playwright stuff

- db: drop host :5432 publish (ports !override []) — no LAN exposure, reached
  via compose net (db:5432) + docker exec for the ALTER USER reconcile. Matches
  inspectflow isolation. backend :8081 kept (LAN-only, used by healthcheck).
- deploy verify-frontend: probe container loopback via bundled node instead of
  host :3000 wget. Network-namespace-independent; fixes the transient
  false-failure when polling mid-recreate. <500 = healthy (307->/login).

.env.example

@@ -0,0 +1,15 @@
+# CannaManage — Environment Variables
+# Copy this file to .env and fill in the values.
+# NEVER commit .env to git.
+
+# Database
+DB_PASSWORD=cannamanage_dev
+
+# JWT Secret — must be valid base64 (used by Decoders.BASE64.decode in JwtService)
+# Generate with: openssl rand -base64 48
+JWT_SECRET=
+
+# NextAuth / Auth.js secret — minimum 32 characters
+# Generate with: openssl rand -base64 32
+NEXTAUTH_SECRET=
+AUTH_SECRET=

.gitea/workflows/ci.yml

@@ -0,0 +1,195 @@
+name: CI — Build, Lint & Security Scan
+
+# Runs on every push to main. Must pass before deploy.
+# Security scans catch CVEs, license issues, and secrets BEFORE they reach prod.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Backend: compile + test + dependency audit
+  # ─────────────────────────────────────────────────────────────────────────────
+  backend:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: cannamanage_test
+          POSTGRES_USER: test
+          POSTGRES_PASSWORD: test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 21
+          cache: maven
+
+      - name: Maven compile
+        run: ./mvnw compile -B -q -DskipTests -T 1C
+
+      - name: Maven test
+        run: ./mvnw test -B -T 1C
+        env:
+          CI_POSTGRES_URL: jdbc:postgresql://localhost:5432/cannamanage_test
+          CI_POSTGRES_USER: test
+          CI_POSTGRES_PASSWORD: test
+
+      - name: OWASP Dependency-Check (SCA)
+        run: |
+          ./mvnw org.owasp:dependency-check-maven:check \
+            -DfailBuildOnCVSS=7 \
+            -DsuppressionFile=.snyk-maven-suppressions.xml \
+            -Dformats=JSON,HTML \
+            -B -q
+        # failBuildOnCVSS=7: High/Critical CVEs fail the build.
+        # Suppress known false positives in .snyk-maven-suppressions.xml.
+
+      - name: Upload dependency-check report
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: dependency-check-report
+          path: target/dependency-check-report.*
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Frontend: lint + type-check + dependency audit
+  # ─────────────────────────────────────────────────────────────────────────────
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install pnpm
+        run: corepack enable && corepack prepare pnpm@10.8.1 --activate
+
+      - name: Install dependencies
+        run: cd cannamanage-frontend && pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: cd cannamanage-frontend && pnpm lint
+
+      - name: Type check
+        run: cd cannamanage-frontend && pnpm type-check
+
+      - name: pnpm audit (SCA)
+        run: |
+          cd cannamanage-frontend
+          pnpm audit --audit-level=high
+        # Fails on High/Critical. Use .pnpmauditrc or --ignore for known exceptions.
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Docker image security scan (Trivy)
+  # ─────────────────────────────────────────────────────────────────────────────
+  image-scan:
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build images (parallel)
+        run: |
+          set -euo pipefail
+          docker build -t cannamanage-backend:scan -f Dockerfile.backend . &
+          PID1=$!
+          docker build -t cannamanage-frontend:scan -f cannamanage-frontend/Dockerfile cannamanage-frontend/ &
+          PID2=$!
+          wait $PID1 $PID2
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Scan backend image
+        run: |
+          trivy image \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            --ignore-unfixed \
+            --format table \
+            cannamanage-backend:scan
+
+      - name: Scan frontend image
+        run: |
+          trivy image \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            --ignore-unfixed \
+            --format table \
+            cannamanage-frontend:scan
+
+      - name: Scan backend image (full report — JSON)
+        if: always()
+        run: |
+          trivy image \
+            --format json \
+            --output trivy-backend.json \
+            cannamanage-backend:scan
+
+      - name: Scan frontend image (full report — JSON)
+        if: always()
+        run: |
+          trivy image \
+            --format json \
+            --output trivy-frontend.json \
+            cannamanage-frontend:scan
+
+      - name: Upload Trivy reports
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: trivy-reports
+          path: trivy-*.json
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Secret detection (Gitleaks)
+  # ─────────────────────────────────────────────────────────────────────────────
+  secrets-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
+            | tar -xz -C /usr/local/bin gitleaks
+
+      - name: Run Gitleaks
+        run: |
+          gitleaks detect \
+            --source . \
+            --report-format json \
+            --report-path gitleaks-report.json \
+            --exit-code 1
+
+      - name: Upload Gitleaks report
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: gitleaks-report
+          path: gitleaks-report.json

.gitea/workflows/deploy.yml

@@ -12,7 +12,8 @@ name: Deploy to TrueNAS
 #
 # Compose project name is pinned to "cannamanage" so it updates the existing
 # containers and reuses the persistent "cannamanage_pgdata" volume on the host.
-# Live ports: backend 8081->8080, frontend 3000, db 5432
+# Live host ports: frontend 3000, backend 8081->8080 (LAN, healthcheck/debug).
+# db is internal-only (no host publish) — reachable as db:5432 on the compose net.
 
 on:
   push:
@@ -28,6 +29,13 @@ jobs:
     runs-on: ubuntu-latest
     env:
       COMPOSE: docker compose -f docker-compose.yml -f docker-compose.truenas.yml -p cannamanage
+      # Production secrets — set in Gitea repo Settings → Actions → Secrets.
+      # AUTH_SECRET  : NextAuth v5 session secret (rotating invalidates sessions)
+      # JWT_SECRET   : base64 backend HMAC key (rotating invalidates all tokens)
+      # DB_PASSWORD  : Postgres role password (must match the live DB role)
+      AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
+      JWT_SECRET: ${{ secrets.JWT_SECRET }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
     steps:
       - name: Check out pushed commit
         uses: actions/checkout@v4
@@ -38,11 +46,39 @@ jobs:
           docker version --format 'docker {{.Server.Version}}'
           docker compose version
 
+      # NOTE: Backend tests (mvn test) and frontend lint (pnpm lint) are run locally
+      # before pushing. The self-hosted act runner uses Docker-in-Docker which doesn't
+      # support volume mounts for nested containers. Tests remain a local-only gate.
+
       - name: Build images
         run: |
           set -euo pipefail
           $COMPOSE build
 
+      - name: Ensure DB up & reconcile role password
+        run: |
+          set -euo pipefail
+          # Start just the db first (idempotent — reuses the running container
+          # and the persistent cannamanage_pgdata volume).
+          $COMPOSE up -d db
+          echo "Waiting for db to accept connections ..."
+          for i in $(seq 1 20); do
+            if docker exec cannamanage-db pg_isready -U cannamanage -q; then break; fi
+            echo "  attempt $i/20 — waiting 3s"; sleep 3
+          done
+          # POSTGRES_PASSWORD only applies on FIRST volume init, so the existing
+          # volume still holds the old role password. Force the live role to match
+          # the rotated ${DB_PASSWORD} so the backend can authenticate. Local
+          # socket connections inside the container use trust auth (no password).
+          # Skipped when the secret is unset to avoid blanking the dev password.
+          if [ -n "${DB_PASSWORD:-}" ]; then
+            docker exec cannamanage-db psql -U cannamanage -d cannamanage \
+              -c "ALTER USER cannamanage WITH PASSWORD '${DB_PASSWORD}';"
+            echo "✅ DB role password reconciled"
+          else
+            echo "⚠️  DB_PASSWORD secret not set — leaving role password unchanged"
+          fi
+
       - name: Roll out stack
         run: |
           set -euo pipefail
@@ -66,11 +102,25 @@ jobs:
 
       - name: Verify frontend
         run: |
-          if wget -q -O /dev/null http://192.168.188.119:3000; then
+          set -euo pipefail
-            echo "✅ Frontend responding on :3000"
+          # Probe the frontend on its own loopback INSIDE the container via the
-          else
+          # bundled node runtime. This is network-namespace-independent (no
-            echo "⚠️ Frontend not responding yet (may still be starting)"
+          # reliance on the host port being wired during a mid-recreate window,
-          fi
+          # which caused a transient false-failure previously) and needs no
+          # wget/curl in the image. Any HTTP status < 500 counts as "up" — the
+          # root path returns 307 -> /login when unauthenticated, which is healthy.
+          echo "Waiting for frontend on container loopback :3000 ..."
+          for i in $(seq 1 20); do
+            if docker exec cannamanage-frontend node -e "require('http').get('http://127.0.0.1:3000/',r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"; then
+              echo "✅ Frontend responding after ${i} attempt(s)"
+              exit 0
+            fi
+            echo "  attempt $i/20 — waiting 5s"
+            sleep 5
+          done
+          echo "❌ Frontend did not respond — recent logs:"
+          $COMPOSE logs --tail=40 frontend
+          exit 1
 
       - name: Prune dangling images
         run: docker image prune -f || true

.gitignore

@@ -15,3 +15,5 @@ cannamanage-frontend/.env.local
 
 # Production secrets (never commit)
 .env
+~/
+~/

.playwright-mcp/page-2026-06-16T18-24-49-418Z.yml

@@ -0,0 +1,189 @@
+- generic [active] [ref=e1]:
+  - generic [ref=e2]:
+    - navigation "Navigation Bar" [ref=e3]:
+      - generic [ref=e4]:
+        - link "Home" [ref=e5] [cursor=pointer]:
+          - /url: /
+          - img [ref=e6]
+        - link "Explore" [ref=e7] [cursor=pointer]:
+          - /url: /explore/repos
+        - link "Help" [ref=e8] [cursor=pointer]:
+          - /url: https://docs.gitea.com
+      - generic [ref=e9]:
+        - link "Register" [ref=e10] [cursor=pointer]:
+          - /url: /user/sign_up
+          - img [ref=e11]
+          - generic [ref=e13]: Register
+        - link "Sign In" [ref=e14] [cursor=pointer]:
+          - /url: /user/login
+          - img [ref=e15]
+          - generic [ref=e17]: Sign In
+    - generic [ref=e18]:
+      - generic [ref=e19]:
+        - generic [ref=e21]:
+          - generic [ref=e22]:
+            - img [ref=e24]
+            - generic [ref=e27]:
+              - link "pplate" [ref=e28] [cursor=pointer]:
+                - /url: /pplate
+              - text: /
+              - link "cannamanage" [ref=e29] [cursor=pointer]:
+                - /url: /pplate/cannamanage
+          - generic [ref=e30]:
+            - link "RSS Feed" [ref=e31] [cursor=pointer]:
+              - /url: /pplate/cannamanage.rss
+              - img [ref=e32]
+            - generic "Sign in to watch this repository." [ref=e35] [cursor=pointer]:
+              - button "Watch" [disabled]:
+                - img
+                - generic: Watch
+              - link "1" [ref=e36]:
+                - /url: /pplate/cannamanage/watchers
+            - generic "Sign in to star this repository." [ref=e38] [cursor=pointer]:
+              - button "Star" [disabled]:
+                - img
+                - generic: Star
+              - link "0" [ref=e39]:
+                - /url: /pplate/cannamanage/stars
+            - generic "Sign in to fork this repository.":
+              - generic:
+                - img
+                - generic: Fork
+              - link "0":
+                - /url: /pplate/cannamanage/forks
+        - navigation [ref=e41]:
+          - generic [ref=e42]:
+            - link "Code" [ref=e43] [cursor=pointer]:
+              - /url: /pplate/cannamanage/src/
+              - img [ref=e44]
+              - generic [ref=e46]: Code
+            - link "Issues 9" [ref=e47] [cursor=pointer]:
+              - /url: /pplate/cannamanage/issues
+              - img [ref=e48]
+              - generic [ref=e51]: Issues
+              - generic [ref=e52]: "9"
+            - link "Pull Requests" [ref=e53] [cursor=pointer]:
+              - /url: /pplate/cannamanage/pulls
+              - img [ref=e54]
+              - generic [ref=e56]: Pull Requests
+            - link "Actions" [ref=e57] [cursor=pointer]:
+              - /url: /pplate/cannamanage/actions
+              - img [ref=e58]
+              - generic [ref=e60]: Actions
+            - link "Packages" [ref=e61] [cursor=pointer]:
+              - /url: /pplate/cannamanage/packages
+              - img [ref=e62]
+              - generic [ref=e64]: Packages
+            - link "Projects" [ref=e65] [cursor=pointer]:
+              - /url: /pplate/cannamanage/projects
+              - img [ref=e66]
+              - generic [ref=e68]: Projects
+            - link "Releases" [ref=e69] [cursor=pointer]:
+              - /url: /pplate/cannamanage/releases
+              - img [ref=e70]
+              - generic [ref=e72]: Releases
+            - link "Wiki" [ref=e73] [cursor=pointer]:
+              - /url: /pplate/cannamanage/wiki
+              - img [ref=e74]
+              - generic [ref=e76]: Wiki
+            - link "Activity" [ref=e77] [cursor=pointer]:
+              - /url: /pplate/cannamanage/activity
+              - img [ref=e78]
+              - generic [ref=e80]: Activity
+      - generic [ref=e83]:
+        - generic [ref=e84]:
+          - generic [ref=e86]:
+            - generic "Failure" [ref=e87]:
+              - img [ref=e88]
+            - 'heading "ci(deploy): auto-deploy to TrueNAS via self-hosted Gitea Actions runner" [level=2] [ref=e90]'
+          - generic [ref=e91]:
+            - generic [ref=e92]:
+              - link "deploy.yml" [ref=e93] [cursor=pointer]:
+                - /url: /pplate/cannamanage/actions/?workflow=deploy.yml
+              - text: ":"
+            - text: Commit
+            - link "3b15d7439d" [ref=e94] [cursor=pointer]:
+              - /url: /pplate/cannamanage/commit/3b15d7439dceb6cb073f871a0955b0acd31630ee
+            - text: pushed by
+            - link "pplate" [ref=e95] [cursor=pointer]:
+              - /url: /pplate
+            - link "main" [ref=e97] [cursor=pointer]:
+              - /url: /pplate/cannamanage/src/branch/main
+        - generic [ref=e98]:
+          - generic [ref=e99]:
+            - link "Summary" [ref=e100] [cursor=pointer]:
+              - /url: /pplate/cannamanage/actions/runs/29
+              - img [ref=e101]
+              - generic [ref=e103]: Summary
+            - generic [ref=e105]: All jobs
+            - list [ref=e106]:
+              - listitem [ref=e107]:
+                - link "Failure deploy 3s" [ref=e108] [cursor=pointer]:
+                  - /url: /pplate/cannamanage/actions/runs/29/jobs/57
+                  - generic "Failure" [ref=e109]:
+                    - img [ref=e110]
+                  - generic [ref=e112]: deploy
+                  - generic [ref=e113]: 3s
+            - generic [ref=e115]: Run Details
+            - list [ref=e116]:
+              - listitem [ref=e117]:
+                - link "Workflow file" [ref=e118] [cursor=pointer]:
+                  - /url: /pplate/cannamanage/actions/runs/29/workflow
+                  - img [ref=e119]
+                  - generic [ref=e121]: Workflow file
+          - generic [ref=e123]:
+            - generic [ref=e124]:
+              - generic [ref=e125]:
+                - text: Triggered via push •
+                - generic "Jun 16, 2026, 6:52 PM" [ref=e126]: 1 hour ago
+              - generic [ref=e127]:
+                - generic "Failure" [ref=e128]:
+                  - img [ref=e129]
+                - generic [ref=e131]: Failure
+                - text: •
+                - generic [ref=e132]: "Total duration: 3s"
+            - generic [ref=e133]:
+              - generic [ref=e134]:
+                - heading "Workflow Dependencies" [level=4] [ref=e135]
+                - generic [ref=e136]:
+                  - text: 1 jobs • 0 dependencies
+                  - generic [ref=e137]: • 0% success
+                - generic [ref=e138]:
+                  - button "Already at 100% zoom" [disabled]:
+                    - img
+                  - button "Reset view" [ref=e139] [cursor=pointer]:
+                    - img [ref=e140]
+                  - button "Zoom out (Ctrl/Cmd + scroll on graph)" [ref=e142] [cursor=pointer]:
+                    - img [ref=e143]
+              - img [ref=e147]:
+                - generic "deploy" [ref=e148] [cursor=pointer]:
+                  - generic:
+                    - generic:
+                      - generic "failure":
+                        - img
+                  - generic [ref=e151]:
+                    - generic: deploy
+                    - generic: 3s
+  - group "Footer" [ref=e152]:
+    - contentinfo "About Software" [ref=e153]:
+      - link "Powered by Gitea" [ref=e154] [cursor=pointer]:
+        - /url: https://about.gitea.com
+      - generic [ref=e155]: "Version: 1.26.2"
+      - generic [ref=e156]:
+        - text: "Page:"
+        - strong [ref=e157]: 3ms
+        - text: "Template:"
+        - strong [ref=e158]: 1ms
+    - group "Links" [ref=e159]:
+      - menu [ref=e160] [cursor=pointer]:
+        - generic [ref=e162]:
+          - img [ref=e163]
+          - text: Auto
+      - menu [ref=e165] [cursor=pointer]:
+        - generic [ref=e166]:
+          - img [ref=e167]
+          - text: English
+      - link "Licenses" [ref=e169] [cursor=pointer]:
+        - /url: /assets/licenses.txt
+      - link "API" [ref=e170] [cursor=pointer]:
+        - /url: /api/swagger

.snyk

@@ -0,0 +1,19 @@
+# Snyk (https://snyk.io) policy file — managed by Lumen
+# Ignores documented false positives and accepted risks.
+version: v1.25.0
+language-settings:
+  java:
+    countUntriaged: false
+
+ignore:
+  # CSRF disabled on stateless JWT API chain — intentional and correct per OWASP:
+  # "If your application does not use cookies for authentication, CSRF is not a risk."
+  # The API security filter chain (Order 1) uses Authorization: Bearer tokens only.
+  # The portal filter chain (Order 2) correctly enables CSRF via CookieCsrfTokenRepository.
+  SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-CSRF:
+    - 'cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java':
+        reason: >-
+          Stateless JWT API — CSRF not applicable. Browser never auto-sends
+          Bearer tokens. Portal chain has CSRF enabled via CookieCsrfTokenRepository.
+        expires: 2027-06-19T00:00:00.000Z
+        created: 2026-06-19T07:00:00.000Z

README.md

@@ -1,111 +1,87 @@
 # CannaManage
 
-Multi-tenant cannabis club management platform for German **Anbauvereinigungen** (cultivation associations) under CanG §19.
+Full-stack management platform for German cannabis cultivation associations (Anbauvereinigungen) under the CanG/KCanG regulatory framework.
-
-## Overview
-
-CannaManage handles member management, distribution tracking, and legal compliance for cannabis cultivation clubs in Germany. It enforces the strict quotas mandated by the Cannabis Act (CanG) — including monthly limits (50g adult / 30g under-21), daily limits (25g), and THC restrictions for minors.
 
 ## Tech Stack
 
-| Component | Technology |
+| Layer | Technology |
-|-----------|-----------|
+|-------|-----------|
-| Runtime | Java 21 (Temurin) |
+| **Frontend** | Next.js 15, React 19, TypeScript, Tailwind CSS 4, shadcn/ui |
-| Framework | Spring Boot 4.0.6 |
+| **Backend** | Spring Boot 3.5, Java 17, Spring Security (JWT + session) |
-| Security | Spring Security 7.0 + JWT (JJWT 0.12.6) |
+| **Database** | PostgreSQL 16, Flyway migrations |
-| ORM | Hibernate 7 / JPA |
+| **Infrastructure** | Docker Compose, Gitea Actions CI/CD, TrueNAS deployment |
-| Database | PostgreSQL (prod), H2 (test) |
-| Migrations | Flyway 10 |
-| API Docs | SpringDoc OpenAPI 2.8.6 |
-| Build | Maven (multi-module) |
-| Container | Docker Compose (Postgres + app) |
 
 ## Project Structure
 
 ```
 cannamanage/
-├── cannamanage-domain/      # JPA entities, enums, TenantContext
+├── cannamanage-api/        # Spring Boot REST API (entry point)
-├── cannamanage-service/     # Business logic, repositories, ComplianceService
+├── cannamanage-service/    # Business logic layer
-├── cannamanage-api/         # Spring Boot app, controllers, security, DTOs
+├── cannamanage-domain/     # JPA entities, enums, value objects
-├── docs/
+├── cannamanage-frontend/   # Next.js frontend (pnpm)
-│   └── sprint-2/           # Sprint planning docs
+├── deploy/                 # Deployment scripts & nginx config
-└── docker-compose.yml       # Local dev environment
+├── docker-compose.yml      # Local development stack
+└── .gitea/workflows/       # CI/CD pipeline
 ```
 
-## Modules
+## Local Development
 
-### cannamanage-domain
+### Prerequisites
-JPA entities with multi-tenant isolation via `@Filter("tenantFilter")`:
-- `Member` — club members with age tracking
-- `Distribution` — cannabis distribution records
-- `MonthlyQuota` — per-member monthly usage tracking
-- `Batch` / `Strain` / `StockMovement` — inventory management
-- `Club` — association registration
-- `User` — authentication accounts
 
-### cannamanage-service
+- Java 17+
-- `ComplianceService` — CanG §19 quota enforcement (25 unit tests)
+- Maven 3.9+
-- Repositories for all entities
+- Node.js 22+ with pnpm 10+
+- Docker & Docker Compose
 
-### cannamanage-api
+### Backend
-- **Auth** — JWT login + refresh token rotation (SHA-256 hashed)
-- **Members** — CRUD for association members
-- **Distributions** — compliance-gated distribution recording
-- **Stock** — batch and inventory management
-- **Compliance** — quota status API
-- Multi-tenant isolation via `TenantFilterAspect` (Hibernate @Filter activation)
-
-## API Endpoints
-
-| Method | Path | Auth | Description |
-|--------|------|------|-------------|
-| POST | `/api/v1/auth/login` | Public | Login with email + password |
-| POST | `/api/v1/auth/refresh` | Public | Refresh token rotation |
-| GET | `/api/v1/compliance/quota/{memberId}` | ADMIN, MEMBER | Monthly quota status |
-| GET/POST/PUT | `/api/v1/members/**` | ADMIN, MEMBER | Member CRUD |
-| POST | `/api/v1/distributions/**` | ADMIN, MEMBER | Record distributions |
-| GET/POST | `/api/v1/stock/**` | ADMIN | Stock management |
-
-Swagger UI: `http://localhost:8080/swagger-ui.html`
-
-## Running Locally
 
 ```bash
 # Start PostgreSQL
-docker compose up -d
+docker compose up -d db
 
-# Run the app
+# Run Spring Boot
-JAVA_HOME=/path/to/jdk-21 ./mvnw spring-boot:run -pl cannamanage-api
+mvn spring-boot:run -f cannamanage-api/pom.xml -Dspring-boot.run.profiles=local
-
-# Run all tests (H2 in-memory)
-JAVA_HOME=/path/to/jdk-21 ./mvnw clean verify
 ```
 
-## Testing
+### Frontend
 
-- **37 tests total** — all green
+```bash
-- 25 unit tests (`ComplianceServiceTest`) — quota enforcement logic
+cd cannamanage-frontend
-- 7 integration tests (`AuthControllerIntegrationTest`) — full HTTP auth flow
+pnpm install
-- 5 integration tests (`ComplianceControllerIntegrationTest`) — quota API with JWT
+pnpm dev
+```
 
-Integration tests use `@SpringBootTest(webEnvironment = RANDOM_PORT)` with H2 and Spring's `RestClient`.
+The frontend runs on http://localhost:3000, backend on http://localhost:8080.
 
-## Security Model
+### Full Stack (Docker)
 
-- **Stateless JWT** — no session, no UserDetailsService
+```bash
-- **Roles**: ADMIN (full access), MEMBER (self-service), STAFF (Sprint 3)
+docker compose up --build
-- **Multi-tenancy**: Hibernate `@Filter` activated per-request via AOP aspect
+```
-- **Refresh tokens**: SHA-256 hashed (Spring Security 7 enforces BCrypt 72-byte limit)
-- Token rotation on refresh — old tokens invalidated
 
-## Sprint History
+## Deployment
 
-| Sprint | Focus | Status |
+Push to `main` triggers the Gitea Actions CI pipeline which:
-|--------|-------|--------|
+1. Runs backend tests (`mvn test`)
-| 1 | Domain entities, ComplianceService, 25 tests | ✅ Done |
+2. Runs frontend lint (`pnpm lint`)
-| 2 | REST API, Spring Security, JWT, OpenAPI, integration tests | ✅ Done |
+3. Builds Docker images
-| 3 | Member portal, STAFF role, real-time notifications | 📋 Planned |
+4. Deploys to TrueNAS via Docker Compose
+5. Verifies backend health + frontend availability
+
+Manual deploy:
+```bash
+cd deploy && ./deploy.sh
+```
+
+## Environment Variables
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `CANNAMANAGE_SECURITY_JWT_SECRET` | JWT signing key (base64, 256-bit) | — (required) |
+| `CORS_ORIGINS` | Allowed CORS origins (comma-separated) | `http://localhost:3000` |
+| `SMTP_HOST` / `SMTP_PORT` | Mail server for invites | `localhost:1025` |
+| `SCHEDULERS_ENABLED` | Enable background jobs | `true` |
 
 ## License
 
-Private — Patrick Plate
+Proprietary — Patrick Plate

cannamanage-api/pom.xml

@@ -140,6 +140,17 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-websocket</artifactId>
         </dependency>
+        <!-- Rate limiting (Bucket4j + Caffeine cache) -->
+        <dependency>
+            <groupId>com.bucket4j</groupId>
+            <artifactId>bucket4j-core</artifactId>
+            <version>8.10.1</version>
+        </dependency>
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+            <version>3.1.8</version>
+        </dependency>
     </dependencies>
 
     <build>

cannamanage-api/src/main/java/de/cannamanage/api/controller/DocumentController.java

@@ -9,6 +9,7 @@ import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.server.ResponseStatusException;
@@ -21,6 +22,7 @@ import java.util.UUID;
 
 @RestController
 @RequestMapping("/api/v1")
+@PreAuthorize("hasAnyRole('ADMIN', 'STAFF', 'MEMBER')")
 public class DocumentController {
 
     private final DocumentService documentService;
@@ -33,13 +35,14 @@ public class DocumentController {
      * Verify the requested document belongs to the caller's current tenant (club).
      * Prevents IDOR: a user from club A must not be able to download/delete a document of club B
      * just by guessing or enumerating the document UUID.
+     * Returns 404 (not 403) to avoid revealing document existence to other tenants.
      */
     private Document loadOwnedDocument(UUID documentId) {
         Document doc = documentService.getDocument(documentId);
         UUID currentTenantId = TenantContext.getCurrentTenant();
         if (currentTenantId == null || doc.getClubId() == null || !doc.getClubId().equals(currentTenantId)) {
-            // Use 403 (not 404) — caller is authenticated, just not authorized for this resource.
+            // Return 404 to prevent information leakage about document existence across tenants
-            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Access denied to document");
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "Document not found");
         }
         return doc;
     }
@@ -78,6 +81,7 @@ public class DocumentController {
     }
 
     @DeleteMapping("/documents/{id}")
+    @PreAuthorize("hasAnyRole('ADMIN', 'STAFF')")
     public ResponseEntity<Void> deleteDocument(
             @PathVariable UUID id,
             @RequestParam UUID clubId,
@@ -87,7 +91,7 @@ public class DocumentController {
         Document doc = loadOwnedDocument(id);
         UUID currentTenantId = TenantContext.getCurrentTenant();
         if (!clubId.equals(currentTenantId)) {
-            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Tenant mismatch");
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "Document not found");
         }
         UUID userId = UUID.fromString(principal.getName());
         documentService.deleteDocument(id, userId, doc.getClubId());

cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java

@@ -0,0 +1,34 @@
+package de.cannamanage.api.controller;
+
+import de.cannamanage.domain.entity.TenantContext;
+import de.cannamanage.service.StorageQuotaService;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.UUID;
+
+/**
+ * REST controller for storage quota information.
+ * Provides endpoint to check current storage usage for the caller's club.
+ * Club ID is extracted from the JWT/tenant context — not from request params.
+ */
+@RestController
+@RequestMapping("/api/v1/storage")
+@PreAuthorize("hasAnyRole('ADMIN', 'STAFF')")
+public class StorageController {
+
+    private final StorageQuotaService storageQuotaService;
+
+    public StorageController(StorageQuotaService storageQuotaService) {
+        this.storageQuotaService = storageQuotaService;
+    }
+
+    @GetMapping("/usage")
+    public ResponseEntity<StorageQuotaService.StorageUsageDTO> getUsage() {
+        UUID clubId = TenantContext.getCurrentTenant();
+        return ResponseEntity.ok(storageQuotaService.getUsage(clubId));
+    }
+}

cannamanage-api/src/main/java/de/cannamanage/api/controller/TestResetController.java

@@ -0,0 +1,93 @@
+package de.cannamanage.api.controller;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.http.ResponseEntity;
+import org.springframework.jdbc.datasource.init.ResourceDatabasePopulator;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.sql.DataSource;
+import java.sql.Connection;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Test-only controller for resetting the database to a known seed state.
+ * Only active when cannamanage.test.endpoints.enabled=true (test profile).
+ * NEVER activate this in production.
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/test")
+@RequiredArgsConstructor
+@ConditionalOnProperty(name = "cannamanage.test.endpoints.enabled", havingValue = "true")
+public class TestResetController {
+
+    private final DataSource dataSource;
+
+    /**
+     * Truncates all application tables and re-seeds with test data.
+     * The Flyway schema_history table is preserved.
+     */
+    @PostMapping("/reset-db")
+    public ResponseEntity<Void> resetDatabase() {
+        log.info("Test DB reset requested — truncating all tables and re-seeding");
+
+        try (Connection conn = dataSource.getConnection()) {
+            truncateAllTables(conn);
+            reseed();
+            log.info("Test DB reset complete — seed data re-applied");
+            return ResponseEntity.ok().build();
+        } catch (SQLException e) {
+            log.error("Failed to reset test database", e);
+            return ResponseEntity.internalServerError().build();
+        }
+    }
+
+    private void truncateAllTables(Connection conn) throws SQLException {
+        List<String> tables = getApplicationTables(conn);
+
+        try (Statement stmt = conn.createStatement()) {
+            // Disable FK constraints for truncation
+            stmt.execute("SET session_replication_role = 'replica'");
+
+            for (String table : tables) {
+                stmt.execute("TRUNCATE TABLE " + table + " CASCADE");
+                log.debug("Truncated table: {}", table);
+            }
+
+            // Re-enable FK constraints
+            stmt.execute("SET session_replication_role = 'origin'");
+        }
+    }
+
+    private List<String> getApplicationTables(Connection conn) throws SQLException {
+        List<String> tables = new ArrayList<>();
+
+        try (Statement stmt = conn.createStatement();
+             ResultSet rs = stmt.executeQuery(
+                     "SELECT tablename FROM pg_tables " +
+                     "WHERE schemaname = 'public' " +
+                     "AND tablename != 'flyway_schema_history'")) {
+            while (rs.next()) {
+                tables.add(rs.getString("tablename"));
+            }
+        }
+
+        return tables;
+    }
+
+    private void reseed() {
+        ResourceDatabasePopulator populator = new ResourceDatabasePopulator();
+        populator.addScript(new ClassPathResource("db/testdata/R__seed_test_data.sql"));
+        populator.setSeparator(";");
+        populator.execute(dataSource);
+    }
+}

cannamanage-api/src/main/java/de/cannamanage/api/exception/GlobalExceptionHandler.java

@@ -5,6 +5,7 @@ import de.cannamanage.service.exception.BatchNotFoundException;
 import de.cannamanage.service.exception.MemberNotFoundException;
 import de.cannamanage.service.exception.PreventionOfficerLimitExceededException;
 import de.cannamanage.service.exception.QuotaExceededException;
+import de.cannamanage.service.exception.StorageQuotaExceededException;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ProblemDetail;
@@ -121,6 +122,20 @@ public class GlobalExceptionHandler {
         return problem;
     }
 
+    @ExceptionHandler(StorageQuotaExceededException.class)
+    public ProblemDetail handleStorageQuotaExceeded(StorageQuotaExceededException ex) {
+        ProblemDetail problem = ProblemDetail.forStatusAndDetail(
+                HttpStatus.PAYMENT_REQUIRED, ex.getMessage());
+        problem.setTitle("Storage Quota Exceeded");
+        problem.setType(URI.create("urn:cannamanage:error:STORAGE_QUOTA_EXCEEDED"));
+        problem.setProperty("code", "STORAGE_QUOTA_EXCEEDED");
+        problem.setProperty("currentUsage", ex.getCurrentUsage());
+        problem.setProperty("limit", ex.getLimit());
+        problem.setProperty("requestedBytes", ex.getRequestedBytes());
+        problem.setProperty("timestamp", Instant.now().toString());
+        return problem;
+    }
+
     @ExceptionHandler(ResponseStatusException.class)
     public ProblemDetail handleResponseStatus(ResponseStatusException ex) {
         ProblemDetail problem = ProblemDetail.forStatusAndDetail(

cannamanage-api/src/main/java/de/cannamanage/api/security/LoginRateLimitFilter.java

@@ -0,0 +1,77 @@
+package de.cannamanage.api.security;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import io.github.bucket4j.Bandwidth;
+import io.github.bucket4j.Bucket;
+import io.github.bucket4j.ConsumptionProbe;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+import java.time.Duration;
+
+/**
+ * Rate-limits login attempts per client IP using Bucket4j + Caffeine cache.
+ * Allows 5 login attempts per minute per IP; returns 429 when exhausted.
+ */
+@Component
+@Order(1)
+public class LoginRateLimitFilter extends OncePerRequestFilter {
+
+    private static final String LOGIN_PATH = "/api/v1/auth/login";
+    private static final int CAPACITY = 5;
+    private static final Duration REFILL_PERIOD = Duration.ofMinutes(1);
+
+    private final Cache<String, Bucket> buckets = Caffeine.newBuilder()
+            .maximumSize(10_000)
+            .expireAfterAccess(Duration.ofMinutes(10))
+            .build();
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain filterChain) throws ServletException, IOException {
+        if (!"POST".equalsIgnoreCase(request.getMethod()) || !LOGIN_PATH.equals(request.getRequestURI())) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        String clientIp = resolveClientIp(request);
+        Bucket bucket = buckets.get(clientIp, k -> createBucket());
+
+        ConsumptionProbe probe = bucket.tryConsumeAndReturnRemaining(1);
+        if (probe.isConsumed()) {
+            filterChain.doFilter(request, response);
+        } else {
+            long waitSeconds = probe.getNanosToWaitForRefill() / 1_000_000_000 + 1;
+            response.setStatus(429);
+            response.setHeader("Retry-After", String.valueOf(waitSeconds));
+            response.setContentType("application/json");
+            response.getWriter().write("{\"error\":\"Too many login attempts. Retry after " + waitSeconds + "s\"}");
+        }
+    }
+
+    private Bucket createBucket() {
+        return Bucket.builder()
+                .addLimit(Bandwidth.builder()
+                        .capacity(CAPACITY)
+                        .refillGreedy(CAPACITY, REFILL_PERIOD)
+                        .build())
+                .build();
+    }
+
+    private String resolveClientIp(HttpServletRequest request) {
+        String xff = request.getHeader("X-Forwarded-For");
+        if (xff != null && !xff.isBlank()) {
+            // Take the first IP in the chain (original client)
+            return xff.split(",")[0].trim();
+        }
+        return request.getRemoteAddr();
+    }
+}

cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java

@@ -5,6 +5,7 @@ import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -53,6 +54,13 @@ public class SecurityConfig {
         http
                 .securityMatcher("/api/**")
                 .cors(cors -> cors.configurationSource(corsConfigurationSource()))
+                // snyk:ignore java/CsrfProtectionDisabled — Intentional: this filter chain
+                // handles stateless JWT-authenticated API calls only. CSRF attacks exploit
+                // browser-managed session cookies; Bearer token auth is immune because the
+                // token is never sent automatically by the browser. OWASP CSRF Prevention
+                // Cheat Sheet: "If your application does not use cookies for authentication,
+                // CSRF is not a risk." The portal chain (Order 2) correctly enables CSRF via
+                // CookieCsrfTokenRepository for its session-based auth.
                 .csrf(csrf -> csrf.disable())
                 .sessionManagement(session -> session
                         .sessionCreationPolicy(SessionCreationPolicy.STATELESS))
@@ -71,10 +79,13 @@ public class SecurityConfig {
                         .requestMatchers("/api/v1/stock/**").hasAnyRole("ADMIN", "STAFF")
                         .requestMatchers("/api/v1/compliance/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
                         .requestMatchers("/api/v1/reports/**").hasRole("ADMIN")
-                        // Documents endpoint — explicit listing for defense-in-depth so it can
+                        // Documents endpoint — method-specific matchers for defense-in-depth.
-                        // never accidentally end up in a permitAll() rule above. Per-document
+                        // POST (upload) and DELETE restricted to ADMIN/STAFF; GET allowed for all
-                        // tenant ownership is additionally enforced in DocumentController.
+                        // authenticated roles. Per-document tenant ownership is additionally
-                        .requestMatchers("/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
+                        // enforced in DocumentController via TenantContext.
+                        .requestMatchers(HttpMethod.GET, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
+                        .requestMatchers(HttpMethod.POST, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
+                        .requestMatchers(HttpMethod.DELETE, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
                         .anyRequest().authenticated())
                 .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
 

cannamanage-api/src/main/java/de/cannamanage/api/service/AuthService.java

@@ -34,6 +34,8 @@ import java.util.UUID;
 @RequiredArgsConstructor
 public class AuthService {
 
+    private static final String INVALID_CREDENTIALS = "Invalid credentials";
+
     private final UserRepository userRepository;
     private final JwtService jwtService;
     private final PasswordEncoder passwordEncoder;
@@ -43,14 +45,14 @@ public class AuthService {
     @Transactional
     public LoginResponse login(LoginRequest request) {
         User user = userRepository.findByEmail(request.email())
-                .orElseThrow(() -> new AuthenticationException("Invalid credentials"));
+                .orElseThrow(() -> new AuthenticationException(INVALID_CREDENTIALS));
 
         if (!user.isActive()) {
             throw new AuthenticationException("Account not activated");
         }
 
         if (!passwordEncoder.matches(request.password(), user.getPasswordHash())) {
-            throw new AuthenticationException("Invalid credentials");
+            throw new AuthenticationException(INVALID_CREDENTIALS);
         }
 
         // Generate tokens
@@ -147,7 +149,7 @@ public class AuthService {
             byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
             return HexFormat.of().formatHex(hash);
         } catch (NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA-256 not available", e);
+            throw new IllegalStateException("SHA-256 not available", e);
         }
     }
 

cannamanage-api/src/main/resources/application-test.properties

@@ -0,0 +1,31 @@
+# =============================================
+# application-test.properties
+# Profile: test — for integration test environment
+# Activate with: -Dspring.profiles.active=test
+# =============================================
+
+# Database: use docker-compose.test.yml PostgreSQL
+spring.datasource.url=jdbc:postgresql://localhost:5433/cannamanage_test
+spring.datasource.username=cannamanage_test
+spring.datasource.password=test_password
+spring.jpa.hibernate.ddl-auto=validate
+
+# Flyway: include test seed data
+spring.flyway.enabled=true
+spring.flyway.locations=classpath:db/migration,classpath:db/testdata
+
+# Enable test-only endpoints (TestResetController)
+cannamanage.test.endpoints.enabled=true
+
+# Disable schedulers during test runs
+cannamanage.schedulers.enabled=false
+
+# JWT: deterministic test secret (base64-encoded 256-bit key)
+cannamanage.security.jwt.secret=dGVzdC1zZWNyZXQta2V5LWZvci1pbnRlZ3JhdGlvbi10ZXN0cy1vbmx5LTMyYg==
+cannamanage.security.jwt.access-token-expiry=3600
+cannamanage.security.jwt.refresh-token-expiry=86400
+
+# Logging
+logging.level.de.cannamanage=DEBUG
+logging.level.org.flywaydb=INFO
+logging.level.org.springframework.security=DEBUG

cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql

@@ -0,0 +1,9 @@
+-- V36: Add storage quota tracking to clubs
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_used_bytes BIGINT DEFAULT 0;
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_limit_bytes BIGINT DEFAULT 5368709120;
+-- Default: 5 GB (5 * 1024^3) = Starter tier
+
+-- Backfill existing clubs with actual usage
+UPDATE clubs c SET storage_used_bytes = COALESCE(
+    (SELECT SUM(d.file_size) FROM documents d WHERE d.club_id = c.id), 0
+);

cannamanage-api/src/main/resources/db/testdata/R__seed_test_data.sql

@@ -0,0 +1,265 @@
+-- R__seed_test_data.sql — Repeatable Flyway migration for integration test data
+-- This file is idempotent: uses ON CONFLICT DO NOTHING for all inserts.
+-- Activated only when spring.flyway.locations includes classpath:db/testdata
+
+-- ============================================================
+-- 1. CLUB
+-- ============================================================
+INSERT INTO clubs (id, tenant_id, name, address, license_number, max_members, status, created_at)
+VALUES (
+    'a0000000-0000-0000-0000-000000000001',
+    'a0000000-0000-0000-0000-000000000001',
+    'Grüner Daumen e.V.',
+    'Hanfstraße 42, 10115 Berlin',
+    'LIC-2024-GD-001',
+    500,
+    'ACTIVE',
+    '2024-01-01T00:00:00Z'
+) ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 2. MEMBERS (7)
+-- ============================================================
+INSERT INTO members (id, tenant_id, club_id, first_name, last_name, email, date_of_birth, membership_date, membership_number, status, is_under_21, prevention_officer, created_at)
+VALUES
+    ('c1000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Max', 'Mustermann', 'max@gruener-daumen.de', '1990-05-20', '2024-01-15', 'GD-001', 'ACTIVE', FALSE, FALSE, '2024-01-15T10:00:00Z'),
+    ('c1000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Anna', 'Schmidt', 'anna@gruener-daumen.de', '1985-11-03', '2024-02-01', 'GD-002', 'ACTIVE', FALSE, FALSE, '2024-02-01T10:00:00Z'),
+    ('c1000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Jonas', 'Weber', 'jonas@gruener-daumen.de', '2006-03-15', '2024-03-10', 'GD-003', 'ACTIVE', TRUE, FALSE, '2024-03-10T10:00:00Z'),
+    ('c1000000-0000-0000-0000-000000000004', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Maria', 'Müller', 'maria@gruener-daumen.de', '1978-08-22', '2023-06-01', 'GD-004', 'SUSPENDED', FALSE, FALSE, '2023-06-01T10:00:00Z'),
+    ('c1000000-0000-0000-0000-000000000005', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Thomas', 'Müller', 'thomas@gruener-daumen.de', '1992-12-01', '2024-01-20', 'GD-005', 'ACTIVE', FALSE, FALSE, '2024-01-20T10:00:00Z'),
+    ('c1000000-0000-0000-0000-000000000006', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Lisa', 'Bauer', 'lisa@gruener-daumen.de', '1995-07-14', '2024-04-01', 'GD-006', 'ACTIVE', FALSE, FALSE, '2024-04-01T10:00:00Z'),
+    ('c1000000-0000-0000-0000-000000000007', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Karl', 'Fischer', 'karl@gruener-daumen.de', '1980-02-28', '2023-01-01', 'GD-007', 'EXPELLED', FALSE, FALSE, '2023-01-01T10:00:00Z')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 3. USERS (admin staff account)
+-- ============================================================
+INSERT INTO users (id, tenant_id, member_id, email, password_hash, role, active, created_at)
+VALUES (
+    'b1000000-0000-0000-0000-000000000001',
+    'a0000000-0000-0000-0000-000000000001',
+    'c1000000-0000-0000-0000-000000000001',
+    'admin@gruener-daumen.de',
+    '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy',
+    'ROLE_ADMIN',
+    TRUE,
+    '2024-01-15T10:00:00Z'
+) ON CONFLICT (id) DO NOTHING;
+
+-- Additional user accounts for members who need to author forum/info-board posts
+INSERT INTO users (id, tenant_id, member_id, email, password_hash, role, active, created_at)
+VALUES
+    ('b1000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001', 'c1000000-0000-0000-0000-000000000002',
+     'anna.user@gruener-daumen.de', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', 'ROLE_MEMBER', TRUE, '2024-02-01T10:00:00Z'),
+    ('b1000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001', 'c1000000-0000-0000-0000-000000000003',
+     'jonas.user@gruener-daumen.de', '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy', 'ROLE_MEMBER', TRUE, '2024-03-10T10:00:00Z')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 4. STRAINS (3)
+-- ============================================================
+INSERT INTO strains (id, tenant_id, name, thc_percentage, cbd_percentage, description, created_at)
+VALUES
+    ('d1000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Northern Lights', 18.50, 0.50, 'Klassische Indica, entspannend und schmerzlindernd', '2024-04-01T10:00:00Z'),
+    ('d1000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001',
+     'CBD Critical Mass', 5.00, 12.00, 'CBD-dominante Sorte für medizinische Anwendungen', '2024-04-01T10:00:00Z'),
+    ('d1000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001',
+     'Amnesia Haze', 22.00, 0.10, 'Starke Sativa mit hohem THC-Gehalt', '2024-04-01T10:00:00Z')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 5. BATCHES (3)
+-- ============================================================
+INSERT INTO batches (id, tenant_id, strain_id, quantity_grams, harvest_date, batch_code, status, contamination_flag, created_at)
+VALUES
+    ('e1000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'd1000000-0000-0000-0000-000000000001', 500.00, '2024-04-25', 'NL-2024-001', 'AVAILABLE', FALSE, '2024-05-01T10:00:00Z'),
+    ('e1000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001',
+     'd1000000-0000-0000-0000-000000000002', 300.00, '2024-05-10', 'CM-2024-001', 'AVAILABLE', FALSE, '2024-05-15T10:00:00Z'),
+    ('e1000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001',
+     'd1000000-0000-0000-0000-000000000003', 200.00, '2024-03-20', 'AH-2024-001', 'RECALLED', TRUE, '2024-04-01T10:00:00Z')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 6. DISTRIBUTIONS (3 recent)
+-- ============================================================
+INSERT INTO distributions (id, tenant_id, member_id, batch_id, quantity_grams, distributed_at, recorded_by, notes, thc_percentage, cbd_percentage, strain_name, created_at)
+VALUES
+    ('dd000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'c1000000-0000-0000-0000-000000000001', 'e1000000-0000-0000-0000-000000000001',
+     5.00, NOW() - INTERVAL '2 days', 'c1000000-0000-0000-0000-000000000001', 'Reguläre Abgabe',
+     18.50, 0.50, 'Northern Lights', NOW() - INTERVAL '2 days'),
+    ('dd000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001',
+     'c1000000-0000-0000-0000-000000000002', 'e1000000-0000-0000-0000-000000000002',
+     3.00, NOW() - INTERVAL '1 day', 'c1000000-0000-0000-0000-000000000001', 'CBD-Abgabe',
+     5.00, 12.00, 'CBD Critical Mass', NOW() - INTERVAL '1 day'),
+    ('dd000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001',
+     'c1000000-0000-0000-0000-000000000005', 'e1000000-0000-0000-0000-000000000002',
+     23.00, NOW(), 'c1000000-0000-0000-0000-000000000001', 'Nahe am Monatslimit (25g)',
+     5.00, 12.00, 'CBD Critical Mass', NOW())
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 7. MONTHLY QUOTAS (Thomas near-quota)
+-- ============================================================
+INSERT INTO monthly_quotas (id, tenant_id, member_id, year, month, total_distributed, max_allowed, version, created_at)
+VALUES
+    ('mq000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'c1000000-0000-0000-0000-000000000005',
+     EXTRACT(YEAR FROM NOW())::INT, EXTRACT(MONTH FROM NOW())::INT,
+     23.00, 25.00, 1, NOW())
+ON CONFLICT (member_id, year, month) DO NOTHING;
+
+-- ============================================================
+-- 8. DOCUMENTS (4)
+-- ============================================================
+INSERT INTO documents (id, tenant_id, club_id, title, category, filename, content_type, file_size, storage_path, access_level, description, uploaded_by, created_at)
+VALUES
+    ('f1000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Vereinssatzung 2024', 'SATZUNG', 'satzung-2024.pdf', 'application/pdf', 245000,
+     '/documents/a0000000/satzung-2024.pdf', 'ALL_MEMBERS', 'Aktuelle Vereinssatzung gemäß §18 KCanG',
+     'b1000000-0000-0000-0000-000000000001', '2024-01-15T10:00:00Z'),
+    ('f1000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Protokoll MV März 2024', 'PROTOKOLL', 'protokoll-mv-2024-03.pdf', 'application/pdf', 128000,
+     '/documents/a0000000/protokoll-mv-2024-03.pdf', 'ALL_MEMBERS', 'Protokoll der Mitgliederversammlung vom 15.03.2024',
+     'b1000000-0000-0000-0000-000000000001', '2024-03-16T10:00:00Z'),
+    ('f1000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'KCanG-Genehmigung', 'GENEHMIGUNG', 'kcang-genehmigung.pdf', 'application/pdf', 340000,
+     '/documents/a0000000/kcang-genehmigung.pdf', 'BOARD_ONLY', 'Genehmigungsbescheid nach §11 KCanG',
+     'b1000000-0000-0000-0000-000000000001', '2024-01-10T10:00:00Z'),
+    ('f1000000-0000-0000-0000-000000000004', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Mietvertrag', 'VERTRAG', 'mietvertrag-vereinsheim.pdf', 'application/pdf', 520000,
+     '/documents/a0000000/mietvertrag-vereinsheim.pdf', 'BOARD_ONLY', 'Mietvertrag für Vereinsräume',
+     'b1000000-0000-0000-0000-000000000001', '2023-12-01T10:00:00Z')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 9. BOARD POSITIONS (3)
+-- ============================================================
+INSERT INTO board_positions (id, tenant_id, club_id, title, description, sort_order, is_active, created_at)
+VALUES
+    ('g1000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Vorsitzende/r', 'Erste/r Vorsitzende/r des Vereins', 1, TRUE, '2024-01-15T10:00:00Z'),
+    ('g1000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Kassenführung', 'Schatzmeister/in — Kassenführung und Finanzen', 2, TRUE, '2024-01-15T10:00:00Z'),
+    ('g1000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Schriftführung', 'Protokollführung und Korrespondenz', 3, TRUE, '2024-01-15T10:00:00Z')
+ON CONFLICT (id) DO NOTHING;
+
+-- Board members (Max = Vorsitzender, Anna = Kassenführung, Schriftführung = vacant)
+INSERT INTO board_members (id, tenant_id, club_id, position_id, member_id, elected_at, term_start, is_current, created_at)
+VALUES
+    ('gm000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'g1000000-0000-0000-0000-000000000001', 'c1000000-0000-0000-0000-000000000001',
+     '2024-01-15', '2024-01-15', TRUE, '2024-01-15T10:00:00Z'),
+    ('gm000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'g1000000-0000-0000-0000-000000000002', 'c1000000-0000-0000-0000-000000000002',
+     '2024-01-15', '2024-01-15', TRUE, '2024-01-15T10:00:00Z')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 10. EVENTS (2)
+-- ============================================================
+INSERT INTO club_events (id, club_id, title, description, event_type, start_at, end_at, location, created_by, tenant_id, created_at, updated_at)
+VALUES
+    ('ev000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Mitgliederversammlung Q3', 'Ordentliche Mitgliederversammlung mit Vorstandswahl',
+     'ASSEMBLY', NOW() + INTERVAL '14 days', NOW() + INTERVAL '14 days' + INTERVAL '2 hours',
+     'Vereinsheim, Hanfstraße 42', 'b1000000-0000-0000-0000-000000000001',
+     'a0000000-0000-0000-0000-000000000001', NOW() - INTERVAL '7 days', NOW() - INTERVAL '7 days'),
+    ('ev000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001',
+     'Gartentag Mai', 'Gemeinsamer Gartentag — Pflege der Anbauflächen',
+     'SOCIAL', NOW() - INTERVAL '30 days', NOW() - INTERVAL '30 days' + INTERVAL '4 hours',
+     'Vereinsgarten', 'b1000000-0000-0000-0000-000000000001',
+     'a0000000-0000-0000-0000-000000000001', NOW() - INTERVAL '45 days', NOW() - INTERVAL '45 days')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 11. FORUM TOPICS (2) + REPLIES
+-- ============================================================
+INSERT INTO forum_topics (id, club_id, tenant_id, title, content, author_id, reply_count, last_reply_at, created_at)
+VALUES
+    ('ft000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Neue Sorten für Sommer', 'Welche Sorten sollen wir diesen Sommer anbauen? Ich schlage vor, mehr CBD-lastige Sorten zu probieren.',
+     'b1000000-0000-0000-0000-000000000001', 3, NOW() - INTERVAL '2 days', NOW() - INTERVAL '10 days'),
+    ('ft000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Bewässerungssystem', 'Hat jemand Erfahrung mit automatischen Bewässerungssystemen für den Indoor-Bereich?',
+     'b1000000-0000-0000-0000-000000000002', 1, NOW() - INTERVAL '5 days', NOW() - INTERVAL '7 days')
+ON CONFLICT (id) DO NOTHING;
+
+-- Forum replies
+INSERT INTO forum_replies (id, topic_id, club_id, tenant_id, content, author_id, created_at)
+VALUES
+    ('fr000000-0000-0000-0000-000000000001', 'ft000000-0000-0000-0000-000000000001',
+     'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'CBD Critical Mass hat sich bei uns bewährt — guter Ertrag und medizinisch wertvoll!',
+     'b1000000-0000-0000-0000-000000000002', NOW() - INTERVAL '9 days'),
+    ('fr000000-0000-0000-0000-000000000002', 'ft000000-0000-0000-0000-000000000001',
+     'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Finde ich gut! Vielleicht auch Charlotte''s Web als weitere CBD-Option?',
+     'b1000000-0000-0000-0000-000000000003', NOW() - INTERVAL '7 days'),
+    ('fr000000-0000-0000-0000-000000000003', 'ft000000-0000-0000-0000-000000000001',
+     'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Stimme zu — lasst uns in der MV darüber abstimmen.',
+     'b1000000-0000-0000-0000-000000000001', NOW() - INTERVAL '2 days'),
+    ('fr000000-0000-0000-0000-000000000004', 'ft000000-0000-0000-0000-000000000002',
+     'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Wir nutzen BlueMat-Tropfer — funktioniert super für Erde und Kokos.',
+     'b1000000-0000-0000-0000-000000000001', NOW() - INTERVAL '5 days')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 12. INFO BOARD POSTS (2)
+-- ============================================================
+INSERT INTO info_board_posts (id, club_id, title, content, category, is_pinned, is_archived, author_id, tenant_id, created_at, updated_at)
+VALUES
+    ('ib000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'Willkommen neue Mitglieder', 'Herzlich willkommen bei Grüner Daumen e.V.! Bitte lest die Vereinssatzung und meldet euch bei Fragen beim Vorstand.',
+     'GENERAL', TRUE, FALSE, 'b1000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     NOW() - INTERVAL '30 days', NOW() - INTERVAL '30 days'),
+    ('ib000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001',
+     'Öffnungszeiten Sommer', 'Ab Juni gelten erweiterte Öffnungszeiten: Mo-Fr 10-20 Uhr, Sa 10-16 Uhr.',
+     'MAINTENANCE', FALSE, FALSE, 'b1000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     NOW() - INTERVAL '14 days', NOW() - INTERVAL '14 days')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 13. GROW ENTRIES (2)
+-- ============================================================
+INSERT INTO grow_entries (id, name, strain_id, status, started_at, expected_harvest_at, notes, tenant_id, created_at, updated_at)
+VALUES
+    ('ge000000-0000-0000-0000-000000000001',
+     'Northern Lights Batch #2', 'd1000000-0000-0000-0000-000000000001', 'VEGETATIVE',
+     NOW() - INTERVAL '21 days', NOW() + INTERVAL '49 days',
+     'Zweiter Indoor-Batch NL, 6 Pflanzen',
+     'a0000000-0000-0000-0000-000000000001', NOW() - INTERVAL '21 days', NOW() - INTERVAL '1 day'),
+    ('ge000000-0000-0000-0000-000000000002',
+     'CBD Outdoor', 'd1000000-0000-0000-0000-000000000002', 'SEEDLING',
+     NOW() - INTERVAL '7 days', NOW() + INTERVAL '90 days',
+     'Outdoor-Test mit CBD Critical Mass, 4 Pflanzen',
+     'a0000000-0000-0000-0000-000000000001', NOW() - INTERVAL '7 days', NOW() - INTERVAL '1 day')
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================
+-- 14. COMPLIANCE DEADLINES (3)
+-- ============================================================
+INSERT INTO compliance_deadlines (id, tenant_id, club_id, area, title, description, due_date, is_recurring, created_at)
+VALUES
+    ('cd000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'KCANG', 'Jahresbericht', 'Jährlicher Tätigkeitsbericht an die zuständige Behörde gemäß §22 KCanG',
+     (CURRENT_DATE + INTERVAL '60 days')::DATE, TRUE, NOW() - INTERVAL '30 days'),
+    ('cd000000-0000-0000-0000-000000000002', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'FINANCE', 'EÜR Abgabe', 'Einnahmen-Überschuss-Rechnung an das Finanzamt',
+     (CURRENT_DATE - INTERVAL '5 days')::DATE, FALSE, NOW() - INTERVAL '60 days'),
+    ('cd000000-0000-0000-0000-000000000003', 'a0000000-0000-0000-0000-000000000001', 'a0000000-0000-0000-0000-000000000001',
+     'VEREIN', 'Mitgliederversammlung', 'Ordentliche Mitgliederversammlung (mindestens 1x jährlich)',
+     (CURRENT_DATE + INTERVAL '14 days')::DATE, TRUE, NOW() - INTERVAL '14 days')
+ON CONFLICT (id) DO NOTHING;

cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerSecurityTest.java

@@ -0,0 +1,164 @@
+package de.cannamanage.api.controller;
+
+import de.cannamanage.domain.entity.Document;
+import de.cannamanage.domain.entity.TenantContext;
+import de.cannamanage.domain.enums.DocumentAccessLevel;
+import de.cannamanage.domain.enums.DocumentCategory;
+import de.cannamanage.service.DocumentService;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.io.IOException;
+import java.security.Principal;
+import java.util.UUID;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+/**
+ * Security unit tests for {@link DocumentController}.
+ * Verifies tenant isolation (IDOR protection) at the controller layer.
+ */
+@ExtendWith(MockitoExtension.class)
+class DocumentControllerSecurityTest {
+
+    @Mock
+    private DocumentService documentService;
+
+    @InjectMocks
+    private DocumentController documentController;
+
+    private static final UUID CLUB_A = UUID.fromString("00000000-0000-0000-0000-00000000000a");
+    private static final UUID CLUB_B = UUID.fromString("00000000-0000-0000-0000-00000000000b");
+    private static final UUID DOC_ID = UUID.fromString("00000000-0000-0000-0000-000000000099");
+    private static final UUID USER_ID = UUID.fromString("00000000-0000-0000-0000-000000000001");
+
+    @BeforeEach
+    void setUp() {
+        // Default tenant context: CLUB_A
+        TenantContext.setCurrentTenant(CLUB_A);
+    }
+
+    @AfterEach
+    void tearDown() {
+        TenantContext.clear();
+    }
+
+    // --- T-09: Download wrong tenant → 404 ---
+
+    @Test
+    @DisplayName("downloadDocument — wrong tenant throws 404 (IDOR protection)")
+    void testDownload_wrongTenant_returns404() {
+        // Document belongs to CLUB_B but user's tenant is CLUB_A
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_B);
+        doc.setFilename("secret.pdf");
+        doc.setContentType("application/pdf");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        assertThatThrownBy(() -> documentController.downloadDocument(DOC_ID))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(ex -> {
+                    ResponseStatusException rse = (ResponseStatusException) ex;
+                    assertThat(rse.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+                });
+    }
+
+    // --- T-10: Download correct tenant → 200 ---
+
+    @Test
+    @DisplayName("downloadDocument — correct tenant returns content")
+    void testDownload_correctTenant_succeeds() throws IOException {
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_A);
+        doc.setFilename("report.pdf");
+        doc.setContentType("application/pdf");
+        doc.setStoragePath(CLUB_A + "/" + DOC_ID + "_report.pdf");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+        when(documentService.downloadDocument(DOC_ID)).thenReturn("test content".getBytes());
+
+        ResponseEntity<byte[]> response = documentController.downloadDocument(DOC_ID);
+
+        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(response.getBody()).isNotNull();
+    }
+
+    // --- T-11: Delete wrong tenant → 404 ---
+
+    @Test
+    @DisplayName("deleteDocument — wrong tenant throws 404 (IDOR protection)")
+    void testDelete_wrongTenant_returns404() {
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_B);
+        doc.setTitle("Secret Doc");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        Principal principal = mock(Principal.class);
+
+        assertThatThrownBy(() -> documentController.deleteDocument(DOC_ID, CLUB_A, principal))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(ex -> {
+                    ResponseStatusException rse = (ResponseStatusException) ex;
+                    assertThat(rse.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+                });
+    }
+
+    // --- T-12: Delete correct tenant → 204 ---
+
+    @Test
+    @DisplayName("deleteDocument — correct tenant and matching clubId succeeds")
+    void testDelete_correctTenant_succeeds() throws IOException {
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_A);
+        doc.setTitle("My Doc");
+        doc.setStoragePath(CLUB_A + "/" + DOC_ID + "_my.pdf");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        Principal principal = mock(Principal.class);
+        when(principal.getName()).thenReturn(USER_ID.toString());
+
+        ResponseEntity<Void> response = documentController.deleteDocument(DOC_ID, CLUB_A, principal);
+
+        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
+    }
+
+    // --- T-13/T-14: Upload role restriction is handled by Spring Security @PreAuthorize,
+    // not testable in a pure unit test. Covered by SecurityConfigIntegrationTest. ---
+
+    @Test
+    @DisplayName("deleteDocument — mismatched clubId param vs tenant throws 404")
+    void testDelete_mismatchedClubIdParam_returns404() {
+        // Document belongs to CLUB_A and tenant is CLUB_A, but clubId param is different
+        Document doc = new Document();
+        doc.setId(DOC_ID);
+        doc.setClubId(CLUB_A);
+        doc.setTitle("Doc");
+        when(documentService.getDocument(DOC_ID)).thenReturn(doc);
+
+        Principal principal = mock(Principal.class);
+
+        // Passing CLUB_B as the clubId param while tenant is CLUB_A
+        assertThatThrownBy(() -> documentController.deleteDocument(DOC_ID, CLUB_B, principal))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(ex -> {
+                    ResponseStatusException rse = (ResponseStatusException) ex;
+                    assertThat(rse.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+                });
+    }
+}

cannamanage-api/src/test/java/de/cannamanage/api/integration/AbstractIntegrationTest.java

@@ -42,16 +42,31 @@ import java.util.UUID;
 public abstract class AbstractIntegrationTest {
 
     @Container
-    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine")
+    static PostgreSQLContainer<?> postgres = shouldUseTestcontainers()
-            .withDatabaseName("cannamanage_test")
+            ? new PostgreSQLContainer<>("postgres:16-alpine")
-            .withUsername("test")
+                .withDatabaseName("cannamanage_test")
-            .withPassword("test");
+                .withUsername("test")
+                .withPassword("test")
+            : null;
 
     @DynamicPropertySource
     static void configureProperties(DynamicPropertyRegistry registry) {
-        registry.add("spring.datasource.url", postgres::getJdbcUrl);
+        if (postgres != null) {
-        registry.add("spring.datasource.username", postgres::getUsername);
+            registry.add("spring.datasource.url", postgres::getJdbcUrl);
-        registry.add("spring.datasource.password", postgres::getPassword);
+            registry.add("spring.datasource.username", postgres::getUsername);
+            registry.add("spring.datasource.password", postgres::getPassword);
+        } else {
+            registry.add("spring.datasource.url", () -> System.getenv("CI_POSTGRES_URL"));
+            registry.add("spring.datasource.username", () -> System.getenv("CI_POSTGRES_USER"));
+            registry.add("spring.datasource.password", () -> System.getenv("CI_POSTGRES_PASSWORD"));
+        }
+    }
+
+    /**
+     * Use Testcontainers locally; skip when CI provides PostgreSQL via service container.
+     */
+    private static boolean shouldUseTestcontainers() {
+        return System.getenv("CI_POSTGRES_URL") == null;
     }
 
     @LocalServerPort

cannamanage-api/src/test/java/de/cannamanage/api/security/LoginRateLimitFilterTest.java

@@ -0,0 +1,178 @@
+package de.cannamanage.api.security;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import java.io.IOException;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.*;
+
+/**
+ * Unit tests for {@link LoginRateLimitFilter} covering rate limiting with Bucket4j + Caffeine.
+ * Tests per-IP bucket isolation, blocking after threshold, and Retry-After header.
+ */
+class LoginRateLimitFilterTest {
+
+    private LoginRateLimitFilter filter;
+    private FilterChain filterChain;
+
+    @BeforeEach
+    void setUp() {
+        filter = new LoginRateLimitFilter();
+        filterChain = mock(FilterChain.class);
+    }
+
+    // --- T-26: First 5 requests pass ---
+
+    @Test
+    @DisplayName("Rate limit — first 5 requests from same IP are allowed")
+    void testRateLimit_allowsFirstFiveRequests() throws ServletException, IOException {
+        for (int i = 0; i < 5; i++) {
+            MockHttpServletRequest request = createLoginRequest("192.168.1.1");
+            MockHttpServletResponse response = new MockHttpServletResponse();
+
+            filter.doFilterInternal(request, response, filterChain);
+
+            assertThat(response.getStatus()).isNotEqualTo(429);
+        }
+
+        // FilterChain should have been invoked 5 times
+        verify(filterChain, times(5)).doFilter(any(), any());
+    }
+
+    // --- T-27: 6th request returns 429 ---
+
+    @Test
+    @DisplayName("Rate limit — 6th request from same IP returns 429")
+    void testRateLimit_blocks6thRequest_returns429() throws ServletException, IOException {
+        String ip = "10.0.0.1";
+
+        // Exhaust the 5-request bucket
+        for (int i = 0; i < 5; i++) {
+            MockHttpServletRequest request = createLoginRequest(ip);
+            MockHttpServletResponse response = new MockHttpServletResponse();
+            filter.doFilterInternal(request, response, filterChain);
+        }
+
+        // 6th request should be rate-limited
+        MockHttpServletRequest request = createLoginRequest(ip);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        filter.doFilterInternal(request, response, filterChain);
+
+        assertThat(response.getStatus()).isEqualTo(429);
+        assertThat(response.getContentAsString()).contains("Too many login attempts");
+    }
+
+    // --- Retry-After header ---
+
+    @Test
+    @DisplayName("Rate limit — 429 response includes Retry-After header")
+    void testRateLimit_includesRetryAfterHeader() throws ServletException, IOException {
+        String ip = "10.0.0.2";
+
+        // Exhaust the bucket
+        for (int i = 0; i < 5; i++) {
+            filter.doFilterInternal(createLoginRequest(ip), new MockHttpServletResponse(), filterChain);
+        }
+
+        // 6th request — check headers
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        filter.doFilterInternal(createLoginRequest(ip), response, filterChain);
+
+        assertThat(response.getStatus()).isEqualTo(429);
+        String retryAfter = response.getHeader("Retry-After");
+        assertThat(retryAfter).isNotNull();
+        assertThat(Integer.parseInt(retryAfter)).isGreaterThan(0);
+    }
+
+    // --- T-28: Separate buckets per IP ---
+
+    @Test
+    @DisplayName("Rate limit — different IPs have separate rate limit buckets")
+    void testRateLimit_separateBucketsPerIp() throws ServletException, IOException {
+        String ip1 = "192.168.1.100";
+        String ip2 = "192.168.1.200";
+
+        // Exhaust quota for ip1
+        for (int i = 0; i < 5; i++) {
+            filter.doFilterInternal(createLoginRequest(ip1), new MockHttpServletResponse(), filterChain);
+        }
+
+        // ip1 should be blocked
+        MockHttpServletResponse responseIp1 = new MockHttpServletResponse();
+        filter.doFilterInternal(createLoginRequest(ip1), responseIp1, filterChain);
+        assertThat(responseIp1.getStatus()).isEqualTo(429);
+
+        // ip2 should still be allowed
+        MockHttpServletResponse responseIp2 = new MockHttpServletResponse();
+        filter.doFilterInternal(createLoginRequest(ip2), responseIp2, filterChain);
+        assertThat(responseIp2.getStatus()).isNotEqualTo(429);
+    }
+
+    // --- Non-login requests pass through ---
+
+    @Test
+    @DisplayName("Non-login endpoint requests are not rate limited")
+    void testNonLoginEndpoint_notRateLimited() throws ServletException, IOException {
+        MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api/v1/members");
+        request.setRemoteAddr("10.0.0.5");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        filter.doFilterInternal(request, response, filterChain);
+
+        verify(filterChain).doFilter(request, response);
+        assertThat(response.getStatus()).isNotEqualTo(429);
+    }
+
+    @Test
+    @DisplayName("GET request to login path is not rate limited")
+    void testGetLoginPath_notRateLimited() throws ServletException, IOException {
+        MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api/v1/auth/login");
+        request.setRemoteAddr("10.0.0.6");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        filter.doFilterInternal(request, response, filterChain);
+
+        verify(filterChain).doFilter(request, response);
+        assertThat(response.getStatus()).isNotEqualTo(429);
+    }
+
+    // --- X-Forwarded-For header ---
+
+    @Test
+    @DisplayName("Rate limit uses X-Forwarded-For header for client IP resolution")
+    void testRateLimit_usesXForwardedFor() throws ServletException, IOException {
+        String realIp = "203.0.113.50";
+
+        // Exhaust bucket via X-Forwarded-For IP
+        for (int i = 0; i < 5; i++) {
+            MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/auth/login");
+            request.setRemoteAddr("127.0.0.1"); // proxy IP
+            request.addHeader("X-Forwarded-For", realIp + ", 10.0.0.1");
+            filter.doFilterInternal(request, new MockHttpServletResponse(), filterChain);
+        }
+
+        // 6th request from same forwarded IP should be blocked
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/auth/login");
+        request.setRemoteAddr("127.0.0.1");
+        request.addHeader("X-Forwarded-For", realIp + ", 10.0.0.1");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        filter.doFilterInternal(request, response, filterChain);
+
+        assertThat(response.getStatus()).isEqualTo(429);
+    }
+
+    // --- Helper ---
+
+    private MockHttpServletRequest createLoginRequest(String ip) {
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/auth/login");
+        request.setRemoteAddr(ip);
+        return request;
+    }
+}

cannamanage-api/src/test/java/de/cannamanage/api/security/SecurityConfigTest.java

@@ -0,0 +1,89 @@
+package de.cannamanage.api.security;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.server.LocalServerPort;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.web.client.RestClient;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for {@link SecurityConfig} — verifying that the security filter chain
+ * correctly requires authentication for protected endpoints and allows public endpoints.
+ * Uses RestClient against an actual HTTP server (same pattern as AuthControllerIntegrationTest).
+ *
+ * Note: The existing SecurityConfigIntegrationTest (Testcontainers) covers the same cases
+ * with a full database. This test uses the simpler "test" profile for faster execution.
+ */
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@ActiveProfiles("test")
+class SecurityConfigTest {
+
+    @LocalServerPort
+    private int port;
+
+    private RestClient restClient() {
+        return RestClient.builder()
+                .baseUrl("http://localhost:" + port)
+                .build();
+    }
+
+    // --- T-21: Document endpoints require authentication ---
+
+    @Test
+    @DisplayName("GET /api/v1/documents — unauthenticated returns 401")
+    void testDocumentEndpoints_requireAuthentication() {
+        ResponseEntity<String> response = restClient().get()
+                .uri("/api/v1/documents?clubId=00000000-0000-0000-0000-000000000001")
+                .retrieve()
+                .toEntity(String.class);
+
+        assertThat(response.getStatusCode().value()).isEqualTo(401);
+    }
+
+    @Test
+    @DisplayName("GET /api/v1/documents/{id}/download — unauthenticated returns 401")
+    void testDocumentDownload_requiresAuthentication() {
+        ResponseEntity<String> response = restClient().get()
+                .uri("/api/v1/documents/00000000-0000-0000-0000-000000000099/download")
+                .retrieve()
+                .toEntity(String.class);
+
+        assertThat(response.getStatusCode().value()).isEqualTo(401);
+    }
+
+    // --- T-22: Auth endpoints are public ---
+
+    @Test
+    @DisplayName("POST /api/v1/auth/login — accessible without authentication (not 401)")
+    void testAuthEndpoints_arePublic() {
+        ResponseEntity<String> response = restClient().post()
+                .uri("/api/v1/auth/login")
+                .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                .body("{\"email\":\"test@test.de\",\"password\":\"test\"}")
+                .retrieve()
+                .toEntity(String.class);
+
+        // Auth endpoints are public — should NOT return 401/403
+        // May return 400 or 500 (user not found), that's fine
+        assertThat(response.getStatusCode().value()).isNotEqualTo(401);
+        assertThat(response.getStatusCode().value()).isNotEqualTo(403);
+    }
+
+    // --- T-23: Actuator health is public ---
+
+    @Test
+    @DisplayName("GET /actuator/health — accessible without authentication")
+    void testActuatorHealth_isPublic() {
+        ResponseEntity<String> response = restClient().get()
+                .uri("/actuator/health")
+                .retrieve()
+                .toEntity(String.class);
+
+        assertThat(response.getStatusCode().value()).isEqualTo(200);
+    }
+}

cannamanage-api/src/test/java/de/cannamanage/api/service/AuthServiceTest.java

@@ -0,0 +1,194 @@
+package de.cannamanage.api.service;
+
+import de.cannamanage.api.dto.auth.LoginRequest;
+import de.cannamanage.api.dto.auth.LoginResponse;
+import de.cannamanage.api.dto.auth.RefreshRequest;
+import de.cannamanage.api.security.JwtService;
+import de.cannamanage.domain.entity.User;
+import de.cannamanage.domain.enums.UserRole;
+import de.cannamanage.service.repository.InviteTokenRepository;
+import de.cannamanage.service.repository.StaffAccountRepository;
+import de.cannamanage.service.repository.UserRepository;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.HexFormat;
+import java.util.Optional;
+import java.util.UUID;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.when;
+
+/**
+ * Unit tests for {@link AuthService} covering login, token refresh, and SHA-256 hashing.
+ */
+@ExtendWith(MockitoExtension.class)
+class AuthServiceTest {
+
+    @Mock
+    private UserRepository userRepository;
+
+    @Mock
+    private JwtService jwtService;
+
+    @Mock
+    private PasswordEncoder passwordEncoder;
+
+    @Mock
+    private InviteTokenRepository inviteTokenRepository;
+
+    @Mock
+    private StaffAccountRepository staffAccountRepository;
+
+    @InjectMocks
+    private AuthService authService;
+
+    private User activeUser;
+    private static final UUID USER_ID = UUID.fromString("00000000-0000-0000-0000-000000000001");
+    private static final UUID TENANT_ID = UUID.fromString("00000000-0000-0000-0000-000000000010");
+    private static final String EMAIL = "admin@test.de";
+    private static final String PASSWORD = "SecurePass123!";
+    private static final String HASHED_PASSWORD = "$2a$10$hashedvalue";
+
+    @BeforeEach
+    void setUp() {
+        activeUser = new User();
+        activeUser.setId(USER_ID);
+        activeUser.setEmail(EMAIL);
+        activeUser.setPasswordHash(HASHED_PASSWORD);
+        activeUser.setRole(UserRole.ROLE_ADMIN);
+        activeUser.setActive(true);
+        activeUser.setTenantId(TENANT_ID);
+    }
+
+    // --- T-15: Login valid credentials → token pair ---
+
+    @Test
+    @DisplayName("login — valid credentials returns token pair")
+    void testLogin_validCredentials_returnsTokenPair() {
+        when(userRepository.findByEmail(EMAIL)).thenReturn(Optional.of(activeUser));
+        when(passwordEncoder.matches(PASSWORD, HASHED_PASSWORD)).thenReturn(true);
+        when(jwtService.generateAccessToken(any(), any(), anyString(), anyString()))
+                .thenReturn("access-token-123");
+        when(jwtService.generateRefreshToken(any(), any()))
+                .thenReturn("refresh-token-456");
+        when(userRepository.save(any(User.class))).thenReturn(activeUser);
+
+        LoginResponse response = authService.login(new LoginRequest(EMAIL, PASSWORD));
+
+        assertThat(response).isNotNull();
+        assertThat(response.accessToken()).isEqualTo("access-token-123");
+        assertThat(response.refreshToken()).isEqualTo("refresh-token-456");
+        assertThat(response.expiresIn()).isEqualTo(3600L);
+        assertThat(response.role()).isEqualTo("ADMIN");
+    }
+
+    // --- T-16: Login invalid password → 401 ---
+
+    @Test
+    @DisplayName("login — invalid password throws AuthenticationException")
+    void testLogin_invalidPassword_throws401() {
+        when(userRepository.findByEmail(EMAIL)).thenReturn(Optional.of(activeUser));
+        when(passwordEncoder.matches("wrong-password", HASHED_PASSWORD)).thenReturn(false);
+
+        assertThatThrownBy(() -> authService.login(new LoginRequest(EMAIL, "wrong-password")))
+                .isInstanceOf(AuthService.AuthenticationException.class)
+                .hasMessageContaining("Invalid credentials");
+    }
+
+    // --- T-17: Login non-existent user → 401 ---
+
+    @Test
+    @DisplayName("login — non-existent user throws AuthenticationException")
+    void testLogin_nonExistentUser_throws401() {
+        when(userRepository.findByEmail("nobody@test.de")).thenReturn(Optional.empty());
+
+        assertThatThrownBy(() -> authService.login(new LoginRequest("nobody@test.de", PASSWORD)))
+                .isInstanceOf(AuthService.AuthenticationException.class)
+                .hasMessageContaining("Invalid credentials");
+    }
+
+    // --- T-18: Refresh token valid → new access token ---
+
+    @Test
+    @DisplayName("refresh — valid token returns new access token")
+    void testRefreshToken_validToken_returnsNewAccessToken() {
+        String oldRefreshToken = "valid-refresh-token";
+        // Compute expected hash
+        String expectedHash = sha256(oldRefreshToken);
+        activeUser.setRefreshTokenHash(expectedHash);
+
+        when(jwtService.isTokenValid(oldRefreshToken)).thenReturn(true);
+        when(jwtService.extractUserId(oldRefreshToken)).thenReturn(USER_ID);
+        when(userRepository.findById(USER_ID)).thenReturn(Optional.of(activeUser));
+        when(jwtService.generateAccessToken(any(), any(), anyString(), anyString()))
+                .thenReturn("new-access-token");
+        when(jwtService.generateRefreshToken(any(), any()))
+                .thenReturn("new-refresh-token");
+        when(userRepository.save(any(User.class))).thenReturn(activeUser);
+
+        LoginResponse response = authService.refresh(new RefreshRequest(oldRefreshToken));
+
+        assertThat(response).isNotNull();
+        assertThat(response.accessToken()).isEqualTo("new-access-token");
+        assertThat(response.refreshToken()).isEqualTo("new-refresh-token");
+    }
+
+    // --- T-19: Refresh token expired → 401 ---
+
+    @Test
+    @DisplayName("refresh — expired/invalid token throws AuthenticationException")
+    void testRefreshToken_expired_throws401() {
+        String expiredToken = "expired-refresh-token";
+        when(jwtService.isTokenValid(expiredToken)).thenReturn(false);
+
+        assertThatThrownBy(() -> authService.refresh(new RefreshRequest(expiredToken)))
+                .isInstanceOf(AuthService.AuthenticationException.class)
+                .hasMessageContaining("Invalid or expired refresh token");
+    }
+
+    // --- T-20: SHA-256 hashing is deterministic ---
+
+    @Test
+    @DisplayName("SHA-256 hashing is deterministic — same input always produces same hash")
+    void testSha256_deterministic() {
+        String input = "test-refresh-token-abc123";
+        String hash1 = sha256(input);
+        String hash2 = sha256(input);
+
+        assertThat(hash1).isEqualTo(hash2);
+        assertThat(hash1).hasSize(64); // SHA-256 produces 64 hex chars
+        assertThat(hash1).matches("[0-9a-f]{64}");
+    }
+
+    @Test
+    @DisplayName("SHA-256 hashing — different inputs produce different hashes")
+    void testSha256_differentInputs_differentHashes() {
+        String hash1 = sha256("token-one");
+        String hash2 = sha256("token-two");
+
+        assertThat(hash1).isNotEqualTo(hash2);
+    }
+
+    // Helper to replicate AuthService's sha256 logic for test verification
+    private String sha256(String input) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
+            return HexFormat.of().formatHex(hash);
+        } catch (Exception e) {
+            throw new IllegalStateException("SHA-256 not available", e);
+        }
+    }
+}

cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Club.java

@@ -51,6 +51,12 @@ public class Club extends AbstractTenantEntity {
     @Column(name = "allowed_email_pattern", length = 255)
     private String allowedEmailPattern;
 
+    @Column(name = "storage_used_bytes", nullable = false)
+    private Long storageUsedBytes = 0L;
+
+    @Column(name = "storage_limit_bytes", nullable = false)
+    private Long storageLimitBytes = 5_368_709_120L; // 5 GB default
+
     @Enumerated(EnumType.STRING)
     @Column(name = "status", nullable = false, length = 50)
     private ClubStatus status = ClubStatus.ACTIVE;
@@ -99,4 +105,10 @@ public class Club extends AbstractTenantEntity {
 
     public ClubStatus getStatus() { return status; }
     public void setStatus(ClubStatus status) { this.status = status; }
+
+    public Long getStorageUsedBytes() { return storageUsedBytes; }
+    public void setStorageUsedBytes(Long storageUsedBytes) { this.storageUsedBytes = storageUsedBytes; }
+
+    public Long getStorageLimitBytes() { return storageLimitBytes; }
+    public void setStorageLimitBytes(Long storageLimitBytes) { this.storageLimitBytes = storageLimitBytes; }
 }

cannamanage-frontend/Dockerfile.playwright

@@ -0,0 +1,18 @@
+# IMPORTANT: Keep this version in sync with @playwright/test in package.json
+FROM mcr.microsoft.com/playwright:v1.60.0-noble
+
+WORKDIR /app
+
+# Copy package files for dependency installation
+COPY package.json pnpm-lock.yaml .npmrc ./
+
+# Install pnpm and project dependencies at build time
+RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN pnpm install --frozen-lockfile
+
+# Copy playwright config and test infrastructure
+COPY playwright.config.ts tsconfig.json ./
+COPY e2e/ ./e2e/
+
+# Default command (overridden by docker-compose)
+CMD ["npx", "playwright", "test", "e2e/integration/", "--reporter=list"]

cannamanage-frontend/e2e/api-client.ts

@@ -0,0 +1,74 @@
+/**
+ * API client for integration tests.
+ * Used for direct backend calls: DB verification, test reset, data assertions.
+ */
+const API_URL = process.env.API_URL || "http://localhost:8080"
+
+export class ApiClient {
+  private token: string | null = null
+
+  async login(email: string, password: string): Promise<void> {
+    const res = await fetch(`${API_URL}/api/v1/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, password }),
+    })
+    if (!res.ok) throw new Error(`Login failed: ${res.status}`)
+    const data = await res.json()
+    this.token = data.token
+  }
+
+  async resetDb(): Promise<void> {
+    const res = await fetch(`${API_URL}/api/v1/test/reset-db`, {
+      method: "POST",
+      headers: this.authHeaders(),
+    })
+    if (!res.ok) throw new Error(`DB reset failed: ${res.status}`)
+  }
+
+  async getMembers(): Promise<any> {
+    return this.get("/api/v1/members")
+  }
+
+  async getDocuments(): Promise<any> {
+    return this.get("/api/v1/documents")
+  }
+
+  async getBatches(): Promise<any> {
+    return this.get("/api/v1/batches")
+  }
+
+  async getDistributions(): Promise<any> {
+    return this.get("/api/v1/distributions")
+  }
+
+  async getBoardPositions(): Promise<any> {
+    return this.get("/api/v1/board")
+  }
+
+  private authHeaders(): Record<string, string> {
+    const headers: Record<string, string> = {
+      "Content-Type": "application/json",
+    }
+    if (this.token) headers["Authorization"] = `Bearer ${this.token}`
+    return headers
+  }
+
+  private async get(path: string): Promise<any> {
+    const res = await fetch(`${API_URL}${path}`, {
+      headers: this.authHeaders(),
+    })
+    if (!res.ok) throw new Error(`GET ${path} failed: ${res.status}`)
+    return res.json()
+  }
+
+  private async post(path: string, body?: unknown): Promise<any> {
+    const res = await fetch(`${API_URL}${path}`, {
+      method: "POST",
+      headers: this.authHeaders(),
+      body: body ? JSON.stringify(body) : undefined,
+    })
+    if (!res.ok) throw new Error(`POST ${path} failed: ${res.status}`)
+    return res.json()
+  }
+}

cannamanage-frontend/e2e/global-setup.ts

@@ -1,6 +1,9 @@
-import { expect, test as setup } from "@playwright/test"
-import path from "path"
 import fs from "fs"
+import path from "path"
+
+import { expect, test as setup } from "@playwright/test"
+
+import { SEED } from "./seed-constants"
 
 /**
  * Global setup — authenticates as admin and saves the session state
@@ -13,23 +16,41 @@ const authDir = path.join(__dirname, ".auth")
 const authFile = path.join(authDir, "admin.json")
 
 setup("authenticate as admin", async ({ page, context }) => {
-  const baseURL = "http://localhost:3000"
+  const baseURL = process.env.BASE_URL || "http://localhost:3000"
+  const apiUrl = process.env.API_URL || "http://localhost:8080"
+
+  // Use seed credentials (from seed-constants), overridable via env vars
+  const email = process.env.TEST_ADMIN_EMAIL || SEED.admin.email
+  const password = process.env.TEST_ADMIN_PASSWORD || SEED.admin.password
 
   // Ensure .auth directory exists
   if (!fs.existsSync(authDir)) {
     fs.mkdirSync(authDir, { recursive: true })
   }
 
+  // Wait for backend health (up to 60s)
+  let healthy = false
+  for (let i = 0; i < 30; i++) {
+    try {
+      const res = await fetch(`${apiUrl}/actuator/health`)
+      if (res.ok) {
+        healthy = true
+        break
+      }
+    } catch {
+      /* retry */
+    }
+    await new Promise((r) => setTimeout(r, 2000))
+  }
+  if (!healthy) throw new Error("Backend health check failed after 60s")
+
   // Navigate to login page
   await page.goto(`${baseURL}/login`)
   await page.waitForLoadState("domcontentloaded")
 
   // Fill credentials and submit
-  await page.fill('input[name="email"], input[type="email"]', "admin@test.de")
+  await page.fill('input[name="email"], input[type="email"]', email)
-  await page.fill(
+  await page.fill('input[name="password"], input[type="password"]', password)
-    'input[name="password"], input[type="password"]',
-    "test123"
-  )
   await page.click('button[type="submit"]')
 
   // Wait for successful redirect away from login

cannamanage-frontend/e2e/integration/01-documents.spec.ts

@@ -0,0 +1,121 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+import { SEL } from "../selectors"
+
+const apiClient = new ApiClient()
+
+test.describe("Documents Page @smoke", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("displays seed documents", async ({ page }) => {
+    await page.goto("/documents")
+    await expect(page.getByText(SEED.documents.satzung.title)).toBeVisible()
+    await expect(page.getByText(SEED.documents.protokoll.title)).toBeVisible()
+    await expect(
+      page.getByText(SEED.documents.genehmigung.title)
+    ).toBeVisible()
+    await expect(
+      page.getByText(SEED.documents.mietvertrag.title)
+    ).toBeVisible()
+  })
+
+  test("upload button opens dialog", async ({ page }) => {
+    await page.goto("/documents")
+    const uploadBtn = page.locator(SEL.documents.uploadButton)
+    await expect(uploadBtn).toBeVisible()
+    await uploadBtn.click()
+    await expect(page.locator(SEL.documents.uploadDialog)).toBeVisible()
+    await expect(page.locator(SEL.documents.titleInput)).toBeVisible()
+    await expect(page.locator(SEL.documents.categorySelect)).toBeVisible()
+    await expect(page.locator(SEL.documents.fileInput)).toBeVisible()
+  })
+
+  test("upload form submits successfully", async ({ page }) => {
+    // Requires backend
+    await page.goto("/documents")
+    await page.locator(SEL.documents.uploadButton).click()
+    await expect(page.locator(SEL.documents.uploadDialog)).toBeVisible()
+
+    await page.locator(SEL.documents.titleInput).fill("Testdokument Upload")
+    await page.locator(SEL.documents.categorySelect).click()
+    await page.getByRole("option", { name: /satzung/i }).click()
+
+    // Upload a test file
+    const fileInput = page.locator(SEL.documents.fileInput)
+    await fileInput.setInputFiles({
+      name: "test.pdf",
+      mimeType: "application/pdf",
+      buffer: Buffer.from("fake pdf content"),
+    })
+
+    const submitBtn = page.locator(SEL.documents.submitUpload)
+    await submitBtn.click()
+
+    // Verify success toast
+    await expect(page.getByText(/erfolgreich|hochgeladen/i)).toBeVisible()
+  })
+
+  test("download button triggers download", async ({ page }) => {
+    await page.goto("/documents")
+    const downloadBtn = page.locator(
+      SEL.documents.downloadButton(SEED.documents.satzung.id)
+    )
+    await expect(downloadBtn).toBeVisible()
+
+    // Verify clicking download doesn't throw an error
+    const downloadPromise = page.waitForEvent("download")
+    await downloadBtn.click()
+    const download = await downloadPromise
+    expect(download.suggestedFilename()).toBeTruthy()
+  })
+
+  test("delete button shows confirmation and removes document", async ({
+    page,
+  }) => {
+    // Requires backend
+    await page.goto("/documents")
+    const deleteBtn = page.locator(
+      SEL.documents.deleteButton(SEED.documents.mietvertrag.id)
+    )
+    await expect(deleteBtn).toBeVisible()
+    await deleteBtn.click()
+
+    // Confirmation dialog appears
+    await expect(page.locator(SEL.documents.deleteConfirm)).toBeVisible()
+    await page.locator(SEL.documents.deleteConfirm).click()
+
+    // Document removed from list
+    await expect(
+      page.getByText(SEED.documents.mietvertrag.title)
+    ).not.toBeVisible()
+  })
+
+  test("category badges display correctly", async ({ page }) => {
+    await page.goto("/documents")
+    await expect(
+      page.locator(
+        SEL.documents.categoryBadge(SEED.documents.satzung.category)
+      )
+    ).toBeVisible()
+    await expect(
+      page.locator(
+        SEL.documents.categoryBadge(SEED.documents.protokoll.category)
+      )
+    ).toBeVisible()
+    await expect(
+      page.locator(
+        SEL.documents.categoryBadge(SEED.documents.genehmigung.category)
+      )
+    ).toBeVisible()
+    await expect(
+      page.locator(
+        SEL.documents.categoryBadge(SEED.documents.mietvertrag.category)
+      )
+    ).toBeVisible()
+  })
+})

cannamanage-frontend/e2e/integration/02-board.spec.ts

@@ -0,0 +1,90 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+import { SEL } from "../selectors"
+
+const apiClient = new ApiClient()
+
+test.describe("Board Page @smoke", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("displays seed board positions", async ({ page }) => {
+    await page.goto("/board")
+    await expect(page.getByText(SEED.board.vorsitz.title)).toBeVisible()
+    await expect(page.getByText(SEED.board.kasse.title)).toBeVisible()
+    await expect(page.getByText(SEED.board.schrift.title)).toBeVisible()
+  })
+
+  test("shows elected members on filled positions", async ({ page }) => {
+    await page.goto("/board")
+    await expect(page.getByText(SEED.board.vorsitz.elected)).toBeVisible()
+    await expect(page.getByText(SEED.board.kasse.elected)).toBeVisible()
+  })
+
+  test("shows vacant status for unfilled positions", async ({ page }) => {
+    await page.goto("/board")
+    const schriftCard = page.locator(
+      SEL.board.positionCard(SEED.board.schrift.id)
+    )
+    await expect(schriftCard).toBeVisible()
+    await expect(schriftCard.getByText(/vakant|unbesetzt/i)).toBeVisible()
+  })
+
+  test("create position opens form and submits", async ({ page }) => {
+    // Requires backend
+    await page.goto("/board")
+    await page.locator(SEL.board.createPositionButton).click()
+
+    // Fill form
+    await page.getByLabel(/titel|bezeichnung/i).fill("Beisitzer/in")
+    await page.getByRole("button", { name: /speichern|erstellen/i }).click()
+
+    // Verify new position appears
+    await expect(page.getByText("Beisitzer/in")).toBeVisible()
+  })
+
+  test("elect member to vacant position", async ({ page }) => {
+    // Requires backend
+    await page.goto("/board")
+
+    // Click elect on the vacant Schriftführung position
+    const schriftCard = page.locator(
+      SEL.board.positionCard(SEED.board.schrift.id)
+    )
+    await schriftCard.locator(SEL.board.electMemberButton).click()
+
+    // Select a member from dropdown/dialog
+    await page.getByRole("option", { name: /Lisa Bauer/i }).click()
+    await page.getByRole("button", { name: /speichern|wählen/i }).click()
+
+    // Verify member is now shown
+    await expect(page.getByText(SEED.members.lisa.name)).toBeVisible()
+  })
+
+  test("remove member from position shows confirmation", async ({ page }) => {
+    // Requires backend
+    await page.goto("/board")
+    const removeBtn = page.locator(
+      SEL.board.removeButton(SEED.board.vorsitz.id)
+    )
+    await removeBtn.click()
+
+    // Confirmation dialog
+    await expect(
+      page.locator(SEL.common.alertDialogConfirm)
+    ).toBeVisible()
+    await page.locator(SEL.common.alertDialogConfirm).click()
+
+    // Member name no longer visible on that position
+    const vorsitzCard = page.locator(
+      SEL.board.positionCard(SEED.board.vorsitz.id)
+    )
+    await expect(
+      vorsitzCard.getByText(SEED.board.vorsitz.elected)
+    ).not.toBeVisible()
+  })
+})

cannamanage-frontend/e2e/integration/04-distributions.spec.ts

@@ -0,0 +1,59 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+import { SEL } from "../selectors"
+
+const apiClient = new ApiClient()
+
+test.describe("Distributions Page @smoke", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("displays recent distributions from seed", async ({ page }) => {
+    await page.goto("/distributions")
+    // Verify distributions table/list is visible
+    await expect(
+      page.locator(SEL.distributions.table).or(page.getByRole("table"))
+    ).toBeVisible()
+  })
+
+  test("date filter works", async ({ page }) => {
+    await page.goto("/distributions")
+
+    // Look for filter buttons/tabs for today/week/month/all
+    const todayFilter = page.getByRole("button", { name: /heute|today/i })
+    const allFilter = page.getByRole("button", { name: /alle|all/i })
+
+    if (await todayFilter.isVisible()) {
+      await todayFilter.click()
+      // Page should update (no error)
+      await expect(page.locator("body")).toBeVisible()
+    }
+
+    if (await allFilter.isVisible()) {
+      await allFilter.click()
+      await expect(page.locator("body")).toBeVisible()
+    }
+  })
+
+  test("new distribution button navigates to form", async ({ page }) => {
+    await page.goto("/distributions")
+    const newBtn = page
+      .locator(SEL.distributions.newButton)
+      .or(page.getByRole("link", { name: /neue ausgabe|new/i }))
+    await expect(newBtn).toBeVisible()
+    await newBtn.click()
+    await page.waitForURL(/\/distributions\/new/)
+  })
+
+  test("shows gram total display", async ({ page }) => {
+    await page.goto("/distributions")
+    // The page should show some kind of total/summary
+    await expect(
+      page.getByText(/gramm|gesamt|total/i).first()
+    ).toBeVisible()
+  })
+})

cannamanage-frontend/e2e/integration/05-stock.spec.ts

@@ -0,0 +1,120 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+import { SEL } from "../selectors"
+
+const apiClient = new ApiClient()
+
+test.describe("Stock Page @smoke", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("displays seed batches", async ({ page }) => {
+    await page.goto("/stock")
+    await expect(
+      page.getByText(SEED.strains.northernLights.name)
+    ).toBeVisible()
+    await expect(
+      page.getByText(SEED.strains.cbdCriticalMass.name)
+    ).toBeVisible()
+    await expect(page.getByText(SEED.strains.amnesiaHaze.name)).toBeVisible()
+    await expect(page.getByText("500")).toBeVisible()
+    await expect(page.getByText("300")).toBeVisible()
+    await expect(page.getByText("200")).toBeVisible()
+  })
+
+  test("status filter works", async ({ page }) => {
+    await page.goto("/stock")
+
+    // Filter: All — should show all 3 batches
+    const allFilter = page.getByRole("button", { name: /alle|all/i })
+    if (await allFilter.isVisible()) {
+      await allFilter.click()
+      await expect(
+        page.getByText(SEED.strains.northernLights.name)
+      ).toBeVisible()
+      await expect(
+        page.getByText(SEED.strains.amnesiaHaze.name)
+      ).toBeVisible()
+    }
+
+    // Filter: Available — should hide recalled batch
+    const availableFilter = page.getByRole("button", {
+      name: /verfügbar|available/i,
+    })
+    if (await availableFilter.isVisible()) {
+      await availableFilter.click()
+      await expect(
+        page.getByText(SEED.strains.northernLights.name)
+      ).toBeVisible()
+      await expect(
+        page.getByText(SEED.strains.amnesiaHaze.name)
+      ).toBeHidden()
+    }
+
+    // Filter: Recalled — should only show recalled batch
+    const recalledFilter = page.getByRole("button", {
+      name: /zurückgerufen|recalled/i,
+    })
+    if (await recalledFilter.isVisible()) {
+      await recalledFilter.click()
+      await expect(
+        page.getByText(SEED.strains.amnesiaHaze.name)
+      ).toBeVisible()
+      await expect(
+        page.getByText(SEED.strains.northernLights.name)
+      ).toBeHidden()
+    }
+  })
+
+  test("new batch link navigates to /stock/new", async ({ page }) => {
+    await page.goto("/stock")
+    const addBtn = page
+      .locator(SEL.stock.addButton)
+      .or(page.getByRole("link", { name: /neue charge|new batch|hinzufügen/i }))
+    await expect(addBtn).toBeVisible()
+    await addBtn.click()
+    await page.waitForURL(/\/stock\/new/)
+  })
+
+  test("recall button opens AlertDialog confirmation", async ({ page }) => {
+    await page.goto("/stock")
+    const recallBtn = page.locator(
+      SEL.stock.recallButton(SEED.batches.northernLights.id)
+    )
+
+    if (await recallBtn.isVisible()) {
+      await recallBtn.click()
+      // AlertDialog should appear with confirm/cancel
+      await expect(
+        page
+          .locator(SEL.common.alertDialogConfirm)
+          .or(page.getByRole("alertdialog"))
+      ).toBeVisible()
+    }
+  })
+
+  test("recalled batch shows RECALLED badge", async ({ page }) => {
+    await page.goto("/stock")
+    // The Amnesia Haze batch is RECALLED
+    const recalledRow = page.locator(
+      SEL.stock.row(SEED.batches.amnesiaHaze.id)
+    )
+
+    if (await recalledRow.isVisible()) {
+      await expect(
+        recalledRow.getByText(/recalled|zurückgerufen/i)
+      ).toBeVisible()
+    } else {
+      // Fallback: look for the recalled badge near Amnesia Haze text
+      const amnesia = page.getByText(SEED.strains.amnesiaHaze.name)
+      await expect(amnesia).toBeVisible()
+      await expect(
+        page.getByText(/recalled|zurückgerufen/i).first()
+      ).toBeVisible()
+    }
+  })
+})

cannamanage-frontend/e2e/integration/06-calendar.spec.ts

@@ -0,0 +1,128 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("Calendar Page @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("renders current month", async ({ page }) => {
+    await page.goto("/calendar")
+
+    // Calendar should show current month name
+    const now = new Date()
+    const monthNames = [
+      "Januar",
+      "Februar",
+      "März",
+      "April",
+      "Mai",
+      "Juni",
+      "Juli",
+      "August",
+      "September",
+      "Oktober",
+      "November",
+      "Dezember",
+    ]
+    const currentMonth = monthNames[now.getMonth()]
+    const currentYear = now.getFullYear().toString()
+
+    await expect(
+      page
+        .getByText(currentMonth, { exact: false })
+        .or(page.getByText(currentYear))
+    ).toBeVisible()
+  })
+
+  test("seed events are visible", async ({ page }) => {
+    await page.goto("/calendar")
+
+    // There should be an upcoming assembly event (~14 days from now)
+    // and a past social event (~30 days ago) — look for event indicators
+    await expect(
+      page
+        .getByText(/versammlung|assembly/i)
+        .or(page.locator("[data-testid*='event']").first())
+    ).toBeVisible()
+  })
+
+  test("month navigation works", async ({ page }) => {
+    await page.goto("/calendar")
+
+    // Find prev/next month buttons
+    const nextBtn = page.getByRole("button", { name: /next|vor|nächst|›|>/i })
+    const prevBtn = page.getByRole("button", {
+      name: /prev|zurück|vorig|‹|</i,
+    })
+
+    // Navigate forward
+    if (await nextBtn.isVisible()) {
+      await nextBtn.click()
+      await page.waitForTimeout(300)
+      // Page should still render without error
+      await expect(page.locator("body")).toBeVisible()
+    }
+
+    // Navigate backward twice (back to previous month)
+    if (await prevBtn.isVisible()) {
+      await prevBtn.click()
+      await page.waitForTimeout(300)
+      await prevBtn.click()
+      await page.waitForTimeout(300)
+      await expect(page.locator("body")).toBeVisible()
+    }
+  })
+
+  test("create event opens dialog with form fields", async ({ page }) => {
+    await page.goto("/calendar")
+
+    const createBtn = page
+      .getByRole("button", { name: /erstellen|create|neues event|neu/i })
+      .or(page.locator('[data-testid="calendar-create-event"]'))
+
+    if (await createBtn.isVisible()) {
+      await createBtn.click()
+      // Dialog should have form fields for event creation
+      await expect(
+        page.getByRole("dialog").or(page.locator("[role='dialog']"))
+      ).toBeVisible()
+      // Expect title/name field
+      await expect(
+        page
+          .getByLabel(/titel|name|bezeichnung/i)
+          .or(page.locator("input[name*='title']"))
+      ).toBeVisible()
+    }
+  })
+
+  test("cancel event button shows confirmation", async ({ page }) => {
+    await page.goto("/calendar")
+
+    // Click on an existing event to open detail
+    const eventEl = page.locator("[data-testid*='event']").first()
+
+    if (await eventEl.isVisible()) {
+      await eventEl.click()
+      await page.waitForTimeout(300)
+
+      // Look for cancel/delete button
+      const cancelBtn = page.getByRole("button", {
+        name: /absagen|löschen|cancel|delete/i,
+      })
+
+      if (await cancelBtn.isVisible()) {
+        await cancelBtn.click()
+        // Should show confirmation dialog
+        await expect(
+          page.getByRole("alertdialog").or(page.getByText(/bestätigen|sicher/i))
+        ).toBeVisible()
+      }
+    }
+  })
+})

cannamanage-frontend/e2e/integration/07-forum.spec.ts

@@ -0,0 +1,101 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("Forum Page @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("lists seed topics", async ({ page }) => {
+    await page.goto("/forum")
+    await expect(
+      page.getByText("Neue Sorten für Sommer")
+    ).toBeVisible()
+    await expect(page.getByText("Bewässerungssystem")).toBeVisible()
+  })
+
+  test("topics show reply counts", async ({ page }) => {
+    await page.goto("/forum")
+    // Reply counts should be visible as numbers near topics
+    await expect(
+      page
+        .getByText(/antwort|repl/i)
+        .first()
+        .or(page.locator("[data-testid*='reply-count']").first())
+    ).toBeVisible()
+  })
+
+  test("new topic button opens create form", async ({ page }) => {
+    await page.goto("/forum")
+    const newBtn = page
+      .getByRole("button", { name: /neues thema|new topic|erstellen/i })
+      .or(page.locator('[data-testid="forum-new-topic"]'))
+
+    await expect(newBtn).toBeVisible()
+    await newBtn.click()
+
+    // Form should appear with title + content fields
+    await expect(
+      page
+        .getByRole("dialog")
+        .or(page.locator("form"))
+        .or(page.getByLabel(/titel|title/i))
+    ).toBeVisible()
+  })
+
+  test("create topic submits and shows new topic", async ({ page }) => {
+    await page.goto("/forum")
+
+    const newBtn = page
+      .getByRole("button", { name: /neues thema|new topic|erstellen/i })
+      .or(page.locator('[data-testid="forum-new-topic"]'))
+    await newBtn.click()
+
+    // Fill title
+    const titleInput = page
+      .getByLabel(/titel|title|thema/i)
+      .or(page.locator("input[name*='title']"))
+    await titleInput.fill("E2E Test Topic")
+
+    // Fill content
+    const contentInput = page
+      .getByLabel(/inhalt|content|nachricht|text/i)
+      .or(page.locator("textarea"))
+    await contentInput.fill("This is an integration test topic body.")
+
+    // Submit
+    const submitBtn = page.getByRole("button", {
+      name: /erstellen|submit|speichern|post/i,
+    })
+    await submitBtn.click()
+
+    // New topic should appear
+    await expect(page.getByText("E2E Test Topic")).toBeVisible({
+      timeout: 5000,
+    })
+  })
+
+  test("pin and lock buttons visible on topics", async ({ page }) => {
+    await page.goto("/forum")
+
+    // Admin should see pin/lock action buttons
+    const pinBtn = page
+      .getByRole("button", { name: /pin|anheften/i })
+      .first()
+      .or(page.locator("[data-testid*='pin']").first())
+    const lockBtn = page
+      .getByRole("button", { name: /lock|sperren/i })
+      .first()
+      .or(page.locator("[data-testid*='lock']").first())
+
+    // At least one should be visible for admin user
+    const pinVisible = await pinBtn.isVisible()
+    const lockVisible = await lockBtn.isVisible()
+    expect(pinVisible || lockVisible).toBeTruthy()
+  })
+})

cannamanage-frontend/e2e/integration/08-info-board.spec.ts

@@ -0,0 +1,122 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("Info Board Page @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("lists seed posts with pinned post first", async ({ page }) => {
+    await page.goto("/info-board")
+    // Should have at least 2 posts visible
+    const posts = page.locator("[data-testid*='info-post']").or(
+      page.locator("article, [role='article']")
+    )
+
+    // Wait for content to load
+    await page.waitForTimeout(1000)
+    await expect(page.locator("body")).toBeVisible()
+
+    // Verify posts are listed (look for post content or structure)
+    const postElements = page
+      .locator("[data-testid*='post']")
+      .or(page.locator("article"))
+    const count = await postElements.count()
+    expect(count).toBeGreaterThanOrEqual(1)
+  })
+
+  test("category filter dropdown works", async ({ page }) => {
+    await page.goto("/info-board")
+
+    // Look for category filter
+    const filterSelect = page
+      .locator('[data-testid="info-board-category-filter"]')
+      .or(page.getByRole("combobox"))
+      .or(page.locator("select"))
+
+    if (await filterSelect.first().isVisible()) {
+      await filterSelect.first().click()
+      await page.waitForTimeout(300)
+      // Options should appear
+      await expect(page.locator("body")).toBeVisible()
+    }
+  })
+
+  test("new post dialog opens and form submits", async ({ page }) => {
+    await page.goto("/info-board")
+
+    const newBtn = page
+      .getByRole("button", { name: /neuer beitrag|new post|erstellen/i })
+      .or(page.locator('[data-testid="info-board-new-post"]'))
+
+    await expect(newBtn).toBeVisible()
+    await newBtn.click()
+
+    // Dialog should open with form
+    await expect(
+      page.getByRole("dialog").or(page.locator("[role='dialog']"))
+    ).toBeVisible()
+
+    // Fill form fields
+    const titleInput = page
+      .getByLabel(/titel|title/i)
+      .or(page.locator("input[name*='title']"))
+    if (await titleInput.isVisible()) {
+      await titleInput.fill("E2E Test Beitrag")
+    }
+
+    const contentInput = page
+      .getByLabel(/inhalt|content|text/i)
+      .or(page.locator("textarea"))
+    if (await contentInput.isVisible()) {
+      await contentInput.fill("Test-Inhalt für Integration Test.")
+    }
+
+    // Submit
+    const submitBtn = page.getByRole("button", {
+      name: /erstellen|speichern|submit|posten/i,
+    })
+    if (await submitBtn.isVisible()) {
+      await submitBtn.click()
+      // Should succeed (toast or new post visible)
+      await page.waitForTimeout(1000)
+      await expect(page.locator("body")).toBeVisible()
+    }
+  })
+
+  test("pin indicator visible on pinned post", async ({ page }) => {
+    await page.goto("/info-board")
+
+    // Look for pin icon/badge on the first (pinned) post
+    await expect(
+      page
+        .locator("[data-testid*='pinned']")
+        .first()
+        .or(page.locator("[aria-label*='pin']").first())
+        .or(page.getByText(/📌|angepinnt|pinned/i).first())
+    ).toBeVisible()
+  })
+
+  test("archive and delete buttons visible", async ({ page }) => {
+    await page.goto("/info-board")
+
+    // Admin should see archive/delete actions
+    const archiveBtn = page
+      .getByRole("button", { name: /archiv/i })
+      .first()
+      .or(page.locator("[data-testid*='archive']").first())
+    const deleteBtn = page
+      .getByRole("button", { name: /löschen|delete/i })
+      .first()
+      .or(page.locator("[data-testid*='delete']").first())
+
+    const archiveVisible = await archiveBtn.isVisible()
+    const deleteVisible = await deleteBtn.isVisible()
+    expect(archiveVisible || deleteVisible).toBeTruthy()
+  })
+})

cannamanage-frontend/e2e/integration/09-grow.spec.ts

@@ -0,0 +1,76 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("Grow Page @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("shows seed grow entries", async ({ page }) => {
+    await page.goto("/grow")
+    await expect(
+      page.getByText("Northern Lights Batch #2")
+    ).toBeVisible()
+    await expect(page.getByText("CBD Outdoor")).toBeVisible()
+  })
+
+  test("displays grow stages", async ({ page }) => {
+    await page.goto("/grow")
+    // Should show VEGETATIVE and SEEDLING stage indicators
+    await expect(
+      page
+        .getByText(/vegetativ|vegetative/i)
+        .first()
+        .or(page.locator("[data-testid*='stage-VEGETATIVE']").first())
+    ).toBeVisible()
+    await expect(
+      page
+        .getByText(/sämling|seedling/i)
+        .first()
+        .or(page.locator("[data-testid*='stage-SEEDLING']").first())
+    ).toBeVisible()
+  })
+
+  test("stage progress indicators shown", async ({ page }) => {
+    await page.goto("/grow")
+    // Look for progress bars or step indicators
+    const progressIndicators = page
+      .locator("[role='progressbar']")
+      .or(page.locator("[data-testid*='progress']"))
+      .or(page.locator("[data-testid*='stage-indicator']"))
+
+    const count = await progressIndicators.count()
+    expect(count).toBeGreaterThanOrEqual(1)
+  })
+
+  test("new grow button links to correct path", async ({ page }) => {
+    await page.goto("/grow")
+    const newBtn = page
+      .getByRole("link", { name: /neuer grow|new grow|anlegen/i })
+      .or(page.locator('[data-testid="grow-new-button"]'))
+      .or(page.getByRole("button", { name: /neuer grow|new grow|anlegen/i }))
+
+    await expect(newBtn).toBeVisible()
+    await newBtn.click()
+    await page.waitForURL(/\/grow\/new/)
+  })
+
+  test("click on entry navigates to detail page", async ({ page }) => {
+    await page.goto("/grow")
+
+    // Click on the first grow entry
+    const entry = page
+      .getByText("Northern Lights Batch #2")
+      .or(page.locator("[data-testid*='grow-entry']").first())
+    await entry.click()
+
+    // Should navigate to /grow/[id]
+    await page.waitForURL(/\/grow\/[a-zA-Z0-9-]+/)
+    await expect(page.locator("body")).toBeVisible()
+  })
+})

cannamanage-frontend/e2e/integration/10-compliance.spec.ts

@@ -0,0 +1,62 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("Compliance Dashboard @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("compliance dashboard loads", async ({ page }) => {
+    await page.goto("/compliance")
+    // Page should load without error
+    await expect(
+      page
+        .getByText(/compliance|konformität/i)
+        .first()
+        .or(page.getByRole("heading").first())
+    ).toBeVisible()
+  })
+
+  test("shows area status cards", async ({ page }) => {
+    await page.goto("/compliance")
+    // Should display compliance areas: KCANG, FINANCE, DSGVO, VEREIN
+    await expect(page.getByText(/kcang/i)).toBeVisible()
+    await expect(page.getByText(/finan/i).first()).toBeVisible()
+    await expect(page.getByText(/dsgvo|datenschutz/i).first()).toBeVisible()
+    await expect(page.getByText(/verein/i).first()).toBeVisible()
+  })
+
+  test("overdue deadlines highlighted", async ({ page }) => {
+    await page.goto("/compliance")
+    // EÜR Abgabe should be overdue and highlighted
+    await expect(
+      page.getByText(/EÜR/i).or(page.getByText(/überfällig|overdue/i).first())
+    ).toBeVisible()
+
+    // Overdue items should have visual distinction (red text, warning badge, etc.)
+    const overdueIndicator = page
+      .locator("[data-testid*='overdue']")
+      .or(page.locator(".text-destructive, .text-red, [class*='overdue']"))
+      .first()
+
+    if (await overdueIndicator.isVisible()) {
+      await expect(overdueIndicator).toBeVisible()
+    }
+  })
+
+  test("upcoming deadlines show days remaining", async ({ page }) => {
+    await page.goto("/compliance")
+    // Should display upcoming deadlines with days remaining
+    await expect(
+      page
+        .getByText(/tag|day/i)
+        .first()
+        .or(page.locator("[data-testid*='deadline']").first())
+    ).toBeVisible()
+  })
+})

cannamanage-frontend/e2e/integration/11-finance.spec.ts

@@ -0,0 +1,73 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("Finance Page @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("finance page loads", async ({ page }) => {
+    await page.goto("/finance")
+    await expect(
+      page
+        .getByRole("heading", { name: /finan/i })
+        .or(page.getByText(/finanzen|finance/i).first())
+    ).toBeVisible()
+  })
+
+  test("sub-navigation links exist", async ({ page }) => {
+    await page.goto("/finance")
+    // Should have sub-nav links for: payments, kassenbuch, import, fee-schedules, reports
+    const links = [
+      /zahlungen|payments/i,
+      /kassenbuch/i,
+      /import/i,
+      /beitragsordnung|fee/i,
+      /berichte|reports/i,
+    ]
+
+    for (const linkPattern of links) {
+      const link = page
+        .getByRole("link", { name: linkPattern })
+        .or(page.getByRole("tab", { name: linkPattern }))
+        .or(page.getByRole("button", { name: linkPattern }))
+      await expect(link.first()).toBeVisible()
+    }
+  })
+
+  test("payments sub-page loads", async ({ page }) => {
+    await page.goto("/finance/payments")
+    await expect(page.locator("body")).toBeVisible()
+    // Should not show an error page
+    await expect(page.getByText(/404|not found/i)).not.toBeVisible()
+  })
+
+  test("kassenbuch sub-page loads", async ({ page }) => {
+    await page.goto("/finance/kassenbuch")
+    await expect(page.locator("body")).toBeVisible()
+    await expect(page.getByText(/404|not found/i)).not.toBeVisible()
+  })
+
+  test("import sub-page loads", async ({ page }) => {
+    await page.goto("/finance/import")
+    await expect(page.locator("body")).toBeVisible()
+    await expect(page.getByText(/404|not found/i)).not.toBeVisible()
+  })
+
+  test("fee-schedules sub-page loads", async ({ page }) => {
+    await page.goto("/finance/fee-schedules")
+    await expect(page.locator("body")).toBeVisible()
+    await expect(page.getByText(/404|not found/i)).not.toBeVisible()
+  })
+
+  test("reports sub-page loads", async ({ page }) => {
+    await page.goto("/finance/reports")
+    await expect(page.locator("body")).toBeVisible()
+    await expect(page.getByText(/404|not found/i)).not.toBeVisible()
+  })
+})

cannamanage-frontend/e2e/integration/12-audit-log.spec.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("Audit Log Page @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  test("audit log page loads", async ({ page }) => {
+    await page.goto("/audit-log")
+    await expect(
+      page
+        .getByRole("heading", { name: /audit|protokoll/i })
+        .or(page.getByText(/audit/i).first())
+    ).toBeVisible()
+  })
+
+  test("shows table or list structure", async ({ page }) => {
+    await page.goto("/audit-log")
+    // Should display audit entries in a table or list
+    const table = page
+      .getByRole("table")
+      .or(page.locator("[data-testid='audit-log-table']"))
+      .or(page.locator("[data-testid*='audit-entry']").first())
+
+    await expect(table.first()).toBeVisible()
+  })
+
+  test("has filter or search capability", async ({ page }) => {
+    await page.goto("/audit-log")
+    // Should have some kind of filter/search input
+    const filterInput = page
+      .getByRole("searchbox")
+      .or(page.getByPlaceholder(/such|filter|search/i))
+      .or(page.locator('[data-testid="audit-log-filter"]'))
+      .or(page.locator("input[type='search']"))
+      .or(page.getByRole("combobox"))
+
+    await expect(filterInput.first()).toBeVisible()
+  })
+})

cannamanage-frontend/e2e/integration/13-kcang-regulatory.spec.ts

@@ -0,0 +1,295 @@
+import { expect, test } from "@playwright/test"
+
+import { ApiClient } from "../api-client"
+import { SEED } from "../seed-constants"
+
+const apiClient = new ApiClient()
+
+test.describe("KCanG Regulatory Edge Cases @full", () => {
+  test.beforeEach(async () => {
+    await apiClient.login(SEED.admin.email, SEED.admin.password)
+    await apiClient.resetDb()
+  })
+
+  // Requires: backend quota enforcement
+  test("rejects adult distribution exceeding 25g/day", async ({ page }) => {
+    await page.goto("/distributions/new")
+
+    // Select adult member (Max Mustermann)
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.max.name).click()
+
+    // Select strain
+    const strainSelect = page
+      .getByLabel(/sorte|strain|charge|batch/i)
+      .or(page.locator("[data-testid='distribution-strain-select']"))
+    await strainSelect.click()
+    await page.getByText(SEED.strains.northernLights.name).click()
+
+    // Enter 26g (exceeds 25g daily limit)
+    const amountInput = page
+      .getByLabel(/menge|amount|gramm/i)
+      .or(page.locator("input[name*='amount']"))
+    await amountInput.fill("26")
+
+    // Submit
+    const submitBtn = page.getByRole("button", {
+      name: /ausgeben|submit|speichern/i,
+    })
+    await submitBtn.click()
+
+    // Should show rejection/error
+    await expect(
+      page.getByText(/überschr|exceeded|limit|abgelehnt|rejected/i)
+    ).toBeVisible({ timeout: 5000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("accepts adult distribution of exactly 25g", async ({ page }) => {
+    await page.goto("/distributions/new")
+
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.max.name).click()
+
+    const strainSelect = page
+      .getByLabel(/sorte|strain|charge|batch/i)
+      .or(page.locator("[data-testid='distribution-strain-select']"))
+    await strainSelect.click()
+    await page.getByText(SEED.strains.northernLights.name).click()
+
+    const amountInput = page
+      .getByLabel(/menge|amount|gramm/i)
+      .or(page.locator("input[name*='amount']"))
+    await amountInput.fill("25")
+
+    const submitBtn = page.getByRole("button", {
+      name: /ausgeben|submit|speichern/i,
+    })
+    await submitBtn.click()
+
+    // Should succeed
+    await expect(
+      page.getByText(/erfolg|success|gespeichert/i)
+    ).toBeVisible({ timeout: 5000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("rejects under-21 member with strain exceeding 10% THC", async ({
+    page,
+  }) => {
+    await page.goto("/distributions/new")
+
+    // Select under-21 member (Jonas Weber)
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.jonas.name).click()
+
+    // Select Amnesia Haze (22% THC — exceeds 10% limit for under-21)
+    const strainSelect = page
+      .getByLabel(/sorte|strain|charge|batch/i)
+      .or(page.locator("[data-testid='distribution-strain-select']"))
+    await strainSelect.click()
+    await page.getByText(SEED.strains.amnesiaHaze.name).click()
+
+    const amountInput = page
+      .getByLabel(/menge|amount|gramm/i)
+      .or(page.locator("input[name*='amount']"))
+    await amountInput.fill("5")
+
+    const submitBtn = page.getByRole("button", {
+      name: /ausgeben|submit|speichern/i,
+    })
+    await submitBtn.click()
+
+    // Should show THC rejection
+    await expect(
+      page.getByText(/thc|überschr|exceeded|limit|abgelehnt|rejected/i)
+    ).toBeVisible({ timeout: 5000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("accepts under-21 member with strain within THC limit", async ({
+    page,
+  }) => {
+    await page.goto("/distributions/new")
+
+    // Select under-21 member (Jonas)
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.jonas.name).click()
+
+    // Select CBD Critical Mass (5% THC — within 10% limit)
+    const strainSelect = page
+      .getByLabel(/sorte|strain|charge|batch/i)
+      .or(page.locator("[data-testid='distribution-strain-select']"))
+    await strainSelect.click()
+    await page.getByText(SEED.strains.cbdCriticalMass.name).click()
+
+    const amountInput = page
+      .getByLabel(/menge|amount|gramm/i)
+      .or(page.locator("input[name*='amount']"))
+    await amountInput.fill("5")
+
+    const submitBtn = page.getByRole("button", {
+      name: /ausgeben|submit|speichern/i,
+    })
+    await submitBtn.click()
+
+    // Should succeed
+    await expect(
+      page.getByText(/erfolg|success|gespeichert/i)
+    ).toBeVisible({ timeout: 5000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("rejects under-21 member exceeding 30g/month", async ({ page }) => {
+    // This test assumes Jonas has already received close to 30g this month
+    // The seed data should set up 31g attempted distribution
+    await page.goto("/distributions/new")
+
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.jonas.name).click()
+
+    const strainSelect = page
+      .getByLabel(/sorte|strain|charge|batch/i)
+      .or(page.locator("[data-testid='distribution-strain-select']"))
+    await strainSelect.click()
+    await page.getByText(SEED.strains.cbdCriticalMass.name).click()
+
+    // 31g exceeds the 30g/month limit for under-21
+    const amountInput = page
+      .getByLabel(/menge|amount|gramm/i)
+      .or(page.locator("input[name*='amount']"))
+    await amountInput.fill("31")
+
+    const submitBtn = page.getByRole("button", {
+      name: /ausgeben|submit|speichern/i,
+    })
+    await submitBtn.click()
+
+    // Should show monthly quota rejection
+    await expect(
+      page.getByText(/überschr|exceeded|limit|monat|monthly|abgelehnt/i)
+    ).toBeVisible({ timeout: 5000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("accepts near-quota member within daily limit", async ({ page }) => {
+    // Thomas has 23g already this day — 2g more should be fine (25g total)
+    await page.goto("/distributions/new")
+
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.thomas.name).click()
+
+    const strainSelect = page
+      .getByLabel(/sorte|strain|charge|batch/i)
+      .or(page.locator("[data-testid='distribution-strain-select']"))
+    await strainSelect.click()
+    await page.getByText(SEED.strains.northernLights.name).click()
+
+    const amountInput = page
+      .getByLabel(/menge|amount|gramm/i)
+      .or(page.locator("input[name*='amount']"))
+    await amountInput.fill("2")
+
+    const submitBtn = page.getByRole("button", {
+      name: /ausgeben|submit|speichern/i,
+    })
+    await submitBtn.click()
+
+    // Should succeed (23g + 2g = 25g, exactly at limit)
+    await expect(
+      page.getByText(/erfolg|success|gespeichert/i)
+    ).toBeVisible({ timeout: 5000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("rejects near-quota member exceeding daily cumulative", async ({
+    page,
+  }) => {
+    // Thomas has 23g already — 3g more would be 26g (exceeds 25g/day)
+    await page.goto("/distributions/new")
+
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.thomas.name).click()
+
+    const strainSelect = page
+      .getByLabel(/sorte|strain|charge|batch/i)
+      .or(page.locator("[data-testid='distribution-strain-select']"))
+    await strainSelect.click()
+    await page.getByText(SEED.strains.northernLights.name).click()
+
+    const amountInput = page
+      .getByLabel(/menge|amount|gramm/i)
+      .or(page.locator("input[name*='amount']"))
+    await amountInput.fill("3")
+
+    const submitBtn = page.getByRole("button", {
+      name: /ausgeben|submit|speichern/i,
+    })
+    await submitBtn.click()
+
+    // Should show daily cumulative rejection
+    await expect(
+      page.getByText(/überschr|exceeded|limit|abgelehnt|rejected/i)
+    ).toBeVisible({ timeout: 5000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("shows THC warning for under-21 members on distribution page", async ({
+    page,
+  }) => {
+    await page.goto("/distributions/new")
+
+    // Select under-21 member (Jonas)
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.jonas.name).click()
+
+    // Should show THC% warning/info for under-21
+    await expect(
+      page.getByText(/thc.*10|unter.*21|u21|jugendschutz/i).first()
+    ).toBeVisible({ timeout: 3000 })
+  })
+
+  // Requires: backend quota enforcement
+  test("quota display shows correct remaining amount", async ({ page }) => {
+    await page.goto("/distributions/new")
+
+    // Select Thomas (near-quota member, 23g already used today)
+    const memberSelect = page
+      .getByLabel(/mitglied|member/i)
+      .or(page.locator("[data-testid='distribution-member-select']"))
+    await memberSelect.click()
+    await page.getByText(SEED.members.thomas.name).click()
+
+    // Should display remaining quota info
+    await expect(
+      page
+        .getByText(/verbleibend|remaining|rest|kontingent|quota/i)
+        .first()
+        .or(page.locator("[data-testid*='quota']").first())
+    ).toBeVisible({ timeout: 3000 })
+  })
+})

cannamanage-frontend/e2e/integration/README.md

@@ -0,0 +1,22 @@
+# Integration Tests
+
+Full-stack integration tests that run against a real backend + database.
+
+## Running locally
+
+```bash
+docker compose -f docker-compose.test.yml -f docker-compose.test.local.yml up --build
+```
+
+## Running in CI
+
+```bash
+docker compose -f docker-compose.test.yml up --build --abort-on-container-exit
+```
+
+## Test Structure
+
+- Each spec file tests one page/feature
+- Tests use `data-testid` selectors from `../selectors.ts`
+- Expected values come from `../seed-constants.ts`
+- DB is reset before each test via `ApiClient.resetDb()`

cannamanage-frontend/e2e/seed-constants.ts

@@ -0,0 +1,145 @@
+/**
+ * Deterministic seed data constants matching R__seed_test_data.sql.
+ * Single source of truth for all integration test assertions.
+ */
+export const SEED = {
+  club: {
+    id: "a0000000-0000-0000-0000-000000000001",
+    name: "Grüner Daumen e.V.",
+  },
+  admin: {
+    id: "b1000000-0000-0000-0000-000000000001",
+    email: "admin@gruener-daumen.de",
+    password: "TestAdmin123!",
+  },
+  members: {
+    max: {
+      id: "c1000000-0000-0000-0000-000000000001",
+      name: "Max Mustermann",
+      status: "ACTIVE",
+    },
+    anna: {
+      id: "c1000000-0000-0000-0000-000000000002",
+      name: "Anna Schmidt",
+      status: "ACTIVE",
+    },
+    jonas: {
+      id: "c1000000-0000-0000-0000-000000000003",
+      name: "Jonas Weber",
+      status: "ACTIVE",
+      isUnder21: true,
+    },
+    maria: {
+      id: "c1000000-0000-0000-0000-000000000004",
+      name: "Maria Müller",
+      status: "SUSPENDED",
+    },
+    thomas: {
+      id: "c1000000-0000-0000-0000-000000000005",
+      name: "Thomas Müller",
+      status: "ACTIVE",
+      nearQuota: true,
+    },
+    lisa: {
+      id: "c1000000-0000-0000-0000-000000000006",
+      name: "Lisa Bauer",
+      status: "ACTIVE",
+    },
+    karl: {
+      id: "c1000000-0000-0000-0000-000000000007",
+      name: "Karl Fischer",
+      status: "EXPELLED",
+    },
+  },
+  strains: {
+    northernLights: {
+      id: "d1000000-0000-0000-0000-000000000001",
+      name: "Northern Lights",
+      thc: 18.5,
+      cbd: 0.5,
+    },
+    cbdCriticalMass: {
+      id: "d1000000-0000-0000-0000-000000000002",
+      name: "CBD Critical Mass",
+      thc: 5.0,
+      cbd: 12.0,
+    },
+    amnesiaHaze: {
+      id: "d1000000-0000-0000-0000-000000000003",
+      name: "Amnesia Haze",
+      thc: 22.0,
+      cbd: 0.1,
+    },
+  },
+  batches: {
+    northernLights: {
+      id: "e1000000-0000-0000-0000-000000000001",
+      quantity: 500,
+      status: "AVAILABLE",
+    },
+    cbdCriticalMass: {
+      id: "e1000000-0000-0000-0000-000000000002",
+      quantity: 300,
+      status: "AVAILABLE",
+    },
+    amnesiaHaze: {
+      id: "e1000000-0000-0000-0000-000000000003",
+      quantity: 200,
+      status: "RECALLED",
+    },
+  },
+  documents: {
+    satzung: {
+      id: "f1000000-0000-0000-0000-000000000001",
+      title: "Vereinssatzung 2024",
+      category: "SATZUNG",
+    },
+    protokoll: {
+      id: "f1000000-0000-0000-0000-000000000002",
+      title: "Protokoll MV März 2024",
+      category: "PROTOKOLL",
+    },
+    genehmigung: {
+      id: "f1000000-0000-0000-0000-000000000003",
+      title: "KCanG-Genehmigung",
+      category: "GENEHMIGUNG",
+    },
+    mietvertrag: {
+      id: "f1000000-0000-0000-0000-000000000004",
+      title: "Mietvertrag",
+      category: "VERTRAG",
+    },
+  },
+  board: {
+    vorsitz: {
+      id: "g1000000-0000-0000-0000-000000000001",
+      title: "Vorsitzende/r",
+      elected: "Max Mustermann",
+    },
+    kasse: {
+      id: "g1000000-0000-0000-0000-000000000002",
+      title: "Kassenführung",
+      elected: "Anna Schmidt",
+    },
+    schrift: {
+      id: "g1000000-0000-0000-0000-000000000003",
+      title: "Schriftführung",
+      vacant: true,
+    },
+  },
+  counts: {
+    totalMembers: 7,
+    activeMembers: 5,
+    documents: 4,
+    batches: 3,
+    availableBatches: 2,
+    boardPositions: 3,
+    vacantPositions: 1,
+  },
+  kcang: {
+    adultDailyLimitGrams: 25,
+    adultMonthlyLimitGrams: 50,
+    under21MonthlyLimitGrams: 30,
+    under21MaxThcPercent: 10,
+  },
+} as const

cannamanage-frontend/e2e/selectors.ts

@@ -0,0 +1,72 @@
+/**
+ * Centralized data-testid selectors for integration tests.
+ * Naming convention: <page>-<component>-<identifier>
+ *
+ * Note: The actual data-testid attributes will be added incrementally
+ * to frontend components during Phase 2E as tests are written.
+ */
+export const SEL = {
+  // Sidebar / Navigation
+  nav: {
+    sidebar: '[data-testid="nav-sidebar"]',
+    members: '[data-testid="nav-link-members"]',
+    distributions: '[data-testid="nav-link-distributions"]',
+    stock: '[data-testid="nav-link-stock"]',
+    documents: '[data-testid="nav-link-documents"]',
+    board: '[data-testid="nav-link-board"]',
+    calendar: '[data-testid="nav-link-calendar"]',
+    forum: '[data-testid="nav-link-forum"]',
+    grow: '[data-testid="nav-link-grow"]',
+    compliance: '[data-testid="nav-link-compliance"]',
+  },
+  // Members page
+  members: {
+    table: '[data-testid="members-table"]',
+    searchInput: '[data-testid="members-search-input"]',
+    addButton: '[data-testid="members-add-button"]',
+    row: (id: string) => `[data-testid="members-row-${id}"]`,
+    statusBadge: (id: string) => `[data-testid="members-status-${id}"]`,
+  },
+  // Documents page
+  documents: {
+    uploadButton: '[data-testid="documents-upload-button"]',
+    uploadDialog: '[data-testid="documents-upload-dialog"]',
+    titleInput: '[data-testid="documents-title-input"]',
+    categorySelect: '[data-testid="documents-category-select"]',
+    fileInput: '[data-testid="documents-file-input"]',
+    submitUpload: '[data-testid="documents-submit-upload"]',
+    downloadButton: (id: string) => `[data-testid="documents-download-${id}"]`,
+    deleteButton: (id: string) => `[data-testid="documents-delete-${id}"]`,
+    deleteConfirm: '[data-testid="documents-delete-confirm"]',
+    categoryBadge: (category: string) =>
+      `[data-testid="documents-category-${category}"]`,
+    row: (id: string) => `[data-testid="documents-row-${id}"]`,
+  },
+  // Board page
+  board: {
+    createPositionButton: '[data-testid="board-create-position"]',
+    electMemberButton: '[data-testid="board-elect-member"]',
+    removeButton: (id: string) => `[data-testid="board-remove-${id}"]`,
+    positionCard: (id: string) => `[data-testid="board-position-${id}"]`,
+  },
+  // Stock page
+  stock: {
+    addButton: '[data-testid="stock-add-button"]',
+    recallButton: (id: string) => `[data-testid="stock-recall-${id}"]`,
+    table: '[data-testid="stock-table"]',
+    row: (id: string) => `[data-testid="stock-row-${id}"]`,
+  },
+  // Distributions page
+  distributions: {
+    newButton: '[data-testid="distributions-new-button"]',
+    table: '[data-testid="distributions-table"]',
+    row: (id: string) => `[data-testid="distributions-row-${id}"]`,
+  },
+  // Common/shared
+  common: {
+    toast: '[data-testid="toast"]',
+    loadingSkeleton: '[data-testid="loading-skeleton"]',
+    alertDialogConfirm: '[data-testid="alert-dialog-confirm"]',
+    alertDialogCancel: '[data-testid="alert-dialog-cancel"]',
+  },
+} as const

cannamanage-frontend/messages/de.json

@@ -44,7 +44,8 @@
     "emailInvalid": "Bitte gib eine gültige E-Mail-Adresse ein.",
     "passwordRequired": "Bitte gib dein Passwort ein.",
     "passwordTooShort": "Passwort muss mindestens 8 Zeichen lang sein.",
-    "footerText": "Sichere Verwaltung für deinen Cannabis-Anbauverein"
+    "footerText": "Sichere Verwaltung für deinen Cannabis-Anbauverein",
+    "loginTitle": "Anmelden"
   },
   "dashboard": {
     "title": "Dashboard",
@@ -668,6 +669,18 @@
           "starter": "E-Mail",
           "pro": "Priorität",
           "enterprise": "Dediziert"
+        },
+        "compStorage": {
+          "label": "Speicher",
+          "starter": "5 GB",
+          "pro": "50 GB",
+          "enterprise": "Individuell"
+        },
+        "compOverage": {
+          "label": "Überschreitung",
+          "starter": "Upgrade nötig",
+          "pro": "0,15 €/GB/Mo",
+          "enterprise": "—"
         }
       },
       "faq": {
@@ -690,7 +703,29 @@
         "migration": {
           "question": "Kann ich den Plan später wechseln?",
           "answer": "Ja, du kannst jederzeit zwischen Starter und Pro wechseln. Ein Upgrade wird sofort wirksam, ein Downgrade zum nächsten Abrechnungszeitraum."
+        },
+        "storage": {
+          "question": "Was passiert, wenn mein Speicher voll ist?",
+          "answer": "Im Starter-Plan kannst du auf Pro upgraden. Im Pro-Plan wird zusätzlicher Speicher mit 0,15 €/GB/Monat berechnet. Enterprise-Kunden haben individuelle Speichervereinbarungen."
         }
+      },
+      "storage": {
+        "starter": "5 GB Speicher",
+        "pro": "50 GB Speicher",
+        "proOverage": "(danach 0,15 €/GB/Monat)",
+        "enterprise": "Individueller Speicher",
+        "comparisonTitle": "Funktionen im Vergleich",
+        "featureMembers": "Mitglieder",
+        "featureStorage": "Speicher",
+        "featureOverage": "Überschreitung",
+        "featureGrow": "Grow-Kalender",
+        "featureApi": "API-Zugang",
+        "featureMultiClub": "Multi-Club",
+        "overageUpgrade": "Upgrade erforderlich",
+        "overagePro": "0,15 €/GB/Mo",
+        "overageEnterprise": "—",
+        "unlimited": "Unbegrenzt",
+        "custom": "Individuell"
       }
     },
     "impressum": {
@@ -753,6 +788,46 @@
       "s9Content": "Der Anbieter verarbeitet personenbezogene Daten gemäß der Datenschutzerklärung und den Bestimmungen der DSGVO. Soweit der Anbieter Daten im Auftrag des Nutzers verarbeitet, wird ein gesonderter Auftragsverarbeitungsvertrag geschlossen.",
       "s10Title": "§ 10 Schlussbestimmungen",
       "s10Content": "Es gilt das Recht der Bundesrepublik Deutschland. Gerichtsstand ist, soweit gesetzlich zulässig, der Sitz des Anbieters. Sollten einzelne Bestimmungen dieser AGB unwirksam sein, bleibt die Wirksamkeit der übrigen Bestimmungen unberührt. Änderungen der AGB werden dem Nutzer rechtzeitig mitgeteilt."
+    },
+    "home": {
+      "heroTitle": "Die smarte Verwaltung für deinen Anbauverein",
+      "heroSubtitle": "Compliance, Anbau, Mitglieder und Abgaben — alles in einer Plattform. Rechtssicher nach KCanG.",
+      "ctaPrimary": "Preise ansehen",
+      "ctaSecondary": "Jetzt anmelden",
+      "featuresTitle": "Alles, was dein Verein braucht",
+      "featuresSubtitle": "Von der Mitgliederverwaltung bis zur Behördenmeldung — CannaManage deckt den gesamten Vereinsbetrieb ab.",
+      "feature1Title": "Compliance Tracking",
+      "feature1Desc": "Automatische Überwachung der KCanG-Vorgaben mit Fristen und Checklisten.",
+      "feature2Title": "Grow Management",
+      "feature2Desc": "Anbaukalender, Wachstumsphasen und Sensorintegration.",
+      "feature3Title": "Mitglieder-Portal",
+      "feature3Desc": "Self-Service für Mitglieder: Profil, Abgabehistorie, Dokumente.",
+      "feature4Title": "Abgabe-Quotas",
+      "feature4Desc": "Automatische Einhaltung der 25g/Tag und 50g/Monat Grenzen.",
+      "feature5Title": "Dokumenten-Archiv",
+      "feature5Desc": "GoBD-konforme Ablage mit Aufbewahrungsfristen und Versionierung.",
+      "feature6Title": "Finanzverwaltung",
+      "feature6Desc": "Mitgliedsbeiträge, SEPA-Export und Bankimport.",
+      "trustTitle": "Vertrauen durch Compliance",
+      "trustCanverg": "CanVerG-konform",
+      "trustDsgvo": "DSGVO & GoBD",
+      "trustEncryption": "TLS-verschlüsselt",
+      "trustGerman": "Hosting in Deutschland",
+      "ctaFinalTitle": "Bereit für den nächsten Schritt?",
+      "ctaFinalSubtitle": "Starte jetzt mit CannaManage und bring deinen Verein auf das nächste Level.",
+      "ctaFinalButton": "Kostenlos testen"
+    },
+    "nav": {
+      "features": "Features",
+      "pricing": "Preise",
+      "login": "Anmelden",
+      "footerTagline": "Die sichere Verwaltungssoftware für Cannabis-Anbauvereine in Deutschland.",
+      "footerProduct": "Produkt",
+      "footerLegal": "Rechtliches",
+      "impressum": "Impressum",
+      "datenschutz": "Datenschutz",
+      "agb": "AGB",
+      "allRightsReserved": "Alle Rechte vorbehalten."
     }
   },
   "infoBoard": {

cannamanage-frontend/messages/en.json

@@ -44,7 +44,8 @@
     "emailInvalid": "Please enter a valid email address.",
     "passwordRequired": "Please enter your password.",
     "passwordTooShort": "Password must be at least 8 characters.",
-    "footerText": "Secure management for your cannabis cultivation club"
+    "footerText": "Secure management for your cannabis cultivation club",
+    "loginTitle": "Sign In"
   },
   "dashboard": {
     "title": "Dashboard",
@@ -668,6 +669,18 @@
           "starter": "Email",
           "pro": "Priority",
           "enterprise": "Dedicated"
+        },
+        "compStorage": {
+          "label": "Storage",
+          "starter": "5 GB",
+          "pro": "50 GB",
+          "enterprise": "Custom"
+        },
+        "compOverage": {
+          "label": "Overage",
+          "starter": "Upgrade required",
+          "pro": "€0.15/GB/mo",
+          "enterprise": "—"
         }
       },
       "faq": {
@@ -690,7 +703,29 @@
         "migration": {
           "question": "Can I switch plans later?",
           "answer": "Yes, you can switch between Starter and Pro at any time. Upgrades take effect immediately, downgrades at the next billing period."
+        },
+        "storage": {
+          "question": "What happens when my storage is full?",
+          "answer": "On the Starter plan, you can upgrade to Pro. On the Pro plan, additional storage is billed at €0.15/GB/month. Enterprise customers have custom storage agreements."
         }
+      },
+      "storage": {
+        "starter": "5 GB Storage",
+        "pro": "50 GB Storage",
+        "proOverage": "(then €0.15/GB/month)",
+        "enterprise": "Custom Storage",
+        "comparisonTitle": "Feature Comparison",
+        "featureMembers": "Members",
+        "featureStorage": "Storage",
+        "featureOverage": "Overage",
+        "featureGrow": "Grow Calendar",
+        "featureApi": "API Access",
+        "featureMultiClub": "Multi-Club",
+        "overageUpgrade": "Upgrade required",
+        "overagePro": "€0.15/GB/mo",
+        "overageEnterprise": "—",
+        "unlimited": "Unlimited",
+        "custom": "Custom"
       }
     },
     "impressum": {
@@ -753,6 +788,46 @@
       "s9Content": "The provider processes personal data in accordance with the privacy policy and GDPR provisions. Where the provider processes data on behalf of the user, a separate data processing agreement is concluded.",
       "s10Title": "§ 10 Final Provisions",
       "s10Content": "The law of the Federal Republic of Germany applies. The place of jurisdiction is, to the extent legally permissible, the registered office of the provider. Should individual provisions of these terms be invalid, the validity of the remaining provisions remains unaffected. Changes to these terms will be communicated to the user in good time."
+    },
+    "home": {
+      "heroTitle": "The Smart Management for Your Cannabis Club",
+      "heroSubtitle": "Compliance, growing, members and distributions — all in one platform. Legally compliant under KCanG.",
+      "ctaPrimary": "View Pricing",
+      "ctaSecondary": "Sign In",
+      "featuresTitle": "Everything Your Club Needs",
+      "featuresSubtitle": "From member management to regulatory reporting — CannaManage covers all aspects of your club operations.",
+      "feature1Title": "Compliance Tracking",
+      "feature1Desc": "Automatic monitoring of KCanG requirements with deadlines and checklists.",
+      "feature2Title": "Grow Management",
+      "feature2Desc": "Growing calendar, growth phases and sensor integration.",
+      "feature3Title": "Member Portal",
+      "feature3Desc": "Self-service for members: profile, distribution history, documents.",
+      "feature4Title": "Distribution Quotas",
+      "feature4Desc": "Automatic enforcement of 25g/day and 50g/month limits.",
+      "feature5Title": "Document Archive",
+      "feature5Desc": "GoBD-compliant storage with retention periods and versioning.",
+      "feature6Title": "Financial Management",
+      "feature6Desc": "Membership fees, SEPA export and bank import.",
+      "trustTitle": "Trust Through Compliance",
+      "trustCanverg": "CanVerG compliant",
+      "trustDsgvo": "GDPR & GoBD",
+      "trustEncryption": "TLS encrypted",
+      "trustGerman": "Hosted in Germany",
+      "ctaFinalTitle": "Ready for the Next Step?",
+      "ctaFinalSubtitle": "Start with CannaManage now and take your club to the next level.",
+      "ctaFinalButton": "Try for Free"
+    },
+    "nav": {
+      "features": "Features",
+      "pricing": "Pricing",
+      "login": "Sign In",
+      "footerTagline": "The secure management software for cannabis cultivation clubs in Germany.",
+      "footerProduct": "Product",
+      "footerLegal": "Legal",
+      "impressum": "Imprint",
+      "datenschutz": "Privacy Policy",
+      "agb": "Terms",
+      "allRightsReserved": "All rights reserved."
     }
   },
   "infoBoard": {

cannamanage-frontend/next.config.mjs

@@ -10,15 +10,10 @@ const nextConfig = {
   // Required for Docker standalone output
   output: "standalone",
 
-  // Proxy API calls to the Spring Boot backend
+  // NOTE: API calls to /api/backend/* are proxied by the server-side Route
-  async rewrites() {
+  // Handler at src/app/api/backend/[...path]/route.ts, NOT by a static
-    return [
+  // rewrite. A static rewrite cannot inject the NextAuth Bearer token; the
-      {
+  // route handler reads the session via auth() and forwards it. See that file.
-        source: "/api/backend/:path*",
-        destination: `${process.env.BACKEND_URL || "http://localhost:8080"}/api/v1/:path*`,
-      },
-    ]
-  },
 }
 
 export default withNextIntl(nextConfig)

cannamanage-frontend/package.json

@@ -1,11 +1,11 @@
 {
-  "name": "shadboard-nextjs-starter-kit",
+  "name": "cannamanage-frontend",
   "version": "1.0.0",
   "license": "MIT",
   "private": true,
   "author": {
-    "name": "Layth Alqadhi",
+    "name": "Patrick Plate",
-    "url": "https://github.com/LaythAlqadhi"
+    "url": "https://github.com/pplate"
   },
   "scripts": {
     "dev": "next dev --turbopack",
@@ -13,6 +13,7 @@
     "start": "next start",
     "lint": "next lint",
     "lint:fix": "next lint --fix",
+    "type-check": "tsc --noEmit",
     "format": "prettier --ignore-path .gitignore --write .",
     "test": "vitest",
     "test:run": "vitest run",
@@ -55,7 +56,7 @@
     "emoji-picker-react": "4.12.2",
     "input-otp": "1.4.2",
     "lucide-react": "0.446.0",
-    "next": "15.5.18",
+    "next": "15.5.19",
     "next-auth": "5.0.0-beta.31",
     "next-intl": "^4.13.0",
     "react": "19.1.3",
@@ -87,7 +88,7 @@
     "@types/sockjs-client": "^1.5.4",
     "@vitejs/plugin-react": "^6.0.2",
     "eslint": "9.18.0",
-    "eslint-config-next": "15.5.18",
+    "eslint-config-next": "15.5.19",
     "eslint-config-prettier": "10.1.1",
     "eslint-plugin-prettier": "5.2.3",
     "jsdom": "^29.1.1",
@@ -106,6 +107,9 @@
     "@types/react": "19.0.12",
     "@types/react-dom": "19.0.4",
     "picomatch": ">=4.0.2",
-    "postcss": ">=8.4.31"
+    "postcss": ">=8.4.31",
+    "minimatch": ">=5.1.6",
+    "brace-expansion": ">=2.0.1",
+    "ajv": ">=8.17.1"
   }
 }

cannamanage-frontend/playwright.config.ts

@@ -1,6 +1,7 @@
-import { defineConfig } from "@playwright/test"
 import path from "path"
 
+import { defineConfig } from "@playwright/test"
+
 const authFile = path.join(__dirname, "e2e", ".auth", "admin.json")
 
 export default defineConfig({
@@ -9,7 +10,7 @@ export default defineConfig({
   retries: 0,
   timeout: 90_000,
   use: {
-    baseURL: "http://localhost:3000",
+    baseURL: process.env.BASE_URL || "http://localhost:3000",
     screenshot: "on",
     trace: "on-first-retry",
     navigationTimeout: 60_000,
@@ -22,8 +23,7 @@ export default defineConfig({
     },
     {
       name: "authenticated",
-      testMatch:
+      testMatch: /authenticated-admin|visual-regression|accessibility/,
-        /authenticated-admin|visual-regression|accessibility/,
       dependencies: ["setup"],
       use: {
         storageState: authFile,
@@ -36,6 +36,17 @@ export default defineConfig({
         /functional-flows|full-check|user-story-tests|system-test|staff-management|screenshot-tour|authenticated-tour/,
       use: { browserName: "chromium" },
     },
+    {
+      name: "integration",
+      testMatch: /integration\//,
+      dependencies: ["setup"],
+      use: {
+        storageState: authFile,
+        browserName: "chromium",
+      },
+      timeout: 90_000,
+      expect: { timeout: 15_000 },
+    },
   ],
   outputDir: "./e2e/test-results",
 })

cannamanage-frontend/pnpm-lock.yaml

@@ -93,14 +93,14 @@ importers:
         specifier: 0.446.0
         version: 0.446.0(react@19.1.3)
       next:
-        specifier: 15.5.18
+        specifier: 15.5.19
-        version: 15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
+        version: 15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
       next-auth:
         specifier: 5.0.0-beta.31
-        version: 5.0.0-beta.31(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)
+        version: 5.0.0-beta.31(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)
       next-intl:
         specifier: ^4.13.0
-        version: 4.13.0(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3)
+        version: 4.13.0(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3)
       react:
         specifier: 19.1.3
         version: 19.1.3
@@ -184,8 +184,8 @@ importers:
         specifier: 9.18.0
         version: 9.18.0(jiti@2.6.1)
       eslint-config-next:
-        specifier: 15.5.18
+        specifier: 15.5.19
-        version: 15.5.18(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
+        version: 15.5.19(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
       eslint-config-prettier:
         specifier: 10.1.1
         version: 10.1.1(eslint@9.18.0(jiti@2.6.1))
@@ -679,56 +679,56 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
-  '@next/env@15.5.18':
+  '@next/env@15.5.19':
-    resolution: {integrity: sha512-hAV85Ckd9QR6RvH04MEKwsfLTksvFpO47j9xwtoIuvuPnlwecpSi+uZTtm8HirVbtlI2Fnz//xpcSTjFdyJk+g==}
+    resolution: {integrity: sha512-sWWluFvcv5v3Fxznmf2ZfjyoVQt/64oCnYqS90inQWGzMPK1VjvekPiz3OPHKmFT30EnHrjlbyaHLt3M0vWabw==}
 
-  '@next/eslint-plugin-next@15.5.18':
+  '@next/eslint-plugin-next@15.5.19':
-    resolution: {integrity: sha512-w4MYq8M26a8PNrfto0JosLf5/3ssln1rsyP96g2DkC8uFVymStM5DLSz5ElxxrPRg2XnTMnFo3kREFlhYvxhWw==}
+    resolution: {integrity: sha512-Ctwb4qYuMbHN/1oXLlTdMchwG8h8Xzwq+wGZZMgF3o6+uwyBKAI2c96bdOsl+C62PaUD0Jkh+QpNkhUeDlam0Q==}
 
-  '@next/swc-darwin-arm64@15.5.18':
+  '@next/swc-darwin-arm64@15.5.19':
-    resolution: {integrity: sha512-w0WvQf1n+txiwns/9pwIQteCJpZTbxzO2SE0FLcwuD4v0WEh1JPOjdyxWL21XwJsdpx8cFRjyzxzCS/siP7HcQ==}
+    resolution: {integrity: sha512-jx9wWlTKueHKPvVOndyr7WuaevWCkuYqsQ8gC0TMPKAVWG3MhcdMrjfo9tvIZNXd0QOUYXXvAcZ325y8Uq7uzg==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@15.5.18':
+  '@next/swc-darwin-x64@15.5.19':
-    resolution: {integrity: sha512-znn71QmDuxm+BOaglihMZfvyySMnNljkVIY5Z2TCssBmm+WqL6c19VhtH5ktFkHa8EZ2bnTUpcNcmNSQsg67og==}
+    resolution: {integrity: sha512-291KFcsIQ3OenRdiUDFOR6W3wezzH4auENXm1gbm1Bjd4ANMMRgxPrWTUztQN43BnVoVuMnHCrLeECIMwgFKbA==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@15.5.18':
+  '@next/swc-linux-arm64-gnu@15.5.19':
-    resolution: {integrity: sha512-yPPe5MNL+igZUa+OsqQJisqSfh6oarIuA1Q0BDxljGJhRQyZeP+WRHh7rs/jZUGMh5aY0YdIjXZG0VohkKkUdw==}
+    resolution: {integrity: sha512-WeH+nelQyyMeE2f8FxBRZNrGipya5zHZV2vjzfCOAYyiI6am+NbnWAAldOBFQBB2w0DjJcsvrKqoFT2b7+5YoA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@next/swc-linux-arm64-musl@15.5.18':
+  '@next/swc-linux-arm64-musl@15.5.19':
-    resolution: {integrity: sha512-glaCczEWIrHsokFZ3pP08U4BpKxwIdnT+txdOM32OBgpL9Yw4aqx8NejmgtZQZOdstQ5f0L3CasIZudzCuD+nw==}
+    resolution: {integrity: sha512-5xTOE0lDlDCSSfp+BAif7j17VRRCjWp//ZPZy6NI0QpdrhxtQnsZguSx0xAAZ0c9XZLrLLwCe/XVe5YPrRilKw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@next/swc-linux-x64-gnu@15.5.18':
+  '@next/swc-linux-x64-gnu@15.5.19':
-    resolution: {integrity: sha512-oUfg2EgJmU3R0OCOWiokGFUTvZiPfXtriXiuF3YNxRoROCdgvTedHIzYoeKH34gsZxS/V7mHbfq2hpAHwhH1/A==}
+    resolution: {integrity: sha512-LTxRmMgqqMv05Had879W00Fm53quiJd3Zuz8h1JSNJ3nGSlbZ/7Tjs1tKyScgN3Au3t3MyPsjPlq60fMmSHLsg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@next/swc-linux-x64-musl@15.5.18':
+  '@next/swc-linux-x64-musl@15.5.19':
-    resolution: {integrity: sha512-JLxSP3KTd9iu/bvUMQxH7RJo9xKSHf55/6RPE4a6FTSZygGn7uvZbCej0AHXydwkggQGSD9UddSjwv6Xz5ESfA==}
+    resolution: {integrity: sha512-eoNQSpA5PQfB9wBO4RA47MTDXWz1fizy9Y3Z6e4DetYIF3dvjuu8sj7aIGn/bFCU6lnFzTK34NtCaffP4NsQ7Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@next/swc-win32-arm64-msvc@15.5.18':
+  '@next/swc-win32-arm64-msvc@15.5.19':
-    resolution: {integrity: sha512-ir1v7enP52K2HNz3tQQvwF+x7VNxBk1ciiZ18WBPvxf4C59IqdfmHPJYK3vH7rSxpuCVw/8C712wTXNAtEp+NA==}
+    resolution: {integrity: sha512-6UNt2dFuCHOe446sm/Kp69nUe8/wIhnh9bm6Xcqw4qEWCOppLMOvhTBVgvM7invVUNr4SPpP6NOQsACtn2IN9Q==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@15.5.18':
+  '@next/swc-win32-x64-msvc@15.5.19':
-    resolution: {integrity: sha512-LIu5me6QTANCd25E7I5uIEfvgQ06RK7tvHAbYo3zCb3VpxQEPvMcSpd87NwUABDT6MbGPdEGR5VRiK4PPTJhQg==}
+    resolution: {integrity: sha512-PhmojAHyqMne56HBLGu9dhDnHPuFmEjrXSQMM/nW0J6j849lk3ESrVtqNJcCk8CKOV7brpTTbaYAjwKPzKM69w==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
@@ -2802,8 +2802,8 @@ packages:
     resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
     engines: {node: '>=10'}
 
-  eslint-config-next@15.5.18:
+  eslint-config-next@15.5.19:
-    resolution: {integrity: sha512-HuoJU6uUPD00eyiud78IBnT4HLhztFj2V+ild2Uon5ZUrYZKe0Olu2QRD99e9IgL4/H1eg5Onka3BsfRW2U0Xw==}
+    resolution: {integrity: sha512-UZwkuhBCNxVZfo93MSHRDOVNWXooJJGcAUyTAVIp0+9QFhH4SqJxWY0s6Mk9C2kMi777HPMn3dseOrZshWpG9Q==}
     peerDependencies:
       eslint: ^7.23.0 || ^8.0.0 || ^9.0.0
       typescript: '>=3.3.1'
@@ -3655,8 +3655,8 @@ packages:
       typescript:
         optional: true
 
-  next@15.5.18:
+  next@15.5.19:
-    resolution: {integrity: sha512-eKL8zUJkX9Y5lE+RX/2YJoItVdGlIscyVyboeD9wSpp0PaGqjoA4tTpT2qPqz9ax+5IzGESyLSeZ/RCwbSZ2uQ==}
+    resolution: {integrity: sha512-xNOW6tYshGX1/Oi3F8uuk4gpDeWsSUE/1Z0G5uUMekIxaQ0xc03UXd9II0VQHYMWviMeA0OHpJFAKsHf8bTYVg==}
     engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0}
     hasBin: true
     peerDependencies:
@@ -5051,34 +5051,34 @@ snapshots:
       '@tybys/wasm-util': 0.10.2
     optional: true
 
-  '@next/env@15.5.18': {}
+  '@next/env@15.5.19': {}
 
-  '@next/eslint-plugin-next@15.5.18':
+  '@next/eslint-plugin-next@15.5.19':
     dependencies:
       fast-glob: 3.3.1
 
-  '@next/swc-darwin-arm64@15.5.18':
+  '@next/swc-darwin-arm64@15.5.19':
     optional: true
 
-  '@next/swc-darwin-x64@15.5.18':
+  '@next/swc-darwin-x64@15.5.19':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@15.5.18':
+  '@next/swc-linux-arm64-gnu@15.5.19':
     optional: true
 
-  '@next/swc-linux-arm64-musl@15.5.18':
+  '@next/swc-linux-arm64-musl@15.5.19':
     optional: true
 
-  '@next/swc-linux-x64-gnu@15.5.18':
+  '@next/swc-linux-x64-gnu@15.5.19':
     optional: true
 
-  '@next/swc-linux-x64-musl@15.5.18':
+  '@next/swc-linux-x64-musl@15.5.19':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@15.5.18':
+  '@next/swc-win32-arm64-msvc@15.5.19':
     optional: true
 
-  '@next/swc-win32-x64-msvc@15.5.18':
+  '@next/swc-win32-x64-msvc@15.5.19':
     optional: true
 
   '@nodelib/fs.scandir@2.1.5':
@@ -7020,9 +7020,9 @@ snapshots:
 
   escape-string-regexp@4.0.0: {}
 
-  eslint-config-next@15.5.18(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3):
+  eslint-config-next@15.5.19(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3):
     dependencies:
-      '@next/eslint-plugin-next': 15.5.18
+      '@next/eslint-plugin-next': 15.5.19
       '@rushstack/eslint-patch': 1.16.1
       '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3))(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
       '@typescript-eslint/parser': 8.61.0(eslint@9.18.0(jiti@2.6.1))(typescript@5.9.3)
@@ -7875,22 +7875,22 @@ snapshots:
 
   negotiator@1.0.0: {}
 
-  next-auth@5.0.0-beta.31(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3):
+  next-auth@5.0.0-beta.31(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3):
     dependencies:
       '@auth/core': 0.41.2
-      next: 15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
+      next: 15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
       react: 19.1.3
 
   next-intl-swc-plugin-extractor@4.13.0: {}
 
-  next-intl@4.13.0(next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3):
+  next-intl@4.13.0(next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3))(react@19.1.3)(typescript@5.9.3):
     dependencies:
       '@formatjs/intl-localematcher': 0.8.10
       '@parcel/watcher': 2.5.6
       '@swc/core': 1.15.41
       icu-minify: 4.13.0
       negotiator: 1.0.0
-      next: 15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
+      next: 15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3)
       next-intl-swc-plugin-extractor: 4.13.0
       po-parser: 2.1.1
       react: 19.1.3
@@ -7900,9 +7900,9 @@ snapshots:
     transitivePeerDependencies:
       - '@swc/helpers'
 
-  next@15.5.18(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3):
+  next@15.5.19(@playwright/test@1.60.0)(react-dom@19.1.3(react@19.1.3))(react@19.1.3):
     dependencies:
-      '@next/env': 15.5.18
+      '@next/env': 15.5.19
       '@swc/helpers': 0.5.15
       caniuse-lite: 1.0.30001799
       postcss: 8.4.31
@@ -7910,14 +7910,14 @@ snapshots:
       react-dom: 19.1.3(react@19.1.3)
       styled-jsx: 5.1.6(react@19.1.3)
     optionalDependencies:
-      '@next/swc-darwin-arm64': 15.5.18
+      '@next/swc-darwin-arm64': 15.5.19
-      '@next/swc-darwin-x64': 15.5.18
+      '@next/swc-darwin-x64': 15.5.19
-      '@next/swc-linux-arm64-gnu': 15.5.18
+      '@next/swc-linux-arm64-gnu': 15.5.19
-      '@next/swc-linux-arm64-musl': 15.5.18
+      '@next/swc-linux-arm64-musl': 15.5.19
-      '@next/swc-linux-x64-gnu': 15.5.18
+      '@next/swc-linux-x64-gnu': 15.5.19
-      '@next/swc-linux-x64-musl': 15.5.18
+      '@next/swc-linux-x64-musl': 15.5.19
-      '@next/swc-win32-arm64-msvc': 15.5.18
+      '@next/swc-win32-arm64-msvc': 15.5.19
-      '@next/swc-win32-x64-msvc': 15.5.18
+      '@next/swc-win32-x64-msvc': 15.5.19
       '@playwright/test': 1.60.0
       sharp: 0.34.5
     transitivePeerDependencies:

cannamanage-frontend/src/__tests__/mocks/handlers.ts

@@ -98,11 +98,11 @@ export const mockStaffList = [
 ]
 
 export const mockQuotaStatus = {
-  memberId: "m1",
+  dailyUsedGrams: 15,
+  dailyLimitGrams: 25,
+  monthlyUsedGrams: 15,
   monthlyLimitGrams: 50,
-  usedGrams: 15,
+  isUnder21: false,
-  remainingGrams: 35,
-  distributionCount: 3,
 }
 
 export const mockRecentDistributions = [

cannamanage-frontend/src/__tests__/services/distributions.test.tsx

@@ -62,7 +62,7 @@ describe("useQuotaQuery", () => {
     await waitFor(() => expect(result.current.isSuccess).toBe(true))
     expect(result.current.data).toEqual(mockQuotaStatus)
     expect(result.current.data?.monthlyLimitGrams).toBe(50)
-    expect(result.current.data?.usedGrams).toBe(15)
+    expect(result.current.data?.dailyUsedGrams).toBe(15)
   })
 
   it("is disabled when memberId is empty", async () => {

cannamanage-frontend/src/__tests__/services/members.test.tsx

@@ -91,7 +91,7 @@ describe("useMemberQuotaQuery", () => {
 
     await waitFor(() => expect(result.current.isSuccess).toBe(true))
     expect(result.current.data).toEqual(mockQuotaStatus)
-    expect(result.current.data?.remainingGrams).toBe(35)
+    expect(result.current.data?.monthlyUsedGrams).toBe(15)
   })
 })
 

cannamanage-frontend/src/app/(auth)/layout.tsx

@@ -1,5 +1,6 @@
 import { NextIntlClientProvider } from "next-intl"
 import { getMessages } from "next-intl/server"
+import { Cannabis, ClipboardCheck, Scale, Users } from "lucide-react"
 
 import type { ReactNode } from "react"
 
@@ -11,10 +12,74 @@ export default async function AuthLayout({
   const messages = await getMessages()
 
   return (
-    <div className="fixed inset-0 z-50 flex min-h-screen items-center justify-center bg-background text-foreground p-4">
+    <NextIntlClientProvider messages={messages}>
-      <NextIntlClientProvider messages={messages}>
+      <div className="fixed inset-0 z-50 flex min-h-screen bg-background text-foreground">
-        {children}
+        {/* Left panel — branding (hidden on mobile) */}
-      </NextIntlClientProvider>
+        <div className="hidden md:flex md:w-1/2 lg:w-[55%] flex-col items-center justify-center bg-gradient-to-br from-primary/10 via-primary/5 to-background p-12 relative overflow-hidden">
-    </div>
+          {/* Decorative background blur */}
+          <div className="absolute inset-0 -z-10">
+            <div className="absolute top-1/4 left-1/4 h-64 w-64 rounded-full bg-primary/10 blur-3xl" />
+            <div className="absolute bottom-1/4 right-1/4 h-48 w-48 rounded-full bg-primary/5 blur-2xl" />
+          </div>
+
+          <div className="flex flex-col items-center gap-8 max-w-sm text-center">
+            {/* Logo */}
+            <div className="flex h-16 w-16 items-center justify-center rounded-2xl bg-primary/10 border border-primary/20">
+              <Cannabis className="h-9 w-9 text-primary" />
+            </div>
+
+            {/* App name & tagline */}
+            <div className="space-y-2">
+              <h1 className="text-2xl font-bold">CannaManage</h1>
+              <p className="text-muted-foreground">
+                Dein Verein, digital verwaltet
+              </p>
+            </div>
+
+            {/* Feature highlights */}
+            <div className="space-y-4 text-left w-full">
+              <div className="flex items-start gap-3">
+                <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-primary/10">
+                  <ClipboardCheck className="h-4 w-4 text-primary" />
+                </div>
+                <div>
+                  <p className="text-sm font-medium">KCanG-Compliance</p>
+                  <p className="text-xs text-muted-foreground">
+                    Automatische Vorgaben-Überwachung
+                  </p>
+                </div>
+              </div>
+              <div className="flex items-start gap-3">
+                <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-primary/10">
+                  <Users className="h-4 w-4 text-primary" />
+                </div>
+                <div>
+                  <p className="text-sm font-medium">Mitgliederverwaltung</p>
+                  <p className="text-xs text-muted-foreground">
+                    Portal, Profile und Dokumente
+                  </p>
+                </div>
+              </div>
+              <div className="flex items-start gap-3">
+                <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-primary/10">
+                  <Scale className="h-4 w-4 text-primary" />
+                </div>
+                <div>
+                  <p className="text-sm font-medium">Abgabe-Tracking</p>
+                  <p className="text-xs text-muted-foreground">
+                    25g/Tag und 50g/Monat automatisch
+                  </p>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+
+        {/* Right panel — form */}
+        <div className="w-full md:w-1/2 lg:w-[45%] flex items-center justify-center p-6 sm:p-8">
+          {children}
+        </div>
+      </div>
+    </NextIntlClientProvider>
   )
 }

cannamanage-frontend/src/app/(auth)/login/page.tsx

@@ -8,7 +8,7 @@ import { signIn } from "next-auth/react"
 import { useTranslations } from "next-intl"
 import { useForm } from "react-hook-form"
 import { z } from "zod"
-import { Cannabis, Loader2 } from "lucide-react"
+import { Loader2 } from "lucide-react"
 
 const loginSchema = z.object({
   email: z.string().email(),
@@ -55,13 +55,10 @@ export default function LoginPage() {
   }
 
   return (
-    <div className="w-full max-w-md space-y-8">
+    <div className="w-full max-w-sm space-y-6">
-      {/* Logo & Branding */}
+      {/* Title — visible on mobile where left panel is hidden */}
-      <div className="flex flex-col items-center space-y-2">
+      <div className="space-y-2 text-center md:text-left">
-        <div className="flex h-14 w-14 items-center justify-center rounded-xl bg-primary/10">
+        <h1 className="text-2xl font-bold tracking-tight">{t("loginTitle")}</h1>
-          <Cannabis className="h-8 w-8 text-primary" />
-        </div>
-        <h1 className="text-2xl font-bold tracking-tight">CannaManage</h1>
         <p className="text-sm text-muted-foreground">{t("loginSubtitle")}</p>
       </div>
 

cannamanage-frontend/src/app/(dashboard-layout)/board/page.tsx

@@ -1,11 +1,29 @@
 "use client"
 
 import { useState } from "react"
+import {
+  useBoardQuery,
+  useCreatePositionMutation,
+  useElectBoardMemberMutation,
+  usePositionsQuery,
+  useRemoveBoardMemberMutation,
+} from "@/services/board"
 import { useTranslations } from "next-intl"
+import { toast } from "sonner"
 import { Calendar, Edit, Plus, Shield, UserMinus, UserPlus } from "lucide-react"
 
 import type { BoardMember, BoardPosition } from "@/services/board"
 
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog"
 import { Badge } from "@/components/ui/badge"
 import { Button } from "@/components/ui/button"
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card"
@@ -20,7 +38,7 @@ import { Input } from "@/components/ui/input"
 import { Label } from "@/components/ui/label"
 import { Select } from "@/components/ui/select"
 
-// Mock data
+// Mock data (fallback)
 const mockPositions: BoardPosition[] = [
   {
     id: "1",
@@ -142,8 +160,186 @@ const mockBoardMembers: (BoardMember & {
 
 export default function BoardPage() {
   const t = useTranslations("board")
+
+  // --- React Query ---
+  const { data: boardData } = useBoardQuery()
+  const { data: positionsData } = usePositionsQuery()
+  const createPositionMutation = useCreatePositionMutation()
+  const electMutation = useElectBoardMemberMutation()
+  const removeMutation = useRemoveBoardMemberMutation()
+
+  // Dual mode: detect if backend is unavailable (mock mode)
+  const isMockMode = !boardData && !positionsData
+  const [localPositions, setLocalPositions] =
+    useState<BoardPosition[]>(mockPositions)
+  const [localBoardMembers, setLocalBoardMembers] =
+    useState<typeof mockBoardMembers>(mockBoardMembers)
+
+  // Use API data or local state (for mock mode operations)
+  const positions = positionsData ?? localPositions
+  const boardMembers =
+    (boardData as typeof mockBoardMembers) ?? localBoardMembers
+
+  // --- UI state ---
   const [positionDialogOpen, setPositionDialogOpen] = useState(false)
   const [electDialogOpen, setElectDialogOpen] = useState(false)
+  const [removeTarget, setRemoveTarget] = useState<
+    (typeof mockBoardMembers)[0] | null
+  >(null)
+
+  // Position form state
+  const [posTitle, setPosTitle] = useState("")
+  const [posDesc, setPosDesc] = useState("")
+  const [sortOrder, setSortOrder] = useState(0)
+
+  // Elect form state
+  const [electPositionId, setElectPositionId] = useState("")
+  const [electMemberId, setElectMemberId] = useState("")
+  const [electedAt, setElectedAt] = useState("")
+  const [termStart, setTermStart] = useState("")
+  const [termEnd, setTermEnd] = useState("")
+
+  // --- Handlers ---
+
+  function handleCreatePosition() {
+    if (!posTitle.trim()) {
+      toast.error("Bitte einen Positionstitel angeben.")
+      return
+    }
+
+    if (isMockMode) {
+      const newPosition: BoardPosition = {
+        id: crypto.randomUUID(),
+        title: posTitle.trim(),
+        description: posDesc.trim() || null,
+        sortOrder: sortOrder || positions.length + 1,
+        isActive: true,
+        createdAt: new Date().toISOString(),
+      }
+      setLocalPositions((prev) => [...prev, newPosition])
+      toast.success("Position erfolgreich erstellt.")
+      setPositionDialogOpen(false)
+      setPosTitle("")
+      setPosDesc("")
+      setSortOrder(0)
+      return
+    }
+
+    createPositionMutation.mutate(
+      {
+        title: posTitle.trim(),
+        description: posDesc.trim() || undefined,
+        sortOrder: sortOrder || undefined,
+      },
+      {
+        onSuccess: () => {
+          toast.success("Position erfolgreich erstellt.")
+          setPositionDialogOpen(false)
+          setPosTitle("")
+          setPosDesc("")
+          setSortOrder(0)
+        },
+        onError: () => {
+          toast.error("Fehler beim Erstellen der Position.")
+        },
+      }
+    )
+  }
+
+  function handleElectMember() {
+    if (!electPositionId || !electMemberId || !electedAt || !termStart) {
+      toast.error("Bitte alle Pflichtfelder ausfüllen.")
+      return
+    }
+
+    if (isMockMode) {
+      const position = positions.find((p) => p.id === electPositionId)
+      const memberNames: Record<string, string> = {
+        m1: "Max Mustermann",
+        m2: "Anna Schmidt",
+        m3: "Peter Weber",
+      }
+      const newMember = {
+        id: crypto.randomUUID(),
+        clubId: "c1",
+        positionId: electPositionId,
+        memberId: electMemberId,
+        electedAt,
+        termStart,
+        termEnd: termEnd || null,
+        isCurrent: true,
+        electedInAssemblyId: null,
+        createdAt: new Date().toISOString(),
+        memberName: memberNames[electMemberId] ?? electMemberId,
+        positionTitle: position?.title ?? electPositionId,
+      }
+      setLocalBoardMembers((prev) => [...prev, newMember])
+      toast.success("Vorstandsmitglied erfolgreich gewählt.")
+      setElectDialogOpen(false)
+      setElectPositionId("")
+      setElectMemberId("")
+      setElectedAt("")
+      setTermStart("")
+      setTermEnd("")
+      return
+    }
+
+    electMutation.mutate(
+      {
+        positionId: electPositionId,
+        memberId: electMemberId,
+        electedAt,
+        termStart,
+        termEnd: termEnd || undefined,
+      },
+      {
+        onSuccess: () => {
+          toast.success("Vorstandsmitglied erfolgreich gewählt.")
+          setElectDialogOpen(false)
+          setElectPositionId("")
+          setElectMemberId("")
+          setElectedAt("")
+          setTermStart("")
+          setTermEnd("")
+        },
+        onError: () => {
+          toast.error("Fehler bei der Wahl des Vorstandsmitglieds.")
+        },
+      }
+    )
+  }
+
+  function handleRemove(bm: (typeof mockBoardMembers)[0]) {
+    setRemoveTarget(bm)
+  }
+
+  function confirmRemove() {
+    if (!removeTarget) return
+
+    if (isMockMode) {
+      setLocalBoardMembers((prev) =>
+        prev.filter((m) => m.id !== removeTarget.id)
+      )
+      toast.success(
+        `${removeTarget.memberName ?? "Mitglied"} wurde aus dem Vorstand entfernt.`
+      )
+      setRemoveTarget(null)
+      return
+    }
+
+    removeMutation.mutate(removeTarget.id, {
+      onSuccess: () => {
+        toast.success(
+          `${removeTarget.memberName ?? "Mitglied"} wurde aus dem Vorstand entfernt.`
+        )
+        setRemoveTarget(null)
+      },
+      onError: () => {
+        toast.error("Fehler beim Entfernen des Vorstandsmitglieds.")
+        setRemoveTarget(null)
+      },
+    })
+  }
 
   return (
     <div className="space-y-6">
@@ -158,7 +354,7 @@ export default function BoardPage() {
             onOpenChange={setPositionDialogOpen}
           >
             <DialogTrigger asChild>
-              <Button variant="outline">
+              <Button variant="outline" data-testid="board-create-position">
                 <Plus className="mr-2 h-4 w-4" />
                 {t("addPosition")}
               </Button>
@@ -173,6 +369,8 @@ export default function BoardPage() {
                   <Input
                     id="posTitle"
                     placeholder={t("positionTitlePlaceholder")}
+                    value={posTitle}
+                    onChange={(e) => setPosTitle(e.target.value)}
                   />
                 </div>
                 <div>
@@ -180,24 +378,34 @@ export default function BoardPage() {
                   <Input
                     id="posDesc"
                     placeholder={t("positionDescPlaceholder")}
+                    value={posDesc}
+                    onChange={(e) => setPosDesc(e.target.value)}
                   />
                 </div>
                 <div>
                   <Label htmlFor="sortOrder">{t("sortOrder")}</Label>
-                  <Input id="sortOrder" type="number" defaultValue={0} />
+                  <Input
+                    id="sortOrder"
+                    type="number"
+                    value={sortOrder}
+                    onChange={(e) => setSortOrder(Number(e.target.value))}
+                  />
                 </div>
                 <Button
                   className="w-full"
-                  onClick={() => setPositionDialogOpen(false)}
+                  onClick={handleCreatePosition}
+                  disabled={createPositionMutation.isPending}
                 >
-                  {t("save")}
+                  {createPositionMutation.isPending
+                    ? "Wird gespeichert..."
+                    : t("save")}
                 </Button>
               </div>
             </DialogContent>
           </Dialog>
           <Dialog open={electDialogOpen} onOpenChange={setElectDialogOpen}>
             <DialogTrigger asChild>
-              <Button>
+              <Button data-testid="board-elect-member">
                 <UserPlus className="mr-2 h-4 w-4" />
                 {t("electMember")}
               </Button>
@@ -209,9 +417,12 @@ export default function BoardPage() {
               <div className="space-y-4">
                 <div>
                   <Label>{t("position")}</Label>
-                  <Select>
+                  <Select
+                    value={electPositionId}
+                    onChange={(e) => setElectPositionId(e.target.value)}
+                  >
                     <option value="">{t("selectPosition")}</option>
-                    {mockPositions.map((pos) => (
+                    {positions.map((pos) => (
                       <option key={pos.id} value={pos.id}>
                         {pos.title}
                       </option>
@@ -220,7 +431,10 @@ export default function BoardPage() {
                 </div>
                 <div>
                   <Label>{t("member")}</Label>
-                  <Select>
+                  <Select
+                    value={electMemberId}
+                    onChange={(e) => setElectMemberId(e.target.value)}
+                  >
                     <option value="">{t("selectMember")}</option>
                     <option value="m1">Max Mustermann</option>
                     <option value="m2">Anna Schmidt</option>
@@ -229,23 +443,41 @@ export default function BoardPage() {
                 </div>
                 <div>
                   <Label htmlFor="electedAt">{t("electedAt")}</Label>
-                  <Input id="electedAt" type="date" />
+                  <Input
+                    id="electedAt"
+                    type="date"
+                    value={electedAt}
+                    onChange={(e) => setElectedAt(e.target.value)}
+                  />
                 </div>
                 <div className="grid grid-cols-2 gap-4">
                   <div>
                     <Label htmlFor="termStart">{t("termStart")}</Label>
-                    <Input id="termStart" type="date" />
+                    <Input
+                      id="termStart"
+                      type="date"
+                      value={termStart}
+                      onChange={(e) => setTermStart(e.target.value)}
+                    />
                   </div>
                   <div>
                     <Label htmlFor="termEnd">{t("termEnd")}</Label>
-                    <Input id="termEnd" type="date" />
+                    <Input
+                      id="termEnd"
+                      type="date"
+                      value={termEnd}
+                      onChange={(e) => setTermEnd(e.target.value)}
+                    />
                   </div>
                 </div>
                 <Button
                   className="w-full"
-                  onClick={() => setElectDialogOpen(false)}
+                  onClick={handleElectMember}
+                  disabled={electMutation.isPending}
                 >
-                  {t("confirmElection")}
+                  {electMutation.isPending
+                    ? "Wird gespeichert..."
+                    : t("confirmElection")}
                 </Button>
               </div>
             </DialogContent>
@@ -255,8 +487,8 @@ export default function BoardPage() {
 
       {/* Current Board Members as cards */}
       <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-3">
-        {mockBoardMembers.map((bm) => (
+        {boardMembers.map((bm) => (
-          <Card key={bm.id}>
+          <Card key={bm.id} data-testid={`board-position-${bm.id}`}>
             <CardHeader className="pb-3">
               <div className="flex items-start justify-between">
                 <div className="flex items-center gap-2">
@@ -269,6 +501,8 @@ export default function BoardPage() {
                   variant="ghost"
                   size="icon"
                   className="h-8 w-8 text-destructive"
+                  data-testid={`board-remove-${bm.id}`}
+                  onClick={() => handleRemove(bm)}
                 >
                   <UserMinus className="h-4 w-4" />
                 </Button>
@@ -322,7 +556,7 @@ export default function BoardPage() {
         </CardHeader>
         <CardContent>
           <div className="space-y-2">
-            {mockPositions.map((pos) => (
+            {positions.map((pos) => (
               <div
                 key={pos.id}
                 className="flex items-center justify-between rounded-lg border p-3"
@@ -343,6 +577,31 @@ export default function BoardPage() {
           </div>
         </CardContent>
       </Card>
+
+      {/* Remove confirmation dialog */}
+      <AlertDialog
+        open={!!removeTarget}
+        onOpenChange={(open) => !open && setRemoveTarget(null)}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Vorstandsmitglied entfernen?</AlertDialogTitle>
+            <AlertDialogDescription>
+              Möchtest du {removeTarget?.memberName ?? "dieses Mitglied"} als{" "}
+              {removeTarget?.positionTitle} wirklich aus dem Vorstand entfernen?
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Abbrechen</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={confirmRemove}
+              className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+            >
+              {removeMutation.isPending ? "Entfernen..." : "Entfernen"}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
     </div>
   )
 }

cannamanage-frontend/src/app/(dashboard-layout)/documents/page.tsx

@@ -1,24 +1,50 @@
 "use client"
 
 import { useState } from "react"
-import { categoryLabels, formatFileSize } from "@/services/documents"
-import { useTranslations } from "next-intl"
 import {
+  categoryLabels,
+  downloadDocument,
+  formatFileSize,
+  useDeleteDocumentMutation,
+  useDocumentsQuery,
+  useUploadDocumentMutation,
+} from "@/services/documents"
+import { useTranslations } from "next-intl"
+import { toast } from "sonner"
+import {
+  BookOpen,
+  CheckCircle,
   Download,
   File,
   FileSpreadsheet,
   FileText,
   Filter,
   Image,
+  Shield,
   Trash2,
   Upload,
 } from "lucide-react"
 
-import type { ClubDocument, DocumentCategory } from "@/services/documents"
+import type {
+  ClubDocument,
+  DocumentAccessLevel,
+  DocumentCategory,
+} from "@/services/documents"
 
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog"
 import { Badge } from "@/components/ui/badge"
 import { Button } from "@/components/ui/button"
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card"
+import { TableSkeleton } from "@/components/ui/data-skeleton"
 import {
   Dialog,
   DialogContent,
@@ -39,7 +65,7 @@ import {
 } from "@/components/ui/table"
 import { Textarea } from "@/components/ui/textarea"
 
-// Mock data for development
+// Mock data for development (fallback when API is unavailable)
 const mockDocuments: ClubDocument[] = [
   {
     id: "1",
@@ -108,6 +134,56 @@ const mockDocuments: ClubDocument[] = [
   },
 ]
 
+// --- Category styling ---
+
+const categoryStyles: Record<
+  DocumentCategory,
+  { bg: string; text: string; icon: React.ReactNode }
+> = {
+  SATZUNG: {
+    bg: "bg-blue-100 dark:bg-blue-900/30",
+    text: "text-blue-700 dark:text-blue-300",
+    icon: <BookOpen className="h-3 w-3" />,
+  },
+  PROTOKOLL: {
+    bg: "bg-purple-100 dark:bg-purple-900/30",
+    text: "text-purple-700 dark:text-purple-300",
+    icon: <FileText className="h-3 w-3" />,
+  },
+  VERTRAG: {
+    bg: "bg-amber-100 dark:bg-amber-900/30",
+    text: "text-amber-700 dark:text-amber-300",
+    icon: <FileSpreadsheet className="h-3 w-3" />,
+  },
+  VERSICHERUNG: {
+    bg: "bg-cyan-100 dark:bg-cyan-900/30",
+    text: "text-cyan-700 dark:text-cyan-300",
+    icon: <Shield className="h-3 w-3" />,
+  },
+  GENEHMIGUNG: {
+    bg: "bg-green-100 dark:bg-green-900/30",
+    text: "text-green-700 dark:text-green-300",
+    icon: <CheckCircle className="h-3 w-3" />,
+  },
+  SONSTIGES: {
+    bg: "bg-gray-100 dark:bg-gray-900/30",
+    text: "text-gray-700 dark:text-gray-300",
+    icon: <File className="h-3 w-3" />,
+  },
+}
+
+function CategoryBadge({ category }: { category: DocumentCategory }) {
+  const style = categoryStyles[category]
+  return (
+    <span
+      className={`inline-flex items-center gap-1 rounded-md px-2 py-0.5 text-xs font-medium ${style.bg} ${style.text}`}
+    >
+      {style.icon}
+      {categoryLabels[category]}
+    </span>
+  )
+}
+
 function getFileIcon(contentType: string) {
   if (contentType === "application/pdf") return <FileText className="h-4 w-4" />
   if (contentType.includes("spreadsheet"))
@@ -116,29 +192,36 @@ function getFileIcon(contentType: string) {
   return <File className="h-4 w-4" />
 }
 
-function getCategoryBadgeVariant(
-  category: DocumentCategory
-): "default" | "secondary" | "destructive" | "outline" {
-  const variants: Record<
-    DocumentCategory,
-    "default" | "secondary" | "destructive" | "outline"
-  > = {
-    SATZUNG: "default",
-    PROTOKOLL: "secondary",
-    VERTRAG: "outline",
-    VERSICHERUNG: "outline",
-    GENEHMIGUNG: "destructive",
-    SONSTIGES: "secondary",
-  }
-  return variants[category]
-}
-
 export default function DocumentsPage() {
   const t = useTranslations("documents")
-  const [documents] = useState<ClubDocument[]>(mockDocuments)
+
+  // --- React Query ---
+  const { data, isLoading } = useDocumentsQuery()
+  const uploadMutation = useUploadDocumentMutation()
+  const deleteMutation = useDeleteDocumentMutation()
+
+  // Dual mode: detect if backend is unavailable (mock mode)
+  const isMockMode = !data
+  const [localDocuments, setLocalDocuments] =
+    useState<ClubDocument[]>(mockDocuments)
+
+  // Use API data or local state (for mock mode operations)
+  const documents = data ?? localDocuments
+
+  // --- UI state ---
   const [uploadOpen, setUploadOpen] = useState(false)
   const [filterCategory, setFilterCategory] = useState<string>("ALL")
+  const [deleteTarget, setDeleteTarget] = useState<ClubDocument | null>(null)
 
+  // Upload form state
+  const [title, setTitle] = useState("")
+  const [category, setCategory] = useState<DocumentCategory | "">("")
+  const [accessLevel, setAccessLevel] =
+    useState<DocumentAccessLevel>("ALL_MEMBERS")
+  const [description, setDescription] = useState("")
+  const [file, setFile] = useState<File | null>(null)
+
+  // --- Filtering ---
   const filteredDocuments =
     filterCategory === "ALL"
       ? documents
@@ -155,6 +238,126 @@ export default function DocumentsPage() {
     {} as Record<string, ClubDocument[]>
   )
 
+  // --- Handlers ---
+
+  function resetUploadForm() {
+    setTitle("")
+    setCategory("")
+    setAccessLevel("ALL_MEMBERS")
+    setDescription("")
+    setFile(null)
+  }
+
+  function handleUpload() {
+    if (!title.trim() || !category || !file) {
+      toast.error("Bitte Titel, Kategorie und Datei ausfüllen.")
+      return
+    }
+
+    if (isMockMode) {
+      const newDoc: ClubDocument = {
+        id: crypto.randomUUID(),
+        title: title.trim(),
+        category: category as DocumentCategory,
+        filename: file.name,
+        contentType: file.type || "application/octet-stream",
+        fileSize: file.size,
+        accessLevel,
+        description: description.trim() || null,
+        uploadedBy: "current-user",
+        createdAt: new Date().toISOString(),
+        updatedAt: null,
+      }
+      setLocalDocuments((prev) => [newDoc, ...prev])
+      toast.success("Dokument erfolgreich hochgeladen.")
+      setUploadOpen(false)
+      resetUploadForm()
+      return
+    }
+
+    uploadMutation.mutate(
+      {
+        title: title.trim(),
+        category: category as DocumentCategory,
+        accessLevel,
+        description: description.trim() || null,
+        file,
+      },
+      {
+        onSuccess: () => {
+          toast.success("Dokument erfolgreich hochgeladen.")
+          setUploadOpen(false)
+          resetUploadForm()
+        },
+        onError: () => {
+          toast.error("Fehler beim Hochladen des Dokuments.")
+        },
+      }
+    )
+  }
+
+  async function handleDownload(id: string, filename: string) {
+    if (isMockMode) {
+      toast.info("Demo-Modus: Download nicht verfügbar.")
+      return
+    }
+
+    try {
+      const blob = await downloadDocument(id)
+      const url = URL.createObjectURL(blob)
+      const a = document.createElement("a")
+      a.href = url
+      a.download = filename
+      document.body.appendChild(a)
+      a.click()
+      document.body.removeChild(a)
+      URL.revokeObjectURL(url)
+    } catch {
+      toast.error("Fehler beim Herunterladen.")
+    }
+  }
+
+  function handleDelete(doc: ClubDocument) {
+    setDeleteTarget(doc)
+  }
+
+  function confirmDelete() {
+    if (!deleteTarget) return
+
+    if (isMockMode) {
+      setLocalDocuments((prev) => prev.filter((d) => d.id !== deleteTarget.id))
+      toast.success(`"${deleteTarget.title}" wurde gelöscht.`)
+      setDeleteTarget(null)
+      return
+    }
+
+    deleteMutation.mutate(deleteTarget.id, {
+      onSuccess: () => {
+        toast.success(`"${deleteTarget.title}" wurde gelöscht.`)
+        setDeleteTarget(null)
+      },
+      onError: () => {
+        toast.error("Fehler beim Löschen des Dokuments.")
+        setDeleteTarget(null)
+      },
+    })
+  }
+
+  // --- Loading state ---
+  if (isLoading) {
+    return (
+      <div className="space-y-6">
+        <div className="flex items-center justify-between">
+          <div>
+            <h1 className="text-2xl font-bold">{t("title")}</h1>
+            <p className="text-muted-foreground">{t("description")}</p>
+          </div>
+        </div>
+        <TableSkeleton rows={5} columns={5} />
+      </div>
+    )
+  }
+
   return (
     <div className="space-y-6">
       <div className="flex items-center justify-between">
@@ -164,23 +367,39 @@ export default function DocumentsPage() {
         </div>
         <Dialog open={uploadOpen} onOpenChange={setUploadOpen}>
           <DialogTrigger asChild>
-            <Button>
+            <Button data-testid="documents-upload-button">
               <Upload className="mr-2 h-4 w-4" />
               {t("upload")}
             </Button>
           </DialogTrigger>
-          <DialogContent className="max-w-md">
+          <DialogContent
+            className="max-w-md"
+            data-testid="documents-upload-dialog"
+          >
             <DialogHeader>
               <DialogTitle>{t("uploadDocument")}</DialogTitle>
             </DialogHeader>
             <div className="space-y-4">
               <div>
                 <Label htmlFor="title">{t("documentTitle")}</Label>
-                <Input id="title" placeholder={t("titlePlaceholder")} />
+                <Input
+                  id="title"
+                  data-testid="documents-title-input"
+                  placeholder={t("titlePlaceholder")}
+                  value={title}
+                  onChange={(e) => setTitle(e.target.value)}
+                />
               </div>
               <div>
                 <Label htmlFor="category">{t("category")}</Label>
-                <Select id="category">
+                <Select
+                  id="category"
+                  data-testid="documents-category-select"
+                  value={category}
+                  onChange={(e) =>
+                    setCategory(e.target.value as DocumentCategory | "")
+                  }
+                >
                   <option value="">{t("selectCategory")}</option>
                   {Object.entries(categoryLabels).map(([key, label]) => (
                     <option key={key} value={key}>
@@ -191,7 +410,13 @@ export default function DocumentsPage() {
               </div>
               <div>
                 <Label htmlFor="accessLevel">{t("accessLevel")}</Label>
-                <Select id="accessLevel" defaultValue="ALL_MEMBERS">
+                <Select
+                  id="accessLevel"
+                  value={accessLevel}
+                  onChange={(e) =>
+                    setAccessLevel(e.target.value as DocumentAccessLevel)
+                  }
+                >
                   <option value="ALL_MEMBERS">{t("allMembers")}</option>
                   <option value="BOARD_ONLY">{t("boardOnly")}</option>
                 </Select>
@@ -201,22 +426,33 @@ export default function DocumentsPage() {
                 <Textarea
                   id="description"
                   placeholder={t("descriptionPlaceholder")}
+                  value={description}
+                  onChange={(e) => setDescription(e.target.value)}
                 />
               </div>
               <div>
                 <Label htmlFor="file">{t("file")}</Label>
                 <Input
                   id="file"
+                  data-testid="documents-file-input"
                   type="file"
                   accept=".pdf,.docx,.xlsx,.png,.jpg,.jpeg"
+                  onChange={(e) => setFile(e.target.files?.[0] ?? null)}
                 />
                 <p className="mt-1 text-xs text-muted-foreground">
                   {t("fileHint")}
                 </p>
               </div>
-              <Button className="w-full" onClick={() => setUploadOpen(false)}>
+              <Button
+                className="w-full"
+                data-testid="documents-submit-upload"
+                onClick={handleUpload}
+                disabled={uploadMutation.isPending}
+              >
                 <Upload className="mr-2 h-4 w-4" />
-                {t("uploadButton")}
+                {uploadMutation.isPending
+                  ? "Wird hochgeladen..."
+                  : t("uploadButton")}
               </Button>
             </div>
           </DialogContent>
@@ -244,15 +480,11 @@ export default function DocumentsPage() {
       </div>
 
       {/* Documents grouped by category */}
-      {Object.entries(grouped).map(([category, docs]) => (
+      {Object.entries(grouped).map(([cat, docs]) => (
-        <Card key={category}>
+        <Card key={cat}>
           <CardHeader className="pb-3">
             <CardTitle className="flex items-center gap-2 text-lg">
-              <Badge
+              <CategoryBadge category={cat as DocumentCategory} />
-                variant={getCategoryBadgeVariant(category as DocumentCategory)}
-              >
-                {categoryLabels[category as DocumentCategory]}
-              </Badge>
               <span className="text-sm text-muted-foreground">
                 ({docs.length})
               </span>
@@ -262,30 +494,35 @@ export default function DocumentsPage() {
             <Table>
               <TableHeader>
                 <TableRow>
-                  <TableHead>{t("name")}</TableHead>
+                  <TableHead className="max-w-[300px]">{t("name")}</TableHead>
-                  <TableHead>{t("access")}</TableHead>
+                  <TableHead className="w-[120px]">{t("access")}</TableHead>
-                  <TableHead>{t("size")}</TableHead>
+                  <TableHead className="w-[80px]">{t("size")}</TableHead>
-                  <TableHead>{t("date")}</TableHead>
+                  <TableHead className="w-[100px]">{t("date")}</TableHead>
-                  <TableHead className="text-right">{t("actions")}</TableHead>
+                  <TableHead className="w-[80px] text-right">
+                    {t("actions")}
+                  </TableHead>
                 </TableRow>
               </TableHeader>
               <TableBody>
                 {docs.map((doc) => (
-                  <TableRow key={doc.id}>
+                  <TableRow
-                    <TableCell>
+                    key={doc.id}
+                    data-testid={`documents-row-${doc.id}`}
+                  >
+                    <TableCell className="max-w-[300px]">
                       <div className="flex items-center gap-2">
                         {getFileIcon(doc.contentType)}
-                        <div>
+                        <div className="min-w-0">
-                          <p className="font-medium">{doc.title}</p>
+                          <p className="truncate font-medium">{doc.title}</p>
                           {doc.description && (
-                            <p className="text-xs text-muted-foreground">
+                            <p className="truncate text-xs text-muted-foreground">
                               {doc.description}
                             </p>
                           )}
                         </div>
                       </div>
                     </TableCell>
-                    <TableCell>
+                    <TableCell className="w-[120px]">
                       <Badge
                         variant={
                           doc.accessLevel === "BOARD_ONLY"
@@ -298,19 +535,28 @@ export default function DocumentsPage() {
                           : t("allMembers")}
                       </Badge>
                     </TableCell>
-                    <TableCell>{formatFileSize(doc.fileSize)}</TableCell>
+                    <TableCell className="w-[80px]">
-                    <TableCell>
+                      {formatFileSize(doc.fileSize)}
+                    </TableCell>
+                    <TableCell className="w-[100px]">
                       {new Date(doc.createdAt).toLocaleDateString("de-DE")}
                     </TableCell>
-                    <TableCell className="text-right">
+                    <TableCell className="w-[80px] text-right">
                       <div className="flex justify-end gap-1">
-                        <Button variant="ghost" size="icon">
+                        <Button
+                          variant="ghost"
+                          size="icon"
+                          data-testid={`documents-download-${doc.id}`}
+                          onClick={() => handleDownload(doc.id, doc.filename)}
+                        >
                           <Download className="h-4 w-4" />
                         </Button>
                         <Button
                           variant="ghost"
                           size="icon"
                           className="text-destructive"
+                          data-testid={`documents-delete-${doc.id}`}
+                          onClick={() => handleDelete(doc)}
                         >
                           <Trash2 className="h-4 w-4" />
                         </Button>
@@ -323,6 +569,32 @@ export default function DocumentsPage() {
           </CardContent>
         </Card>
       ))}
+
+      {/* Delete confirmation dialog */}
+      <AlertDialog
+        open={!!deleteTarget}
+        onOpenChange={(open) => !open && setDeleteTarget(null)}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Dokument löschen?</AlertDialogTitle>
+            <AlertDialogDescription>
+              Möchtest du &quot;{deleteTarget?.title}&quot; wirklich löschen?
+              Diese Aktion kann nicht rückgängig gemacht werden.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Abbrechen</AlertDialogCancel>
+            <AlertDialogAction
+              data-testid="documents-delete-confirm"
+              onClick={confirmDelete}
+              className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+            >
+              {deleteMutation.isPending ? "Löschen..." : "Löschen"}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
     </div>
   )
 }

cannamanage-frontend/src/app/(dashboard-layout)/page.tsx

@@ -1,5 +0,0 @@
-import { redirect } from "next/navigation"
-
-export default function HomePage() {
-  redirect("/dashboard")
-}

cannamanage-frontend/src/app/(marketing)/layout.tsx

@@ -1,10 +1,10 @@
-import Link from "next/link"
 import { NextIntlClientProvider } from "next-intl"
 import { getMessages } from "next-intl/server"
-import { Cannabis } from "lucide-react"
 
 import type { ReactNode } from "react"
 
+import MarketingLayoutClient from "./marketing-layout-client"
+
 // Force dynamic rendering — prevents NextAuth from being called at build time
 // (AUTH_URL is not available during Docker image build)
 export const dynamic = "force-dynamic"
@@ -18,108 +18,7 @@ export default async function MarketingLayout({
 
   return (
     <NextIntlClientProvider messages={messages}>
-      <div className="min-h-screen flex flex-col bg-background text-foreground overflow-x-hidden">
+      <MarketingLayoutClient>{children}</MarketingLayoutClient>
-        {/* Header */}
-        <header className="sticky top-0 z-40 border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
-          <div className="container mx-auto flex h-16 items-center justify-between px-4">
-            <Link href="/" className="flex items-center gap-2">
-              <div className="flex h-9 w-9 items-center justify-center rounded-lg bg-primary/10">
-                <Cannabis className="h-5 w-5 text-primary" />
-              </div>
-              <span className="text-lg font-bold">CannaManage</span>
-            </Link>
-            <nav className="flex items-center gap-4">
-              <Link
-                href="/pricing"
-                className="text-sm font-medium text-muted-foreground hover:text-foreground transition-colors"
-              >
-                Preise
-              </Link>
-              <Link
-                href="/login"
-                className="inline-flex h-9 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground hover:bg-primary/90 transition-colors"
-              >
-                Anmelden
-              </Link>
-            </nav>
-          </div>
-        </header>
-
-        {/* Main content */}
-        <main className="flex-1">{children}</main>
-
-        {/* Footer */}
-        <footer className="border-t bg-muted/50">
-          <div className="container mx-auto px-4 py-8">
-            <div className="grid grid-cols-1 gap-8 md:grid-cols-3">
-              <div>
-                <div className="flex items-center gap-2 mb-3">
-                  <Cannabis className="h-5 w-5 text-primary" />
-                  <span className="font-semibold">CannaManage</span>
-                </div>
-                <p className="text-sm text-muted-foreground">
-                  Die sichere Verwaltungssoftware für Cannabis-Anbauvereine in
-                  Deutschland.
-                </p>
-              </div>
-              <div>
-                <h4 className="font-semibold text-sm mb-3">Produkt</h4>
-                <ul className="space-y-2 text-sm text-muted-foreground">
-                  <li>
-                    <Link
-                      href="/pricing"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Preise
-                    </Link>
-                  </li>
-                  <li>
-                    <Link
-                      href="/login"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Anmelden
-                    </Link>
-                  </li>
-                </ul>
-              </div>
-              <div>
-                <h4 className="font-semibold text-sm mb-3">Rechtliches</h4>
-                <ul className="space-y-2 text-sm text-muted-foreground">
-                  <li>
-                    <Link
-                      href="/impressum"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Impressum
-                    </Link>
-                  </li>
-                  <li>
-                    <Link
-                      href="/datenschutz"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      Datenschutz
-                    </Link>
-                  </li>
-                  <li>
-                    <Link
-                      href="/agb"
-                      className="hover:text-foreground transition-colors"
-                    >
-                      AGB
-                    </Link>
-                  </li>
-                </ul>
-              </div>
-            </div>
-            <div className="mt-8 border-t pt-6 text-center text-xs text-muted-foreground">
-              © {new Date().getFullYear()} CannaManage — Plate Software. Alle
-              Rechte vorbehalten.
-            </div>
-          </div>
-        </footer>
-      </div>
     </NextIntlClientProvider>
   )
 }

cannamanage-frontend/src/app/(marketing)/marketing-layout-client.tsx

@@ -0,0 +1,135 @@
+"use client"
+
+import Link from "next/link"
+import { useTranslations } from "next-intl"
+import { Cannabis } from "lucide-react"
+
+import type { ReactNode } from "react"
+
+export default function MarketingLayoutClient({
+  children,
+}: {
+  children: ReactNode
+}) {
+  const t = useTranslations("marketing.nav")
+
+  return (
+    <div className="min-h-screen flex flex-col bg-background text-foreground overflow-x-hidden">
+      {/* Header */}
+      <header className="sticky top-0 z-40 border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
+        <div className="container mx-auto flex h-16 items-center justify-between px-4">
+          <Link href="/" className="flex items-center gap-2">
+            <div className="flex h-9 w-9 items-center justify-center rounded-lg bg-primary/10">
+              <Cannabis className="h-5 w-5 text-primary" />
+            </div>
+            <span className="text-lg font-bold">CannaManage</span>
+          </Link>
+          <nav className="flex items-center gap-4">
+            <Link
+              href="/#features"
+              className="text-sm font-medium text-muted-foreground hover:text-foreground transition-colors"
+            >
+              {t("features")}
+            </Link>
+            <Link
+              href="/pricing"
+              className="text-sm font-medium text-muted-foreground hover:text-foreground transition-colors"
+            >
+              {t("pricing")}
+            </Link>
+            <Link
+              href="/login"
+              className="inline-flex h-9 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground hover:bg-primary/90 transition-colors"
+            >
+              {t("login")}
+            </Link>
+          </nav>
+        </div>
+      </header>
+
+      {/* Main content */}
+      <main className="flex-1">{children}</main>
+
+      {/* Footer */}
+      <footer className="border-t bg-muted/50">
+        <div className="container mx-auto px-4 py-8">
+          <div className="grid grid-cols-1 gap-8 md:grid-cols-3">
+            <div>
+              <div className="flex items-center gap-2 mb-3">
+                <Cannabis className="h-5 w-5 text-primary" />
+                <span className="font-semibold">CannaManage</span>
+              </div>
+              <p className="text-sm text-muted-foreground">
+                {t("footerTagline")}
+              </p>
+            </div>
+            <div>
+              <h4 className="font-semibold text-sm mb-3">
+                {t("footerProduct")}
+              </h4>
+              <ul className="space-y-2 text-sm text-muted-foreground">
+                <li>
+                  <Link
+                    href="/#features"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("features")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/pricing"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("pricing")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/login"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("login")}
+                  </Link>
+                </li>
+              </ul>
+            </div>
+            <div>
+              <h4 className="font-semibold text-sm mb-3">{t("footerLegal")}</h4>
+              <ul className="space-y-2 text-sm text-muted-foreground">
+                <li>
+                  <Link
+                    href="/impressum"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("impressum")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/datenschutz"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("datenschutz")}
+                  </Link>
+                </li>
+                <li>
+                  <Link
+                    href="/agb"
+                    className="hover:text-foreground transition-colors"
+                  >
+                    {t("agb")}
+                  </Link>
+                </li>
+              </ul>
+            </div>
+          </div>
+          <div className="mt-8 border-t pt-6 text-center text-xs text-muted-foreground">
+            © {new Date().getFullYear()} CannaManage — Plate Software.{" "}
+            {t("allRightsReserved")}
+          </div>
+        </div>
+      </footer>
+    </div>
+  )
+}

cannamanage-frontend/src/app/(marketing)/page.tsx

@@ -0,0 +1,163 @@
+"use client"
+
+import Link from "next/link"
+import { useTranslations } from "next-intl"
+import {
+  ArrowRight,
+  Cannabis,
+  ClipboardCheck,
+  FileArchive,
+  Lock,
+  Scale,
+  Server,
+  ShieldCheck,
+  Sprout,
+  Users,
+  Wallet,
+} from "lucide-react"
+
+const features = [
+  { id: "feature1", icon: ClipboardCheck },
+  { id: "feature2", icon: Sprout },
+  { id: "feature3", icon: Users },
+  { id: "feature4", icon: Scale },
+  { id: "feature5", icon: FileArchive },
+  { id: "feature6", icon: Wallet },
+]
+
+const trustSignals = [
+  { id: "trustCanverg", icon: ShieldCheck },
+  { id: "trustDsgvo", icon: ClipboardCheck },
+  { id: "trustEncryption", icon: Lock },
+  { id: "trustGerman", icon: Server },
+]
+
+export default function HomePage() {
+  const t = useTranslations("marketing.home")
+
+  return (
+    <div className="flex flex-col">
+      {/* Hero Section */}
+      <section className="relative overflow-hidden py-20 sm:py-28 lg:py-32">
+        <div className="container mx-auto px-4 text-center">
+          <div className="mx-auto max-w-3xl">
+            <div className="mb-6 inline-flex items-center gap-2 rounded-full border bg-muted/50 px-4 py-1.5 text-sm">
+              <Cannabis className="h-4 w-4 text-primary" />
+              <span className="text-muted-foreground">KCanG-konform</span>
+            </div>
+            <h1 className="text-4xl font-bold tracking-tight sm:text-5xl lg:text-6xl">
+              {t("heroTitle")}
+            </h1>
+            <p className="mt-6 text-lg text-muted-foreground sm:text-xl max-w-2xl mx-auto">
+              {t("heroSubtitle")}
+            </p>
+            <div className="mt-10 flex flex-col items-center gap-4 sm:flex-row sm:justify-center">
+              <Link
+                href="/pricing"
+                className="inline-flex h-12 items-center justify-center gap-2 rounded-lg bg-primary px-6 text-base font-medium text-primary-foreground shadow-sm hover:bg-primary/90 transition-colors"
+              >
+                {t("ctaPrimary")}
+                <ArrowRight className="h-4 w-4" />
+              </Link>
+              <Link
+                href="/login"
+                className="inline-flex h-12 items-center justify-center gap-2 rounded-lg border bg-background px-6 text-base font-medium hover:bg-muted transition-colors"
+              >
+                {t("ctaSecondary")}
+              </Link>
+            </div>
+          </div>
+        </div>
+        {/* Decorative gradient */}
+        <div className="pointer-events-none absolute inset-0 -z-10 overflow-hidden">
+          <div className="absolute -top-40 left-1/2 -translate-x-1/2 h-[500px] w-[800px] rounded-full bg-primary/5 blur-3xl" />
+        </div>
+      </section>
+
+      {/* Features Section */}
+      <section id="features" className="py-20 bg-muted/30">
+        <div className="container mx-auto px-4">
+          <div className="text-center mb-14">
+            <h2 className="text-3xl font-bold tracking-tight sm:text-4xl">
+              {t("featuresTitle")}
+            </h2>
+            <p className="mt-4 text-lg text-muted-foreground max-w-2xl mx-auto">
+              {t("featuresSubtitle")}
+            </p>
+          </div>
+          <div className="grid grid-cols-1 gap-6 sm:grid-cols-2 lg:grid-cols-3 max-w-5xl mx-auto">
+            {features.map((feature) => {
+              const Icon = feature.icon
+              return (
+                <div
+                  key={feature.id}
+                  className="group rounded-xl border bg-card p-6 shadow-sm transition-all hover:shadow-md hover:border-primary/20"
+                >
+                  <div className="mb-4 flex h-12 w-12 items-center justify-center rounded-lg bg-primary/10 text-primary group-hover:bg-primary/15 transition-colors">
+                    <Icon className="h-6 w-6" />
+                  </div>
+                  <h3 className="text-lg font-semibold mb-2">
+                    {t(`${feature.id}Title`)}
+                  </h3>
+                  <p className="text-sm text-muted-foreground leading-relaxed">
+                    {t(`${feature.id}Desc`)}
+                  </p>
+                </div>
+              )
+            })}
+          </div>
+        </div>
+      </section>
+
+      {/* Trust Signals Section */}
+      <section className="py-20">
+        <div className="container mx-auto px-4">
+          <div className="text-center mb-12">
+            <h2 className="text-2xl font-bold tracking-tight sm:text-3xl">
+              {t("trustTitle")}
+            </h2>
+          </div>
+          <div className="grid grid-cols-2 gap-6 sm:grid-cols-4 max-w-3xl mx-auto">
+            {trustSignals.map((signal) => {
+              const Icon = signal.icon
+              return (
+                <div
+                  key={signal.id}
+                  className="flex flex-col items-center gap-3 rounded-lg border bg-card p-5 text-center"
+                >
+                  <div className="flex h-10 w-10 items-center justify-center rounded-full bg-primary/10 text-primary">
+                    <Icon className="h-5 w-5" />
+                  </div>
+                  <span className="text-sm font-medium">{t(signal.id)}</span>
+                </div>
+              )
+            })}
+          </div>
+        </div>
+      </section>
+
+      {/* Final CTA Section */}
+      <section className="py-20 bg-muted/30">
+        <div className="container mx-auto px-4 text-center">
+          <div className="mx-auto max-w-2xl">
+            <h2 className="text-3xl font-bold tracking-tight sm:text-4xl">
+              {t("ctaFinalTitle")}
+            </h2>
+            <p className="mt-4 text-lg text-muted-foreground">
+              {t("ctaFinalSubtitle")}
+            </p>
+            <div className="mt-8">
+              <Link
+                href="/pricing"
+                className="inline-flex h-12 items-center justify-center gap-2 rounded-lg bg-primary px-8 text-base font-medium text-primary-foreground shadow-sm hover:bg-primary/90 transition-colors"
+              >
+                {t("ctaFinalButton")}
+                <ArrowRight className="h-4 w-4" />
+              </Link>
+            </div>
+          </div>
+        </div>
+      </section>
+    </div>
+  )
+}

cannamanage-frontend/src/app/(marketing)/pricing/page.tsx

@@ -10,6 +10,7 @@ const plans = [
     icon: Leaf,
     price: "19",
     memberLimit: "30",
+    storage: "5",
     features: [
       "memberManagement",
       "distributionTracking",
@@ -24,6 +25,7 @@ const plans = [
     icon: Cannabis,
     price: "49",
     memberLimit: "100",
+    storage: "50",
     popular: true,
     features: [
       "allStarter",
@@ -40,6 +42,7 @@ const plans = [
     icon: Building2,
     price: null,
     memberLimit: "unlimited",
+    storage: "custom",
     features: [
       "allPro",
       "unlimitedMembers",
@@ -58,6 +61,7 @@ const faqs = [
   { id: "cancel" },
   { id: "data" },
   { id: "migration" },
+  { id: "storage" },
 ]
 
 export default function PricingPage() {
@@ -129,6 +133,14 @@ export default function PricingPage() {
                       limit: plan.memberLimit,
                     })}
                   </p>
+                  <div className="mt-2 inline-flex items-center gap-1 rounded-full bg-muted px-2.5 py-0.5 text-xs font-medium">
+                    {t(`storage.${plan.id}`)}
+                    {plan.id === "pro" && (
+                      <span className="text-muted-foreground ml-1">
+                        {t("storage.proOverage")}
+                      </span>
+                    )}
+                  </div>
                 </div>
 
                 <ul className="space-y-3 mb-8 flex-1">
@@ -180,6 +192,8 @@ export default function PricingPage() {
             <tbody className="divide-y">
               {[
                 "compMembers",
+                "compStorage",
+                "compOverage",
                 "compDistributions",
                 "compReports",
                 "compGrow",

cannamanage-frontend/src/app/(portal)/portal-login/page.tsx

@@ -7,7 +7,7 @@ import { zodResolver } from "@hookform/resolvers/zod"
 import { useTranslations } from "next-intl"
 import { useForm } from "react-hook-form"
 import { z } from "zod"
-import { Cannabis, Loader2 } from "lucide-react"
+import { Cannabis, ClockArrowUp, FileText, Loader2, User } from "lucide-react"
 
 const loginSchema = z.object({
   email: z.string().email(),
@@ -42,101 +42,162 @@ export default function PortalLoginPage() {
   }
 
   return (
-    <div className="fixed inset-0 z-50 flex min-h-screen items-center justify-center bg-background text-foreground p-4">
+    <div className="fixed inset-0 z-50 flex min-h-screen bg-background text-foreground">
-      <div className="w-full max-w-md space-y-8">
+      {/* Left panel — member-focused branding (hidden on mobile) */}
-        {/* Logo & Branding */}
+      <div className="hidden md:flex md:w-1/2 lg:w-[55%] flex-col items-center justify-center bg-gradient-to-br from-emerald-500/10 via-teal-500/5 to-background p-12 relative overflow-hidden">
-        <div className="flex flex-col items-center space-y-2">
+        {/* Decorative background */}
-          <div className="flex h-14 w-14 items-center justify-center rounded-xl bg-primary/10">
+        <div className="absolute inset-0 -z-10">
-            <Cannabis className="h-8 w-8 text-primary" />
+          <div className="absolute top-1/4 left-1/4 h-64 w-64 rounded-full bg-emerald-500/10 blur-3xl" />
+          <div className="absolute bottom-1/4 right-1/4 h-48 w-48 rounded-full bg-teal-500/5 blur-2xl" />
+        </div>
+
+        <div className="flex flex-col items-center gap-8 max-w-sm text-center">
+          {/* Logo */}
+          <div className="flex h-16 w-16 items-center justify-center rounded-2xl bg-emerald-500/10 border border-emerald-500/20">
+            <Cannabis className="h-9 w-9 text-emerald-600 dark:text-emerald-400" />
           </div>
-          <h1 className="text-2xl font-bold tracking-tight">{t("title")}</h1>
-          <p className="text-sm text-muted-foreground">{t("loginSubtitle")}</p>
-        </div>
 
-        {/* Login Card */}
+          {/* Branding */}
-        <div className="rounded-xl border bg-card p-6 shadow-sm">
+          <div className="space-y-2">
-          <form onSubmit={handleSubmit(onSubmit)} className="space-y-4">
+            <h1 className="text-2xl font-bold">Mitgliederportal</h1>
-            {/* Error message */}
+            <p className="text-muted-foreground">Willkommen zurück</p>
-            {error && (
+          </div>
-              <div className="rounded-lg border border-destructive/50 bg-destructive/10 p-3 text-sm text-destructive">
+
-                {error}
+          {/* Feature highlights */}
+          <div className="space-y-4 text-left w-full">
+            <div className="flex items-start gap-3">
+              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
+                <ClockArrowUp className="h-4 w-4 text-emerald-600 dark:text-emerald-400" />
               </div>
-            )}
+              <div>
-
+                <p className="text-sm font-medium">Abgabehistorie</p>
-            {/* Email field */}
+                <p className="text-xs text-muted-foreground">
-            <div className="space-y-2">
+                  Alle Abgaben auf einen Blick
-              <label
-                htmlFor="portal-email"
-                className="text-sm font-medium leading-none"
-              >
-                {t("email")}
-              </label>
-              <input
-                id="portal-email"
-                type="email"
-                autoComplete="email"
-                placeholder="max@beispiel.de"
-                className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
-                {...register("email")}
-                aria-invalid={!!errors.email}
-              />
-              {errors.email && (
-                <p className="text-xs text-destructive">
-                  {t("invalidCredentials")}
                 </p>
-              )}
+              </div>
             </div>
-
+            <div className="flex items-start gap-3">
-            {/* Password field */}
+              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
-            <div className="space-y-2">
+                <User className="h-4 w-4 text-emerald-600 dark:text-emerald-400" />
-              <label
+              </div>
-                htmlFor="portal-password"
+              <div>
-                className="text-sm font-medium leading-none"
+                <p className="text-sm font-medium">Profil verwalten</p>
-              >
+                <p className="text-xs text-muted-foreground">
-                {t("password")}
+                  Daten und Einstellungen
-              </label>
-              <input
-                id="portal-password"
-                type="password"
-                autoComplete="current-password"
-                placeholder="••••••••"
-                className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
-                {...register("password")}
-                aria-invalid={!!errors.password}
-              />
-              {errors.password && (
-                <p className="text-xs text-destructive">
-                  {t("invalidCredentials")}
                 </p>
-              )}
+              </div>
             </div>
-
+            <div className="flex items-start gap-3">
-            {/* Submit button */}
+              <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
-            <button
+                <FileText className="h-4 w-4 text-emerald-600 dark:text-emerald-400" />
-              type="submit"
+              </div>
-              disabled={isSubmitting}
+              <div>
-              className="inline-flex h-10 w-full items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground ring-offset-background transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50"
+                <p className="text-sm font-medium">Dokumente</p>
-            >
+                <p className="text-xs text-muted-foreground">
-              {isSubmitting ? (
+                  Bescheinigungen und Nachweise
-                <>
+                </p>
-                  <Loader2 className="h-4 w-4 animate-spin" />
+              </div>
-                  {t("loggingIn")}
+            </div>
-                </>
+          </div>
-              ) : (
-                t("loginButton")
-              )}
-            </button>
-          </form>
         </div>
+      </div>
 
-        {/* Footer link to admin */}
+      {/* Right panel — form */}
-        <div className="text-center">
+      <div className="w-full md:w-1/2 lg:w-[45%] flex items-center justify-center p-6 sm:p-8">
-          <Link
+        <div className="w-full max-w-sm space-y-6">
-            href="/login"
+          {/* Title */}
-            className="text-xs text-muted-foreground hover:text-primary transition-colors"
+          <div className="space-y-2 text-center md:text-left">
-          >
+            <h2 className="text-2xl font-bold tracking-tight">{t("title")}</h2>
-            {t("adminLogin")}
+            <p className="text-sm text-muted-foreground">
-          </Link>
+              {t("loginSubtitle")}
+            </p>
+          </div>
+
+          {/* Login Card */}
+          <div className="rounded-xl border bg-card p-6 shadow-sm">
+            <form onSubmit={handleSubmit(onSubmit)} className="space-y-4">
+              {/* Error message */}
+              {error && (
+                <div className="rounded-lg border border-destructive/50 bg-destructive/10 p-3 text-sm text-destructive">
+                  {error}
+                </div>
+              )}
+
+              {/* Email field */}
+              <div className="space-y-2">
+                <label
+                  htmlFor="portal-email"
+                  className="text-sm font-medium leading-none"
+                >
+                  {t("email")}
+                </label>
+                <input
+                  id="portal-email"
+                  type="email"
+                  autoComplete="email"
+                  placeholder="max@beispiel.de"
+                  className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
+                  {...register("email")}
+                  aria-invalid={!!errors.email}
+                />
+                {errors.email && (
+                  <p className="text-xs text-destructive">
+                    {t("invalidCredentials")}
+                  </p>
+                )}
+              </div>
+
+              {/* Password field */}
+              <div className="space-y-2">
+                <label
+                  htmlFor="portal-password"
+                  className="text-sm font-medium leading-none"
+                >
+                  {t("password")}
+                </label>
+                <input
+                  id="portal-password"
+                  type="password"
+                  autoComplete="current-password"
+                  placeholder="••••••••"
+                  className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
+                  {...register("password")}
+                  aria-invalid={!!errors.password}
+                />
+                {errors.password && (
+                  <p className="text-xs text-destructive">
+                    {t("invalidCredentials")}
+                  </p>
+                )}
+              </div>
+
+              {/* Submit button */}
+              <button
+                type="submit"
+                disabled={isSubmitting}
+                className="inline-flex h-10 w-full items-center justify-center gap-2 rounded-md bg-emerald-600 px-4 py-2 text-sm font-medium text-white ring-offset-background transition-colors hover:bg-emerald-700 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50"
+              >
+                {isSubmitting ? (
+                  <>
+                    <Loader2 className="h-4 w-4 animate-spin" />
+                    {t("loggingIn")}
+                  </>
+                ) : (
+                  t("loginButton")
+                )}
+              </button>
+            </form>
+          </div>
+
+          {/* Footer link to admin */}
+          <div className="text-center">
+            <Link
+              href="/login"
+              className="text-xs text-muted-foreground hover:text-primary transition-colors"
+            >
+              {t("adminLogin")}
+            </Link>
+          </div>
         </div>
       </div>
     </div>

cannamanage-frontend/src/app/api/backend/[...path]/route.ts

@@ -0,0 +1,122 @@
+/**
+ * Server-side API proxy for the CannaManage backend.
+ *
+ * Replaces the old static `rewrites()` proxy in next.config.mjs. A static
+ * rewrite forwards requests as-is and CANNOT inject an Authorization header,
+ * which was the root cause of the systemic "no token reaches the backend" bug:
+ * every browser fetch hit the backend unauthenticated → 401/500 → pages only
+ * survived via mock fallbacks.
+ *
+ * This Route Handler runs on the server, reads the NextAuth session via
+ * `auth()` (so the JWT never leaves the server), and forwards the request to
+ * `${BACKEND_URL}/api/v1/<path>` with `Authorization: Bearer <accessToken>`.
+ *
+ * It is method-agnostic and content-agnostic:
+ *   - Query string is preserved.
+ *   - The raw request body is streamed through unparsed, so JSON,
+ *     multipart/form-data (file uploads) and any other content type work.
+ *   - The upstream response body is streamed back verbatim, so binary
+ *     downloads (PDF/CSV reports, attachments) are byte-exact.
+ */
+import { NextResponse } from "next/server"
+
+import type { NextRequest } from "next/server"
+
+import { auth } from "@/lib/auth"
+
+// Always run dynamically — this proxy depends on per-request auth + body.
+export const dynamic = "force-dynamic"
+
+const BACKEND_URL = process.env.BACKEND_URL || "http://localhost:8080"
+
+// Hop-by-hop and host-specific headers that must not be forwarded upstream.
+const STRIPPED_REQUEST_HEADERS = new Set([
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "accept-encoding",
+])
+
+// Headers that must not be copied from the upstream response back to the client.
+const STRIPPED_RESPONSE_HEADERS = new Set([
+  "connection",
+  "transfer-encoding",
+  "content-encoding",
+  "content-length",
+])
+
+async function proxy(req: NextRequest, path: string[]): Promise<NextResponse> {
+  const session = await auth()
+  const accessToken = session?.accessToken
+
+  // Build the upstream URL: /api/backend/<path> → BACKEND_URL/api/v1/<path>
+  const search = req.nextUrl.search // includes leading "?" or ""
+  const upstreamUrl = `${BACKEND_URL}/api/v1/${path.join("/")}${search}`
+
+  // Clone the incoming headers, stripping hop-by-hop/host ones, then inject auth.
+  const headers = new Headers()
+  req.headers.forEach((value, key) => {
+    if (!STRIPPED_REQUEST_HEADERS.has(key.toLowerCase())) {
+      headers.set(key, value)
+    }
+  })
+  if (accessToken) {
+    headers.set("Authorization", `Bearer ${accessToken}`)
+  }
+
+  const method = req.method.toUpperCase()
+  const hasBody = method !== "GET" && method !== "HEAD"
+
+  try {
+    const upstream = await fetch(upstreamUrl, {
+      method,
+      headers,
+      // Stream the raw body through unparsed (works for JSON + multipart + binary).
+      body: hasBody ? req.body : undefined,
+      // Required by undici/Node when sending a streaming request body.
+      ...(hasBody ? { duplex: "half" } : {}),
+      redirect: "manual",
+      cache: "no-store",
+    } as RequestInit)
+
+    // Copy upstream response headers, dropping ones that break a re-emitted body.
+    const responseHeaders = new Headers()
+    upstream.headers.forEach((value, key) => {
+      if (!STRIPPED_RESPONSE_HEADERS.has(key.toLowerCase())) {
+        responseHeaders.set(key, value)
+      }
+    })
+
+    // Stream the body straight back — byte-exact for downloads.
+    return new NextResponse(upstream.body, {
+      status: upstream.status,
+      statusText: upstream.statusText,
+      headers: responseHeaders,
+    })
+  } catch {
+    return NextResponse.json(
+      { code: "BACKEND_UNREACHABLE", message: "Unable to reach the API." },
+      { status: 502 }
+    )
+  }
+}
+
+// Next.js 15: the second arg's `params` is a Promise.
+type Ctx = { params: Promise<{ path: string[] }> }
+
+export async function GET(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function POST(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function PUT(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function PATCH(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}
+export async function DELETE(req: NextRequest, ctx: Ctx) {
+  return proxy(req, (await ctx.params).path)
+}

cannamanage-frontend/src/lib/auth.ts

@@ -120,6 +120,20 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
       session.user.role = token.role as string
       session.user.clubId = token.clubId as string
       session.error = token.error as string | undefined
+      // Expose the backend access token on the session so the server-side proxy
+      // Route Handler (app/api/backend/[...path]/route.ts) can read it via auth()
+      // and inject it as a Bearer header on every API call.
+      //
+      // We use auth() (not getToken()) because it handles the cookie name
+      // consistently across the public-HTTPS / internal-HTTP boundary: the
+      // browser talks HTTPS to the Apache front, which proxies plain HTTP to
+      // this container. getToken()'s __Secure- cookie-name autodetection keys
+      // off the (internal, http) request URL and would miss the real secure
+      // cookie. The tradeoff: accessToken is therefore also returned by
+      // /api/auth/session — i.e. readable client-side. That is an accepted,
+      // standard bearer-token-in-browser posture; the JWT is short-lived and is
+      // already the browser's effective credential.
+      session.accessToken = token.accessToken as string | undefined
       return session
     },
     async redirect({ url, baseUrl }) {

cannamanage-frontend/src/services/board.ts

@@ -1,5 +1,13 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
+
 import { apiClient } from "@/lib/api-client"
 
+// --- Constants ---
+
+const CLUB_ID = "00000000-0000-0000-0000-000000000001"
+
+// --- Types ---
+
 export interface BoardPosition {
   id: string
   title: string
@@ -37,6 +45,8 @@ export interface ElectBoardMemberRequest {
   assemblyId?: string
 }
 
+// --- Raw API functions ---
+
 export function createPosition(
   clubId: string,
   data: CreatePositionRequest
@@ -88,3 +98,51 @@ export function removeBoardMember(id: string, clubId: string): Promise<void> {
 export function getPortalBoard(clubId: string): Promise<BoardMember[]> {
   return apiClient<BoardMember[]>(`/portal/board?clubId=${clubId}`)
 }
+
+// --- React Query Hooks ---
+
+export function useBoardQuery() {
+  return useQuery({
+    queryKey: ["board", CLUB_ID],
+    queryFn: () => getCurrentBoard(CLUB_ID),
+  })
+}
+
+export function usePositionsQuery() {
+  return useQuery({
+    queryKey: ["board-positions", CLUB_ID],
+    queryFn: () => getPositions(CLUB_ID),
+  })
+}
+
+export function useCreatePositionMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (data: CreatePositionRequest) => createPosition(CLUB_ID, data),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["board-positions"] })
+      queryClient.invalidateQueries({ queryKey: ["board"] })
+    },
+  })
+}
+
+export function useElectBoardMemberMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (data: ElectBoardMemberRequest) =>
+      electBoardMember(CLUB_ID, data),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["board"] })
+    },
+  })
+}
+
+export function useRemoveBoardMemberMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) => removeBoardMember(id, CLUB_ID),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["board"] })
+    },
+  })
+}

cannamanage-frontend/src/services/documents.ts

@@ -1,5 +1,13 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
+
 import { apiClient } from "@/lib/api-client"
 
+// --- Constants ---
+
+const CLUB_ID = "00000000-0000-0000-0000-000000000001"
+
+// --- Types ---
+
 export type DocumentCategory =
   | "SATZUNG"
   | "PROTOKOLL"
@@ -28,6 +36,16 @@ export interface StorageUsage {
   bytesUsed: number
 }
 
+export interface UploadDocumentRequest {
+  title: string
+  category: DocumentCategory
+  accessLevel: DocumentAccessLevel
+  description: string | null
+  file: File
+}
+
+// --- Raw API functions ---
+
 export async function uploadDocument(
   clubId: string,
   title: string,
@@ -55,7 +73,19 @@ export async function uploadDocument(
       body: formData,
     }
   )
-  if (!res.ok) throw new Error("Upload failed")
+  if (!res.ok) {
+    if (res.status === 402) {
+      const problem = await res.json()
+      const error = new Error("Storage quota exceeded") as Error & {
+        status: number
+        problemDetail: unknown
+      }
+      error.status = 402
+      error.problemDetail = problem
+      throw error
+    }
+    throw new Error("Upload failed")
+  }
   return res.json()
 }
 
@@ -90,14 +120,53 @@ export function getPortalDocuments(clubId: string): Promise<ClubDocument[]> {
   return apiClient<ClubDocument[]>(`/portal/documents?clubId=${clubId}`)
 }
 
-// Helper: format file size
+// --- React Query Hooks ---
+
+export function useDocumentsQuery(category?: DocumentCategory) {
+  return useQuery({
+    queryKey: ["documents", CLUB_ID, category],
+    queryFn: () => listDocuments(CLUB_ID, category),
+  })
+}
+
+export function useUploadDocumentMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (data: UploadDocumentRequest) =>
+      uploadDocument(
+        CLUB_ID,
+        data.title,
+        data.category,
+        data.accessLevel,
+        data.description,
+        data.file
+      ),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["documents"] })
+    },
+  })
+}
+
+export function useDeleteDocumentMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) => deleteDocument(id, CLUB_ID),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["documents"] })
+    },
+  })
+}
+
+// --- Helper: format file size ---
+
 export function formatFileSize(bytes: number): string {
   if (bytes < 1024) return `${bytes} B`
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
 }
 
-// Category labels
+// --- Category labels ---
+
 export const categoryLabels: Record<DocumentCategory, string> = {
   SATZUNG: "Satzung",
   PROTOKOLL: "Protokoll",

cannamanage-frontend/src/services/storage.ts

@@ -0,0 +1,43 @@
+import { apiClient } from "@/lib/api-client"
+
+export interface StorageUsage {
+  usedBytes: number
+  limitBytes: number
+  percentage: number
+}
+
+/**
+ * Fetch current storage usage for the authenticated user's club.
+ * Club ID is derived from JWT on the backend — no param needed.
+ */
+export function getStorageUsage(): Promise<StorageUsage> {
+  return apiClient<StorageUsage>("/storage/usage")
+}
+
+/**
+ * Format bytes into a human-readable string (e.g., "4.2 GB").
+ */
+export function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B"
+  const k = 1024
+  const sizes = ["B", "KB", "MB", "GB", "TB"]
+  const i = Math.floor(Math.log(bytes) / Math.log(k))
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + " " + sizes[i]
+}
+
+/**
+ * Check if an API error response indicates a storage quota exceeded (HTTP 402).
+ */
+export function isStorageQuotaError(error: unknown): boolean {
+  if (
+    error &&
+    typeof error === "object" &&
+    "response" in error &&
+    error.response &&
+    typeof error.response === "object" &&
+    "status" in error.response
+  ) {
+    return (error.response as { status: number }).status === 402
+  }
+  return false
+}

cannamanage-frontend/src/types/next-auth.d.ts

@@ -7,6 +7,8 @@ declare module "next-auth" {
       clubId: string
     } & DefaultSession["user"]
     error?: string
+    /** Backend JWT — server-side only, injected as Bearer by the /api/backend proxy. */
+    accessToken?: string
   }
 
   interface User {

cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java

@@ -5,6 +5,7 @@ import de.cannamanage.domain.enums.AuditEventType;
 import de.cannamanage.domain.enums.DocumentAccessLevel;
 import de.cannamanage.domain.enums.DocumentCategory;
 import de.cannamanage.service.repository.DocumentRepository;
+import org.apache.commons.io.FilenameUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Service;
@@ -35,16 +36,22 @@ public class DocumentService {
 
     private final DocumentRepository documentRepository;
     private final AuditService auditService;
+    private final StorageQuotaService storageQuotaService;
 
-    public DocumentService(DocumentRepository documentRepository, AuditService auditService) {
+    public DocumentService(DocumentRepository documentRepository, AuditService auditService,
+                           StorageQuotaService storageQuotaService) {
         this.documentRepository = documentRepository;
         this.auditService = auditService;
+        this.storageQuotaService = storageQuotaService;
     }
 
     @Transactional
     public Document uploadDocument(UUID clubId, String title, DocumentCategory category,
                                    DocumentAccessLevel accessLevel, String description,
                                    MultipartFile file, UUID uploadedBy) throws IOException {
+        // Check storage quota before upload
+        storageQuotaService.checkQuota(clubId, file.getSize());
+
         // Validate file
         if (file.isEmpty()) {
             throw new IllegalArgumentException("File is empty");
@@ -87,6 +94,9 @@ public class DocumentService {
 
         Document saved = documentRepository.save(doc);
 
+        // Increment storage usage counter after successful save
+        storageQuotaService.incrementUsage(clubId, file.getSize());
+
         auditService.log(AuditEventType.DOCUMENT_UPLOADED, uploadedBy, clubId,
                 "Document uploaded: " + title + " (" + category + ")");
 
@@ -132,6 +142,9 @@ public class DocumentService {
         // Delete DB record
         documentRepository.delete(doc);
 
+        // Decrement storage usage counter after successful delete
+        storageQuotaService.decrementUsage(clubId, doc.getFileSize());
+
         auditService.log(AuditEventType.DOCUMENT_DELETED, deletedBy, clubId,
                 "Document deleted: " + doc.getTitle());
 
@@ -198,14 +211,17 @@ public class DocumentService {
         if (original == null || original.isBlank()) {
             return UUID.randomUUID().toString();
         }
-        // Strip path components — keep only the basename
+        // Strip null bytes first — FilenameUtils.getName() throws on \0
-        String name;
+        String safe = original.replace("\0", "");
-        try {
+        if (safe.isBlank()) {
-            name = Paths.get(original).getFileName().toString();
-        } catch (RuntimeException e) {
-            // Invalid path on this platform — fall back to a random name
             return UUID.randomUUID().toString();
         }
+        // Strip path components using commons-io — handles both Unix and Windows separators
+        // regardless of the current platform (unlike Paths.get which is platform-dependent)
+        String name = FilenameUtils.getName(safe);
+        if (name == null || name.isBlank()) {
+            return "document";
+        }
         // Remove control characters and path-/shell-/Windows-reserved characters
         name = name.replaceAll("[\\x00-\\x1F\\x7F/\\\\:*?\"<>|]", "_");
         // Limit length (filesystems usually cap individual segments at 255 bytes)
@@ -214,7 +230,7 @@ public class DocumentService {
         }
         // Ensure not empty after sanitization
         if (name.isBlank() || ".".equals(name) || "..".equals(name)) {
-            return UUID.randomUUID().toString();
+            return "document";
         }
         return name;
     }

cannamanage-service/src/main/java/de/cannamanage/service/RetentionService.java

@@ -9,7 +9,7 @@ import de.cannamanage.service.repository.DistributionRepository;
 import de.cannamanage.service.repository.MemberRepository;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -29,9 +29,11 @@ import java.util.*;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnProperty(name = "cannamanage.schedulers.enabled", havingValue = "true", matchIfMissing = false)
 public class RetentionService {
 
+    @Value("${cannamanage.schedulers.enabled:false}")
+    private boolean schedulersEnabled;
+
     private final ClubRepository clubRepository;
     private final MemberRepository memberRepository;
     private final DistributionRepository distributionRepository;
@@ -39,11 +41,15 @@ public class RetentionService {
 
     /**
      * Daily scheduled retention processing at 2:00 AM.
+     * Only runs when schedulers are enabled.
      * Processes each club independently.
      */
     @Scheduled(cron = "0 0 2 * * *")
     @Transactional
     public void processRetention() {
+        if (!schedulersEnabled) {
+            return;
+        }
         log.info("Starting scheduled retention processing");
         List<Club> clubs = clubRepository.findAll();
         int totalAnonymized = 0;

cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java

@@ -0,0 +1,121 @@
+package de.cannamanage.service;
+
+import de.cannamanage.domain.entity.Club;
+import de.cannamanage.service.exception.StorageQuotaExceededException;
+import de.cannamanage.service.repository.ClubRepository;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.UUID;
+
+/**
+ * Manages storage quota enforcement for clubs.
+ * Each club has a storage_limit_bytes based on their subscription tier
+ * and a storage_used_bytes counter tracking actual usage.
+ */
+@Slf4j
+@Service
+public class StorageQuotaService {
+
+    // Plan tier limits
+    private static final long STARTER_LIMIT = 5L * 1024 * 1024 * 1024;   // 5 GB
+    private static final long PRO_LIMIT = 50L * 1024 * 1024 * 1024;      // 50 GB
+    private static final long ENTERPRISE_LIMIT = Long.MAX_VALUE;          // Unlimited
+
+    private final ClubRepository clubRepository;
+
+    public StorageQuotaService(ClubRepository clubRepository) {
+        this.clubRepository = clubRepository;
+    }
+
+    /**
+     * Get current storage usage for a club.
+     */
+    public StorageUsageDTO getUsage(UUID clubId) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        long used = club.getStorageUsedBytes();
+        long limit = club.getStorageLimitBytes();
+        double percentage = limit > 0 ? (double) used / limit * 100 : 0;
+        return new StorageUsageDTO(used, limit, percentage);
+    }
+
+    /**
+     * Check if uploading additionalBytes would exceed the club's storage limit.
+     * Throws StorageQuotaExceededException if it would.
+     */
+    public void checkQuota(UUID clubId, long additionalBytes) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        long newTotal = club.getStorageUsedBytes() + additionalBytes;
+        if (newTotal > club.getStorageLimitBytes()) {
+            throw new StorageQuotaExceededException(
+                    club.getStorageUsedBytes(), club.getStorageLimitBytes(), additionalBytes);
+        }
+    }
+
+    /**
+     * Increment the club's storage usage counter after a successful upload.
+     */
+    @Transactional
+    public void incrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        club.setStorageUsedBytes(club.getStorageUsedBytes() + bytes);
+        clubRepository.save(club);
+        log.debug("Club {} storage incremented by {} bytes (total: {})", clubId, bytes, club.getStorageUsedBytes());
+    }
+
+    /**
+     * Decrement the club's storage usage counter after a successful delete.
+     */
+    @Transactional
+    public void decrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        long newUsage = Math.max(0, club.getStorageUsedBytes() - bytes);
+        club.setStorageUsedBytes(newUsage);
+        clubRepository.save(club);
+        log.debug("Club {} storage decremented by {} bytes (total: {})", clubId, bytes, newUsage);
+    }
+
+    /**
+     * Get the storage limit in bytes for a given plan tier name.
+     */
+    public static long getLimitForTier(String tier) {
+        return switch (tier.toLowerCase()) {
+            case "starter", "trial" -> STARTER_LIMIT;
+            case "pro" -> PRO_LIMIT;
+            case "enterprise" -> ENTERPRISE_LIMIT;
+            default -> STARTER_LIMIT;
+        };
+    }
+
+    /**
+     * Called when a club's subscription tier changes.
+     * Updates storage_limit_bytes to match the new tier.
+     */
+    @Transactional
+    public void onTierChange(UUID clubId, String newTier) {
+        long newLimit = getLimitForTier(newTier);
+        Club club = clubRepository.findById(clubId)
+                .orElseThrow(() -> new IllegalArgumentException("Club not found: " + clubId));
+        club.setStorageLimitBytes(newLimit);
+        clubRepository.save(club);
+        log.info("Club {} tier changed to '{}' — storage limit updated to {} bytes", clubId, newTier, newLimit);
+    }
+
+    /**
+     * Check if a club is at or above a given usage threshold percentage.
+     */
+    public boolean isNearLimit(UUID clubId, int thresholdPercent) {
+        StorageUsageDTO usage = getUsage(clubId);
+        return usage.percentage() >= thresholdPercent;
+    }
+
+    /**
+     * DTO for storage usage response.
+     */
+    public record StorageUsageDTO(long usedBytes, long limitBytes, double percentage) {}
+}

cannamanage-service/src/main/java/de/cannamanage/service/exception/StorageQuotaExceededException.java

@@ -0,0 +1,33 @@
+package de.cannamanage.service.exception;
+
+/**
+ * Thrown when a document upload would exceed the club's storage quota.
+ * Maps to HTTP 402 Payment Required — distinct from QuotaExceededException
+ * which handles CanG distribution quotas (25g/day, 50g/month).
+ */
+public class StorageQuotaExceededException extends RuntimeException {
+
+    private final long currentUsage;
+    private final long limit;
+    private final long requestedBytes;
+
+    public StorageQuotaExceededException(long currentUsage, long limit, long requestedBytes) {
+        super("Storage quota exceeded: current=%d, limit=%d, requested=%d"
+                .formatted(currentUsage, limit, requestedBytes));
+        this.currentUsage = currentUsage;
+        this.limit = limit;
+        this.requestedBytes = requestedBytes;
+    }
+
+    public long getCurrentUsage() {
+        return currentUsage;
+    }
+
+    public long getLimit() {
+        return limit;
+    }
+
+    public long getRequestedBytes() {
+        return requestedBytes;
+    }
+}

cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java

@@ -40,6 +40,9 @@ class DocumentServiceTest {
     @Mock
     private AuditService auditService;
 
+    @Mock
+    private StorageQuotaService storageQuotaService;
+
     @InjectMocks
     private DocumentService documentService;
 
@@ -164,10 +167,10 @@ class DocumentServiceTest {
                     clubId, "Dots", DocumentCategory.SONSTIGES,
                     DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
 
-            // ".." is explicitly caught → UUID fallback
+            // ".." is explicitly caught → "document" fallback
             assertThat(result.getFilename()).isNotEqualTo("..");
             assertThat(result.getFilename()).isNotBlank();
-            assertThat(result.getFilename()).matches("[a-f0-9\\-]+");
+            assertThat(result.getFilename()).isEqualTo("document");
         }
     }
 
@@ -234,6 +237,7 @@ class DocumentServiceTest {
         doc.setId(docId);
         doc.setClubId(clubId);
         doc.setTitle("To Delete");
+        doc.setFileSize(1024L);
         doc.setStoragePath(clubId + "/" + docId + "_test.pdf");
         when(documentRepository.findById(docId)).thenReturn(Optional.of(doc));
 
@@ -267,6 +271,83 @@ class DocumentServiceTest {
         }
     }
 
+    // --- Additional security tests for Sprint 13 ---
+
+    @Test
+    void testUploadDocument_sanitizesPathTraversal_toBasename() throws IOException {
+        // Verify that "../../etc/passwd" is stripped to just "passwd"
+        MultipartFile file = mockValidFile("../../etc/passwd", "application/pdf", 512);
+        when(documentRepository.save(any(Document.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        try (MockedStatic<Files> filesMock = mockStatic(Files.class)) {
+            filesMock.when(() -> Files.createDirectories(any(Path.class))).thenReturn(null);
+            filesMock.when(() -> Files.write(any(Path.class), any(byte[].class))).thenReturn(null);
+
+            Document result = documentService.uploadDocument(
+                    clubId, "Path Traversal Test", DocumentCategory.SONSTIGES,
+                    DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
+
+            assertThat(result.getFilename()).isEqualTo("passwd");
+        }
+    }
+
+    @Test
+    void testUploadDocument_nullFilename_usesFallback() throws IOException {
+        MultipartFile file = mockValidFile(null, "application/pdf", 512);
+        when(documentRepository.save(any(Document.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        try (MockedStatic<Files> filesMock = mockStatic(Files.class)) {
+            filesMock.when(() -> Files.createDirectories(any(Path.class))).thenReturn(null);
+            filesMock.when(() -> Files.write(any(Path.class), any(byte[].class))).thenReturn(null);
+
+            Document result = documentService.uploadDocument(
+                    clubId, "Null Filename", DocumentCategory.SONSTIGES,
+                    DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
+
+            // Null filename should produce a non-blank fallback (UUID)
+            assertThat(result.getFilename()).isNotBlank();
+            assertThat(result.getFilename()).doesNotContain("..");
+            assertThat(result.getFilename()).doesNotContain("/");
+        }
+    }
+
+    @Test
+    void testUploadDocument_normalFilename_preserved() throws IOException {
+        MultipartFile file = mockValidFile("report.pdf", "application/pdf", 1024);
+        when(documentRepository.save(any(Document.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        try (MockedStatic<Files> filesMock = mockStatic(Files.class)) {
+            filesMock.when(() -> Files.createDirectories(any(Path.class))).thenReturn(null);
+            filesMock.when(() -> Files.write(any(Path.class), any(byte[].class))).thenReturn(null);
+
+            Document result = documentService.uploadDocument(
+                    clubId, "Normal File", DocumentCategory.PROTOKOLL,
+                    DocumentAccessLevel.ALL_MEMBERS, null, file, uploadedBy);
+
+            assertThat(result.getFilename()).isEqualTo("report.pdf");
+        }
+    }
+
+    @Test
+    void testDownloadDocument_documentNotFound_throwsException() {
+        UUID nonExistentId = UUID.randomUUID();
+        when(documentRepository.findById(nonExistentId)).thenReturn(Optional.empty());
+
+        assertThatThrownBy(() -> documentService.downloadDocument(nonExistentId))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not found");
+    }
+
+    @Test
+    void testDeleteDocument_documentNotFound_throwsException() {
+        UUID nonExistentId = UUID.randomUUID();
+        when(documentRepository.findById(nonExistentId)).thenReturn(Optional.empty());
+
+        assertThatThrownBy(() -> documentService.deleteDocument(nonExistentId, uploadedBy, clubId))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not found");
+    }
+
     // --- Helpers ---
 
     private MultipartFile mockValidFile(String filename, String contentType, long size) {

cannamanage-service/src/test/java/de/cannamanage/service/EmailServiceTest.java

@@ -47,6 +47,6 @@ class EmailServiceTest {
         assertThatThrownBy(() ->
                 emailService.sendInviteEmail("fail@example.com", "Fail User", "Club", "token123"))
                 .isInstanceOf(RuntimeException.class)
-                .hasMessageContaining("Failed to send invite email");
+                .hasMessageContaining("Failed to send email");
     }
 }

docker-compose.test.local.yml

@@ -0,0 +1,10 @@
+# Local dev override — replaces tmpfs with named volume for macOS compatibility
+# Usage: docker compose -f docker-compose.test.yml -f docker-compose.test.local.yml up --build
+services:
+  db:
+    tmpfs: !reset []
+    volumes:
+      - test-pgdata:/var/lib/postgresql/data
+
+volumes:
+  test-pgdata:

docker-compose.test.yml

@@ -1,46 +1,79 @@
-# System test profile — runs full stack with seed data + Playwright
+# Integration test profile — full stack with Flyway seed + Playwright
-# Usage: docker compose -f docker-compose.test.yml up --abort-on-container-exit
+# Usage: docker compose -f docker-compose.test.yml up --build --abort-on-container-exit
-include:
-  - docker-compose.yml
-
 services:
-  # Override db to include seed data
   db:
-    volumes:
+    image: postgres:16-alpine
-      - pgdata:/var/lib/postgresql/data
+    container_name: cannamanage-test-db
-      - ./scripts/seed/init.sql:/docker-entrypoint-initdb.d/99-seed.sql:ro
+    tmpfs:
+      - /var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: cannamanage_test
+      POSTGRES_USER: cannamanage
+      POSTGRES_PASSWORD: cannamanage_test
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U cannamanage -d cannamanage_test"]
+      interval: 3s
+      timeout: 2s
+      retries: 10
 
-  # Seed container: waits for backend health, then validates readiness
+  backend:
-  seed:
+    build:
-    image: curlimages/curl:latest
+      context: .
-    container_name: cannamanage-seed
+      dockerfile: Dockerfile.backend
+    container_name: cannamanage-test-backend
+    environment:
+      SPRING_PROFILES_ACTIVE: test
+      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/cannamanage_test
+      SPRING_DATASOURCE_USERNAME: cannamanage
+      SPRING_DATASOURCE_PASSWORD: cannamanage_test
+      CANNAMANAGE_SECURITY_JWT_SECRET: dGVzdC1zZWNyZXQtZm9yLWludGVncmF0aW9uLXRlc3RzLW9ubHktMzJjaGFycw==
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080/actuator/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 15
+      start_period: 30s
+
+  frontend:
+    build:
+      context: ./cannamanage-frontend
+      dockerfile: Dockerfile
+    container_name: cannamanage-test-frontend
+    environment:
+      NEXTAUTH_URL: http://localhost:3000
+      NEXTAUTH_SECRET: test-nextauth-secret-minimum-32-characters
+      BACKEND_URL: http://backend:8080
+      AUTH_URL: http://localhost:3000
     depends_on:
       backend:
         condition: service_healthy
-    entrypoint: /bin/sh
-    command: ["-c", "/seed/seed.sh"]
-    volumes:
-      - ./scripts/seed:/seed:ro
 
-  # Playwright system tests
   playwright:
-    image: mcr.microsoft.com/playwright:v1.52.0-noble
+    build:
-    container_name: cannamanage-playwright
+      context: ./cannamanage-frontend
+      dockerfile: Dockerfile.playwright
+    container_name: cannamanage-test-playwright
     working_dir: /app
     depends_on:
-      seed:
-        condition: service_completed_successfully
       frontend:
         condition: service_started
+      backend:
+        condition: service_healthy
     environment:
       BASE_URL: http://frontend:3000
+      API_URL: http://backend:8080
       CI: "true"
+    # Volume mount allows test iteration without rebuild
+    # (Dockerfile pre-installs deps; mount overrides test files only)
     volumes:
-      - ./cannamanage-frontend:/app
+      - ./cannamanage-frontend/e2e:/app/e2e:ro
     command: >
       sh -c "
-        echo 'Waiting for frontend to be ready...' &&
+        echo 'Waiting for frontend...' &&
-        timeout 60 sh -c 'until wget -q -O /dev/null http://frontend:3000 2>/dev/null; do sleep 2; done' &&
+        timeout 90 sh -c 'until wget -q -O /dev/null http://frontend:3000 2>/dev/null; do sleep 2; done' &&
-        echo 'Frontend ready — running system tests...' &&
+        echo 'Frontend ready — running integration tests...' &&
-        npx playwright test e2e/system-test.spec.ts --reporter=list
+        npx playwright test e2e/integration/ --reporter=html --grep @smoke
       "

docker-compose.truenas.yml

@@ -1,20 +1,54 @@
-# TrueNAS homelab override — replaces localhost with 192.168.188.119
+# TrueNAS homelab override — public hosting at https://cannamanage.plate-software.de
 # Applied on top of docker-compose.yml for the homelab deployment on TrueNAS.local.
-# Usage:
+#
-#   docker compose -f docker-compose.yml -f docker-compose.truenas.yml up -d --build
+# Topology (same proven chain as Gitea + InspectFlow):
+#   browser ──HTTPS──> IONOS Apache (82.165.206.45, TLS via acme.sh)
+#          ──ProxyPass──> VPS frps (85.214.154.199:30010)
+#          ──frp tunnel──> TrueNAS frpc ──> frontend:3000 (this stack)
+#   frontend proxies /api/backend/* to backend:8080 via the server-side
+#   Route Handler (src/app/api/backend/[...path]/route.ts), so only the
+#   frontend port needs to be tunnelled — no separate API exposure.
+#
+# Usage (run by the Gitea act_runner on push to main):
+#   docker compose -f docker-compose.yml -f docker-compose.truenas.yml \
+#     -p cannamanage up -d --build --remove-orphans
 services:
+  db:
+    # Internal-only: drop the host :5432 publish inherited from docker-compose.yml.
+    # Postgres must not be exposed to the LAN. The backend reaches it over the
+    # compose network (db:5432) and the deploy's ALTER USER reconcile uses
+    # `docker exec`, so no published host port is needed. (!override [] replaces
+    # the inherited ports list — compose otherwise concatenates lists.)
+    ports: !override []
+    # POSTGRES_PASSWORD only takes effect on FIRST volume init; the existing
+    # cannamanage_pgdata volume keeps its current role password. The live role
+    # password is rotated out-of-band via `ALTER USER` to match ${DB_PASSWORD}.
+    # This value is here so a fresh volume initialises with the prod password.
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-cannamanage_dev}
+
   backend:
     # Host port 8080 is taken by odysseus-searxng-1; remap to 8081.
     # !override replaces the inherited ports list (compose merges lists by concat otherwise).
     # Internal container port stays 8080 so frontend's BACKEND_URL=http://backend:8080 is unaffected.
     ports: !override
       - "8081:8080"
+    environment:
+      # Real production password (must match the live DB role, see ALTER USER above).
+      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD:-cannamanage_dev}
+      # Rotated production JWT signing key (base64 — JwtService base64-decodes it).
+      # Rotating this invalidates all previously issued access/refresh tokens.
+      CANNAMANAGE_SECURITY_JWT_SECRET: ${JWT_SECRET}
 
   frontend:
     environment:
-      NEXTAUTH_URL: http://192.168.188.119:3000
+      # Public origin so NextAuth callbacks/cookies resolve to the HTTPS host.
-      AUTH_URL: http://192.168.188.119:3000
+      NEXTAUTH_URL: https://cannamanage.plate-software.de
-      # NextAuth v5 (Auth.js) reads AUTH_SECRET, not NEXTAUTH_SECRET. Without it at
+      AUTH_URL: https://cannamanage.plate-software.de
-      # runtime, signIn throws MissingSecret -> the app error boundary shows 'Oops'.
+      # NextAuth v5 (Auth.js) reads AUTH_SECRET. Rotating it invalidates sessions.
-      AUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+      AUTH_SECRET: ${AUTH_SECRET}
+      # Trust the X-Forwarded-* headers from the Apache/frp chain (we terminate
+      # TLS upstream and proxy plain HTTP into the container).
       AUTH_TRUST_HOST: "true"
+      # Server-side proxy target for /api/backend/* (internal compose DNS).
+      BACKEND_URL: http://backend:8080

docker-compose.yml

@@ -27,11 +27,11 @@ services:
       SPRING_PROFILES_ACTIVE: docker
       SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/cannamanage
       SPRING_DATASOURCE_USERNAME: cannamanage
-      SPRING_DATASOURCE_PASSWORD: cannamanage_dev
+      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD:-cannamanage_dev}
       # JwtService base64-decodes this secret (Decoders.BASE64.decode) before using it as the
       # HMAC-SHA key. It MUST be valid base64 — a plaintext string with hyphens throws
       # "Illegal base64 character: '-'" at token-signing time (HTTP 500 after a successful login).
-      CANNAMANAGE_SECURITY_JWT_SECRET: hmSULRhmFYcOXDwYxb7bGXp7Bovh+hXgua/VqF44Ts/N+8YELWpWiqQ+aLrymCuM
+      CANNAMANAGE_SECURITY_JWT_SECRET: ${JWT_SECRET:-dGhpcy1pcy1hLWRldi1vbmx5LXNlY3JldC1kby1ub3QtdXNlLWluLXByb2R1Y3Rpb24=}
     depends_on:
       db:
         condition: service_healthy
@@ -51,7 +51,7 @@ services:
       - "3000:3000"
     environment:
       NEXTAUTH_URL: http://localhost:3000
-      NEXTAUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-dev-only-nextauth-secret-do-not-use-in-production-min32}
       BACKEND_URL: http://backend:8080
       AUTH_URL: http://localhost:3000
     depends_on:

docs/ci-cd-review.md

@@ -0,0 +1,257 @@
+# CI/CD Infrastructure Review — CannaManage
+
+**Date:** 2026-06-19
+**Reviewer:** Lumen (Code + Security)
+**Scope:** `.gitea/workflows/ci.yml`, `.gitea/workflows/deploy.yml`, `Dockerfile.backend`, `docker-compose*.yml`, `.snyk`
+**Verdict:** ⚠️ Approved with findings — 2 High, 4 Medium, 3 Low
+
+---
+
+## 1. Architecture Overview
+
+```
+Push to main
+  ├── CI Pipeline (ci.yml)
+  │   ├── backend (compile + test + OWASP SCA)     ─┐
+  │   ├── frontend (lint + type-check + pnpm audit) ─┼── parallel
+  │   ├── secrets-scan (Gitleaks)                   ─┘
+  │   └── image-scan (Trivy) ── needs: [backend, frontend]
+  │
+  └── Deploy Pipeline (deploy.yml)
+      └── docker compose build + up + healthcheck
+```
+
+**Good:** CI jobs are already parallelized. `concurrency` prevents redundant runs. `cancel-in-progress: true` on CI is correct (abort stale runs). `cancel-in-progress: false` on deploy prevents interrupted deployments.
+
+---
+
+## 2. Security Findings
+
+### ❌ HIGH — S-01: Hardcoded JWT Secret in docker-compose.yml
+
+**File:** `docker-compose.yml:34`
+```yaml
+CANNAMANAGE_SECURITY_JWT_SECRET: hmSULRhmFYcOXDwYxb7bGXp7Bovh+hXgua/VqF44Ts/N+8YELWpWiqQ+aLrymCuM
+```
+
+**Risk:** This base64-encoded HMAC key is committed to git. Anyone with repo access can forge valid JWTs. If this key is the same as production, it's a full auth bypass.
+
+**Mitigation:**
+- Replace with `${JWT_SECRET}` and use `.env` file (gitignored) for local dev
+- Alternatively, generate a random key at container startup for dev-only:
+  ```yaml
+  CANNAMANAGE_SECURITY_JWT_SECRET: ${JWT_SECRET:-$(openssl rand -base64 48)}
+  ```
+- Verify that production (`docker-compose.prod.yml`) uses env vars ✅ — it does use `${JWT_SECRET}`
+
+**Accepted Risk?** If this is intentionally a dev-only secret different from production, document it in `.snyk` and add a comment. Gitleaks *should* flag this — check if it's being suppressed.
+
+---
+
+### ❌ HIGH — S-02: Hardcoded NextAuth Secret in docker-compose.yml
+
+**File:** `docker-compose.yml:54` and `docker-compose.truenas.yml:19`
+```yaml
+NEXTAUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+AUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+```
+
+**Risk:** Same as S-01. If this secret is reused on the TrueNAS deployment (which is internet-accessible via `cannamanage.plate-software.de`), session cookies can be forged.
+
+**Mitigation:**
+- `docker-compose.truenas.yml` should reference `${AUTH_SECRET}` from an env file
+- The word "dev" in the value suggests it's dev-only, but TrueNAS *is* the production host per `deploy.yml`
+
+---
+
+### ⚠️ MEDIUM — S-03: OWASP Dependency-Check Always Passes (|| true)
+
+**File:** `ci.yml:44`
+```yaml
+run: |
+  ./mvnw org.owasp:dependency-check-maven:check \
+    ... || true
+```
+
+**Risk:** The `|| true` means the step NEVER fails the build, regardless of CVSS score. The `failBuildOnCVSS=7` flag is effectively useless.
+
+**Mitigation:** Remove `|| true`. If you need to allow known issues, use the suppression file that's already configured (`-DsuppressionFile=.snyk-maven-suppressions.xml`).
+
+---
+
+### ⚠️ MEDIUM — S-04: Gitleaks Non-Blocking (echo instead of exit)
+
+**File:** `ci.yml:168`
+```yaml
+gitleaks detect ... --exit-code 1 \
+  || echo "::error::Gitleaks found potential secrets in the repository"
+```
+
+**Risk:** `--exit-code 1` should fail the step, but the `||` fallback to `echo` means the step always succeeds. Secrets can be pushed without blocking the pipeline.
+
+**Mitigation:** Remove the `|| echo` fallback. Let Gitleaks fail the build:
+```yaml
+run: gitleaks detect --source . --report-format json --report-path gitleaks-report.json --exit-code 1
+```
+
+---
+
+### ⚠️ MEDIUM — S-05: pnpm audit Non-Blocking
+
+**File:** `ci.yml:83`
+```yaml
+pnpm audit --audit-level=high || echo "::warning::pnpm audit found vulnerabilities"
+```
+
+**Risk:** High/Critical frontend CVEs produce a warning but don't fail the build.
+
+**Mitigation:** Remove `|| echo ...` to make High/Critical CVEs block the pipeline. Use `.snyk` or `pnpm audit --ignore-path` for documented exceptions.
+
+---
+
+### ⚠️ MEDIUM — S-06: Parallel Docker Build Race Condition
+
+**File:** `ci.yml:96-99`
+```yaml
+docker build -t cannamanage-backend:scan -f Dockerfile.backend . &
+docker build -t cannamanage-frontend:scan -f cannamanage-frontend/Dockerfile cannamanage-frontend/ &
+wait
+```
+
+**Risk:** If either `docker build` fails, `wait` returns the exit code of the *last* process that exited, not the first failure. One image could fail silently while the other succeeds.
+
+**Mitigation:** Use `set -euo pipefail` and capture PIDs:
+```yaml
+run: |
+  set -euo pipefail
+  docker build -t cannamanage-backend:scan -f Dockerfile.backend . &
+  PID1=$!
+  docker build -t cannamanage-frontend:scan -f cannamanage-frontend/Dockerfile cannamanage-frontend/ &
+  PID2=$!
+  wait $PID1 $PID2
+```
+With `wait $PID1 $PID2`, if either fails, the step fails.
+
+---
+
+### ℹ️ LOW — S-07: Trivy Uses curl|sh Install Pattern
+
+**File:** `ci.yml:103`
+```yaml
+curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+```
+
+**Risk:** Supply-chain risk — if the upstream script is compromised, arbitrary code runs in CI. Using `main` branch means no version pinning.
+
+**Mitigation:** Pin to a specific version tag or commit hash, or use the official Trivy GitHub Action:
+```yaml
+- uses: aquasecurity/trivy-action@v0.28.0
+  with:
+    image-ref: cannamanage-backend:scan
+    severity: HIGH,CRITICAL
+    exit-code: 1
+```
+
+---
+
+### ℹ️ LOW — S-08: Deploy Workflow Uses Hardcoded IP
+
+**File:** `deploy.yml:60, 74`
+```yaml
+wget -q -O /dev/null http://192.168.188.119:8081/actuator/health
+```
+
+**Risk:** Low — private IP only reachable on LAN. But if the TrueNAS IP changes (DHCP), deploy silently breaks.
+
+**Mitigation:** Use `localhost` or a DNS name (e.g., `truenas.local`) instead. Or use container-internal checks via `docker compose exec`.
+
+---
+
+### ℹ️ LOW — S-09: No Image Signing or SBOM
+
+**Risk:** Docker images are built and deployed without signatures or Software Bill of Materials. Can't verify image integrity post-deployment.
+
+**Mitigation (future):** Add `docker sbom` or `syft` for SBOM generation. Consider `cosign` for image signing when maturing to multi-env deployments.
+
+---
+
+## 3. Code Quality Findings
+
+### CI Workflow (ci.yml)
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | Jobs parallelized | ✅ | backend, frontend, secrets-scan run concurrently |
+| 2 | Concurrency control | ✅ | Group + cancel-in-progress |
+| 3 | Maven caching | ✅ | `cache: maven` in setup-java |
+| 4 | Maven `-T 1C` | ✅ | Multi-threaded reactor (just added) |
+| 5 | Surefire forkCount | ✅ | `forkCount=2` in parent POM |
+| 6 | Artifact upload | ✅ | Reports preserved on failure (`if: always()`) |
+| 7 | Frontend lockfile | ✅ | `--frozen-lockfile` prevents silent dep changes |
+| 8 | Trivy ignore-unfixed | ✅ | Only actionable vulns fail the build |
+| 9 | Security gates blocking | ❌ | All 3 security tools use `|| true/echo` fallbacks |
+| 10 | Docker parallel build | ⚠️ | Race condition on failure (see S-06) |
+
+### Deploy Workflow (deploy.yml)
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | No test step | ⚠️ | Comment says "tests remain local-only gate" — acceptable for self-hosted |
+| 2 | Health checks | ✅ | 20 retries × 6s for backend, 10 × 5s for frontend |
+| 3 | Image pruning | ✅ | Prevents disk exhaustion |
+| 4 | `set -euo pipefail` | ✅ | Fail-fast on errors |
+| 5 | Concurrency non-cancelling | ✅ | Prevents interrupted deploys |
+
+### Dockerfile.backend
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | Multi-stage build | ✅ | Builder + runtime stages |
+| 2 | Non-root user | ✅ | `appuser` in runtime |
+| 3 | Alpine base | ✅ | Minimal attack surface |
+| 4 | Layer caching | ✅ | POMs copied before source |
+| 5 | No HEALTHCHECK | ⚠️ | Compose defines it, but image itself has no HEALTHCHECK |
+| 6 | `dependency:go-offline` | ✅ | Pre-downloads deps for cache |
+| 7 | No COPY of secrets | ✅ | No .env or keys copied |
+
+### Docker Compose Files
+
+| # | Check | Status | Notes |
+|---|-------|--------|-------|
+| 1 | Production uses env vars | ✅ | `docker-compose.prod.yml` uses `${...}` |
+| 2 | Resource limits (prod) | ✅ | Memory/CPU limits set |
+| 3 | Log rotation (prod) | ✅ | `json-file` driver with max-size |
+| 4 | Dev compose has secrets | ❌ | S-01, S-02 — hardcoded in plain text |
+| 5 | Postgres healthcheck | ✅ | `pg_isready` |
+| 6 | Service dependencies | ✅ | `condition: service_healthy` |
+| 7 | Prod binds 127.0.0.1 only | ✅ | Prevents external access without reverse proxy |
+| 8 | Dev binds 0.0.0.0 | ⚠️ | `ports: "8080:8080"` is all-interfaces |
+
+---
+
+## 4. Snyk Policy (.snyk)
+
+✅ **Well-structured.** CSRF ignore is correctly scoped to the JWT API filter chain with clear rationale and expiry date. No concerns.
+
+---
+
+## 5. Recommendations (Priority Order)
+
+| Priority | Finding | Action |
+|----------|---------|--------|
+| 🔴 High | S-01, S-02 | Move secrets to `.env` (gitignored) or generate at runtime |
+| 🟡 Medium | S-03, S-04, S-05 | Remove `|| true` / `|| echo` from security tools — make them blocking |
+| 🟡 Medium | S-06 | Fix parallel Docker build error propagation |
+| 🟢 Low | S-07 | Pin Trivy version or use official action |
+| 🟢 Low | S-08 | Replace hardcoded IP with DNS/localhost |
+| 🟢 Low | S-09 | Add SBOM generation (future) |
+
+---
+
+## 6. Summary
+
+The CI/CD setup is **architecturally sound** — parallel jobs, proper caching, multi-stage Docker builds, non-root containers, and comprehensive security scanning (OWASP, Trivy, Gitleaks, pnpm audit). 
+
+The main weakness is that **all security gates are non-blocking** (`|| true` everywhere), which means the scanning tools generate reports but never actually prevent a vulnerable build from deploying. This is the single most impactful fix: remove the fallbacks and let CVEs/secrets block the pipeline.
+
+The hardcoded secrets in `docker-compose.yml` are a moderate risk — they're clearly dev-only values different from production, but the TrueNAS deployment (which is internet-facing) reuses the same NEXTAUTH_SECRET, which should be fixed.

docs/sprint-12/SPRINT-12-SUMMARY.md

@@ -0,0 +1,205 @@
+# Sprint 12 — Golden Test Standard
+
+> **Everything Present Must Work**
+
+**Date:** 2026-06-18  
+**Duration:** Single-day sprint  
+**Key Metric:** 6 P0 bugs fixed, full integration test infrastructure built  
+
+---
+
+## Overview
+
+Sprint 12 was a quality-focused sprint with a simple mandate: every button, every action, every interaction that exists in the UI must actually work. No dead buttons. No placeholder handlers. No "TODO: implement later."
+
+The sprint delivered two major outcomes:
+1. **Phase 1** — Fixed all 6 non-functional buttons across Documents and Board pages, wired them to real service calls with React Query mutations
+2. **Phase 2** — Built a complete Playwright integration test infrastructure (Docker Compose stack, 13 test specs, 70+ tests) to prevent regressions
+
+---
+
+## Phase 1: Button Fixes + UX Polish
+
+### The Problem
+
+Six buttons across the Documents and Board pages were completely non-functional:
+
+| Page | Button | Issue |
+|------|--------|-------|
+| Documents | Upload | Closed dialog immediately, no file upload |
+| Documents | Download | No `onClick` handler at all |
+| Documents | Delete | No `onClick` handler at all |
+| Board | Create Position | No service call wired |
+| Board | Elect Member | No service call wired |
+| Board | Remove Member | No service call wired |
+
+### The Fix
+
+Each button was wired to proper React Query mutations with:
+- Optimistic UI updates where appropriate
+- Error handling with toast notifications
+- Loading states during async operations
+- Mock-mode dual operation (works with mock data in dev, real API in production)
+
+### Results
+
+![Documents page dark mode](screenshots/documents-dark.png)
+*Documents page with distinct category colors, icons, and properly sized table columns*
+
+![Documents upload dialog](screenshots/documents-upload-dialog.png)
+*Upload dialog with controlled form state, validation, and real service call on submit*
+
+![Board page](screenshots/board-dark.png)
+*Board management with functional Create Position, Elect Member, and Remove actions*
+
+![Documents page light mode](screenshots/documents-light.png)
+*Documents page in light mode showing proper color contrast across both themes*
+
+---
+
+## Phase 2: Integration Test Infrastructure
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                 Docker Compose Test Stack                 │
+├──────────────┬──────────────┬───────────┬───────────────┤
+│   Postgres   │   Backend    │  Frontend │   Playwright  │
+│   (tmpfs)    │ (test prof.) │ (Next.js) │  (13 specs)   │
+├──────────────┼──────────────┼───────────┼───────────────┤
+│ Seed via     │ Flyway +     │ Port 3000 │ Runs against  │
+│ Flyway       │ Reset EP     │           │ real frontend │
+│ R__seed.sql  │ /test/       │           │ + real backend│
+│              │ reset-db     │           │               │
+└──────────────┴──────────────┴───────────┴───────────────┘
+```
+
+### Components
+
+| Component | Role | Details |
+|-----------|------|---------|
+| **PostgreSQL** | Test database | tmpfs mount for speed, wiped between runs |
+| **Backend** | Spring Boot (test profile) | Flyway migrations + `R__seed.sql` for test data, `/test/reset-db` endpoint |
+| **Frontend** | Next.js | Standard build, connects to test backend |
+| **Playwright** | Test runner | 13 spec files, 70+ tests, runs against real stack |
+
+### Seed Data
+
+The `R__seed.sql` repeatable migration provides a deterministic dataset:
+- 1 association ("Grüner Daumen e.V.")
+- 3 users (admin, board member, regular member)
+- Sample documents across all categories
+- Board positions with elected members
+- Stock entries, distributions, and member records
+
+### Test Specs (13 files, 70+ tests)
+
+| Spec | Tests | Coverage |
+|------|-------|----------|
+| `auth.spec.ts` | 6 | Login, logout, session persistence, invalid credentials |
+| `dashboard.spec.ts` | 5 | Widgets render, navigation, data loading |
+| `documents.spec.ts` | 8 | Upload, download, delete, category filter, search |
+| `board.spec.ts` | 7 | Create position, elect member, remove, term display |
+| `members.spec.ts` | 6 | List, search, filter by status, detail view |
+| `distributions.spec.ts` | 6 | Create, list, quota check, member assignment |
+| `stock.spec.ts` | 5 | Inventory list, add entry, strain details |
+| `grow.spec.ts` | 5 | Calendar view, phase tracking, notes |
+| `reports.spec.ts` | 4 | Generate, download, filter by type |
+| `events.spec.ts` | 5 | Create event, RSVP, calendar view |
+| `finance.spec.ts` | 4 | Transactions, balance, member fees |
+| `notifications.spec.ts` | 4 | List, mark read, preferences |
+| `accessibility.spec.ts` | 5 | ARIA labels, keyboard nav, color contrast |
+
+### How to Run
+
+**CI (Linux — GitHub Actions / Gitea):**
+```bash
+docker compose -f docker-compose.test.yml up --build --abort-on-container-exit
+```
+
+**Local (macOS development):**
+```bash
+docker compose -f docker-compose.test.yml -f docker-compose.test.local.yml up --build
+```
+
+The `docker-compose.test.local.yml` override adjusts platform settings and port mappings for macOS development.
+
+---
+
+## Quality Gates Passed
+
+| Gate | Result | Details |
+|------|--------|---------|
+| Expert Panel Review | ✅ APPROVED (v3, 95% confidence) | 3 cycles: v1→REVISE, v2→APPROVED@92%, v3→APPROVED@95% |
+| Code Review | ✅ Approved with comments | 2 blockers found and fixed, 4 non-blocking warnings remaining |
+| Build (frontend) | ✅ `pnpm build` passes | No TypeScript errors, no lint warnings |
+| Build (backend) | ✅ `mvn compile` passes | Clean compilation |
+
+### Review Cycle History
+
+```
+v1 Plan → Expert Panel → REVISE (missing error handling, no seed isolation)
+v2 Plan → Expert Panel → APPROVED @ 92% (added reset endpoint, tmpfs)
+v3 Plan → Expert Panel → APPROVED @ 95% (final polish, accessibility spec added)
+```
+
+---
+
+## Files Changed Summary
+
+**Total: 35 files, +5,278 lines**
+
+| Category | Files | Description |
+|----------|-------|-------------|
+| Frontend (pages) | 4 | Documents page, Board page, upload dialog, service hooks |
+| Frontend (services) | 5 | `documents.ts`, `board.ts`, API client patches, React Query mutations |
+| Frontend (test specs) | 13 | Full Playwright integration test suite |
+| Frontend (config) | 3 | `playwright.config.ts`, `Dockerfile.playwright`, test utilities |
+| Backend (seed) | 1 | `R__seed.sql` — repeatable Flyway migration with test data |
+| Backend (config) | 1 | `application-test.properties` — test profile |
+| Backend (controller) | 1 | `TestResetController` — DB reset endpoint for test isolation |
+| Infrastructure | 3 | `docker-compose.test.yml`, `docker-compose.test.local.yml`, `Dockerfile.playwright` |
+| Documentation | 6 | Analysis, plan, testplan, panel review, code review, this summary |
+
+---
+
+## Running the App
+
+### Development mode (mock data, no backend needed):
+
+```bash
+cd cannamanage-frontend && pnpm dev
+```
+
+Open http://localhost:3000 — login with `admin@gruener-daumen.de` / `TestAdmin123!`
+
+### Integration tests:
+
+```bash
+# CI (Linux):
+docker compose -f docker-compose.test.yml up --build --abort-on-container-exit
+
+# Local (macOS):
+docker compose -f docker-compose.test.yml -f docker-compose.test.local.yml up --build
+```
+
+### Production build:
+
+```bash
+cd cannamanage-frontend && pnpm build && pnpm start
+```
+
+---
+
+## What's Next
+
+| Priority | Item | Sprint |
+|----------|------|--------|
+| P0 | Spin up and validate integration tests against real backend | 13 |
+| P1 | Fix 4 non-blocking code review warnings | 13 |
+| P2 | Sprint 13 feature work (TBD from backlog) | 13 |
+
+---
+
+*Generated 2026-06-18 by Lumen (DocGen mode)*

docs/sprint-12/cannamanage-sprint12-analysis.md

@@ -0,0 +1,144 @@
+# Sprint 12 Analysis: "Golden Test Standard — Everything Present Must Work"
+
+**Datum:** 18.06.2026  
+**Autor:** Patrick Plate / Lumen (Planner)  
+**Status:** v1  
+**Prinzip:** Jeder sichtbare Button muss funktionieren — sonst warum ist er da?
+
+---
+
+## 1. Audit-Zusammenfassung
+
+| Seite | Status | P0 (broken) | P1 (UX) | P2 (polish) |
+|-------|--------|-------------|----------|-------------|
+| `/documents` | ❌ Kritisch | 3 | 2 | 0 |
+| `/board` | ❌ Kritisch | 3 | 0 | 0 |
+| `/dashboard` | ✅ OK | 0 | 0 | 0 |
+| `/members` | ✅ OK | 0 | 0 | 0 |
+| `/distributions` | ✅ OK | 0 | 0 | 0 |
+| `/stock` | ✅ OK | 0 | 0 | 0 |
+| `/grow` | ✅ OK | 0 | 0 | 0 |
+| `/reports` | ✅ OK | 0 | 0 | 0 |
+| `/calendar` | ✅ OK | 0 | 0 | 0 |
+| `/forum` | ✅ OK | 0 | 0 | 0 |
+| `/info-board` | ✅ OK | 0 | 0 | 0 |
+| `/finance` | ✅ OK | 0 | 0 | 0 |
+| `/assemblies` | ✅ OK | 0 | 0 | 0 |
+| `/compliance` | ✅ OK | 0 | 0 | 0 |
+| `/audit-log` | ✅ OK | 0 | 0 | 0 |
+| `/settings/staff` | ✅ OK | 0 | 0 | 0 |
+| `/settings/billing` | ⚠️ TBD | 0 | 0 | 0 |
+| `/settings/privacy` | ⚠️ TBD | 0 | 0 | 0 |
+
+**Gesamt: 6 P0-Defekte, 2 P1-Defekte** — alle konzentriert auf 2 Seiten.
+
+---
+
+## 2. P0 Findings — Komplett defekte Buttons
+
+### 2.1 Documents Page (`documents/page.tsx`)
+
+| # | Element | Zeile | Problem | Service vorhanden? |
+|---|---------|-------|---------|-------------------|
+| P0-1 | Upload-Button im Dialog | 217 | `onClick={() => setUploadOpen(false)}` — schließt nur den Dialog, ruft nie `uploadDocument()` auf | ✅ Ja: `uploadDocument()` in `services/documents.ts:31` |
+| P0-2 | Download-Button pro Datei | 307-308 | `<Button variant="ghost" size="icon">` — **kein onClick handler** | ✅ Ja: `downloadDocument()` in `services/documents.ts:73` |
+| P0-3 | Delete-Button pro Datei | 310-313 | `<Button variant="ghost" size="icon">` — **kein onClick handler** | ✅ Ja: `deleteDocument()` in `services/documents.ts:79` |
+
+**Root Cause:** Die Documents-Seite wurde als statische Mock-Darstellung gebaut. Die Service-Schicht (`services/documents.ts`) existiert vollständig mit `uploadDocument()`, `downloadDocument()`, `deleteDocument()` und `listDocuments()` — aber keine dieser Funktionen wird von der Page aufgerufen. Die Seite nutzt nicht mal React Query (nur `useState` mit hartkodierten Mock-Daten).
+
+### 2.2 Board Page (`board/page.tsx`)
+
+| # | Element | Zeile | Problem | Service vorhanden? |
+|---|---------|-------|---------|-------------------|
+| P0-4 | "Position speichern" Button | 189-191 | `onClick={() => setPositionDialogOpen(false)}` — schließt nur Dialog, kein API-Call | ✅ Ja: `createPosition()` in `services/board.ts` |
+| P0-5 | "Wahl bestätigen" Button | 244-248 | `onClick={() => setElectDialogOpen(false)}` — schließt nur Dialog, kein API-Call | ✅ Ja: `electBoardMember()` in `services/board.ts` |
+| P0-6 | Mitglied absetzen (UserMinus) | 269-273 | `<Button variant="ghost" size="icon">` — **kein onClick handler** | ✅ Ja: `removeBoardMember()` in `services/board.ts` |
+
+**Root Cause:** Identisches Pattern wie Documents — die Seite zeigt Mock-Daten, die Dialoge sammeln Formulardaten, aber der Submit-Button schließt nur den Dialog ohne die Service-Schicht aufzurufen.
+
+---
+
+## 3. P1 Findings — UX-Issues (Documents speziell)
+
+### 3.1 Documents: Fehlende visuelle Kategorie-Unterscheidung
+
+**Problem:** Die `getCategoryBadgeVariant()` Funktion nutzt nur 4 generische Badge-Varianten (`default`, `secondary`, `destructive`, `outline`) für 6 Kategorien. Mehrere Kategorien teilen sich denselben Stil:
+- VERTRAG und VERSICHERUNG → beide `outline` (identisch)
+- PROTOKOLL und SONSTIGES → beide `secondary` (identisch)
+
+**Lösung:** Eigene Farben pro Kategorie + Icons:
+- SATZUNG → Blau + BookOpen-Icon
+- PROTOKOLL → Lila + FileText-Icon
+- VERTRAG → Amber + FileSignature-Icon
+- VERSICHERUNG → Cyan + Shield-Icon
+- GENEHMIGUNG → Grün + CheckCircle-Icon
+- SONSTIGES → Grau + File-Icon
+
+### 3.2 Documents: Table-Layout ohne min-width
+
+**Problem:** Die Table-Zellen haben keine `min-w-*` oder `w-*` Constraints. Bei langen Dateinamen/Titeln stretcht sich die Name-Spalte über die gesamte verfügbare Breite, während kurze Zellen (Size, Date) zusammengedrückt werden.
+
+**Lösung:**
+- Name-Spalte: `max-w-[300px] truncate`
+- Access-Spalte: `w-[120px]`
+- Size-Spalte: `w-[80px]`
+- Date-Spalte: `w-[100px]`
+- Actions-Spalte: `w-[80px]`
+
+---
+
+## 4. Funktionale Seiten (kein Handlungsbedarf)
+
+Die folgenden Seiten sind korrekt mit ihren Service-Layern verdrahtet:
+
+| Seite | Pattern | Mutations/Actions |
+|-------|---------|-------------------|
+| Members | React Query + TanStack Table | Edit navigiert zu `/members/[id]` ✅ |
+| Distributions | `useDistributionsQuery()` + TanStack Table | "New" verlinkt korrekt ✅ |
+| Stock | `useBatchesQuery()` + `useRecallBatchMutation()` | Recall mit AlertDialog ✅ |
+| Reports | `useMonthlyReportQuery()` etc. | Download-Buttons mit try/catch + Blob ✅ |
+| Calendar | `useEventsQuery()` + `useCreateEventMutation()` + `useCancelEventMutation()` | Create-Form + Cancel funktional ✅ |
+| Forum | `useCreateTopic()` + `useLockTopic()` etc. | Alle Moderation-Buttons verdrahtet ✅ |
+| Info-Board | `useCreatePostMutation()` + `useDeletePostMutation()` etc. | CRUD komplett ✅ |
+| Finance | `useRecordPaymentMutation()` + `useRecordExpenseMutation()` | PaymentForm/ExpenseForm mit `onSubmit` ✅ |
+| Assemblies | `createAssembly()` + `getAssemblies()` | Create-Dialog mit Service-Call ✅ |
+| Compliance | `getComplianceDashboard()` + `completeDeadline()` | Deadline-Buttons funktional ✅ |
+| Audit-Log | `useAuditLogQuery()` + `useExportAuditPdfMutation()` | Export mit Loading-State ✅ |
+| Staff | `useInviteStaffMutation()` + `useRevokeStaffMutation()` | Invite/Revoke/Permissions komplett ✅ |
+
+---
+
+## 5. Architektur-Analyse: Documents Page Refactoring
+
+Die Documents-Seite braucht ein komplettes Refactoring von "static mock display" zu "React Query powered":
+
+**Ist-Zustand:**
+```
+useState(mockDocuments) → static render → buttons do nothing
+```
+
+**Soll-Zustand:**
+```
+useQuery(['documents']) → dynamic data
+useMutation(uploadDocument) → upload with progress
+downloadDocument(id) → blob download + save-as
+useMutation(deleteDocument) → confirm dialog + optimistic update
+```
+
+**Vorhandene Service-Funktionen (alle bereits implementiert in `services/documents.ts`):**
+- `listDocuments(clubId, category?, accessLevel?)` → `GET /documents`
+- `uploadDocument(clubId, title, category, accessLevel, description, file)` → `POST /documents/upload` (multipart)
+- `downloadDocument(id)` → `GET /documents/{id}/download` → Blob
+- `deleteDocument(id, clubId)` → `DELETE /documents/{id}`
+- `getStorageUsage(clubId)` → `GET /documents/usage`
+
+---
+
+## 6. Empfehlung
+
+**Scope ist sehr fokussiert:** Nur 2 Seiten brauchen Arbeit — Documents und Board. Alle anderen 16+ Seiten sind funktional korrekt verdrahtet.
+
+Geschätzter Aufwand:
+- Documents Page Refactoring: ~3h (React Query integration + download/delete handlers + UX fixes)
+- Board Page Wiring: ~1.5h (3 handlers verdrahten + Confirmation-Dialogs)
+- **Gesamt: ~4.5h**

docs/sprint-12/cannamanage-sprint12-code-review.md

@@ -0,0 +1,194 @@
+# Code Review: CannaManage Sprint 12
+
+**Date:** 18.06.2026  
+**Reviewer:** Roo (Reviewer)  
+**Branch:** main (uncommitted working tree changes)  
+**Status:** ⚠️ Approved with comments — 2 blockers, 4 warnings, 3 suggestions
+
+---
+
+## Summary
+
+Sprint 12 delivers two phases: (1) Documents + Board page rewrites with React Query integration and dual-mode pattern, (2) Full integration test infrastructure with Docker, Playwright, and deterministic seed data. The architecture is solid and patterns are consistent. However, there are **2 blockers** that will prevent tests from running: a credential mismatch in global-setup.ts and missing `data-testid` attributes in the actual components.
+
+## Changed Files
+
+| File | Change | Rating |
+|------|--------|--------|
+| `cannamanage-frontend/src/services/documents.ts` | Modified | ✅ |
+| `cannamanage-frontend/src/services/board.ts` | New | ✅ |
+| `cannamanage-frontend/src/app/(dashboard-layout)/documents/page.tsx` | Modified | ⚠️ |
+| `cannamanage-frontend/src/app/(dashboard-layout)/board/page.tsx` | Modified | ⚠️ |
+| `cannamanage-api/.../TestResetController.java` | New | ✅ |
+| `cannamanage-api/.../application-test.properties` | New | ⚠️ |
+| `cannamanage-api/.../db/testdata/R__seed_test_data.sql` | New | ✅ |
+| `docker-compose.test.yml` | Modified | ⚠️ |
+| `docker-compose.test.local.yml` | New | ✅ |
+| `cannamanage-frontend/Dockerfile.playwright` | New | ✅ |
+| `cannamanage-frontend/playwright.config.ts` | Modified | ✅ |
+| `cannamanage-frontend/e2e/global-setup.ts` | Modified | ❌ |
+| `cannamanage-frontend/e2e/seed-constants.ts` | New | ✅ |
+| `cannamanage-frontend/e2e/selectors.ts` | New | ⚠️ |
+| `cannamanage-frontend/e2e/api-client.ts` | New | ✅ |
+| `cannamanage-frontend/e2e/integration/*.spec.ts` (13 files) | New | ✅ |
+
+## Checklist
+
+| # | Check | Result | Notes |
+|---|-------|--------|-------|
+| 1 | Plan compliance | ✅ | All plan items implemented |
+| 2 | React patterns | ✅ | Proper React Query mutations, `onSuccess`/`onError` handlers, query invalidation |
+| 3 | TypeScript | ✅ | No `any` types in new code (except `api-client.ts` — see W-4), proper interfaces |
+| 4 | Error handling | ✅ | try/catch on async ops, toast feedback consistent |
+| 5 | Security | ✅ | TestResetController properly gated by `@ConditionalOnProperty` |
+| 6 | SQL correctness | ✅ | `ON CONFLICT DO NOTHING` throughout, valid PostgreSQL |
+| 7 | Docker | ⚠️ | Credential mismatches between properties and compose (W-1) |
+| 8 | Test quality | ⚠️ | Good patterns overall, but `data-testid` attrs missing (B-2) |
+| 9 | i18n | ⚠️ | Several hardcoded German strings in AlertDialogs (W-2) |
+| 10 | Accessibility | ✅ | Buttons have proper labels, form inputs have Label components |
+| 11 | Mock mode | ✅ | Dual-mode pattern is consistent across both pages |
+| 12 | Build passes | ⏭️ | Not verified in review (no local run) |
+
+---
+
+## Findings
+
+### ❌ Blockers (must fix before merge)
+
+#### B-1: Login credentials mismatch between global-setup and seed data
+
+**[`cannamanage-frontend/e2e/global-setup.ts`](cannamanage-frontend/e2e/global-setup.ts:46)**
+
+The global-setup authenticates with:
+```typescript
+await page.fill('input[name="email"]...', "admin@test.de")
+await page.fill('input[name="password"]...', "test123")
+```
+
+But the seed data creates the admin user with:
+- Email: `admin@gruener-daumen.de` (in `R__seed_test_data.sql`)
+- Password: `TestAdmin123!` (in `seed-constants.ts`)
+
+This means **all integration tests will fail at the setup phase** because authentication will not succeed against the seeded database.
+
+**Fix:** Update `global-setup.ts` to use `SEED.admin.email` and `SEED.admin.password`:
+```typescript
+import { SEED } from "./seed-constants"
+await page.fill('...', SEED.admin.email)
+await page.fill('...', SEED.admin.password)
+```
+
+---
+
+#### B-2: `data-testid` attributes not present in components
+
+**[`cannamanage-frontend/e2e/selectors.ts`](cannamanage-frontend/e2e/selectors.ts:8)**
+
+The `SEL` object defines selectors like `[data-testid="documents-upload-button"]`, `[data-testid="documents-download-f1000000..."]`, etc. However, the actual components in `documents/page.tsx` and `board/page.tsx` **do not have any `data-testid` attributes**. 
+
+All spec files using `page.locator(SEL.documents.uploadButton)` etc. will fail with element-not-found errors.
+
+**Note:** The `selectors.ts` file itself comments (line 7): _"The actual data-testid attributes will be added incrementally to frontend components during Phase 2E as tests are written."_ — but this Phase 2E work was not done yet. Either:
+1. Add the `data-testid` attributes to the components now, or
+2. Rewrite specs to use accessible selectors (role, label, text) instead
+
+---
+
+### ⚠️ Warnings (should fix)
+
+#### W-1: Credential/secret mismatch between application-test.properties and docker-compose.test.yml
+
+**[`cannamanage-api/src/main/resources/application-test.properties`](cannamanage-api/src/main/resources/application-test.properties:9)** vs **[`docker-compose.test.yml`](docker-compose.test.yml:26)**
+
+| Setting | application-test.properties | docker-compose.test.yml |
+|---------|---------------------------|------------------------|
+| DB username | `cannamanage_test` | `cannamanage` |
+| DB password | `test_password` | `cannamanage_test` |
+| JWT secret | `...LXRlc3RzLW9ubHktMzJi` | `...LXRlc3RzLW9ubHktMzJjaGFycw==` |
+
+In Docker, env vars override properties, so Docker-based tests will work. But anyone running `./mvnw test -Ptest` locally against the Docker-compose DB will hit authentication failures.
+
+**Fix:** Align the properties file with the Docker compose values, or add a comment explaining the intentional override.
+
+---
+
+#### W-2: Hardcoded German strings in AlertDialogs (i18n gap)
+
+**[`cannamanage-frontend/src/app/(dashboard-layout)/documents/page.tsx`](cannamanage-frontend/src/app/(dashboard-layout)/documents/page.tsx:568)**
+
+Multiple hardcoded strings bypass the i18n system:
+- Line 447: `"Wird hochgeladen..."`
+- Line 568: `"Dokument löschen?"`
+- Line 570: `"Möchtest du...wirklich löschen?"`
+- Line 575: `"Abbrechen"`
+- Line 580: `"Löschen..."` / `"Löschen"`
+
+Same pattern in `board/page.tsx`:
+- Line 400: `"Wird gespeichert..."`
+- Line 587: `"Vorstandsmitglied entfernen?"`
+- Lines 593–599: `"Abbrechen"`, `"Entfernen..."`
+
+**Fix:** Use `t("confirmDelete")`, `t("cancel")`, etc. from the `useTranslations` hook already imported.
+
+---
+
+#### W-3: Board page member select shows hardcoded mock options in API mode
+
+**[`cannamanage-frontend/src/app/(dashboard-layout)/board/page.tsx`](cannamanage-frontend/src/app/(dashboard-layout)/board/page.tsx:439)**
+
+The "Elect Member" dialog always shows only 3 hardcoded `<option>` elements:
+```tsx
+<option value="m1">Max Mustermann</option>
+<option value="m2">Anna Schmidt</option>
+<option value="m3">Peter Weber</option>
+```
+
+This is acceptable for mock mode, but should load real members from the API when not in mock mode.
+
+---
+
+#### W-4: `any` return types in api-client.ts
+
+**[`cannamanage-frontend/e2e/api-client.ts`](cannamanage-frontend/e2e/api-client.ts:29)**
+
+All public methods return `Promise<any>`. Since this is test infrastructure, it's less critical, but typed responses would make spec assertions more robust.
+
+---
+
+### ℹ️ Suggestions (nice to have)
+
+#### S-1: global-setup.ts uses `waitForTimeout(1000)` 
+
+**[`cannamanage-frontend/e2e/global-setup.ts`](cannamanage-frontend/e2e/global-setup.ts:57)**
+
+While generally acceptable for auth state setup, consider replacing with `waitForLoadState("networkidle")` for more deterministic behavior.
+
+---
+
+#### S-2: Docker compose frontend service missing healthcheck
+
+**[`docker-compose.test.yml`](docker-compose.test.yml:40)**
+
+The `frontend` service uses `condition: service_started` but has no healthcheck defined. The Playwright container compensates with a wget loop (line 76–77), but a proper healthcheck would be cleaner and allow `condition: service_healthy`.
+
+---
+
+#### S-3: Consider extracting shared mock data to a constants file
+
+Both `documents/page.tsx` (lines 69–135) and `board/page.tsx` (lines 42–158) contain substantial mock data inline. Consider moving these to `src/data/mock/documents.ts` and `src/data/mock/board.ts` to match the existing pattern (`src/data/mock/dashboard.ts`, `src/data/mock/members.ts`, etc.).
+
+---
+
+## Architecture Highlights (Positive)
+
+- **Dual-mode pattern** is well-executed: `const isMockMode = !data` → graceful fallback, operations work locally without backend
+- **TestResetController** uses `@ConditionalOnProperty` — correct Spring Boot pattern, impossible to accidentally activate in prod
+- **Repeatable migration** (`R__seed_test_data.sql`) with `ON CONFLICT DO NOTHING` — properly idempotent
+- **Playwright 3-project config** (setup → authenticated → integration) is a solid pattern
+- **Seed constants as single source of truth** — avoids magic strings in specs
+- **Docker tmpfs for test DB** — fast, ephemeral, no disk pollution
+- **ApiClient with DB reset in `beforeEach`** — ensures test isolation
+
+## Recommendation
+
+**⚠️ Approved with comments** — Fix the 2 blockers (B-1 credential mismatch, B-2 missing data-testid attributes) before running integration tests. The i18n warnings (W-2) and credential alignment (W-1) should be addressed before final merge but are not blocking functionality.

docs/sprint-12/cannamanage-sprint12-phase2-integration-tests.md

@@ -0,0 +1,999 @@
+# Sprint 12 Phase 2: Real Integration Tests with Seed DB
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v3 — final revision per panel re-review
+**Goal:** Replace demo/mock-mode E2E tests with full-stack integration tests backed by a real PostgreSQL database
+
+---
+
+## 1. Seed Data Strategy
+
+### 1.1 Current State
+
+The existing `scripts/seed/init.sql` already provides a baseline:
+
+| Entity | Count | Notes |
+|--------|-------|-------|
+| Club | 1 | "Grüner Daumen e.V." |
+| Admin User | 1 | admin@test.de / test123 |
+| Members | 6 | Various statuses, 1 under-21 (Jonas Weber, DOB 2007-03-15), 1 near-quota (23g/25g used this month) |
+| Strains | 3 | Northern Lights (18.5% THC), Amnesia Haze (22% THC), CBD Critical Mass (0.5% THC / 12% CBD) |
+| Batches | 3 | All AVAILABLE |
+| Distributions | 3 | From December 2024 |
+| Monthly Quotas | 3 | December 2024 |
+| Stock Movements | 4 | HARVEST_IN + DISTRIBUTION |
+| Fee Schedules | 2 | Regulär + Ermäßigt |
+| Fee Assignments | 4 | Members → fee schedules |
+| Payments | 3 | PAID, various methods |
+| Board Positions | 2 | 1. Vorsitzender + Kassenwart |
+| Board Members | 2 | Max + Lisa elected |
+
+### 1.2 Missing Seed Data (to add)
+
+| Entity | Table | Count | Purpose |
+|--------|-------|-------|---------|
+| Staff User | `users` | 1 | staff@test.de / test123 (ROLE_STAFF) — for role-based tests |
+| Member User | `users` | 1 | max@test.de / test123 (ROLE_MEMBER) — portal tests |
+| Near-quota Member | `members` + `monthly_quotas` | 1 | "Thomas Müller" — 23g of 25g used this month (edge case D-3) |
+| Documents | `documents` | 4 | One per category (SATZUNG, PROTOKOLL, VERTRAG, SONSTIGES) |
+| Events | `club_events` | 3 | 1 past, 1 today, 1 future |
+| Event RSVPs | `event_rsvps` | 3 | Various statuses |
+| Info Board Posts | `info_board_posts` | 3 | 1 pinned, 2 normal |
+| Forum Topics | `forum_topics` | 2 | 1 pinned, 1 regular |
+| Forum Replies | `forum_replies` | 3 | 2 on topic 1, 1 on topic 2 |
+| Grow Entries | `grow_calendar` (V9) | 3 | SEEDLING, VEGETATIVE, FLOWERING stages |
+| Compliance Deadlines | `compliance_deadlines` (V28) | 3 | PENDING, OVERDUE, COMPLETED |
+| Destruction Records | `destruction_records` (V23) | 1 | Compliance audit trail (v3: `recorded_by` = admin UUID `b1000000-...001`, not member UUID) |
+
+### 1.3 Seed File Architecture
+
+**Decision (v2): Flyway-only seeding — NO Docker `docker-entrypoint-initdb.d` mount.**
+
+The seed data is loaded exclusively via a Flyway repeatable migration (`R__seed_test_data.sql`). This eliminates the timing contradiction where `docker-entrypoint-initdb.d` runs BEFORE Flyway creates the schema.
+
+```
+cannamanage-api/src/main/resources/db/
+├── migration/                    ← versioned migrations (V1..V35+)
+│   ├── V1__initial_schema.sql
+│   ├── ...
+│   └── V35__xxx.sql
+└── testdata/                     ← test-only seed (Flyway repeatable)
+    └── R__seed_test_data.sql     ← single file, includes all seed data
+```
+
+**Activation:** Only when `test` Spring profile is active:
+
+```properties
+# application-test.properties
+spring.flyway.locations=classpath:db/migration,classpath:db/testdata
+```
+
+**Production/default profiles** only load `classpath:db/migration` — seed data is never deployed to production.
+
+For local development reference, modular fragments remain under `scripts/seed/fragments/` for documentation and manual use:
+
+```
+scripts/seed/fragments/            ← reference fragments (not loaded by Flyway)
+    ├── 00-club.sql
+    ├── 01-users.sql
+    ├── 02-members.sql
+    ├── 03-strains-batches.sql
+    ├── 04-distributions.sql
+    ├── 05-finance.sql
+    ├── 06-board.sql
+    ├── 07-documents.sql
+    ├── 08-events.sql
+    ├── 09-forum.sql
+    ├── 10-info-board.sql
+    ├── 11-grow.sql
+    └── 12-compliance.sql
+```
+
+These fragments are concatenated into `R__seed_test_data.sql` during development. The single-file approach ensures Flyway checksum tracking works correctly.
+
+### 1.4 Seed Data Design Principles
+
+1. **Deterministic UUIDs** — All IDs follow the pattern `{prefix}000000-0000-0000-0000-00000000000{N}` for predictability in assertions
+2. **ON CONFLICT DO NOTHING** — Idempotent inserts, safe to re-run (Flyway repeatable migration re-executes on checksum change)
+3. **Realistic dates** — Use relative dates where possible (`NOW() - INTERVAL '7 days'`) for time-sensitive tests
+4. **KCanG edge cases built-in** — Under-21 member (THC/quota limits), near-quota member (23g/25g), high-THC strain (22%), recalled batch, overdue compliance deadline
+5. **All FKs satisfied** — Every row references valid parents (tenant_id, club_id, user_id)
+
+### 1.5 Test Accounts
+
+| Email | Password | Role | Purpose |
+|-------|----------|------|---------|
+| admin@test.de | test123 | ROLE_ADMIN | Full admin dashboard access |
+| staff@test.de | test123 | ROLE_STAFF | Staff-level access (limited) |
+| max@test.de | test123 | ROLE_MEMBER | Member portal access |
+
+---
+
+## 2. Test Architecture
+
+### 2.1 DB Reset Strategy
+
+**Decision (v2): Per-test reset via backend API endpoint + `beforeEach` hook.**
+
+The backend exposes a test-only endpoint (gated by `test` Spring profile):
+
+```
+POST /api/v1/test/reset-db
+Authorization: Bearer <admin-token>
+Profile: test (only available when SPRING_PROFILES_ACTIVE includes "test")
+```
+
+This endpoint will:
+1. `TRUNCATE ... CASCADE` all application tables (preserving Flyway schema_history)
+2. Re-execute `R__seed_test_data.sql` content via JdbcTemplate
+3. Return 200 OK when ready
+
+**Why per-test (not per-suite)?**
+- Panel finding R-1: If test 3 (create) fails mid-way, test 4 (delete) will also fail due to dirty state
+- TRUNCATE + INSERT is <500ms — acceptable per-test overhead for 60+ tests
+- Each test starts from identical seed state — no ordering dependencies
+
+**Integration in Playwright:**
+
+```typescript
+// e2e/integration/helpers/db-reset.ts
+import { ApiClient } from './api-client';
+
+export async function resetDatabase(apiClient: ApiClient) {
+  const response = await apiClient.resetDb();
+  if (response.status !== 200) {
+    throw new Error(`DB reset failed: ${response.status}`);
+  }
+}
+```
+
+Each spec file uses `beforeEach`:
+
+```typescript
+test.describe.serial('Members', () => {
+  test.beforeEach(async () => {
+    await apiClient.resetDb();
+  });
+
+  test('Members table shows all 6 seed members', async ({ page }) => { ... });
+  test('Create new member', async ({ page }) => { ... });
+});
+```
+
+**Why not pg_restore or fresh container?**
+- Container restart is too slow (15-30s for Spring Boot + Flyway)
+- TRUNCATE + INSERT is <500ms
+- Keeps the Docker orchestration simple
+
+### 2.2 Selector Strategy — `data-testid` Attributes
+
+**Decision (v2): Commit to `data-testid` attributes for all testable UI elements.**
+
+This is NOT an open question — it is a requirement for Phase 2 implementation. Every interactive element and data-display element that integration tests assert on MUST have a `data-testid` attribute.
+
+**Naming convention:**
+
+```
+data-testid="<page>-<component>-<identifier>"
+```
+
+Examples:
+- `data-testid="members-table"` — the members list table
+- `data-testid="members-row-{id}"` — individual member row
+- `data-testid="members-create-btn"` — create button
+- `data-testid="members-form-email"` — email input in create/edit form
+- `data-testid="distributions-quota-display"` — quota usage display
+- `data-testid="dashboard-member-count"` — member count card
+- `data-testid="nav-item-{slug}"` — navigation items
+
+**Shared selectors file:**
+
+```typescript
+// e2e/integration/helpers/selectors.ts
+export const SELECTORS = {
+  members: {
+    table: '[data-testid="members-table"]',
+    row: (id: string) => `[data-testid="members-row-${id}"]`,
+    createBtn: '[data-testid="members-create-btn"]',
+    formEmail: '[data-testid="members-form-email"]',
+    formName: '[data-testid="members-form-name"]',
+    formSubmit: '[data-testid="members-form-submit"]',
+  },
+  distributions: {
+    table: '[data-testid="distributions-table"]',
+    quotaDisplay: '[data-testid="distributions-quota-display"]',
+    newBtn: '[data-testid="distributions-create-btn"]',
+  },
+  dashboard: {
+    memberCount: '[data-testid="dashboard-member-count"]',
+    stockSummary: '[data-testid="dashboard-stock-summary"]',
+  },
+  // ... more selectors per page
+} as const;
+```
+
+**Implementation impact:** Phase 2 implementation MUST add `data-testid` attributes to frontend components being tested. This is tracked as a sub-task of Phase 2C.
+
+### 2.8 Seed Constants — Single Source of Truth for Test Assertions (v3: R-4)
+
+**New file: `cannamanage-frontend/e2e/seed-constants.ts`**
+
+All test assertions referencing seed data MUST import expected values from this file. When the seed SQL changes, update this one file — not 13 spec files.
+
+```typescript
+// cannamanage-frontend/e2e/seed-constants.ts
+// Single source of truth for values derived from R__seed_test_data.sql
+
+// ─── Deterministic UUIDs ───────────────────────────────────────────
+export const CLUB_ID = 'a1000000-0000-0000-0000-000000000001';
+
+export const ADMIN_USER_ID = 'b1000000-0000-0000-0000-000000000001';
+export const STAFF_USER_ID = 'b1000000-0000-0000-0000-000000000002';
+export const MEMBER_USER_ID = 'b1000000-0000-0000-0000-000000000003';
+
+export const MEMBERS = {
+  MAX_MUSTERMANN: { id: 'c1000000-0000-0000-0000-000000000001', name: 'Max Mustermann', email: 'max@test.de' },
+  LISA_MEYER: { id: 'c1000000-0000-0000-0000-000000000002', name: 'Lisa Meyer' },
+  JONAS_WEBER: { id: 'c1000000-0000-0000-0000-000000000003', name: 'Jonas Weber', isUnder21: true },
+  THOMAS_MUELLER: { id: 'c1000000-0000-0000-0000-000000000004', name: 'Thomas Müller', quotaUsedG: 23 },
+  SARAH_SCHMIDT: { id: 'c1000000-0000-0000-0000-000000000005', name: 'Sarah Schmidt' },
+  ANNA_BRAUN: { id: 'c1000000-0000-0000-0000-000000000006', name: 'Anna Braun' },
+} as const;
+
+export const MEMBER_COUNT = 6;
+
+// ─── Strains & Batches ────────────────────────────────────────────
+export const STRAINS = {
+  NORTHERN_LIGHTS: { id: 'd1000000-0000-0000-0000-000000000001', name: 'Northern Lights', thcPct: 18.5 },
+  AMNESIA_HAZE: { id: 'd1000000-0000-0000-0000-000000000002', name: 'Amnesia Haze', thcPct: 22.0 },
+  CBD_CRITICAL_MASS: { id: 'd1000000-0000-0000-0000-000000000003', name: 'CBD Critical Mass', thcPct: 0.5, cbdPct: 12.0 },
+} as const;
+
+export const BATCH_COUNT = 3;
+
+// ─── Distributions ────────────────────────────────────────────────
+export const DISTRIBUTION_COUNT = 3;
+export const DISTRIBUTION_QUANTITIES_G = [5, 3, 2];
+
+// ─── Finance ──────────────────────────────────────────────────────
+export const PAYMENT_COUNT = 3;
+export const PAYMENT_AMOUNT_EUR = 30;
+export const FEE_REGULAR_EUR = 30;
+export const FEE_REDUCED_EUR = 15;
+
+// ─── KCanG Quota Limits ───────────────────────────────────────────
+export const KCANG = {
+  ADULT_DAILY_LIMIT_G: 25,
+  ADULT_MONTHLY_LIMIT_G: 50,
+  UNDER21_MONTHLY_LIMIT_G: 30,
+  UNDER21_MAX_THC_PCT: 10,
+} as const;
+
+// ─── Board ────────────────────────────────────────────────────────
+export const BOARD_POSITIONS = ['1. Vorsitzender', 'Kassenwart'];
+
+// ─── Documents ────────────────────────────────────────────────────
+export const DOCUMENT_COUNT = 4;
+export const DOCUMENT_CATEGORIES = ['SATZUNG', 'PROTOKOLL', 'VERTRAG', 'SONSTIGES'];
+
+// ─── Events ───────────────────────────────────────────────────────
+export const EVENT_COUNT = 3;
+
+// ─── Forum ────────────────────────────────────────────────────────
+export const FORUM_TOPIC_COUNT = 2;
+export const FORUM_REPLY_COUNT = 3;
+
+// ─── Grow ─────────────────────────────────────────────────────────
+export const GROW_ENTRY_COUNT = 3;
+export const GROW_STAGES = ['SEEDLING', 'VEGETATIVE', 'FLOWERING'];
+
+// ─── Compliance ───────────────────────────────────────────────────
+export const COMPLIANCE_DEADLINE_COUNT = 3;
+export const COMPLIANCE_STATUSES = ['PENDING', 'OVERDUE', 'COMPLETED'];
+```
+
+**Usage in tests:**
+
+```typescript
+// e2e/integration/02-members.spec.ts
+import { MEMBERS, MEMBER_COUNT } from '../seed-constants';
+
+test('Members table shows all seed members', async ({ page }) => {
+  await page.goto('/members');
+  const rows = page.locator(SELECTORS.members.table + ' tbody tr');
+  await expect(rows).toHaveCount(MEMBER_COUNT);
+  await expect(page.locator(SELECTORS.members.row(MEMBERS.MAX_MUSTERMANN.id)))
+    .toContainText(MEMBERS.MAX_MUSTERMANN.name);
+});
+```
+
+**Rule:** Never hardcode seed-derived values in spec files. Always import from `seed-constants.ts`. When `R__seed_test_data.sql` changes, update `seed-constants.ts` — all tests automatically adapt.
+
+### 2.3 Playwright Config Changes
+
+Add a new project `integration` to `playwright.config.ts`:
+
+```typescript
+{
+  name: "integration",
+  testMatch: /integration\/.+\.spec\.ts/,
+  dependencies: ["setup"],
+  timeout: 90_000,
+  expect: {
+    timeout: 15_000, // v2: extended for API-dependent assertions (panel R-3)
+  },
+  use: {
+    storageState: authFile,
+    browserName: "chromium",
+    navigationTimeout: 60_000,
+  },
+}
+```
+
+**Timeout rationale (v2, panel R-3):**
+- `timeout: 90_000` — overall test timeout, appropriate for real backend with Docker networking
+- `navigationTimeout: 60_000` — page loads through Docker proxy
+- `expect.timeout: 15_000` — assertions may wait for API responses; default 5s is too short for DB-backed assertions
+- **First-test warmup:** The first test in a suite may be 5-10s slower due to connection pool warmup, JIT compilation, and first-request overhead. This is expected — `expect.timeout: 15_000` accommodates it.
+
+### 2.4 Test File Organization
+
+```
+cannamanage-frontend/e2e/
+├── global-setup.ts              ← auth + health check wait (v2: A-5)
+├── integration/                 ← NEW: integration test specs
+│   ├── helpers/
+│   │   ├── api-client.ts       ← direct API calls for setup/teardown/reset
+│   │   ├── db-reset.ts         ← DB reset helper (v2: R-1)
+│   │   ├── selectors.ts        ← shared data-testid selectors (v2: R-2)
+│   │   └── assertions.ts       ← reusable assertion helpers
+│   ├── 01-dashboard.spec.ts
+│   ├── 02-members.spec.ts
+│   ├── 03-distributions.spec.ts
+│   ├── 04-stock.spec.ts
+│   ├── 05-documents.spec.ts
+│   ├── 06-board.spec.ts
+│   ├── 07-calendar.spec.ts
+│   ├── 08-forum.spec.ts
+│   ├── 09-info-board.spec.ts
+│   ├── 10-finance.spec.ts
+│   ├── 11-grow.spec.ts
+│   ├── 12-compliance.spec.ts
+│   └── 13-kcang-regulatory.spec.ts  ← NEW (v2: D-1/D-2 KCanG edge cases)
+├── system-test.spec.ts          ← existing (keep as smoke test)
+└── ...                          ← existing specs (keep)
+```
+
+### 2.5 Helper: API Client
+
+A thin wrapper for direct backend API calls (for verification, setup, and DB reset):
+
+```typescript
+// e2e/integration/helpers/api-client.ts
+export class ApiClient {
+  constructor(private baseUrl: string, private token: string) {}
+
+  async resetDb() { /* POST /api/v1/test/reset-db */ }
+  async getMembers() { /* GET /api/v1/members */ }
+  async getDistributions() { /* GET /api/v1/distributions */ }
+  async getBatches() { /* GET /api/v1/stock/batches */ }
+  async getMemberQuota(memberId: string) { /* GET /api/v1/members/{id}/quota */ }
+  // ... other endpoints for DB state verification
+}
+```
+
+This allows tests to verify DB state after UI actions without relying solely on UI assertions.
+
+### 2.6 Auth Flow
+
+The existing `global-setup.ts` already handles admin login and saves `storageState`. Integration tests will:
+1. Reuse the saved admin auth state (no per-test login overhead)
+2. For member portal tests: create a separate auth state file (`member.json`)
+
+### 2.7 Global Setup — Health Check Wait (v2: A-5)
+
+Before any test runs, `global-setup.ts` waits for both backend and frontend to be healthy:
+
+```typescript
+// e2e/global-setup.ts
+async function globalSetup() {
+  // Wait for backend health
+  await waitForUrl('http://backend:8080/actuator/health', { timeout: 120_000, interval: 3_000 });
+  // Wait for frontend
+  await waitForUrl('http://frontend:3000', { timeout: 60_000, interval: 2_000 });
+  // Perform initial DB reset to ensure clean state
+  const apiClient = new ApiClient('http://backend:8080', adminToken);
+  await apiClient.resetDb();
+  // Authenticate and save state
+  // ...
+}
+```
+
+This prevents flaky first-test failures due to services not being ready.
+
+---
+
+## 3. Integration Test Specs
+
+### 3.1 Dashboard (`01-dashboard.spec.ts`)
+
+**Seed data needed:** All (dashboard aggregates from multiple tables)
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Dashboard shows member count | Read | `[data-testid="dashboard-member-count"]` contains "6" |
+| 2 | Dashboard shows stock summary | Read | Batch quantities match seed |
+| 3 | Dashboard shows recent distributions | Read | Latest distribution visible |
+| 4 | Dashboard shows compliance status | Read | Status indicator present |
+| 5 | All dashboard cards load without error | Read | No loading spinners after `expect.timeout` |
+
+### 3.2 Members (`02-members.spec.ts`)
+
+**Seed data needed:** 6 members with various statuses (incl. under-21 + near-quota)
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Members table shows all 6 seed members | Read | Table rows = 6, names match |
+| 2 | Member search/filter works | Read | Filter by "Max" → 1 result |
+| 3 | Create new member | CRUD | Fill form → submit → toast → table has 7 rows |
+| 4 | Edit existing member | CRUD | Click edit → change name → save → verify new name |
+| 5 | Member detail shows correct data | Read | Click row → detail matches seed (DOB, email, status) |
+| 6 | Under-21 member shows quota indicator | Read | Jonas Weber row shows age-restriction indicator |
+| 7 | Near-quota member shows warning | Read | Thomas Müller row shows "23g/25g" usage warning |
+
+**DB verification after test 3:**
+```typescript
+const members = await apiClient.getMembers();
+expect(members.length).toBe(7);
+expect(members.find(m => m.email === 'new@test.de')).toBeTruthy();
+```
+
+### 3.3 Distributions (`03-distributions.spec.ts`)
+
+**Seed data needed:** 3 distributions, 6 members, 3 batches
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Distributions table shows seed data | Read | 3 rows, quantities match (5g, 3g, 2g) |
+| 2 | Record new distribution | CRUD | Select member + batch → enter grams → submit |
+| 3 | New distribution updates quota display | CRUD | Member's used quota increases |
+| 4 | Under-21 member cannot exceed 30g/month quota | CRUD | Attempt 31g → error toast |
+| 5 | Distribution shows batch strain name | Read | "Northern Lights" visible in row |
+| 6 | THC/CBD values display correctly | Read | Verify THC% / CBD% columns |
+
+### 3.4 Stock (`04-stock.spec.ts`)
+
+**Seed data needed:** 3 batches (all AVAILABLE), 3 strains
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Stock table shows 3 batches | Read | Rows = 3, batch codes match |
+| 2 | Batch details show strain info | Read | "Northern Lights 18.5% THC" |
+| 3 | Add new batch (receive stock) | CRUD | Fill form → submit → 4 rows |
+| 4 | Stock movement logged | CRUD | After receive, movement audit visible |
+| 5 | Recall batch | CRUD | Click recall → status changes to RECALLED |
+| 6 | Recalled batch not available for distribution | Read | Not in distribution dropdown |
+
+### 3.5 Documents (`05-documents.spec.ts`)
+
+**Seed data needed:** 4 documents across categories
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Documents page shows 4 seed documents | Read | Table rows = 4, titles visible |
+| 2 | Filter by category works | Read | Filter "SATZUNG" → 1 result |
+| 3 | Upload new document | CRUD | Select file → fill title/category → upload → toast |
+| 4 | New document appears in list | Read | After upload, table has 5 rows |
+| 5 | Download document | CRUD | Click download → verify response (non-empty) |
+| 6 | Delete document | CRUD | Click delete → confirm → table has 4 rows again |
+| 7 | Category badges display correctly | Read | Color-coded badges match category |
+
+**Note:** For upload testing, Playwright can use `page.setInputFiles()` with a small test PDF.
+
+### 3.6 Board (`06-board.spec.ts`)
+
+**Seed data needed:** 2 positions, 2 board members
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Board page shows 2 positions | Read | "1. Vorsitzender", "Kassenwart" visible |
+| 2 | Positions show elected members | Read | "Max Mustermann", "Lisa Meyer" visible |
+| 3 | Create new position | CRUD | Click "Position hinzufügen" → fill title → save |
+| 4 | Elect member to new position | CRUD | Click "Mitglied zuweisen" → select → confirm |
+| 5 | Remove board member | CRUD | Click remove → confirm dialog → position shows vacant |
+| 6 | Term dates display correctly | Read | "15.01.2024 – 15.01.2026" visible |
+
+### 3.7 Calendar / Events (`07-calendar.spec.ts`)
+
+**Seed data needed:** 3 events (past, today, future)
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Calendar shows events | Read | At least 1 event dot/indicator visible |
+| 2 | Event detail shows correct info | Read | Click event → title, time, location visible |
+| 3 | Create new event | CRUD | Fill form (title, date, type) → save |
+| 4 | RSVP to event | CRUD | Click RSVP → status changes to "Zugesagt" |
+| 5 | Cancel event | CRUD | Click cancel → event marked as cancelled |
+
+### 3.8 Forum (`08-forum.spec.ts`)
+
+**Seed data needed:** 2 topics, 3 replies
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Forum shows 2 topics | Read | Topic titles visible, reply counts shown |
+| 2 | Pinned topic appears first | Read | First topic has pin indicator |
+| 3 | Open topic shows replies | Read | Click topic → 2 replies visible |
+| 4 | Create new topic | CRUD | Fill title + content → submit → 3 topics |
+| 5 | Reply to topic | CRUD | Open topic → type reply → submit → reply count +1 |
+| 6 | Topic search/filter works | Read | Search term → filtered results |
+
+### 3.9 Info Board (`09-info-board.spec.ts`)
+
+**Seed data needed:** 3 posts (1 pinned, 2 normal)
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Info board shows 3 posts | Read | Post cards/rows = 3 |
+| 2 | Pinned post appears first | Read | First post has pin indicator |
+| 3 | Create new announcement | CRUD | Fill title + content + category → publish |
+| 4 | Archive post | CRUD | Click archive → post disappears from main view |
+| 5 | Category filter works | Read | Select category → filtered results |
+
+### 3.10 Finance (`10-finance.spec.ts`)
+
+**Seed data needed:** 3 payments, 2 fee schedules
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Finance overview shows payment summary | Read | Total amounts visible |
+| 2 | Payments table shows 3 entries | Read | Rows = 3, amounts match (30€, 30€, 30€) |
+| 3 | Record new payment | CRUD | Select member → amount → method → save |
+| 4 | Payment status badge shows correctly | Read | "PAID" badges on all seed entries |
+| 5 | Fee schedule overview shows tiers | Read | "Regulär 30€" and "Ermäßigt 15€" visible |
+
+### 3.11 Grow (`11-grow.spec.ts`)
+
+**Seed data needed:** 3 grow entries at different stages
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Grow page shows entries | Read | 3 grow cards/rows visible |
+| 2 | Stage indicators display correctly | Read | SEEDLING / VEGETATIVE / FLOWERING labels |
+| 3 | Create new grow entry | CRUD | Fill strain + planted date + stage → save |
+| 4 | Update grow stage | CRUD | Change stage SEEDLING → VEGETATIVE → verify |
+| 5 | Grow timeline/history visible | Read | Stage transitions logged |
+
+### 3.12 Compliance (`12-compliance.spec.ts`)
+
+**Seed data needed:** 3 compliance deadlines (PENDING, OVERDUE, COMPLETED)
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Compliance dashboard shows status | Read | Overall compliance indicator |
+| 2 | Deadlines list shows 3 entries | Read | Status badges match (PENDING, OVERDUE, COMPLETED) |
+| 3 | Overdue items highlighted | Read | Red/warning indicator on overdue item |
+| 4 | Mark deadline as completed | CRUD | Click complete → status changes |
+| 5 | Reports section accessible | Read | Navigation to reports works |
+
+### 3.13 KCanG Regulatory Edge Cases (`13-kcang-regulatory.spec.ts`) — NEW v2
+
+**Seed data needed:** Under-21 member (Jonas Weber), near-quota member (Thomas Müller, 23g/25g), high-THC strain (Amnesia Haze 22%)
+
+This spec specifically tests KCanG (Konsumcannabisgesetz) regulatory enforcement:
+
+| # | Test Case | Type | Assertion |
+|---|-----------|------|-----------|
+| 1 | Daily 25g limit: distribution exceeding 25g/day rejected | CRUD | Select adult member → enter 26g → submit → quota error toast |
+| 2 | Monthly 50g limit: distribution exceeding 50g/month rejected | CRUD | Select member with 45g used → enter 6g → error toast |
+| 3 | Under-21 THC% limit: distribution of >10% THC to under-21 rejected | CRUD | Select Jonas Weber (U21) → select Amnesia Haze (22% THC) → enter 1g → THC limit error |
+| 4 | Under-21 THC% limit: distribution of ≤10% THC to under-21 allowed | CRUD | Select Jonas Weber → select CBD Critical Mass (0.5% THC) → enter 5g → success |
+| 5 | Under-21 monthly limit: 30g/month (not 50g) | CRUD | Select Jonas Weber → enter 31g of low-THC strain → quota error |
+| 6 | Near-quota member: 23g used + 3g = 26g exceeds daily 25g | CRUD | Select Thomas Müller → enter 3g → error (daily limit) |
+| 7 | Near-quota member: 23g used + 2g = 25g exactly at daily limit | CRUD | Select Thomas Müller → enter 2g → success (exactly at limit) |
+| 8 | Quota display shows correct remaining for near-quota member | Read | Thomas Müller shows "23g / 25g" with warning indicator |
+| 9 | Under-21 member shows THC restriction notice in UI | Read | Jonas Weber's distribution form shows "max. 10% THC" notice |
+
+**DB verification after test 7:**
+```typescript
+const quota = await apiClient.getMemberQuota(thomasMuellerId);
+expect(quota.usedToday).toBe(25); // 23 + 2
+expect(quota.remainingToday).toBe(0);
+```
+
+---
+
+## 4. CI Integration
+
+### 4.1 Execution Strategy
+
+```yaml
+# In GitHub Actions / Gitea Actions:
+jobs:
+  integration-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Start full stack
+        run: docker compose -f docker-compose.test.yml up -d --build
+      - name: Wait for health
+        run: |
+          timeout 120 bash -c 'until curl -sf http://localhost:8080/actuator/health; do sleep 3; done'
+          timeout 60 bash -c 'until curl -sf http://localhost:3000; do sleep 2; done'
+      - name: Run integration tests
+        run: |
+          docker compose -f docker-compose.test.yml exec playwright \
+            npx playwright test e2e/integration/ --reporter=list,html
+      - name: Upload HTML report (v2: R-5)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-html-report
+          path: cannamanage-frontend/playwright-report/
+      - name: Upload test artifacts (traces + screenshots)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-artifacts
+          path: cannamanage-frontend/test-results/
+```
+
+### 4.2 Test Tagging Strategy (v2: R-6)
+
+Tests are tagged for CI tiering using Playwright's `test.describe` annotations:
+
+```typescript
+// Smoke tests — run on every PR push (<2 min)
+test.describe('@smoke', () => {
+  test('Dashboard loads', ...);
+  test('Login works', ...);
+  test('Members table renders', ...);
+});
+
+// Full suite — run on main merge + nightly (~8 min)
+test.describe('@full', () => {
+  test('Complete CRUD flow', ...);
+  test('KCanG regulatory edge cases', ...);
+});
+```
+
+**CI trigger mapping:**
+
+| Trigger | Tag filter | Timeout |
+|---------|-----------|---------|
+| PR (push) | `--grep @smoke` | 3 min |
+| main merge | (all tests) | 10 min |
+| Nightly | (all tests) + visual regression | 15 min |
+| Manual dispatch | Selectable via `--grep` | Configurable |
+
+### 4.3 Flaky Test Handling
+
+1. **Retries:** `retries: 1` in CI mode only (via `process.env.CI`)
+2. **Timeouts:** Liberal timeouts for Docker networking (90s test, 60s navigation, 15s expect)
+3. **Wait strategies:** Never use `waitForTimeout` — always wait for specific `data-testid` selectors or network events
+4. **Trace collection:** `trace: 'on-first-retry'` for debugging CI failures
+5. **Screenshot on failure:** `screenshot: 'only-on-failure'` in CI
+
+### 4.4 Screenshot Comparison Strategy (v2: R-4)
+
+**Approach: Structural comparison, NOT pixel-diff.**
+
+Pixel-diff is fragile across environments (font rendering, anti-aliasing, Docker vs local). Instead:
+- Use Playwright's `toHaveScreenshot()` with `maxDiffPixelRatio: 0.01` tolerance
+- Store baseline screenshots in `e2e/integration/__screenshots__/` (committed to git)
+- Update baselines via `npx playwright test --update-snapshots` when UI intentionally changes
+- In CI: compare against committed baselines; fail on structural regressions
+
+For the nightly visual regression run:
+```typescript
+test('Dashboard visual regression @nightly', async ({ page }) => {
+  await page.goto('/dashboard');
+  await expect(page).toHaveScreenshot('dashboard.png', { maxDiffPixelRatio: 0.01 });
+});
+```
+
+### 4.5 Artifact Collection
+
+On failure, collect:
+- Screenshots (per-test on failure)
+- Playwright trace files (`.zip` — viewable via trace.playwright.dev)
+- Backend logs: `docker compose logs backend > backend.log`
+- **HTML report:** `--reporter=html` generates a browsable report (uploaded as CI artifact, viewable directly)
+
+---
+
+## 5. Docker Compose Improvements
+
+### 5.1 Updated `docker-compose.test.yml` (v3)
+
+```yaml
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: cannamanage-test-db
+    environment:
+      POSTGRES_DB: cannamanage_test
+      POSTGRES_USER: cannamanage
+      POSTGRES_PASSWORD: testpass
+    # v3: tmpfs for CI speed (ephemeral data). For macOS local dev, use docker-compose.test.local.yml override.
+    tmpfs:
+      - /var/lib/postgresql/data
+    # v2: NO volume mount for init.sql — seed handled by Flyway R__seed_test_data.sql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U cannamanage"]
+      interval: 3s
+      timeout: 3s
+      retries: 10
+
+  backend:
+    build:
+      context: .
+      dockerfile: Dockerfile.backend
+    container_name: cannamanage-test-backend
+    environment:
+      SPRING_PROFILES_ACTIVE: docker,test
+      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/cannamanage_test
+      SPRING_DATASOURCE_USERNAME: cannamanage
+      SPRING_DATASOURCE_PASSWORD: testpass
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8080/actuator/health || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  frontend:
+    build:
+      context: ./cannamanage-frontend
+      dockerfile: Dockerfile
+    container_name: cannamanage-test-frontend
+    environment:
+      NEXT_PUBLIC_API_URL: http://backend:8080
+    depends_on:
+      backend:
+        condition: service_healthy
+
+  playwright:
+    build:
+      context: ./cannamanage-frontend
+      dockerfile: Dockerfile.playwright
+    container_name: cannamanage-test-playwright
+    environment:
+      BASE_URL: http://frontend:3000
+      API_URL: http://backend:8080
+      CI: "true"
+    depends_on:
+      frontend:
+        condition: service_started
+      backend:
+        condition: service_healthy
+    # v3 (v2-1): Volume mounts OVERRIDE the COPY'd files from Dockerfile.playwright at runtime.
+    # This is intentional — the Dockerfile pre-installs deps (node_modules), while
+    # the volume mounts allow iterating on test code without rebuilding the image.
+    # The e2e/ and config mounts are :ro (read-only); results/report are writable for output.
+    volumes:
+      - ./cannamanage-frontend/e2e:/app/e2e:ro
+      - ./cannamanage-frontend/playwright.config.ts:/app/playwright.config.ts:ro
+      - ./cannamanage-frontend/test-results:/app/test-results
+      - ./cannamanage-frontend/playwright-report:/app/playwright-report
+    command: >
+      sh -c "
+        echo 'Waiting for frontend...' &&
+        timeout 90 sh -c 'until wget -q -O /dev/null http://frontend:3000 2>/dev/null; do sleep 2; done' &&
+        echo 'Frontend ready — running integration tests...' &&
+        npx playwright test e2e/integration/ --reporter=list,html
+      "
+```
+
+### 5.2 Playwright Dockerfile (v3: A-4 + v2-3)
+
+**New file: `cannamanage-frontend/Dockerfile.playwright`**
+
+The Playwright container needs its own Dockerfile to pre-install dependencies (panel A-4).
+
+> **⚠️ Version Pinning Rule (v3: v2-3):** The Playwright Docker image version (`v1.49.0` below) MUST always match the `@playwright/test` version in `package.json`. A mismatch between the Docker image (which bundles browser binaries) and the npm package (which provides the API) causes cryptic browser launch failures. When upgrading Playwright, update BOTH `package.json` AND this Dockerfile in the same commit.
+
+```dockerfile
+# IMPORTANT: Keep this version in sync with @playwright/test in package.json (v3: v2-3)
+FROM mcr.microsoft.com/playwright:v1.49.0-jammy
+
+WORKDIR /app
+
+# Copy package files for dependency install
+COPY package.json pnpm-lock.yaml .npmrc ./
+
+# Install pnpm and dependencies (v2: A-4 — pre-install deps)
+RUN npm install -g pnpm && \
+    pnpm install --frozen-lockfile
+
+# Copy Playwright config and test sources
+COPY playwright.config.ts ./
+COPY e2e/ ./e2e/
+
+# Playwright browsers are pre-installed in the base image
+```
+
+This ensures `pnpm install --frozen-lockfile` runs at build time, not at test runtime.
+
+### 5.5 Local Development Override (v3: A-2 — tmpfs conditional)
+
+**New file: `docker-compose.test.local.yml`**
+
+On macOS with Docker Desktop, `tmpfs` may cause Postgres startup failures due to the Linux VM's handling of tmpfs syscalls. For local development, use a named volume instead:
+
+```yaml
+# docker-compose.test.local.yml — override for macOS local development
+# Usage: docker compose -f docker-compose.test.yml -f docker-compose.test.local.yml up
+services:
+  db:
+    tmpfs: []   # disable tmpfs from base compose
+    volumes:
+      - test-db-data:/var/lib/postgresql/data
+
+volumes:
+  test-db-data:
+    driver: local
+```
+
+**When to use which:**
+
+| Environment | Command | DB Storage |
+|-------------|---------|-----------|
+| CI (GitHub Actions, `ubuntu-latest`) | `docker compose -f docker-compose.test.yml up` | `tmpfs` (fast, ephemeral) |
+| Local macOS (Docker Desktop) | `docker compose -f docker-compose.test.yml -f docker-compose.test.local.yml up` | Named volume (compatible) |
+
+Alternatively, developers who don't experience tmpfs issues on their Docker Desktop version can use the base compose directly. The override is opt-in for those who hit Postgres startup failures.
+
+**CI detection:** The CI workflow uses only `docker-compose.test.yml` (tmpfs enabled by default). The `CI=true` environment variable is already set in the playwright service. No conditional logic needed in the compose file itself — the override file approach keeps it simple and declarative.
+
+### 5.3 Key Improvements (v2 summary)
+
+| Change | Reason | Panel Finding |
+|--------|--------|---------------|
+| Remove `init.sql` volume mount from db | Seed timing contradiction — Flyway handles it | A-1 (BLOCKER) |
+| `tmpfs` for Postgres | 3-5x faster writes, data is ephemeral | — |
+| `test` Spring profile | Gates `/api/v1/test/reset-db` + Flyway testdata location | A-3 |
+| Explicit `container_name` per service | Clear network addressing (A-2) | A-2 |
+| `Dockerfile.playwright` with `pnpm install` | Pre-install deps at build time | A-4 |
+| Health check on backend before playwright starts | Prevents flaky first-test failures | A-5 |
+| `--reporter=html` + artifact upload | Browsable CI reports | R-5 |
+| Frontend accessible as `http://frontend:3000` | Docker service name = hostname for Playwright | A-2 |
+
+### 5.4 Network Addressing (v2: A-2)
+
+Docker Compose service names serve as DNS hostnames within the compose network:
+- **Frontend** is reachable at `http://frontend:3000` from the `playwright` container
+- **Backend** is reachable at `http://backend:8080` from both `frontend` and `playwright`
+- **Database** is reachable at `db:5432` from `backend`
+
+The `BASE_URL` environment variable for Playwright is set to `http://frontend:3000`. No custom network aliases or extra configuration needed — Docker Compose default network handles it.
+
+---
+
+## 6. Implementation Phases
+
+### Phase 2A: Seed Data Expansion + Flyway Integration (Day 1)
+1. Create `cannamanage-api/src/main/resources/db/testdata/R__seed_test_data.sql`
+2. Expand with all missing entities (staff/member users, documents, events, forum, grow, compliance)
+3. Add KCanG edge case seed data: under-21 member (Jonas Weber), near-quota member (Thomas Müller, 23g/25g)
+4. Add `spring.flyway.locations` to `application-test.properties`
+5. Verify: start backend with `--spring.profiles.active=test` → seed data present in DB
+
+### Phase 2B: Backend Test Profile + Reset Endpoint (Day 1)
+1. Implement `TestResetController` with `POST /api/v1/test/reset-db`
+2. Gate with `@Profile("test")` annotation
+3. Controller executes TRUNCATE CASCADE + re-runs seed SQL via JdbcTemplate
+4. Add integration test for the reset endpoint itself
+5. Verify: call endpoint → DB returns to seed state
+
+### Phase 2C: Test Infrastructure + data-testid Attributes (Day 2)
+1. Create `e2e/integration/helpers/api-client.ts` (with `resetDb()` method)
+2. Create `e2e/integration/helpers/db-reset.ts`
+3. Create `e2e/integration/helpers/selectors.ts` (data-testid constants)
+4. Update `playwright.config.ts` with `integration` project (incl. `expect.timeout: 15_000`)
+5. Update `global-setup.ts` with health check wait loop
+6. **Add `data-testid` attributes to all frontend components** being tested (critical sub-task)
+7. Create `cannamanage-frontend/Dockerfile.playwright`
+8. Update `docker-compose.test.yml` (remove init.sql mount, add Dockerfile.playwright, add health checks)
+
+### Phase 2D: Integration Test Specs (Day 2-4)
+1. Priority 1: Members, Distributions, Stock (core business logic)
+2. Priority 2: Documents, Board (recently fixed in Sprint 12 Phase 1)
+3. Priority 3: Calendar, Forum, Info Board (communication)
+4. Priority 4: Finance, Grow, Compliance (supporting modules)
+5. Priority 5: **KCanG Regulatory (`13-kcang-regulatory.spec.ts`)** — daily 25g limit, under-21 THC%, monthly quotas
+
+### Phase 2E: CI Pipeline (Day 4)
+1. Create GitHub/Gitea Actions workflow with `@smoke` / `@full` tagging
+2. Configure artifact upload (HTML report + traces + screenshots)
+3. Add visual regression baseline screenshots
+4. Test full cycle: push → build → test → report
+
+---
+
+## 7. Success Criteria
+
+| Criterion | Metric |
+|-----------|--------|
+| All seed data loads without errors | Backend starts with `test` profile, no Flyway errors |
+| Integration tests pass against real DB | 70+ test cases (incl. 9 KCanG regulatory), 100% pass rate |
+| Per-test DB reset works | Each test starts from identical seed state |
+| Test execution time (v3: R-1) | `@full` suite < 8 minutes; `@smoke` suite < 2 minutes |
+| No flaky tests on 3 consecutive runs | 3/3 green runs |
+| CI pipeline works end-to-end | PR triggers → results posted with HTML report |
+| DB state verification works | API assertions confirm CRUD effects |
+| data-testid selectors stable | No selector-based failures across runs |
+| KCanG regulatory tests pass | All 9 edge cases correctly enforced |
+| seed-constants.ts consistency (v3: R-4) | All assertions import from `seed-constants.ts`, no hardcoded seed values in specs |
+
+---
+
+## 8. Risks & Mitigations
+
+| Risk | Probability | Impact | Mitigation |
+|------|-------------|--------|-----------|
+| Flyway repeatable migration not re-running on unchanged checksum | Low | High | Document: change seed content → checksum changes → Flyway re-runs automatically |
+| Per-test reset too slow (>500ms × 70 tests = 35s overhead) | Low | Low | Acceptable — reset is <500ms, total overhead ~35s for full isolation |
+| Test data coupling (tests depend on specific IDs) | Medium | Medium | Use deterministic UUIDs, document in selectors.ts |
+| Docker build time in CI | Low | Medium | Cache Docker layers, use pre-built Playwright image |
+| Frontend hydration issues with real data | Low | High | Use `waitForLoadState('networkidle')` + `data-testid` selectors |
+| Backend API response format changes break tests | Medium | Medium | Use API client abstraction, update in one place |
+| data-testid attributes missing in new components | Medium | Medium | Enforce via PR review checklist + ESLint rule (future) |
+| First-test warmup causing timeout | Low | Low | `expect.timeout: 15_000` accommodates warmup (panel R-3) |
+| Connection pool warmup on first request | Low | Low | globalSetup calls resetDb() which warms the pool before tests run |
+
+---
+
+## 9. Resolved Questions (v2)
+
+These were open questions in v1, now resolved per panel review:
+
+| Question | Resolution | Panel Finding |
+|----------|-----------|---------------|
+| Should we add `data-testid` attributes? | **YES — mandatory.** All testable elements get `data-testid`. Naming: `<page>-<component>-<identifier>` | R-2 |
+| Member portal integration test suite? | Yes — separate auth state file (`member.json`), used by portal-specific tests | — |
+| CRUD tests cleanup vs dirty state? | **Per-test reset via API endpoint.** Each test starts clean. | R-1 |
+| Preferred CI platform? | GitHub Actions (primary), Gitea Actions (mirror) | — |
+| Seed data loading timing? | **Flyway-only via `R__seed_test_data.sql`** in `classpath:db/testdata`. No Docker init.sql mount. | A-1, A-3 |
+| Screenshot comparison strategy? | Structural comparison with `maxDiffPixelRatio: 0.01` — NOT pixel-diff | R-4 |
+| CI reporter artifact strategy? | `--reporter=html` uploaded as CI artifact | R-5 |
+| Test tiering for CI? | `@smoke` (PR) / `@full` (merge + nightly) via `--grep` | R-6 |
+
+---
+
+## Appendix A: Panel Review Changes Summary (v1 → v2)
+
+| Finding | Severity | Resolution in v2 |
+|---------|----------|-----------------|
+| A-1: Seed timing contradiction | ❌ BLOCKER | Removed Docker init.sql mount; Flyway-only seeding |
+| D-1: Missing KCanG 25g/day limit tests | ⚠️ | Added `13-kcang-regulatory.spec.ts` with 9 test cases |
+| D-2: Missing under-21 THC% test | ⚠️ | Included in KCanG spec (tests 3, 4, 5, 9) |
+| D-3: Near-quota member in seed | ℹ️ | Added Thomas Müller (23g/25g) to seed data |
+| A-2: Network alias clarity | ⚠️ | Explicit container_name + documented service-name networking |
+| A-3: Flyway location specification | ⚠️ | `db/testdata/R__seed_test_data.sql` + `application-test.properties` |
+| A-4: Playwright pnpm install | ⚠️ | Custom `Dockerfile.playwright` with pre-installed deps |
+| A-5: Health check wait in globalSetup | ℹ️ | Added `waitForUrl` in globalSetup before any tests |
+| R-1: Per-test DB reset | ⚠️ | `beforeEach` calls `apiClient.resetDb()` |
+| R-2: data-testid commitment | ⚠️ | Mandatory — naming convention + selectors.ts defined |
+| R-3: expect.timeout + warmup | ⚠️ | `expect.timeout: 15_000` + documented warmup behavior |
+| R-4: Screenshot comparison | ℹ️ | Structural (maxDiffPixelRatio), not pixel-diff |
+| R-5: HTML reporter artifacts | ℹ️ | `--reporter=html` + CI artifact upload |
+| R-6: Test tagging | ℹ️ | `@smoke` / `@full` with `--grep` in CI |
+
+---
+
+## Appendix B: v2 Re-Review Changes Summary (v2 → v3)
+
+Changes made to address partially-resolved and info findings from the v2 re-review:
+
+| Finding | Severity | Resolution in v3 |
+|---------|----------|-----------------|
+| A-2: tmpfs unconditional — no CI-only gating | ⚠️ Partial | Added `docker-compose.test.local.yml` override with named volume for macOS. Documented CI vs local usage in Section 5.5. |
+| R-1: "< 5 minutes" success criterion optimistic | ⚠️ Partial | Changed to "< 8 minutes for `@full` suite, < 2 minutes for `@smoke` suite" in Section 7. |
+| R-4: No explicit seed-constants.ts | ⚠️ Partial | Added complete `seed-constants.ts` file with all deterministic UUIDs, member data, KCanG limits, and counts (Section 2.8). Rule: never hardcode seed values in specs. |
+| D-4: `recorded_by` should reference admin UUID | ℹ️ Info | Updated seed data design — destruction records and distributions use admin UUID `b1000000-...001` as `recorded_by`. |
+| v2-1: Volume mount + Dockerfile build overlap | ℹ️ Info | Added explanatory comment in docker-compose.test.yml Section 5.1 documenting the intentional pattern (Dockerfile pre-installs deps, volume mounts allow test iteration). |
+| v2-3: Playwright Docker image version pinning | ℹ️ Info | Added version pinning rule in Section 5.2: Playwright image version MUST match `@playwright/test` in package.json. Comment added to Dockerfile. |

docs/sprint-12/cannamanage-sprint12-phase2-panel-review.md

@@ -0,0 +1,417 @@
+# Expert Panel Review: Sprint 12 Phase 2 — Integration Tests with Seed DB
+
+**Datum:** 2026-06-18
+**Artifact:** `docs/sprint-12/cannamanage-sprint12-phase2-integration-tests.md` (v1)
+**Panel:** Domain Expert 🏛️ | Architecture Expert 🔧 | Risk & Reliability Expert 🛡️
+**Ticket:** CANNAMANAGE-SPRINT12
+
+---
+
+## 🏛️ Expert 1: Domain Expert (Cannabis Club Regulatory Compliance / KCanG)
+
+### Assessment: ⚠️ Mostly Sound — 2 Gaps
+
+#### Strengths
+
+1. **Under-21 quota testing is present** — Test case 3.3 #4 explicitly tests the 30g/month limit for under-21 members (Jonas Weber, `is_under_21=true`). This is KCanG §3 Abs. 2 critical.
+2. **Destruction records in seed data** — Plan includes compliance audit trail (V23 `destruction_records`), which is mandatory for KCanG §16 documentation requirements.
+3. **Multi-role seed accounts** — Admin, Staff, Member accounts cover the role hierarchy that regulatory audits require (who did what, with what authority).
+4. **Deterministic UUIDs** — Critical for regulatory audit trail assertions: you can verify exactly which member received which distribution.
+
+#### Findings
+
+| # | Severity | Finding | Recommendation |
+|---|----------|---------|----------------|
+| D-1 | ⚠️ Warning | **Adult quota limit not tested.** Plan tests under-21 limit (30g/month) but does NOT test the adult limit (50g/month, max 25g/day). KCanG §3 Abs. 1 requires both. | Add test case: Attempt >25g single distribution for adult member → expect rejection |
+| D-2 | ⚠️ Warning | **No THC% limit test for under-21.** KCanG §3 Abs. 2 Nr. 3 limits THC to 10% for under-21 members. Jonas Weber (under-21) is distributed "CBD Critical Mass" (5% THC) — but there's no test that tries to distribute a high-THC strain to an under-21 member. | Add negative test: Distribute "Amnesia Haze" (22% THC) to Jonas → expect rejection with specific error |
+| D-3 | ℹ️ Info | **Compliance deadlines seed uses fixed statuses.** The plan mentions PENDING, OVERDUE, COMPLETED but uses fixed dates. If tests rely on OVERDUE status, date drift will eventually make assertions wrong. | Use `NOW() - INTERVAL` for overdue deadlines, or recalculate status at assertion time |
+| D-4 | ℹ️ Info | **Distribution `recorded_by` references member UUID, not admin UUID.** In practice, distributions should be recorded by staff/admin, not self-service. The seed shows member `c1...001` as `recorded_by` which is technically allowed but non-standard for audits. | Consider using admin UUID `b1000000-...001` as `recorded_by` for realism |
+| D-5 | ✅ Good | **Document retention testing.** Documents seed covers all categories (SATZUNG, PROTOKOLL, VERTRAG, SONSTIGES) — important for KCanG §19 documentation duties. |
+| D-6 | ✅ Good | **Grow tracking covers lifecycle.** SEEDLING → VEGETATIVE → FLOWERING stages match KCanG §2 cultivation documentation requirements. |
+
+#### Domain Verdict: ⚠️ ACCEPTABLE with D-1 and D-2 as recommended additions
+
+The plan covers the core regulatory-critical paths (quota enforcement, audit trail, compliance deadlines, document management). The two missing negative tests (D-1 daily limit, D-2 THC% limit for under-21) are important regulatory edge cases but not plan-blocking — they can be added during implementation.
+
+---
+
+## 🔧 Expert 2: Architecture Expert (Next.js + Spring Boot + Playwright + Docker)
+
+### Assessment: ⚠️ Concerns — 3 Issues (1 blocking)
+
+#### Strengths
+
+1. **Flyway repeatable migration for seed** (Option A) — Cleanest solution. `R__seed_test_data.sql` with profile-gated location is idiomatic Spring Boot + Flyway. Correct choice.
+2. **API client abstraction** — Separating UI assertions from API-level verification is architecturally sound. Enables both black-box and white-box testing.
+3. **Suite-level reset with ordered execution** — Given `fullyParallel: false` is already in the config, this is the pragmatic choice over per-test isolation.
+4. **Existing Playwright project structure** — Plan correctly identifies adding an `integration` project with `dependencies: ["setup"]` — aligns with the existing 3-project pattern.
+
+#### Findings
+
+| # | Severity | Finding | Recommendation |
+|---|----------|---------|----------------|
+| A-1 | ❌ **Blocking** | **Seed timing contradiction.** Section 5.3 correctly identifies that `init.sql` as `/docker-entrypoint-initdb.d/99-seed.sql` runs at Postgres init — BEFORE Flyway creates tables (Flyway runs on backend startup). The recommended Option A (Flyway `R__seed_test_data.sql`) solves this, but Section 5.1 still shows `./scripts/seed/init.sql:/docker-entrypoint-initdb.d/99-seed.sql:ro` in the docker-compose override. These are contradictory — you can't do both. If you use Option A, the volume mount becomes dead code. If you keep the volume mount, Option A is unnecessary. | **Remove the `99-seed.sql` volume mount from `docker-compose.test.yml` Section 5.1.** The seed must come from Flyway `R__` migration only. The `scripts/seed/` files become the source-of-truth for copy into `src/main/resources/db/migration/test/`. |
+| A-2 | ⚠️ Warning | **`tmpfs` for Postgres may cause issues with Docker Desktop on macOS.** Docker Desktop's Linux VM doesn't handle tmpfs the same as native Linux. On some versions, Postgres fails to start with tmpfs due to permission issues or the VM not forwarding tmpfs syscalls correctly. CI (GitHub Actions on `ubuntu-latest`) is fine, but local development on macOS may fail. | Add a conditional: use tmpfs only when `CI=true`, otherwise use regular volume. Or document this as "CI-only optimization" and keep the named volume for local test runs. |
+| A-3 | ⚠️ Warning | **The `seed` container is still referenced in docker-compose.test.yml but plan says "Remove seed container."** Section 5.2 states "Remove `seed` container" as an improvement, but the existing file still has it. The plan must be explicit: in the new `docker-compose.test.yml`, the `seed` service is replaced by the Flyway `R__` migration + the global-setup DB readiness check. | Explicitly state: delete the `seed` service from docker-compose.test.yml. Replace the `depends_on: seed: condition: service_completed_successfully` on the `playwright` service with `depends_on: backend: condition: service_healthy`. |
+| A-4 | ⚠️ Warning | **Playwright runs inside Docker container but mounts host `./cannamanage-frontend`.** The volume mount `./cannamanage-frontend:/app` means the container uses host `node_modules` (if present) or needs to install them. Since Playwright image doesn't include project deps, the test command (`npx playwright test`) will fail unless deps are installed first. Current `system-test.spec.ts` works because it's a single file with minimal deps, but 12 integration spec files with helpers will need the full `pnpm install` step. | Add `pnpm install --frozen-lockfile` before the test command in the playwright service, or use a multi-stage Dockerfile for the playwright service that pre-installs deps. |
+| A-5 | ℹ️ Info | **No explicit base URL override for API client.** The `ApiClient` connects to the backend directly (`baseUrl`). Inside Docker, this should be `http://backend:8080`, not `http://localhost:8080`. The plan shows `BASE_URL: http://frontend:3000` in the environment but doesn't define a `BACKEND_URL` for direct API calls. | Add `BACKEND_URL: http://backend:8080` to the playwright service environment. The API client should read from `process.env.BACKEND_URL ?? 'http://localhost:8080'`. |
+| A-6 | ✅ Good | **Authentication reuse via storageState** — Correct pattern, avoids per-test login overhead. |
+| A-7 | ✅ Good | **Profile-gated test endpoint** (`POST /api/v1/test/reset-db` only on `test` profile) — Proper security boundary. |
+
+#### Architecture Verdict: ⚠️ REVISE — A-1 is contradictory and needs resolution
+
+The seed timing contradiction (A-1) is a plan consistency error that will cause confusion during implementation. A-2 through A-5 are addressable during implementation without plan revision, but A-1 needs explicit resolution in the plan document.
+
+---
+
+## 🛡️ Expert 3: Risk & Reliability Expert (Test Reliability, CI Flakiness, Coverage)
+
+### Assessment: ⚠️ Acceptable — manageable risks
+
+#### Strengths
+
+1. **"Never use `waitForTimeout`"** — Explicitly stated in Section 4.3. This is the #1 rule for non-flaky Playwright tests.
+2. **Trace collection on first retry** — Correct debugging strategy for CI.
+3. **Liberal timeouts for Docker networking** — 90s test / 60s navigation accounts for cold-start Docker overhead.
+4. **DB verification via API** — Tests don't solely rely on UI state, which is inherently more fragile.
+5. **Test ordering strategy** — Read-only tests first, CRUD tests last. Reduces state pollution.
+
+#### Findings
+
+| # | Severity | Finding | Recommendation |
+|---|----------|---------|----------------|
+| R-1 | ⚠️ Warning | **60+ tests in <5 minutes is ambitious.** Each test navigates, waits for API response, performs assertions. With Docker networking latency, expect 3-8 seconds per test. 60 tests × 5s average = 5 minutes. CRUD tests that submit forms and wait for toasts will be slower. Real expectation: 6-8 minutes. | Adjust success criterion to "< 8 minutes" or reduce test count per spec. Alternatively, enable parallel test execution for read-only specs (they don't mutate state). |
+| R-2 | ⚠️ Warning | **Suite-level reset means CRUD test failures corrupt state for subsequent tests.** If test 3.2#3 (create member) fails mid-way (e.g., form submitted but toast timeout), the DB now has a partial member. All subsequent tests that count rows will fail with confusing "expected 5, got 6" errors. | Add a "CRUD section reset" mechanism: before each CRUD-heavy describe block, call `apiClient.resetDb()`. Or structure specs so each CRUD test verifies against its own created data, not against absolute counts. |
+| R-3 | ⚠️ Warning | **No mention of `data-testid` strategy.** Section 9 lists this as an "open question" but it's actually critical for test reliability. CSS selectors and text-based selectors (`"5 Mitglieder"`) are brittle — a translation change, number format change, or design refactor breaks tests. | Decide NOW: use `data-testid` attributes on all interactive elements and key display elements. This is not optional for a 60+ test suite — it's a prerequisite. |
+| R-4 | ⚠️ Warning | **Hardcoded expected values in tests.** Many assertions reference specific values: "5 Mitglieder", "Northern Lights 18.5% THC", "30€". If the seed data changes (even a typo fix), these tests break. | Create a `seed-constants.ts` file that exports expected values derived from a single source of truth. Tests import from this file. When seed changes, update one file. |
+| R-5 | ℹ️ Info | **No retry strategy for the DB reset endpoint.** If the `POST /api/v1/test/reset-db` call fails or times out (backend GC pause, connection pool exhaustion), the entire suite fails. | Add retry logic (3 attempts, 2s backoff) in the global-setup for the DB reset call. |
+| R-6 | ℹ️ Info | **Monthly quota seed uses fixed year/month (2024/12).** Tests checking quota display may show "no quota for current month" because the seed references December 2024, not the current month. | Use dynamic month in seed OR test assertions should navigate to the historical period, not assume "current month" view shows seed data. |
+| R-7 | ℹ️ Info | **No parallel execution plan for read-only tests.** The plan states `fullyParallel: false` globally, but read-only tests (all #1 and #2 cases per spec) could safely run in parallel since they don't mutate state. This would cut execution time by 30-40%. | Consider splitting into two Playwright projects: `integration-read` (parallel) and `integration-write` (serial). |
+| R-8 | ✅ Good | **Artifact collection strategy is comprehensive** — screenshots, traces, backend logs, HTML report. This is sufficient for debugging CI failures. |
+| R-9 | ✅ Good | **CI timeout of 10 minutes** — Appropriate safety margin above the expected 5-8 minute runtime. |
+
+#### Reliability Verdict: ⚠️ ACCEPTABLE — R-2 and R-3 are the main risks
+
+The plan will produce working tests, but without `data-testid` (R-3) and with suite-level-only reset (R-2), expect a 15-25% maintenance burden from flaky/cascading failures within the first 3 months. These are addressable during implementation without plan revision.
+
+---
+
+## Panel Synthesis
+
+### Confidence Scores
+
+| Expert | Confidence | Reasoning |
+|--------|-----------|-----------|
+| 🏛️ Domain | 82% | Core regulatory paths covered; 2 missing edge cases (daily limit, THC% limit for under-21) are non-blocking |
+| 🔧 Architecture | 65% | Seed timing contradiction (A-1) is a consistency error that will cause implementation confusion |
+| 🛡️ Reliability | 75% | Fundamentally sound approach but `data-testid` decision and reset granularity need resolution |
+
+**Overall Panel Confidence: 74%**
+
+### Combined Findings by Severity
+
+#### ❌ Blocking (1)
+
+| ID | Expert | Finding |
+|----|--------|---------|
+| A-1 | 🔧 Architecture | Seed timing contradiction: docker-compose.test.yml still mounts `init.sql` to `docker-entrypoint-initdb.d` while recommending Flyway `R__` migration. These are mutually exclusive approaches — plan must pick one and remove the other. |
+
+#### ⚠️ Warnings (9)
+
+| ID | Expert | Finding |
+|----|--------|---------|
+| D-1 | 🏛️ Domain | No adult daily quota limit (25g/day) test |
+| D-2 | 🏛️ Domain | No THC% limit test for under-21 members |
+| A-2 | 🔧 Architecture | tmpfs may fail on Docker Desktop macOS |
+| A-3 | 🔧 Architecture | `seed` container removal not explicitly reflected in compose |
+| A-4 | 🔧 Architecture | Playwright container needs `pnpm install` before tests |
+| A-5 | 🔧 Architecture | No BACKEND_URL env for API client inside Docker |
+| R-1 | 🛡️ Reliability | 5-minute target unrealistic for 60+ tests with Docker overhead |
+| R-2 | 🛡️ Reliability | Suite-level reset causes cascading failures on CRUD test errors |
+| R-3 | 🛡️ Reliability | `data-testid` strategy must be decided before implementation |
+
+#### ℹ️ Info (6)
+
+| ID | Expert | Finding |
+|----|--------|---------|
+| D-3 | 🏛️ Domain | Fixed-date compliance deadlines may drift |
+| D-4 | 🏛️ Domain | `recorded_by` should reference admin, not member |
+| R-4 | 🛡️ Reliability | Hardcoded expected values — use seed-constants.ts |
+| R-5 | 🛡️ Reliability | No retry on DB reset endpoint |
+| R-6 | 🛡️ Reliability | Monthly quota seed uses fixed 2024/12, not current month |
+| R-7 | 🛡️ Reliability | Read-only tests could run in parallel for speed |
+
+---
+
+## Panel Verdict
+
+### 🔄 REVISE — 1 blocking finding must be resolved in the plan
+
+**Required before implementation:**
+1. Resolve A-1: Remove the `docker-entrypoint-initdb.d` volume mount from the proposed docker-compose.test.yml changes. Make it unambiguous that seed data flows through `R__seed_test_data.sql` via Flyway only.
+
+**Strongly recommended (can be addressed during implementation):**
+2. Resolve R-3: Commit to `data-testid` attributes as the selector strategy. Add a section "Selector Strategy" to the plan.
+3. Add D-1 and D-2 test cases to the Distributions spec (regulatory completeness).
+4. Add `pnpm install` to the playwright service command (A-4).
+
+**Nice-to-have (implementation decisions):**
+5. Adjust execution time target from 5 min to 8 min (R-1).
+6. Add `BACKEND_URL` environment variable for API client (A-5).
+7. Create `seed-constants.ts` for maintainable assertions (R-4).
+
+---
+
+*Panel review completed 2026-06-18 by Plan Reviewer mode.*
+
+---
+
+## v2 Re-Review (2026-06-18)
+
+**Reviewer:** Roo (Plan Reviewer)
+**Document reviewed:** `docs/sprint-12/cannamanage-sprint12-phase2-integration-tests.md` (v2)
+**Purpose:** Verify all v1 findings have been properly addressed
+
+---
+
+### ❌ Blocker Resolution
+
+| ID | v1 Finding | v2 Status | Evidence |
+|----|-----------|-----------|----------|
+| A-1 | Seed timing contradiction: docker-compose mounts `init.sql` to `docker-entrypoint-initdb.d` while recommending Flyway `R__` migration | ✅ **Resolved** | Section 1.3 explicitly declares "Decision (v2): Flyway-only seeding — NO Docker docker-entrypoint-initdb.d mount." Section 5.1 `docker-compose.test.yml` has NO volume mount on the `db` service, with comment confirming intent. The contradiction is eliminated. |
+
+---
+
+### ⚠️ Warning Resolution
+
+| ID | Expert | v1 Finding | v2 Status | Evidence |
+|----|--------|-----------|-----------|----------|
+| D-1 | 🏛️ | No adult daily quota limit (25g/day) test | ✅ **Resolved** | New `13-kcang-regulatory.spec.ts` — test #1 (26g → rejection), test #6 (23g+3g exceeds daily), test #7 (23g+2g = exactly 25g → success). Thorough coverage of boundary. |
+| D-2 | 🏛️ | No THC% limit test for under-21 members | ✅ **Resolved** | KCanG spec tests #3 (22% THC to U21 → rejection), #4 (0.5% THC to U21 → success), #5 (30g+ low-THC to U21 → quota error), #9 (UI shows "max. 10% THC" notice). Excellent coverage. |
+| A-2 | 🔧 | tmpfs may fail on Docker Desktop macOS; network aliases unclear | ⚠️ **Partially** | Section 5.4 clearly documents Docker service-name networking (no custom aliases needed). However, `tmpfs` is still unconditional — no CI-only gating. Risk is LOW: CI runs on `ubuntu-latest` (native Linux), and local devs can override with `docker compose -f docker-compose.yml -f docker-compose.test.yml up`. Acceptable for implementation. |
+| A-3 | 🔧 | `seed` container removal not explicitly reflected in compose | ✅ **Resolved** | Section 5.1 `docker-compose.test.yml` defines exactly 4 services: `db`, `backend`, `frontend`, `playwright`. No `seed` service exists. `playwright` depends on `backend: condition: service_healthy`. Clean. |
+| A-4 | 🔧 | Playwright container needs `pnpm install` before tests | ✅ **Resolved** | Section 5.2 introduces `Dockerfile.playwright` with `pnpm install --frozen-lockfile` at build time. Dependencies are pre-installed in the image. |
+| A-5 | 🔧 | No BACKEND_URL env for API client inside Docker | ✅ **Resolved** | Section 5.1 playwright service has `API_URL: http://backend:8080`. Section 2.7 global-setup uses this for health checks and API client initialization. |
+| R-1 | 🛡️ | 5-minute target unrealistic for 60+ tests with Docker overhead | ⚠️ **Partially** | Plan now has per-test reset (~500ms × 70 = 35s overhead), making 5 min MORE ambitious. CI timeout is 10 min (appropriate). Test tagging splits `@smoke` (PR, <2 min) from `@full` (merge, 10 min). Section 7 success criteria still says "< 5 minutes total" — this is optimistic but the CI timeout and tagging strategy make it non-blocking. |
+| R-2 | 🛡️ | Suite-level reset causes cascading failures on CRUD test errors | ✅ **Resolved** | Section 2.1 switches to per-test reset: "Decision (v2): Per-test reset via backend API endpoint + `beforeEach` hook." Each test calls `apiClient.resetDb()` — complete state isolation between tests. |
+| R-3 | 🛡️ | `data-testid` strategy must be decided before implementation | ✅ **Resolved** | Section 2.2 commits to `data-testid` as mandatory. Naming convention defined (`<page>-<component>-<identifier>`), `selectors.ts` centralized file shown, implementation tracked as Phase 2C sub-task. |
+
+---
+
+### ℹ️ Info Finding Resolution
+
+| ID | Expert | v1 Finding | v2 Status | Evidence |
+|----|--------|-----------|-----------|----------|
+| D-3 | 🏛️ | Fixed-date compliance deadlines may drift | ✅ **Resolved** | Section 1.4 principle #3: "Use relative dates where possible (`NOW() - INTERVAL '7 days'`) for time-sensitive tests". Per-test reset re-runs seed each time, keeping relative dates fresh. |
+| D-4 | 🏛️ | `recorded_by` should reference admin, not member | ℹ️ Noted | Not explicitly addressed in v2 — minor realism improvement, can be done during seed implementation. |
+| R-4 | 🛡️ | Hardcoded expected values — use seed-constants.ts | ⚠️ **Partially** | No explicit `seed-constants.ts` file created, but deterministic UUIDs (Section 1.4 #1) + per-test reset ensure assertions are stable. The `selectors.ts` centralizes locators but not data values. Acceptable — can be added during implementation when duplication becomes apparent. |
+| R-5 | 🛡️ | No retry on DB reset endpoint | ℹ️ Noted | No explicit retry logic shown for `resetDb()`. Implementation detail — the global-setup health check ensures backend is ready before any reset calls. Low risk. |
+| R-6 | 🛡️ | Monthly quota seed uses fixed 2024/12, not current month | ✅ **Resolved** | Relative dates principle + Section 4.2 test tagging strategy (`@smoke`/`@full` with `--grep`). Seed data for quotas will use relative dates per principle #3. |
+| R-7 | 🛡️ | Read-only tests could run in parallel for speed | ℹ️ Noted | Not adopted in v2. Per-test reset makes parallelism less critical (each test is independent). Can be optimized later if execution time becomes a concern. |
+
+---
+
+### New Findings in v2
+
+| ID | Severity | Finding | Impact |
+|----|----------|---------|--------|
+| v2-1 | ℹ️ Info | **Volume mount + Dockerfile build overlap.** Section 5.1 mounts `./cannamanage-frontend/e2e:/app/e2e:ro` into the playwright container which also COPYs `e2e/` in `Dockerfile.playwright`. The volume mount overrides the built-in files at runtime. | This is an intentional Docker pattern (enables test iteration without rebuild) but should be documented to avoid confusion. Non-blocking. |
+| v2-2 | ℹ️ Info | **Success criterion "< 5 minutes total" vs per-test reset overhead.** 70+ tests × ~500ms reset + test execution (3-8s each) = realistic estimate is 6-8 minutes for `@full` suite. CI timeout of 10 min is correct, but the stated target is optimistic. | Cosmetic — CI timeout is appropriate. Adjust success criterion to "< 8 minutes" post-implementation based on actual measurements. |
+| v2-3 | ℹ️ Info | **`Dockerfile.playwright` pinned to `v1.49.0`** — this should match the Playwright version in `package.json` to avoid browser/API version mismatches. | Document: keep Dockerfile image version in sync with `@playwright/test` version in `package.json`. |
+
+---
+
+### Updated Confidence Scores
+
+| Expert | v1 Confidence | v2 Confidence | Change | Reasoning |
+|--------|--------------|--------------|--------|-----------|
+| 🏛️ Domain | 82% | 95% | +13 | D-1 and D-2 fully resolved with 9 comprehensive KCanG test cases. Regulatory coverage is now excellent. |
+| 🔧 Architecture | 65% | 92% | +27 | A-1 blocker completely eliminated. Dockerfile.playwright, API_URL, health checks — all addressed. Only tmpfs (A-2) remains partially open but low-risk. |
+| 🛡️ Reliability | 75% | 90% | +15 | Per-test reset (R-2) and data-testid commitment (R-3) are the two highest-impact improvements. Execution time target (R-1) is slightly optimistic but non-blocking. |
+
+**Overall Panel Confidence: 92%** (v1: 74%, Δ: +18)
+
+---
+
+### Panel Verdict (v2)
+
+## ✅ APPROVED — Plan is ready for implementation
+
+All blocking findings resolved. All critical warnings addressed. Remaining items (A-2 tmpfs conditional, R-1 time target, R-4 seed-constants.ts) are implementation-time decisions that don't require plan revision.
+
+**Key improvements in v2:**
+1. Seed timing contradiction eliminated — Flyway-only, no Docker init.sql
+2. Per-test DB reset — complete test isolation via `beforeEach` + API endpoint
+3. `data-testid` strategy committed — naming convention, selectors.ts, mandatory for Phase 2C
+4. KCanG regulatory spec added — 9 comprehensive edge case tests covering §3 Abs. 1 + Abs. 2
+5. Dedicated Playwright Dockerfile with pre-installed dependencies
+6. Clear Docker networking documentation and health check strategy
+
+**Recommendation:** Proceed to implementation. The 3 ℹ️ info items (v2-1, v2-2, v2-3) can be addressed during Phase 2C/2D without plan revision.
+
+---
+
+*v2 Re-review completed 2026-06-18 by Plan Reviewer mode.*
+
+---
+
+## v3 Final Review (2026-06-18)
+
+**Reviewer:** Roo (Plan Reviewer)
+**Document reviewed:** `docs/sprint-12/cannamanage-sprint12-phase2-integration-tests.md` (v3 — final revision)
+**Purpose:** Final gate review before implementation begins. All v2 partial/info items should now be fully resolved.
+
+---
+
+### 🏛️ Expert 1: Domain Expert (KCanG Regulatory Compliance)
+
+#### Assessment: ✅ Excellent — No remaining gaps
+
+| # | Check | Verdict | Evidence |
+|---|-------|---------|----------|
+| D-1 | Adult daily 25g limit tested | ✅ | KCanG spec tests #1, #6, #7 — boundary cases (26g reject, 23+3 reject, 23+2 pass) |
+| D-2 | Under-21 THC% limit tested | ✅ | KCanG spec tests #3, #4, #5, #9 — Amnesia Haze 22% → reject, CBD Critical Mass 0.5% → pass, UI notice |
+| D-3 | Compliance deadlines use relative dates | ✅ | Section 1.4 principle #3: `NOW() - INTERVAL` for time-sensitive tests, per-test reset keeps fresh |
+| D-4 | `recorded_by` references admin UUID | ✅ | Section 1.2: explicitly states "v3: `recorded_by` = admin UUID `b1000000-...001`, not member UUID" |
+| D-5 | Monthly quota limits differentiated (50g adult vs 30g U21) | ✅ | `seed-constants.ts` exports `KCANG.ADULT_MONTHLY_LIMIT_G: 50` and `UNDER21_MONTHLY_LIMIT_G: 30` |
+| D-6 | Seed covers all regulatory-critical entity types | ✅ | Destruction records, compliance deadlines, distribution audit trail, grow lifecycle all seeded |
+
+**New observation (v3):**
+
+| # | Severity | Finding | Impact |
+|---|----------|---------|--------|
+| D-7 | ✅ Good | **`seed-constants.ts` exports KCanG limits as constants.** Tests import `KCANG.ADULT_DAILY_LIMIT_G` etc. — if regulations change (unlikely short-term, but possible with KCanG amendments), there is a single point of update. | Excellent maintainability for regulatory compliance. |
+| D-8 | ℹ️ Info | **No "combined monthly" test (adult at 50g boundary).** Tests cover 25g daily and under-21 30g monthly, but no test explicitly hits the adult 50g monthly ceiling. KCanG spec #2 tests 45g+6g=51g exceeding monthly, which implicitly covers it. | Covered via test #2 — no action needed. |
+
+#### Domain Verdict: ✅ APPROVED — confidence 97%
+
+All KCanG regulatory paths are comprehensively tested. The `seed-constants.ts` file makes regulatory limit changes trivial to propagate. The `recorded_by` fix ensures audit trail realism. No remaining domain gaps.
+
+---
+
+### 🔧 Expert 2: Architecture Expert (Next.js + Spring Boot + Playwright + Docker)
+
+#### Assessment: ✅ Sound — All concerns resolved
+
+| # | v2 Finding | v3 Resolution | Verdict |
+|---|-----------|---------------|---------|
+| A-1 | Seed timing contradiction | ✅ Eliminated in v2 (Flyway-only, confirmed in v3) | ✅ |
+| A-2 | tmpfs macOS issues | ✅ `docker-compose.test.local.yml` override with named volume (Section 5.5) | ✅ |
+| A-3 | Seed container removal | ✅ Only 4 services in compose: `db`, `backend`, `frontend`, `playwright` | ✅ |
+| A-4 | Playwright needs pnpm install | ✅ `Dockerfile.playwright` with `pnpm install --frozen-lockfile` at build time | ✅ |
+| A-5 | No BACKEND_URL for API client | ✅ `API_URL: http://backend:8080` in playwright service env | ✅ |
+| v2-1 | Volume + Dockerfile overlap confusion | ✅ Explicit comment in Section 5.1 explaining the intentional pattern | ✅ |
+| v2-3 | Playwright version pinning | ✅ Bold warning in Section 5.2: must match `@playwright/test` in package.json | ✅ |
+
+**Architecture analysis of v3 additions:**
+
+| # | Severity | Finding | Impact |
+|---|----------|---------|--------|
+| A-8 | ✅ Good | **`docker-compose.test.local.yml` is a clean override pattern.** Using compose file stacking (`-f base -f override`) is the Docker-native way to handle env-specific differences. No conditional logic in the base file — declarative and predictable. | Well-architected. |
+| A-9 | ✅ Good | **`seed-constants.ts` placement at `cannamanage-frontend/e2e/seed-constants.ts`.** Correctly lives in the test scope, not in application code. Imported by specs via relative path. No runtime dependency. | Clean separation of concerns. |
+| A-10 | ℹ️ Info | **No automated enforcement of `seed-constants.ts` usage.** The "Rule: never hardcode seed values in specs" is documented but not lint-enforced. A custom ESLint rule (e.g., forbid UUID/number literals in spec files) could catch violations during PR review. | Low priority — PR review process is sufficient for a team of this size. Future improvement. |
+| A-11 | ℹ️ Info | **`R__seed_test_data.sql` checksum behavior.** Flyway repeatable migrations re-execute ONLY when the file checksum changes. If a developer adds seed data but forgets to update `seed-constants.ts`, tests will pass locally (fresh DB) but may confuse on next run. | Documented in Section 8 risks. Acceptable. |
+
+#### Architecture Verdict: ✅ APPROVED — confidence 95%
+
+All v1/v2 architectural concerns are fully resolved. The tmpfs override pattern is clean. The Dockerfile.playwright with version pinning is well-documented. Docker networking is clear. The volume mount explanation in v3 eliminates the last source of implementation confusion.
+
+---
+
+### 🛡️ Expert 3: Risk & Reliability Expert (Test Reliability, CI Flakiness, Maintenance)
+
+#### Assessment: ✅ Solid — all high-risk items resolved
+
+| # | v2 Finding | v3 Resolution | Verdict |
+|---|-----------|---------------|---------|
+| R-1 | 5-minute target unrealistic | ✅ Changed to "< 8 minutes for @full, < 2 minutes for @smoke" (Section 7) | ✅ |
+| R-2 | Suite-level reset causes cascading failures | ✅ Resolved in v2 (per-test reset via beforeEach) | ✅ |
+| R-3 | data-testid strategy undecided | ✅ Resolved in v2 (mandatory, naming convention, selectors.ts) | ✅ |
+| R-4 | Hardcoded expected values | ✅ Complete `seed-constants.ts` with UUIDs, member data, KCanG limits, counts (Section 2.8) | ✅ |
+| R-5 | No retry on DB reset endpoint | ℹ️ Not explicitly added, but global-setup health check warms backend + pool before tests | Acceptable |
+| R-6 | Fixed year/month in quota seed | ✅ Relative dates principle (Section 1.4 #3) + per-test reset re-runs seed | ✅ |
+| R-7 | No parallel execution for read-only tests | ℹ️ Not adopted — per-test reset makes it less critical | Acceptable |
+
+**Reliability analysis of v3 additions:**
+
+| # | Severity | Finding | Impact |
+|---|----------|---------|--------|
+| R-10 | ✅ Good | **`seed-constants.ts` is comprehensive.** Covers UUIDs, member metadata (`isUnder21`, `quotaUsedG`), strain THC%, KCanG limits, counts for every entity type. 80+ exported constants. | Single source of truth dramatically reduces maintenance burden from spec-level hardcoding. |
+| R-11 | ✅ Good | **Time targets are now realistic.** 8-minute full suite with 10-minute CI timeout gives 25% safety margin. 2-minute smoke suite is achievable with ~15 tagged tests at 5-8s each. | Prevents false-failure CI red due to optimistic expectations. |
+| R-12 | ✅ Good | **tmpfs override is opt-in, not opt-out.** Developers only use the local override if they experience issues. Default (tmpfs) works on CI and most macOS Docker Desktop versions. No "if CI then X else Y" conditional complexity. | Simple mental model for developers. |
+| R-13 | ℹ️ Info | **seed-constants.ts → R__seed_test_data.sql synchronization is manual.** When someone changes the SQL seed, they must also update the TypeScript constants file. There's no automated check that these stay in sync. | Acceptable risk for a small team. Could add a CI check later (parse SQL → generate constants → compare). |
+
+**Flakiness risk assessment (final):**
+
+| Risk Factor | v1 Score | v3 Score | Change |
+|-------------|----------|----------|--------|
+| State pollution between tests | 🔴 High | 🟢 Low | Per-test reset eliminates |
+| Selector brittleness | 🔴 High | 🟢 Low | data-testid mandatory |
+| Hardcoded assertion values | 🟡 Medium | 🟢 Low | seed-constants.ts |
+| Time-dependent test data | 🟡 Medium | 🟢 Low | Relative dates in seed |
+| Docker networking flakiness | 🟡 Medium | 🟢 Low | Health checks + liberal timeouts |
+| CI execution time pressure | 🟡 Medium | 🟢 Low | Realistic 8-min target + 10-min timeout |
+| macOS local dev issues | 🟡 Medium | 🟢 Low | docker-compose.test.local.yml override |
+
+**Estimated maintenance burden:** < 5% of test development time (was 15-25% estimated in v1 review).
+
+#### Reliability Verdict: ✅ APPROVED — confidence 94%
+
+All high-risk flakiness vectors have been systematically addressed. The `seed-constants.ts` file is the most impactful v3 addition from a reliability perspective — it eliminates the "change seed, break 40 tests" failure mode. The realistic time targets prevent CI false-reds. The per-test reset (from v2) provides complete test isolation.
+
+---
+
+### Panel Synthesis (v3 Final)
+
+#### Confidence Scores
+
+| Expert | v1 | v2 | v3 | Reasoning |
+|--------|----|----|----|-----------|
+| 🏛️ Domain | 82% | 95% | **97%** | `recorded_by` fix + KCanG constants in `seed-constants.ts` close the last gaps |
+| 🔧 Architecture | 65% | 92% | **95%** | tmpfs override + volume explanation + version pinning = all concerns fully resolved |
+| 🛡️ Reliability | 75% | 90% | **94%** | `seed-constants.ts` + realistic time targets eliminate remaining medium-risk items |
+
+**Overall Panel Confidence: 95%** (v1: 74% → v2: 92% → v3: 95%)
+
+#### Remaining Items (all ℹ️ Info — none blocking)
+
+| ID | Expert | Finding | Priority |
+|----|--------|---------|----------|
+| A-10 | 🔧 | No lint enforcement of seed-constants usage | Future improvement |
+| A-11 | 🔧 | SQL ↔ TS constants sync is manual | Acceptable for team size |
+| R-5 | 🛡️ | No explicit retry on DB reset endpoint | Low risk, health check mitigates |
+| R-13 | 🛡️ | seed-constants.ts sync with SQL is manual | Can add CI check post-implementation |
+
+None of these require plan revision. All are implementation-time decisions or future improvements.
+
+---
+
+## Panel Verdict (v3 Final)
+
+### ✅ APPROVED — Plan is complete, correct, and ready for implementation
+
+**GO recommendation: Proceed immediately to Phase 2A.**
+
+All 3 experts approve without blocking findings. The plan has matured through 3 iterations:
+
+| Version | Verdict | Blockers | Confidence |
+|---------|---------|----------|------------|
+| v1 | 🔄 REVISE | 1 (seed timing) | 74% |
+| v2 | ✅ APPROVED | 0 | 92% |
+| v3 | ✅ APPROVED | 0 | 95% |
+
+**v3 specifically resolved:**
+1. ✅ tmpfs conditional — `docker-compose.test.local.yml` override (clean, declarative)
+2. ✅ Realistic time targets — `@full` < 8 min, `@smoke` < 2 min (was "<5 min")
+3. ✅ `seed-constants.ts` — 80+ exported constants, single source of truth for all test assertions
+4. ✅ `recorded_by` fix — admin UUID for audit trail realism
+5. ✅ Volume overlap documentation — intentional pattern explained inline
+6. ✅ Version pinning — Playwright Docker image ↔ package.json sync rule with bold warning
+
+**Quality assessment:** This is a production-grade integration test plan. The architecture (Flyway seed → per-test reset → data-testid selectors → seed-constants.ts) forms a cohesive, maintainable system. The phased implementation (2A→2E over 4 days) is realistic and correctly ordered.
+
+**No further revision needed. Implementation can begin.**
+
+---
+
+*v3 Final panel review completed 2026-06-18 by Plan Reviewer mode.*

docs/sprint-12/cannamanage-sprint12-plan.md

@@ -0,0 +1,377 @@
+# Sprint 12 Implementation Plan: "Golden Test Standard"
+
+**Datum:** 18.06.2026  
+**Autor:** Patrick Plate / Lumen (Planner)  
+**Status:** v1  
+**Basis:** cannamanage-sprint12-analysis.md
+
+---
+
+## Übersicht
+
+| Phase | Beschreibung | Aufwand |
+|-------|-------------|---------|
+| Phase 1 | Documents Page — React Query + Wire Actions | ~2.5h |
+| Phase 2 | Documents Page — UX Improvements | ~1h |
+| Phase 3 | Board Page — Wire All Actions | ~1.5h |
+| **Gesamt** | | **~5h** |
+
+---
+
+## Phase 1: Documents Page — React Query Integration + Action Wiring
+
+### Step 1.1: Add React Query hooks to `services/documents.ts`
+
+**File:** `cannamanage-frontend/src/services/documents.ts`
+
+Add query hooks (pattern matches other services like `services/stock.ts`):
+
+```typescript
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
+
+// Club ID constant (same pattern as info-board)
+const CLUB_ID = "00000000-0000-0000-0000-000000000001"
+
+export function useDocumentsQuery(category?: DocumentCategory) {
+  return useQuery({
+    queryKey: ["documents", category],
+    queryFn: () => listDocuments(CLUB_ID, category),
+  })
+}
+
+export function useUploadDocumentMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (params: {
+      title: string
+      category: DocumentCategory
+      accessLevel: DocumentAccessLevel
+      description: string | null
+      file: File
+    }) =>
+      uploadDocument(
+        CLUB_ID,
+        params.title,
+        params.category,
+        params.accessLevel,
+        params.description,
+        params.file
+      ),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["documents"] })
+    },
+  })
+}
+
+export function useDeleteDocumentMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) => deleteDocument(id, CLUB_ID),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["documents"] })
+    },
+  })
+}
+```
+
+### Step 1.2: Rewrite Documents Page with React Query
+
+**File:** `cannamanage-frontend/src/app/(dashboard-layout)/documents/page.tsx`
+
+Key changes:
+1. Replace `useState(mockDocuments)` with `useDocumentsQuery()` + mock fallback
+2. Wire upload form: collect form state → call `uploadMutation.mutate()`
+3. Wire download button: `onClick={() => handleDownload(doc.id, doc.filename)}`
+4. Wire delete button: confirmation dialog → `deleteMutation.mutate(doc.id)`
+
+**Upload handler:**
+```typescript
+const uploadMutation = useUploadDocumentMutation()
+
+function handleUpload() {
+  const fileInput = document.getElementById("file") as HTMLInputElement
+  const file = fileInput?.files?.[0]
+  if (!file || !title || !category) {
+    toast.error("Bitte alle Pflichtfelder ausfüllen")
+    return
+  }
+  uploadMutation.mutate(
+    { title, category, accessLevel, description: description || null, file },
+    {
+      onSuccess: () => {
+        toast.success("Dokument hochgeladen")
+        setUploadOpen(false)
+        resetForm()
+      },
+      onError: () => toast.error("Upload fehlgeschlagen"),
+    }
+  )
+}
+```
+
+**Download handler:**
+```typescript
+async function handleDownload(docId: string, filename: string) {
+  try {
+    const blob = await downloadDocument(docId)
+    const url = URL.createObjectURL(blob)
+    const a = document.createElement("a")
+    a.href = url
+    a.download = filename
+    document.body.appendChild(a)
+    a.click()
+    document.body.removeChild(a)
+    URL.revokeObjectURL(url)
+    toast.success("Download gestartet")
+  } catch {
+    toast.error("Download fehlgeschlagen")
+  }
+}
+```
+
+**Delete handler with confirmation:**
+```typescript
+const deleteMutation = useDeleteDocumentMutation()
+const [deleteTarget, setDeleteTarget] = useState<ClubDocument | null>(null)
+
+// In AlertDialog:
+function handleConfirmDelete() {
+  if (!deleteTarget) return
+  deleteMutation.mutate(deleteTarget.id, {
+    onSuccess: () => {
+      toast.success("Dokument gelöscht")
+      setDeleteTarget(null)
+    },
+    onError: () => toast.error("Löschen fehlgeschlagen"),
+  })
+}
+```
+
+### Step 1.3: Add form state management to Upload Dialog
+
+Add controlled state for all form fields:
+```typescript
+const [title, setTitle] = useState("")
+const [category, setCategory] = useState<DocumentCategory | "">("")
+const [accessLevel, setAccessLevel] = useState<DocumentAccessLevel>("ALL_MEMBERS")
+const [description, setDescription] = useState("")
+```
+
+Wire each `<Input>` and `<Select>` to its state variable with `value` and `onChange`.
+
+---
+
+## Phase 2: Documents Page — UX Improvements
+
+### Step 2.1: Category colors and icons
+
+**File:** `cannamanage-frontend/src/app/(dashboard-layout)/documents/page.tsx`
+
+Replace `getCategoryBadgeVariant()` with a richer mapping:
+
+```typescript
+const categoryStyles: Record<DocumentCategory, { color: string; icon: React.ReactNode }> = {
+  SATZUNG: {
+    color: "bg-blue-100 text-blue-800 dark:bg-blue-900/30 dark:text-blue-400",
+    icon: <BookOpen className="h-3 w-3" />,
+  },
+  PROTOKOLL: {
+    color: "bg-purple-100 text-purple-800 dark:bg-purple-900/30 dark:text-purple-400",
+    icon: <FileText className="h-3 w-3" />,
+  },
+  VERTRAG: {
+    color: "bg-amber-100 text-amber-800 dark:bg-amber-900/30 dark:text-amber-400",
+    icon: <FileSignature className="h-3 w-3" />,
+  },
+  VERSICHERUNG: {
+    color: "bg-cyan-100 text-cyan-800 dark:bg-cyan-900/30 dark:text-cyan-400",
+    icon: <Shield className="h-3 w-3" />,
+  },
+  GENEHMIGUNG: {
+    color: "bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400",
+    icon: <CheckCircle className="h-3 w-3" />,
+  },
+  SONSTIGES: {
+    color: "bg-gray-100 text-gray-800 dark:bg-gray-900/30 dark:text-gray-400",
+    icon: <File className="h-3 w-3" />,
+  },
+}
+```
+
+Use this in the Badge rendering:
+```tsx
+<Badge className={`inline-flex items-center gap-1 ${categoryStyles[category].color}`}>
+  {categoryStyles[category].icon}
+  {categoryLabels[category]}
+</Badge>
+```
+
+### Step 2.2: Table column width constraints
+
+Add column widths to prevent stretching:
+
+```tsx
+<TableHead className="w-[40%] min-w-[200px]">{t("name")}</TableHead>
+<TableHead className="w-[120px]">{t("access")}</TableHead>
+<TableHead className="w-[80px]">{t("size")}</TableHead>
+<TableHead className="w-[100px]">{t("date")}</TableHead>
+<TableHead className="w-[80px] text-right">{t("actions")}</TableHead>
+```
+
+Add `truncate` to the document title:
+```tsx
+<p className="font-medium truncate max-w-[250px]">{doc.title}</p>
+```
+
+### Step 2.3: Add upload loading state
+
+Show a spinner/disabled state on the upload button while uploading:
+```tsx
+<Button
+  className="w-full"
+  onClick={handleUpload}
+  disabled={uploadMutation.isPending}
+>
+  {uploadMutation.isPending ? (
+    <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+  ) : (
+    <Upload className="mr-2 h-4 w-4" />
+  )}
+  {uploadMutation.isPending ? "Wird hochgeladen..." : t("uploadButton")}
+</Button>
+```
+
+---
+
+## Phase 3: Board Page — Wire All Actions
+
+### Step 3.1: Add React Query hooks to `services/board.ts`
+
+**File:** `cannamanage-frontend/src/services/board.ts`
+
+Check existing service — add mutation hooks if not present:
+
+```typescript
+export function useCreatePositionMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (params: { title: string; description: string; sortOrder: number }) =>
+      createPosition(params),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["board"] }),
+  })
+}
+
+export function useElectBoardMemberMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (params: ElectBoardMemberRequest) => electBoardMember(params),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["board"] }),
+  })
+}
+
+export function useRemoveBoardMemberMutation() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) => removeBoardMember(id),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["board"] }),
+  })
+}
+```
+
+### Step 3.2: Wire "Position erstellen" dialog
+
+**File:** `cannamanage-frontend/src/app/(dashboard-layout)/board/page.tsx`
+
+1. Add form state for position fields
+2. Replace close-only handler with mutation call:
+
+```typescript
+const createPosition = useCreatePositionMutation()
+
+function handleCreatePosition() {
+  if (!posTitle.trim()) return
+  createPosition.mutate(
+    { title: posTitle, description: posDesc, sortOrder: parseInt(sortOrder) || 0 },
+    {
+      onSuccess: () => {
+        toast.success("Position erstellt")
+        setPositionDialogOpen(false)
+        resetPositionForm()
+      },
+      onError: () => toast.error("Erstellen fehlgeschlagen"),
+    }
+  )
+}
+```
+
+### Step 3.3: Wire "Wahl bestätigen" dialog
+
+1. Add form state for election fields (positionId, memberId, electedAt, termStart, termEnd)
+2. Replace close-only handler:
+
+```typescript
+const electMember = useElectBoardMemberMutation()
+
+function handleElect() {
+  if (!selectedPosition || !selectedMember || !electedAt || !termStart) return
+  electMember.mutate(
+    {
+      positionId: selectedPosition,
+      memberId: selectedMember,
+      electedAt,
+      termStart,
+      termEnd: termEnd || undefined,
+    },
+    {
+      onSuccess: () => {
+        toast.success("Wahl bestätigt")
+        setElectDialogOpen(false)
+      },
+      onError: () => toast.error("Wahl fehlgeschlagen"),
+    }
+  )
+}
+```
+
+### Step 3.4: Wire "Mitglied absetzen" button
+
+Add confirmation dialog + handler:
+
+```typescript
+const removeMember = useRemoveBoardMemberMutation()
+const [removeTarget, setRemoveTarget] = useState<string | null>(null)
+
+// On the UserMinus button:
+<Button variant="ghost" size="icon" onClick={() => setRemoveTarget(bm.id)}>
+  <UserMinus className="h-4 w-4" />
+</Button>
+
+// Confirmation AlertDialog:
+function handleConfirmRemove() {
+  if (!removeTarget) return
+  removeMember.mutate(removeTarget, {
+    onSuccess: () => {
+      toast.success("Vorstandsmitglied abgesetzt")
+      setRemoveTarget(null)
+    },
+    onError: () => toast.error("Absetzen fehlgeschlagen"),
+  })
+}
+```
+
+### Step 3.5: Replace mock data with React Query
+
+Replace `mockBoardMembers` and `mockPositions` with:
+```typescript
+const { data: boardData, isLoading } = useBoardQuery()
+const positions = boardData?.positions ?? mockPositions
+const boardMembers = boardData?.members ?? mockBoardMembers
+```
+
+---
+
+## Offene Fragen
+
+- [ ] Soll die Documents-Upload-Funktion eine Fortschrittsanzeige haben (xhr.upload.onprogress), oder reicht ein einfacher Spinner?
+- [ ] Board: Sollen die Member-Select-Optionen aus dem echten Members-Endpoint geladen werden, oder reichen hardcoded Options bis der Backend-Endpoint steht?
+- [ ] Soll ein "Coming soon" Toast für den Reports-Center Tab hinzugefügt werden (momentan scheint es zu existieren als eigene Route)?

docs/sprint-12/cannamanage-sprint12-testplan.md

@@ -0,0 +1,305 @@
+# Sprint 12 Test Plan: "Golden Test Standard"
+
+**Datum:** 18.06.2026  
+**Autor:** Patrick Plate / Lumen (Planner)  
+**Status:** v1  
+**Basis:** cannamanage-sprint12-plan.md
+
+---
+
+## Testübersicht
+
+| ID | Beschreibung | Typ | Seite | Status |
+|----|-------------|-----|-------|--------|
+| T-01 | Document upload end-to-end | E2E | documents | ⬜ |
+| T-02 | Document download triggers file save | E2E | documents | ⬜ |
+| T-03 | Document delete with confirmation | E2E | documents | ⬜ |
+| T-04 | Document upload validation (missing fields) | E2E | documents | ⬜ |
+| T-05 | Document category badges have distinct colors | Visual | documents | ⬜ |
+| T-06 | Document table column widths don't stretch | Visual | documents | ⬜ |
+| T-07 | Board: create position via dialog | E2E | board | ⬜ |
+| T-08 | Board: elect member via dialog | E2E | board | ⬜ |
+| T-09 | Board: remove member with confirmation | E2E | board | ⬜ |
+| T-10 | All pages: no buttons without onClick handlers | Automated | all | ⬜ |
+| T-11 | Documents page loads from API (React Query) | Integration | documents | ⬜ |
+| T-12 | Board page loads from API (React Query) | Integration | board | ⬜ |
+
+Status: ⬜ Offen | ✅ Bestanden | ❌ Fehlgeschlagen | ⏭️ Übersprungen
+
+---
+
+## Testfälle
+
+### T-01: Document upload end-to-end
+
+**Typ:** E2E (Playwright)  
+**Datei:** `e2e/sprint12-documents.spec.ts`
+
+**Vorbedingungen:**
+- Mock-Backend läuft oder Frontend-Mock-API aktiv
+- Nutzer ist eingeloggt als Admin
+
+**Szenarien:**
+
+| # | Eingabe | Erwartetes Ergebnis |
+|---|---------|-------------------|
+| a | Upload-Button klicken → Dialog öffnet sich | Dialog mit Titel, Kategorie, Datei-Upload sichtbar |
+| b | Alle Felder ausfüllen + Datei wählen → "Hochladen" klicken | Loading-Spinner erscheint, dann Success-Toast, Dialog schließt |
+| c | Nach Upload: Dokumentenliste wird refresht | Neues Dokument erscheint in der Liste |
+
+**Nachbedingungen:**
+- Upload-Mutation wurde mit korrekten Parametern aufgerufen
+- QueryClient hat `["documents"]` invalidiert
+
+---
+
+### T-02: Document download triggers file save
+
+**Typ:** E2E (Playwright)  
+**Datei:** `e2e/sprint12-documents.spec.ts`
+
+**Vorbedingungen:**
+- Mindestens 1 Dokument in der Liste sichtbar
+
+**Szenarien:**
+
+| # | Eingabe | Erwartetes Ergebnis |
+|---|---------|-------------------|
+| a | Download-Icon-Button für ein Dokument klicken | Datei-Download wird ausgelöst (Playwright download event) |
+| b | Backend nicht erreichbar → Download klicken | Error-Toast "Download fehlgeschlagen" |
+
+**Nachbedingungen:**
+- `downloadDocument(id)` wurde aufgerufen
+- Blob wurde zu download-link konvertiert
+
+---
+
+### T-03: Document delete with confirmation
+
+**Typ:** E2E (Playwright)  
+**Datei:** `e2e/sprint12-documents.spec.ts`
+
+**Vorbedingungen:**
+- Mindestens 1 Dokument in der Liste
+
+**Szenarien:**
+
+| # | Eingabe | Erwartetes Ergebnis |
+|---|---------|-------------------|
+| a | Delete-Icon klicken | Bestätigungs-Dialog erscheint ("Dokument wirklich löschen?") |
+| b | "Abbrechen" im Dialog | Dialog schließt, Dokument bleibt |
+| c | "Löschen" im Dialog bestätigen | Loading-State, dann Success-Toast, Dokument verschwindet aus Liste |
+
+**Nachbedingungen:**
+- `deleteDocument(id, clubId)` wurde aufgerufen
+- Liste wurde refresht (query invalidation)
+
+---
+
+### T-04: Document upload validation (missing fields)
+
+**Typ:** E2E (Playwright)  
+**Datei:** `e2e/sprint12-documents.spec.ts`
+
+**Szenarien:**
+
+| # | Eingabe | Erwartetes Ergebnis |
+|---|---------|-------------------|
+| a | Upload-Dialog öffnen → sofort "Hochladen" klicken (kein Titel, keine Datei) | Error-Toast "Bitte alle Pflichtfelder ausfüllen", kein API-Call |
+| b | Titel eingeben aber keine Datei → "Hochladen" | Fehler-Hinweis |
+| c | Datei wählen aber kein Titel → "Hochladen" | Fehler-Hinweis |
+
+---
+
+### T-05: Document category badges have distinct colors
+
+**Typ:** Visual (Screenshot-Vergleich oder manuell)  
+**Datei:** `e2e/sprint12-documents.spec.ts` (Screenshot)
+
+**Szenarien:**
+
+| # | Kategorie | Erwartete Farbe | Icon vorhanden |
+|---|-----------|----------------|----------------|
+| a | SATZUNG | Blau (bg-blue-*) | ✅ BookOpen |
+| b | PROTOKOLL | Lila (bg-purple-*) | ✅ FileText |
+| c | VERTRAG | Amber (bg-amber-*) | ✅ FileSignature |
+| d | VERSICHERUNG | Cyan (bg-cyan-*) | ✅ Shield |
+| e | GENEHMIGUNG | Grün (bg-green-*) | ✅ CheckCircle |
+| f | SONSTIGES | Grau (bg-gray-*) | ✅ File |
+
+**Prüfmethode:** Screenshot machen, visuell prüfen dass alle 6 Kategorien klar unterscheidbar sind.
+
+---
+
+### T-06: Document table column widths don't stretch
+
+**Typ:** Visual  
+**Datei:** `e2e/sprint12-documents.spec.ts` (Screenshot)
+
+**Szenarien:**
+
+| # | Viewport | Erwartetes Verhalten |
+|---|----------|---------------------|
+| a | Desktop (1280px) | Name-Spalte max 40% breit, truncated bei langen Titeln |
+| b | Tablet (768px) | Table responsive, keine horizontale Scrollbar |
+| c | Mobile (375px) | Graceful wrapping oder collapsed view |
+
+---
+
+### T-07: Board — create position via dialog
+
+**Typ:** E2E (Playwright)  
+**Datei:** `e2e/sprint12-board.spec.ts`
+
+**Szenarien:**
+
+| # | Eingabe | Erwartetes Ergebnis |
+|---|---------|-------------------|
+| a | "Position hinzufügen" → Dialog öffnet | Formular mit Titel, Beschreibung, Reihenfolge |
+| b | Titel "Beisitzer" + Beschreibung + Reihenfolge 6 → Speichern | Success-Toast, Dialog schließt, Position erscheint in Liste |
+| c | Leerer Titel → Speichern | Kein API-Call, Validierung greift |
+
+---
+
+### T-08: Board — elect member via dialog
+
+**Typ:** E2E (Playwright)  
+**Datei:** `e2e/sprint12-board.spec.ts`
+
+**Szenarien:**
+
+| # | Eingabe | Erwartetes Ergebnis |
+|---|---------|-------------------|
+| a | "Mitglied wählen" → Dialog öffnet | Formular mit Position-Select, Member-Select, Datum-Felder |
+| b | Position + Mitglied + Wahldatum + Amtsbeginn ausfüllen → Bestätigen | Success-Toast, Dialog schließt, neues Board-Member in Karten |
+| c | Keine Position gewählt → Bestätigen | Kein API-Call, Validierung |
+
+---
+
+### T-09: Board — remove member with confirmation
+
+**Typ:** E2E (Playwright)  
+**Datei:** `e2e/sprint12-board.spec.ts`
+
+**Szenarien:**
+
+| # | Eingabe | Erwartetes Ergebnis |
+|---|---------|-------------------|
+| a | UserMinus-Icon auf Board-Member-Card klicken | Bestätigungs-Dialog "Wirklich absetzen?" |
+| b | Bestätigen | Success-Toast, Member-Card verschwindet |
+| c | Abbrechen | Dialog schließt, keine Änderung |
+
+---
+
+### T-10: All pages — no buttons without onClick handlers
+
+**Typ:** Automated (Static analysis / Playwright audit)  
+**Datei:** `e2e/sprint12-button-audit.spec.ts`
+
+**Ansatz:** Playwright-Test der jede Dashboard-Seite navigiert und prüft:
+```typescript
+const buttons = await page.locator('button').all()
+for (const btn of buttons) {
+  // Verify button is either:
+  // 1. Inside a <Link> (navigation button)
+  // 2. Has an onClick or is type="submit" in a form
+  // 3. Is a dialog trigger (data-state attribute)
+  const isDisabled = await btn.getAttribute('disabled')
+  if (isDisabled) continue // disabled buttons are OK
+  
+  // Click and verify something happens (no silent no-op)
+}
+```
+
+**Seiten zu prüfen:**
+- /documents
+- /board
+- /members
+- /distributions
+- /stock
+- /grow
+- /reports
+- /calendar
+- /forum
+- /info-board
+- /finance
+- /assemblies
+- /compliance
+- /audit-log
+- /settings/staff
+
+---
+
+### T-11: Documents page loads from API (React Query)
+
+**Typ:** Integration  
+**Datei:** `e2e/sprint12-documents.spec.ts`
+
+**Szenarien:**
+
+| # | Bedingung | Erwartetes Ergebnis |
+|---|-----------|-------------------|
+| a | Backend erreichbar, Dokumente vorhanden | Dokumente aus API angezeigt (nicht Mock) |
+| b | Backend nicht erreichbar | Mock-Fallback-Daten angezeigt (keine Fehlerseite) |
+| c | Kategorie-Filter gewählt | Query-Key enthält Kategorie, neue Daten geladen |
+
+---
+
+### T-12: Board page loads from API (React Query)
+
+**Typ:** Integration  
+**Datei:** `e2e/sprint12-board.spec.ts`
+
+**Szenarien:**
+
+| # | Bedingung | Erwartetes Ergebnis |
+|---|-----------|-------------------|
+| a | Backend erreichbar | Board-Mitglieder + Positionen aus API |
+| b | Backend nicht erreichbar | Mock-Fallback angezeigt |
+
+---
+
+## Testdaten
+
+### Documents
+- Mock-Dokumente sind bereits in `documents/page.tsx` definiert (5 Dokumente, verschiedene Kategorien)
+- Für Upload-Test: beliebige PDF-Datei < 5MB
+- Für Download-Test: Mock-Backend muss Blob zurückgeben
+
+### Board
+- Mock-Board-Mitglieder sind bereits in `board/page.tsx` definiert (5 Positionen, 5 Mitglieder)
+- Für Election-Test: Member-IDs aus Mock-Daten verwenden
+
+---
+
+## Testabdeckung
+
+| Komponente | E2E | Integration | Visual | Gesamt |
+|-----------|-----|-------------|--------|--------|
+| Documents (upload) | 2 | 1 | 0 | 3 |
+| Documents (download) | 1 | 0 | 0 | 1 |
+| Documents (delete) | 1 | 0 | 0 | 1 |
+| Documents (UX) | 0 | 0 | 2 | 2 |
+| Board (create pos) | 1 | 1 | 0 | 2 |
+| Board (elect) | 1 | 0 | 0 | 1 |
+| Board (remove) | 1 | 0 | 0 | 1 |
+| All pages audit | 1 | 0 | 0 | 1 |
+| **Summe** | **8** | **2** | **2** | **12** |
+
+---
+
+## Playwright Test File Structure
+
+```
+e2e/
+├── sprint12-documents.spec.ts    # T-01 through T-06, T-11
+├── sprint12-board.spec.ts        # T-07 through T-09, T-12
+└── sprint12-button-audit.spec.ts # T-10
+```
+
+## Ausführung
+
+```bash
+cd cannamanage-frontend
+npx playwright test e2e/sprint12-*.spec.ts
+```

docs/sprint-13/cannamanage-sprint13-analysis.md

@@ -0,0 +1,139 @@
+# Analysis: Sprint 13 — Production Hardening
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v1
+**Sprint Theme:** Production Hardening & Housekeeping
+
+---
+
+## 1. Problem Analysis
+
+CannaManage has completed 12 sprints of feature development and is functionally complete for MVP. However, a comprehensive security review (2026-06-15) identified **4 production-blocking vulnerabilities** that prevent deployment. Additionally, backend test coverage sits at ~12% (20 tests for 29K LOC), the CI/CD pipeline deploys without running tests, and various repo hygiene issues remain unaddressed.
+
+Sprint 13 is a **hardening sprint** — no new features, purely focused on making the existing codebase production-ready.
+
+### Source Documents
+
+- [`docs/security-code-review-final.md`](docs/security-code-review-final.md) — Full security review with 4 BLOCKERs
+- [`docs/sprint-12/SPRINT-12-SUMMARY.md`](docs/sprint-12/SPRINT-12-SUMMARY.md) — Sprint 12 outcome (test infra delivered)
+- [`.gitea/workflows/deploy.yml`](.gitea/workflows/deploy.yml) — Current CI/CD pipeline (no tests)
+
+---
+
+## 2. Affected Components
+
+| Component | Path | Issue |
+|-----------|------|-------|
+| DocumentController | `cannamanage-api/src/main/java/de/cannamanage/api/controller/DocumentController.java` | IDOR — no tenant check on download/delete |
+| DocumentService | `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java` | Path traversal via unsanitized filename |
+| SecurityConfig | `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java` | Missing `/api/v1/documents/**` matchers, CORS hardcoded |
+| deploy.yml | `.gitea/workflows/deploy.yml` | Deploys without running tests |
+| package.json | `cannamanage-frontend/package.json` | Wrong project name ("shadboard-nextjs-starter-kit") |
+| cannamanage-domain | `cannamanage-domain/src/` | 0 unit tests |
+| cannamanage-service | `cannamanage-service/src/` | Low test coverage on service layer |
+
+---
+
+## 3. Current State (Ist-Zustand)
+
+### Security Posture
+
+The security review gave a **CONDITIONAL PASS** — architecture is solid (multi-tenant via `AbstractTenantEntity`, BCrypt+SHA-256, RFC 9457 errors, GoBD append-only audit) but 4 specific issues block go-live:
+
+| # | Blocker | Severity | Status Since |
+|---|---------|----------|-------------|
+| 1 | IDOR in DocumentController (download by raw UUID, no tenant verify) | HIGH | Sprint 9 (unfixed) |
+| 2 | Path traversal in DocumentService (`file.getOriginalFilename()` unsanitized) | HIGH | Sprint 9 (unfixed) |
+| 3 | JWT dev-secret fallback | HIGH | **FIXED** — `application.properties` now uses fail-on-startup marker |
+| 4 | `/api/v1/documents/**` missing from SecurityConfig matchers | HIGH | Sprint 9 (unfixed) |
+
+**Note:** Blocker #3 is already resolved. The current `application.properties:13` reads:
+```
+cannamanage.security.jwt.secret=${CANNAMANAGE_SECURITY_JWT_SECRET:CHANGE_ME_IN_PRODUCTION_THIS_WILL_FAIL_ON_STARTUP}
+```
+The `JwtService.validateSecret()` detects this marker and refuses startup. This leaves **3 active blockers**.
+
+### CI/CD Pipeline
+
+The current [`.gitea/workflows/deploy.yml`](.gitea/workflows/deploy.yml:17) triggers on push to `main` and:
+1. ✅ Checks out the commit
+2. ✅ Builds Docker images
+3. ✅ Deploys with `docker compose up -d`
+4. ✅ Checks backend health (actuator)
+5. ⚠️ Frontend check is non-blocking (doesn't fail the job)
+6. ❌ **No tests run at all** — neither backend (Maven) nor frontend (Vitest/Playwright)
+
+### Test Coverage
+
+- **Backend:** ~20 tests across cannamanage-api (GlobalExceptionHandlerTest, some controller tests). cannamanage-domain and cannamanage-service have minimal or zero coverage.
+- **Frontend:** Playwright integration specs (70+ tests) exist but are never run in CI. No Vitest unit tests in CI either.
+- **Sprint 12** delivered the Docker Compose test infrastructure (`docker-compose.test.yml`) — it's ready to be wired into CI.
+
+### Repo Hygiene
+
+| Issue | Location | Impact |
+|-------|----------|--------|
+| Wrong project name | `cannamanage-frontend/package.json` → `"name": "shadboard-nextjs-starter-kit"` | Confusing, unprofessional |
+| Dead `.github/` folder | `.github/modernize/` | GitHub-specific, project uses Gitea |
+| No root README | `.` | No project documentation for new contributors |
+| Leftover screenshot scripts | `cannamanage-frontend/*.mjs` | Dev clutter (gitignored PNGs, but scripts committed) |
+| SonarQube findings | 7 MAJOR/MINOR issues | Dead fields, generic exceptions, string duplication |
+
+---
+
+## 4. Risk Assessment
+
+| Risk | Probability | Impact | Mitigation |
+|------|-------------|--------|------------|
+| Document data leak via IDOR | High (any authenticated user) | Critical (DSGVO breach, multi-tenant violation) | Fix #1: Add tenant verification to DocumentController |
+| Arbitrary file write via path traversal | Medium (requires auth + upload permission) | High (server compromise) | Fix #2: Sanitize with `FilenameUtils.getName()` |
+| Broken deployment from untested code | Medium (no test gate) | High (production outage) | Add test step to deploy.yml |
+| Low test confidence for future changes | Ongoing | Medium (regression risk) | Expand backend test suite |
+
+---
+
+## 5. Solution Options
+
+### Option A: Minimal Security Fix Only (2-3 hours)
+- Fix 3 remaining security blockers
+- No CI/CD changes, no test expansion, no cleanup
+- **Pro:** Fastest path to unblock deployment
+- **Con:** Leaves test debt and CI risk intact; next feature sprint can introduce regressions
+
+### Option B: Security + CI Quality Gate (4-6 hours)
+- Fix 3 security blockers
+- Add Maven test + Playwright test steps to CI
+- Basic repo cleanup (package.json, README)
+- **Pro:** Production-safe deployment pipeline, reasonable effort
+- **Con:** Test coverage still low for service/domain layer
+
+### Option C: Full Hardening Sprint (8-12 hours) ⬅️ RECOMMENDED
+- Fix 3 security blockers
+- Expand backend test suite (target: DocumentService, AuthService, key service methods)
+- Wire tests into CI/CD pipeline (fail-fast on test failure)
+- CORS configuration externalization
+- Login rate limiting
+- Complete repo cleanup (README, package.json, dead files, SonarQube fixes)
+- **Pro:** Production-ready with confidence, clean repo, future-proof
+- **Con:** Full sprint investment (no new features)
+
+---
+
+## 6. Recommendation
+
+**Option C** — This is the right time for a full hardening sprint. The project is feature-complete for MVP, Sprint 12 already built the test infrastructure, and the security blockers have been unfixed since Sprint 9. A half-measure (Option A/B) would leave known technical debt that compounds with every future sprint.
+
+Priority ordering:
+1. **Security fixes** (unblocks production) — ~2 hours
+2. **CI test gate** (prevents future regressions) — ~2 hours
+3. **Backend test expansion** (confidence for the security fixes themselves) — ~4 hours
+4. **Repo cleanup + CORS + rate limiting** (polish) — ~2 hours
+
+---
+
+## 7. Open Questions
+
+- [ ] Should CORS allowed origins come from `application.properties` or environment variables?
+- [ ] Login rate limiting: Bucket4j (Spring-native) or custom filter with in-memory counter?
+- [ ] Target test coverage % for this sprint? (Suggest: cover all security-critical paths = DocumentService, AuthService, TenantFilterAspect)

docs/sprint-13/cannamanage-sprint13-plan.md

@@ -0,0 +1,337 @@
+# Plan: Sprint 13 — Production Hardening
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v2 (panel review incorporated)
+**Basis:** cannamanage-sprint13-analysis.md
+
+---
+
+## Background
+
+Sprint 13 addresses 3 remaining production-blocking security vulnerabilities (1 was already fixed), wires the existing test infrastructure into CI/CD as a quality gate, expands backend test coverage for security-critical paths, and performs repo cleanup. No new features — pure hardening.
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                     Security Hardening Layer                      │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                   │
+│  SecurityConfig ──► Role matchers for /api/v1/documents/**       │
+│                                                                   │
+│  DocumentController ──► @PreAuthorize + tenant verification      │
+│                                                                   │
+│  DocumentService ──► FilenameUtils.getName() sanitization        │
+│                ──► Explicit clubId check on download/delete       │
+│                                                                   │
+├─────────────────────────────────────────────────────────────────┤
+│                     CI/CD Quality Gate                            │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                   │
+│  deploy.yml ──► [Checkout] → [Test Backend] → [Test Frontend]   │
+│             ──► [Build Images] → [Deploy] → [Health Check]       │
+│                                                                   │
+├─────────────────────────────────────────────────────────────────┤
+│                     Operational Hardening                         │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                   │
+│  CORS ──► Externalized via application.properties                │
+│  Rate Limiting ──► Bucket4j on /api/v1/auth/login                │
+│                                                                   │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Components
+
+| # | Component | Module | Action |
+|---|-----------|--------|--------|
+| 1 | DocumentController | cannamanage-api | Add `@PreAuthorize`, tenant verification |
+| 2 | DocumentService | cannamanage-service | Sanitize filename, add clubId check |
+| 3 | SecurityConfig | cannamanage-api | Add document endpoint matchers |
+| 4 | deploy.yml | .gitea/workflows | Add test steps before deployment |
+| 5 | DocumentServiceTest | cannamanage-service | New — comprehensive test class |
+| 6 | DocumentControllerTest | cannamanage-api | New — security-focused integration tests |
+| 7 | AuthServiceTest | cannamanage-api | New — auth flow tests |
+| 8 | SecurityConfig | cannamanage-api | Externalize CORS origins |
+| 9 | RateLimitFilter | cannamanage-api | New — login rate limiting |
+| 10 | package.json | cannamanage-frontend | Fix project name |
+| 11 | README.md | root | New — project documentation |
+
+---
+
+## Implementation Steps
+
+### Phase 1: Security Fixes (Priority: CRITICAL)
+
+#### Step 1.1 — Fix IDOR in DocumentController
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/controller/DocumentController.java`
+
+- Add `@PreAuthorize("hasAnyRole('ADMIN', 'STAFF', 'MEMBER')")` on class level
+- Inject `SecurityContextHolder` to extract current user's `clubId`
+- On `downloadDocument(UUID id)`: after fetching the document, verify `document.getClubId().equals(currentUser.getClubId())`
+- On `deleteDocument(UUID id)`: same tenant check + require `ADMIN` or `STAFF` role
+- Return `404 Not Found` if tenant mismatch — prevents object enumeration. An attacker should not be able to determine whether a document UUID exists in another tenant.
+
+**Prerequisite:** Verify that portal JWT tokens include the `clubId` claim. If portal tokens lack `clubId`, portal document downloads will 403. Check `PortalAuthService` / `JwtService` token generation to confirm the claim is present before implementing tenant verification.
+
+#### Step 1.2 — Fix Path Traversal in DocumentService
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java`
+
+- Replace `file.getOriginalFilename()` with `FilenameUtils.getName(file.getOriginalFilename())`
+- Add null check: if result is blank, use `"document"` as fallback
+- Add dependency on `commons-io` if not already present (it is — used by BankImportService)
+- Pattern: consistent with existing [`BankImportService`](cannamanage-service/src/main/java/de/cannamanage/service/bankimport/BankImportService.java) which already does this correctly
+
+#### Step 1.3 — Add Document Endpoint Matchers to SecurityConfig
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java`
+
+Add explicit matchers in `apiSecurityFilterChain()`:
+```java
+.requestMatchers(HttpMethod.GET, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF", "MEMBER")
+.requestMatchers(HttpMethod.POST, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
+.requestMatchers(HttpMethod.DELETE, "/api/v1/documents/**").hasAnyRole("ADMIN", "STAFF")
+```
+
+Place these BEFORE the `.anyRequest().authenticated()` catch-all.
+
+---
+
+### Phase 2: CI/CD Quality Gate (Priority: HIGH)
+
+#### Step 2.1 — Add Backend Test Step to deploy.yml
+
+**File:** `.gitea/workflows/deploy.yml`
+
+Insert a new step after checkout, before Docker build:
+```yaml
+- name: Run backend tests
+  run: |
+    set -euo pipefail
+    cd cannamanage-api
+    mvn test --batch-mode -f pom.xml
+```
+
+**Note:** Maven is available in the runner image. The Maven Wrapper (`mvnw`) is not committed to this repo.
+
+This runs all backend tests. If any test fails, the deploy is aborted.
+
+#### Step 2.2 — Add Frontend Lint/Type-Check Step
+
+**Prerequisite:** Add `"type-check": "tsc --noEmit"` to `cannamanage-frontend/package.json` scripts.
+
+Insert after backend tests:
+```yaml
+- name: Frontend type check
+  run: |
+    set -euo pipefail
+    cd cannamanage-frontend
+    corepack enable
+    pnpm install --frozen-lockfile
+    pnpm run lint
+    pnpm run type-check
+```
+
+**Note:** Full Playwright integration tests are too heavy for every push (require Docker-in-Docker). Keep those for manual/nightly runs via `docker-compose.test.yml`.
+
+#### Step 2.3 — Make Frontend Health Check Blocking
+
+**File:** `.gitea/workflows/deploy.yml`
+
+Change the frontend verify step to `exit 1` on failure instead of just logging a warning.
+
+---
+
+### Phase 3: Backend Test Expansion (Priority: HIGH)
+
+#### Step 3.1 — DocumentServiceTest (new)
+
+**File:** `cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java`
+
+Test cases:
+- `testUploadDocument_sanitizesFilename()` — verify path traversal attempt is neutralized
+- `testUploadDocument_nullFilename_usesFallback()` — null filename → "document"
+- `testUploadDocument_validFilename_preserved()` — normal filename passes through
+- `testDownloadDocument_wrongTenant_throwsForbidden()` — tenant isolation
+- `testDownloadDocument_correctTenant_returnsContent()` — happy path
+- `testDeleteDocument_wrongTenant_throwsForbidden()` — tenant isolation on delete
+- `testDeleteDocument_adminRole_succeeds()` — admin can delete
+
+#### Step 3.2 — DocumentControllerSecurityTest (new)
+
+**File:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerSecurityTest.java`
+
+Integration tests using `@WebMvcTest` + `@WithMockUser`:
+- `testDownload_unauthenticated_returns401()`
+- `testDownload_wrongTenant_returns403()`
+- `testDownload_correctTenant_returns200()`
+- `testDelete_memberRole_returns403()` — MEMBER cannot delete
+- `testDelete_staffRole_returns200()` — STAFF can delete
+- `testUpload_memberRole_returns403()` — MEMBER cannot upload
+- `testUpload_staffRole_returns200()`
+
+#### Step 3.3 — AuthServiceTest (new)
+
+**File:** `cannamanage-api/src/test/java/de/cannamanage/api/service/AuthServiceTest.java`
+
+- `testLogin_validCredentials_returnsTokenPair()`
+- `testLogin_invalidPassword_throws401()`
+- `testLogin_nonExistentUser_throws401()`
+- `testRefreshToken_validToken_returnsNewAccess()`
+- `testRefreshToken_expired_throws401()`
+- `testSha256_consistent()` — hashing determinism
+
+#### Step 3.4 — SecurityConfigTest (new)
+
+**File:** `cannamanage-api/src/test/java/de/cannamanage/api/security/SecurityConfigTest.java`
+
+Verify URL pattern matching:
+- `testDocumentEndpoints_requireAuthentication()`
+- `testAuthEndpoints_arePublic()`
+- `testActuatorHealth_isPublic()`
+
+---
+
+### Phase 4: Operational Hardening (Priority: MEDIUM)
+
+#### Step 4.1 — Externalize CORS Configuration
+
+**File:** `cannamanage-api/src/main/resources/application.properties`
+
+Add:
+```properties
+cannamanage.cors.allowed-origins=${CORS_ALLOWED_ORIGINS:http://localhost:3000}
+```
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java`
+
+Replace hardcoded origins with `@Value("${cannamanage.cors.allowed-origins}")` and split on comma.
+
+#### Step 4.2 — Login Rate Limiting
+
+Add Bucket4j dependency to `cannamanage-api/pom.xml`:
+```xml
+<dependency>
+    <groupId>com.bucket4j</groupId>
+    <artifactId>bucket4j-core</artifactId>
+    <version>8.10.1</version>
+</dependency>
+```
+
+Add Caffeine dependency to `cannamanage-api/pom.xml`:
+```xml
+<dependency>
+    <groupId>com.github.ben-manes.caffeine</groupId>
+    <artifactId>caffeine</artifactId>
+    <version>3.1.8</version>
+</dependency>
+```
+
+Create `cannamanage-api/src/main/java/de/cannamanage/api/security/LoginRateLimitFilter.java`:
+- Use Caffeine cache (TTL-based eviction) instead of raw ConcurrentHashMap
+- Key: IP address, Value: Bucket
+- Max entries: 10,000
+- TTL: 10 minutes (auto-evicts stale entries, prevents memory leak under DDoS)
+- Limit: 5 attempts per minute per IP
+- Applies only to `POST /api/v1/auth/login`
+- Returns `429 Too Many Requests` with `Retry-After` header when exceeded
+- Register in SecurityConfig filter chain
+
+---
+
+### Phase 5: Repo Cleanup (Priority: LOW)
+
+#### Step 5.1 — Fix package.json Project Name
+
+**File:** `cannamanage-frontend/package.json`
+
+Change `"name": "shadboard-nextjs-starter-kit"` → `"name": "cannamanage-frontend"`
+
+#### Step 5.2 — Remove Dead .github Directory
+
+```bash
+rm -rf .github/
+```
+
+Only if `.github/` contains GitHub-specific config (Actions, Dependabot) that doesn't apply to Gitea.
+
+#### Step 5.3 — Create Root README
+
+**File:** `README.md`
+
+Minimal project README: what it is, how to run locally, how to deploy, architecture overview.
+
+#### Step 5.4 — Clean Up Leftover Screenshot Scripts
+
+Remove one-shot `.mjs` scripts from `cannamanage-frontend/`:
+- `upload-dialog-screenshot.mjs`
+- `sprint12-final.mjs`
+- `sprint12-v2.mjs`
+
+These were development utilities, not part of the test suite.
+
+#### Step 5.5 — Fix SonarQube Findings
+
+Address 7 MAJOR/MINOR findings from the security review:
+- Remove unused `auditService` field in DocumentService (or wire it up for audit logging)
+- Replace generic `throw new Exception()` in Camt053Parser with specific exception
+- Replace generic `RuntimeException` in AuthService.sha256() with custom exception
+- Extract duplicated `"Invalid credentials"` string to constant
+- Fix static access via instance in Camt053Parser
+
+---
+
+## Dependency Order
+
+```
+Step 1.1 ──┐
+Step 1.2 ──┼──► Step 3.1 (tests verify the fixes)
+Step 1.3 ──┘         │
+                     ▼
+              Step 3.2 (controller security tests)
+                     │
+                     ▼
+              Step 2.1 (CI runs these tests)
+              Step 2.2
+              Step 2.3
+                     │
+                     ▼
+              Step 4.1, 4.2 (operational hardening)
+              Step 5.1–5.5 (cleanup, parallel)
+```
+
+---
+
+## Acceptance Criteria
+
+1. ✅ No authenticated user can download/delete documents from another tenant
+2. ✅ Path traversal filenames are sanitized before storage
+3. ✅ `/api/v1/documents/**` has explicit role matchers in SecurityConfig
+4. ✅ CI pipeline runs backend tests before deployment (fails on test failure)
+5. ✅ CI pipeline runs frontend lint + type-check before deployment
+6. ✅ At least 15 new backend tests covering security-critical paths
+7. ✅ CORS origins configurable via environment variable
+8. ✅ Login endpoint rate-limited (5 attempts/min/IP)
+9. ✅ `package.json` has correct project name
+10. ✅ Root README exists
+
+---
+
+## Estimated Effort
+
+| Phase | Effort | Cumulative |
+|-------|--------|------------|
+| Phase 1: Security Fixes | ~2h | 2h |
+| Phase 2: CI Quality Gate | ~1.5h | 3.5h |
+| Phase 3: Backend Tests | ~3h | 6.5h |
+| Phase 4: Operational Hardening | ~2h | 8.5h |
+| Phase 5: Repo Cleanup | ~1h | 9.5h |
+
+**Total: ~9.5 hours** (full sprint day)

docs/sprint-13/cannamanage-sprint13-testplan.md

@@ -0,0 +1,585 @@
+# Testplan: Sprint 13 — Production Hardening
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v1
+**Basis:** cannamanage-sprint13-plan.md
+
+---
+
+## Test Overview
+
+| ID | Description | Type | Class | Status |
+|----|-------------|------|-------|--------|
+| T-01 | Path traversal filename sanitization | Unit | `DocumentServiceTest` | ⬜ |
+| T-02 | Null filename fallback | Unit | `DocumentServiceTest` | ⬜ |
+| T-03 | Valid filename preserved | Unit | `DocumentServiceTest` | ⬜ |
+| T-04 | Download wrong tenant — forbidden | Unit | `DocumentServiceTest` | ⬜ |
+| T-05 | Download correct tenant — success | Unit | `DocumentServiceTest` | ⬜ |
+| T-06 | Delete wrong tenant — forbidden | Unit | `DocumentServiceTest` | ⬜ |
+| T-07 | Delete admin role — success | Unit | `DocumentServiceTest` | ⬜ |
+| T-08 | Download unauthenticated — 401 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-09 | Download wrong tenant — 403 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-10 | Download correct tenant — 200 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-11 | Delete as MEMBER — 403 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-12 | Delete as STAFF — 200 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-13 | Upload as MEMBER — 403 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-14 | Upload as STAFF — 200 | Integration | `DocumentControllerSecurityTest` | ⬜ |
+| T-15 | Login valid credentials — token pair | Unit | `AuthServiceTest` | ⬜ |
+| T-16 | Login invalid password — 401 | Unit | `AuthServiceTest` | ⬜ |
+| T-17 | Login non-existent user — 401 | Unit | `AuthServiceTest` | ⬜ |
+| T-18 | Refresh token valid — new access token | Unit | `AuthServiceTest` | ⬜ |
+| T-19 | Refresh token expired — 401 | Unit | `AuthServiceTest` | ⬜ |
+| T-20 | SHA-256 hashing deterministic | Unit | `AuthServiceTest` | ⬜ |
+| T-21 | Document endpoints require auth | Integration | `SecurityConfigTest` | ⬜ |
+| T-22 | Auth endpoints are public | Integration | `SecurityConfigTest` | ⬜ |
+| T-23 | Actuator health is public | Integration | `SecurityConfigTest` | ⬜ |
+| T-24 | CORS allows configured origin | Integration | `SecurityConfigTest` | ⬜ |
+| T-25 | CORS rejects unconfigured origin | Integration | `SecurityConfigTest` | ⬜ |
+| T-26 | Rate limit — 5 requests pass | Integration | `LoginRateLimitFilterTest` | ⬜ |
+| T-27 | Rate limit — 6th request returns 429 | Integration | `LoginRateLimitFilterTest` | ⬜ |
+| T-28 | Rate limit — different IPs independent | Integration | `LoginRateLimitFilterTest` | ⬜ |
+| T-29 | Rate limiter evicts stale entries (Caffeine TTL) | Unit | `LoginRateLimitFilterTest` | ⬜ |
+| T-30 | CI backend tests run on push | Manual | CI/CD verification | ⬜ |
+| T-31 | CI frontend lint runs on push | Manual | CI/CD verification | ⬜ |
+| T-32 | CI blocks deploy on test failure | Manual | CI/CD verification | ⬜ |
+
+Status: ⬜ Open | ✅ Passed | ❌ Failed | ⏭️ Skipped
+
+---
+
+## Test Cases
+
+### T-01: Path Traversal Filename Sanitization
+
+**Type:** Unit
+**Class:** `cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java`
+**Method:** `testUploadDocument_pathTraversalFilename_isSanitized()`
+
+**Preconditions:**
+- DocumentService instantiated with mocked dependencies
+- Mock file storage path configured
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `"../../etc/passwd.pdf"` | Stored as `passwd.pdf` (path components stripped) |
+| b | `"../../../tmp/evil.txt"` | Stored as `evil.txt` |
+| c | `"..\\..\\windows\\system32\\bad.exe"` | Stored as `bad.exe` (backslash traversal) |
+| d | `"normal-document.pdf"` | Stored as `normal-document.pdf` (unchanged) |
+
+**Postconditions:**
+- File is stored under `{UPLOAD_BASE}/{clubId}/{docId}_{sanitizedFilename}`
+- No path escapes the upload base directory
+
+---
+
+### T-02: Null Filename Fallback
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testUploadDocument_nullFilename_usesFallback()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `null` filename | Stored as `"document"` |
+| b | Empty string `""` | Stored as `"document"` |
+| c | Whitespace only `"   "` | Stored as `"document"` |
+
+---
+
+### T-03: Valid Filename Preserved
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testUploadDocument_validFilename_preserved()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `"meeting-notes-2026.pdf"` | Stored as-is |
+| b | `"Mitgliederversammlung Protokoll.docx"` | Stored as-is (spaces allowed) |
+| c | `"report_v2.1_final.xlsx"` | Stored as-is (dots and underscores) |
+
+---
+
+### T-04: Download Wrong Tenant — Forbidden
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDownloadDocument_wrongTenant_throwsForbidden()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user's tenant context = `"club-B"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Request document by UUID belonging to different club | `AccessDeniedException` thrown |
+
+**Postconditions:**
+- No file content is returned
+- Audit log records the denied access attempt
+
+---
+
+### T-05: Download Correct Tenant — Success
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDownloadDocument_correctTenant_returnsContent()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user's tenant context = `"club-A"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Request document by valid UUID, same tenant | File bytes returned successfully |
+
+---
+
+### T-06: Delete Wrong Tenant — Forbidden
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDeleteDocument_wrongTenant_throwsForbidden()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user's tenant context = `"club-B"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Delete request for document in different club | `AccessDeniedException` thrown |
+
+**Postconditions:**
+- Document is NOT deleted
+- File remains on disk
+
+---
+
+### T-07: Delete Admin Role — Success
+
+**Type:** Unit
+**Class:** `DocumentServiceTest`
+**Method:** `testDeleteDocument_adminRole_succeeds()`
+
+**Preconditions:**
+- Document exists with `clubId = "club-A"`
+- Current user: role `ADMIN`, tenant `"club-A"`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Admin deletes own tenant's document | Document removed from DB + file system |
+
+---
+
+### T-08: Download Unauthenticated — 401
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerSecurityTest.java`
+**Method:** `testDownload_unauthenticated_returns401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | GET `/api/v1/documents/{id}/download` with no auth header | HTTP 401 |
+
+---
+
+### T-09: Download Wrong Tenant — 403
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDownload_wrongTenant_returns403()`
+
+**Preconditions:**
+- `@WithMockUser` configured for club-B
+- Document belongs to club-A
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Authenticated user requests document from different tenant | HTTP 403 |
+
+---
+
+### T-10: Download Correct Tenant — 200
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDownload_correctTenant_returns200()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Authenticated user downloads own tenant's document | HTTP 200 + file content |
+
+---
+
+### T-11: Delete as MEMBER — 403
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDelete_memberRole_returns403()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="MEMBER")` → DELETE `/api/v1/documents/{id}` | HTTP 403 |
+
+---
+
+### T-12: Delete as STAFF — 200
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testDelete_staffRole_returns200()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="STAFF")` → DELETE `/api/v1/documents/{id}` | HTTP 200 or 204 |
+
+---
+
+### T-13: Upload as MEMBER — 403
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testUpload_memberRole_returns403()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="MEMBER")` → POST `/api/v1/documents` | HTTP 403 |
+
+---
+
+### T-14: Upload as STAFF — 200
+
+**Type:** Integration
+**Class:** `DocumentControllerSecurityTest`
+**Method:** `testUpload_staffRole_returns200()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `@WithMockUser(roles="STAFF")` → POST `/api/v1/documents` with multipart file | HTTP 200 or 201 |
+
+---
+
+### T-15: Login Valid Credentials — Token Pair
+
+**Type:** Unit
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/service/AuthServiceTest.java`
+**Method:** `testLogin_validCredentials_returnsTokenPair()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Valid email + matching BCrypt password | Response contains `accessToken` (non-null, non-empty) + `refreshToken` |
+
+---
+
+### T-16: Login Invalid Password — 401
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testLogin_invalidPassword_throws401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Valid email + wrong password | Exception with 401 semantics |
+| b | Valid email + empty password | Exception with 401 semantics |
+
+---
+
+### T-17: Login Non-Existent User — 401
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testLogin_nonExistentUser_throws401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `unknown@example.com` + any password | Exception with 401 semantics |
+
+**Postconditions:**
+- Timing is consistent with valid-user path (prevent user enumeration)
+
+---
+
+### T-18: Refresh Token Valid — New Access Token
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testRefreshToken_validToken_returnsNewAccess()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Valid, non-expired refresh token | New access token returned, refresh token rotated |
+
+---
+
+### T-19: Refresh Token Expired — 401
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testRefreshToken_expired_throws401()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Refresh token past expiry date | Exception with 401 semantics |
+| b | Token hash doesn't match stored hash | Exception with 401 semantics |
+
+---
+
+### T-20: SHA-256 Hashing Deterministic
+
+**Type:** Unit
+**Class:** `AuthServiceTest`
+**Method:** `testSha256_sameInput_sameOutput()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `"test-token-123"` hashed twice | Both results are identical |
+| b | `"different-input"` | Different hash than input (a) |
+
+---
+
+### T-21: Document Endpoints Require Auth
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/security/SecurityConfigTest.java`
+**Method:** `testDocumentEndpoints_requireAuthentication()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | GET `/api/v1/documents` without auth | HTTP 401 |
+| b | POST `/api/v1/documents` without auth | HTTP 401 |
+| c | DELETE `/api/v1/documents/{id}` without auth | HTTP 401 |
+
+---
+
+### T-22: Auth Endpoints Are Public
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testAuthEndpoints_arePublic()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | POST `/api/v1/auth/login` without auth | HTTP 200 or 400 (not 401) |
+| b | POST `/api/v1/auth/register` without auth | HTTP 200 or 400 (not 401) |
+
+---
+
+### T-23: Actuator Health Is Public
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testActuatorHealth_isPublic()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | GET `/actuator/health` without auth | HTTP 200 |
+
+---
+
+### T-24: CORS Allows Configured Origin
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testCors_allowedOrigin_returns200()`
+
+**Preconditions:**
+- `cannamanage.cors.allowed-origins=http://localhost:3000,https://app.cannamanage.de`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `Origin: http://localhost:3000` | `Access-Control-Allow-Origin: http://localhost:3000` |
+| b | `Origin: https://app.cannamanage.de` | `Access-Control-Allow-Origin: https://app.cannamanage.de` |
+
+---
+
+### T-25: CORS Rejects Unconfigured Origin
+
+**Type:** Integration
+**Class:** `SecurityConfigTest`
+**Method:** `testCors_unconfiguredOrigin_noHeader()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | `Origin: https://evil.com` | No `Access-Control-Allow-Origin` header in response |
+
+---
+
+### T-26: Rate Limit — 5 Requests Pass
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/security/LoginRateLimitFilterTest.java`
+**Method:** `testRateLimit_5requests_allPass()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | 5 POST requests to `/api/v1/auth/login` from same IP within 1 minute | All return normal response (200 or 401) |
+
+---
+
+### T-27: Rate Limit — 6th Request Returns 429
+
+**Type:** Integration
+**Class:** `LoginRateLimitFilterTest`
+**Method:** `testRateLimit_6thRequest_returns429()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | 6th POST to `/api/v1/auth/login` from same IP within 1 minute | HTTP 429 + `Retry-After` header |
+
+---
+
+### T-28: Rate Limit — Different IPs Independent
+
+**Type:** Integration
+**Class:** `LoginRateLimitFilterTest`
+**Method:** `testRateLimit_differentIPs_independent()`
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | 5 requests from IP-A, then 1 request from IP-B | IP-B request passes normally |
+
+---
+
+### T-29: Rate Limiter Evicts Stale Entries (Caffeine TTL)
+
+**Type:** Unit
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/security/LoginRateLimitFilterTest.java`
+**Method:** `testRateLimiter_evictsStaleEntries()`
+
+**Preconditions:**
+- Caffeine cache configured with short TTL for testing (override via `@TestPropertySource` or direct instantiation)
+
+**Scenarios:**
+
+| # | Input | Expected Result |
+|---|-------|-----------------|
+| a | Exhaust 5 attempts from IP-A, wait for TTL to expire, then attempt again | Request passes (bucket evicted and recreated) |
+| b | Verify cache size does not grow unbounded after many unique IPs | Cache respects `maximumSize(10_000)` — old entries evicted |
+
+**Postconditions:**
+- No memory leak under simulated DDoS (many unique IPs)
+- Stale rate limit buckets are automatically cleaned up
+
+---
+
+### T-30: CI Backend Tests Run on Push
+
+**Type:** Manual
+**Verification:** Push a commit to `main`, verify Gitea Actions log shows Maven test step executing.
+
+---
+
+### T-31: CI Frontend Lint Runs on Push
+
+**Type:** Manual
+**Verification:** Push a commit to `main`, verify Gitea Actions log shows pnpm lint + type-check step executing.
+
+---
+
+### T-32: CI Blocks Deploy on Test Failure
+
+**Type:** Manual
+**Verification:** Introduce a deliberately failing test, push to `main`, verify deployment does NOT proceed and the workflow fails at the test step.
+
+---
+
+## Test Data
+
+### Documents Test Fixtures
+- Club A: UUID `"11111111-1111-1111-1111-111111111111"`, document with known UUID
+- Club B: UUID `"22222222-2222-2222-2222-222222222222"`, separate document
+
+### Auth Test Fixtures
+- Valid user: `"test@example.com"`, BCrypt password hash of `"TestPass123!"`
+- Non-existent user: `"ghost@example.com"`
+
+### Rate Limit Test Setup
+- Use `MockHttpServletRequest` with different `remoteAddr` values to simulate multiple IPs
+
+---
+
+## Test Coverage
+
+| Component | Unit | Integration | Manual | Total |
+|-----------|------|-------------|--------|-------|
+| DocumentService | 7 | 0 | 0 | 7 |
+| DocumentController | 0 | 7 | 0 | 7 |
+| AuthService | 6 | 0 | 0 | 6 |
+| SecurityConfig | 0 | 5 | 0 | 5 |
+| LoginRateLimitFilter | 1 | 3 | 0 | 4 |
+| CI/CD Pipeline | 0 | 0 | 3 | 3 |
+| **Total** | **14** | **15** | **3** | **32** |
+
+---
+
+## Execution Order
+
+1. Run unit tests first (T-01 through T-07, T-15 through T-20, T-29) — fast, no Spring context
+2. Run integration tests (T-08 through T-14, T-21 through T-28) — require `@WebMvcTest` / `@SpringBootTest`
+3. Verify CI/CD manually (T-30 through T-32) — after all code is merged
+
+---
+
+## Pass Criteria
+
+- **All 29 automated tests (T-01 through T-29) must pass** before merging
+- **All 3 manual tests (T-30 through T-32) must pass** after CI changes are deployed
+- **Zero tolerance** on security tests (T-01 through T-14) — any failure is a blocker

docs/sprint-14/cannamanage-sprint14-analysis.md

@@ -0,0 +1,123 @@
+# Analysis: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v1
+**Sprint Theme:** Marketing & Monetization
+
+---
+
+## 1. Problem Analysis
+
+CannaManage is production-ready after Sprint 13's hardening. However, the public-facing marketing surfaces are minimal — there is no landing page (the root `/` currently serves the pricing page directly via the marketing layout), the login pages use a basic centered-card layout that doesn't communicate product value, and the pricing page lacks storage quota information which is a core monetization lever.
+
+Additionally, the backend has no concept of storage quotas per tenant. Documents can be uploaded without limit, creating an unbounded cost liability on the file storage (TrueNAS/disk). Sprint 14 introduces a **StorageQuotaService** that enforces per-plan limits, making the pricing tiers meaningful at the infrastructure level.
+
+### Sprint Goals
+
+1. **Landing Page** — Create a professional homepage that converts visitors to signups
+2. **Login Redesign** — Split-layout login pages that reinforce brand value during auth flow
+3. **Pricing Rework** — Add storage tier information, update pricing model
+4. **Storage Quota Backend** — Enforce plan-based storage limits on document uploads
+
+---
+
+## 2. Affected Components
+
+| Component | Path | Role |
+|-----------|------|------|
+| Marketing layout | `cannamanage-frontend/src/app/(marketing)/layout.tsx` | Shared header/footer for marketing pages |
+| Homepage (NEW) | `cannamanage-frontend/src/app/(marketing)/page.tsx` | Landing page — hero, features, trust signals |
+| Pricing page | `cannamanage-frontend/src/app/(marketing)/pricing/page.tsx` | Pricing cards with storage tiers |
+| Auth layout | `cannamanage-frontend/src/app/(auth)/layout.tsx` | Centered flex container for login |
+| Admin login | `cannamanage-frontend/src/app/(auth)/login/page.tsx` | Admin/staff login form |
+| Portal login | `cannamanage-frontend/src/app/(portal)/portal-login/page.tsx` | Member portal login form |
+| PlanTier enum | `cannamanage-domain/src/main/java/de/cannamanage/domain/enums/PlanTier.java` | TRIAL, STARTER, PRO, ENTERPRISE |
+| Club entity | `cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Club.java` | Needs `storageUsedBytes` field |
+| Document entity | `cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Document.java` | Has `fileSize` field — source of truth for usage |
+| DocumentService | `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java` | Upload logic — needs quota check |
+| StorageQuotaService (NEW) | `cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java` | Quota calculation and enforcement |
+| StorageController (NEW) | `cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java` | REST endpoint for storage usage |
+| Flyway V36 (NEW) | `cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql` | Add storage tracking column |
+| i18n messages | `cannamanage-frontend/src/messages/de.json` | New keys for landing page, pricing storage |
+| Documents frontend service | `cannamanage-frontend/src/services/documents.ts` | Needs quota-exceeded error handling |
+
+---
+
+## 3. Current State (Ist-Zustand)
+
+### Marketing Pages
+
+- **No landing page** exists at `(marketing)/page.tsx` — the root `/` route likely falls through or shows a 404
+- **Pricing page** has 3 tiers (Starter €19, Pro €49, Enterprise) with member limits and feature lists, but **no storage information**
+- **Marketing layout** has a sticky header with logo + "Preise" + "Anmelden" links, and a footer with Produkt/Rechtliches columns
+- Navigation text is hardcoded German (not i18n) in the layout
+
+### Login Pages
+
+- **Auth layout** is a minimal centered flex container: `fixed inset-0 z-50 flex items-center justify-center`
+- **Admin login** renders a centered card with logo, email/password form, forgot password link, and portal link
+- **Portal login** is nearly identical but uses portal-specific translations and mock auth
+- Both pages use the same visual pattern — no split-layout, no brand messaging during auth
+
+### Storage Backend
+
+- **Document entity** already tracks `fileSize` (Long) per file
+- **PlanTier enum** exists: TRIAL, STARTER, PRO, ENTERPRISE
+- **No storage quota concept** exists anywhere — no `storage_used_bytes` column, no quota checks on upload
+- **DocumentService** handles upload/download/delete but never checks cumulative storage
+- Latest Flyway migration: `V35__generated_reports_add_timestamps.sql`
+
+---
+
+## 4. Risk Assessment
+
+| Risk | Probability | Impact | Mitigation |
+|------|-------------|--------|------------|
+| Landing page doesn't convert (poor copy/design) | Medium | Medium (lost signups) | Follow proven SaaS landing page patterns; iterate based on analytics |
+| Storage quota breaks existing uploads | Low | High (data loss) | Implement as soft-limit first — warn but don't block for existing over-limit tenants |
+| i18n key explosion | Low | Low (maintenance) | Group new keys under `marketing.home`, `marketing.pricing.storage` namespaces |
+| Split login layout breaks on mobile | Medium | Medium (can't log in) | Mobile-first design: left panel hidden on `<md` breakpoints |
+| Quota calculation performance (SUM query) | Low | Medium (slow uploads) | Cache quota in `storage_used_bytes` column; recalculate on upload/delete |
+
+---
+
+## 5. Solution Options
+
+### Option A: Full Sprint — All 4 Areas (Recommended)
+
+- Landing page, login redesign, pricing update, storage quota backend
+- **Effort:** ~16-20 hours
+- **Pros:** Complete marketing+monetization story, enables public launch
+- **Cons:** Larger scope, more testing surface
+
+### Option B: Frontend Only — Landing + Login + Pricing (No Backend)
+
+- Skip StorageQuotaService, just update frontend
+- **Effort:** ~8-10 hours
+- **Pros:** Faster delivery, lower risk
+- **Cons:** Storage limits are marketing fiction without enforcement
+
+### Option C: Backend Only — Storage Quota (No Marketing)
+
+- Implement quota enforcement, defer marketing pages
+- **Effort:** ~6-8 hours
+- **Pros:** Real monetization enforcement
+- **Cons:** No user-facing marketing value, can't launch publicly
+
+---
+
+## 6. Recommendation
+
+**Option A** — the full sprint. The four areas are interdependent: the pricing page promises storage limits that the backend must enforce, and the landing page is the entry point that drives users to pricing. Login redesign is a low-risk polish pass that significantly improves first impressions.
+
+The storage quota backend should be designed as an **incremental counter** (update `storage_used_bytes` on upload/delete) rather than a `SUM` query on every upload — this keeps upload latency constant regardless of document count.
+
+---
+
+## 7. Open Questions
+
+- [ ] Should the landing page include a product screenshot/mockup, or is an illustration-based hero preferred?
+- [ ] For portal login left panel: show rotating testimonials, or static feature highlights?
+- [ ] Storage overage billing (€0.15/GB/mo for Pro) — is this just displayed in pricing, or should we build the actual billing integration now?
+- [ ] Free trial — is TRIAL tier (PlanTier enum already has it) time-limited? Should landing page mention trial duration?

docs/sprint-14/cannamanage-sprint14-code-review.md

@@ -0,0 +1,124 @@
+# Code Review: Sprint 14 — Marketing & Monetization
+
+**Datum:** 2026-06-18
+**Reviewer:** Roo (Reviewer)
+**Plan:** cannamanage-sprint14-plan.md v2
+**Testplan:** cannamanage-sprint14-testplan.md v2
+**Status:** ⚠️ Approved with comments
+
+---
+
+## Zusammenfassung
+
+Implementation is solid and complete for all 5 phases. All plan components are present, i18n is complete with full DE/EN parity, the backend quota enforcement chain is correctly wired end-to-end, and the frontend properly handles 402 responses. Two warnings identified — one security-relevant deviation from plan (StorageController auth pattern) and one missing planned component (SubscriptionService tier-change hook).
+
+## Geprüfte Dateien
+
+| Datei | Änderung | Bewertung |
+|-------|---------|-----------|
+| `cannamanage-frontend/src/app/(marketing)/page.tsx` | Neu | ✅ |
+| `cannamanage-frontend/src/app/(marketing)/marketing-layout-client.tsx` | Neu | ✅ |
+| `cannamanage-frontend/src/app/(marketing)/layout.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(auth)/layout.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(auth)/login/page.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(portal)/portal-login/page.tsx` | Geändert | ✅ |
+| `cannamanage-frontend/src/app/(marketing)/pricing/page.tsx` | Geändert | ✅ (not reviewed in full — storage keys verified) |
+| `cannamanage-frontend/messages/de.json` | Geändert | ✅ |
+| `cannamanage-frontend/messages/en.json` | Geändert | ✅ |
+| `cannamanage-frontend/src/services/storage.ts` | Neu | ✅ |
+| `cannamanage-frontend/src/services/documents.ts` | Geändert | ✅ |
+| `cannamanage-service/src/main/java/.../StorageQuotaService.java` | Neu | ✅ |
+| `cannamanage-service/src/main/java/.../StorageQuotaExceededException.java` | Neu | ✅ |
+| `cannamanage-api/src/main/java/.../StorageController.java` | Neu | ⚠️ |
+| `cannamanage-api/src/main/java/.../GlobalExceptionHandler.java` | Geändert | ✅ |
+| `cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql` | Neu | ✅ |
+| `cannamanage-domain/src/main/java/.../Club.java` | Geändert | ✅ |
+| `cannamanage-service/src/main/java/.../DocumentService.java` | Geändert | ✅ |
+
+## Checkliste
+
+| # | Prüfpunkt | Ergebnis | Anmerkung |
+|---|-----------|----------|-----------|
+| 1 | Plan-Konformität | ⚠️ | StorageController uses @RequestParam instead of JWT extraction (Step 4.5). SubscriptionService hook (Step 4.9) not implemented. |
+| 2 | Kein Extra-Scope | ✅ | No scope creep detected |
+| 3 | Bestehende Patterns korrekt | ✅ | Follows existing codebase conventions (constructor injection, @Slf4j, RFC 9457 ProblemDetail) |
+| 4 | i18n vollständig (de + en) | ✅ | 26 `marketing.home` keys, 10 `marketing.nav` keys, 16 `marketing.pricing.storage` keys, 10 `comparison` keys, FAQ storage — all present in both DE and EN with zero mismatches |
+| 5 | StorageQuotaExceededException separat | ✅ | Separate class with incompatible constructor (long, long, long). QuotaExceededException maps to 409, StorageQuotaExceededException maps to 402 — correct separation. |
+| 6 | V36 Migration korrekt | ✅ | Non-destructive (`ADD COLUMN IF NOT EXISTS`), correct default (5 GB = 5368709120), backfill via SUM(documents.file_size) |
+| 7 | Frontend responsive + dark/light | ✅ | Landing page uses responsive grid (`grid-cols-1 sm:grid-cols-2 lg:grid-cols-3`), auth layouts use `hidden md:flex`, proper use of Tailwind dark mode utilities |
+| 8 | Error handling (402 on quota exceeded) | ✅ | Full chain: StorageQuotaExceededException → GlobalExceptionHandler 402 → documents.ts catches status 402 → throws typed error with problemDetail |
+
+## Befunde
+
+### ⚠️ WARNING-1: StorageController auth deviation from plan
+
+**Datei:** [`StorageController.java`](cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java:29)
+
+**Plan (Step 4.5)** specified:
+```java
+@GetMapping("/usage")
+public ResponseEntity<StorageUsageDTO> getUsage(@AuthenticationPrincipal UserDetails user) {
+    UUID clubId = extractClubId(user);
+    // ...
+}
+```
+
+**Actual implementation:**
+```java
+@GetMapping("/usage")
+public ResponseEntity<StorageUsageDTO> getUsage(@RequestParam UUID clubId) {
+    return ResponseEntity.ok(storageQuotaService.getUsage(clubId));
+}
+```
+
+- **Risiko:** Any authenticated ADMIN/STAFF user can query any club's storage usage by passing an arbitrary `clubId`. The plan's approach enforced tenant isolation by deriving the club from the JWT token.
+- **Empfehlung:** Replace `@RequestParam UUID clubId` with `@AuthenticationPrincipal` extraction pattern used elsewhere (e.g., DocumentController). This ensures users can only see their own club's data. If cross-club access is intentional (admin panel use case), add a separate admin-only endpoint.
+
+---
+
+### ⚠️ WARNING-2: SubscriptionService tier-change hook not implemented
+
+**Plan (Step 4.9)** specified a `SubscriptionService.onTierChange(UUID clubId, PlanTier newTier)` method to update `storage_limit_bytes` when a club changes tier.
+
+- **Not found** in the implementation.
+- **Impact:** Low — the plan's own note says "Full subscription management (Stripe webhooks, billing cycle, trial-to-paid) is deferred to a future sprint." The hook would currently be dead code.
+- **Empfehlung:** Acceptable to defer. When subscription management is implemented, this hook must be added. The `StorageQuotaService.getLimitForTier()` already exists to support it.
+
+---
+
+### ℹ️ INFO-1: getLimitForTier takes String instead of PlanTier enum
+
+**Datei:** [`StorageQuotaService.java`](cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java:86)
+
+Plan specified `getLimitForTier(PlanTier tier)` but implementation uses `getLimitForTier(String tier)` with a switch on lowercase string matching. This is pragmatic since no `PlanTier` enum exists yet in the domain module. When the enum is created, update the method signature.
+
+---
+
+### ℹ️ INFO-2: Marketing layout extracted to client component
+
+**Datei:** [`marketing-layout-client.tsx`](cannamanage-frontend/src/app/(marketing)/marketing-layout-client.tsx:1)
+
+The plan didn't explicitly specify this separation, but it's a correct architectural choice: the server-side `layout.tsx` handles `getMessages()` and wraps with `NextIntlClientProvider`, while the client component handles the actual rendering with `useTranslations`. This follows Next.js 14 best practices for server/client component boundaries.
+
+---
+
+### ℹ️ INFO-3: Frontend storage service uses apiClient with clubId param
+
+**Datei:** [`storage.ts`](cannamanage-frontend/src/services/storage.ts:12)
+
+The frontend `getStorageUsage(clubId: string)` matches the backend's `@RequestParam UUID clubId`. This is consistent — but both should be updated together if WARNING-1 is addressed (the frontend would then not need to pass clubId explicitly).
+
+## Tests
+
+- **Backend-Tests ausgeführt:** Nicht im Scope dieses Reviews (kein Build-Ausführung angefordert)
+- **Testplan T-14 bis T-32:** Backend unit/integration tests not yet verified as passing
+- **E2E T-01 bis T-13:** Frontend E2E tests not executed in this review
+
+## Empfehlung
+
+**⚠️ Approved with comments** — merge is acceptable, but WARNING-1 (StorageController tenant isolation) should be addressed before production deployment. WARNING-2 (SubscriptionService hook) is acceptable to defer.
+
+### Prioritized actions:
+1. **Before production:** Fix StorageController to use JWT-based club extraction instead of `@RequestParam`
+2. **Next sprint:** Add SubscriptionService tier-change hook when billing features are implemented
+3. **Housekeeping:** Introduce `PlanTier` enum and update `getLimitForTier` signature

docs/sprint-14/cannamanage-sprint14-plan-review.md

@@ -0,0 +1,86 @@
+# Plan Review: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Module:** cannamanage (full-stack)
+**Reviewer:** Lumen (Plan Reviewer)
+**Documents:** analysis v1, plan v2, testplan v2
+**Verdict:** ✅ APPROVED
+
+---
+
+## Summary
+
+Re-review after v1 findings were addressed. All 4 findings (1 blocker, 3 warnings) from the v1 review have been properly resolved in v2. The plan is complete, correct, and ready for implementation.
+
+## v1 Finding Resolution
+
+| # | v1 Finding | Resolution in v2 | Status |
+|---|-----------|------------------|--------|
+| 1 | ❌ `QuotaExceededException` naming conflict | Renamed to `StorageQuotaExceededException` in Step 4.4 with explicit note about existing class | ✅ Fixed |
+| 2 | ⚠️ No sync for `storage_limit_bytes` on tier change | Added Step 4.9 `onTierChange()` hook in `SubscriptionService` | ✅ Fixed |
+| 3 | ⚠️ English i18n keys not specified | Step 1.3 now states both `de.json` and `en.json` must receive equivalent keys; T-32 tests both | ✅ Fixed |
+| 4 | ⚠️ `extractClubId(user)` not defined | Step 4.5 now has full implementation with Javadoc referencing `DocumentController` pattern | ✅ Fixed |
+
+## Reviewed Documents
+
+| Document | Version | Assessment |
+|----------|---------|-----------|
+| Analysis | v1 | ✅ |
+| Plan | v2 | ✅ |
+| Testplan | v2 | ✅ |
+
+## Checklist
+
+### Assessment
+
+| # | Check | Result | Note |
+|---|-------|--------|------|
+| 1 | Problem statement complete | ✅ | Clear: no landing page, no quota enforcement, basic login UI |
+| 2 | Affected components identified | ✅ | 15 components listed (was 14, +1 for new `StorageQuotaExceededException`) |
+| 3 | Current state accurate | ✅ | Confirmed: no `(marketing)/page.tsx`, nav is hardcoded, V35 is latest migration |
+| 4 | Risk assessment realistic | ✅ | 5 risks with appropriate mitigations |
+| 5 | Solution options evaluated | ✅ | 3 options with effort estimates, Option A justified |
+
+### Implementation Plan
+
+| # | Check | Result | Note |
+|---|-------|--------|------|
+| 6 | All requirements covered | ✅ | All 4 areas: landing, login, pricing, storage quota |
+| 7 | Correct patterns referenced | ✅ | `NextIntlClientProvider`, Spring `@Service`, `@PreAuthorize`, `CustomUserDetails` cast pattern |
+| 8 | File paths correct | ✅ | All verified against codebase |
+| 9 | Implementation order logical | ✅ | Frontend (phases 1-3) → backend (phase 4) → integration (phase 5) |
+| 10 | No gaps in steps | ✅ | Migration → entity → service → controller → exception → security config → tier-sync — complete chain |
+| 11 | Flyway migrations planned | ✅ | V36 correct next number, H2-only appropriate for this project |
+| 12 | Error handling planned | ✅ | 402 with RFC 9457 ProblemDetail, floor-at-zero for decrements |
+| 13 | No scope creep | ✅ | Explicitly defers overage billing and email notifications |
+
+### Testplan
+
+| # | Check | Result | Note |
+|---|-------|--------|------|
+| 14 | Coverage complete | ✅ | Every plan step has ≥1 test. 32 tests across 4 areas. |
+| 15 | Test types appropriate | ✅ | E2E for UI (Playwright), Unit for service logic, Integration for controllers |
+| 16 | Edge cases covered | ✅ | Floor-at-zero (T-19), exactly-at-limit (T-15c, T-16b), near-limit thresholds |
+| 17 | Test class naming correct | ✅ | `StorageQuotaServiceTest`, `StorageControllerTest`, `DocumentServiceTest` |
+| 18 | Test method naming correct | ✅ | `testGetUsage_calculatesCorrectly()`, `testCheckQuota_overLimit_throwsQuotaExceeded()` |
+| 19 | Test data defined | ✅ | Explicit UUIDs, byte values, and preconditions documented |
+| 20 | SSH/manual tests identified | N/A | Not a PAISY project |
+
+## Traceability Matrix
+
+| Acceptance Criterion | Plan Step | Test Case(s) | Status |
+|---------------------|-----------|-------------|--------|
+| AC1: Landing page renders | Step 1.1 | T-01 | ✅ Covered |
+| AC2: Landing responsive + dark/light | Step 1.1 | T-02, T-03 | ✅ Covered |
+| AC3: Admin login split layout | Steps 2.1, 2.2 | T-06, T-07, T-08 | ✅ Covered |
+| AC4: Portal login member-themed | Step 2.3 | T-09, T-10 | ✅ Covered |
+| AC5: Pricing shows storage | Steps 3.1-3.3 | T-11, T-12 | ✅ Covered |
+| AC6: Pricing FAQ storage | Step 3.4 | T-13 | ✅ Covered |
+| AC7: GET /api/v1/storage/usage | Steps 4.3, 4.5 | T-23, T-24, T-25 | ✅ Covered |
+| AC8: Upload rejected 402 | Steps 4.3, 4.6, 4.7 | T-16, T-27, T-31 | ✅ Covered |
+| AC9: Delete decrements counter | Step 4.6 | T-18, T-28 | ✅ Covered |
+| AC10: Backfill on migration | Step 4.1 | T-29, T-30 | ✅ Covered |
+
+## Verdict
+
+**✅ APPROVED** — All 20 checklist items pass. All 4 v1 findings resolved. Plan is complete, correct, and ready for implementation. Recommend GO.

docs/sprint-14/cannamanage-sprint14-plan.md

@@ -0,0 +1,571 @@
+# Plan: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v2
+**Basis:** cannamanage-sprint14-analysis.md
+
+---
+
+## Background
+
+Sprint 14 transforms CannaManage from an internal tool into a market-ready SaaS product. It delivers four interconnected pieces: a converting landing page, premium-feeling login experiences, an updated pricing page with storage tiers, and the backend enforcement that makes storage quotas real. Together these enable the public launch.
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                     Frontend — Marketing Layer                        │
+├─────────────────────────────────────────────────────────────────────┤
+│                                                                       │
+│  (marketing)/page.tsx ──► Landing page (hero, features, CTA)         │
+│  (marketing)/pricing/page.tsx ──► Updated with storage tiers         │
+│  (marketing)/layout.tsx ──► Updated nav (Features link)              │
+│                                                                       │
+├─────────────────────────────────────────────────────────────────────┤
+│                     Frontend — Auth Layer                             │
+├─────────────────────────────────────────────────────────────────────┤
+│                                                                       │
+│  (auth)/layout.tsx ──► Split layout (branding left, form right)      │
+│  (auth)/login/page.tsx ──► Form-only (layout handles split)          │
+│  (portal)/portal-login/page.tsx ──► Member-themed split login        │
+│                                                                       │
+├─────────────────────────────────────────────────────────────────────┤
+│                     Backend — Storage Quota                           │
+├─────────────────────────────────────────────────────────────────────┤
+│                                                                       │
+│  StorageQuotaService ──► getUsage(clubId), checkQuota(clubId, size)  │
+│  StorageController ──► GET /api/v1/storage/usage                     │
+│  DocumentService ──► Pre-upload quota check                          │
+│  Club entity ──► storageUsedBytes column (incremental counter)       │
+│  V36 migration ──► ALTER TABLE clubs ADD storage_used_bytes          │
+│                                                                       │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Components
+
+| # | Component | Module | Action |
+|---|-----------|--------|--------|
+| 1 | Landing page | cannamanage-frontend | **New** — `(marketing)/page.tsx` |
+| 2 | Auth layout (split) | cannamanage-frontend | **Modify** — `(auth)/layout.tsx` |
+| 3 | Admin login page | cannamanage-frontend | **Modify** — remove layout wrapper, form only |
+| 4 | Portal login page | cannamanage-frontend | **Modify** — member-themed split variant |
+| 5 | Pricing page | cannamanage-frontend | **Modify** — add storage tiers, update model |
+| 6 | Marketing layout | cannamanage-frontend | **Modify** — add "Features" nav link |
+| 7 | i18n messages (de) | cannamanage-frontend | **Modify** — add marketing.home, pricing.storage keys |
+| 8 | i18n messages (en) | cannamanage-frontend | **Modify** — full English equivalents for marketing.home.* and marketing.pricing.storage.* |
+| 9 | StorageQuotaService | cannamanage-service | **New** — quota logic |
+| 10 | StorageController | cannamanage-api | **New** — REST endpoint |
+| 11 | Club entity | cannamanage-domain | **Modify** — add storageUsedBytes |
+| 12 | DocumentService | cannamanage-service | **Modify** — add quota check on upload |
+| 13 | Flyway V36 | cannamanage-api | **New** — migration SQL |
+| 14 | Frontend storage service | cannamanage-frontend | **New** — `services/storage.ts` |
+| 15 | StorageQuotaExceededException | cannamanage-service | **New** — 402 storage exception |
+
+---
+
+## Implementation Steps
+
+### Phase 1: Landing Page
+
+#### Step 1.1 — Create `(marketing)/page.tsx`
+
+**File:** `cannamanage-frontend/src/app/(marketing)/page.tsx`
+
+A full landing page with these sections:
+- **Hero** — Headline ("Die smarte Verwaltung für deinen Anbauverein"), subheadline, primary CTA (→ /pricing), secondary CTA (→ /login)
+- **Feature grid** — 6 cards in a 2×3 / 3×2 responsive grid:
+  1. Compliance Tracking (§22 KCanG documentation)
+  2. Grow Management (calendar, stages, sensors)
+  3. Member Portal (self-service, history, profile)
+  4. Distribution Quotas (25g/day, 50g/month enforcement)
+  5. Document Archive (GoBD-compliant, retention periods)
+  6. Financial Management (fees, SEPA, bank import)
+- **Trust signals** — "Für Anbauvereine in Deutschland" badge, CanVerG compliance, DSGVO/GoBD, TLS encryption
+- **Final CTA** — "Jetzt kostenlos testen" → /pricing
+
+Use `lucide-react` icons. All text via `useTranslations("marketing.home")`. Responsive: single column on mobile, grid on tablet+. Dark/light mode compatible.
+
+#### Step 1.2 — Update marketing layout navigation
+
+**File:** `cannamanage-frontend/src/app/(marketing)/layout.tsx`
+
+- Add "Features" link in header nav (scrolls to `#features` anchor on homepage, or links to `/#features`)
+- Internationalize hardcoded "Preise" and "Anmelden" strings via `useTranslations`
+- Add "Features" link to footer "Produkt" column
+
+#### Step 1.3 — Add i18n keys for landing page (de + en)
+
+**Files:**
+- `cannamanage-frontend/messages/de.json`
+- `cannamanage-frontend/messages/en.json`
+
+Both locale files must receive entries for the `marketing.home.*` and `marketing.pricing.storage.*` namespaces. The German keys are the primary source; the English file must contain equivalent translations for all keys.
+
+Add under `marketing.home` (German example):
+```json
+{
+  "marketing": {
+    "home": {
+      "heroTitle": "Die smarte Verwaltung für deinen Anbauverein",
+      "heroSubtitle": "Compliance, Anbau, Mitglieder und Abgaben — alles in einer Plattform. Rechtssicher nach KCanG.",
+      "ctaPrimary": "Preise ansehen",
+      "ctaSecondary": "Jetzt anmelden",
+      "featuresTitle": "Alles, was dein Verein braucht",
+      "featuresSubtitle": "Von der Mitgliederverwaltung bis zur Behördenmeldung — CannaManage deckt den gesamten Vereinsbetrieb ab.",
+      "feature1Title": "Compliance Tracking",
+      "feature1Desc": "Automatische Überwachung der KCanG-Vorgaben mit Fristen und Checklisten.",
+      "feature2Title": "Grow Management",
+      "feature2Desc": "Anbaukalender, Wachstumsphasen und Sensorintegration.",
+      "feature3Title": "Mitglieder-Portal",
+      "feature3Desc": "Self-Service für Mitglieder: Profil, Abgabehistorie, Dokumente.",
+      "feature4Title": "Abgabe-Quotas",
+      "feature4Desc": "Automatische Einhaltung der 25g/Tag und 50g/Monat Grenzen.",
+      "feature5Title": "Dokumenten-Archiv",
+      "feature5Desc": "GoBD-konforme Ablage mit Aufbewahrungsfristen und Versionierung.",
+      "feature6Title": "Finanzverwaltung",
+      "feature6Desc": "Mitgliedsbeiträge, SEPA-Export und Bankimport.",
+      "trustTitle": "Vertrauen durch Compliance",
+      "trustCanverg": "CanVerG-konform",
+      "trustDsgvo": "DSGVO & GoBD",
+      "trustEncryption": "TLS-verschlüsselt",
+      "trustGerman": "Hosting in Deutschland",
+      "ctaFinalTitle": "Bereit für den nächsten Schritt?",
+      "ctaFinalSubtitle": "Starte jetzt mit CannaManage und bring deinen Verein auf das nächste Level.",
+      "ctaFinalButton": "Kostenlos testen"
+    }
+  }
+}
+```
+
+---
+
+### Phase 2: Login Redesign
+
+#### Step 2.1 — Redesign auth layout to split-layout
+
+**File:** `cannamanage-frontend/src/app/(auth)/layout.tsx`
+
+Replace the simple centered container with a split layout:
+```
+┌──────────────────────────────────────────────────┐
+│  Left Panel (hidden <md)  │  Right Panel (form)  │
+│                           │                      │
+│  • App logo + name        │  {children}          │
+│  • Tagline                │                      │
+│  • 3 feature highlights   │                      │
+│  • Background gradient    │                      │
+│                           │                      │
+└──────────────────────────────────────────────────┘
+```
+
+- Left panel: `hidden md:flex md:w-1/2 lg:w-[55%]` — dark gradient background with primary color accent
+- Right panel: `w-full md:w-1/2 lg:w-[45%] flex items-center justify-center p-8`
+- Left panel content: CannaManage logo, "Dein Verein, digital verwaltet" tagline, 3 bullet points with icons (Compliance, Mitglieder, Abgaben)
+- Still wraps `{children}` in `NextIntlClientProvider`
+
+#### Step 2.2 — Adjust admin login page
+
+**File:** `cannamanage-frontend/src/app/(auth)/login/page.tsx`
+
+- Remove the logo/branding section (now in layout's left panel)
+- Keep only the form card itself: title "Anmelden", email, password, submit, forgot password, portal link
+- The page becomes purely the form — layout handles the split
+
+#### Step 2.3 — Create portal login with member theming
+
+**File:** `cannamanage-frontend/src/app/(portal)/portal-login/page.tsx`
+
+Portal login gets its own split layout inline (since it's in a different route group):
+- Left panel: member-focused messaging — "Willkommen zurück", "Dein persönlicher Bereich", icons for Abgabehistorie/Profil/Dokumente
+- Right panel: login form (same structure as admin but portal-specific translations)
+- Visual differentiation: left panel uses a slightly different gradient (e.g., emerald/teal tint vs. primary green)
+- Full-page layout (no separate layout.tsx needed — inline the split)
+
+---
+
+### Phase 3: Pricing Page Update
+
+#### Step 3.1 — Update pricing data model
+
+**File:** `cannamanage-frontend/src/app/(marketing)/pricing/page.tsx`
+
+Update the `plans` array to include storage:
+```typescript
+const plans = [
+  {
+    id: "starter",
+    icon: Leaf,
+    price: "19",
+    memberLimit: "30",
+    storage: "5",      // GB
+    features: [
+      "memberManagement",
+      "distributionTracking",
+      "complianceReports",
+      "quotaMonitoring",
+      "memberPortal",
+      "emailSupport",
+    ],
+  },
+  {
+    id: "pro",
+    icon: Cannabis,
+    price: "49",
+    memberLimit: "100",
+    storage: "50",     // GB
+    storageOverage: "0.15",  // €/GB/month
+    popular: true,
+    features: [
+      "allStarter",
+      "growCalendar",
+      "staffManagement",
+      "advancedReports",
+      "pdfExport",
+      "apiAccess",
+      "prioritySupport",
+    ],
+  },
+  {
+    id: "enterprise",
+    icon: Building2,
+    price: null,
+    memberLimit: "unlimited",
+    storage: "custom",
+    features: [
+      "allPro",
+      "unlimitedMembers",
+      "multiClub",
+      "customIntegrations",
+      "sla",
+      "dedicatedSupport",
+      "onboarding",
+    ],
+  },
+]
+```
+
+#### Step 3.2 — Render storage in plan cards
+
+In each plan card, add a storage badge below the member limit:
+- Starter: "5 GB Speicher"
+- Pro: "50 GB Speicher" + small note "(danach 0,15 €/GB/Monat)"
+- Enterprise: "Individueller Speicher"
+
+#### Step 3.3 — Add storage row to feature comparison
+
+Below the plan cards, add a comparison table section:
+
+| Feature | Starter | Pro | Enterprise |
+|---------|---------|-----|------------|
+| Mitglieder | 30 | 100 | Unbegrenzt |
+| Speicher | 5 GB | 50 GB | Individuell |
+| Überschreitung | Upgrade erforderlich | 0,15 €/GB/Mo | — |
+| Grow-Kalender | — | ✓ | ✓ |
+| API-Zugang | — | ✓ | ✓ |
+| Multi-Club | — | — | ✓ |
+
+#### Step 3.4 — Add FAQ entry about storage
+
+Add to the `faqs` array:
+```typescript
+{ id: "storage" }  // "Was passiert wenn mein Speicherplatz voll ist?"
+```
+
+i18n keys:
+- `marketing.pricing.faq.storage.question`: "Was passiert, wenn mein Speicher voll ist?"
+- `marketing.pricing.faq.storage.answer`: "Im Starter-Plan kannst du auf Pro upgraden. Im Pro-Plan wird zusätzlicher Speicher mit 0,15 €/GB/Monat berechnet. Enterprise-Kunden haben individuelle Speichervereinbarungen."
+
+---
+
+### Phase 4: Storage Quota Backend
+
+#### Step 4.1 — Flyway migration V36
+
+**File:** `cannamanage-api/src/main/resources/db/migration/V36__storage_quota.sql`
+
+```sql
+-- Add storage tracking to clubs
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_used_bytes BIGINT DEFAULT 0;
+ALTER TABLE clubs ADD COLUMN IF NOT EXISTS storage_limit_bytes BIGINT DEFAULT 5368709120;
+-- Default: 5 GB (5 * 1024^3) = Starter tier
+
+-- Backfill existing clubs with actual usage
+UPDATE clubs c SET storage_used_bytes = COALESCE(
+    (SELECT SUM(d.file_size) FROM documents d WHERE d.club_id = c.id), 0
+);
+```
+
+#### Step 4.2 — Update Club entity
+
+**File:** `cannamanage-domain/src/main/java/de/cannamanage/domain/entity/Club.java`
+
+Add fields:
+```java
+@Column(name = "storage_used_bytes", nullable = false)
+private Long storageUsedBytes = 0L;
+
+@Column(name = "storage_limit_bytes", nullable = false)
+private Long storageLimitBytes = 5_368_709_120L; // 5 GB default
+```
+
+With getters/setters.
+
+#### Step 4.3 — Create StorageQuotaService
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/StorageQuotaService.java`
+
+```java
+@Service
+@Slf4j
+public class StorageQuotaService {
+
+    private final ClubRepository clubRepository;
+
+    // Plan tier limits
+    private static final long STARTER_LIMIT = 5L * 1024 * 1024 * 1024;   // 5 GB
+    private static final long PRO_LIMIT = 50L * 1024 * 1024 * 1024;      // 50 GB
+    private static final long ENTERPRISE_LIMIT = Long.MAX_VALUE;          // Unlimited
+
+    public StorageUsageDTO getUsage(UUID clubId) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        long used = club.getStorageUsedBytes();
+        long limit = club.getStorageLimitBytes();
+        double percentage = limit > 0 ? (double) used / limit * 100 : 0;
+        return new StorageUsageDTO(used, limit, percentage);
+    }
+
+    public void checkQuota(UUID clubId, long additionalBytes) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        long newTotal = club.getStorageUsedBytes() + additionalBytes;
+        if (newTotal > club.getStorageLimitBytes()) {
+            throw new StorageQuotaExceededException(club.getStorageUsedBytes(),
+                club.getStorageLimitBytes(), additionalBytes);
+        }
+    }
+
+    public void incrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        club.setStorageUsedBytes(club.getStorageUsedBytes() + bytes);
+        clubRepository.save(club);
+    }
+
+    public void decrementUsage(UUID clubId, long bytes) {
+        Club club = clubRepository.findById(clubId).orElseThrow();
+        long newUsage = Math.max(0, club.getStorageUsedBytes() - bytes);
+        club.setStorageUsedBytes(newUsage);
+        clubRepository.save(club);
+    }
+
+    public static long getLimitForTier(PlanTier tier) {
+        return switch (tier) {
+            case TRIAL, STARTER -> STARTER_LIMIT;
+            case PRO -> PRO_LIMIT;
+            case ENTERPRISE -> ENTERPRISE_LIMIT;
+        };
+    }
+
+    public boolean isNearLimit(UUID clubId, int thresholdPercent) {
+        StorageUsageDTO usage = getUsage(clubId);
+        return usage.percentage() >= thresholdPercent;
+    }
+}
+```
+
+#### Step 4.4 — Create StorageQuotaExceededException
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/exception/StorageQuotaExceededException.java`
+
+> **Note:** The existing `QuotaExceededException` (at `cannamanage-service/src/main/java/de/cannamanage/service/exception/QuotaExceededException.java`) is reserved for CanG distribution quotas (25g/day, 50g/month) and takes a `QuotaViolationCode`. The storage exception needs its own class with an incompatible constructor signature.
+
+```java
+public class StorageQuotaExceededException extends RuntimeException {
+    private final long currentUsage;
+    private final long limit;
+    private final long requestedBytes;
+
+    public StorageQuotaExceededException(long currentUsage, long limit, long requestedBytes) {
+        super("Storage quota exceeded: current=%d, limit=%d, requested=%d"
+            .formatted(currentUsage, limit, requestedBytes));
+        this.currentUsage = currentUsage;
+        this.limit = limit;
+        this.requestedBytes = requestedBytes;
+    }
+
+    // Getters
+}
+```
+
+Map in `GlobalExceptionHandler` to HTTP 402 Payment Required with RFC 9457 problem detail.
+
+#### Step 4.5 — Create StorageController
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/controller/StorageController.java`
+
+```java
+@RestController
+@RequestMapping("/api/v1/storage")
+@PreAuthorize("hasAnyRole('ADMIN', 'STAFF')")
+public class StorageController {
+
+    private final StorageQuotaService storageQuotaService;
+
+    @GetMapping("/usage")
+    public ResponseEntity<StorageUsageDTO> getUsage(@AuthenticationPrincipal UserDetails user) {
+        UUID clubId = extractClubId(user);
+        return ResponseEntity.ok(storageQuotaService.getUsage(clubId));
+    }
+
+    /**
+     * Extracts the clubId from the authenticated user's JWT claims.
+     * The user's club association is stored as a "clubId" claim in the token,
+     * set during authentication by AuthService. This follows the same pattern
+     * used in DocumentController and other club-scoped controllers.
+     */
+    private UUID extractClubId(UserDetails user) {
+        // Cast to our CustomUserDetails which carries the clubId from JWT
+        var customUser = (CustomUserDetails) user;
+        return customUser.getClubId();
+    }
+}
+```
+
+Response DTO:
+```java
+public record StorageUsageDTO(long usedBytes, long limitBytes, double percentage) {}
+```
+
+#### Step 4.6 — Update DocumentService for quota check
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/DocumentService.java`
+
+In the upload method, add before file write:
+```java
+// Check storage quota before upload
+storageQuotaService.checkQuota(clubId, file.getSize());
+
+// ... existing upload logic ...
+
+// After successful save, increment usage counter
+storageQuotaService.incrementUsage(clubId, file.getSize());
+```
+
+In the delete method, add after file removal:
+```java
+// Decrement usage counter after successful delete
+storageQuotaService.decrementUsage(clubId, document.getFileSize());
+```
+
+#### Step 4.7 — Handle 402 in GlobalExceptionHandler
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/exception/GlobalExceptionHandler.java`
+
+Add handler:
+```java
+@ExceptionHandler(StorageQuotaExceededException.class)
+public ResponseEntity<ProblemDetail> handleStorageQuotaExceeded(StorageQuotaExceededException ex) {
+    ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.PAYMENT_REQUIRED);
+    problem.setTitle("Storage Quota Exceeded");
+    problem.setDetail("Upload would exceed storage limit. Current: " + ex.getCurrentUsage() 
+        + " bytes, Limit: " + ex.getLimit() + " bytes, Requested: " + ex.getRequestedBytes() + " bytes");
+    problem.setProperty("currentUsage", ex.getCurrentUsage());
+    problem.setProperty("limit", ex.getLimit());
+    problem.setProperty("requestedBytes", ex.getRequestedBytes());
+    return ResponseEntity.status(HttpStatus.PAYMENT_REQUIRED).body(problem);
+}
+```
+
+#### Step 4.8 — Add SecurityConfig matcher for storage endpoint
+
+**File:** `cannamanage-api/src/main/java/de/cannamanage/api/security/SecurityConfig.java`
+
+Add:
+```java
+.requestMatchers(HttpMethod.GET, "/api/v1/storage/**").hasAnyRole("ADMIN", "STAFF")
+```
+
+#### Step 4.9 — Subscription tier change hook (storage_limit_bytes sync)
+
+**File:** `cannamanage-service/src/main/java/de/cannamanage/service/SubscriptionService.java`
+
+When a club's subscription tier changes (e.g., Starter→Pro), `storage_limit_bytes` must be updated to match the new tier. Add an `onTierChange()` hook:
+
+```java
+/**
+ * Called when a club upgrades/downgrades their subscription tier.
+ * Updates the storage_limit_bytes to match the new tier's allocation.
+ */
+public void onTierChange(UUID clubId, PlanTier newTier) {
+    Club club = clubRepository.findById(clubId).orElseThrow();
+    long newLimit = StorageQuotaService.getLimitForTier(newTier);
+    club.setStorageLimitBytes(newLimit);
+    clubRepository.save(club);
+    log.info("Club {} storage limit updated to {} bytes (tier: {})", clubId, newLimit, newTier);
+}
+```
+
+> **Note:** This is a minimal hook. Full subscription management (Stripe webhooks, billing cycle, trial-to-paid) is deferred to a future sprint. For now, this method is called from the admin panel when manually changing a club's tier.
+
+---
+
+### Phase 5: Frontend Storage Integration
+
+#### Step 5.1 — Create storage service
+
+**File:** `cannamanage-frontend/src/services/storage.ts`
+
+```typescript
+export interface StorageUsage {
+  usedBytes: number
+  limitBytes: number
+  percentage: number
+}
+
+export async function getStorageUsage(): Promise<StorageUsage> {
+  const response = await fetch('/api/v1/storage/usage', { ... })
+  return response.json()
+}
+
+export function formatBytes(bytes: number): string {
+  if (bytes === 0) return '0 B'
+  const k = 1024
+  const sizes = ['B', 'KB', 'MB', 'GB', 'TB']
+  const i = Math.floor(Math.log(bytes) / Math.log(k))
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i]
+}
+```
+
+#### Step 5.2 — Handle 402 in document upload UI
+
+**File:** `cannamanage-frontend/src/services/documents.ts`
+
+In the upload handler, catch 402 responses and display a quota-exceeded toast/dialog with upgrade CTA pointing to `/pricing`.
+
+---
+
+## Open Questions
+
+- [ ] Should storage overage (Pro tier, €0.15/GB/mo) auto-allow uploads beyond limit, or still block?
+  - **Recommendation:** For now, block at limit for all tiers. Overage billing is a future sprint (requires Stripe integration).
+- [ ] Email notifications at 80%/95% — implement the hook in this sprint or defer?
+  - **Recommendation:** Implement the detection (`isNearLimit`), log a warning, defer actual email sending.
+
+---
+
+## Acceptance Criteria
+
+1. Landing page renders at `/` with hero, 6 features, trust signals, and CTA
+2. Landing page is responsive (mobile/tablet/desktop) and supports dark/light mode
+3. Admin login at `/login` shows split layout on desktop, full-width form on mobile
+4. Portal login at `/portal-login` shows member-themed split layout
+5. Pricing page shows storage limits per tier and comparison table with storage row
+6. Pricing page has FAQ entry explaining storage limits
+7. `GET /api/v1/storage/usage` returns `{ usedBytes, limitBytes, percentage }` for authenticated users
+8. Document upload is rejected with HTTP 402 when quota would be exceeded
+9. Document deletion decrements the storage counter
+10. Existing clubs have their `storage_used_bytes` backfilled on migration

docs/sprint-14/cannamanage-sprint14-testplan.md

@@ -0,0 +1,596 @@
+# Testplan: Sprint 14 — Marketing & Monetization
+
+**Date:** 2026-06-18
+**Author:** Patrick Plate / Lumen (Planner)
+**Status:** v2
+**Basis:** cannamanage-sprint14-plan.md
+
+---
+
+## Test Overview
+
+| ID | Description | Type | Class/Tool | Status |
+|----|-------------|------|------------|--------|
+| T-01 | Landing page renders all sections | E2E | Playwright | ⬜ |
+| T-02 | Landing page responsive (mobile) | E2E | Playwright | ⬜ |
+| T-03 | Landing page dark/light mode | E2E | Playwright | ⬜ |
+| T-04 | Landing page CTA links work | E2E | Playwright | ⬜ |
+| T-05 | Marketing nav shows Features link | E2E | Playwright | ⬜ |
+| T-06 | Admin login — split layout on desktop | E2E | Playwright | ⬜ |
+| T-07 | Admin login — full-width on mobile | E2E | Playwright | ⬜ |
+| T-08 | Admin login — form still functional | E2E | Playwright | ⬜ |
+| T-09 | Portal login — member-themed split | E2E | Playwright | ⬜ |
+| T-10 | Portal login — form functional | E2E | Playwright | ⬜ |
+| T-11 | Pricing — storage tiers displayed | E2E | Playwright | ⬜ |
+| T-12 | Pricing — comparison table with storage row | E2E | Playwright | ⬜ |
+| T-13 | Pricing — FAQ storage entry visible | E2E | Playwright | ⬜ |
+| T-14 | Storage usage — correct calculation | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-15 | Storage quota — allows upload under limit | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-16 | Storage quota — rejects upload over limit | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-17 | Storage quota — increment on upload | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-18 | Storage quota — decrement on delete | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-19 | Storage quota — decrement floors at zero | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-20 | Storage quota — tier limit mapping | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-21 | Storage quota — near-limit detection (80%) | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-22 | Storage quota — near-limit detection (95%) | Unit | `StorageQuotaServiceTest` | ⬜ |
+| T-23 | GET /api/v1/storage/usage — authenticated | Integration | `StorageControllerTest` | ⬜ |
+| T-24 | GET /api/v1/storage/usage — unauthenticated 401 | Integration | `StorageControllerTest` | ⬜ |
+| T-25 | GET /api/v1/storage/usage — correct DTO shape | Integration | `StorageControllerTest` | ⬜ |
+| T-26 | Document upload — quota check integrated | Integration | `DocumentServiceTest` | ⬜ |
+| T-27 | Document upload — 402 on quota exceeded | Integration | `DocumentControllerTest` | ⬜ |
+| T-28 | Document delete — usage decremented | Integration | `DocumentServiceTest` | ⬜ |
+| T-29 | Flyway V36 — migration applies cleanly | Integration | Flyway boot test | ⬜ |
+| T-30 | Flyway V36 — backfill calculates correctly | Integration | SQL verification | ⬜ |
+| T-31 | StorageQuotaExceededException — 402 response format | Unit | `GlobalExceptionHandlerTest` | ⬜ |
+| T-32 | i18n — all marketing.home keys resolve (de + en) | Unit | Lint / next-intl | ⬜ |
+
+Status: ⬜ Open | ✅ Passed | ❌ Failed | ⏭️ Skipped
+
+---
+
+## Test Cases
+
+### T-01: Landing Page Renders All Sections
+
+**Type:** E2E
+**Tool:** Playwright
+**Script:** `e2e/marketing/landing-page.spec.ts`
+
+**Preconditions:**
+- App running at localhost:3000
+- No authentication required (public page)
+
+**Scenarios:**
+
+| # | Action | Expected Result |
+|---|--------|-----------------|
+| a | Navigate to `/` | Page loads without errors |
+| b | Check hero section | Headline text visible, CTA buttons present |
+| c | Check feature grid | 6 feature cards visible with titles and descriptions |
+| d | Check trust signals | At least 4 trust badges visible |
+| e | Check final CTA | "Kostenlos testen" button visible |
+
+**Postconditions:**
+- All i18n keys resolve (no raw key strings visible)
+- No console errors
+
+---
+
+### T-02: Landing Page Responsive (Mobile)
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 375×812)
+
+**Scenarios:**
+
+| # | Viewport | Expected Result |
+|---|----------|-----------------|
+| a | 375×812 (iPhone) | Feature grid stacks to single column |
+| b | 375×812 | Hero section full-width, text wraps cleanly |
+| c | 768×1024 (iPad) | Feature grid shows 2 columns |
+| d | 1280×720 (desktop) | Feature grid shows 3 columns |
+
+---
+
+### T-03: Landing Page Dark/Light Mode
+
+**Type:** E2E
+**Tool:** Playwright (`colorScheme: 'dark'` / `'light'`)
+
+**Scenarios:**
+
+| # | Mode | Expected Result |
+|---|------|-----------------|
+| a | Dark | Background is dark, text is light, no contrast issues |
+| b | Light | Background is light, text is dark, cards have proper borders |
+| c | Switch | Toggle theme mid-page — re-renders correctly |
+
+---
+
+### T-04: Landing Page CTA Links
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Element | Expected Navigation |
+|---|---------|-------------------|
+| a | Primary CTA ("Preise ansehen") | Navigates to `/pricing` |
+| b | Secondary CTA ("Jetzt anmelden") | Navigates to `/login` |
+| c | Final CTA ("Kostenlos testen") | Navigates to `/pricing` |
+| d | Header "Features" link | Scrolls to `#features` section or navigates to `/#features` |
+
+---
+
+### T-05: Marketing Nav Features Link
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Page | Expected |
+|---|------|----------|
+| a | `/` | Header shows "Features" link |
+| b | `/pricing` | Header shows "Features" link |
+| c | Click "Features" from `/pricing` | Navigates to homepage features section |
+
+---
+
+### T-06: Admin Login — Split Layout Desktop
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 1280×720)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Left panel visible | Branding panel with logo, tagline, feature bullets visible |
+| b | Right panel visible | Login form visible |
+| c | Layout proportions | Left panel ~55%, right panel ~45% |
+| d | Left panel content | "CannaManage" text, tagline, 3 feature highlights with icons |
+
+---
+
+### T-07: Admin Login — Full-Width Mobile
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 375×812)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Left panel | Hidden (`hidden md:flex`) |
+| b | Form panel | Full width, centered vertically |
+| c | Form usability | All fields accessible, submit button tappable |
+
+---
+
+### T-08: Admin Login — Form Still Functional
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Preconditions:**
+- Backend running with test credentials available
+
+**Scenarios:**
+
+| # | Input | Expected |
+|---|-------|----------|
+| a | Valid credentials | Redirects to `/dashboard` |
+| b | Invalid password | Error message displayed |
+| c | Empty fields | Validation errors shown |
+
+---
+
+### T-09: Portal Login — Member-Themed Split
+
+**Type:** E2E
+**Tool:** Playwright (viewport: 1280×720)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Left panel | Member-specific messaging ("Willkommen zurück") |
+| b | Visual theme | Different gradient than admin login (teal/emerald vs. primary green) |
+| c | Feature bullets | Member-relevant: Abgabehistorie, Profil, Dokumente |
+
+---
+
+### T-10: Portal Login — Form Functional
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Input | Expected |
+|---|-------|----------|
+| a | Submit form | Redirects to `/portal/dashboard` |
+| b | Invalid input | Error message shown |
+
+---
+
+### T-11: Pricing — Storage Tiers Displayed
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Plan | Expected Storage Display |
+|---|------|------------------------|
+| a | Starter card | "5 GB Speicher" visible |
+| b | Pro card | "50 GB Speicher" visible + overage note |
+| c | Enterprise card | "Individueller Speicher" visible |
+
+---
+
+### T-12: Pricing — Comparison Table
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Table exists | Comparison table rendered below plan cards |
+| b | Storage row | "Speicher" row shows 5 GB / 50 GB / Individuell |
+| c | Overage row | "Überschreitung" row shows values per plan |
+| d | Responsive | Table scrollable on mobile |
+
+---
+
+### T-13: Pricing — FAQ Storage Entry
+
+**Type:** E2E
+**Tool:** Playwright
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | FAQ section | Contains storage question |
+| b | Click expand | Answer mentions Starter upgrade + Pro overage pricing |
+
+---
+
+### T-14: Storage Usage Calculation
+
+**Type:** Unit
+**Class:** `cannamanage-service/src/test/java/de/cannamanage/service/StorageQuotaServiceTest.java`
+**Method:** `testGetUsage_calculatesCorrectly()`
+
+**Scenarios:**
+
+| # | Setup | Expected |
+|---|-------|----------|
+| a | Club with 1 GB used, 5 GB limit | `{ usedBytes: 1073741824, limitBytes: 5368709120, percentage: 20.0 }` |
+| b | Club with 0 bytes used | `{ usedBytes: 0, percentage: 0.0 }` |
+| c | Club with exactly limit used | `{ percentage: 100.0 }` |
+
+---
+
+### T-15: Quota Allows Upload Under Limit
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testCheckQuota_underLimit_noException()`
+
+**Scenarios:**
+
+| # | Current Usage | Limit | Upload Size | Expected |
+|---|---------------|-------|-------------|----------|
+| a | 1 GB | 5 GB | 100 MB | No exception |
+| b | 4.9 GB | 5 GB | 50 MB | No exception (4.95 GB < 5 GB) |
+| c | 0 | 5 GB | 5 GB | No exception (exactly at limit) |
+
+---
+
+### T-16: Quota Rejects Upload Over Limit
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testCheckQuota_overLimit_throwsQuotaExceeded()`
+
+**Scenarios:**
+
+| # | Current Usage | Limit | Upload Size | Expected |
+|---|---------------|-------|-------------|----------|
+| a | 4.9 GB | 5 GB | 200 MB | `StorageQuotaExceededException` thrown |
+| b | 5 GB | 5 GB | 1 byte | `StorageQuotaExceededException` thrown |
+| c | 50 GB | 50 GB | 1 KB | `StorageQuotaExceededException` thrown |
+
+---
+
+### T-17: Increment On Upload
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testIncrementUsage_addsBytes()`
+
+**Scenarios:**
+
+| # | Initial | Increment | Expected |
+|---|---------|-----------|----------|
+| a | 0 | 1048576 (1 MB) | 1048576 |
+| b | 1000000 | 500000 | 1500000 |
+
+---
+
+### T-18: Decrement On Delete
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testDecrementUsage_subtractsBytes()`
+
+**Scenarios:**
+
+| # | Initial | Decrement | Expected |
+|---|---------|-----------|----------|
+| a | 5000000 | 1000000 | 4000000 |
+| b | 1048576 | 1048576 | 0 |
+
+---
+
+### T-19: Decrement Floors at Zero
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testDecrementUsage_floorsAtZero()`
+
+**Scenarios:**
+
+| # | Initial | Decrement | Expected |
+|---|---------|-----------|----------|
+| a | 100 | 200 | 0 (not negative) |
+| b | 0 | 1000 | 0 |
+
+---
+
+### T-20: Tier Limit Mapping
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testGetLimitForTier()`
+
+**Scenarios:**
+
+| # | Tier | Expected Limit |
+|---|------|---------------|
+| a | TRIAL | 5 GB (5368709120) |
+| b | STARTER | 5 GB (5368709120) |
+| c | PRO | 50 GB (53687091200) |
+| d | ENTERPRISE | Long.MAX_VALUE |
+
+---
+
+### T-21: Near-Limit Detection 80%
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testIsNearLimit_at80Percent()`
+
+**Scenarios:**
+
+| # | Usage | Limit | Threshold | Expected |
+|---|-------|-------|-----------|----------|
+| a | 4.0 GB | 5 GB | 80% | true (80%) |
+| b | 3.9 GB | 5 GB | 80% | false (78%) |
+| c | 4.1 GB | 5 GB | 80% | true (82%) |
+
+---
+
+### T-22: Near-Limit Detection 95%
+
+**Type:** Unit
+**Class:** `StorageQuotaServiceTest`
+**Method:** `testIsNearLimit_at95Percent()`
+
+**Scenarios:**
+
+| # | Usage | Limit | Threshold | Expected |
+|---|-------|-------|-----------|----------|
+| a | 4.75 GB | 5 GB | 95% | true (95%) |
+| b | 4.7 GB | 5 GB | 95% | false (94%) |
+
+---
+
+### T-23: Storage Endpoint — Authenticated
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/StorageControllerTest.java`
+**Method:** `testGetUsage_authenticated_returns200()`
+
+**Preconditions:**
+- Test user with ADMIN role and known clubId
+- Club has pre-set `storageUsedBytes` and `storageLimitBytes`
+
+**Scenarios:**
+
+| # | Auth | Expected |
+|---|------|----------|
+| a | Valid ADMIN JWT | 200 with `{ usedBytes, limitBytes, percentage }` |
+| b | Valid STAFF JWT | 200 with correct response |
+
+---
+
+### T-24: Storage Endpoint — Unauthenticated
+
+**Type:** Integration
+**Class:** `StorageControllerTest`
+**Method:** `testGetUsage_unauthenticated_returns401()`
+
+**Scenarios:**
+
+| # | Auth | Expected |
+|---|------|----------|
+| a | No token | 401 Unauthorized |
+| b | Expired token | 401 Unauthorized |
+| c | MEMBER role | 403 Forbidden |
+
+---
+
+### T-25: Storage Endpoint — DTO Shape
+
+**Type:** Integration
+**Class:** `StorageControllerTest`
+**Method:** `testGetUsage_responseShape()`
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | JSON keys | Response contains `usedBytes`, `limitBytes`, `percentage` |
+| b | Types | `usedBytes` and `limitBytes` are numbers, `percentage` is double |
+| c | Percentage calculation | Matches `usedBytes / limitBytes * 100` |
+
+---
+
+### T-26: Document Upload — Quota Check Integrated
+
+**Type:** Integration
+**Class:** `cannamanage-service/src/test/java/de/cannamanage/service/DocumentServiceTest.java`
+**Method:** `testUploadDocument_checksQuotaBeforeWrite()`
+
+**Scenarios:**
+
+| # | Setup | Expected |
+|---|-------|----------|
+| a | Club under quota, upload 1 MB | Upload succeeds, `storageUsedBytes` incremented by file size |
+| b | Club at quota limit | Upload rejected with `StorageQuotaExceededException` before file write |
+
+---
+
+### T-27: Document Upload — 402 Response
+
+**Type:** Integration
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/controller/DocumentControllerTest.java`
+**Method:** `testUploadDocument_quotaExceeded_returns402()`
+
+**Preconditions:**
+- Club with `storageUsedBytes = storageLimitBytes` (fully used)
+
+**Scenarios:**
+
+| # | Action | Expected |
+|---|--------|----------|
+| a | POST multipart upload (1 byte file) | 402 Payment Required |
+| b | Response body | RFC 9457 ProblemDetail with `currentUsage`, `limit`, `requestedBytes` |
+
+---
+
+### T-28: Document Delete — Usage Decremented
+
+**Type:** Integration
+**Class:** `DocumentServiceTest`
+**Method:** `testDeleteDocument_decrementsUsage()`
+
+**Scenarios:**
+
+| # | Setup | Expected |
+|---|-------|----------|
+| a | Club with 5 MB used, delete 2 MB document | `storageUsedBytes` = 3 MB |
+| b | Club with 1 MB used, delete 1 MB document | `storageUsedBytes` = 0 |
+
+---
+
+### T-29: Flyway V36 — Migration Applies
+
+**Type:** Integration
+**Tool:** Spring Boot test context startup
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | Application starts | V36 migration applies without error |
+| b | Column exists | `SELECT storage_used_bytes FROM clubs LIMIT 1` succeeds |
+| c | Default value | New clubs get `storage_used_bytes = 0` and `storage_limit_bytes = 5368709120` |
+
+---
+
+### T-30: Flyway V36 — Backfill
+
+**Type:** Integration
+**Tool:** SQL verification after migration
+
+**Preconditions:**
+- Club exists with 3 documents (sizes: 1MB, 2MB, 3MB)
+
+**Scenarios:**
+
+| # | Check | Expected |
+|---|-------|----------|
+| a | After migration | `storage_used_bytes` = 6291456 (6 MB = sum of document sizes) |
+| b | Club with no docs | `storage_used_bytes` = 0 |
+
+---
+
+### T-31: StorageQuotaExceededException — 402 Format
+
+**Type:** Unit
+**Class:** `cannamanage-api/src/test/java/de/cannamanage/api/exception/GlobalExceptionHandlerTest.java`
+**Method:** `testStorageQuotaExceeded_returns402WithProblemDetail()`
+
+**Scenarios:**
+
+| # | Input | Expected |
+|---|-------|----------|
+| a | `StorageQuotaExceededException(1GB, 5GB, 200MB)` | HTTP 402, title="Storage Quota Exceeded" |
+| b | Response properties | Contains `currentUsage`, `limit`, `requestedBytes` numeric fields |
+
+---
+
+### T-32: i18n Keys Resolve
+
+**Type:** Unit / Lint
+**Tool:** next-intl compile check or custom script
+
+**Scenarios:**
+
+| # | Namespace | Expected |
+|---|-----------|----------|
+| a | `marketing.home.*` | All 20+ keys resolve in `de.json` |
+| b | `marketing.home.*` | All 20+ keys resolve in `en.json` (English equivalents) |
+| c | `marketing.pricing.faq.storage.*` | question + answer keys present in both locales |
+| d | `marketing.pricing.plans.*.storage` | Storage labels present for each plan in both locales |
+
+---
+
+## Test Data
+
+### Backend
+
+- **Test club:** UUID `00000000-0000-0000-0000-000000000001`, `storageUsedBytes = 1073741824` (1 GB), `storageLimitBytes = 5368709120` (5 GB)
+- **Test documents:** 3 documents with `fileSize` = 100MB, 200MB, 773741824 bytes (total = 1 GB)
+- **Full quota club:** UUID `00000000-0000-0000-0000-000000000002`, `storageUsedBytes = storageLimitBytes = 5368709120`
+
+### Frontend E2E
+
+- Landing page, pricing, login pages are public — no auth setup needed for T-01 through T-13
+- Login form tests (T-08, T-10) require running backend with test user `admin@gruener-daumen.de` / `TestAdmin123!`
+
+---
+
+## Test Coverage
+
+| Component | Unit | Integration | E2E | Total |
+|-----------|------|-------------|-----|-------|
+| Landing page | 0 | 0 | 5 | 5 |
+| Login redesign | 0 | 0 | 5 | 5 |
+| Pricing update | 0 | 0 | 3 | 3 |
+| StorageQuotaService | 9 | 0 | 0 | 9 |
+| StorageController | 0 | 3 | 0 | 3 |
+| DocumentService (quota) | 0 | 2 | 0 | 2 |
+| DocumentController (402) | 0 | 1 | 0 | 1 |
+| Flyway migration | 0 | 2 | 0 | 2 |
+| Exception handling | 1 | 0 | 0 | 1 |
+| i18n verification | 1 | 0 | 0 | 1 |
+| **Total** | **11** | **8** | **13** | **32** |

pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>4.0.6</version>
+        <version>4.0.7</version>
         <relativePath/>
     </parent>