAuthorize("hasAnyRole('ADMIN', 'STAFF', 'MEMBER')")` on class level
+- Inject `SecurityContextHolder` to extract current user's `clubId`
+- On `downloadDocument(UUID id)`: after fetching the document, verify `document.getClubId().equals(currentUser.getClubId())`
+- On `deleteDocument(UUID id)`: same tenant check + require `ADMIN` or `STAFF` role
+- Return `404 Not Found` if tenant mismatch — prevents object enumeration. An attacker should not be able to determine whether a document UUID exists in another tenant.
+
+**Prerequisite:** Verify that portal JWT tokens include the `clubId` claim. If portal tokens lack `clubId`, portal document downloads will 403. Check `PortalAuthService` / `JwtService` token generation to confirm the claim is present before implementing tenant verification.
+
+#### Step 1.2 — Fix Path Traversal in DocumentService
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java`
+
+- Replace `file.getOriginalFilename()` with `FilenameUtils.getName(file.getOriginalFilename())`
+- Add null check: if result is blank, use `"document"` as fallback
+- Add dependency on `commons-io` if not already present (it is — used by BankImportService)
+- Pattern: consistent with existing [`BankImportService`](cannamanage-service/src/main/java/de/cannamanage/service/bankimport/BankImportService.java) which already does this correctly
+
+#### Step 1.3 — Add Document Endpoint Matchers to SecurityConfig
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java`
+
+Add explicit matchers in `apiSecurityFilterChain()`:
+```java
+.requestMatchers(HttpMethod.GET, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
+.requestMatchers(HttpMethod.POST, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
+.requestMatchers(HttpMethod.DELETE, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
+```
+
+Place these BEFORE the `.anyRequest().authenticated()` catch-all.
+
+---
+
+### Phase 2: CI/CD Quality Gate (Priority: HIGH)
+
+#### Step 2.1 — Add Backend Test Step to deploy.yml
+
+**File:** `.gitea/workflows/deploy.yml`
+
+Insert a new step after checkout, before Docker build:
+```yaml
+- name: Run backend tests
+  run: |
+    set -euo pipefail
+    cd cannamanage-api
+    mvn test --batch-mode -f pom.xml
+```
+
+**Note:** Maven is available in the runner image. The Maven Wrapper (`mvnw`) is not committed to this repo.
+
+This runs all backend tests. If any test fails, the deploy is aborted.
+
+#### Step 2.2 — Add Frontend Lint/Type-Check Step
+
+**Prerequisite:** Add `"type-check": "tsc --noEmit"` to `cannamanage-frontend/package.json` scripts.
+
+Insert after backend tests:
+```yaml
+- name: Frontend type check
+  run: |
+    set -euo pipefail
+    cd cannamanage-frontend
+    corepack enable
+    pnpm install --frozen-lockfile
+    pnpm run lint
+    pnpm run type-check
+```
+
+**Note:** Full Playwright integration tests are too heavy for every push (require Docker-in-Docker). Keep those for manual/nightly runs via `docker-compose.test.yml`.
+
+#### Step 2.3 — Make Frontend Health Check Blocking
+
+**File:** `.gitea/workflows/deploy.yml`
+
+Change the frontend verify step to `exit 1` on failure instead of just logging a warning.
+
+---
+
+### Phase 3: Backend Test Expansion (Priority: HIGH)
+
+#### Step 3.1 — DocumentServiceTest (new)
+
+**File:** `cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java`
+
+Test cases:
+- `testUploadDocument_sanitizesFilename()` — verify path traversal attempt is neutralized
+- `testUploadDocument_nullFilename_usesFallback()` — null filename → "document"
+- `testUploadDocument_validFilename_preserved()` — normal filename passes through
+- `testDownloadDocument_wrongTenant_throwsForbidden()` — tenant isolation
+- `testDownloadDocument_correctTenant_returnsContent()` — happy path
+- `testDeleteDocument_wrongTenant_throwsForbidden()` — tenant isolation on delete
+- `testDeleteDocument_adminRole_succeeds()` — admin can delete
+
+#### Step 3.2 — DocumentControllerSecurityTest (new)
+
+**File:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerSecurityTest.java`
+
+Integration tests using `@WebMvcTest` + `@WithMockUser`:
+- `testDownload_unauthenticated_returns401()`
+- `testDownload_wrongTenant_returns403()`
+- `testDownload_correctTenant_returns200()`
+- `testDelete_memberRole_returns403()` — MEMBER cannot delete
+- `testDelete_staffRole_returns200()` — STAFF can delete
+- `testUpload_memberRole_returns403()` — MEMBER cannot upload
+- `testUpload_staffRole_returns200()`
+
+#### Step 3.3 — AuthServiceTest (new)
+
+**File:** `cannamanage-api/src/test/java/de/cannamanage/api/service/AuthServiceTest.java`
+
+- `testLogin_validCredentials_returnsTokenPair()`
+- `testLogin_invalidPassword_throws401()`
+- `testLogin_nonExistentUser_throws401()`
+- `testRefreshToken_validToken_returnsNewAccess()`
+- `testRefreshToken_expired_throws401()`
+- `testSha256_consistent()` — hashing determinism
+
+#### Step 3.4 — SecurityConfigTest (new)
+
+**File:** `cannamanage-api/src/test/java/de/cannamanage/api/security/SecurityConfigTest.java`
+
+Verify URL pattern matching:
+- `testDocumentEndpoints_requireAuthentication()`
+- `testAuthEndpoints_arePublic()`
+- `testActuatorHealth_isPublic()`
+
+---
+
+### Phase 4: Operational Hardening (Priority: MEDIUM)
+
+#### Step 4.1 — Externalize CORS Configuration
+
+**File:** `cannamanage-api/src/main/resources/application.properties`
+
+Add:
+```properties
+cannamanage.cors.allowed-origins=${CORS_ALLOWED_ORIGINS:http://localhost:3000}
+```
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java`
+
+Replace hardcoded origins with `@Value("${cannamanage.cors.allowed-origins}")` and split on comma.
+
+#### Step 4.2 — Login Rate Limiting
+
+Add Bucket4j dependency to `cannamanage-api/pom.xml`:
+```xml
+<dependency>
+    <groupId>com.bucket4j</groupId>
+    <artifactId>bucket4j-core</artifactId>
+    <version>8.10.1</version>
+</dependency>
+```
+
+Add Caffeine dependency to `cannamanage-api/pom.xml`:
+```xml
+<dependency>
+    <groupId>com.github.ben-manes.caffeine</groupId>
+    <artifactId>caffeine</artifactId>
+    <version>3.1.8</version>
+</dependency>
+```
+
+Create `cannamanage-api/src/main/java/de/cannamanage/api/security/LoginRateLimitFilter.java`:
+- Use Caffeine cache (TTL-based eviction) instead of raw ConcurrentHashMap
+- Key: IP address, Value: Bucket
+- Max entries: 10,000
+- TTL: 10 minutes (auto-evicts stale entries, prevents memory leak under DDoS)
+- Limit: 5 attempts per minute per IP
+- Applies only to `POST /api/v1/auth/login`
+- Returns `429 Too Many Requests` with `Retry-After` header when exceeded
+- Register in SecurityConfig filter chain
+
+---
+
+### Phase 5: Repo Cleanup (Priority: LOW)
+
+#### Step 5.1 — Fix package.json Project Name
+
+**File:** `cannamanage-frontend/package.json`
+
+Change `"name": "shadboard-nextjs-starter-kit"` → `"name": "cannamanage-frontend"`
+
+#### Step 5.2 — Remove Dead .github Directory
+
+```bash
+rm -rf .github/
+```
+
+Only if `.github/` contains GitHub-specific config (Actions, Dependabot) that doesn't apply to Gitea.
+
+#### Step 5.3 — Create Root README
+
+**File:** `README.md`
+
+Minimal project README: what it is, how to run locally, how to deploy, architecture overview.
+
+#### Step 5.4 — Clean Up Leftover Screenshot Scripts
+
+Remove one-shot `.mjs` scripts from `cannamanage-frontend/`:
+- `upload-dialog-screenshot.mjs`
+- `sprint12-final.mjs`
+- `sprint12-v2.mjs`
+
+These were development utilities, not part of the test suite.
+
+#### Step 5.5 — Fix SonarQube Findings
+
+Address 7 MAJOR/MINOR findings from the security review:
+- Remove unused `auditService` field in DocumentService (or wire it up for audit logging)
+- Replace generic `throw new Exception()` in Camt053Parser with specific exception
+- Replace generic `RuntimeException` in AuthService.sha256() with custom exception
+- Extract duplicated `"Invalid credentials"` string to constant
+- Fix static access via instance in Camt053Parser
+
+---
+
+## Dependency Order
+
+```
+Step 1.1 ──┐
+Step 1.2 ──┼──► Step 3.1 (tests verify the fixes)
+Step 1.3 ──┘         │
+                     ▼
+              Step 3.2 (controller security tests)
+                     │
+                     ▼
+              Step 2.1 (CI runs these tests)
+              Step 2.2
+              Step 2.3
+                     │
+                     ▼
+              Step 4.1, 4.2 (operational hardening)
+              Step 5.1–5.5 (cleanup, parallel)
+```
+
+---
+
+## Acceptance Criteria
+
+1. ✅ No authenticated user can download/delete documents from another tenant
+2. ✅ Path traversal filenames are sanitized before storage
+3. ✅ `/api/v1/documents/**` has explicit role matchers in SecurityConfig
+4. ✅ CI pipeline runs backend tests before deployment (fails on test failure)
+5. ✅ CI pipeline runs frontend lint + type-check before deployment
+6. ✅ At least 15 new backend tests covering security-critical paths
+7. ✅ CORS origins configurable via environment variable
+8. ✅ Login endpoint rate-limited (5 attempts/min/IP)
+9. ✅ `package.json` has correct project name
+10. ✅ Root README exists
+
+---
+
+## Estimated Effort
+
+| Phase | Effort | Cumulative |
+|-------|--------|------------|
+| Phase 1: Security Fixes | ~2h | 2h |
+| Phase 2: CI Quality Gate | ~1.5h | 3.5h |
+| Phase 3: Backend Tests | ~3h | 6.5h |
+| Phase 4: Operational Hardening | ~2h | 8.5h |
+| Phase 5: Repo Cleanup | ~1h | 9.5h |
+
+**Total: ~9.5 hours** (full sprint day)

docs/sprint-13/cannamanage-sprint13-testplan.md

@@ -0,0 +1,585 @@
+# Testplan: Sprint 13 — Production Hardening
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v1
+**Basis:** cannamanage-sprint13-plan.md
+
+---
+
+## Test Overview
+
+| ID | Description | Type | Class | Status |
+|----|-------------|------|-------|--------|
+| T-01 | Path traversal filename sanitization | Unit | `DocumentServiceTest` | ⬜ |
+| T-02 | Null filename fallback | Unit | `DocumentServiceTest` | ⬜ |
+| T-03 | Valid filename preserved | Unit | `DocumentServiceTest` | ⬜ |
+| T-04 | Download wrong tenant — forbidden | Unit | `DocumentServiceTest` | ⬜ |
+| T-05 | Download correct tenant — success | Unit | `DocumentServiceTest` | ⬜ |
+| T-06 | Delete wrong tenant — forbidden | Unit | `DocumentServiceTest` | ⬜ |
+| T-07 | Delete admin role — success | Unit | `DocumentServiceTest` | ⬜ |
+| T-08 | Download unauthenticated — 401 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-09 | Download wrong tenant — 403 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-10 | Download correct tenant — 200 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-11 | Delete as MEMBER — 403 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-12 | Delete as STAFF — 200 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-13 | Upload as MEMBER — 403 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-14 | Upload as STAFF — 200 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-15 | Login valid credentials — token pair | Unit | `AuthServiceTest` | ⬜ |
+| T-16 | Login invalid password — 401 | Unit | `AuthServiceTest` | ⬜ |
+| T-17 | Login non-existent user — 401 | Unit | `AuthServiceTest` | ⬜ |
+| T-18 | Refresh token valid — new access token | Unit | `AuthServiceTest` | ⬜ |
+| T-19 | Refresh token expired — 401 | Unit | `AuthServiceTest` | ⬜ |
+| T-20 | SHA-256 hashing deterministic | Unit | `AuthServiceTest` | ⬜ |
+| T-21 | Document endpoints require auth | Integration | `SecurityConfigTest` | ⬜ |
+| T-22 | Auth endpoints are public | Integration | `SecurityConfigTest` | ⬜ |
+| T-23 | Actuator health is public | Integration | `SecurityConfigTest` | ⬜ |
+| T-24 | CORS allows configured origin | Integration | `SecurityConfigTest` | ⬜ |
+| T-25 | CORS rejects unconfigured origin | Integration | `SecurityConfigTest` | ⬜ |
+| T-26 | Rate limit — 5 requests pass | Integration | `LoginRateLimitFilterTest` | ⬜ |
+| T-27 | Rate limit — 6th request returns 429 | Integration | `LoginRateLimitFilterTest` | ⬜ |
+| T-28 | Rate limit — different IPs independent | Integration | `LoginRateLimitFilterTest` | ⬜ |
+| T-29 | Rate limiter evicts stale entries (Caffeine TTL) | Unit | `LoginRateLimitFilterTest` | ⬜ |
+| T-30 | CI backend tests run on push | Manual | CI/CD verification | ⬜ |
+| T-31 | CI frontend lint runs on push | Manual | CI/CD verification | ⬜ |
+| T-32 | CI blocks deploy on test failure | Manual | CI/CD verification | ⬜ |
+
+Status: ⬜ Open | ✅ Passed | ❌ Failed | ⏭️ Skipped
+
+---
+
+## Test Cases
+
+### T-01: Path Traversal Filename Sanitization
+
+**Type:** Unit
+**Class:** `cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java`
+**Method:** `testUploadDocument_pathTraversalFilename_isSanitized()`
+
+**Preconditions:**
+- DocumentService instantiated with mocked dependencies
+- Mock file storage path configured
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `"../../etc/passwd.pdf"` | Stored as `passwd.pdf` (path components stripped) |
+| b | `"../../../tmp/evil.txt"` | Stored as `evil.txt` |
+| c | `"..\\..\\windows\\system32\\bad.exe"` | Stored as `bad.exe` (backslash traversal) |
+| d | `"normal-document.pdf"` | Stored as `normal-document.pdf` (unchanged) |
+
+**Postconditions:**
+- File is stored under `{UPLOAD_BASE}/{clubId}/{docId}_{sanitizedFilename}`
+- No path escapes the upload base directory
+
+---
+
+### T-02: Null Filename Fallback
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testUploadDocument_nullFilename_usesFallback()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `null` filename | Stored as `"document"` |
+| b | Empty string `""` | Stored as `"document"` |
+| c | Whitespace only `"   "` | Stored as `"document"` |
+
+---
+
+### T-03: Valid Filename Preserved
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testUploadDocument_validFilename_preserved()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `"meeting-notes-2026.pdf"` | Stored as-is |
+| b | `"Mitgliederversammlung Protokoll.docx"` | Stored as-is (spaces allowed) |
+| c | `"report_v2.1_final.xlsx"` | Stored as-is (dots and underscores) |
+
+---
+
+### T-04: Download Wrong Tenant — Forbidden
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDownloadDocument_wrongTenant_throwsForbidden()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user's tenant context = `"club-B"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Request document by UUID belonging to different club | `AccessDeniedException` thrown |
+
+**Postconditions:**
+- No file content is returned
+- Audit log records the denied access attempt
+
+---
+
+### T-05: Download Correct Tenant — Success
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDownloadDocument_correctTenant_returnsContent()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user's tenant context = `"club-A"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Request document by valid UUID, same tenant | File bytes returned successfully |
+
+---
+
+### T-06: Delete Wrong Tenant — Forbidden
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDeleteDocument_wrongTenant_throwsForbidden()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user's tenant context = `"club-B"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Delete request for document in different club | `AccessDeniedException` thrown |
+
+**Postconditions:**
+- Document is NOT deleted
+- File remains on disk
+
+---
+
+### T-07: Delete Admin Role — Success
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDeleteDocument_adminRole_succeeds()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user: role `ADMIN`, tenant `"club-A"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Admin deletes own tenant's document | Document removed from DB + file system |
+
+---
+
+### T-08: Download Unauthenticated — 401
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerSecurityTest.java`
+**Method:** `testDownload_unauthenticated_returns401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | GET `/api/v1/documents/{id}/download` with no auth header | HTTP 401 |
+
+---
+
+### T-09: Download Wrong Tenant — 403
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDownload_wrongTenant_returns403()`
+
+**Preconditions:**
+- `@WithMockUser` configured for club-B
+- Document belongs to club-A
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Authenticated user requests document from different tenant | HTTP 403 |
+
+---
+
+### T-10: Download Correct Tenant — 200
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDownload_correctTenant_returns200()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Authenticated user downloads own tenant's document | HTTP 200 + file content |
+
+---
+
+### T-11: Delete as MEMBER — 403
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDelete_memberRole_returns403()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="MEMBER")` → DELETE `/api/v1/documents/{id}` | HTTP 403 |
+
+---
+
+### T-12: Delete as STAFF — 200
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDelete_staffRole_returns200()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="STAFF")` → DELETE `/api/v1/documents/{id}` | HTTP 200 or 204 |
+
+---
+
+### T-13: Upload as MEMBER — 403
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testUpload_memberRole_returns403()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="MEMBER")` → POST `/api/v1/documents` | HTTP 403 |
+
+---
+
+### T-14: Upload as STAFF — 200
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testUpload_staffRole_returns200()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="STAFF")` → POST `/api/v1/documents` with multipart file | HTTP 200 or 201 |
+
+---
+
+### T-15: Login Valid Credentials — Token Pair
+
+**Type:** Unit
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/service/AuthServiceTest.java`
+**Method:** `testLogin_validCredentials_returnsTokenPair()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Valid email + matching BCrypt password | Response contains `accessToken` (non-null, non-empty) + `refreshToken` |
+
+---
+
+### T-16: Login Invalid Password — 401
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testLogin_invalidPassword_throws401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Valid email + wrong password | Exception with 401 semantics |
+| b | Valid email + empty password | Exception with 401 semantics |
+
+---
+
+### T-17: Login Non-Existent User — 401
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testLogin_nonExistentUser_throws401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `unknown@example.com` + any password | Exception with 401 semantics |
+
+**Postconditions:**
+- Timing is consistent with valid-user path (prevent user enumeration)
+
+---
+
+### T-18: Refresh Token Valid — New Access Token
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testRefreshToken_validToken_returnsNewAccess()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Valid, non-expired refresh token | New access token returned, refresh token rotated |
+
+---
+
+### T-19: Refresh Token Expired — 401
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testRefreshToken_expired_throws401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Refresh token past expiry date | Exception with 401 semantics |
+| b | Token hash doesn't match stored hash | Exception with 401 semantics |
+
+---
+
+### T-20: SHA-256 Hashing Deterministic
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testSha256_sameInput_sameOutput()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `"test-token-123"` hashed twice | Both results are identical |
+| b | `"different-input"` | Different hash than input (a) |
+
+---
+
+### T-21: Document Endpoints Require Auth
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/security/SecurityConfigTest.java`
+**Method:** `testDocumentEndpoints_requireAuthentication()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | GET `/api/v1/documents` without auth | HTTP 401 |
+| b | POST `/api/v1/documents` without auth | HTTP 401 |
+| c | DELETE `/api/v1/documents/{id}` without auth | HTTP 401 |
+
+---
+
+### T-22: Auth Endpoints Are Public
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testAuthEndpoints_arePublic()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | POST `/api/v1/auth/login` without auth | HTTP 200 or 400 (not 401) |
+| b | POST `/api/v1/auth/register` without auth | HTTP 200 or 400 (not 401) |
+
+---
+
+### T-23: Actuator Health Is Public
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testActuatorHealth_isPublic()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | GET `/actuator/health` without auth | HTTP 200 |
+
+---
+
+### T-24: CORS Allows Configured Origin
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testCors_allowedOrigin_returns200()`
+
+**Preconditions:**
+- `cannamanage.cors.allowed-origins=http://localhost:3000,https://app.cannamanage.de`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `Origin: http://localhost:3000` | `Access-Control-Allow-Origin: http://localhost:3000` |
+| b | `Origin: https://app.cannamanage.de` | `Access-Control-Allow-Origin: https://app.cannamanage.de` |
+
+---
+
+### T-25: CORS Rejects Unconfigured Origin
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testCors_unconfiguredOrigin_noHeader()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `Origin: https://evil.com` | No `Access-Control-Allow-Origin` header in response |
+
+---
+
+### T-26: Rate Limit — 5 Requests Pass
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/security/LoginRateLimitFilterTest.java`
+**Method:** `testRateLimit_5requests_allPass()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | 5 POST requests to `/api/v1/auth/login` from same IP within 1 minute | All return normal response (200 or 401) |
+
+---
+
+### T-27: Rate Limit — 6th Request Returns 429
+
+**Type:** Integration
+**Class:** `LoginRateLimitFilterTest`
+**Method:** `testRateLimit_6thRequest_returns429()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | 6th POST to `/api/v1/auth/login` from same IP within 1 minute | HTTP 429 + `Retry-After` header |
+
+---
+
+### T-28: Rate Limit — Different IPs Independent
+
+**Type:** Integration
+**Class:** `LoginRateLimitFilterTest`
+**Method:** `testRateLimit_differentIPs_independent()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | 5 requests from IP-A, then 1 request from IP-B | IP-B request passes normally |
+
+---
+
+### T-29: Rate Limiter Evicts Stale Entries (Caffeine TTL)
+
+**Type:** Unit
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/security/LoginRateLimitFilterTest.java`
+**Method:** `testRateLimiter_evictsStaleEntries()`
+
+**Preconditions:**
+- Caffeine cache configured with short TTL for testing (override via `@TestPropertySource` or direct instantiation)
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Exhaust 5 attempts from IP-A, wait for TTL to expire, then attempt again | Request passes (bucket evicted and recreated) |
+| b | Verify cache size does not grow unbounded after many unique IPs | Cache respects `maximumSize(10_000)` — old entries evicted |
+
+**Postconditions:**
+- No memory leak under simulated DDoS (many unique IPs)
+- Stale rate limit buckets are automatically cleaned up
+
+---
+
+### T-30: CI Backend Tests Run on Push
+
+**Type:** Manual
+**Verification:** Push a commit to `main`, verify Gitea Actions log shows Maven test step executing.
+
+---
+
+### T-31: CI Frontend Lint Runs on Push
+
+**Type:** Manual
+**Verification:** Push a commit to `main`, verify Gitea Actions log shows pnpm lint + type-check step executing.
+
+---
+
+### T-32: CI Blocks Deploy on Test Failure
+
+**Type:** Manual
+**Verification:** Introduce a deliberately failing test, push to `main`, verify deployment does NOT proceed and the workflow fails at the test step.
+
+---
+
+## Test Data
+
+### Documents Test Fixtures
+- Club A: UUID `"11111111-1111-1111-1111-111111111111"`, document with known UUID
+- Club B: UUID `"22222222-2222-2222-2222-222222222222"`, separate document
+
+### Auth Test Fixtures
+- Valid user: `"test@example.com"`, BCrypt password hash of `"TestPass123!"`
+- Non-existent user: `"ghost@example.com"`
+
+### Rate Limit Test Setup
+- Use `MockHttpServletRequest` with different `remoteAddr` values to simulate multiple IPs
+
+---
+
+## Test Coverage
+
+| Component | Unit | Integration | Manual | Total |
+|-----------|------|-------------|--------|-------|
+| DocumentService | 7 | 0 | 0 | 7 |
+| DocumentController | 0 | 7 | 0 | 7 |
+| AuthService | 6 | 0 | 0 | 6 |
+| SecurityConfig | 0 | 5 | 0 | 5 |
+| LoginRateLimitFilter | 1 | 3 | 0 | 4 |
+| CI/CD Pipeline | 0 | 0 | 3 | 3 |
+| **Total** | **14** | **15** | **3** | **32** |
+
+---
+
+## Execution Order
+
+1. Run unit tests first (T-01 through T-07, T-15 through T-20, T-29) — fast, no Spring context
+2. Run integration tests (T-08 through T-14, T-21 through T-28) — require `@WebMvcTest` / `@SpringBootTest`
+3. Verify CI/CD manually (T-30 through T-32) — after all code is merged
+
+---
+
+## Pass Criteria
+
+- **All 29 automated tests (T-01 through T-29) must pass** before merging
+- **All 3 manual tests (T-30 through T-32) must pass** after CI changes are deployed
+- **Zero tolerance** on security tests (T-01 through T-14) — any failure is a blocker

docs/sprint-14/cannamanage-sprint14-analysis.md

@@ -0,0 +1,123 @@
+# Analysis: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v1
+**Sprint Theme:** Marketing & Monetization
+
+---
+
+## 1. Problem Analysis
+
+CannaManage is production-ready after Sprint 13's hardening. However, the public-facing marketing surfaces are minimal — there is no landing page (the root `/` currently serves the pricing page directly via the marketing layout), the login pages use a basic centered-card layout that doesn't communicate product value, and the pricing page lacks storage quota information which is a core monetization lever.
+
+Additionally, the backend has no concept of storage quotas per tenant. Documents can be uploaded without limit, creating an unbounded cost liability on the file storage (TrueNAS/disk). Sprint 14 introduces a **StorageQuotaService** that enforces per-plan limits, making the pricing tiers meaningful at the infrastructure level.
+
+### Sprint Goals
+
+1. **Landing Page** — Create a professional homepage that converts visitors to signups
+2. **Login Redesign** — Split-layout login pages that reinforce brand value during auth flow
+3. **Pricing Rework** — Add storage tier information, update pricing model
+4. **Storage Quota Backend** — Enforce plan-based storage limits on document uploads
+
+---
+
+## 2. Affected Components
+
+| Component | Path | Role |
+|-----------|------|------|
+| Marketing layout | `cannamanage-frontend/src/app/(marketing)/layout.tsx` | Shared header/footer for marketing pages |
+| Homepage (NEW) | `cannamanage-frontend/src/app/(marketing)/page.tsx` | Landing page — hero, features, trust signals |
+| Pricing page | `cannamanage-frontend/src/app/(marketing)/pricing/page.tsx` | Pricing cards with storage tiers |
+| Auth layout | `cannamanage-frontend/src/app/(auth)/layout.tsx` | Centered flex container for login |
+| Admin login | `cannamanage-frontend/src/app/(auth)/login/page.tsx` | Admin/staff login form |
+| Portal login | `cannamanage-frontend/src/app/(portal)/portal-login/page.tsx` | Member portal login form |
+| PlanTier enum | `cannamanage-domain/src/main/java/de/cannamanage/domain/enums/PlanTier.java` | TRIAL, STARTER, PRO, ENTERPRISE |
+| Club entity | `cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Club.java` | Needs `storageUsedBytes` field |
+| Document entity | `cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Document.java` | Has `fileSize` field — source of truth for usage |
+| DocumentService | `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java` | Upload logic — needs quota check |
+| StorageQuotaService (NEW) | `cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java` | Quota calculation and enforcement |
+| StorageController (NEW) | `cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java` | REST endpoint for storage usage |
+| Flyway V36 (NEW) | `cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql` | Add storage tracking column |
+| i18n messages | `cannamanage-frontend/src/messages/de.json` | New keys for landing page, pricing storage |
+| Documents frontend service | `cannamanage-frontend/src/services/documents.ts` | Needs quota-exceeded error handling |
+
+---
+
+## 3. Current State (Ist-Zustand)
+
+### Marketing Pages
+
+- **No landing page** exists at `(marketing)/page.tsx` — the root `/` route likely falls through or shows a 404
+- **Pricing page** has 3 tiers (Starter €19, Pro €49, Enterprise) with member limits and feature lists, but **no storage information**
+- **Marketing layout** has a sticky header with logo + "Preise" + "Anmelden" links, and a footer with Produkt/Rechtliches columns
+- Navigation text is hardcoded German (not i18n) in the layout
+
+### Login Pages
+
+- **Auth layout** is a minimal centered flex container: `fixed inset-0 z-50 flex items-center justify-center`
+- **Admin login** renders a centered card with logo, email/password form, forgot password link, and portal link
+- **Portal login** is nearly identical but uses portal-specific translations and mock auth
+- Both pages use the same visual pattern — no split-layout, no brand messaging during auth
+
+### Storage Backend
+
+- **Document entity** already tracks `fileSize` (Long) per file
+- **PlanTier enum** exists: TRIAL, STARTER, PRO, ENTERPRISE
+- **No storage quota concept** exists anywhere — no `storage_used_bytes` column, no quota checks on upload
+- **DocumentService** handles upload/download/delete but never checks cumulative storage
+- Latest Flyway migration: `V35__generated_reports_add_timestamps.sql`
+
+---
+
+## 4. Risk Assessment
+
+| Risk | Probability | Impact | Mitigation |
+|------|-------------|--------|------------|
+| Landing page doesn't convert (poor copy/design) | Medium | Medium (lost signups) | Follow proven SaaS landing page patterns; iterate based on analytics |
+| Storage quota breaks existing uploads | Low | High (data loss) | Implement as soft-limit first — warn but don't block for existing over-limit tenants |
+| i18n key explosion | Low | Low (maintenance) | Group new keys under `marketing.home`, `marketing.pricing.storage` namespaces |
+| Split login layout breaks on mobile | Medium | Medium (can't log in) | Mobile-first design: left panel hidden on `<md` breakpoints |
+| Quota calculation performance (SUM query) | Low | Medium (slow uploads) | Cache quota in `storage_used_bytes` column; recalculate on upload/delete |
+
+---
+
+## 5. Solution Options
+
+### Option A: Full Sprint — All 4 Areas (Recommended)
+
+- Landing page, login redesign, pricing update, storage quota backend
+- **Effort:** ~16-20 hours
+- **Pros:** Complete marketing+monetization story, enables public launch
+- **Cons:** Larger scope, more testing surface
+
+### Option B: Frontend Only — Landing + Login + Pricing (No Backend)
+
+- Skip StorageQuotaService, just update frontend
+- **Effort:** ~8-10 hours
+- **Pros:** Faster delivery, lower risk
+- **Cons:** Storage limits are marketing fiction without enforcement
+
+### Option C: Backend Only — Storage Quota (No Marketing)
+
+- Implement quota enforcement, defer marketing pages
+- **Effort:** ~6-8 hours
+- **Pros:** Real monetization enforcement
+- **Cons:** No user-facing marketing value, can't launch publicly
+
+---
+
+## 6. Recommendation
+
+**Option A** — the full sprint. The four areas are interdependent: the pricing page promises storage limits that the backend must enforce, and the landing page is the entry point that drives users to pricing. Login redesign is a low-risk polish pass that significantly improves first impressions.
+
+The storage quota backend should be designed as an **incremental counter** (update `storage_used_bytes` on upload/delete) rather than a `SUM` query on every upload — this keeps upload latency constant regardless of document count.
+
+---
+
+## 7. Open Questions
+
+- [ ] Should the landing page include a product screenshot/mockup, or is an illustration-based hero preferred?
+- [ ] For portal login left panel: show rotating testimonials, or static feature highlights?
+- [ ] Storage overage billing (€0.15/GB/mo for Pro) — is this just displayed in pricing, or should we build the actual billing integration now?
+- [ ] Free trial — is TRIAL tier (PlanTier enum already has it) time-limited? Should landing page mention trial duration?

docs/sprint-14/cannamanage-sprint14-code-review.md

@@ -0,0 +1,124 @@
+# Code Review: Sprint 14 — Marketing & Monetization
+
+**Datum:** 2026-06-18
+**Reviewer:** Roo (Reviewer)
+**Plan:** cannamanage-sprint14-plan.md v2
+**Testplan:** cannamanage-sprint14-testplan.md v2
+**Status:** ⚠️ Approved with comments
+
+---
+
+## Zusammenfassung
+
+Implementation is solid and complete for all 5 phases. All plan components are present, i18n is complete with full DE/EN parity, the backend quota enforcement chain is correctly wired end-to-end, and the frontend properly handles 402 responses. Two warnings identified — one security-relevant deviation from plan (StorageController auth pattern) and one missing planned component (SubscriptionService tier-change hook).
+
+## Geprüfte Dateien
+
+| Datei | Änderung | Bewertung |
+|-------|---------|-----------|
+| `cannamanage-frontend/src/app/(marketing)/page.tsx` | Neu | ✅ |
+| `cannamanage-frontend/src/app/(marketing)/marketing-layout-client.tsx` | Neu | ✅ |
+| `cannamanage-frontend/src/app/(marketing)/layout.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(auth)/layout.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(auth)/login/page.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(portal)/portal-login/page.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(marketing)/pricing/page.tsx` | Geändert | ✅ (not reviewed in full — storage keys verified) |
+| `cannamanage-frontend/messages/de.json` | Geändert | ✅ |
+| `cannamanage-frontend/messages/en.json` | Geändert | ✅ |
+| `cannamanage-frontend/src/services/storage.ts` | Neu | ✅ |
+| `cannamanage-frontend/src/services/documents.ts` | Geändert | ✅ |
+| `cannamanage-service/src/main/java/.../StorageQuotaService.java` | Neu | ✅ |
+| `cannamanage-service/src/main/java/.../StorageQuotaExceededException.java` | Neu | ✅ |
+| `cannamanage-api/src/main/java/.../StorageController.java` | Neu | ⚠️ |
+| `cannamanage-api/src/main/java/.../GlobalExceptionHandler.java` | Geändert | ✅ |
+| `cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql` | Neu | ✅ |
+| `cannamanage-domain/src/main/java/.../Club.java` | Geändert | ✅ |
+| `cannamanage-service/src/main/java/.../DocumentService.java` | Geändert | ✅ |
+
+## Checkliste
+
+| # | Prüfpunkt | Ergebnis | Anmerkung |
+|---|-----------|----------|-----------|
+| 1 | Plan-Konformität | ⚠️ | StorageController uses @RequestParam instead of JWT extraction (Step 4.5). SubscriptionService hook (Step 4.9) not implemented. |
+| 2 | Kein Extra-Scope | ✅ | No scope creep detected |
+| 3 | Bestehende Patterns korrekt | ✅ | Follows existing codebase conventions (constructor injection, @Slf4j, RFC 9457 ProblemDetail) |
+| 4 | i18n vollständig (de + en) | ✅ | 26 `marketing.home` keys, 10 `marketing.nav` keys, 16 `marketing.pricing.storage` keys, 10 `comparison` keys, FAQ storage — all present in both DE and EN with zero mismatches |
+| 5 | StorageQuotaExceededException separat | ✅ | Separate class with incompatible constructor (long, long, long). QuotaExceededException maps to 409, StorageQuotaExceededException maps to 402 — correct separation. |
+| 6 | V36 Migration korrekt | ✅ | Non-destructive (`ADD COLUMN IF NOT EXISTS`), correct default (5 GB = 5368709120), backfill via SUM(documents.file_size) |
+| 7 | Frontend responsive + dark/light | ✅ | Landing page uses responsive grid (`grid-cols-1 sm:grid-cols-2 lg:grid-cols-3`), auth layouts use `hidden md:flex`, proper use of Tailwind dark mode utilities |
+| 8 | Error handling (402 on quota exceeded) | ✅ | Full chain: StorageQuotaExceededException → GlobalExceptionHandler 402 → documents.ts catches status 402 → throws typed error with problemDetail |
+
+## Befunde
+
+### ⚠️ WARNING-1: StorageController auth deviation from plan
+
+**Datei:** [`StorageController.java`](cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java:29)
+
+**Plan (Step 4.5)** specified:
+```java
+@GetMapping("/usage")
+public ResponseEntity<StorageUsageDTO> getUsage(@AuthenticationPrincipal UserDetails user) {
+    UUID clubId = extractClubId(user);
+    // ...
+}
+```
+
+**Actual implementation:**
+```java
+@GetMapping("/usage")
+public ResponseEntity<StorageUsageDTO> getUsage(@RequestParam UUID clubId) {
+    return ResponseEntity.ok(storageQuotaService.getUsage(clubId));
+}
+```
+
+- **Risiko:** Any authenticated ADMIN/STAFF user can query any club's storage usage by passing an arbitrary `clubId`. The plan's approach enforced tenant isolation by deriving the club from the JWT token.
+- **Empfehlung:** Replace `@RequestParam UUID clubId` with `@AuthenticationPrincipal` extraction pattern used elsewhere (e.g., DocumentController). This ensures users can only see their own club's data. If cross-club access is intentional (admin panel use case), add a separate admin-only endpoint.
+
+---
+
+### ⚠️ WARNING-2: SubscriptionService tier-change hook not implemented
+
+**Plan (Step 4.9)** specified a `SubscriptionService.onTierChange(UUID clubId, PlanTier newTier)` method to update `storage_limit_bytes` when a club changes tier.
+
+- **Not found** in the implementation.
+- **Impact:** Low — the plan's own note says "Full subscription management (Stripe webhooks, billing cycle, trial-to-paid) is deferred to a future sprint." The hook would currently be dead code.
+- **Empfehlung:** Acceptable to defer. When subscription management is implemented, this hook must be added. The `StorageQuotaService.getLimitForTier()` already exists to support it.
+
+---
+
+### ℹ️ INFO-1: getLimitForTier takes String instead of PlanTier enum
+
+**Datei:** [`StorageQuotaService.java`](cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java:86)
+
+Plan specified `getLimitForTier(PlanTier tier)` but implementation uses `getLimitForTier(String tier)` with a switch on lowercase string matching. This is pragmatic since no `PlanTier` enum exists yet in the domain module. When the enum is created, update the method signature.
+
+---
+
+### ℹ️ INFO-2: Marketing layout extracted to client component
+
+**Datei:** [`marketing-layout-client.tsx`](cannamanage-frontend/src/app/(marketing)/marketing-layout-client.tsx:1)
+
+The plan didn't explicitly specify this separation, but it's a correct architectural choice: the server-side `layout.tsx` handles `getMessages()` and wraps with `NextIntlClientProvider`, while the client component handles the actual rendering with `useTranslations`. This follows Next.js 14 best practices for server/client component boundaries.
+
+---
+
+### ℹ️ INFO-3: Frontend storage service uses apiClient with clubId param
+
+**Datei:** [`storage.ts`](cannamanage-frontend/src/services/storage.ts:12)
+
+The frontend `getStorageUsage(clubId: string)` matches the backend's `@RequestParam UUID clubId`. This is consistent — but both should be updated together if WARNING-1 is addressed (the frontend would then not need to pass clubId explicitly).
+
+## Tests
+
+- **Backend-Tests ausgeführt:** Nicht im Scope dieses Reviews (kein Build-Ausführung angefordert)
+- **Testplan T-14 bis T-32:** Backend unit/integration tests not yet verified as passing
+- **E2E T-01 bis T-13:** Frontend E2E tests not executed in this review
+
+## Empfehlung
+
+**⚠️ Approved with comments** — merge is acceptable, but WARNING-1 (StorageController tenant isolation) should be addressed before production deployment. WARNING-2 (SubscriptionService hook) is acceptable to defer.
+
+### Prioritized actions:
+1. **Before production:** Fix StorageController to use JWT-based club extraction instead of `@RequestParam`
+2. **Next sprint:** Add SubscriptionService tier-change hook when billing features are implemented
+3. **Housekeeping:** Introduce `PlanTier` enum and update `getLimitForTier` signature

docs/sprint-14/cannamanage-sprint14-plan-review.md

@@ -0,0 +1,86 @@
+# Plan Review: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Module:** cannamanage (full-stack)
+**Reviewer:** Lumen (Plan Reviewer)
+**Documents:** analysis v1, plan v2, testplan v2
+**Verdict:** ✅ APPROVED
+
+---
+
+## Summary
+
+Re-review after v1 findings were addressed. All 4 findings (1 blocker, 3 warnings) from the v1 review have been properly resolved in v2. The plan is complete, correct, and ready for implementation.
+
+## v1 Finding Resolution
+
+| # | v1 Finding | Resolution in v2 | Status |
+|---|-----------|------------------|--------|
+| 1 | ❌ `QuotaExceededException` naming conflict | Renamed to `StorageQuotaExceededException` in Step 4.4 with explicit note about existing class | ✅ Fixed |
+| 2 | ⚠️ No sync for `storage_limit_bytes` on tier change | Added Step 4.9 `onTierChange()` hook in `SubscriptionService` | ✅ Fixed |
+| 3 | ⚠️ English i18n keys not specified | Step 1.3 now states both `de.json` and `en.json` must receive equivalent keys; T-32 tests both | ✅ Fixed |
+| 4 | ⚠️ `extractClubId(user)` not defined | Step 4.5 now has full implementation with Javadoc referencing `DocumentController` pattern | ✅ Fixed |
+
+## Reviewed Documents
+
+| Document | Version | Assessment |
+|----------|---------|-----------|
+| Analysis | v1 | ✅ |
+| Plan | v2 | ✅ |
+| Testplan | v2 | ✅ |
+
+## Checklist
+
+### Assessment
+
+| # | Check | Result | Note |
+|---|-------|--------|------|
+| 1 | Problem statement complete | ✅ | Clear: no landing page, no quota enforcement, basic login UI |
+| 2 | Affected components identified | ✅ | 15 components listed (was 14, +1 for new `StorageQuotaExceededException`) |
+| 3 | Current state accurate | ✅ | Confirmed: no `(marketing)/page.tsx`, nav is hardcoded, V35 is latest migration |
+| 4 | Risk assessment realistic | ✅ | 5 risks with appropriate mitigations |
+| 5 | Solution options evaluated | ✅ | 3 options with effort estimates, Option A justified |
+
+### Implementation Plan
+
+| # | Check | Result | Note |
+|---|-------|--------|------|
+| 6 | All requirements covered | ✅ | All 4 areas: landing, login, pricing, storage quota |
+| 7 | Correct patterns referenced | ✅ | `NextIntlClientProvider`, Spring `@Service`, `@PreAuthorize`, `CustomUserDetails` cast pattern |
+| 8 | File paths correct | ✅ | All verified against codebase |
+| 9 | Implementation order logical | ✅ | Frontend (phases 1-3) → backend (phase 4) → integration (phase 5) |
+| 10 | No gaps in steps | ✅ | Migration → entity → service → controller → exception → security config → tier-sync — complete chain |
+| 11 | Flyway migrations planned | ✅ | V36 correct next number, H2-only appropriate for this project |
+| 12 | Error handling planned | ✅ | 402 with RFC 9457 ProblemDetail, floor-at-zero for decrements |
+| 13 | No scope creep | ✅ | Explicitly defers overage billing and email notifications |
+
+### Testplan
+
+| # | Check | Result | Note |
+|---|-------|--------|------|
+| 14 | Coverage complete | ✅ | Every plan step has ≥1 test. 32 tests across 4 areas. |
+| 15 | Test types appropriate | ✅ | E2E for UI (Playwright), Unit for service logic, Integration for controllers |
+| 16 | Edge cases covered | ✅ | Floor-at-zero (T-19), exactly-at-limit (T-15c, T-16b), near-limit thresholds |
+| 17 | Test class naming correct | ✅ | `StorageQuotaServiceTest`, `StorageControllerTest`, `DocumentServiceTest` |
+| 18 | Test method naming correct | ✅ | `testGetUsage_calculatesCorrectly()`, `testCheckQuota_overLimit_throwsQuotaExceeded()` |
+| 19 | Test data defined | ✅ | Explicit UUIDs, byte values, and preconditions documented |
+| 20 | SSH/manual tests identified | N/A | Not a PAISY project |
+
+## Traceability Matrix
+
+| Acceptance Criterion | Plan Step | Test Case(s) | Status |
+|---------------------|-----------|-------------|--------|
+| AC1: Landing page renders | Step 1.1 | T-01 | ✅ Covered |
+| AC2: Landing responsive + dark/light | Step 1.1 | T-02, T-03 | ✅ Covered |
+| AC3: Admin login split layout | Steps 2.1, 2.2 | T-06, T-07, T-08 | ✅ Covered |
+| AC4: Portal login member-themed | Step 2.3 | T-09, T-10 | ✅ Covered |
+| AC5: Pricing shows storage | Steps 3.1-3.3 | T-11, T-12 | ✅ Covered |
+| AC6: Pricing FAQ storage | Step 3.4 | T-13 | ✅ Covered |
+| AC7: GET /api/v1/storage/usage | Steps 4.3, 4.5 | T-23, T-24, T-25 | ✅ Covered |
+| AC8: Upload rejected 402 | Steps 4.3, 4.6, 4.7 | T-16, T-27, T-31 | ✅ Covered |
+| AC9: Delete decrements counter | Step 4.6 | T-18, T-28 | ✅ Covered |
+| AC10: Backfill on migration | Step 4.1 | T-29, T-30 | ✅ Covered |
+
+## Verdict
+
+**✅ APPROVED** — All 20 checklist items pass. All 4 v1 findings resolved. Plan is complete, correct, and ready for implementation. Recommend GO.

docs/sprint-14/cannamanage-sprint14-plan.md

@@ -0,0 +1,571 @@
+# Plan: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v2
+**Basis:** cannamanage-sprint14-analysis.md
+
+---
+
+## Background
+
+Sprint 14 transforms CannaManage from an internal tool into a market-ready SaaS product. It delivers four interconnected pieces: a converting landing page, premium-feeling login experiences, an updated pricing page with storage tiers, and the backend enforcement that makes storage quotas real. Together these enable the public launch.
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                     Frontend — Marketing Layer                        │
+├─────────────────────────────────────────────────────────────────────┤
+│                                                                       │
+│  (marketing)/page.tsx ──► Landing page (hero, features, CTA)         │
+│  (marketing)/pricing/page.tsx ──► Updated with storage tiers         │
+│  (marketing)/layout.tsx ──► Updated nav (Features link)              │
+│                                                                       │
+├─────────────────────────────────────────────────────────────────────┤
+│                     Frontend — Auth Layer                             │
+├─────────────────────────────────────────────────────────────────────┤
+│                                                                       │
+│  (auth)/layout.tsx ──► Split layout (branding left, form right)      │
+│  (auth)/login/page.tsx ──► Form-only (layout handles split)          │
+│  (portal)/portal-login/page.tsx ──► Member-themed split login        │
+│                                                                       │
+├─────────────────────────────────────────────────────────────────────┤
+│                     Backend — Storage Quota                           │
+├─────────────────────────────────────────────────────────────────────┤
+│                                                                       │
+│  StorageQuotaService ──► getUsage(clubId), checkQuota(clubId, size)  │
+│  StorageController ──► GET /api/v1/storage/usage                     │
+│  DocumentService ──► Pre-upload quota check                          │
+│  Club entity ──► storageUsedBytes column (incremental counter)       │
+│  V36 migration ──► ALTER TABLE clubs ADD storage_used_bytes          │
+│                                                                       │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Components
+
+| # | Component | Module | Action |
+|---|-----------|--------|--------|
+| 1 | Landing page | cannamanage-frontend | **New** — `(marketing)/page.tsx` |
+| 2 | Auth layout (split) | cannamanage-frontend | **Modify** — `(auth)/layout.tsx` |
+| 3 | Admin login page | cannamanage-frontend | **Modify** — remove layout wrapper, form only |
+| 4 | Portal login page | cannamanage-frontend | **Modify** — member-themed split variant |
+| 5 | Pricing page | cannamanage-frontend | **Modify** — add storage tiers, update model |
+| 6 | Marketing layout | cannamanage-frontend | **Modify** — add "Features" nav link |
+| 7 | i18n messages (de) | cannamanage-frontend | **Modify** — add marketing.home, pricing.storage keys |
+| 8 | i18n messages (en) | cannamanage-frontend | **Modify** — full English equivalents for marketing.home.* and marketing.pricing.storage.* |
+| 9 | StorageQuotaService | cannamanage-service | **New** — quota logic |
+| 10 | StorageController | cannamanage-api | **New** — REST endpoint |
+| 11 | Club entity | cannamanage-domain | **Modify** — add storageUsedBytes |
+| 12 | DocumentService | cannamanage-service | **Modify** — add quota check on upload |
+| 13 | Flyway V36 | cannamanage-api | **New** — migration SQL |
+| 14 | Frontend storage service | cannamanage-frontend | **New** — `services/storage.ts` |
+| 15 | StorageQuotaExceededException | cannamanage-service | **New** — 402 storage exception |
+
+---
+
+## Implementation Steps
+
+### Phase 1: Landing Page
+
+#### Step 1.1 — Create `(marketing)/page.tsx`
+
+**File:** `cannamanage-frontend/src/app/(marketing)/page.tsx`
+
+A full landing page with these sections:
+- **Hero** — Headline ("Die smarte Verwaltung für deinen Anbauverein"), subheadline, primary CTA (→ /pricing), secondary CTA (→ /login)
+- **Feature grid** — 6 cards in a 2×3 / 3×2 responsive grid:
+  1. Compliance Tracking (§22 KCanG documentation)
+  2. Grow Management (calendar, stages, sensors)
+  3. Member Portal (self-service, history, profile)
+  4. Distribution Quotas (25g/day, 50g/month enforcement)
+  5. Document Archive (GoBD-compliant, retention periods)
+  6. Financial Management (fees, SEPA, bank import)
+- **Trust signals** — "Für Anbauvereine in Deutschland" badge, CanVerG compliance, DSGVO/GoBD, TLS encryption
+- **Final CTA** — "Jetzt kostenlos testen" → /pricing
+
+Use `lucide-react` icons. All text via `useTranslations("marketing.home")`. Responsive: single column on mobile, grid on tablet+. Dark/light mode compatible.
+
+#### Step 1.2 — Update marketing layout navigation
+
+**File:** `cannamanage-frontend/src/app/(marketing)/layout.tsx`
+
+- Add "Features" link in header nav (scrolls to `#features` anchor on homepage, or links to `/#features`)
+- Internationalize hardcoded "Preise" and "Anmelden" strings via `useTranslations`
+- Add "Features" link to footer "Produkt" column
+
+#### Step 1.3 — Add i18n keys for landing page (de + en)
+
+**Files:**
+- `cannamanage-frontend/messages/de.json`
+- `cannamanage-frontend/messages/en.json`
+
+Both locale files must receive entries for the `marketing.home.*` and `marketing.pricing.storage.*` namespaces. The German keys are the primary source; the English file must contain equivalent translations for all keys.
+
+Add under `marketing.home` (German example):
+```json
+{
+  "marketing": {
+    "home": {
+      "heroTitle": "Die smarte Verwaltung für deinen Anbauverein",
+      "heroSubtitle": "Compliance, Anbau, Mitglieder und Abgaben — alles in einer Plattform. Rechtssicher nach KCanG.",
+      "ctaPrimary": "Preise ansehen",
+      "ctaSecondary": "Jetzt anmelden",
+      "featuresTitle": "Alles, was dein Verein braucht",
+      "featuresSubtitle": "Von der Mitgliederverwaltung bis zur Behördenmeldung — CannaManage deckt den gesamten Vereinsbetrieb ab.",
+      "feature1Title": "Compliance Tracking",
+      "feature1Desc": "Automatische Überwachung der KCanG-Vorgaben mit Fristen und Checklisten.",
+      "feature2Title": "Grow Management",
+      "feature2Desc": "Anbaukalender, Wachstumsphasen und Sensorintegration.",
+      "feature3Title": "Mitglieder-Portal",
+      "feature3Desc": "Self-Service für Mitglieder: Profil, Abgabehistorie, Dokumente.",
+      "feature4Title": "Abgabe-Quotas",
+      "feature4Desc": "Automatische Einhaltung der 25g/Tag und 50g/Monat Grenzen.",
+      "feature5Title": "Dokumenten-Archiv",
+      "feature5Desc": "GoBD-konforme Ablage mit Aufbewahrungsfristen und Versionierung.",
+      "feature6Title": "Finanzverwaltung",
+      "feature6Desc": "Mitgliedsbeiträge, SEPA-Export und Bankimport.",
+      "trustTitle": "Vertrauen durch Compliance",
+      "trustCanverg": "CanVerG-konform",
+      "trustDsgvo": "DSGVO & GoBD",
+      "trustEncryption": "TLS-verschlüsselt",
+      "trustGerman": "Hosting in Deutschland",
+      "ctaFinalTitle": "Bereit für den nächsten Schritt?",
+      "ctaFinalSubtitle": "Starte jetzt mit CannaManage und bring deinen Verein auf das nächste Level.",
+      "ctaFinalButton": "Kostenlos testen"
+    }
+  }
+}
+```
+
+---
+
+### Phase 2: Login Redesign
+
+#### Step 2.1 — Redesign auth layout to split-layout
+
+**File:** `cannamanage-frontend/src/app/(auth)/layout.tsx`
+
+Replace the simple centered container with a split layout:
+```
+┌──────────────────────────────────────────────────┐
+│  Left Panel (hidden <md)  │  Right Panel (form)  │
+│                           │                      │
+│  • App logo + name        │  {children}          │
+│  • Tagline                │                      │
+│  • 3 feature highlights   │                      │
+│  • Background gradient    │                      │
+│                           │                      │
+└──────────────────────────────────────────────────┘
+```
+
+- Left panel: `hidden md:flex md:w-1/2 lg:w-[55%]` — dark gradient background with primary color accent
+- Right panel: `w-full md:w-1/2 lg:w-[45%] flex items-center justify-center p-8`
+- Left panel content: CannaManage logo, "Dein Verein, digital verwaltet" tagline, 3 bullet points with icons (Compliance, Mitglieder, Abgaben)
+- Still wraps `{children}` in `NextIntlClientProvider`
+
+#### Step 2.2 — Adjust admin login page
+
+**File:** `cannamanage-frontend/src/app/(auth)/login/page.tsx`
+
+- Remove the logo/branding section (now in layout's left panel)
+- Keep only the form card itself: title "Anmelden", email, password, submit, forgot password, portal link
+- The page becomes purely the form — layout handles the split
+
+#### Step 2.3 — Create portal login with member theming
+
+**File:** `cannamanage-frontend/src/app/(portal)/portal-login/page.tsx`
+
+Portal login gets its own split layout inline (since it's in a different route group):
+- Left panel: member-focused messaging — "Willkommen zurück", "Dein persönlicher Bereich", icons for Abgabehistorie/Profil/Dokumente
+- Right panel: login form (same structure as admin but portal-specific translations)
+- Visual differentiation: left panel uses a slightly different gradient (e.g., emerald/teal tint vs. primary green)
+- Full-page layout (no separate layout.tsx needed — inline the split)
+
+---
+
+### Phase 3: Pricing Page Update
+
+#### Step 3.1 — Update pricing data model
+
+**File:** `cannamanage-frontend/src/app/(marketing)/pricing/page.tsx`
+
+Update the `plans` array to include storage:
+```typescript
+const plans = [
+  {
+    id: "starter",
+    icon: Leaf,
+    price: "19",
+    memberLimit: "30",
+    storage: "5",      // GB
+    features: [
+      "memberManagement",
+      "distributionTracking",
+      "complianceReports",
+      "quotaMonitoring",
+      "memberPortal",
+      "emailSupport",
+    ],
+  },
+  {
+    id: "pro",
+    icon: Cannabis,
+    price: "49",
+    memberLimit: "100",
+    storage: "50",     // GB
+    storageOverage: "0.15",  // €/GB/month
+    popular: true,
+    features: [
+      "allStarter",
+      "growCalendar",
+      "staffManagement",
+      "advancedReports",
+      "pdfExport",
+      "apiAccess",
+      "prioritySupport",
+    ],
+  },
+  {
+    id: "enterprise",
+    icon: Building2,
+    price: null,
+    memberLimit: "unlimited",
+    storage: "custom",
+    features: [
+      "allPro",
+      "unlimitedMembers",
+      "multiClub",
+      "customIntegrations",
+      "sla",
+      "dedicatedSupport",
+      "onboarding",
+    ],
+  },
+]
+```
+
+#### Step 3.2 — Render storage in plan cards
+
+In each plan card, add a storage badge below the member limit:
+- Starter: "5 GB Speicher"
+- Pro: "50 GB Speicher" + small note "(danach 0,15 €/GB/Monat)"
+- Enterprise: "Individueller Speicher"
+
+#### Step 3.3 — Add storage row to feature comparison
+
+Below the plan cards, add a comparison table section:
+
+| Feature | Starter | Pro | Enterprise |
+|---------|---------|-----|------------|
+| Mitglieder | 30 | 100 | Unbegrenzt |
+| Speicher | 5 GB | 50 GB | Individuell |
+| Überschreitung | Upgrade erforderlich | 0,15 €/GB/Mo | — |
+| Grow-Kalender | — | ✓ | ✓ |
+| API-Zugang | — | ✓ | ✓ |
+| Multi-Club | — | — | ✓ |
+
+#### Step 3.4 — Add FAQ entry about storage
+
+Add to the `faqs` array:
+```typescript
+{ id: "storage" }  // "Was passiert wenn mein Speicherplatz voll ist?"
+```
+
+i18n keys:
+- `marketing.pricing.faq.storage.question`: "Was passiert, wenn mein Speicher voll ist?"
+- `marketing.pricing.faq.storage.answer`: "Im Starter-Plan kannst du auf Pro upgraden. Im Pro-Plan wird zusätzlicher Speicher mit 0,15 €/GB/Monat berechnet. Enterprise-Kunden haben individuelle Speichervereinbarungen."
+
+---
+
+### Phase 4: Storage Quota Backend
+
+#### Step 4.1 — Flyway migration V36
+
+**File:** `cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql`
+
+```sql
+-- Add storage tracking to clubs
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_used_bytes BIGINT DEFAULT 0;
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_limit_bytes BIGINT DEFAULT 5368709120;
+-- Default: 5 GB (5 * 1024^3) = Starter tier
+
+-- Backfill existing clubs with actual usage
+UPDATE clubs c SET storage_used_bytes = COALESCE(
+    (SELECT SUM(d.file_size) FROM documents d WHERE d.club_id = c.id), 0
+);
+```
+
+#### Step 4.2 — Update Club entity
+
+**File:** `cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Club.java`
+
+Add fields:
+```java
+@Column(name = "storage_used_bytes", nullable = false)
+private Long storageUsedBytes = 0L;
+
+@Column(name = "storage_limit_bytes", nullable = false)
+private Long storageLimitBytes = 5_368_709_120L; // 5 GB default
+```
+
+With getters/setters.
+
+#### Step 4.3 — Create StorageQuotaService
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java`
+
+```java
+@Service
+@Slf4j
+public class StorageQuotaService {
+
+    private final ClubRepository clubRepository;
+
+    // Plan tier limits
+    private static final long STARTER_LIMIT = 5L * 1024 * 1024 * 1024;   // 5 GB
+    private static final long PRO_LIMIT = 50L * 1024 * 1024 * 1024;      // 50 GB
+    private static final long ENTERPRISE_LIMIT = Long.MAX_VALUE;          // Unlimited
+
+    public StorageUsageDTO getUsage(UUID clubId) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        long used = club.getStorageUsedBytes();
+        long limit = club.getStorageLimitBytes();
+        double percentage = limit > 0 ? (double) used / limit * 100 : 0;
+        return new StorageUsageDTO(used, limit, percentage);
+    }
+
+    public void checkQuota(UUID clubId, long additionalBytes) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        long newTotal = club.getStorageUsedBytes() + additionalBytes;
+        if (newTotal > club.getStorageLimitBytes()) {
+            throw new StorageQuotaExceededException(club.getStorageUsedBytes(),
+                club.getStorageLimitBytes(), additionalBytes);
+        }
+    }
+
+    public void incrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        club.setStorageUsedBytes(club.getStorageUsedBytes() + bytes);
+        clubRepository.save(club);
+    }
+
+    public void decrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        long newUsage = Math.max(0, club.getStorageUsedBytes() - bytes);
+        club.setStorageUsedBytes(newUsage);
+        clubRepository.save(club);
+    }
+
+    public static long getLimitForTier(PlanTier tier) {
+        return switch (tier) {
+            case TRIAL, STARTER -> STARTER_LIMIT;
+            case PRO -> PRO_LIMIT;
+            case ENTERPRISE -> ENTERPRISE_LIMIT;
+        };
+    }
+
+    public boolean isNearLimit(UUID clubId, int thresholdPercent) {
+        StorageUsageDTO usage = getUsage(clubId);
+        return usage.percentage() >= thresholdPercent;
+    }
+}
+```
+
+#### Step 4.4 — Create StorageQuotaExceededException
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/exception/StorageQuotaExceededException.java`
+
+> **Note:** The existing `QuotaExceededException` (at `cannamanage-service/src/main/java/de/cannamanage/service/exception/QuotaExceededException.java`) is reserved for CanG distribution quotas (25g/day, 50g/month) and takes a `QuotaViolationCode`. The storage exception needs its own class with an incompatible constructor signature.
+
+```java
+public class StorageQuotaExceededException extends RuntimeException {
+    private final long currentUsage;
+    private final long limit;
+    private final long requestedBytes;
+
+    public StorageQuotaExceededException(long currentUsage, long limit, long requestedBytes) {
+        super("Storage quota exceeded: current=%d, limit=%d, requested=%d"
+            .formatted(currentUsage, limit, requestedBytes));
+        this.currentUsage = currentUsage;
+        this.limit = limit;
+        this.requestedBytes = requestedBytes;
+    }
+
+    // Getters
+}
+```
+
+Map in `GlobalExceptionHandler` to HTTP 402 Payment Required with RFC 9457 problem detail.
+
+#### Step 4.5 — Create StorageController
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java`
+
+```java
+@RestController
+@RequestMapping("/api/v1/storage")
+@PreAuthorize("hasAnyRole('ADMIN', 'STAFF')")
+public class StorageController {
+
+    private final StorageQuotaService storageQuotaService;
+
+    @GetMapping("/usage")
+    public ResponseEntity<StorageUsageDTO> getUsage(@AuthenticationPrincipal UserDetails user) {
+        UUID clubId = extractClubId(user);
+        return ResponseEntity.ok(storageQuotaService.getUsage(clubId));
+    }
+
+    /**
+     * Extracts the clubId from the authenticated user's JWT claims.
+     * The user's club association is stored as a "clubId" claim in the token,
+     * set during authentication by AuthService. This follows the same pattern
+     * used in DocumentController and other club-scoped controllers.
+     */
+    private UUID extractClubId(UserDetails user) {
+        // Cast to our CustomUserDetails which carries the clubId from JWT
+        var customUser = (CustomUserDetails) user;
+        return customUser.getClubId();
+    }
+}
+```
+
+Response DTO:
+```java
+public record StorageUsageDTO(long usedBytes, long limitBytes, double percentage) {}
+```
+
+#### Step 4.6 — Update DocumentService for quota check
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java`
+
+In the upload method, add before file write:
+```java
+// Check storage quota before upload
+storageQuotaService.checkQuota(clubId, file.getSize());
+
+// ... existing upload logic ...
+
+// After successful save, increment usage counter
+storageQuotaService.incrementUsage(clubId, file.getSize());
+```
+
+In the delete method, add after file removal:
+```java
+// Decrement usage counter after successful delete
+storageQuotaService.decrementUsage(clubId, document.getFileSize());
+```
+
+#### Step 4.7 — Handle 402 in GlobalExceptionHandler
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/exception/GlobalExceptionHandler.java`
+
+Add handler:
+```java
+@ExceptionHandler(StorageQuotaExceededException.class)
+public ResponseEntity<ProblemDetail> handleStorageQuotaExceeded(StorageQuotaExceededException ex) {
+    ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.PAYMENT_REQUIRED);
+    problem.setTitle("Storage Quota Exceeded");
+    problem.setDetail("Upload would exceed storage limit. Current: " + ex.getCurrentUsage() 
+        + " bytes, Limit: " + ex.getLimit() + " bytes, Requested: " + ex.getRequestedBytes() + " bytes");
+    problem.setProperty("currentUsage", ex.getCurrentUsage());
+    problem.setProperty("limit", ex.getLimit());
+    problem.setProperty("requestedBytes", ex.getRequestedBytes());
+    return ResponseEntity.status(HttpStatus.PAYMENT_REQUIRED).body(problem);
+}
+```
+
+#### Step 4.8 — Add SecurityConfig matcher for storage endpoint
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java`
+
+Add:
+```java
+.requestMatchers(HttpMethod.GET, "/api/v1/storage/**").hasAnyRole("ADMIN", "STAFF")
+```
+
+#### Step 4.9 — Subscription tier change hook (storage_limit_bytes sync)
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/SubscriptionService.java`
+
+When a club's subscription tier changes (e.g., Starter→Pro), `storage_limit_bytes` must be updated to match the new tier. Add an `onTierChange()` hook:
+
+```java
+/**
+ * Called when a club upgrades/downgrades their subscription tier.
+ * Updates the storage_limit_bytes to match the new tier's allocation.
+ */
+public void onTierChange(UUID clubId, PlanTier newTier) {
+    Club club = clubRepository.findById(clubId).orElseThrow();
+    long newLimit = StorageQuotaService.getLimitForTier(newTier);
+    club.setStorageLimitBytes(newLimit);
+    clubRepository.save(club);
+    log.info("Club {} storage limit updated to {} bytes (tier: {})", clubId, newLimit, newTier);
+}
+```
+
+> **Note:** This is a minimal hook. Full subscription management (Stripe webhooks, billing cycle, trial-to-paid) is deferred to a future sprint. For now, this method is called from the admin panel when manually changing a club's tier.
+
+---
+
+### Phase 5: Frontend Storage Integration
+
+#### Step 5.1 — Create storage service
+
+**File:** `cannamanage-frontend/src/services/storage.ts`
+
+```typescript
+export interface StorageUsage {
+  usedBytes: number
+  limitBytes: number
+  percentage: number
+}
+
+export async function getStorageUsage(): Promise<StorageUsage> {
+  const response = await fetch('/api/v1/storage/usage', { ... })
+  return response.json()
+}
+
+export function formatBytes(bytes: number): string {
+  if (bytes === 0) return '0 B'
+  const k = 1024
+  const sizes = ['B', 'KB', 'MB', 'GB', 'TB']
+  const i = Math.floor(Math.log(bytes) / Math.log(k))
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i]
+}
+```
+
+#### Step 5.2 — Handle 402 in document upload UI
+
+**File:** `cannamanage-frontend/src/services/documents.ts`
+
+In the upload handler, catch 402 responses and display a quota-exceeded toast/dialog with upgrade CTA pointing to `/pricing`.
+
+---
+
+## Open Questions
+
+- [ ] Should storage overage (Pro tier, €0.15/GB/mo) auto-allow uploads beyond limit, or still block?
+  - **Recommendation:** For now, block at limit for all tiers. Overage billing is a future sprint (requires Stripe integration).
+- [ ] Email notifications at 80%/95% — implement the hook in this sprint or defer?
+  - **Recommendation:** Implement the detection (`isNearLimit`), log a warning, defer actual email sending.
+
+---
+
+## Acceptance Criteria
+
+1. Landing page renders at `/` with hero, 6 features, trust signals, and CTA
+2. Landing page is responsive (mobile/tablet/desktop) and supports dark/light mode
+3. Admin login at `/login` shows split layout on desktop, full-width form on mobile
+4. Portal login at `/portal-login` shows member-themed split layout
+5. Pricing page shows storage limits per tier and comparison table with storage row
+6. Pricing page has FAQ entry explaining storage limits
+7. `GET /api/v1/storage/usage` returns `{ usedBytes, limitBytes, percentage }` for authenticated users
+8. Document upload is rejected with HTTP 402 when quota would be exceeded
+9. Document deletion decrements the storage counter
+10. Existing clubs have their `storage_used_bytes` backfilled on migration

docs/sprint-14/cannamanage-sprint14-testplan.md

@@ -0,0 +1,596 @@
+# Testplan: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v2
+**Basis:** cannamanage-sprint14-plan.md
+
+---
+
+## Test Overview
+
+| ID | Description | Type | Class/Tool | Status |
+|----|-------------|------|------------|--------|
+| T-01 | Landing page renders all sections | E2E | Playwright | ⬜ |
+| T-02 | Landing page responsive (mobile) | E2E | Playwright | ⬜ |
+| T-03 | Landing page dark/light mode | E2E | Playwright | ⬜ |
+| T-04 | Landing page CTA links work | E2E | Playwright | ⬜ |
+| T-05 | Marketing nav shows Features link | E2E | Playwright | ⬜ |
+| T-06 | Admin login — split layout on desktop | E2E | Playwright | ⬜ |
+| T-07 | Admin login — full-width on mobile | E2E | Playwright | ⬜ |
+| T-08 | Admin login — form still functional | E2E | Playwright | ⬜ |
+| T-09 | Portal login — member-themed split | E2E | Playwright | ⬜ |
+| T-10 | Portal login — form functional | E2E | Playwright | ⬜ |
+| T-11 | Pricing — storage tiers displayed | E2E | Playwright | ⬜ |
+| T-12 | Pricing — comparison table with storage row | E2E | Playwright | ⬜ |
+| T-13 | Pricing — FAQ storage entry visible | E2E | Playwright | ⬜ |
+| T-14 | Storage usage — correct calculation | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-15 | Storage quota — allows upload under limit | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-16 | Storage quota — rejects upload over limit | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-17 | Storage quota — increment on upload | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-18 | Storage quota — decrement on delete | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-19 | Storage quota — decrement floors at zero | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-20 | Storage quota — tier limit mapping | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-21 | Storage quota — near-limit detection (80%) | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-22 | Storage quota — near-limit detection (95%) | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-23 | GET /api/v1/storage/usage — authenticated | Integration | `StorageControllerTest` | ⬜ |
+| T-24 | GET /api/v1/storage/usage — unauthenticated 401 | Integration | `StorageControllerTest` | ⬜ |
+| T-25 | GET /api/v1/storage/usage — correct DTO shape | Integration | `StorageControllerTest` | ⬜ |
+| T-26 | Document upload — quota check integrated | Integration | `DocumentServiceTest` | ⬜ |
+| T-27 | Document upload — 402 on quota exceeded | Integration | `DocumentControllerTest` | ⬜ |
+| T-28 | Document delete — usage decremented | Integration | `DocumentServiceTest` | ⬜ |
+| T-29 | Flyway V36 — migration applies cleanly | Integration | Flyway boot test | ⬜ |
+| T-30 | Flyway V36 — backfill calculates correctly | Integration | SQL verification | ⬜ |
+| T-31 | StorageQuotaExceededException — 402 response format | Unit | `GlobalExceptionHandlerTest` | ⬜ |
+| T-32 | i18n — all marketing.home keys resolve (de + en) | Unit | Lint / next-intl | ⬜ |
+
+Status: ⬜ Open | ✅ Passed | ❌ Failed | ⏭️ Skipped
+
+---
+
+## Test Cases
+
+### T-01: Landing Page Renders All Sections
+
+**Type:** E2E
+**Tool:** Playwright
+**Script:** `e2e/marketing/landing-page.spec.ts`
+
+**Preconditions:**
+- App running at localhost:3000
+- No authentication required (public page)
+
+**Scenarios:**
+
+| # | Action | Expected Result |
+|---|--------|-----------------|
+| a | Navigate to `/` | Page loads without errors |
+| b | Check hero section | Headline text visible, CTA buttons present |
+| c | Check feature grid | 6 feature cards visible with titles and descriptions |
+| d | Check trust signals | At least 4 trust badges visible |
+| e | Check final CTA | "Kostenlos testen" button visible |
+
+**Postconditions:**
+- All i18n keys resolve (no raw key strings visible)
+- No console errors
+
+---
+
+### T-02: Landing Page Responsive (Mobile)
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 375×812)
+
+**Scenarios:**
+
+| # | Viewport | Expected Result |
+|---|----------|-----------------|
+| a | 375×812 (iPhone) | Feature grid stacks to single column |
+| b | 375×812 | Hero section full-width, text wraps cleanly |
+| c | 768×1024 (iPad) | Feature grid shows 2 columns |
+| d | 1280×720 (desktop) | Feature grid shows 3 columns |
+
+---
+
+### T-03: Landing Page Dark/Light Mode
+
+**Type:** E2E
+**Tool:** Playwright (`colorScheme: 'dark'` / `'light'`)
+
+**Scenarios:**
+
+| # | Mode | Expected Result |
+|---|------|-----------------|
+| a | Dark | Background is dark, text is light, no contrast issues |
+| b | Light | Background is light, text is dark, cards have proper borders |
+| c | Switch | Toggle theme mid-page — re-renders correctly |
+
+---
+
+### T-04: Landing Page CTA Links
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Element | Expected Navigation |
+|---|---------|-------------------|
+| a | Primary CTA ("Preise ansehen") | Navigates to `/pricing` |
+| b | Secondary CTA ("Jetzt anmelden") | Navigates to `/login` |
+| c | Final CTA ("Kostenlos testen") | Navigates to `/pricing` |
+| d | Header "Features" link | Scrolls to `#features` section or navigates to `/#features` |
+
+---
+
+### T-05: Marketing Nav Features Link
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Page | Expected |
+|---|------|----------|
+| a | `/` | Header shows "Features" link |
+| b | `/pricing` | Header shows "Features" link |
+| c | Click "Features" from `/pricing` | Navigates to homepage features section |
+
+---
+
+### T-06: Admin Login — Split Layout Desktop
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 1280×720)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Left panel visible | Branding panel with logo, tagline, feature bullets visible |
+| b | Right panel visible | Login form visible |
+| c | Layout proportions | Left panel ~55%, right panel ~45% |
+| d | Left panel content | "CannaManage" text, tagline, 3 feature highlights with icons |
+
+---
+
+### T-07: Admin Login — Full-Width Mobile
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 375×812)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Left panel | Hidden (`hidden md:flex`) |
+| b | Form panel | Full width, centered vertically |
+| c | Form usability | All fields accessible, submit button tappable |
+
+---
+
+### T-08: Admin Login — Form Still Functional
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Preconditions:**
+- Backend running with test credentials available
+
+**Scenarios:**
+
+| # | Input | Expected |
+|---|-------|----------|
+| a | Valid credentials | Redirects to `/dashboard` |
+| b | Invalid password | Error message displayed |
+| c | Empty fields | Validation errors shown |
+
+---
+
+### T-09: Portal Login — Member-Themed Split
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 1280×720)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Left panel | Member-specific messaging ("Willkommen zurück") |
+| b | Visual theme | Different gradient than admin login (teal/emerald vs. primary green) |
+| c | Feature bullets | Member-relevant: Abgabehistorie, Profil, Dokumente |
+
+---
+
+### T-10: Portal Login — Form Functional
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Input | Expected |
+|---|-------|----------|
+| a | Submit form | Redirects to `/portal/dashboard` |
+| b | Invalid input | Error message shown |
+
+---
+
+### T-11: Pricing — Storage Tiers Displayed
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Plan | Expected Storage Display |
+|---|------|------------------------|
+| a | Starter card | "5 GB Speicher" visible |
+| b | Pro card | "50 GB Speicher" visible + overage note |
+| c | Enterprise card | "Individueller Speicher" visible |
+
+---
+
+### T-12: Pricing — Comparison Table
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Table exists | Comparison table rendered below plan cards |
+| b | Storage row | "Speicher" row shows 5 GB / 50 GB / Individuell |
+| c | Overage row | "Überschreitung" row shows values per plan |
+| d | Responsive | Table scrollable on mobile |
+
+---
+
+### T-13: Pricing — FAQ Storage Entry
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | FAQ section | Contains storage question |
+| b | Click expand | Answer mentions Starter upgrade + Pro overage pricing |
+
+---
+
+### T-14: Storage Usage Calculation
+
+**Type:** Unit
+**Class:** `cannamanage-service/src/test/java/de/cannamanage/service/StorageQuotaServiceTest.java`
+**Method:** `testGetUsage_calculatesCorrectly()`
+
+**Scenarios:**
+
+| # | Setup | Expected |
+|---|-------|----------|
+| a | Club with 1 GB used, 5 GB limit | `{ usedBytes: 1073741824, limitBytes: 5368709120, percentage: 20.0 }` |
+| b | Club with 0 bytes used | `{ usedBytes: 0, percentage: 0.0 }` |
+| c | Club with exactly limit used | `{ percentage: 100.0 }` |
+
+---
+
+### T-15: Quota Allows Upload Under Limit
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testCheckQuota_underLimit_noException()`
+
+**Scenarios:**
+
+| # | Current Usage | Limit | Upload Size | Expected |
+|---|---------------|-------|-------------|----------|
+| a | 1 GB | 5 GB | 100 MB | No exception |
+| b | 4.9 GB | 5 GB | 50 MB | No exception (4.95 GB < 5 GB) |
+| c | 0 | 5 GB | 5 GB | No exception (exactly at limit) |
+
+---
+
+### T-16: Quota Rejects Upload Over Limit
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testCheckQuota_overLimit_throwsQuotaExceeded()`
+
+**Scenarios:**
+
+| # | Current Usage | Limit | Upload Size | Expected |
+|---|---------------|-------|-------------|----------|
+| a | 4.9 GB | 5 GB | 200 MB | `StorageQuotaExceededException` thrown |
+| b | 5 GB | 5 GB | 1 byte | `StorageQuotaExceededException` thrown |
+| c | 50 GB | 50 GB | 1 KB | `StorageQuotaExceededException` thrown |
+
+---
+
+### T-17: Increment On Upload
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testIncrementUsage_addsBytes()`
+
+**Scenarios:**
+
+| # | Initial | Increment | Expected |
+|---|---------|-----------|----------|
+| a | 0 | 1048576 (1 MB) | 1048576 |
+| b | 1000000 | 500000 | 1500000 |
+
+---
+
+### T-18: Decrement On Delete
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testDecrementUsage_subtractsBytes()`
+
+**Scenarios:**
+
+| # | Initial | Decrement | Expected |
+|---|---------|-----------|----------|
+| a | 5000000 | 1000000 | 4000000 |
+| b | 1048576 | 1048576 | 0 |
+
+---
+
+### T-19: Decrement Floors at Zero
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testDecrementUsage_floorsAtZero()`
+
+**Scenarios:**
+
+| # | Initial | Decrement | Expected |
+|---|---------|-----------|----------|
+| a | 100 | 200 | 0 (not negative) |
+| b | 0 | 1000 | 0 |
+
+---
+
+### T-20: Tier Limit Mapping
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testGetLimitForTier()`
+
+**Scenarios:**
+
+| # | Tier | Expected Limit |
+|---|------|---------------|
+| a | TRIAL | 5 GB (5368709120) |
+| b | STARTER | 5 GB (5368709120) |
+| c | PRO | 50 GB (53687091200) |
+| d | ENTERPRISE | Long.MAX_VALUE |
+
+---
+
+### T-21: Near-Limit Detection 80%
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testIsNearLimit_at80Percent()`
+
+**Scenarios:**
+
+| # | Usage | Limit | Threshold | Expected |
+|---|-------|-------|-----------|----------|
+| a | 4.0 GB | 5 GB | 80% | true (80%) |
+| b | 3.9 GB | 5 GB | 80% | false (78%) |
+| c | 4.1 GB | 5 GB | 80% | true (82%) |
+
+---
+
+### T-22: Near-Limit Detection 95%
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testIsNearLimit_at95Percent()`
+
+**Scenarios:**
+
+| # | Usage | Limit | Threshold | Expected |
+|---|-------|-------|-----------|----------|
+| a | 4.75 GB | 5 GB | 95% | true (95%) |
+| b | 4.7 GB | 5 GB | 95% | false (94%) |
+
+---
+
+### T-23: Storage Endpoint — Authenticated
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/StorageControllerTest.java`
+**Method:** `testGetUsage_authenticated_returns200()`
+
+**Preconditions:**
+- Test user with ADMIN role and known clubId
+- Club has pre-set `storageUsedBytes` and `storageLimitBytes`
+
+**Scenarios:**
+
+| # | Auth | Expected |
+|---|------|----------|
+| a | Valid ADMIN JWT | 200 with `{ usedBytes, limitBytes, percentage }` |
+| b | Valid STAFF JWT | 200 with correct response |
+
+---
+
+### T-24: Storage Endpoint — Unauthenticated
+
+**Type:** Integration
+**Class:** `StorageControllerTest`
+**Method:** `testGetUsage_unauthenticated_returns401()`
+
+**Scenarios:**
+
+| # | Auth | Expected |
+|---|------|----------|
+| a | No token | 401 Unauthorized |
+| b | Expired token | 401 Unauthorized |
+| c | MEMBER role | 403 Forbidden |
+
+---
+
+### T-25: Storage Endpoint — DTO Shape
+
+**Type:** Integration
+**Class:** `StorageControllerTest`
+**Method:** `testGetUsage_responseShape()`
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | JSON keys | Response contains `usedBytes`, `limitBytes`, `percentage` |
+| b | Types | `usedBytes` and `limitBytes` are numbers, `percentage` is double |
+| c | Percentage calculation | Matches `usedBytes / limitBytes * 100` |
+
+---
+
+### T-26: Document Upload — Quota Check Integrated
+
+**Type:** Integration
+**Class:** `cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java`
+**Method:** `testUploadDocument_checksQuotaBeforeWrite()`
+
+**Scenarios:**
+
+| # | Setup | Expected |
+|---|-------|----------|
+| a | Club under quota, upload 1 MB | Upload succeeds, `storageUsedBytes` incremented by file size |
+| b | Club at quota limit | Upload rejected with `StorageQuotaExceededException` before file write |
+
+---
+
+### T-27: Document Upload — 402 Response
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerTest.java`
+**Method:** `testUploadDocument_quotaExceeded_returns402()`
+
+**Preconditions:**
+- Club with `storageUsedBytes = storageLimitBytes` (fully used)
+
+**Scenarios:**
+
+| # | Action | Expected |
+|---|--------|----------|
+| a | POST multipart upload (1 byte file) | 402 Payment Required |
+| b | Response body | RFC 9457 ProblemDetail with `currentUsage`, `limit`, `requestedBytes` |
+
+---
+
+### T-28: Document Delete — Usage Decremented
+
+**Type:** Integration
+**Class:** `DocumentServiceTest`
+**Method:** `testDeleteDocument_decrementsUsage()`
+
+**Scenarios:**
+
+| # | Setup | Expected |
+|---|-------|----------|
+| a | Club with 5 MB used, delete 2 MB document | `storageUsedBytes` = 3 MB |
+| b | Club with 1 MB used, delete 1 MB document | `storageUsedBytes` = 0 |
+
+---
+
+### T-29: Flyway V36 — Migration Applies
+
+**Type:** Integration
+**Tool:** Spring Boot test context startup
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Application starts | V36 migration applies without error |
+| b | Column exists | `SELECT storage_used_bytes FROM clubs LIMIT 1` succeeds |
+| c | Default value | New clubs get `storage_used_bytes = 0` and `storage_limit_bytes = 5368709120` |
+
+---
+
+### T-30: Flyway V36 — Backfill
+
+**Type:** Integration
+**Tool:** SQL verification after migration
+
+**Preconditions:**
+- Club exists with 3 documents (sizes: 1MB, 2MB, 3MB)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | After migration | `storage_used_bytes` = 6291456 (6 MB = sum of document sizes) |
+| b | Club with no docs | `storage_used_bytes` = 0 |
+
+---
+
+### T-31: StorageQuotaExceededException — 402 Format
+
+**Type:** Unit
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/exception/GlobalExceptionHandlerTest.java`
+**Method:** `testStorageQuotaExceeded_returns402WithProblemDetail()`
+
+**Scenarios:**
+
+| # | Input | Expected |
+|---|-------|----------|
+| a | `StorageQuotaExceededException(1GB, 5GB, 200MB)` | HTTP 402, title="Storage Quota Exceeded" |
+| b | Response properties | Contains `currentUsage`, `limit`, `requestedBytes` numeric fields |
+
+---
+
+### T-32: i18n Keys Resolve
+
+**Type:** Unit / Lint
+**Tool:** next-intl compile check or custom script
+
+**Scenarios:**
+
+| # | Namespace | Expected |
+|---|-----------|----------|
+| a | `marketing.home.*` | All 20+ keys resolve in `de.json` |
+| b | `marketing.home.*` | All 20+ keys resolve in `en.json` (English equivalents) |
+| c | `marketing.pricing.faq.storage.*` | question + answer keys present in both locales |
+| d | `marketing.pricing.plans.*.storage` | Storage labels present for each plan in both locales |
+
+---
+
+## Test Data
+
+### Backend
+
+- **Test club:** UUID `00000000-0000-0000-0000-000000000001`, `storageUsedBytes = 1073741824` (1 GB), `storageLimitBytes = 5368709120` (5 GB)
+- **Test documents:** 3 documents with `fileSize` = 100MB, 200MB, 773741824 bytes (total = 1 GB)
+- **Full quota club:** UUID `00000000-0000-0000-0000-000000000002`, `storageUsedBytes = storageLimitBytes = 5368709120`
+
+### Frontend E2E
+
+- Landing page, pricing, login pages are public — no auth setup needed for T-01 through T-13
+- Login form tests (T-08, T-10) require running backend with test user `admin@gruener-daumen.de` / `TestAdmin123!`
+
+---
+
+## Test Coverage
+
+| Component | Unit | Integration | E2E | Total |
+|-----------|------|-------------|-----|-------|
+| Landing page | 0 | 0 | 5 | 5 |
+| Login redesign | 0 | 0 | 5 | 5 |
+| Pricing update | 0 | 0 | 3 | 3 |
+| StorageQuotaService | 9 | 0 | 0 | 9 |
+| StorageController | 0 | 3 | 0 | 3 |
+| DocumentService (quota) | 0 | 2 | 0 | 2 |
+| DocumentController (402) | 0 | 1 | 0 | 1 |
+| Flyway migration | 0 | 2 | 0 | 2 |
+| Exception handling | 1 | 0 | 0 | 1 |
+| i18n verification | 1 | 0 | 0 | 1 |
+| **Total** | **11** | **8** | **13** | **32** |

pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>4.0.6</version>
+        <version>4.0.7</version>
         <relativePath/>
     </parent>