Merge commit '6aedf21bf6dc495fdda89abadbd383fb3ea9e15e'

9676bb0 core: update-check is token-free (running vs vendored cms/core version)
59fb691 core: System panel fix + settings (update-check, self-service password, admins)
67bcb6a docs: HANDOVER — kgva LIVE on core (Variant A, in-place CT130); both sites on core

git-subtree-dir: cms/core
git-subtree-split: 9676bb0264a7caf254ccbc461bc803a6b3583127

.gitignore

@@ -11,6 +11,8 @@ hugo_stats.json
 
 # Node (CMS)
 node_modules/
+# Admin-SPA Build-Output (wird im Container gebaut)
+cms/admin/dist/
 
 # Editors
 .vscode/
@@ -22,3 +24,6 @@ node_modules/
 .env
 .env.local
 hugo.local.yaml
+
+# DB-Backups (Dialog-Daten-Dumps)
+backups/

archetypes/library.md

@@ -0,0 +1,6 @@
+---
+title: "{{ replace .File.ContentBaseName `-` ` ` | title }}"
+group: "Allgemein"
+summary: ""
+toc: false
+---

cms/.env.example

@@ -20,7 +20,13 @@ API_EXTERNAL_URL=http://localhost:8000
 # unter `authors` steht.
 ADMIN_EMAILS=karim@gabrielevarano.ch
 
-# ═══ Optional: Ports ═══
+# ═══ Optional: Ports & Binding ═══
+# Auf welcher Host-Adresse lauschen die veröffentlichten Ports?
+#   127.0.0.1 (Standard) = nur lokal / hinter Reverse-Proxy mit TLS (empfohlen).
+#   0.0.0.0              = direkt im LAN erreichbar (ohne Proxy).
+# Bei 127.0.0.1 muss SITE_URL/API_EXTERNAL_URL über den Proxy laufen, sonst
+# erreicht der Browser :8000/:8080 nicht.
+BIND_ADDR=127.0.0.1
 APP_PORT=8080          # CMS: Site + /admin + /_preview + /api
 KONG_HTTP_PORT=8000    # Supabase-API-Gateway
 KONG_HTTPS_PORT=8443

cms/README.md

@@ -66,14 +66,37 @@ bash <(curl -fsSL https://git.kgva.ch/karim/OPENBUREAU/raw/branch/main/cms/proxm
 Fragt interaktiv nur Storage/Bridge/IP ab (Enter = Default). Kein Token nötig.
 `GIT_TOKEN` nur setzen, wenn das CMS per `GIT_PUBLISH` nach Gitea zurückschreiben soll.
 
+Alle CONFIG-Werte sind auch per **Umgebungsvariable** überschreibbar (für
+non-interaktiv/SSH) — `ROOTFS_STORAGE` (z.B. `local-zfs`), `HOSTNAME`, `CTID`,
+`IP`, `GATEWAY`, `DISK_GB`, `RAM_MB`, `CORES`, `BRIDGE`. Mit **`SITE_DOMAIN`**
+wird der Stack direkt für eine öffentliche HTTPS-Domain hinter einem
+Reverse-Proxy konfiguriert (Same-Origin, Pfad-Routing der Supabase-API).
+Beispiel + Caddy-Block: siehe [`proxmox/README.md`](../proxmox/README.md).
+
+### Updaten (bestehender LXC)
+
+Nicht `git pull` von Hand — das vergisst CORS-Origin (kong.yml), Dateirechte
+(non-root) und den Neustart. Stattdessen im Container:
+
+```bash
+bash /opt/openbureau/cms/update.sh
+```
+
+Das macht: `git pull` → CORS-Origin aus `SITE_URL` in `kong.yml` rendern →
+`chown -R 1000:1000` → `docker compose up -d --build` + kong neu laden →
+Healthcheck. (Beim allerersten Mal das Skript per einmaligem `git pull` holen.)
+
 ### Manuell (oder im Container)
 
 1. `cp .env.example .env`
 2. `POSTGRES_PASSWORD` + `JWT_SECRET` setzen: je `openssl rand -hex 32`
 3. Keys ableiten: `node scripts/generate-keys.mjs` → `ANON_KEY` + `SERVICE_ROLE_KEY` in `.env`
 4. `SITE_URL` + `API_EXTERNAL_URL` auf die LAN-/Domain-Adresse setzen
-5. `docker compose up -d --build`  (Erststart: DB bootet + Schema/Migrations)
-6. Login-User anlegen (Self-Signup ist aus):
+5. `kong.yml`: Platzhalter `__CORS_ORIGIN__` durch `SITE_URL` (Browser-Origin) ersetzen
+6. `BIND_ADDR` in `.env`: `127.0.0.1` hinter Reverse-Proxy (Standard), `0.0.0.0` für LAN-Direktzugriff
+7. Repo dem Container-User (uid 1000) übereignen: `chown -R 1000:1000 <repo-root>`
+8. `docker compose up -d --build`  (Erststart: DB bootet + Schema/Migrations)
+9. Login-User anlegen (Self-Signup ist aus):
    ```
    source .env
    curl -X POST "$API_EXTERNAL_URL/auth/v1/admin/users" \
@@ -89,6 +112,79 @@ Dann: Admin `…:8080/admin/` · Live `…:8080/` · Preview `…:8080/_preview/
 `cd admin && npm install && npm run dev` (Vite-Devserver, proxyt `/api` +
 `/_preview` an den laufenden Container auf :8080).
 
+Tests der API (ohne DB/Container, reine Logik): `cd api && npm test`
+(`node --test` — Pfad-Sicherheit, Rollen/Auth, Rate-Limit, Build-Coalescing).
+
+### Demo-Inhalt fürs Forum (optional)
+
+`db/seed-demo.sql` füllt die Forum-Kategorien mit ein paar Beispiel-Threads und
+-Wortmeldungen — bewusst **getrennt** von der Migration, damit die Produktion
+leer startet. Bei Bedarf manuell einspielen (idempotent, mehrfach lauffähig):
+
+```bash
+docker compose exec -T db psql -U supabase_admin -d postgres < db/seed-demo.sql
+```
+
+Wieder entfernen: DELETE-Block am Ende der Datei (auskommentiert).
+
+### Backup der Dialog-Daten
+
+⚠️ Foren, Threads und Wortmeldungen liegen **nur in Postgres** — anders als
+`content/*.md` (in Git) sind sie sonst nirgends gesichert. Das Proxmox-Script
+richtet ein **tägliches** Backup ein (`/etc/cron.d/openbureau-backup`, 3:15 Uhr).
+Manuell/sonst:
+
+```bash
+bash scripts/backup-db.sh          # → backups/openbureau-<TS>.sql.gz (rotiert, 14 Stk.)
+```
+
+Wiederherstellen:
+
+```bash
+gunzip -c backups/openbureau-<TS>.sql.gz \
+  | docker compose exec -T db psql -U supabase_admin -d postgres
+```
+
+## Sicherheit / Härtung
+
+Eingebaute Schutzmaßnahmen (Stand: Härtungs-Pass):
+
+- **Sicherheits-Header** auf allen Antworten (X-Frame-Options, nosniff,
+  Referrer-Policy, HSTS); Uploads unter `/images/*` mit strikter CSP +
+  `sandbox` → ein bösartiges SVG kann kein JavaScript im Origin ausführen.
+- **Rate-Limit** auf `/api/auth/login` (10 Versuche/IP pro 5 Min) gegen Brute-Force.
+- **Body-Limit** 256 KB auf JSON-`/api/*`, Bild-Upload max. 8 MB mit
+  Format-Verifikation (sharp-Metadaten bzw. SVG/GIF-Signatur).
+- **Comment-Limits** (Body ≤ 10 000 Zeichen) gegen DB-Bloat.
+- **Kein Info-Leak**: rohe DB-Fehler werden serverseitig geloggt, nach außen
+  nur generische Meldungen.
+- **Non-root**: der CMS-Container läuft als `node` (uid 1000).
+- **Port-Binding** über `BIND_ADDR` (Standard `127.0.0.1`), DB nur auf localhost.
+- **CORS** am Kong-Gateway auf die eigene `SITE_URL`-Origin beschränkt (kein `*`).
+- **Reverse-Proxy nur `/auth/*`**: bei einem Domain-Deploy gehört nur das Login
+  (GoTrue) public — `/rest`, `/storage`, `/realtime` nicht durchreichen (PostgREST
+  `/rest/v1/` würde sonst die DB-Schema-Beschreibung preisgeben). Siehe Caddy-Block
+  in [`../proxmox/README.md`](../proxmox/README.md).
+- **Login-Rate-Limit** an GoTrue (`GOTRUE_RATE_LIMIT_TOKEN_REFRESH`), weil das
+  öffentliche Login direkt aufs `/token` geht (nicht übers Node-Limit).
+- **Keine Tabellenrechte für `anon`/`authenticated`** (`revoke` in `db/schema.sql`):
+  RLS bleibt so auch bei künftigen Policies dicht; nur `service_role` (Node) liest.
+
+### Migration eines bestehenden Containers
+
+Bei `git pull` auf einer schon laufenden Instanz greifen drei Änderungen, die
+sonst einen frischen Deploy voraussetzen — **vor** dem nächsten
+`docker compose up -d --build` von Hand nachziehen:
+
+1. **Non-root:** `chown -R 1000:1000 <repo-root>` — sonst kann Hugo `public/`
+   nicht mehr bauen (Permission denied).
+2. **CORS:** `kong.yml` enthält jetzt `__CORS_ORIGIN__`; auf einem bereits
+   initialisierten Container ersetzt das Proxmox-Script den Platzhalter nicht.
+   Manuell auf die `SITE_URL` setzen, sonst werden alle Browser-API-Calls
+   (inkl. Login) per CORS geblockt.
+3. **BIND_ADDR:** Key in `.env` ergänzen. Default `127.0.0.1` ist hinter einem
+   TLS-Proxy korrekt; für LAN-Direktzugriff `0.0.0.0` setzen.
+
 ## API
 
 Alle `/api/*` (ausser `/health`) verlangen `Authorization: Bearer <supabase-token>`.

cms/admin/src/supabase.js

@@ -1,8 +0,0 @@
-import { createClient } from '@supabase/supabase-js';
-
-// Öffentliche Browser-Werte (zur Build-Zeit von Vite eingesetzt). Der anon-Key
-// ist per Design öffentlich; die echte Autorität liegt server-seitig.
-const url = import.meta.env.VITE_SUPABASE_URL;
-const anonKey = import.meta.env.VITE_SUPABASE_ANON_KEY;
-
-export const supabase = createClient(url, anonKey);

cms/api/src/index.js

@@ -1,78 +0,0 @@
-import { serve } from '@hono/node-server';
-import { serveStatic } from '@hono/node-server/serve-static';
-import { Hono } from 'hono';
-
-import content from './routes/content.js';
-import preview from './routes/preview.js';
-import publish from './routes/publish.js';
-import upload from './routes/upload.js';
-import profile from './routes/profile.js';
-import users from './routes/users.js';
-import { listComments, createComment, deleteComment, login } from './routes/comments.js';
-import {
-  listForums, showForum, recent, threadInfo, newThread, mod, adminForums,
-} from './routes/dialog.js';
-import { requireAuth } from './auth.js';
-import { syncLibrary } from './dialog-store.js';
-
-const SITE_DIR = process.env.SITE_DIR || '/site';
-const ADMIN_DIR = process.env.ADMIN_DIR || '/app/admin-dist';
-const PORT = Number(process.env.PORT || 3000);
-
-const app = new Hono();
-
-// --- API ---
-app.get('/api/health', (c) => c.json({ ok: true, hugo: '0.161.1+extended' }));
-// Öffentlich (ohne Login): Dialog lesen, Übersicht, Login fürs Dialog-Widget.
-app.get('/api/comments', listComments);
-app.get('/api/forums', listForums);
-app.get('/api/forums/:slug', showForum);
-app.get('/api/recent', recent);
-app.get('/api/thread', threadInfo);
-app.post('/api/auth/login', login);
-// Alles weitere unter /api/* braucht ein gültiges Supabase-Token.
-app.use('/api/*', requireAuth);
-app.get('/api/me', (c) => c.json({ email: c.get('email'), role: c.get('role'), isAdmin: c.get('isAdmin'), canModerate: c.get('canModerate') }));
-app.post('/api/comments', createComment);
-app.delete('/api/comments/:id', deleteComment);
-app.post('/api/threads', newThread);
-app.route('/api/mod', mod);
-app.route('/api/admin/forums', adminForums);
-app.route('/api/content', content);
-app.route('/api/preview', preview);
-app.route('/api/publish', publish);
-app.route('/api/upload', upload);
-app.route('/api/profile', profile);
-app.route('/api/users', users);
-
-// --- Admin-SPA (im Container mitgebaut, unter /admin serviert) ---
-app.get('/admin', (c) => c.redirect('/admin/'));
-app.use(
-  '/admin/*',
-  serveStatic({
-    root: ADMIN_DIR,
-    rewriteRequestPath: (p) => p.replace(/^\/admin/, '') || '/',
-  }),
-);
-
-// --- Vorschau (gebaut nach preview/ mit --buildDrafts) ---
-app.use(
-  '/_preview/*',
-  serveStatic({
-    root: `${SITE_DIR}/preview`,
-    rewriteRequestPath: (p) => p.replace(/^\/_preview/, ''),
-  }),
-);
-
-// Hochgeladene Bilder direkt aus static/ servieren — sofort sichtbar
-// (Vorschau, Cover, Profilbild), ohne auf den nächsten Hugo-Build zu warten.
-app.use('/images/*', serveStatic({ root: `${SITE_DIR}/static` }));
-
-// --- Live-Site (gebaut nach public/) ---
-app.use('/*', serveStatic({ root: `${SITE_DIR}/public` }));
-
-serve({ fetch: app.fetch, port: PORT }, (info) => {
-  console.log(`OPENBUREAU CMS läuft auf :${info.port} — Site + API + /_preview`);
-  // Library-Beiträge als Threads in „Beiträge" spiegeln (nicht blockierend).
-  syncLibrary().catch((e) => console.error('syncLibrary:', e?.message || e));
-});

cms/api/src/routes/upload.js

@@ -1,54 +0,0 @@
-import { Hono } from 'hono';
-import { mkdir, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import sharp from 'sharp';
-
-// Bild-Upload → static/images/. Raster-Bilder werden zu WebP konvertiert
-// (kleiner, web-optimiert), auf max. 2000px begrenzt, EXIF-Rotation korrigiert.
-// SVG/GIF bleiben unangetastet (Vektor/Animation erhalten).
-const SITE_DIR = process.env.SITE_DIR || '/site';
-const PASSTHROUGH = new Set(['.svg', '.gif']);
-
-const upload = new Hono();
-
-upload.post('/', async (c) => {
-  const body = await c.req.parseBody();
-  const file = body['file'];
-  if (!file || typeof file === 'string') return c.json({ error: 'Keine Datei' }, 400);
-
-  const dir = path.join(SITE_DIR, 'static', 'images');
-  await mkdir(dir, { recursive: true });
-
-  const buffer = Buffer.from(await file.arrayBuffer());
-  const ext = path.extname(file.name || '').toLowerCase();
-  const base = `${safeBase(file.name)}-${uid()}`;
-
-  let outName, outBuf;
-  if (PASSTHROUGH.has(ext)) {
-    outName = `${base}${ext}`;
-    outBuf = buffer;
-  } else {
-    outName = `${base}.webp`;
-    outBuf = await sharp(buffer)
-      .rotate()
-      .resize({ width: 2000, withoutEnlargement: true })
-      .webp({ quality: 82 })
-      .toBuffer();
-  }
-
-  await writeFile(path.join(dir, outName), outBuf);
-  return c.json({ url: `/images/${outName}` });
-});
-
-// Sicherer Basisname ohne Endung.
-function safeBase(raw) {
-  const base = path.basename(String(raw || 'bild')).replace(/\.[^.]+$/, '');
-  const cleaned = base.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
-  return cleaned || 'bild';
-}
-// Kurze eindeutige Endung, damit gleichnamige Uploads nicht kollidieren.
-function uid() {
-  return Date.now().toString(36).slice(-4) + Math.random().toString(36).slice(2, 5);
-}
-
-export default upload;

cms/api/src/routes/users.js

@@ -1,58 +0,0 @@
-import { Hono } from 'hono';
-import { supabase } from '../supabase.js';
-import { requireAdmin, roleOf } from '../auth.js';
-
-// Autoren-/Nutzerverwaltung über die GoTrue-Admin-API (Service-Key). Nur Admins.
-const ADMINS = (process.env.ADMIN_EMAILS || '')
-  .split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
-
-const users = new Hono();
-users.use('*', requireAdmin);
-
-users.get('/', async (c) => {
-  const { data, error } = await supabase.auth.admin.listUsers();
-  if (error) return c.json({ error: error.message }, 500);
-  const list = (data?.users || []).map((u) => {
-    const role = roleOf(u);
-    return {
-      id: u.id,
-      email: u.email,
-      created_at: u.created_at,
-      role,
-      isAdmin: role === 'admin',
-      // Admins aus der .env lassen sich nicht per UI herabstufen.
-      fixedAdmin: ADMINS.includes((u.email || '').toLowerCase()),
-    };
-  });
-  return c.json(list);
-});
-
-users.post('/', async (c) => {
-  const { email, password } = await c.req.json();
-  if (!email || !password) return c.json({ error: 'E-Mail und Passwort nötig' }, 400);
-  const { data, error } = await supabase.auth.admin.createUser({ email, password, email_confirm: true });
-  if (error) return c.json({ error: error.message }, 400);
-  return c.json({ ok: true, id: data.user.id });
-});
-
-users.put('/:id', async (c) => {
-  const { password, role } = await c.req.json();
-  const patch = {};
-  if (password) patch.password = password;
-  if (role) {
-    if (!['user', 'editor', 'admin'].includes(role)) return c.json({ error: 'Unbekannte Rolle' }, 400);
-    patch.app_metadata = { role };
-  }
-  if (!Object.keys(patch).length) return c.json({ error: 'Nichts zu ändern' }, 400);
-  const { error } = await supabase.auth.admin.updateUserById(c.req.param('id'), patch);
-  if (error) return c.json({ error: error.message }, 400);
-  return c.json({ ok: true });
-});
-
-users.delete('/:id', async (c) => {
-  const { error } = await supabase.auth.admin.deleteUser(c.req.param('id'));
-  if (error) return c.json({ error: error.message }, 400);
-  return c.json({ ok: true });
-});
-
-export default users;

cms/api/src/supabase.js

@@ -1,21 +0,0 @@
-import { createClient } from '@supabase/supabase-js';
-
-const url = process.env.SUPABASE_URL;
-const key = process.env.SUPABASE_SERVICE_KEY;
-
-if (!url || !key) {
-  console.error('FEHLT: SUPABASE_URL und/oder SUPABASE_SERVICE_KEY in .env');
-  process.exit(1);
-}
-
-const opts = { auth: { persistSession: false, autoRefreshToken: false } };
-
-// Daten-Client: Service-Role-Key, umgeht RLS. NUR für DB-Zugriffe (from/insert/…).
-// Wichtig: hier niemals signInWithPassword aufrufen — das schaltet den
-// Authorization-Header des Clients prozessweit auf das User-Token um (SIGNED_IN),
-// wodurch anschließende Inserts als role=authenticated laufen und an RLS scheitern.
-export const supabase = createClient(url, key, opts);
-
-// Eigener Client nur für Auth (Login, Token-Prüfung). Getrennt, damit ein
-// signInWithPassword den Daten-Client oben nicht „vergiftet". Niemals ins Frontend.
-export const supabaseAuth = createClient(url, key, opts);

cms/core/.gitignore

@@ -0,0 +1,8 @@
+node_modules/
+.env
+.env.*
+*.log
+.DS_Store
+
+# build output
+admin/dist/

cms/core/HANDOVER.md

@@ -0,0 +1,202 @@
+# openbureau-core — handover
+
+## For a fresh instance — START HERE
+- **Repo (local):** cloned at `/home/karim/openbureau-core`. Remote
+  `git.openbureau.ch/karim/openbureau-core` is **private**; auth via an HTTPS token
+  in `~/.git-credentials` (the SSH key `id_ed25519_openbureau` is currently rejected
+  by gitea/proxmox — server seems rebuilt; fix the key or keep using the token).
+- **Where the work is:** branch **`stufe-2-5-scaffold`** (pushed, NOT merged). `main`
+  is still the pre-stage-2 foundation. Open a PR or merge when happy.
+- **Done:** stages 1–4 complete, stage 5 *scaffolded*. See "Migration stages" below
+  (markers `[done]`/`[scaffold]`). New code: `api/src/collections.js`,
+  `api/src/plugin-manager.js`, `api/src/plugins/dialog/index.js` + their tests.
+- **Run tests:** `cd api && npm install && node --test` → **44 green**. `node_modules`
+  is git-ignored; the fresh clone needs `npm install` once.
+- **Status:** stages 1–9 DONE; openbureau + kgva BOTH LIVE on core. openbureau on dev CT134 (schema editor + supabase); kgva LIVE at karimgabrielevarano.xyz via core (Variant A: CMS serves the site; CT130 rebuilt in-place — Docker + kgva-cms on :8081, nginx :80 proxies to it and keeps /media, static timer disabled, Caddy untouched). CAVEAT: kgva GIT_PUBLISH=false → edits on CT130 disk, not git-backed (enable GIT_PUBLISH + creds to fix). Rollback for kgva: restore nginx .static.bak + re-enable kgva-deploy.timer + stop kgva-cms. Original stage-5 note kept below for history.
+- **Immediate next action (historic):** stage 5 + 5.5 **DONE** on the branch (commits `c4230a4`
+  cutover, `5e06337` DDL, `a93d11a` migration runner). Plugin-manager singleton
+  (`api/src/plugins.js`) wired into `index.js`/`stats.js`/`publish.js`, hard-coded
+  dialog removed, source moved under `api/src/plugins/dialog/`; DDL captured into
+  `plugins/dialog/migrations/001_dialog.sql` (idempotent); `api/src/migrate.js`
+  applies migrations once via `schema_migrations` at boot. **53 tests green** + a real
+  boot. **Live-verified on the dev stack** (CT 134): a 2nd cms instance from
+  `cms-cms:latest` (my `src` mounted over `/app/src`, real Supabase via `kong:8000`,
+  empty SITE_DIR → no writes) returned **byte-identical** `/api/forums` & `/api/recent`
+  vs the running container, `/api/content` 401 on both; the runner's tracking SQL was
+  proven on a throwaway DB. **NOT deployed** (the running stack still runs old code).
+  NEXT (stage 8): deploy core to openbureau — needs `DATABASE_URL` set for the cms
+  service (e.g. `postgres://postgres:$POSTGRES_PASSWORD@db:5432/postgres`) so the
+  runner can apply migrations, then full login/edit/publish verify before cutting the
+  live container over. Then stages 6 (admin `/api/schema`), 7 (local auth), 9 (kgva).
+  Dev stack: Proxmox CT 134 `openbureau-dev`, repo `/opt/openbureau`, compose
+  `cms/docker-compose.yml`, containers openbureau-{cms,auth,kong,rest,db}, dev URL
+  dev.openbureau.ch. **Do NOT push a blind refactor to prod.**
+- **Env gotcha:** editing a file that's open in Karim's VSCode makes the Edit/Write
+  tool hang/"interrupt" — write such files via Bash (`cat > f <<'EOF' … EOF`) instead.
+
+## Goal
+Extract a generic, **schema-driven** Hugo CMS engine ("openbureau-core") from the
+openbureau site's bundled CMS, so that **both** openbureau and
+karimgabrielevarano.xyz (kgva) consume it as a dependency. Decision: own repo
+(this one), and migrate openbureau to depend on it.
+
+## State (done this session)
+- Repo `karim/openbureau-core` created on Gitea, foundation pushed.
+  - `api/` = engine copied verbatim from `karim/OPENBUREAU` → `cms/api` (Hono/Node).
+  - `admin/` = React/Vite SPA copied verbatim from `OPENBUREAU/cms/admin`.
+  - `api/src/config.js` = NEW loader: reads `CMS_CONFIG` → a site config module.
+  - `examples/openbureau.config.js`, `examples/kgva.config.js` = target schemas.
+  - `README.md` = config API + plugin model + the migration checklist.
+- Nothing in the live openbureau CMS was changed yet.
+
+## Engine is ~80% generic. openbureau-specific seams to make config-driven:
+1. [DONE] `api/src/files.js` `classify(rel)` + the `order` map — now derived from
+   `config.collections` via `api/src/collections.js` (classify/buildPath/compareEntries);
+   `buildPath` exposed there too.
+2. [DONE] `api/src/routes/stats.js` — now per-collection (`statKey`/`draftStatKey`),
+   dialog counts gated by `hasPlugin('dialog')`.
+3. `api/src/index.js` — always mounts dialog routes + runs `syncLibrary` on boot.
+   → only when `config.plugins` includes `dialog`.
+4. `api/src/routes/publish.js` — calls `syncLibrary`. → gate by plugin.
+5. `admin/src/App.jsx` (714 lines) — hard-codes `SECTIONS`, `KIND_LABEL`, the field
+   set, type dropdown, `buildPath`. → render sidebar groups + editor fields from the
+   schema (add `GET /api/schema` returning `config.collections`).
+6. dialog subsystem (`dialog-store.js`, `routes/dialog.js`, `routes/comments.js`
+   + Supabase tables forums/threads/comments + library↔thread sync) = the `dialog`
+   **plugin** (openbureau on, kgva off). First gate by config, later move to
+   `api/src/plugins/dialog/`.
+
+## CRITICAL
+api and admin share a data contract (stats keys, field shapes). Generalising the
+**backend alone breaks the live openbureau admin** — they must change together and
+be tested on the live Supabase/Hugo stack. Do NOT push a blind half-refactor to
+production openbureau.
+
+## Plugin system (decided architecture)
+Everything beyond the generic engine is a **plugin**; the engine gets a small
+**plugin manager**. A plugin = `api/src/plugins/<name>/index.js` exporting a
+manifest `{ name, routes:[{path,app,public?,admin?}], onBoot, onPublish, onPreview,
+migrations:[…], stats, admin:{…} }`. The manager reads `config.plugins`, imports
+each, mounts routes in the right auth tier (public before `requireAuth`, rest
+after, `admin:true` behind `requireAdmin`), registers boot/publish/preview/stats
+hooks, runs migrations; the admin SPA loads UI from `admin/src/plugins/<name>`.
+openbureau's extras become plugins (first: `dialog`); kgva enables none.
+(Full spec in README → "Plugins".)
+
+## Migration stages (also README checklist)
+1. [done] repo + engine + config loader + example configs.
+2. [done] files.js classify/order/buildPath ← config.collections
+   (new `api/src/collections.js` = pure classify/buildPath/compareEntries/contentStats;
+   files.js uses it, loads config lazily in listEntries; `api/test/collections.test.js`
+   proves 1:1 vs openbureau.config.js). All api tests green.
+3. [done] stats.js ← collections: `content` via `statKey` + `draftStatKey`
+   (openbureau beitrag got `draftStatKey: 'entwuerfe'`), dialog counts gated by
+   `hasPlugin('dialog')` (pluginless site does zero DB reads here).
+4. [built, not wired] **plugin manager** — `api/src/plugin-manager.js`
+   (`loadPlugins(names)` imports `plugins/<name>/index.js`; `createManager(manifests)`
+   = pure wiring: `mountPublic`/`mountPrivate(+requireAdmin)`, `runBoot/runPublish/
+   runPreview`, `collectStats` (merged under plugin name), `migrations()` (resolves
+   file URLs; execution deferred to the live DB)). Unit-tested in
+   `api/test/plugin-manager.test.js` (tiers/hooks/stats/migrations). TODO: wire into
+   index.js (stage 5), and admin loads plugin UI from `admin/src/plugins/<name>`.
+5. [DONE — commits c4230a4 (cutover) + 5e06337 (DDL), live e2e verified] extract openbureau extras
+   into the **dialog** plugin. DONE: `api/src/plugins/dialog/index.js` = manifest
+   wrapping the existing modules unchanged (public reads + widget login(rate-limited)
+   + authed writes + self-guarding mod/adminForums sub-apps; onBoot/onPublish =
+   syncLibrary; stats = forum/thread/comment counts). CUTOVER DONE: shared manager
+   singleton `api/src/plugins.js` wired into index.js (mountPublic before requireAuth,
+   mountPrivate(+requireAdmin) after, manager.runBoot at serve()), publish.js
+   (manager.runPublish) and stats.js (manager.collectStats, `{content,users,dialog}`
+   contract preserved); hard-coded dialog REMOVED from all three; dialog source
+   physically moved to `plugins/dialog/{dialog-store,dialog,comments}.js` (imports
+   fixed). Tested: `api/test/{dialog-plugin,cutover}.test.js`, 48 green + real boot.
+   DDL CAPTURED (commit 5e06337): `migrations/001_dialog.sql` from the live dev DB,
+   idempotent, validated on a throwaway DB; manifest `migrations: ['001_dialog.sql']`.
+   LIVE E2E VERIFIED (dev CT 134): 2nd cms instance from cms-cms:latest with my src
+   mounted, real Supabase via kong:8000 — /api/forums & /api/recent byte-identical to
+   the running container, /api/content 401 both, no writes. Migration runner = stage
+   5.5 (commit a93d11a, see new item below). Deploy is stage 8.
+   NB: dialog-store.js still filters `e.kind === 'beitrag'` — openbureau-specific,
+   already moved with the plugin.
+5.5 [done, commit a93d11a] migration runner — `api/src/migrate.js` `runMigrations`
+   tracks applied migrations in `public.schema_migrations` and applies each declared
+   file once, in its own transaction, at boot (wired into index.js before runBoot).
+   Lean: no declared migrations → no DB connection, no pg import (kgva stays DB-less).
+   Executor is injectable (unit-tested without a DB); default uses a lazily-imported
+   `pg` against `DATABASE_URL`, warning-and-skipping if unset. Needs `DATABASE_URL`
+   wired into the cms service env for openbureau (stage 8). Tested: migrate.test.js +
+   tracking SQL proven on the live dev Postgres (throwaway DB).
+6. [DONE, commits f709b5d + f8f4131 + 59b9e20] schema-driven admin. `GET /api/schema`
+   + `GET /api/system` + a System panel; AND the editor now renders sidebar groups +
+   fields from the site's collections (admin/src/fields.jsx: per-type controls
+   string/text/slug/number/date/bool/select/list/image/color/markdown; form↔frontmatter
+   + path building). One admin serves any site. Unknown frontmatter is PRESERVED on
+   save (__raw) — no data loss. Verified working via kgva (stage 9). NOTE: openbureau
+   is NOT yet redeployed with the schema editor (its running image keeps the bespoke
+   one); when it is, its config field types (color→swatch, layout opts) are already
+   tuned. Visual review of the openbureau editor by Karim still recommended before
+   redeploying it.
+7. [DONE, commit 86f9f57] **auth provider** (`config.auth` = `supabase` | `local`).
+   `api/src/auth-local.js` = file-based users (bcryptjs) + self-signed HS256 JWTs of
+   the SAME claim shape; `routes/auth.js` POST /api/auth/login (mounted only when
+   auth:local); supabase.js made null-safe (fail-fast moved to index.js); auth/stats/
+   users.js branch local↔GoTrue; admin supabase.js gains a local-auth SHIM (same
+   interface) when VITE_SUPABASE_URL is absent → App/api untouched, supabase path
+   byte-identical. examples/kgva.config.js → auth:'local'. Verified: 59 tests +
+   DB-less boot smoke (no Supabase: local login → /api/me admin → stats-from-file)
+   + openbureau redeployed and confirmed unregressed (auth=supabase).
+8. [DONE, OB main 3d902a0] openbureau consumes core. Mechanism: **git subtree** at
+   `OPENBUREAU/cms/core` (fits the pull-based deploy; update via
+   `git subtree pull --prefix=cms/core <core> main --squash`). docker-compose builds
+   the cms image from `./core`; `cms/openbureau.config.js` (CMS_CONFIG) carries the
+   content model; old vendored cms/api+cms/admin removed. DATABASE_URL left unset (the
+   stack's migrate service owns db/schema.sql incl. dialog). Deployed to dev CT 134
+   and FULL write-verified: login/list/edit/preview/publish/dialog all identical, no
+   git divergence (GIT_PUBLISH=false). Rollback image `cms-cms:rollback` kept.
+9. [DONE — LIVE on core (Variant A)] kgva consumes core. In
+   `karim/kgva` (git.kgva.ch, main 51a94b8): `cms/core` = core subtree, `cms/kgva.config.js`
+   (project/page/section, auth:'local', no plugins), `docker-compose.yml` builds the core
+   image (Hugo 0.163.3, no VITE_SUPABASE_URL → local-auth admin), `cms/seed-admin.mjs`,
+   updated deploy/provision-lxc.sh + ADMIN.md. VERIFIED DB-less end-to-end on real content
+   (staged on CT134): local login → schema editor → 42 entries (de/en) → stats →
+   create/preview/cleanup; image galleries preserved. The LIVE site is UNCHANGED — CT130
+   still deploys statically (timer → `hugo` → nginx; hugo ignores cms/); the CMS is dormant.
+   PENDING (deliberate, his call — repoints a live domain): provision a kgva-core container
+   (deploy/provision-lxc.sh, free CTID + temp IP) and decide topology — CMS serves the site
+   (Caddy → it) OR CMS edits + GIT_PUBLISH=true commits to git and the CT130 static timer
+   keeps serving. Then Caddy cutover per deploy/README. openbureau also not yet redeployed
+   with the schema editor (stage 6 note).
+
+## How to run / test
+openbureau CMS stack: `OPENBUREAU/cms/docker-compose.yml` (Node api + Hugo +
+Supabase: postgres/kong/gotrue). Env in `cms/.env` (see `.env.example`):
+SUPABASE_URL/SERVICE_KEY, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY (derive via
+`scripts/generate-keys.mjs`), ADMIN_EMAILS, SITE_URL, GIT_*. For core add
+`CMS_CONFIG` (path to the site config) and `SITE_DIR` (site repo mount, default
+`/site`). Admin at `/admin`, preview `/_preview`, publish builds `public/`.
+
+## Infra access (NO secrets in this file)
+- Proxmox node `192.168.1.2`, user `root`. Password: **ask the user** (provided ad
+  hoc, not stored). No SSH key installed — use SSH_ASKPASS, or install a key first.
+- Gitea = container 120 (`pct exec 120 …`), ROOT_URL `git.openbureau.ch`, sqlite at
+  `/var/lib/gitea/data/gitea.db`. Make a token:
+  `pct exec 120 -- su gitea -s /bin/bash -c "/usr/local/bin/gitea admin user
+  generate-access-token --username karim --scopes all --token-name X --raw
+  --config /etc/gitea/app.ini"`. Keep token `kgva-deploy`. Delete tokens via sqlite
+  (`DELETE FROM access_token WHERE name LIKE '…'`) since the API needs the account
+  password.
+- Push without local git auth: tar → scp to node → `pct push 120` into the gitea
+  container → `git push http://karim:<token>@127.0.0.1:3000/karim/<repo>.git`.
+- kgva site deploy: container 130 (kgva-website). nginx serves
+  `/var/www/karimgabrielevarano.xyz` (= ZFS `tank/kgva-website`, owned uid 100000).
+  systemd timer runs `/opt/kgva-deploy.sh` every 60s: pull `karim/kgva` (token
+  `kgva-deploy`) → `hugo` build → copy into webroot. So a push to `karim/kgva` is
+  live in ~1 min. Self-hosted video at `/var/www/media` (nginx `/media/` alias,
+  outside the build). Public TLS for the domain terminates upstream → 192.168.1.130:80.
+
+## Watch out
+- Gitea does NOT send CORS on its OAuth token endpoint → a browser git-CMS
+  (Decap-style) can't auth without a same-origin proxy. openbureau-core uses its own
+  Supabase auth, so this doesn't affect it; it's why kgva edits go via git push.
+- Hugo versions: openbureau CMS bundles 0.161.1; the kgva site needs 0.163.3
+  features. Mind the version a core instance builds with.

cms/core/README.md

@@ -0,0 +1,149 @@
+# openbureau-core
+
+A generic, schema-driven Hugo CMS engine, extracted from the openbureau site.
+A site provides one config (collections + plugins); the core gives it an admin,
+content CRUD over `content/**/*.md` (gray-matter), real Hugo preview/publish,
+Supabase auth, uploads and git backup. openbureau and karimgabrielevarano.xyz
+both consume it.
+
+## How a site uses it
+
+1. Point `CMS_CONFIG` at a config module (e.g. `/site/cms.config.js`).
+2. Mount the site repo at `SITE_DIR` (default `/site`). Run the container.
+
+```
+SITE_DIR=/site
+CMS_CONFIG=/site/cms.config.js
+SUPABASE_URL=…  SUPABASE_SERVICE_KEY=…  JWT_SECRET=…  ADMIN_EMAILS=…
+```
+
+## Config API
+
+```js
+export default {
+  site: 'name',
+  admins: ['you@example.com'],     // bootstrap admins (env ADMIN_EMAILS still wins)
+  auth: 'supabase',                // 'supabase' (GoTrue) | 'local' (file JWTs, no DB)
+  plugins: ['dialog'],             // optional features (see Plugins)
+  collections: [
+    {
+      kind: 'project',             // internal id
+      label: 'Portfolio',          // shown in the admin
+      order: 0,                    // sort order in the list
+      path: 'portfolio/:slug',     // file pattern under content/ (:params captured)
+      // index: true,              // matches _index.md (a section)
+      // fallback: true,           // matches anything not matched above
+      // sections: [...],          // fixed choices for a :section param
+      statKey: 'projects',         // key in the stats response
+      fields: [                    // editor form, in order
+        { name: 'title', type: 'string', required: true },
+        { name: 'images', type: 'list', of: { src: 'image', name: 'string' } },
+        { name: 'body',  type: 'markdown' },
+      ],
+    },
+  ],
+};
+```
+
+`path` patterns: literal segments must match; `:param` segments are captured
+(the last one is the slug). `index: true` → `_index.md`. `fallback: true` →
+everything else. The engine derives content classification, the `buildPath`, the
+list ordering, the stats counters and the admin editor from this.
+
+Field `type`s: `string · text · markdown · slug · date · number · bool · select
+(options) · image · list · list(of:{…})`.
+
+## Plugins
+
+Everything beyond the generic engine is a **plugin**. A site opts into plugins via
+`plugins: [...]` in its config; core's plugin manager loads them and wires them in.
+The engine stays lean; openbureau = core + its plugins + its config.
+
+A plugin is a module at `api/src/plugins/<name>/index.js` exporting a manifest:
+
+```js
+export default {
+  name: 'dialog',
+  routes: [                                  // mounted under /api
+    { path: '/forums',       app: forums,       public: true },  // skips requireAuth
+    { path: '/comments',     app: comments },                    // auth required
+    { path: '/admin/forums', app: adminForums,  admin: true },   // admins only
+  ],
+  onBoot:    async (ctx) => {},               // run once at startup (e.g. syncLibrary)
+  onPublish: async (ctx, { path }) => {},     // hook after a publish build
+  onPreview: async (ctx, { path }) => {},     // hook after a preview build
+  migrations: ['001_forums.sql'],             // applied to Postgres/Supabase on boot
+  stats:     async (ctx) => ({ forums, threads, comments }), // merged into /api/stats
+  admin:     { /* UI panels the admin SPA mounts for this plugin */ },
+};
+```
+
+The **plugin manager** (core): reads `config.plugins`, imports each module, mounts
+its routes in the right auth tier (public → before `requireAuth`, the rest after,
+`admin: true` behind `requireAdmin`), registers its boot/publish/preview/stats
+hooks, and runs its migrations. The admin SPA loads UI from
+`admin/src/plugins/<name>` for enabled plugins only.
+
+First plugin: **`dialog`** — the comment/forum subsystem (Supabase
+`forums/threads/comments`, library↔thread sync, forum admin UI). openbureau enables
+it; kgva doesn't, so none of its routes, hooks, tables or stats load there.
+
+## Auth providers
+
+Auth is a config seam (`auth: 'supabase' | 'local'`, default `supabase`) so a site
+can run **without a database**. The engine already verifies tokens locally — HS256
+against `JWT_SECRET`, no GoTrue roundtrip ([api/src/auth.js]) — so a provider only
+has to *issue* tokens and *store users*.
+
+- **`supabase`** (today): GoTrue logs the user in and is the user store; the engine
+  verifies the JWT. Needed when there are multiple editors or the `dialog` plugin
+  (its forums/threads/comments live in Postgres). This is the heavy path.
+- **`local`**: file-based users (bcrypt hashes) + self-signed HS256 JWTs of the
+  **same claim shape** (`sub`, `email`, `app_metadata.role`, `exp`), so `requireAuth`
+  and roles are unchanged. No GoTrue, no Postgres, no PostgREST. A dialog-less site
+  (e.g. kgva, single admin) then runs as just **Node + Hugo + nginx** (~80 MB vs the
+  ~1–2 GB Supabase suite). Trade-off: you own password hashing; you lose GoTrue's
+  password-reset / rate-limiting — fine for a single-admin CMS.
+
+What a pluginless core needs from Supabase is *only* the auth half anyway: content
+is Markdown on disk, uploads are local FS (`static/images`, via sharp), and
+PostgREST/tables are a `dialog`-plugin need. `local` drops that half too.
+
+## Architecture
+
+- `api/` — Node engine (Hono): `auth` (Supabase JWT), `files` (gray-matter
+  CRUD), `hugo` (coalesced build / preview / publish + git), `routes/*`,
+  `ratelimit`, `config` (this loader).
+- `admin/` — React/Vite SPA; renders list + editor from the config schema.
+- `examples/` — `openbureau.config.js`, `kgva.config.js` (the two consumers).
+
+## Status / migration stages
+
+This repo currently holds the **engine as extracted** plus the config API and the
+two target configs. Generalisation is staged because the api and admin share a
+data contract and openbureau is in production — they must change together and be
+tested on the live Supabase/Hugo stack, not flipped blind.
+
+- [x] Repo, engine, config loader, example configs (openbureau + kgva)
+- [x] `files.js` classify / order / buildPath driven by `collections`
+      (`api/src/collections.js` + tests; behaviour 1:1 vs openbureau.config.js)
+- [x] `stats.js` counters driven by `collections` (`statKey` / `draftStatKey`),
+      dialog counts gated by `hasPlugin('dialog')`
+- [~] **plugin manager** built + unit-tested (`api/src/plugin-manager.js`,
+      `api/test/plugin-manager.test.js`): loads `config.plugins`, mounts routes by
+      auth tier, runs boot/publish/preview hooks, merges stats, surfaces migrations.
+      NOT yet wired into `index.js` (lands with stage 5, needs the live stack);
+      admin plugin-UI loading still TODO
+- [~] extract openbureau's extras into plugins — first **`dialog`**: manifest
+      scaffold at `api/src/plugins/dialog/index.js` wraps the existing dialog
+      modules (routes by tier, `syncLibrary` on boot/publish, forum counters as
+      `stats`), loaded + structurally tested (`api/test/dialog-plugin.test.js`).
+      TODO (live-tested): wire it into `index.js`, capture the Supabase DDL into
+      `migrations/001_dialog.sql`, move the dialog source under `plugins/dialog/`
+- [ ] `index.js` / `publish.js`: no hard-coded dialog — everything via the manager
+- [ ] admin: editor + sidebar groups rendered from the config schema
+- [ ] **auth provider** (`supabase` | `local`): `local` = file users + self-signed
+      HS256 JWTs (same claim shape), no DB — lets a dialog-less core run Supabase-free
+- [ ] cut openbureau over to consume core (= core + `dialog` plugin + its config),
+      behaviour identical — tested on the live stack
+- [ ] onboard kgva as the second consumer (`auth: 'local'`, no plugins, DB-less)

cms/core/admin/src/App.jsx

@@ -3,33 +3,10 @@ import ToastEditor from '@toast-ui/editor';
 import '@toast-ui/editor/dist/toastui-editor.css';
 import { supabase } from './supabase.js';
 import { api } from './api.js';
-
-// OPENBUREAU-Palette (Hex aus assets/css/custom.css) — für Dropdown + Punkte.
-const COLORS = [
-  ['', 'keine', 'transparent'],
-  ['ajisai', 'Ajisai · Hortensie', '#A39EC4'],
-  ['sakura', 'Sakura · Kirschblüte', '#C49EC4'],
-  ['suna', 'Suna · Sand', '#C4C19E'],
-  ['ichigo', 'Ichigo · Erdbeere', '#C49EA0'],
-  ['yuyake', 'Yuyake · Sonnenuntergang', '#CEB188'],
-  ['sora', 'Sora · Himmel', '#9EC3C4'],
-  ['kusa', 'Kusa · Gras', '#9EC49F'],
-  ['kori', 'Kori · Eis', '#A5B4CB'],
-  ['amagumo', 'Amagumo · Regenwolke', '#4C4C4C'],
-  ['yuki', 'Yuki · Schnee', '#F0F0F0'],
-];
-const hexOf = (name) => (COLORS.find((c) => c[0] === name) || [])[2] || 'transparent';
-
-const LAYOUTS = ['', 'text', 'image', 'icon'];
-const SECTIONS = ['buerofuehrung', 'software', 'theorie'];
-const KIND_LABEL = { beitrag: 'Beiträge', seite: 'Seiten', rubrik: 'Rubriken' };
-
-const EMPTY = {
-  isNew: true, path: '', type: 'beitrag', section: 'software', slug: '',
-  title: '', date: new Date().toISOString().slice(0, 10), weight: '',
-  color: '', layout: 'text', tags: '', summary: '', description: '',
-  cover_image: '', external: '', authors: '', toc: false, draft: true, body: '',
-};
+import {
+  Field, blankForm, formFromFrontmatter, frontmatterFromForm, targetPath,
+  isShort, isBody, hexOf, DEFAULT_PALETTE,
+} from './fields.jsx';
 
 export default function App() {
   const [session, setSession] = useState(null);
@@ -69,6 +46,9 @@ function Login() {
 
 function Dashboard({ email }) {
   const [entries, setEntries] = useState([]);
+  const [collections, setCollections] = useState(null);
+  const [plugins, setPlugins] = useState([]);
+  const [site, setSite] = useState('');
   const [current, setCurrent] = useState(null);
   const [query, setQuery] = useState('');
   const [view, setView] = useState('content');
@@ -79,30 +59,57 @@ function Dashboard({ email }) {
     try { setEntries(await api.list()); }
     catch (e) { setMsg({ type: 'err', text: e.message }); }
   }
-  useEffect(() => { refresh(); api.getMe().then(setMe).catch(() => {}); }, []);
+  useEffect(() => {
+    refresh();
+    api.getMe().then(setMe).catch(() => {});
+    api.schema().then((sc) => {
+      setCollections((sc.collections || []).slice().sort((a, b) => (a.order ?? 99) - (b.order ?? 99)));
+      setPlugins(sc.plugins || []); setSite(sc.site || '');
+    }).catch(() => setCollections([]));
+  }, []);
   useEffect(() => { if (!msg) return; const t = setTimeout(() => setMsg(null), 4000); return () => clearTimeout(t); }, [msg]);
 
+  const cols = collections || [];
+  const hasDialog = plugins.includes('dialog');
+  const collectionOf = (kind) => cols.find((c) => c.kind === kind) || cols.find((c) => c.fallback) || cols[0] || null;
+
   async function open(entry) {
-    try { setCurrent(fromRead(await api.read(entry.path))); }
-    catch (err) { setMsg({ type: 'err', text: err.message }); }
+    const col = collectionOf(entry.kind);
+    try {
+      const r = await api.read(entry.path);
+      const bodyField = (col?.fields || []).find(isBody);
+      setCurrent({
+        isNew: false, kind: entry.kind, path: entry.path,
+        ...formFromFrontmatter(r.frontmatter || {}, col || { fields: [] }),
+        ...(bodyField ? { [bodyField.name]: r.body || '' } : {}),
+      });
+    } catch (err) { setMsg({ type: 'err', text: err.message }); }
+  }
+  function openNew() {
+    const col = cols[0];
+    if (col) setCurrent({ isNew: true, kind: col.kind, path: '', ...blankForm(col) });
   }
 
   const q = query.trim().toLowerCase();
-  const filtered = q ? entries.filter((e) => e.title.toLowerCase().includes(q) || (e.section || '').includes(q)) : entries;
-  const groups = { beitrag: [], seite: [], rubrik: [] };
-  for (const e of filtered) (groups[e.kind] || groups.seite).push(e);
+  const filtered = q ? entries.filter((e) => (e.title || '').toLowerCase().includes(q) || (e.section || '').includes(q)) : entries;
+  const fallbackKind = (cols.find((c) => c.fallback) || cols[0] || {}).kind;
+  const groups = {};
+  for (const c of cols) groups[c.kind] = [];
+  for (const e of filtered) { const k = groups[e.kind] ? e.kind : fallbackKind; if (groups[k]) groups[k].push(e); }
 
   return (
     <div className="app">
       <header className="topbar">
-        <span className="logo">OPENBUREAU</span>
+        <span className="logo">{(site || 'cms').toUpperCase()}</span>
         <span className="logo-sub">Redaktion</span>
         <nav className="nav">
+          {me?.isAdmin && <button className={view === 'overview' ? 'active' : ''} onClick={() => setView('overview')}>Übersicht</button>}
           <button className={view === 'content' ? 'active' : ''} onClick={() => setView('content')}>Inhalte</button>
           <button className={view === 'profile' ? 'active' : ''} onClick={() => setView('profile')}>Profil</button>
-          {me?.canModerate && <button className={view === 'moderation' ? 'active' : ''} onClick={() => setView('moderation')}>Moderation</button>}
-          {me?.isAdmin && <button className={view === 'forums' ? 'active' : ''} onClick={() => setView('forums')}>Foren</button>}
+          {me?.canModerate && hasDialog && <button className={view === 'moderation' ? 'active' : ''} onClick={() => setView('moderation')}>Moderation</button>}
+          {me?.isAdmin && hasDialog && <button className={view === 'forums' ? 'active' : ''} onClick={() => setView('forums')}>Foren</button>}
           {me?.isAdmin && <button className={view === 'users' ? 'active' : ''} onClick={() => setView('users')}>Autor:innen</button>}
+          {me?.isAdmin && <button className={view === 'system' ? 'active' : ''} onClick={() => setView('system')}>System</button>}
         </nav>
         <span className="spacer" />
         <span className="who">{email}</span>
@@ -110,7 +117,9 @@ function Dashboard({ email }) {
       </header>
 
       <div className="body">
-        {view === 'profile' ? (
+        {view === 'overview' ? (
+          <Overview onMsg={setMsg} go={setView} />
+        ) : view === 'profile' ? (
           <Profile onMsg={setMsg} />
         ) : view === 'users' ? (
           <Users onMsg={setMsg} currentEmail={me?.email} />
@@ -118,18 +127,20 @@ function Dashboard({ email }) {
           <Forums onMsg={setMsg} />
         ) : view === 'moderation' ? (
           <Moderation onMsg={setMsg} />
+        ) : view === 'system' ? (
+          <System onMsg={setMsg} />
         ) : (
           <>
             <aside>
-              <button className="new" onClick={() => setCurrent({ ...EMPTY })}>＋ Neuer Beitrag</button>
+              <button className="new" onClick={openNew} disabled={!cols.length}>＋ Neu</button>
               <div className="search"><span>⌕</span><input placeholder="Suchen…" value={query} onChange={(e) => setQuery(e.target.value)} /></div>
-              {['beitrag', 'seite', 'rubrik'].map((kind) => groups[kind].length > 0 && (
-                <div className="group" key={kind}>
-                  <div className="group-title">{KIND_LABEL[kind]} <span>{groups[kind].length}</span></div>
+              {cols.map((c) => groups[c.kind]?.length > 0 && (
+                <div className="group" key={c.kind}>
+                  <div className="group-title">{c.label} <span>{groups[c.kind].length}</span></div>
                   <ul className="list">
-                    {groups[kind].map((e) => (
+                    {groups[c.kind].map((e) => (
                       <li key={e.path} className={current?.path === e.path ? 'active' : ''} onClick={() => open(e)}>
-                        <span className="dot" style={{ background: e.color ? hexOf(e.color) : 'var(--line)' }} />
+                        <span className="dot" style={{ background: e.color ? hexOf(DEFAULT_PALETTE, e.color) : 'var(--line)' }} />
                         <span className="t">
                           <span className="t-title">{e.title}</span>
                           <span className="t-meta">{[e.section, e.date].filter(Boolean).join(' · ')}</span>
@@ -143,9 +154,9 @@ function Dashboard({ email }) {
             </aside>
             <main>
               {current
-                ? <Editor key={current.path || 'new'} initial={current}
+                ? <Editor key={(current.path || 'new') + ':' + current.kind} initial={current} collections={cols}
                     onSaved={(loaded) => { setCurrent(loaded); refresh(); }} onMsg={setMsg} />
-                : <div className="empty"><p>Wähle links einen Eintrag — oder leg einen neuen Beitrag an.</p></div>}
+                : <div className="empty"><p>Wähle links einen Eintrag — oder leg einen neuen an.</p></div>}
             </main>
           </>
         )}
@@ -156,7 +167,7 @@ function Dashboard({ email }) {
   );
 }
 
-function Editor({ initial, onSaved, onMsg }) {
+function Editor({ initial, collections, onSaved, onMsg }) {
   const [f, setF] = useState(initial);
   const [previewUrl, setPreviewUrl] = useState(null);
   const [showPreview, setShowPreview] = useState(false);
@@ -164,16 +175,23 @@ function Editor({ initial, onSaved, onMsg }) {
   const [busy, setBusy] = useState(false);
   const editorRef = useRef(null);
   const dragging = useRef(false);
-  const coverIn = useRef(null);
-  const set = (k) => (e) => setF({ ...f, [k]: e.target.type === 'checkbox' ? e.target.checked : e.target.value });
 
-  async function pickCover(ev) {
-    const file = ev.target.files?.[0]; ev.target.value = '';
-    if (!file) return;
-    setBusy(true);
-    try { const { url } = await api.upload(file); setF((p) => ({ ...p, cover_image: url })); }
-    catch (e) { onMsg({ type: 'err', text: e.message }); }
-    finally { setBusy(false); }
+  const cols = collections || [];
+  const collection = cols.find((c) => c.kind === f.kind) || cols[0] || { fields: [] };
+  const fields = collection.fields || [];
+  const titleField = fields.find((x) => x.name === 'title') || fields.find((x) => x.type === 'string' && x.required) || null;
+  const bodyField = fields.find(isBody);
+  const draftField = fields.find((x) => x.type === 'bool' && x.name === 'draft');
+  const shortFields = fields.filter((x) => x !== titleField && !isBody(x) && isShort(x));
+  const longFields = fields.filter((x) => x !== titleField && !isBody(x) && !isShort(x));
+  const isDraft = draftField ? !!f[draftField.name] : false;
+  const hasSlugField = fields.some((x) => x.name === 'slug');
+
+  const setField = (name, val) => setF((p) => ({ ...p, [name]: val }));
+  const upload = async (file) => (await api.upload(file)).url;
+  function changeKind(kind) {
+    const col = cols.find((c) => c.kind === kind);
+    if (col) setF({ isNew: true, kind, path: '', ...blankForm(col) });
   }
 
   // Ziehbarer Trenner Editor ↔ Vorschau.
@@ -190,23 +208,22 @@ function Editor({ initial, onSaved, onMsg }) {
   }, []);
   function startDrag(e) { dragging.current = true; document.body.style.cursor = 'col-resize'; document.body.style.userSelect = 'none'; e.preventDefault(); }
 
-  function currentPath(data = f) {
-    if (!data.isNew) return data.path;
-    const slug = (data.slug || '').trim();
-    if (!slug) return '';
-    return data.type === 'beitrag' ? `library/${data.section}/${slug}.md` : `${slug}.md`;
-  }
-
-  // overrides erlauben z.B. { draft: false } beim Publizieren.
   async function save(overrides = {}) {
     const data = { ...f, ...overrides };
-    const path = currentPath(data);
-    if (!path) { onMsg({ type: 'err', text: 'Bitte einen Slug angeben.' }); return null; }
-    if (!data.title.trim()) { onMsg({ type: 'err', text: 'Titel fehlt.' }); return null; }
+    const path = data.isNew ? targetPath(data, collection) : data.path;
+    if (!path) { onMsg({ type: 'err', text: 'Bitte einen Slug (und ggf. Pflichtsegmente wie Rubrik) angeben.' }); return null; }
+    if (titleField && !((data[titleField.name] || '').trim())) { onMsg({ type: 'err', text: 'Titel fehlt.' }); return null; }
     setBusy(true);
     try {
-      await api.save(path, buildFrontmatter(data), data.body);
-      const loaded = fromRead(await api.read(path));
+      const fm = frontmatterFromForm(data, collection);
+      const body = bodyField ? (data[bodyField.name] || '') : '';
+      await api.save(path, fm, body);
+      const r = await api.read(path);
+      const loaded = {
+        isNew: false, kind: data.kind, path,
+        ...formFromFrontmatter(r.frontmatter || {}, collection),
+        ...(bodyField ? { [bodyField.name]: r.body || '' } : {}),
+      };
       onSaved(loaded); setF(loaded);
       return path;
     } catch (e) { onMsg({ type: 'err', text: e.message }); return null; }
@@ -220,8 +237,8 @@ function Editor({ initial, onSaved, onMsg }) {
     finally { setBusy(false); }
   }
   async function publish() {
-    if (!confirm('Live publizieren? Der Beitrag wird aus „Entwurf“ genommen.')) return;
-    const path = await save({ draft: false }); // Publizieren = nicht mehr Entwurf
+    if (!confirm('Live publizieren?')) return;
+    const path = await save(draftField ? { [draftField.name]: false } : {});
     if (!path) return;
     setBusy(true);
     try { const res = await api.publish(path); onMsg({ type: 'ok', text: `Live: ${res.url}` }); }
@@ -235,7 +252,7 @@ function Editor({ initial, onSaved, onMsg }) {
         <div className="editor-head">
           <div className="crumb">{f.isNew ? 'Neuer Eintrag' : f.path}</div>
           <span className="spacer" />
-          {f.draft ? <span className="status draft">Entwurf</span> : <span className="status live">Veröffentlicht</span>}
+          {draftField && (isDraft ? <span className="status draft">Entwurf</span> : <span className="status live">Veröffentlicht</span>)}
           <button className="toggle" onClick={() => setShowPreview((v) => !v)} title="Vorschau ein/aus">
             {showPreview ? 'Vorschau ⤫' : 'Vorschau ⤢'}
           </button>
@@ -248,59 +265,37 @@ function Editor({ initial, onSaved, onMsg }) {
           {f.isNew && (
             <div className="row">
               <label className="sm">Typ
-                <select value={f.type} onChange={set('type')}>
-                  <option value="beitrag">Beitrag</option>
-                  <option value="seite">Seite</option>
+                <select value={f.kind} onChange={(e) => changeKind(e.target.value)}>
+                  {cols.map((c) => <option key={c.kind} value={c.kind}>{c.label}</option>)}
                 </select>
               </label>
-              {f.type === 'beitrag' && (
-                <label className="sm">Rubrik
-                  <select value={f.section} onChange={set('section')}>{SECTIONS.map((s) => <option key={s}>{s}</option>)}</select>
+              {!hasSlugField && (
+                <label className="sm">Dateiname
+                  <input value={f.slug || ''} onChange={(e) => setField('slug', e.target.value)} placeholder="z. B. impressum" />
                 </label>
               )}
-              <label>Slug<input value={f.slug} onChange={set('slug')} placeholder="z.B. neuer-beitrag" /></label>
             </div>
           )}
 
-          <label className="big">Titel<input value={f.title} onChange={set('title')} placeholder="Titel des Beitrags" /></label>
+          {titleField && (
+            <label className="big">{titleField.label || 'Titel'}
+              <input value={f[titleField.name] || ''} onChange={(e) => setField(titleField.name, e.target.value)} placeholder="Titel" />
+            </label>
+          )}
 
+          {shortFields.length > 0 && (
             <div className="meta">
-            <label className="sm">Datum<input type="date" value={f.date} onChange={set('date')} /></label>
-            <label className="xs">Reihenfolge<input type="number" value={f.weight} onChange={set('weight')} placeholder="weight" /></label>
-            <label className="sm">Farbe
-              <div className="colorpick">
-                <span className="swatch" style={{ background: hexOf(f.color) }} />
-                <select value={f.color} onChange={set('color')}>{COLORS.map(([v, label]) => <option key={v} value={v}>{label}</option>)}</select>
-              </div>
-            </label>
-            <label className="sm">Layout
-              <select value={f.layout} onChange={set('layout')}>{LAYOUTS.map((l) => <option key={l} value={l}>{l || '(automatisch)'}</option>)}</select>
-            </label>
-            <label>Tags<input value={f.tags} onChange={set('tags')} placeholder="komma, getrennt" /></label>
-            <label className="check"><input type="checkbox" checked={f.toc} onChange={set('toc')} /> Inhaltsverz.</label>
-            <label className="check"><input type="checkbox" checked={f.draft} onChange={set('draft')} /> Entwurf</label>
+              {shortFields.map((fld) => <Field key={fld.name} field={fld} value={f[fld.name]} onChange={setField} onUpload={upload} busy={busy} />)}
             </div>
+          )}
 
-          <label>Kurztext (summary)<input value={f.summary} onChange={set('summary')} /></label>
-          <div className="row">
-            <label>Cover-Bild
-              <div className="cover-row">
-                <input value={f.cover_image} onChange={set('cover_image')} placeholder="/images/…jpg" />
-                <button type="button" onClick={() => coverIn.current?.click()} disabled={busy}>Hochladen</button>
-                <input ref={coverIn} type="file" accept="image/*" hidden onChange={pickCover} />
-                {f.cover_image && <span className="cover-thumb" style={{ backgroundImage: `url(${f.cover_image})` }} />}
-              </div>
-            </label>
-            <label>Externer Link<input value={f.external} onChange={set('external')} placeholder="https://…" /></label>
-          </div>
-          <label>Autor:innen (E-Mails, Komma — für gemeinsamen Zugriff)
-            <input value={f.authors} onChange={set('authors')} placeholder="du@…, kollege@…" />
-          </label>
+          {longFields.map((fld) => <Field key={fld.name} field={fld} value={f[fld.name]} onChange={setField} onUpload={upload} busy={busy} />)}
 
+          {bodyField && (
             <div className="rich">
-            <RichEditor value={f.body} onChange={(body) => setF((p) => ({ ...p, body }))}
-              onUpload={async (file) => (await api.upload(file)).url} />
+              <RichEditor value={f[bodyField.name] || ''} onChange={(body) => setField(bodyField.name, body)} onUpload={upload} />
             </div>
+          )}
         </div>
       </div>
 
@@ -394,6 +389,112 @@ function Profile({ onMsg }) {
         <label>Über mich<textarea value={p.bio} onChange={set('bio')} rows={5} placeholder="Kurzer Text über dich…" /></label>
         <div className="actions"><button className="primary" onClick={save} disabled={busy}>Speichern</button></div>
       </div>
+      <PasswordChange onMsg={onMsg} />
+    </div>
+  );
+}
+
+function PasswordChange({ onMsg }) {
+  const [cur, setCur] = useState('');
+  const [nxt, setNxt] = useState('');
+  const [busy, setBusy] = useState(false);
+  async function submit(e) {
+    e.preventDefault();
+    if (nxt.length < 6) { onMsg({ type: 'err', text: 'Neues Passwort zu kurz (min. 6 Zeichen).' }); return; }
+    setBusy(true);
+    try { await api.changePassword(cur, nxt); onMsg({ type: 'ok', text: 'Passwort geändert.' }); setCur(''); setNxt(''); }
+    catch (e) { onMsg({ type: 'err', text: e.message }); }
+    finally { setBusy(false); }
+  }
+  return (
+    <div className="profile-card">
+      <h2>Passwort ändern</h2>
+      <form onSubmit={submit}>
+        <label>Aktuelles Passwort<input type="password" value={cur} onChange={(e) => setCur(e.target.value)} autoComplete="current-password" /></label>
+        <label>Neues Passwort<input type="password" value={nxt} onChange={(e) => setNxt(e.target.value)} autoComplete="new-password" /></label>
+        <div className="actions"><button className="primary" disabled={busy}>Passwort setzen</button></div>
+      </form>
+    </div>
+  );
+}
+
+// ── Übersicht / Dashboard (nur Admin) ───────────────────────────────────────
+function Overview({ onMsg, go }) {
+  const [s, setS] = useState(null);
+  useEffect(() => { api.stats().then(setS).catch((e) => onMsg({ type: 'err', text: e.message })); }, []);
+  if (!s) return <div className="empty">…</div>;
+  const Card = ({ label, value, hint, to }) => (
+    <button className="stat-card" onClick={to ? () => go(to) : undefined} disabled={!to}>
+      <span className="stat-value">{value ?? 0}</span>
+      <span className="stat-label">{label}</span>
+      <span className="stat-hint">{hint || ' '}</span>
+    </button>
+  );
+  const content = s.content || {};
+  const d = s.dialog || { forums: 0, threads: 0, comments: 0 };
+  const hasDialog = (d.forums + d.threads + d.comments) > 0;
+  return (
+    <div className="overview">
+      <h2>Übersicht</h2>
+      <div className="stat-grid">
+        {Object.entries(content).map(([k, v]) => <Card key={k} label={k} value={v} to="content" />)}
+        <Card label="Autor:innen" value={s.users?.total} hint={`${s.users?.admin || 0} Admin · ${s.users?.editor || 0} Red.`} to="users" />
+        {hasDialog && <Card label="Foren" value={d.forums} to="forums" />}
+        {hasDialog && <Card label="Threads" value={d.threads} to="moderation" />}
+        {hasDialog && <Card label="Wortmeldungen" value={d.comments} to="moderation" />}
+      </div>
+      <div className="overview-actions">
+        <h3>Schnellzugriff</h3>
+        <div className="quick">
+          <button onClick={() => go('content')}>Inhalte bearbeiten</button>
+          {hasDialog && <button onClick={() => go('forums')}>Foren verwalten</button>}
+          <button onClick={() => go('users')}>Autor:innen &amp; Rollen</button>
+          <a className="quick-link" href="/" target="_blank" rel="noreferrer">Website ↗</a>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+// ── System (nur Admin): core-Version, Update-Check, Admins, Plugins, Modell ──
+function System({ onMsg }) {
+  const [s, setS] = useState(null);
+  const [upd, setUpd] = useState(null);
+  useEffect(() => {
+    api.system().then(setS).catch((e) => onMsg({ type: 'err', text: e.message }));
+    api.systemUpdate().then(setUpd).catch(() => {});
+  }, []);
+  if (!s) return <div className="empty">…</div>;
+  const badge = !upd ? null
+    : upd.available ? <span className="status draft">core v{upd.vendored} bereit — Rebuild nötig</span>
+    : upd.vendored ? <span className="status live">aktuell</span>
+    : <span className="muted">(kein Subtree)</span>;
+  return (
+    <div className="profile">
+      <div className="profile-card wide">
+        <h2>System</h2>
+        <div className="sysgrid">
+          <div><span className="muted">Core</span><b>{s.core.name} <span className="ver">v{s.core.version}</span></b> {badge}</div>
+          <div><span className="muted">Site</span><b>{s.site || '—'}</b></div>
+          <div><span className="muted">Auth</span><b>{s.auth}</b></div>
+          <div><span className="muted">Hugo</span><b>{s.hugo}</b></div>
+        </div>
+        <h3>Admins <span className="count-pill">{(s.admins || []).length}</span></h3>
+        <ul className="syslist">{(s.admins || []).map((a) => (
+          <li key={a}><b>{a}</b><span className="muted">aus Config (fix)</span></li>
+        ))}</ul>
+        <h3>Plugins <span className="count-pill">{s.plugins.length}</span></h3>
+        {s.plugins.length
+          ? <ul className="syslist">{s.plugins.map((p) => (
+              <li key={p.name}><b>{p.name}</b><span className="muted">{p.routes} Routen · {p.migrations} Migration(en)</span></li>
+            ))}</ul>
+          : <p className="muted">Keine Plugins aktiv.</p>}
+        <h3>Content-Modell <span className="count-pill">{s.collections.length}</span></h3>
+        <ul className="syslist">{s.collections.map((c) => (
+          <li key={c.kind}><b>{c.label}</b><span className="muted">{c.kind} · {c.fields} Felder{c.statKey ? ` · ${c.statKey}` : ''}</span></li>
+        ))}</ul>
+        <p className="muted who-mail">openbureau-core fährt diese Site. Updates werden serverseitig eingespielt (Update-Skript).</p>
+      </div>
     </div>
   );
 }
@@ -403,7 +504,11 @@ function Users({ onMsg, currentEmail }) {
   const [list, setList] = useState(null);
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
+  const [role, setRole] = useState('user');
   const [busy, setBusy] = useState(false);
+  const [q, setQ] = useState('');
+  const [pwFor, setPwFor] = useState(null);
+  const [newPw, setNewPw] = useState('');
 
   async function refresh() {
     try { setList(await api.listUsers()); }
@@ -413,59 +518,85 @@ function Users({ onMsg, currentEmail }) {
 
   async function create(e) {
     e.preventDefault(); setBusy(true);
-    try { await api.createUser(email, password); onMsg({ type: 'ok', text: 'Autor:in angelegt.' }); setEmail(''); setPassword(''); refresh(); }
-    catch (err) { onMsg({ type: 'err', text: err.message }); }
+    try {
+      await api.createUser(email, password, role);
+      onMsg({ type: 'ok', text: 'Autor:in angelegt.' });
+      setEmail(''); setPassword(''); setRole('user'); refresh();
+    } catch (err) { onMsg({ type: 'err', text: err.message }); }
     finally { setBusy(false); }
   }
   async function remove(u) {
-    if (!confirm(`${u.email} löschen?`)) return;
+    if (!confirm(`${u.email} wirklich löschen?`)) return;
     try { await api.deleteUser(u.id); refresh(); }
     catch (e) { onMsg({ type: 'err', text: e.message }); }
   }
-  async function reset(u) {
-    const pw = prompt(`Neues Passwort für ${u.email}:`);
-    if (!pw) return;
-    try { await api.setPassword(u.id, pw); onMsg({ type: 'ok', text: 'Passwort gesetzt.' }); }
+  async function savePw(u) {
+    if (!newPw || newPw.length < 6) { onMsg({ type: 'err', text: 'Passwort zu kurz (min. 6 Zeichen).' }); return; }
+    try { await api.setPassword(u.id, newPw); onMsg({ type: 'ok', text: 'Passwort gesetzt.' }); setPwFor(null); setNewPw(''); }
     catch (e) { onMsg({ type: 'err', text: e.message }); }
   }
-  async function changeRole(u, role) {
-    try { await api.setRole(u.id, role); onMsg({ type: 'ok', text: `Rolle: ${ROLE_LABEL[role]}` }); refresh(); }
+  async function changeRole(u, r) {
+    try { await api.setRole(u.id, r); onMsg({ type: 'ok', text: `Rolle: ${ROLE_LABEL[r]}` }); refresh(); }
     catch (e) { onMsg({ type: 'err', text: e.message }); }
   }
 
   if (!list) return <div className="empty">…</div>;
+  const filtered = q ? list.filter((u) => u.email.toLowerCase().includes(q.toLowerCase())) : list;
+  const RoleSelect = ({ u }) => (
+    <select className="role-select" value={u.role} onChange={(e) => changeRole(u, e.target.value)}>
+      <option value="user">User</option><option value="editor">Redakteur</option><option value="admin">Admin</option>
+    </select>
+  );
   return (
     <div className="profile">
-      <div className="profile-card">
-        <h2>Autor:innen &amp; Rollen</h2>
+      <div className="profile-card wide">
+        <h2>Autor:innen &amp; Rollen <span className="count-pill">{list.length}</span></h2>
         <form className="userform" onSubmit={create}>
           <input type="email" placeholder="E-Mail" value={email} onChange={(e) => setEmail(e.target.value)} required />
           <input type="text" placeholder="Passwort" value={password} onChange={(e) => setPassword(e.target.value)} required />
+          <select className="role-select" value={role} onChange={(e) => setRole(e.target.value)}>
+            <option value="user">User</option><option value="editor">Redakteur</option><option value="admin">Admin</option>
+          </select>
           <button className="primary" disabled={busy}>Anlegen</button>
         </form>
+        {list.length > 6 && <input className="userfilter" placeholder="filtern…" value={q} onChange={(e) => setQ(e.target.value)} />}
         <ul className="userlist">
-          {list.map((u) => (
+          {filtered.map((u) => (
             <li key={u.id}>
-              <span className="t">{u.email}</span>
-              {u.fixedAdmin
-                ? <span className="status live">Admin (.env)</span>
-                : <select className="role-select" value={u.role} onChange={(e) => changeRole(u, e.target.value)}>
-                    <option value="user">User</option>
-                    <option value="editor">Redakteur</option>
-                    <option value="admin">Admin</option>
-                  </select>}
-              <button onClick={() => reset(u)}>Passwort</button>
+              <span className="uavatar" style={avatarStyle(u.email)}>{(u.email || '?').slice(0, 1).toUpperCase()}</span>
+              <span className="t ucol">
+                <span className="uemail">{u.email}{u.email === currentEmail && <span className="you"> · du</span>}</span>
+                <span className="umeta">
+                  angelegt {fmtDate(u.created_at)}
+                  {u.last_sign_in_at ? ` · zuletzt aktiv ${fmtDate(u.last_sign_in_at)}` : ' · nie angemeldet'}
+                </span>
+              </span>
+              {u.fixedAdmin ? <span className="rolebadge admin">Admin · .env</span> : <RoleSelect u={u} />}
+              {pwFor === u.id ? (
+                <span className="pwinline">
+                  <input type="text" placeholder="neues Passwort" value={newPw} autoFocus
+                    onChange={(e) => setNewPw(e.target.value)}
+                    onKeyDown={(e) => { if (e.key === 'Enter') savePw(u); if (e.key === 'Escape') { setPwFor(null); setNewPw(''); } }} />
+                  <button onClick={() => savePw(u)}>OK</button>
+                  <button onClick={() => { setPwFor(null); setNewPw(''); }}>✕</button>
+                </span>
+              ) : (
+                <button onClick={() => { setPwFor(u.id); setNewPw(''); }}>Passwort</button>
+              )}
               {u.email !== currentEmail && !u.fixedAdmin && <button onClick={() => remove(u)}>Löschen</button>}
             </li>
           ))}
         </ul>
-        <p className="muted who-mail"><b>User</b> schreiben nur im Forum · <b>Redakteur</b> moderiert · <b>Admin</b> verwaltet alles. Admins aus <code>ADMIN_EMAILS</code> sind fix.</p>
+        <p className="muted who-mail"><b>User</b> schreiben im Forum · <b>Redakteur</b> moderiert · <b>Admin</b> verwaltet alles. Admins aus <code>ADMIN_EMAILS</code> sind fix.</p>
       </div>
     </div>
   );
 }
 
 const ROLE_LABEL = { user: 'User', editor: 'Redakteur', admin: 'Admin' };
+function fmtDate(ts) { if (!ts) return '—'; try { return new Date(ts).toLocaleDateString('de-CH'); } catch { return '—'; } }
+function uHashHue(s) { let h = 0; for (let i = 0; i < (s || '').length; i++) h = (h * 31 + s.charCodeAt(i)) | 0; return Math.abs(h) % 360; }
+function avatarStyle(s) { const h = uHashHue(s); return { background: `hsl(${h} 36% 82%)`, color: `hsl(${h} 30% 28%)` }; }
 
 // ── Foren-Verwaltung (nur Admin) ────────────────────────────────────────────
 function Forums({ onMsg }) {
@@ -599,36 +730,3 @@ function slugify(s) {
   return (s || '').toLowerCase().normalize('NFD').replace(/[̀-ͯ]/g, '')
     .replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
 }
-
-// ── Mapping Datei-Lesart → Formular ────────────────────────────────────────
-function fromRead(r) {
-  const fm = r.frontmatter || {};
-  return {
-    isNew: false, path: r.path, type: 'beitrag', section: '', slug: '',
-    title: fm.title || '', date: fm.date ? String(fm.date).slice(0, 10) : '',
-    weight: fm.weight ?? '', color: fm.color || '', layout: fm.layout || '',
-    tags: Array.isArray(fm.tags) ? fm.tags.join(', ') : '',
-    summary: fm.summary || '', description: fm.description || '',
-    cover_image: fm.cover_image || '', external: fm.external || '',
-    authors: Array.isArray(fm.authors) ? fm.authors.join(', ') : (fm.authors || ''),
-    toc: !!fm.toc, draft: !!fm.draft, body: r.body || '',
-  };
-}
-function buildFrontmatter(f) {
-  const fm = { title: f.title };
-  if (f.date) fm.date = f.date;
-  if (f.weight !== '' && f.weight != null) fm.weight = Number(f.weight);
-  const tags = f.tags ? f.tags.split(',').map((t) => t.trim()).filter(Boolean) : [];
-  if (tags.length) fm.tags = tags;
-  if (f.summary) fm.summary = f.summary;
-  if (f.description) fm.description = f.description;
-  if (f.cover_image) fm.cover_image = f.cover_image;
-  if (f.layout) fm.layout = f.layout;
-  if (f.external) fm.external = f.external;
-  if (f.color) fm.color = f.color;
-  const authors = f.authors ? f.authors.split(',').map((t) => t.trim()).filter(Boolean) : [];
-  if (authors.length) fm.authors = authors;
-  if (f.toc) fm.toc = true;
-  if (f.draft) fm.draft = true;
-  return fm;
-}

cms/core/admin/src/api.js

@@ -44,8 +44,13 @@ export const api = {
   getProfile: () => call('/profile'),
   saveProfile: (p) => call('/profile', { method: 'PUT', body: JSON.stringify(p) }),
   getMe: () => call('/me'),
+  stats: () => call('/stats'),
+  system: () => call('/system'),
+  systemUpdate: () => call('/system/update'),
+  schema: () => call('/schema'),
+  changePassword: (current, next) => call('/account/password', { method: 'POST', body: JSON.stringify({ current, next }) }),
   listUsers: () => call('/users'),
-  createUser: (email, password) => call('/users', { method: 'POST', body: JSON.stringify({ email, password }) }),
+  createUser: (email, password, role) => call('/users', { method: 'POST', body: JSON.stringify({ email, password, role }) }),
   setPassword: (id, password) => call(`/users/${id}`, { method: 'PUT', body: JSON.stringify({ password }) }),
   setRole: (id, role) => call(`/users/${id}`, { method: 'PUT', body: JSON.stringify({ role }) }),
   deleteUser: (id) => call(`/users/${id}`, { method: 'DELETE' }),

cms/core/admin/src/fields.jsx

@@ -0,0 +1,154 @@
+// Schema-driven form fields. The editor renders a collection's `fields` (from
+// /api/schema) generically, so the SAME admin works for any site's content model
+// (openbureau, kgva, …). Field types → controls; markdown ('body') is handled by
+// the rich editor in App.jsx, not here.
+//
+// A field: { name, type, required?, options?, default?, hint?, palette? }
+// Types: string | text | slug | number | date | bool | select | list | image |
+//        color | markdown (markdown rendered separately).
+
+// openbureau's named colour palette — used for type:'color' when no per-field
+// palette is given. Harmless elsewhere (sites without colour fields never see it).
+export const DEFAULT_PALETTE = [
+  ['', 'keine', 'transparent'],
+  ['ajisai', 'Ajisai · Hortensie', '#A39EC4'], ['sakura', 'Sakura · Kirschblüte', '#C49EC4'],
+  ['suna', 'Suna · Sand', '#C4C19E'], ['ichigo', 'Ichigo · Erdbeere', '#C49EA0'],
+  ['yuyake', 'Yuyake · Sonnenuntergang', '#CEB188'], ['sora', 'Sora · Himmel', '#9EC3C4'],
+  ['kusa', 'Kusa · Gras', '#9EC49F'], ['kori', 'Kori · Eis', '#A5B4CB'],
+  ['amagumo', 'Amagumo · Regenwolke', '#4C4C4C'], ['yuki', 'Yuki · Schnee', '#F0F0F0'],
+];
+export const hexOf = (palette, name) => (palette.find((c) => c[0] === name) || [])[2] || 'transparent';
+
+const SHORT = new Set(['string', 'slug', 'number', 'date', 'bool', 'select', 'color']);
+export const isShort = (f) => SHORT.has(f.type);
+export const isBody = (f) => f.type === 'markdown';
+
+// Empty form for a new entry of `collection`.
+export function blankForm(collection) {
+  const f = { __raw: {} };
+  for (const fld of collection.fields || []) {
+    if (isBody(fld)) { f[fld.name] = fld.default ?? ''; continue; }
+    if (fld.type === 'bool') f[fld.name] = fld.default ?? false;
+    else if (fld.type === 'list') f[fld.name] = '';
+    else f[fld.name] = fld.default ?? '';
+  }
+  return f;
+}
+
+// Frontmatter (from disk) → form values, per field type. The full original
+// frontmatter is stashed under __raw so unknown keys survive a save (no data loss).
+export function formFromFrontmatter(fm, collection) {
+  const f = { __raw: fm || {} };
+  for (const fld of collection.fields || []) {
+    const v = fm[fld.name];
+    if (fld.type === 'bool') f[fld.name] = !!v;
+    else if (fld.type === 'list') f[fld.name] = Array.isArray(v) ? v.join(', ') : (v || '');
+    else if (fld.type === 'date') f[fld.name] = v ? String(v).slice(0, 10) : '';
+    else if (fld.type === 'number') f[fld.name] = v ?? '';
+    else f[fld.name] = v ?? '';
+  }
+  return f;
+}
+
+// Form values → frontmatter. Starts from any preserved __raw (so fields not in the
+// schema, e.g. image galleries, are kept), then sets/clears the schema fields.
+export function frontmatterFromForm(form, collection) {
+  const fm = { ...(form.__raw || {}) };
+  const setOrDrop = (k, v) => { if (v === '' || v == null || (Array.isArray(v) && !v.length)) delete fm[k]; else fm[k] = v; };
+  for (const fld of collection.fields || []) {
+    const v = form[fld.name];
+    if (fld.type === 'bool') { if (v) fm[fld.name] = true; else delete fm[fld.name]; continue; }
+    if (fld.type === 'number') { setOrDrop(fld.name, v === '' || v == null ? '' : Number(v)); continue; }
+    if (fld.type === 'list') { setOrDrop(fld.name, (v || '').split(',').map((x) => x.trim()).filter(Boolean)); continue; }
+    setOrDrop(fld.name, v);
+  }
+  return fm;
+}
+
+// Build the target path from collection.path ( e.g. 'archiv/:section/:slug' ),
+// falling back to '<slug>.md' (or '<id>.md' when there is no slug field).
+export function targetPath(form, collection) {
+  const tmpl = collection.path;
+  const slug = (form.slug || '').trim();
+  if (tmpl) {
+    const rel = tmpl.replace(/:([a-z_]+)/gi, (_, k) => (form[k] || '').toString().trim());
+    if (rel.includes('//') || rel.endsWith('/') || /:/.test(rel)) return ''; // missing segment
+    return rel + '.md';
+  }
+  if (slug) return `${slug}.md`;
+  return '';
+}
+
+// One field control (everything except markdown/body).
+export function Field({ field, value, onChange, onUpload, busy }) {
+  const set = (val) => onChange(field.name, val);
+  const label = field.label || field.name;
+  const palette = field.palette || DEFAULT_PALETTE;
+
+  if (field.type === 'bool') {
+    return <label className="check"><input type="checkbox" checked={!!value} onChange={(e) => set(e.target.checked)} /> {label}</label>;
+  }
+  if (field.type === 'select') {
+    return (
+      <label className="sm">{label}
+        <select value={value || ''} onChange={(e) => set(e.target.value)}>
+          {!field.required && <option value="">(—)</option>}
+          {(field.options || []).map((o) => <option key={o} value={o}>{o}</option>)}
+        </select>
+      </label>
+    );
+  }
+  if (field.type === 'color') {
+    return (
+      <label className="sm">{label}
+        <div className="colorpick">
+          <span className="swatch" style={{ background: hexOf(palette, value) }} />
+          <select value={value || ''} onChange={(e) => set(e.target.value)}>
+            {palette.map(([v, lbl]) => <option key={v} value={v}>{lbl}</option>)}
+          </select>
+        </div>
+      </label>
+    );
+  }
+  if (field.type === 'image') {
+    return (
+      <label>{label}
+        <div className="cover-row">
+          <input value={value || ''} onChange={(e) => set(e.target.value)} placeholder="/img/…" />
+          <ImageUpload onUpload={onUpload} onDone={set} busy={busy} />
+          {value && <span className="cover-thumb" style={{ backgroundImage: `url(${value})` }} />}
+        </div>
+      </label>
+    );
+  }
+  if (field.type === 'text') {
+    return <label>{label}<textarea value={value || ''} rows={2} onChange={(e) => set(e.target.value)} placeholder={field.hint || ''} /></label>;
+  }
+  if (field.type === 'number') {
+    return <label className="xs">{label}<input type="number" value={value ?? ''} onChange={(e) => set(e.target.value)} placeholder={field.hint || ''} /></label>;
+  }
+  if (field.type === 'date') {
+    return <label className="sm">{label}<input type="date" value={value || ''} onChange={(e) => set(e.target.value)} /></label>;
+  }
+  if (field.type === 'list') {
+    return <label>{label}<input value={value || ''} onChange={(e) => set(e.target.value)} placeholder={field.hint || 'komma, getrennt'} /></label>;
+  }
+  // string, slug, and any unknown type → text input
+  const cls = field.type === 'slug' ? 'sm' : '';
+  return <label className={cls}>{label}<input value={value || ''} onChange={(e) => set(e.target.value)} placeholder={field.hint || ''} /></label>;
+}
+
+import { useRef } from 'react';
+function ImageUpload({ onUpload, onDone, busy }) {
+  const ref = useRef(null);
+  return (
+    <>
+      <button type="button" onClick={() => ref.current?.click()} disabled={busy}>Hochladen</button>
+      <input ref={ref} type="file" accept="image/*" hidden onChange={async (ev) => {
+        const file = ev.target.files?.[0]; ev.target.value = '';
+        if (!file) return;
+        try { onDone(await onUpload(file)); } catch { /* ignore */ }
+      }} />
+    </>
+  );
+}

cms/core/admin/src/styles.css

@@ -184,7 +184,48 @@ label.big input { font-family: var(--serif); font-weight: 600; }
 .mod-actions a { color: var(--muted); }
 .mod-actions button { padding: 4px 11px; font-size: 12.5px; }
 
+/* ── Übersicht / Dashboard ── */
+.overview { width: 100%; overflow: auto; padding: 30px 28px; }
+.overview h2 { font-family: var(--serif); font-weight: 600; margin: 0 0 18px; }
+.stat-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(150px, 1fr)); gap: 12px; }
+.stat-card { display: flex; flex-direction: column; align-items: flex-start; gap: 2px; text-align: left;
+  background: var(--panel); border: 1px solid var(--line); border-radius: var(--radius); padding: 16px 18px; box-shadow: var(--shadow); }
+.stat-card:not(:disabled):hover { border-color: var(--accent-soft); transform: translateY(-1px); }
+.stat-card:disabled { opacity: 1; cursor: default; }
+.stat-value { font-family: var(--display); font-weight: 700; font-size: 30px; line-height: 1; color: var(--accent); }
+.stat-label { font-family: var(--serif); font-size: 15px; margin-top: 6px; }
+.stat-hint { font-size: 11.5px; color: var(--muted); min-height: 1em; }
+.overview-actions { margin-top: 30px; }
+.overview-actions h3 { font-family: var(--display); font-size: 12px; font-weight: 700; letter-spacing: .12em; text-transform: uppercase; color: var(--muted); margin: 0 0 10px; }
+.quick { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
+.quick-link { display: inline-flex; align-items: center; padding: 8px 16px; border: 1px solid var(--line); border-radius: var(--pill); text-decoration: none; color: var(--muted); }
+.quick-link:hover { border-color: var(--accent-soft); color: var(--text); }
+
+/* ── Nutzerliste (aufgewertet) ── */
+.count-pill { font-family: var(--sans); font-size: 12px; font-weight: 500; color: var(--muted); background: var(--panel-2); border-radius: 20px; padding: 2px 9px; vertical-align: middle; margin-left: 6px; }
+.userfilter { margin: 4px 0 2px; height: 34px; }
+.userlist .uavatar { width: 30px; height: 30px; border-radius: 50%; display: grid; place-items: center; font-weight: 600; font-size: 13px; flex: none; }
+.userlist .ucol { flex-direction: column; align-items: flex-start; gap: 1px; min-width: 0; }
+.uemail { font-family: var(--serif); font-size: 14.5px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 100%; }
+.uemail .you { color: var(--accent); font-family: var(--sans); font-size: 12px; }
+.umeta { font-size: 11.5px; color: var(--muted); }
+.rolebadge { font-size: 11px; border-radius: var(--pill); padding: 3px 10px; font-weight: 600; flex: none; }
+.rolebadge.admin { color: var(--accent); background: rgba(181,74,44,.12); }
+.pwinline { display: flex; align-items: center; gap: 5px; flex: none; }
+.pwinline input { width: 150px; height: 30px; }
+.pwinline button { padding: 4px 10px; font-size: 12.5px; }
+
 /* ── Toast ── */
 .toast { position: fixed; bottom: 20px; right: 20px; padding: 11px 18px; border-radius: 11px; color: #fff; cursor: pointer; box-shadow: 0 10px 30px -12px rgba(0,0,0,.4); font-size: 13.5px; max-width: 380px; z-index: 50; }
 .toast.ok { background: var(--ok); }
 .toast.err { background: var(--accent); }
+
+/* System-Panel */
+.sysgrid { display: grid; grid-template-columns: repeat(auto-fit, minmax(140px, 1fr)); gap: .75rem; margin: .5rem 0 1rem; }
+.sysgrid > div { display: flex; flex-direction: column; gap: .15rem; }
+.sysgrid .muted { font-size: .8rem; }
+.sysgrid b { font-size: 1.05rem; }
+.sysgrid .ver { opacity: .6; font-weight: 400; }
+.syslist { list-style: none; padding: 0; margin: .25rem 0 1rem; }
+.syslist li { display: flex; justify-content: space-between; align-items: baseline; gap: 1rem; padding: .4rem 0; border-bottom: 1px solid var(--line); }
+.syslist li .muted { font-size: .85rem; }

cms/core/admin/src/supabase.js

@@ -0,0 +1,44 @@
+import { createClient } from '@supabase/supabase-js';
+
+// Öffentliche Browser-Werte (zur Build-Zeit von Vite eingesetzt). Der anon-Key
+// ist per Design öffentlich; die echte Autorität liegt server-seitig.
+const url = import.meta.env.VITE_SUPABASE_URL;
+const anonKey = import.meta.env.VITE_SUPABASE_ANON_KEY;
+
+// Mit Supabase-URL: echter Client (openbureau, unverändert). Ohne (DB-loser core,
+// auth: 'local', z. B. kgva): ein Shim mit DERSELBEN auth-Schnittstelle, die App/
+// api nutzen — getSession / onAuthStateChange / signInWithPassword / signOut —
+// gegen /api/auth/login, Token in localStorage. So bleibt der Supabase-Pfad
+// völlig unangetastet, und der lokale Pfad braucht keine Änderung an App/api.
+function localAuthClient() {
+  const KEY = 'cms_local_session';
+  const read = () => { try { return JSON.parse(localStorage.getItem(KEY) || 'null'); } catch { return null; } };
+  let listeners = [];
+  const emit = (s) => listeners.forEach((cb) => { try { cb(s ? 'SIGNED_IN' : 'SIGNED_OUT', s); } catch { /* ignore */ } });
+  return {
+    auth: {
+      async getSession() { return { data: { session: read() } }; },
+      onAuthStateChange(cb) {
+        listeners.push(cb);
+        return { data: { subscription: { unsubscribe() { listeners = listeners.filter((l) => l !== cb); } } } };
+      },
+      async signInWithPassword({ email, password }) {
+        try {
+          const r = await fetch('/api/auth/login', {
+            method: 'POST', headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email, password }),
+          });
+          const j = await r.json().catch(() => ({}));
+          if (!r.ok) return { error: { message: j.error || `HTTP ${r.status}` } };
+          const session = { access_token: j.access_token, user: { id: j.user.id, email: j.user.email } };
+          localStorage.setItem(KEY, JSON.stringify(session));
+          emit(session);
+          return { data: { session }, error: null };
+        } catch (e) { return { error: { message: String(e.message || e) } }; }
+      },
+      async signOut() { localStorage.removeItem(KEY); emit(null); return { error: null }; },
+    },
+  };
+}
+
+export const supabase = url ? createClient(url, anonKey) : localAuthClient();

cms/core/api/Dockerfile

@@ -40,5 +40,12 @@ COPY --from=admin /admin/dist ./admin-dist
 
 ENV NODE_ENV=production
 ENV ADMIN_DIR=/app/admin-dist
+
+# Als non-root laufen (das node-Image bringt den User `node`, uid/gid 1000 mit).
+# /app gehört dem Build (root, read-only zur Laufzeit — reicht zum Servieren).
+# Das gemountete Repo unter /site muss uid 1000 gehören (siehe Proxmox-Script:
+# chown -R 1000:1000), damit Hugo dort public/ bauen und content/ schreiben kann.
+USER node
+
 EXPOSE 3000
 CMD ["sh", "/app/entrypoint.sh"]

cms/core/api/package-lock.json

@@ -1,17 +1,20 @@
 {
   "name": "openbureau-cms-api",
-  "version": "0.1.0",
+  "version": "0.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openbureau-cms-api",
-      "version": "0.1.0",
+      "version": "0.6.0",
       "dependencies": {
         "@hono/node-server": "^1.13.7",
         "@supabase/supabase-js": "^2.47.10",
+        "bcryptjs": "^2.4.3",
         "gray-matter": "^4.0.3",
         "hono": "^4.6.14",
+        "marked": "^14.1.4",
+        "pg": "^8.22.0",
         "sharp": "^0.33.5"
       }
     },
@@ -527,6 +530,12 @@
         "sprintf-js": "~1.0.2"
       }
     },
+    "node_modules/bcryptjs": {
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-2.4.3.tgz",
+      "integrity": "sha512-V/Hy/X9Vt7f3BbPJEi8BdVFMByHi+jNXrYkW3huaybV/kQ0KJg0Y6PkEMbn+zeT+i+SiKZ/HMqJGIIt4LZDqNQ==",
+      "license": "MIT"
+    },
     "node_modules/color": {
       "version": "4.2.3",
       "resolved": "https://registry.npmjs.org/color/-/color-4.2.3.tgz",
@@ -672,6 +681,146 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/marked": {
+      "version": "14.1.4",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-14.1.4.tgz",
+      "integrity": "sha512-vkVZ8ONmUdPnjCKc5uTRvmkRbx4EAi2OkTOXmfTDhZz3OFqMNBM1oTTWwTr4HY4uAEojhzPf+Fy8F1DWa3Sndg==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/pg": {
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.22.0.tgz",
+      "integrity": "sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-connection-string": "^2.14.0",
+        "pg-pool": "^3.14.0",
+        "pg-protocol": "^1.15.0",
+        "pg-types": "2.2.0",
+        "pgpass": "1.0.5"
+      },
+      "engines": {
+        "node": ">= 16.0.0"
+      },
+      "optionalDependencies": {
+        "pg-cloudflare": "^1.4.0"
+      },
+      "peerDependencies": {
+        "pg-native": ">=3.0.1"
+      },
+      "peerDependenciesMeta": {
+        "pg-native": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/pg-cloudflare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.4.0.tgz",
+      "integrity": "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/pg-connection-string": {
+      "version": "2.14.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.0.tgz",
+      "integrity": "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==",
+      "license": "MIT"
+    },
+    "node_modules/pg-int8": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
+      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/pg-pool": {
+      "version": "3.14.0",
+      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.14.0.tgz",
+      "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "pg": ">=8.0"
+      }
+    },
+    "node_modules/pg-protocol": {
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.15.0.tgz",
+      "integrity": "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==",
+      "license": "MIT"
+    },
+    "node_modules/pg-types": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
+      "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-int8": "1.0.1",
+        "postgres-array": "~2.0.0",
+        "postgres-bytea": "~1.0.0",
+        "postgres-date": "~1.0.4",
+        "postgres-interval": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/pgpass": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.5.tgz",
+      "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.1.0"
+      }
+    },
+    "node_modules/postgres-array": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
+      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postgres-bytea": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.1.tgz",
+      "integrity": "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-date": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
+      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-interval": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
+      "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "xtend": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/section-matter": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/section-matter/-/section-matter-1.0.0.tgz",
@@ -745,6 +894,15 @@
         "is-arrayish": "^0.3.1"
       }
     },
+    "node_modules/split2": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
+      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">= 10.x"
+      }
+    },
     "node_modules/sprintf-js": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
@@ -765,6 +923,15 @@
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
+    },
+    "node_modules/xtend": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4"
+      }
     }
   }
 }

cms/core/api/package.json

@@ -1,18 +1,22 @@
 {
   "name": "openbureau-cms-api",
-  "version": "0.1.0",
+  "version": "0.7.0",
   "private": true,
   "type": "module",
   "description": "Headless CMS backend für OPENBUREAU — schreibt Supabase-Posts in Hugo-content/, baut und serviert die Site.",
   "scripts": {
     "start": "node src/index.js",
-    "dev": "node --watch src/index.js"
+    "dev": "node --watch src/index.js",
+    "test": "node --test"
   },
   "dependencies": {
     "@hono/node-server": "^1.13.7",
     "@supabase/supabase-js": "^2.47.10",
+    "bcryptjs": "^2.4.3",
     "gray-matter": "^4.0.3",
     "hono": "^4.6.14",
+    "marked": "^14.1.4",
+    "pg": "^8.22.0",
     "sharp": "^0.33.5"
   }
 }

cms/core/api/src/auth-local.js

@@ -0,0 +1,109 @@
+// Local auth provider — file-based users (bcrypt) + self-signed JWTs of the SAME
+// claim shape as Supabase/GoTrue (sub / email / app_metadata.role / exp), so the
+// rest of the engine (auth.js verifyToken, roleOf) treats local and supabase
+// tokens identically. Lets a core instance run DB-less (no Supabase/Postgres):
+// Node + Hugo + nginx. Activated by config.auth === 'local'.
+//
+// Users live in a JSON file (USERS_FILE, default <SITE_DIR>/cms-users.json):
+//   [{ id, email, password: <bcrypt hash>, role, created_at, last_sign_in_at }]
+import path from 'node:path';
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { sign } from 'hono/jwt';
+
+const SITE_DIR = process.env.SITE_DIR || '/site';
+const USERS_FILE = process.env.USERS_FILE || path.join(SITE_DIR, 'cms-users.json');
+const JWT_SECRET = process.env.JWT_SECRET || '';
+const ROLES = ['user', 'editor', 'admin'];
+
+// bcryptjs is pure-JS (no native build) and lazily imported — a supabase-auth
+// instance never loads it.
+async function bcrypt() { return (await import('bcryptjs')).default; }
+
+export async function loadUsers() {
+  try {
+    const j = JSON.parse(await readFile(USERS_FILE, 'utf8'));
+    return Array.isArray(j) ? j : (j.users || []);
+  } catch { return []; }
+}
+async function persist(users) {
+  await mkdir(path.dirname(USERS_FILE), { recursive: true });
+  await writeFile(USERS_FILE, JSON.stringify(users, null, 2), 'utf8');
+}
+
+export async function hashPassword(pw) { return (await bcrypt()).hash(pw, 10); }
+export async function verifyPassword(pw, hash) {
+  try { return await (await bcrypt()).compare(pw, hash); } catch { return false; }
+}
+
+// Mint a GoTrue-shaped HS256 access token (verified by auth.js with JWT_SECRET).
+export async function mintToken(user, ttl = 3600) {
+  if (!JWT_SECRET) throw new Error('JWT_SECRET fehlt — für auth: local nötig');
+  const now = Math.floor(Date.now() / 1000);
+  return sign({
+    sub: user.id, email: user.email, role: 'authenticated',
+    app_metadata: { role: user.role || 'user' }, iat: now, exp: now + ttl,
+  }, JWT_SECRET, 'HS256');
+}
+
+export async function login(email, password) {
+  const users = await loadUsers();
+  const u = users.find((x) => (x.email || '').toLowerCase() === (email || '').toLowerCase());
+  if (!u || !u.password) return null;
+  if (!(await verifyPassword(password, u.password))) return null;
+  u.last_sign_in_at = new Date().toISOString();
+  await persist(users);
+  return {
+    access_token: await mintToken(u),
+    token_type: 'bearer',
+    user: { id: u.id, email: u.email, role: u.role || 'user' },
+  };
+}
+
+// ── Admin CRUD (mirrors routes/users.js shapes) ──────────────────────────────
+export async function listUsers(adminEmails = []) {
+  const users = await loadUsers();
+  return users.map((u) => {
+    const fixedAdmin = adminEmails.includes((u.email || '').toLowerCase());
+    const role = u.role || 'user';
+    return {
+      id: u.id, email: u.email, created_at: u.created_at || null,
+      last_sign_in_at: u.last_sign_in_at || null,
+      role: fixedAdmin ? 'admin' : role, isAdmin: fixedAdmin || role === 'admin', fixedAdmin,
+    };
+  });
+}
+export async function countByRole(adminEmails = []) {
+  const list = await listUsers(adminEmails);
+  const out = { total: list.length, admin: 0, editor: 0, user: 0 };
+  for (const u of list) out[u.role] = (out[u.role] || 0) + 1;
+  return out;
+}
+export async function createUser({ email, password, role }) {
+  if (!email || !password) throw new Error('E-Mail und Passwort nötig');
+  if (role && !ROLES.includes(role)) throw new Error('Unbekannte Rolle');
+  const users = await loadUsers();
+  if (users.some((u) => (u.email || '').toLowerCase() === email.toLowerCase())) {
+    throw new Error('E-Mail existiert bereits');
+  }
+  const u = {
+    id: randomUUID(), email, password: await hashPassword(password),
+    role: role || 'user', created_at: new Date().toISOString(), last_sign_in_at: null,
+  };
+  users.push(u); await persist(users);
+  return u.id;
+}
+export async function updateUser(id, { password, role }) {
+  const users = await loadUsers();
+  const u = users.find((x) => x.id === id);
+  if (!u) throw new Error('Nutzer:in nicht gefunden');
+  if (password) u.password = await hashPassword(password);
+  if (role) { if (!ROLES.includes(role)) throw new Error('Unbekannte Rolle'); u.role = role; }
+  await persist(users);
+}
+export async function deleteUser(id) {
+  const users = await loadUsers();
+  const next = users.filter((u) => u.id !== id);
+  if (next.length === users.length) throw new Error('Nutzer:in nicht gefunden');
+  await persist(next);
+}

cms/core/api/src/auth.js

@@ -1,5 +1,30 @@
+import { verify } from 'hono/jwt';
 import { supabaseAuth } from './supabase.js';
 
+// Supabase-Tokens sind HS256-signiert. Mit dem JWT_SECRET verifizieren wir sie
+// lokal (Signatur + Ablauf) — das spart pro Request den Roundtrip zu GoTrue.
+// Ohne JWT_SECRET (z.B. Alt-Deploy) fällt requireAuth auf die Remote-Prüfung
+// zurück. Tokens sind kurzlebig (1h) und Self-Signup ist aus → kein
+// Sperr-Check nötig.
+const JWT_SECRET = process.env.JWT_SECRET || '';
+
+// Liefert ein User-Objekt {id,email,app_metadata} oder null.
+async function verifyToken(token) {
+  if (JWT_SECRET) {
+    try {
+      const p = await verify(token, JWT_SECRET, 'HS256');
+      if (!p?.sub) return null;
+      return { id: p.sub, email: p.email || '', app_metadata: p.app_metadata || {} };
+    } catch { return null; }
+  }
+  // Fallback (kein JWT_SECRET): Remote-Prüfung gegen GoTrue — nur wenn ein
+  // Supabase-Auth-Client existiert (DB-loser Betrieb hat keinen).
+  if (!supabaseAuth) return null;
+  const { data, error } = await supabaseAuth.auth.getUser(token);
+  if (error || !data?.user) return null;
+  return data.user;
+}
+
 // Rollen-Hierarchie: admin > editor (Redakteur) > user.
 //  - admin:  alles (Foren verwalten, moderieren, Nutzer/Rollen, Inhalte)
 //  - editor: moderieren (Wortmeldungen ausblenden/löschen, Threads sperren)
@@ -24,12 +49,12 @@ export async function requireAuth(c, next) {
   const token = header.startsWith('Bearer ') ? header.slice(7) : null;
   if (!token) return c.json({ error: 'Nicht eingeloggt' }, 401);
 
-  const { data, error } = await supabaseAuth.auth.getUser(token);
-  if (error || !data?.user) return c.json({ error: 'Ungültiges Token' }, 401);
+  const user = await verifyToken(token);
+  if (!user) return c.json({ error: 'Ungültiges Token' }, 401);
 
-  const email = (data.user.email || '').toLowerCase();
-  const role = roleOf(data.user);
-  c.set('user', data.user);
+  const email = (user.email || '').toLowerCase();
+  const role = roleOf(user);
+  c.set('user', user);
   c.set('email', email);
   c.set('role', role);
   c.set('isAdmin', role === 'admin');

cms/core/api/src/coalesce.js

@@ -0,0 +1,39 @@
+// Serialisiert asynchrone Aufgaben je `key` und koalesziert Wartende:
+// - Es läuft nie mehr als eine Aufgabe pro Key gleichzeitig.
+// - Kommen während eines Laufs weitere Aufrufe rein, wird GENAU EIN weiterer
+//   Durchlauf nachgelagert (egal wie viele warten) — sie teilen sich dessen
+//   Ergebnis. So sehen alle den jüngsten Stand, ohne einen Lauf-Sturm.
+//
+// Einsatz: teure, idempotente Vorgänge wie der Hugo-Build (siehe hugo.js).
+const state = new Map();
+
+export function coalesce(key, fn) {
+  let s = state.get(key);
+  if (!s) { s = { running: false, rerun: false, fn, waiters: [] }; state.set(key, s); }
+  s.fn = fn;   // jüngste Variante gewinnt für den nächsten Lauf
+  return new Promise((resolve, reject) => {
+    s.waiters.push({ resolve, reject });
+    if (!s.running) drain(key);
+    else s.rerun = true;
+  });
+}
+
+async function drain(key) {
+  const s = state.get(key);
+  s.running = true;
+  try {
+    do {
+      s.rerun = false;
+      const waiters = s.waiters;
+      s.waiters = [];
+      try {
+        const r = await s.fn();
+        waiters.forEach((w) => w.resolve(r));
+      } catch (e) {
+        waiters.forEach((w) => w.reject(e));
+      }
+    } while (s.rerun);
+  } finally {
+    s.running = false;
+  }
+}

cms/core/api/src/collections.js

@@ -0,0 +1,119 @@
+// Derive content classification, list ordering and path building from a site's
+// `config.collections` (see ../../README.md). Pure functions — no config import,
+// no filesystem — so they unit-test against any collections array directly.
+//
+// Fed `examples/openbureau.config.js` these reproduce the engine's original
+// hard-coded archiv/library/rubrik/seite behaviour 1:1.
+
+// Parse a `path` pattern ('archiv/:section/:slug') into segments.
+function parsePattern(pattern) {
+  return pattern.split('/').map((seg) =>
+    seg.startsWith(':') ? { param: seg.slice(1) } : { literal: seg });
+}
+
+// Match a content rel-path's segments (no .md) against a `path` pattern.
+// Returns captured params, or null. Strict: the segment count must equal the
+// pattern's, so 'archiv/:section/:slug' matches exactly three deep — the same
+// rule the original classify() enforced for archiv.
+function matchPattern(segs, pattern) {
+  const pat = parsePattern(pattern);
+  if (segs.length !== pat.length) return null;
+  const params = {};
+  for (let i = 0; i < pat.length; i++) {
+    if (pat[i].literal !== undefined) {
+      if (pat[i].literal !== segs[i]) return null;
+    } else {
+      if (!segs[i]) return null;
+      params[pat[i].param] = segs[i];
+    }
+  }
+  return params;
+}
+
+// First literal segment of a pattern (e.g. 'library' from 'library/:slug').
+function rootSegment(pattern) {
+  const first = pattern.split('/')[0];
+  return first.startsWith(':') ? null : first;
+}
+
+// { kind, section } for a content file, derived from collections.
+// Priority: index (_index.md) → path patterns → fallback — mirrors the original
+// hard-coded classify() when fed openbureau.config.js.
+export function classify(rel, collections) {
+  const parts = rel.split('/');
+  const base = parts[parts.length - 1];
+  const segs = rel.replace(/\.md$/, '').split('/');
+
+  // _index.md → the index collection; section = parent dir (or 'home' at root).
+  if (base === '_index.md') {
+    const idx = collections.find((c) => c.index);
+    if (idx) {
+      const section = parts.length >= 2 ? parts[parts.length - 2] : 'home';
+      return { kind: idx.kind, section };
+    }
+  }
+
+  // path-pattern collections (skip index/fallback).
+  for (const c of collections) {
+    if (!c.path || c.index || c.fallback) continue;
+    const params = matchPattern(segs, c.path);
+    if (params) {
+      const section = params.section ?? rootSegment(c.path);
+      return { kind: c.kind, section: section ?? null };
+    }
+  }
+
+  // fallback collection (everything not otherwise matched).
+  const fb = collections.find((c) => c.fallback);
+  return { kind: fb ? fb.kind : null, section: null };
+}
+
+// Sort comparator for listEntries: collection `order`, then date desc, then title.
+export function compareEntries(collections) {
+  const order = {};
+  collections.forEach((c, i) => { order[c.kind] = c.order ?? 100 + i; });
+  return (a, b) =>
+    ((order[a.kind] ?? 999) - (order[b.kind] ?? 999)) ||
+    (b.date || '').localeCompare(a.date || '') ||
+    a.title.localeCompare(b.title);
+}
+
+// Build a content rel-path for a NEW entry of `kind` from form `data`.
+// Index collection → '<slug>/_index.md'; a collection without a `path` (fallback)
+// → '<slug>.md'; otherwise substitute :params in the collection's `path`
+// (archiv/:section/:slug → archiv/<section>/<slug>.md). Returns '' if a required
+// segment is missing.
+export function buildPath(kind, data, collections) {
+  const c = collections.find((x) => x.kind === kind);
+  const slug = String(data.slug || '').trim();
+  if (c?.index) return slug ? `${slug}/_index.md` : '';
+  if (!c?.path) return slug ? `${slug}.md` : '';
+  let ok = true;
+  const rel = c.path.split('/').map((seg) => {
+    if (!seg.startsWith(':')) return seg;
+    const v = String(data[seg.slice(1)] || '').trim();
+    if (!v) ok = false;
+    return v;
+  }).join('/');
+  return ok && rel ? `${rel}.md` : '';
+}
+
+// Build the stats `content` object from classified entries + collections:
+// one counter per collection.statKey, plus a drafts counter for any collection
+// that declares `draftStatKey`. Mirrors the original hard-coded stats block
+// (beitraege/entwuerfe/library/seiten/rubriken) when fed openbureau.config.js.
+export function contentStats(entries, collections) {
+  const content = {};
+  for (const c of collections) {
+    if (c.statKey) content[c.statKey] ??= 0;
+    if (c.draftStatKey) content[c.draftStatKey] ??= 0;
+  }
+  const byKind = Object.fromEntries(collections.map((c) => [c.kind, c]));
+  for (const e of entries) {
+    const c = byKind[e.kind];
+    if (!c) continue;
+    if (c.statKey) content[c.statKey]++;
+    if (c.draftStatKey && e.draft) content[c.draftStatKey]++;
+  }
+  return content;
+}

cms/core/api/src/config.js

@@ -0,0 +1,29 @@
+// Per-site CMS configuration loader.
+//
+// A site tells the core what it manages through one module, referenced by the
+// CMS_CONFIG env var (e.g. CMS_CONFIG=/site/cms.config.js). The module exports
+// `default` with { collections, plugins, admins }. Loaded once at startup; the
+// engine (files/stats/routes) derives its behaviour from it instead of having
+// openbureau-specific content types hard-coded.
+//
+// See ../../README.md for the schema, and ../../examples/*.config.js.
+import { pathToFileURL } from 'node:url';
+
+const p = process.env.CMS_CONFIG;
+if (!p) {
+  console.error('FEHLT: CMS_CONFIG (Pfad zur Site-Config, z. B. /site/cms.config.js)');
+  process.exit(1);
+}
+
+const mod = await import(pathToFileURL(p).href);
+export const config = mod.default || mod;
+config.collections ||= [];
+config.plugins ||= [];
+config.admins ||= [];
+config.auth ||= 'supabase'; // 'supabase' (GoTrue) | 'local' (file users, DB-less)
+
+export const hasPlugin = (name) => config.plugins.includes(name);
+
+// Collection lookup helpers (used by the generalised files.js / stats.js).
+export const collectionOf = (kind) => config.collections.find((c) => c.kind === kind) || null;
+export const fallbackCollection = () => config.collections.find((c) => c.fallback) || null;

cms/core/api/src/files.js

@@ -1,6 +1,7 @@
 import { readdir, readFile, writeFile, mkdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 import matter from 'gray-matter';
+import { classify, compareEntries } from './collections.js';
 
 const SITE_DIR = process.env.SITE_DIR || '/site';
 const CONTENT = path.join(SITE_DIR, 'content');
@@ -26,20 +27,6 @@ async function walk(dir) {
   return out;
 }
 
-// Beitrag (library/<section>/<slug>.md) | Rubrik (_index.md) | Seite (sonst).
-function classify(rel) {
-  const base = path.basename(rel);
-  const parts = rel.split('/');
-  if (base === '_index.md') {
-    const section = parts.length >= 2 ? parts[parts.length - 2] : 'home';
-    return { kind: 'rubrik', section };
-  }
-  if (parts[0] === 'library' && parts.length === 3) {
-    return { kind: 'beitrag', section: parts[1] };
-  }
-  return { kind: 'seite', section: null };
-}
-
 // authors-Frontmatter zu Array normalisieren (String oder Array erlaubt).
 export function normAuthors(a) {
   if (Array.isArray(a)) return a.map(String).filter(Boolean);
@@ -62,6 +49,9 @@ export function urlFor(rel) {
 }
 
 export async function listEntries() {
+  // Lazy: only listing needs the site config, so importing files.js for its pure
+  // helpers (safeRel/urlFor/…) never triggers the CMS_CONFIG load.
+  const { config } = await import('./config.js');
   const files = await walk(CONTENT);
   const items = [];
   for (const full of files) {
@@ -73,7 +63,7 @@ export async function listEntries() {
     items.push({
       path: rel,
       title: data.title || rel,
-      ...classify(rel),
+      ...classify(rel, config.collections),
       color: data.color || null,
       layout: data.layout || null,
       draft: !!data.draft,
@@ -82,12 +72,8 @@ export async function listEntries() {
       url: urlFor(rel),
     });
   }
-  // Beiträge zuerst, dann Seiten, dann Rubriken; je nach Datum/Titel.
-  const order = { beitrag: 0, seite: 1, rubrik: 2 };
-  items.sort((a, b) =>
-    (order[a.kind] - order[b.kind]) ||
-    (b.date || '').localeCompare(a.date || '') ||
-    a.title.localeCompare(b.title));
+  // Reihenfolge aus der Config (collection.order), dann Datum, dann Titel.
+  items.sort(compareEntries(config.collections));
   return items;
 }
 

cms/core/api/src/hugo.js

@@ -1,5 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { coalesce } from './coalesce.js';
 
 const execFileP = promisify(execFile);
 const SITE_DIR = process.env.SITE_DIR || '/site';
@@ -16,6 +17,13 @@ export async function hugoBuild({ dest, drafts = false } = {}) {
   return { stdout, stderr };
 }
 
+// Koaleszierter Build je Ziel: nie zwei `hugo`-Prozesse für dasselbe dest
+// parallel; schnelle Folge-Aufrufe lösen nur einen nachgelagerten Build aus.
+// Publish (public), Preview (preview) und Profil teilen sich diesen Weg.
+export function buildSite({ dest, drafts = false } = {}) {
+  return coalesce(`build:${dest}:${drafts ? 'd' : 'p'}`, () => hugoBuild({ dest, drafts }));
+}
+
 // Optionaler Git-Backup beim Publish (GIT_PUBLISH=true). Schlägt nie hart fehl —
 // das Publish soll an einem Git-Problem nicht scheitern.
 export async function gitCommit(message) {

cms/core/api/src/index.js

@@ -0,0 +1,148 @@
+import { serve } from '@hono/node-server';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { Hono } from 'hono';
+import { secureHeaders } from 'hono/secure-headers';
+import { bodyLimit } from 'hono/body-limit';
+
+import { rateLimit } from './ratelimit.js';
+import content from './routes/content.js';
+import preview from './routes/preview.js';
+import publish from './routes/publish.js';
+import upload from './routes/upload.js';
+import profile from './routes/profile.js';
+import users from './routes/users.js';
+import stats from './routes/stats.js';
+import system from './routes/system.js';
+import account from './routes/account.js';
+import history from './routes/history.js';
+import authRoute from './routes/auth.js';
+import { requireAuth, requireAdmin } from './auth.js';
+import { config } from './config.js';
+import { supabase } from './supabase.js';
+import { manager } from './plugins.js';
+import { runMigrations } from './migrate.js';
+
+// Fail-fast: auth:'supabase' ohne erreichbaren Service-Client ist ein Fehlstart.
+// (auth:'local' braucht keinen — DB-loser Betrieb.)
+if (config.auth === 'supabase' && !supabase) {
+  console.error('FEHLT: SUPABASE_URL/SERVICE_KEY für auth: supabase');
+  process.exit(1);
+}
+
+const SITE_DIR = process.env.SITE_DIR || '/site';
+const ADMIN_DIR = process.env.ADMIN_DIR || '/app/admin-dist';
+const PORT = Number(process.env.PORT || 3000);
+
+const app = new Hono();
+
+// --- Sicherheits-Header (auf allem) ---
+// CSP bewusst zurückhaltend: Site + Admin-SPA + Dialog-Widget laufen same-origin.
+app.use('*', secureHeaders({
+  xFrameOptions: 'SAMEORIGIN',
+  xContentTypeOptions: 'nosniff',
+  referrerPolicy: 'strict-origin-when-cross-origin',
+  crossOriginOpenerPolicy: 'same-origin',
+  // HSTS nur sinnvoll hinter TLS-Proxy; schadet via HTTP nicht (Browser ignoriert).
+  strictTransportSecurity: 'max-age=31536000; includeSubDomains',
+}));
+
+// Hochgeladene Bilder strikt isolieren: ein bösartiges SVG kann so kein
+// JavaScript im Origin ausführen (sandbox + keine Skript-Quellen).
+app.use('/images/*', secureHeaders({
+  contentSecurityPolicy: { defaultSrc: ["'none'"], imgSrc: ["'self'"], styleSrc: ["'unsafe-inline'"], sandbox: [] },
+  xContentTypeOptions: 'nosniff',
+}));
+
+// Statische Assets cachen: Hugo fingerprintet CSS/JS, Uploads haben stabile,
+// eindeutige Namen. HTML bleibt ungecacht (Antwort ohne Header → immer frisch).
+app.use('*', async (c, next) => {
+  await next();
+  if (c.req.method === 'GET' && /\.(css|js|mjs|woff2?|ttf|otf|eot|svg|png|jpe?g|webp|avif|gif|ico)$/i.test(c.req.path)) {
+    c.header('Cache-Control', 'public, max-age=604800');   // 1 Woche
+  }
+});
+
+// --- API ---
+// Globales Limit gegen aufgeblähte JSON-Bodies (DoS / DB-Bloat). Der Upload-Pfad
+// ist ausgenommen — der bringt sein eigenes, größeres Bild-Limit mit.
+const jsonBodyLimit = bodyLimit({ maxSize: 256 * 1024, onError: (c) => c.json({ error: 'Anfrage zu groß' }, 413) });
+app.use('/api/*', (c, next) =>
+  c.req.path.startsWith('/api/upload') ? next() : jsonBodyLimit(c, next));
+
+app.get('/api/health', (c) => c.json({ ok: true, hugo: '0.161.1+extended' }));
+// Öffentliche Plugin-Routen (ohne Login) — je nach config.plugins, z. B. Dialog
+// lesen + Widget-Login. Jede Route bringt ihre eigenen Limits mit (dialog drosselt
+// den Login auf 10 Versuche/IP pro 5 Minuten). Pluginlose Site: nichts gemountet.
+manager.mountPublic(app);
+// Lokaler Login (nur auth: 'local') — ersetzt GoTrue, öffentlich + gedrosselt.
+// Supabase-Sites loggen direkt gegen GoTrue ein und brauchen das nicht.
+if (config.auth === 'local') app.route('/api/auth', authRoute);
+// Öffentlich: Versionsverlauf der Beiträge (Git-History) — auf der Site anzeigbar.
+app.route('/api/history', history);
+// Alles weitere unter /api/* braucht ein gültiges Token (Supabase oder lokal).
+app.use('/api/*', requireAuth);
+// Schreibzugriffe drosseln (Spam-Schutz, auch bei gekapertem Token):
+// 60 Mutationen/Minute je Nutzer. Lesen (GET) bleibt frei.
+const mutateLimit = rateLimit({
+  max: 60, windowMs: 60_000,
+  keyFn: (c) => 'u:' + (c.get('user')?.id || c.req.header('x-forwarded-for') || 'anon'),
+});
+app.use('/api/*', (c, next) => (c.req.method === 'GET' ? next() : mutateLimit(c, next)));
+app.get('/api/me', (c) => c.json({ email: c.get('email'), role: c.get('role'), isAdmin: c.get('isAdmin'), canModerate: c.get('canModerate') }));
+// Authentifizierte Plugin-Routen (nach requireAuth). admin:true-Routen laufen
+// hinter requireAdmin; self-guarding Sub-Apps (dialog mod/adminForums) regeln den
+// Zugriff selbst und brauchen das Flag nicht.
+manager.mountPrivate(app, '/api', requireAdmin);
+app.route('/api/content', content);
+app.route('/api/preview', preview);
+app.route('/api/publish', publish);
+app.route('/api/upload', upload);
+app.route('/api/profile', profile);
+app.route('/api/users', users);
+app.route('/api/stats', stats);
+app.route('/api/system', system);
+app.route('/api/account', account);
+// Content-Modell der Site fürs Admin (schema-getriebenes Rendern). Jede:r
+// eingeloggte Nutzer:in darf es lesen — der Editor braucht es zum Aufbauen.
+app.get('/api/schema', (c) => c.json({
+  site: config.site || null,
+  auth: config.auth || 'supabase',
+  plugins: config.plugins,
+  collections: config.collections,
+}));
+
+// --- Admin-SPA (im Container mitgebaut, unter /admin serviert) ---
+app.get('/admin', (c) => c.redirect('/admin/'));
+app.use(
+  '/admin/*',
+  serveStatic({
+    root: ADMIN_DIR,
+    rewriteRequestPath: (p) => p.replace(/^\/admin/, '') || '/',
+  }),
+);
+
+// --- Vorschau (gebaut nach preview/ mit --buildDrafts) ---
+app.use(
+  '/_preview/*',
+  serveStatic({
+    root: `${SITE_DIR}/preview`,
+    rewriteRequestPath: (p) => p.replace(/^\/_preview/, ''),
+  }),
+);
+
+// Hochgeladene Bilder direkt aus static/ servieren — sofort sichtbar
+// (Vorschau, Cover, Profilbild), ohne auf den nächsten Hugo-Build zu warten.
+app.use('/images/*', serveStatic({ root: `${SITE_DIR}/static` }));
+
+// --- Live-Site (gebaut nach public/) ---
+app.use('/*', serveStatic({ root: `${SITE_DIR}/public` }));
+
+serve({ fetch: app.fetch, port: PORT }, async (info) => {
+  console.log(`CMS läuft auf :${info.port} — Site + API + /_preview`);
+  // Plugin-Migrationen zuerst anwenden (run-once, getrackt) — die Boot-Hooks
+  // unten brauchen die Tabellen schon. Ohne deklarierte Migrationen ein No-op.
+  await runMigrations(manager, { databaseUrl: process.env.DATABASE_URL })
+    .catch((e) => console.error('migrate:', e?.message || e));
+  // Plugin-Boot-Hooks anstoßen (dialog z. B. spiegelt Library→Threads), nicht blockierend.
+  manager.runBoot({}).catch((e) => console.error('plugin onBoot:', e?.message || e));
+});

cms/core/api/src/migrate.js

@@ -0,0 +1,75 @@
+// Migration runner — applies plugin-declared migrations once each, tracked in
+// public.schema_migrations. The plugin manager only *surfaces* migrations()
+// (file URLs); this is what actually runs them, at boot.
+//
+// Design for a lean / DB-optional core:
+//  * No declared migrations (e.g. kgva: no plugins) → returns immediately, never
+//    opens a DB connection and never imports `pg`.
+//  * `exec` is injectable — an async (text, params?) => rows function — so the
+//    logic unit-tests without a real database. Omit it and the runner connects
+//    via `pg` to `databaseUrl` (lazy import; clear error if `pg` is missing).
+//  * Each migration runs once (id = "<plugin>/<file>") inside its own
+//    transaction; the file SQL is itself idempotent (see 001_dialog.sql), so a
+//    pre-existing DB (openbureau) is baselined cleanly on first run.
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+export async function runMigrations(manager, { databaseUrl, exec, log = console } = {}) {
+  const migs = manager.migrations();
+  if (!migs.length) return { applied: [], skipped: [], pending: false };
+
+  let close = async () => {};
+  if (!exec) {
+    if (!databaseUrl) {
+      log.warn?.(`migrate: ${migs.length} Migration(en) deklariert, aber DATABASE_URL fehlt — übersprungen.`);
+      return { applied: [], skipped: migs.map((m) => `${m.plugin}/${m.file}`), pending: true };
+    }
+    ({ exec, close } = await pgExecutor(databaseUrl));
+  }
+
+  try {
+    await exec(`CREATE TABLE IF NOT EXISTS public.schema_migrations (
+      id text PRIMARY KEY,
+      plugin text NOT NULL,
+      applied_at timestamptz NOT NULL DEFAULT now()
+    )`);
+
+    const applied = [], skipped = [];
+    for (const m of migs) {
+      const id = `${m.plugin}/${m.file}`;
+      const done = await exec('SELECT 1 FROM public.schema_migrations WHERE id = $1', [id]);
+      if (done?.length) { skipped.push(id); continue; }
+      try {
+        const sql = await readFile(fileURLToPath(m.url), 'utf8');
+        await exec('BEGIN');
+        try {
+          await exec(sql);
+          await exec('INSERT INTO public.schema_migrations (id, plugin) VALUES ($1, $2)', [id, m.plugin]);
+          await exec('COMMIT');
+        } catch (e) {
+          await exec('ROLLBACK');
+          throw e;
+        }
+      } catch (e) {
+        throw new Error(`Migration ${id} fehlgeschlagen: ${e.message}`);
+      }
+      applied.push(id);
+      log.log?.(`migrate: angewandt ${id}`);
+    }
+    return { applied, skipped, pending: false };
+  } finally {
+    await close();
+  }
+}
+
+// Default executor: one pg client over databaseUrl. `pg` is imported lazily so a
+// DB-less instance never pulls it in at runtime.
+async function pgExecutor(databaseUrl) {
+  let pg;
+  try { pg = (await import('pg')).default; }
+  catch { throw new Error("migrate: Paket 'pg' fehlt (npm i pg) — für Plugin-Migrationen nötig."); }
+  const client = new pg.Client({ connectionString: databaseUrl });
+  await client.connect();
+  const exec = async (text, params) => (await client.query(text, params)).rows;
+  return { exec, close: () => client.end() };
+}

cms/core/api/src/plugin-manager.js

@@ -0,0 +1,95 @@
+// Plugin manager: everything beyond the generic engine is a plugin (see README →
+// "Plugins"). A plugin is `api/src/plugins/<name>/index.js` exporting a manifest:
+//   { name, routes:[…], onBoot, onPublish, onPreview, migrations:[…], stats, admin:{…} }
+//
+// A route entry is either a mounted sub-app or a single handler:
+//   { path, app, public?, admin? }                       // app = Hono instance
+//   { method, path, handler, public?, admin?, use?:[mw] } // method = get|post|put|delete
+// `public: true` → mounted before requireAuth; `admin: true` → guarded with the
+// supplied requireAdmin; `use` adds per-route middleware (e.g. a rate limit).
+//
+// The manager loads the manifests named in config.plugins and wires them in:
+// mounts routes by auth tier, runs lifecycle hooks, merges stats, surfaces
+// migrations. Pure wiring — plugins import what they need (supabase, files, …).
+
+const PLUGINS_DIR = new URL('./plugins/', import.meta.url);
+
+// Import the manifests for `names` (config.plugins) and return a manager.
+export async function loadPlugins(names = [], dir = PLUGINS_DIR) {
+  const manifests = [];
+  for (const name of names) {
+    const url = new URL(`${name}/index.js`, dir);
+    const mod = await import(url.href);
+    const manifest = mod.default || mod;
+    if (!manifest?.name) throw new Error(`Plugin "${name}": ungültiges Manifest (name fehlt)`);
+    manifest.__dir = new URL(`${name}/`, dir);
+    manifests.push(manifest);
+  }
+  return createManager(manifests);
+}
+
+// Mount one route entry (sub-app or handler) at `full`, behind `guards` (+ its
+// own `use` middleware).
+function mountRoute(app, full, r, guards) {
+  const mws = [...guards, ...(r.use || [])];
+  if (r.app) {
+    for (const mw of mws) { app.use(full, mw); app.use(full + '/*', mw); }
+    app.route(full, r.app);
+  } else if (r.method && r.handler) {
+    app[r.method](full, ...mws, r.handler);
+  } else {
+    throw new Error(`Plugin-Route ${full}: braucht entweder app oder method+handler`);
+  }
+}
+
+// Build a manager over already-loaded manifests (kept separate from import so it
+// unit-tests without touching the filesystem).
+export function createManager(manifests) {
+  const plugins = (manifests || []).filter(Boolean);
+  const routesWhere = (pred) =>
+    plugins.flatMap((p) => (p.routes || []).filter(pred).map((r) => ({ plugin: p.name, ...r })));
+
+  return {
+    plugins,
+    names: () => plugins.map((p) => p.name),
+    has: (name) => plugins.some((p) => p.name === name),
+
+    // Public routes (no auth) — mount BEFORE `requireAuth` in the pipeline.
+    mountPublic(app, prefix = '/api') {
+      for (const r of routesWhere((r) => r.public)) mountRoute(app, prefix + r.path, r, []);
+    },
+
+    // Authenticated routes — mount AFTER `requireAuth`. `admin: true` routes are
+    // guarded with the supplied requireAdmin (sub-apps that self-guard can omit
+    // the flag, as dialog's mod/adminForums do).
+    mountPrivate(app, prefix = '/api', requireAdmin) {
+      for (const r of routesWhere((r) => !r.public)) {
+        const guards = r.admin && requireAdmin ? [requireAdmin] : [];
+        mountRoute(app, prefix + r.path, r, guards);
+      }
+    },
+
+    // Lifecycle hooks (awaited in plugin order).
+    async runBoot(ctx) { for (const p of plugins) if (p.onBoot) await p.onBoot(ctx); },
+    async runPublish(ctx, payload) { for (const p of plugins) if (p.onPublish) await p.onPublish(ctx, payload); },
+    async runPreview(ctx, payload) { for (const p of plugins) if (p.onPreview) await p.onPreview(ctx, payload); },
+
+    // Merge each plugin's stats() under its own name: { dialog: { forums, … } }.
+    async collectStats(ctx) {
+      const out = {};
+      for (const p of plugins) if (p.stats) out[p.name] = await p.stats(ctx);
+      return out;
+    },
+
+    // Declared migrations resolved to file URLs; EXECUTION is the caller's job
+    // (needs the live Postgres — wired in stage 5/boot, not here).
+    migrations() {
+      return plugins.flatMap((p) =>
+        (p.migrations || []).map((file) => ({
+          plugin: p.name,
+          file,
+          url: p.__dir ? new URL(`migrations/${file}`, p.__dir).href : null,
+        })));
+    },
+  };
+}

cms/core/api/src/plugins.js

@@ -0,0 +1,9 @@
+// The plugin manager for this instance, loaded once from config.plugins.
+//
+// Shared singleton: index.js wires its routes/hooks, publish.js fires onPublish,
+// stats.js merges collectStats. A pluginless site (config.plugins = []) gets an
+// empty manager — every call is a no-op, zero DB reads.
+import { loadPlugins } from './plugin-manager.js';
+import { config } from './config.js';
+
+export const manager = await loadPlugins(config.plugins);

cms/core/api/src/plugins/dialog/comments.js

@@ -1,10 +1,13 @@
-import { supabase, supabaseAuth } from '../supabase.js';
-import { roleOf } from '../auth.js';
-import { profileFor, threadLocked } from '../dialog-store.js';
+import { supabase, supabaseAuth } from '../../supabase.js';
+import { roleOf } from '../../auth.js';
+import { profileFor, threadLocked } from './dialog-store.js';
+import { serverError } from '../../util.js';
 
 // Dialog: flache Wortmeldungen pro Thread (= Thread-Key), optionaler Bezug.
 
-const COLS = 'id,thread,parent_id,author_name,author_avatar,body,created_at,deleted';
+const COLS = 'id,thread,parent_id,author_name,author_avatar,author_role,body,created_at,deleted';
+const MAX_BODY = 10_000;     // Zeichen je Wortmeldung
+const MAX_THREAD = 512;      // Thread-Key-Länge
 
 // ÖFFENTLICH: Wortmeldungen eines Threads lesen.
 export async function listComments(c) {
@@ -12,7 +15,7 @@ export async function listComments(c) {
   if (!thread) return c.json({ error: 'thread fehlt' }, 400);
   const { data, error } = await supabase
     .from('comments').select(COLS).eq('thread', thread).order('created_at', { ascending: true });
-  if (error) return c.json({ error: error.message }, 500);
+  if (error) return serverError(c, 'listComments', error);
   const out = (data || []).map((r) => (r.deleted ? { ...r, body: '[gelöscht]', author_avatar: null } : r));
   return c.json(out);
 }
@@ -23,6 +26,8 @@ export async function createComment(c) {
   const email = c.get('email');
   const { thread, body, parent_id } = await c.req.json();
   if (!thread || !body || !body.trim()) return c.json({ error: 'thread und Text nötig' }, 400);
+  if (typeof thread !== 'string' || thread.length > MAX_THREAD) return c.json({ error: 'Ungültiger Thread' }, 400);
+  if (typeof body !== 'string' || body.length > MAX_BODY) return c.json({ error: `Text zu lang (max. ${MAX_BODY} Zeichen)` }, 400);
   if (await threadLocked(thread)) return c.json({ error: 'Thread ist gesperrt' }, 403);
 
   const prof = await profileFor(email);
@@ -32,10 +37,11 @@ export async function createComment(c) {
     user_id: user.id,
     author_name: prof?.name || email.split('@')[0],
     author_avatar: prof?.avatar || null,
+    author_role: prof?.title || null,   // „Position bei OPENBUREAU" (aus data/authors.json)
     body: body.trim(),
   };
   const { data, error } = await supabase.from('comments').insert(row).select(COLS).single();
-  if (error) return c.json({ error: error.message }, 400);
+  if (error) return serverError(c, 'createComment', error, 400);
   return c.json(data, 201);
 }
 
@@ -48,7 +54,7 @@ export async function deleteComment(c) {
   if (e1 || !row) return c.json({ error: 'Nicht gefunden' }, 404);
   if (!canModerate && row.user_id !== user.id) return c.json({ error: 'Kein Recht' }, 403);
   const { error } = await supabase.from('comments').update({ deleted: true }).eq('id', id);
-  if (error) return c.json({ error: error.message }, 400);
+  if (error) return serverError(c, 'deleteComment', error, 400);
   return c.json({ ok: true });
 }
 

cms/core/api/src/plugins/dialog/dialog-store.js

@@ -1,8 +1,8 @@
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { supabase } from './supabase.js';
-import { listEntries } from './files.js';
+import { supabase } from '../../supabase.js';
+import { listEntries } from '../../files.js';
 
 // Daten-Schicht für den Dialog (Foren + Threads + Wortmeldungen).
 // Alle DB-Zugriffe laufen über den Service-Client (umgeht RLS).
@@ -19,7 +19,15 @@ export async function profileFor(email) {
 
 // Library-Beiträge als Threads in der Kategorie „Beiträge" spiegeln, damit man
 // auf jeden Beitrag einen Dialog starten kann. Idempotent (upsert über key).
-export async function syncLibrary() {
+//
+// Gedrosselt: Reads rufen das bei jedem Forum-Aufruf, aber der eigentliche
+// Sync (DB + Filesystem-Walk + Upsert) läuft höchstens alle SYNC_TTL ms.
+// `force: true` (z.B. nach Publish) überspringt die Drosselung.
+const SYNC_TTL = 60_000;
+let lastSync = 0;
+export async function syncLibrary({ force = false } = {}) {
+  if (!force && Date.now() - lastSync < SYNC_TTL) return;
+  lastSync = Date.now();
   const { data: forum } = await supabase
     .from('forums').select('id').eq('slug', LIBRARY_SLUG).single();
   if (!forum) return;
@@ -34,15 +42,11 @@ export async function syncLibrary() {
 }
 
 // Wortmeldungen pro Thread-Key aggregieren: { [key]: {count, last} }.
+// Aggregiert in Postgres (View comment_stats) statt alle Zeilen zu laden.
 async function commentStats() {
-  const { data } = await supabase.from('comments').select('thread,created_at,deleted');
+  const { data } = await supabase.from('comment_stats').select('thread,count,last');
   const map = {};
-  for (const r of data || []) {
-    if (r.deleted) continue;
-    const t = map[r.thread] || (map[r.thread] = { count: 0, last: r.created_at });
-    t.count += 1;
-    if (r.created_at > t.last) t.last = r.created_at;
-  }
+  for (const r of data || []) map[r.thread] = { count: r.count, last: r.last };
   return map;
 }
 

cms/core/api/src/plugins/dialog/dialog.js

@@ -1,9 +1,10 @@
 import { Hono } from 'hono';
-import { supabase } from '../supabase.js';
-import { requireAdmin, requireModerator } from '../auth.js';
+import { supabase } from '../../supabase.js';
+import { requireAdmin, requireModerator } from '../../auth.js';
+import { serverError } from '../../util.js';
 import {
   forumsWithCounts, forumWithThreads, recentComments, createThread, recentForModeration, threadMeta,
-} from '../dialog-store.js';
+} from './dialog-store.js';
 
 // Fehlt die Tabelle (Migration noch nicht eingespielt), nicht mit einem rohen
 // SQL-Fehler antworten — leer zurückgeben und server-seitig laut loggen.
@@ -56,7 +57,7 @@ mod.post('/thread-lock', async (c) => {
   const { key, locked } = await c.req.json();
   if (!key) return c.json({ error: 'key nötig' }, 400);
   const { error } = await supabase.from('threads').update({ locked: !!locked }).eq('key', key);
-  if (error) return c.json({ error: error.message }, 400);
+  if (error) return serverError(c, 'dialog', error, 400);
   return c.json({ ok: true });
 });
 // Thread ausblenden (löschen).
@@ -64,7 +65,7 @@ mod.post('/thread-delete', async (c) => {
   const { key } = await c.req.json();
   if (!key) return c.json({ error: 'key nötig' }, 400);
   const { error } = await supabase.from('threads').update({ deleted: true }).eq('key', key);
-  if (error) return c.json({ error: error.message }, 400);
+  if (error) return serverError(c, 'dialog', error, 400);
   return c.json({ ok: true });
 });
 
@@ -73,7 +74,7 @@ export const adminForums = new Hono();
 adminForums.use('*', requireAdmin);
 adminForums.get('/', async (c) => {
   const { data, error } = await supabase.from('forums').select('*').order('sort');
-  if (error) return c.json({ error: error.message }, 500);
+  if (error) return serverError(c, 'dialog', error, 500);
   return c.json(data || []);
 });
 adminForums.post('/', async (c) => {
@@ -82,7 +83,7 @@ adminForums.post('/', async (c) => {
   const row = { slug: String(slug).trim(), name: String(name).trim(),
     description: description || '', color: color || null, sort: Number(sort) || 0 };
   const { data, error } = await supabase.from('forums').insert(row).select('*').single();
-  if (error) return c.json({ error: error.message }, 400);
+  if (error) return serverError(c, 'dialog', error, 400);
   return c.json(data, 201);
 });
 adminForums.put('/:id', async (c) => {
@@ -90,7 +91,7 @@ adminForums.put('/:id', async (c) => {
   const allowed = {};
   for (const k of ['name', 'description', 'color', 'sort', 'slug']) if (k in patch) allowed[k] = patch[k];
   const { data, error } = await supabase.from('forums').update(allowed).eq('id', c.req.param('id')).select('*').single();
-  if (error) return c.json({ error: error.message }, 400);
+  if (error) return serverError(c, 'dialog', error, 400);
   return c.json(data);
 });
 adminForums.delete('/:id', async (c) => {
@@ -98,6 +99,6 @@ adminForums.delete('/:id', async (c) => {
   const { data: f } = await supabase.from('forums').select('kind').eq('id', id).single();
   if (f?.kind === 'library') return c.json({ error: 'Beiträge-Kategorie kann nicht gelöscht werden' }, 400);
   const { error } = await supabase.from('forums').delete().eq('id', id);
-  if (error) return c.json({ error: error.message }, 400);
+  if (error) return serverError(c, 'dialog', error, 400);
   return c.json({ ok: true });
 });

cms/core/api/src/plugins/dialog/index.js

@@ -0,0 +1,74 @@
+// dialog plugin — openbureau's forum/comment subsystem as a core plugin.
+// Wraps the existing dialog modules (no logic change) into a plugin manifest:
+// public reads + widget login, authenticated writes, self-guarding moderation /
+// forum-admin sub-apps, syncLibrary on boot + after publish, and the forum
+// counters merged into /api/stats. kgva does not enable this plugin.
+//
+// NB: this manifest exists; wiring it into index.js (and removing the hard-coded
+// dialog there) is the live-tested cutover (stage 5) — see HANDOVER.
+import { rateLimit } from '../../ratelimit.js';
+import {
+  listForums, showForum, recent, threadInfo, newThread, mod, adminForums,
+} from './dialog.js';
+import { listComments, createComment, deleteComment, login } from './comments.js';
+import { supabase } from '../../supabase.js';
+import { syncLibrary } from './dialog-store.js';
+
+export default {
+  name: 'dialog',
+
+  routes: [
+    // ── public reads (mounted before requireAuth) ──
+    { method: 'get', path: '/comments', handler: listComments, public: true },
+    { method: 'get', path: '/forums', handler: listForums, public: true },
+    { method: 'get', path: '/forums/:slug', handler: showForum, public: true },
+    { method: 'get', path: '/recent', handler: recent, public: true },
+    { method: 'get', path: '/thread', handler: threadInfo, public: true },
+    // widget login — brute-force throttled (10 / 5 min per IP), as in index.js
+    {
+      method: 'post', path: '/auth/login', handler: login, public: true,
+      use: [rateLimit({ max: 10, windowMs: 5 * 60_000 })],
+    },
+
+    // ── authenticated writes (mounted after requireAuth) ──
+    { method: 'post', path: '/comments', handler: createComment },
+    { method: 'delete', path: '/comments/:id', handler: deleteComment },
+    { method: 'post', path: '/threads', handler: newThread },
+
+    // ── self-guarding sub-apps (requireModerator / requireAdmin inside) ──
+    { path: '/mod', app: mod },
+    { path: '/admin/forums', app: adminForums },
+  ],
+
+  // Mirror library posts as threads — on boot and after every publish build.
+  onBoot: async () => {
+    await syncLibrary().catch((e) => console.error('syncLibrary:', e?.message || e));
+  },
+  onPublish: async () => {
+    await syncLibrary({ force: true }).catch(() => {});
+  },
+
+  // Forum/thread/comment counters, merged into /api/stats under "dialog".
+  stats: async () => {
+    const count = async (table, filter) => {
+      try {
+        let q = supabase.from(table).select('*', { count: 'exact', head: true });
+        if (filter) q = filter(q);
+        const { count: n } = await q;
+        return n || 0;
+      } catch { return 0; }
+    };
+    const [forums, threads, comments] = await Promise.all([
+      count('forums'),
+      count('threads', (q) => q.eq('deleted', false)),
+      count('comments', (q) => q.eq('deleted', false)),
+    ]);
+    return { forums, threads, comments };
+  },
+
+  // Schema (forums/threads/comments + comment_stats view) — captured from the live
+  // openbureau dev DB into migrations/001_dialog.sql (idempotent; verified to apply
+  // on a fresh DB and re-apply as a no-op). The manager surfaces it; a migration
+  // runner applies it on boot for a fresh instance (execution still TODO).
+  migrations: ['001_dialog.sql'],
+};

cms/core/api/src/plugins/dialog/migrations/001_dialog.sql

@@ -0,0 +1,99 @@
+-- dialog plugin schema — forums / threads / comments (+ comment_stats view).
+--
+-- Captured 2026-06-29 from the live openbureau dev DB (CT 134 → openbureau-db,
+-- supabase/postgres 15.8) via `pg_dump --schema-only --no-owner --no-privileges`
+-- of public.{forums,threads,comments,comment_stats}. Made idempotent (IF NOT
+-- EXISTS / OR REPLACE / constraint guards) so it is a no-op against the existing
+-- openbureau DB and safe to apply to a fresh instance.
+--
+-- Notes:
+--  * gen_random_uuid() is built into Postgres 13+ — no pgcrypto extension needed.
+--  * RLS is enabled with NO policies: every read/write is mediated by the CMS
+--    using the Supabase service_role key (which bypasses RLS). The dialog plugin
+--    therefore only makes sense with `auth: supabase`; kgva (local auth) omits it.
+--  * `posts` exists in the live DB but the dialog code never touches it — NOT a
+--    dialog table, intentionally excluded.
+
+-- ── tables ──────────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS public.forums (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    slug text NOT NULL,
+    name text NOT NULL,
+    description text DEFAULT ''::text,
+    color text,
+    sort integer DEFAULT 0 NOT NULL,
+    kind text DEFAULT 'forum'::text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS public.threads (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    forum_id uuid,
+    key text NOT NULL,
+    title text NOT NULL,
+    url text,
+    kind text DEFAULT 'forum'::text NOT NULL,
+    author_name text,
+    user_id uuid,
+    locked boolean DEFAULT false NOT NULL,
+    deleted boolean DEFAULT false NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS public.comments (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    thread text NOT NULL,
+    parent_id uuid,
+    user_id uuid,
+    author_name text,
+    author_avatar text,
+    body text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    deleted boolean DEFAULT false NOT NULL,
+    author_role text
+);
+
+-- ── constraints (guarded — Postgres has no ADD CONSTRAINT IF NOT EXISTS) ──────
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'forums_pkey') THEN
+    ALTER TABLE ONLY public.forums ADD CONSTRAINT forums_pkey PRIMARY KEY (id);
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'forums_slug_key') THEN
+    ALTER TABLE ONLY public.forums ADD CONSTRAINT forums_slug_key UNIQUE (slug);
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'threads_pkey') THEN
+    ALTER TABLE ONLY public.threads ADD CONSTRAINT threads_pkey PRIMARY KEY (id);
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'threads_key_key') THEN
+    ALTER TABLE ONLY public.threads ADD CONSTRAINT threads_key_key UNIQUE (key);
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'comments_pkey') THEN
+    ALTER TABLE ONLY public.comments ADD CONSTRAINT comments_pkey PRIMARY KEY (id);
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'threads_forum_id_fkey') THEN
+    ALTER TABLE ONLY public.threads ADD CONSTRAINT threads_forum_id_fkey
+      FOREIGN KEY (forum_id) REFERENCES public.forums(id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'comments_parent_id_fkey') THEN
+    ALTER TABLE ONLY public.comments ADD CONSTRAINT comments_parent_id_fkey
+      FOREIGN KEY (parent_id) REFERENCES public.comments(id) ON DELETE CASCADE;
+  END IF;
+END $$;
+
+-- ── indexes ───────────────────────────────────────────────────────────────────
+CREATE INDEX IF NOT EXISTS threads_forum_idx ON public.threads USING btree (forum_id);
+CREATE INDEX IF NOT EXISTS comments_thread_idx ON public.comments USING btree (thread, created_at);
+
+-- ── view: per-thread comment counts (used by dialog-store) ────────────────────
+CREATE OR REPLACE VIEW public.comment_stats AS
+ SELECT comments.thread,
+    (count(*))::integer AS count,
+    max(comments.created_at) AS last
+   FROM public.comments
+  WHERE (NOT comments.deleted)
+  GROUP BY comments.thread;
+
+-- ── row-level security (enabled, no policies — service_role-mediated) ─────────
+ALTER TABLE public.forums ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.threads ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.comments ENABLE ROW LEVEL SECURITY;

cms/core/api/src/ratelimit.js

@@ -0,0 +1,34 @@
+// Einfacher In-Memory-Rate-Limiter (ein Container, eine Instanz → genügt).
+// Fixed-Window pro Schlüssel (Standard: Client-IP). Bei Überschreitung 429.
+// Hinter einem Reverse-Proxy liefert X-Forwarded-For die echte IP.
+
+const buckets = new Map(); // key -> { count, reset }
+
+function clientIp(c) {
+  const xff = c.req.header('x-forwarded-for');
+  if (xff) return xff.split(',')[0].trim();
+  return c.req.header('x-real-ip') || 'unknown';
+}
+
+// max Anfragen je windowMs. keyFn erlaubt eigene Schlüssel (z.B. IP+E-Mail).
+export function rateLimit({ max = 10, windowMs = 60_000, keyFn = clientIp } = {}) {
+  return async (c, next) => {
+    const key = keyFn(c);
+    const now = Date.now();
+    let b = buckets.get(key);
+    if (!b || now > b.reset) { b = { count: 0, reset: now + windowMs }; buckets.set(key, b); }
+    b.count += 1;
+    if (b.count > max) {
+      const retry = Math.ceil((b.reset - now) / 1000);
+      c.header('Retry-After', String(retry));
+      return c.json({ error: 'Zu viele Anfragen — bitte später erneut.' }, 429);
+    }
+    await next();
+  };
+}
+
+// Speicher sauber halten: abgelaufene Buckets periodisch wegräumen.
+setInterval(() => {
+  const now = Date.now();
+  for (const [k, b] of buckets) if (now > b.reset) buckets.delete(k);
+}, 5 * 60_000).unref?.();

cms/core/api/src/routes/account.js

@@ -0,0 +1,38 @@
+import { Hono } from 'hono';
+import { config } from '../config.js';
+import { supabase, supabaseAuth } from '../supabase.js';
+import * as local from '../auth-local.js';
+
+// Self-service for the logged-in user (after requireAuth). Currently: change own
+// password — local provider edits the user file; supabase verifies the current
+// password then updates via the admin API.
+const account = new Hono();
+
+account.post('/password', async (c) => {
+  let body = {};
+  try { body = await c.req.json(); } catch { /* 400 below */ }
+  const { current, next } = body;
+  if (!next || String(next).length < 6) return c.json({ error: 'Neues Passwort zu kurz (min. 6 Zeichen).' }, 400);
+  const email = (c.get('email') || '').toLowerCase();
+  const userId = c.get('user')?.id;
+
+  if (config.auth === 'local') {
+    const u = (await local.loadUsers()).find((x) => (x.email || '').toLowerCase() === email);
+    if (!u || !(await local.verifyPassword(current || '', u.password))) {
+      return c.json({ error: 'Aktuelles Passwort ist falsch.' }, 403);
+    }
+    await local.updateUser(u.id, { password: next });
+    return c.json({ ok: true });
+  }
+
+  // supabase: verify current via the dedicated auth client, then update via admin.
+  if (!supabaseAuth || !supabase) return c.json({ error: 'Auth nicht verfügbar' }, 500);
+  const { error: e1 } = await supabaseAuth.auth.signInWithPassword({ email, password: current || '' });
+  await supabaseAuth.auth.signOut().catch(() => {}); // Session sofort wieder lösen
+  if (e1) return c.json({ error: 'Aktuelles Passwort ist falsch.' }, 403);
+  const { error: e2 } = await supabase.auth.admin.updateUserById(userId, { password: next });
+  if (e2) return c.json({ error: e2.message }, 400);
+  return c.json({ ok: true });
+});
+
+export default account;

cms/core/api/src/routes/auth.js

@@ -0,0 +1,20 @@
+import { Hono } from 'hono';
+import { rateLimit } from '../ratelimit.js';
+import { login } from '../auth-local.js';
+
+// Lokaler Login (auth: 'local') — ersetzt GoTrue. Liefert ein GoTrue-förmiges
+// Token, das requireAuth genauso prüft wie ein Supabase-Token. Nur gemountet,
+// wenn config.auth === 'local' (siehe index.js); Brute-Force gedrosselt.
+const auth = new Hono();
+
+auth.post('/login', rateLimit({ max: 10, windowMs: 5 * 60_000 }), async (c) => {
+  let body = {};
+  try { body = await c.req.json(); } catch { /* leerer/kaputter Body → 400 unten */ }
+  const { email, password } = body;
+  if (!email || !password) return c.json({ error: 'E-Mail und Passwort nötig' }, 400);
+  const res = await login(email, password);
+  if (!res) return c.json({ error: 'Login fehlgeschlagen' }, 401);
+  return c.json(res);
+});
+
+export default auth;

cms/core/api/src/routes/history.js

@@ -0,0 +1,83 @@
+import { Hono } from 'hono';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import matter from 'gray-matter';
+import { marked } from 'marked';
+import { safeRel } from '../files.js';
+
+// ÖFFENTLICH: Versionsverlauf eines Library-Beitrags aus der Git-History.
+// Der Container hat das Repo unter /site gemountet + git installiert. Wir
+// holen alte Fassungen on-demand (kein Vorbauen) und zeigen sie auf der Site.
+const execFileP = promisify(execFile);
+const SITE_DIR = process.env.SITE_DIR || '/site';
+const git = (...args) => execFileP('git', ['-C', SITE_DIR, ...args], { maxBuffer: 10 * 1024 * 1024 });
+const US = '\x1f'; // Feldtrenner (Unit Separator) — kommt in Commit-Daten nicht vor.
+
+const history = new Hono();
+
+// Liste der Versionen: neueste zuerst.
+history.get('/', async (c) => {
+  let rel;
+  try { rel = safeRel(c.req.query('path')); } catch { return c.json({ error: 'Ungültiger Pfad' }, 400); }
+  try {
+    const { stdout } = await git(
+      'log', '--follow', `--format=%H${US}%h${US}%aI${US}%an${US}%s`, '--', `content/${rel}`);
+    const versions = stdout.trim().split('\n').filter(Boolean).map((line) => {
+      const [rev, short, date, author, subject] = line.split(US);
+      return { rev, short, date, author, subject };
+    });
+    return c.json(versions);
+  } catch { return c.json({ error: 'Verlauf nicht verfügbar' }, 500); }
+});
+
+// Eine bestimmte Fassung gerendert (HTML), zum Anzeigen auf der Seite.
+history.get('/version', async (c) => {
+  let rel;
+  try { rel = safeRel(c.req.query('path')); } catch { return c.json({ error: 'Ungültiger Pfad' }, 400); }
+  const rev = c.req.query('rev') || '';
+  if (!/^[0-9a-f]{7,40}$/i.test(rev)) return c.json({ error: 'Ungültige Version' }, 400);
+  try {
+    const { stdout } = await git('show', `${rev}:content/${rel}`);
+    const { data, content } = matter(stdout);
+    return c.json({
+      rev,
+      title: data.title || '',
+      date: data.date ? new Date(data.date).toISOString().slice(0, 10) : null,
+      html: renderMarkdown(content),
+    });
+  } catch { return c.json({ error: 'Version nicht gefunden' }, 404); }
+});
+
+// Unified-Diff einer Fassung (was dieser Commit an der Datei geändert hat) —
+// fürs rot/grün-Diff auf der Seite. Roh-Diff; das Frontend färbt +/- ein.
+history.get('/diff', async (c) => {
+  let rel;
+  try { rel = safeRel(c.req.query('path')); } catch { return c.json({ error: 'Ungültiger Pfad' }, 400); }
+  const rev = c.req.query('rev') || '';
+  if (!/^[0-9a-f]{7,40}$/i.test(rev)) return c.json({ error: 'Ungültige Version' }, 400);
+  try {
+    const { stdout } = await git('show', '--format=', '--no-color', rev, '--', `content/${rel}`);
+    return c.json({ rev, diff: stdout });
+  } catch { return c.json({ error: 'Diff nicht verfügbar' }, 404); }
+});
+
+// Markdown → HTML. marked kennt Goldmarks Fußnoten ([^id]) nicht — daher
+// vorab: Definitionen einsammeln, Verweise zu <sup>-Nummern, „Quellen" anhängen
+// (greift dieselbe .footnotes-CSS wie die Live-Seite).
+function renderMarkdown(md) {
+  const defs = {}; const order = [];
+  md = md.replace(/^\[\^([^\]]+)\]:[ \t]*(.*)$/gm, (_, id, txt) => { defs[id] = txt; return ''; });
+  md = md.replace(/\[\^([^\]]+)\]/g, (_, id) => {
+    if (!order.includes(id)) order.push(id);
+    return `<sup class="footnote-ref">${order.indexOf(id) + 1}</sup>`;
+  });
+  let html = marked.parse(md);
+  if (order.length) {
+    html += '<div class="footnotes"><ol>'
+      + order.map((id) => `<li>${marked.parseInline(defs[id] || '')}</li>`).join('')
+      + '</ol></div>';
+  }
+  return html;
+}
+
+export default history;

cms/core/api/src/routes/preview.js

@@ -1,6 +1,6 @@
 import { Hono } from 'hono';
 import { urlFor, safeRel } from '../files.js';
-import { hugoBuild } from '../hugo.js';
+import { buildSite } from '../hugo.js';
 
 // Echte Hugo-Vorschau: ganze Site mit --buildDrafts nach preview/ bauen und die
 // URL des Eintrags zurückgeben (so erscheinen auch draft:true-Einträge).
@@ -10,7 +10,7 @@ preview.post('/', async (c) => {
   const { path: rel } = await c.req.json();
   try {
     const safe = safeRel(rel);
-    const build = await hugoBuild({ dest: 'preview', drafts: true });
+    const build = await buildSite({ dest: 'preview', drafts: true });
     return c.json({ ok: true, url: `/_preview${urlFor(safe)}`, hugo: build.stdout });
   } catch (e) {
     return c.json({ error: String(e.message || e) }, 500);

cms/core/api/src/routes/profile.js

@@ -2,7 +2,7 @@ import { Hono } from 'hono';
 import { readFile, writeFile, mkdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 import matter from 'gray-matter';
-import { hugoBuild } from '../hugo.js';
+import { buildSite } from '../hugo.js';
 
 // Profile als Hugo-Data-Datei (data/authors.json) + öffentliche Autor-Seite
 // (content/authors/<slug>.md), gerendert von layouts/authors/single.html.
@@ -46,8 +46,8 @@ profile.put('/', async (c) => {
     }
     const page = matter.stringify(bio || '', { title: name, avatar: avatar || '' });
     await writeFile(path.join(AUTHORS_DIR, `${slug}.md`), page, 'utf8');
-    // Live bauen, damit die Seite + Byline-Links sofort funktionieren.
-    await hugoBuild({ dest: 'public', drafts: false }).catch(() => {});
+    // Live bauen (koalesziert), damit die Seite + Byline-Links sofort wirken.
+    await buildSite({ dest: 'public', drafts: false }).catch((e) => console.error('[profile] build:', e?.message || e));
   }
 
   return c.json({ ok: true, slug });

cms/core/api/src/routes/publish.js

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { urlFor, safeRel } from '../files.js';
-import { hugoBuild, gitCommit } from '../hugo.js';
+import { buildSite, gitCommit } from '../hugo.js';
+import { manager } from '../plugins.js';
 
 // Publizieren: public/ neu bauen (ohne Drafts) → live. Optional git-commit.
 const publish = new Hono();
@@ -9,7 +10,10 @@ publish.post('/', async (c) => {
   const { path: rel } = await c.req.json();
   try {
     const safe = safeRel(rel);
-    const build = await hugoBuild({ dest: 'public', drafts: false });
+    const build = await buildSite({ dest: 'public', drafts: false });
+    // Plugin-Publish-Hooks anstoßen (dialog spiegelt neue Library-Beiträge sofort
+    // als Threads). Fehler dürfen das Publish nicht kippen — Hooks fangen selbst ab.
+    await manager.runPublish({}, { path: safe });
     const git = await gitCommit(`cms: publish ${safe}`).catch((e) => ({ error: String(e.message || e) }));
     return c.json({ ok: true, url: urlFor(safe), git, hugo: build.stdout });
   } catch (e) {

cms/core/api/src/routes/stats.js

@@ -0,0 +1,44 @@
+import { Hono } from 'hono';
+import { supabase } from '../supabase.js';
+import { listEntries } from '../files.js';
+import { requireAdmin, roleOf } from '../auth.js';
+import { config } from '../config.js';
+import { contentStats } from '../collections.js';
+import { manager } from '../plugins.js';
+import { countByRole } from '../auth-local.js';
+
+const ADMIN_EMAILS = (process.env.ADMIN_EMAILS || '')
+  .split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
+
+// Kennzahlen für die Admin-Übersicht. Nur Admins; rein lesend.
+const stats = new Hono();
+stats.use('*', requireAdmin);
+
+stats.get('/', async (c) => {
+  // Inhalte aus dem Dateisystem zählen — Zähler pro collection.statKey.
+  let content = {};
+  try { content = contentStats(await listEntries(), config.collections); }
+  catch { /* Filesystem nicht lesbar → leer */ }
+
+  // Nutzer nach Rolle: lokal aus der User-Datei, sonst aus GoTrue.
+  let users = { total: 0, admin: 0, editor: 0, user: 0 };
+  if (config.auth === 'local') {
+    try { users = await countByRole(ADMIN_EMAILS); } catch { /* User-Datei fehlt → 0 */ }
+  } else if (supabase) {
+    try {
+      const { data } = await supabase.auth.admin.listUsers();
+      for (const u of data?.users || []) { users.total++; users[roleOf(u)] = (users[roleOf(u)] || 0) + 1; }
+    } catch { /* GoTrue nicht erreichbar */ }
+  }
+
+  // Plugin-Kennzahlen einsammeln (jedes Plugin unter seinem Namen). Nur geladene
+  // Plugins lesen die DB — eine pluginlose Site macht hier null DB-Zugriffe.
+  const pluginStats = await manager.collectStats({});
+  // Dialog bleibt als eigenes Feld im Vertrag (Admin erwartet { forums, threads,
+  // comments }); fehlt das Plugin, sind es Nullen.
+  const dialog = pluginStats.dialog || { forums: 0, threads: 0, comments: 0 };
+
+  return c.json({ content, users, dialog });
+});
+
+export default stats;

cms/core/api/src/routes/system.js

@@ -0,0 +1,63 @@
+import { Hono } from 'hono';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { config } from '../config.js';
+import { manager } from '../plugins.js';
+import { requireAdmin } from '../auth.js';
+
+const execFileP = promisify(execFile);
+
+let _version = null;
+async function coreVersion() {
+  if (_version) return _version;
+  try { _version = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8')).version || '0.0.0'; }
+  catch { _version = '0.0.0'; }
+  return _version;
+}
+let _hugo = null;
+async function hugoVersion() {
+  if (_hugo) return _hugo;
+  try { const { stdout } = await execFileP('hugo', ['version']); _hugo = (stdout.match(/v[0-9][0-9.]*[^\s]*/) || ['?'])[0]; }
+  catch { _hugo = '?'; }
+  return _hugo;
+}
+
+// System-/Diagnose-Info fürs Admin-Panel. Reiner Builder (testbar); die Route hängt
+// nur die zur Laufzeit ermittelten Versionen dran.
+export function systemInfo({ version, hugo }) {
+  return {
+    core: { name: 'openbureau-core', version },
+    site: config.site || null,
+    auth: config.auth || 'supabase',
+    admins: config.admins || [],
+    plugins: manager.plugins.map((p) => ({
+      name: p.name, routes: (p.routes || []).length, migrations: (p.migrations || []).length,
+    })),
+    collections: config.collections.map((c) => ({
+      kind: c.kind, label: c.label, statKey: c.statKey || null, fields: (c.fields || []).length,
+    })),
+    hugo,
+  };
+}
+
+const system = new Hono();
+system.use('*', requireAdmin);
+
+system.get('/', async (c) => c.json(systemInfo({ version: await coreVersion(), hugo: await hugoVersion() })));
+
+// Update-Check (token-frei): laufende Core-Version (Image, /app/package.json) vs. die
+// im Repo VENDORTE Version (SITE_DIR/cms/core/api/package.json). Ist die vendorte neuer,
+// wurde core aktualisiert aber noch nicht neu gebaut → "Rebuild nötig" (Update-Skript).
+system.get('/update', async (c) => {
+  const running = await coreVersion();
+  const siteDir = process.env.SITE_DIR || '/site';
+  const vendorPath = path.join(siteDir, process.env.CORE_VENDOR_PATH || 'cms/core', 'api/package.json');
+  let vendored = null;
+  try { vendored = JSON.parse(await readFile(vendorPath, 'utf8')).version || null; }
+  catch { /* nicht als Subtree eingebunden → kein Vergleich möglich */ }
+  return c.json({ running, vendored, available: !!(vendored && vendored !== running) });
+});
+
+export default system;

cms/core/api/src/routes/upload.js

@@ -0,0 +1,83 @@
+import { Hono } from 'hono';
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import sharp from 'sharp';
+
+// Bild-Upload → static/images/. Raster-Bilder werden zu WebP konvertiert
+// (kleiner, web-optimiert), auf max. 2000px begrenzt, EXIF-Rotation korrigiert.
+// SVG/GIF bleiben unangetastet (Vektor/Animation erhalten).
+//
+// Sicherheit: hartes Größenlimit (DoS / Decompression-Bombs), Raster wird über
+// sharp-Metadaten als echtes Bild verifiziert, SVG nur wenn es wie SVG aussieht.
+// Hochgeladene Dateien werden zudem mit strikter CSP (sandbox) ausgeliefert
+// (siehe index.js, /images/*) → ein bösartiges SVG kann kein JS im Origin starten.
+const SITE_DIR = process.env.SITE_DIR || '/site';
+const MAX_UPLOAD = 8 * 1024 * 1024;   // 8 MB Rohdatei
+const ALLOWED_RASTER = new Set(['jpeg', 'png', 'webp', 'avif', 'tiff']);
+
+const upload = new Hono();
+
+upload.post('/', async (c) => {
+  const body = await c.req.parseBody();
+  const file = body['file'];
+  if (!file || typeof file === 'string') return c.json({ error: 'Keine Datei' }, 400);
+  if (typeof file.size === 'number' && file.size > MAX_UPLOAD) {
+    return c.json({ error: 'Datei zu groß (max. 8 MB)' }, 413);
+  }
+
+  const buffer = Buffer.from(await file.arrayBuffer());
+  if (buffer.length > MAX_UPLOAD) return c.json({ error: 'Datei zu groß (max. 8 MB)' }, 413);
+  if (!buffer.length) return c.json({ error: 'Leere Datei' }, 400);
+
+  const dir = path.join(SITE_DIR, 'static', 'images');
+  await mkdir(dir, { recursive: true });
+
+  const ext = path.extname(file.name || '').toLowerCase();
+  const base = `${safeBase(file.name)}-${uid()}`;
+
+  let outName, outBuf;
+  if (ext === '.svg') {
+    // Muss wie SVG aussehen (Magie/Marker), sonst ablehnen.
+    const head = buffer.subarray(0, 512).toString('utf8').trimStart().toLowerCase();
+    if (!head.startsWith('<?xml') && !head.startsWith('<svg')) {
+      return c.json({ error: 'Keine gültige SVG-Datei' }, 400);
+    }
+    outName = `${base}.svg`;
+    outBuf = buffer;
+  } else if (ext === '.gif') {
+    // GIF-Magie prüfen (kann kein Skript ausführen → Passthrough ok).
+    const sig = buffer.subarray(0, 6).toString('latin1');
+    if (sig !== 'GIF87a' && sig !== 'GIF89a') return c.json({ error: 'Keine gültige GIF-Datei' }, 400);
+    outName = `${base}.gif`;
+    outBuf = buffer;
+  } else {
+    // Raster: über sharp als echtes Bild verifizieren, dann zu WebP.
+    let meta;
+    try { meta = await sharp(buffer).metadata(); } catch { meta = null; }
+    if (!meta || !ALLOWED_RASTER.has(meta.format)) {
+      return c.json({ error: 'Kein unterstütztes Bildformat' }, 400);
+    }
+    outName = `${base}.webp`;
+    outBuf = await sharp(buffer)
+      .rotate()
+      .resize({ width: 2000, withoutEnlargement: true })
+      .webp({ quality: 82 })
+      .toBuffer();
+  }
+
+  await writeFile(path.join(dir, outName), outBuf);
+  return c.json({ url: `/images/${outName}` });
+});
+
+// Sicherer Basisname ohne Endung.
+function safeBase(raw) {
+  const base = path.basename(String(raw || 'bild')).replace(/\.[^.]+$/, '');
+  const cleaned = base.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+  return cleaned || 'bild';
+}
+// Kurze eindeutige Endung, damit gleichnamige Uploads nicht kollidieren.
+function uid() {
+  return Date.now().toString(36).slice(-4) + Math.random().toString(36).slice(2, 5);
+}
+
+export default upload;

cms/core/api/src/routes/users.js

@@ -0,0 +1,80 @@
+import { Hono } from 'hono';
+import { supabase } from '../supabase.js';
+import { requireAdmin, roleOf } from '../auth.js';
+import { config } from '../config.js';
+import * as local from '../auth-local.js';
+
+// Autoren-/Nutzerverwaltung. Mit auth:'local' gegen die User-Datei (DB-los),
+// sonst über die GoTrue-Admin-API (Service-Key). Nur Admins.
+const ADMINS = (process.env.ADMIN_EMAILS || '')
+  .split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
+const isLocal = () => config.auth === 'local';
+
+const users = new Hono();
+users.use('*', requireAdmin);
+
+users.get('/', async (c) => {
+  if (isLocal()) {
+    try { return c.json(await local.listUsers(ADMINS)); }
+    catch (e) { return c.json({ error: String(e.message || e) }, 500); }
+  }
+  const { data, error } = await supabase.auth.admin.listUsers();
+  if (error) return c.json({ error: error.message }, 500);
+  const list = (data?.users || []).map((u) => {
+    const role = roleOf(u);
+    return {
+      id: u.id,
+      email: u.email,
+      created_at: u.created_at,
+      last_sign_in_at: u.last_sign_in_at || null,
+      role,
+      isAdmin: role === 'admin',
+      // Admins aus der .env lassen sich nicht per UI herabstufen.
+      fixedAdmin: ADMINS.includes((u.email || '').toLowerCase()),
+    };
+  });
+  return c.json(list);
+});
+
+users.post('/', async (c) => {
+  const { email, password, role } = await c.req.json();
+  if (!email || !password) return c.json({ error: 'E-Mail und Passwort nötig' }, 400);
+  if (role && !['user', 'editor', 'admin'].includes(role)) return c.json({ error: 'Unbekannte Rolle' }, 400);
+  if (isLocal()) {
+    try { return c.json({ ok: true, id: await local.createUser({ email, password, role }) }); }
+    catch (e) { return c.json({ error: String(e.message || e) }, 400); }
+  }
+  const payload = { email, password, email_confirm: true };
+  if (role && role !== 'user') payload.app_metadata = { role };
+  const { data, error } = await supabase.auth.admin.createUser(payload);
+  if (error) return c.json({ error: error.message }, 400);
+  return c.json({ ok: true, id: data.user.id });
+});
+
+users.put('/:id', async (c) => {
+  const { password, role } = await c.req.json();
+  if (role && !['user', 'editor', 'admin'].includes(role)) return c.json({ error: 'Unbekannte Rolle' }, 400);
+  if (!password && !role) return c.json({ error: 'Nichts zu ändern' }, 400);
+  if (isLocal()) {
+    try { await local.updateUser(c.req.param('id'), { password, role }); return c.json({ ok: true }); }
+    catch (e) { return c.json({ error: String(e.message || e) }, 400); }
+  }
+  const patch = {};
+  if (password) patch.password = password;
+  if (role) patch.app_metadata = { role };
+  const { error } = await supabase.auth.admin.updateUserById(c.req.param('id'), patch);
+  if (error) return c.json({ error: error.message }, 400);
+  return c.json({ ok: true });
+});
+
+users.delete('/:id', async (c) => {
+  if (isLocal()) {
+    try { await local.deleteUser(c.req.param('id')); return c.json({ ok: true }); }
+    catch (e) { return c.json({ error: String(e.message || e) }, 400); }
+  }
+  const { error } = await supabase.auth.admin.deleteUser(c.req.param('id'));
+  if (error) return c.json({ error: error.message }, 400);
+  return c.json({ ok: true });
+});
+
+export default users;

cms/core/api/src/supabase.js

@@ -0,0 +1,29 @@
+import { createClient } from '@supabase/supabase-js';
+
+const url = process.env.SUPABASE_URL;
+const key = process.env.SUPABASE_SERVICE_KEY;
+
+const opts = { auth: { persistSession: false, autoRefreshToken: false } };
+
+// Mit Keys: echte Clients. Ohne (DB-loser core, auth:'local'): Clients bleiben
+// null; die Aufrufer (auth/stats/users) sind null-sicher und nutzen den lokalen
+// Provider. DB-Plugins (dialog) laufen ohnehin nur mit Supabase. Den Fail-Fast
+// für auth:'supabase' macht index.js (das kennt die config) — supabase.js bleibt
+// bewusst config-frei, damit Unit-Tests es ohne CMS_CONFIG importieren können.
+let _supabase = null;
+let _supabaseAuth = null;
+if (url && key) {
+  // Daten-Client: Service-Role-Key, umgeht RLS. NUR für DB-Zugriffe (from/insert/…).
+  // Wichtig: hier niemals signInWithPassword aufrufen — das schaltet den
+  // Authorization-Header des Clients prozessweit auf das User-Token um (SIGNED_IN),
+  // wodurch anschließende Inserts als role=authenticated laufen und an RLS scheitern.
+  _supabase = createClient(url, key, opts);
+  // Eigener Client nur für Auth (Login, Token-Prüfung). Getrennt, damit ein
+  // signInWithPassword den Daten-Client oben nicht „vergiftet". Niemals ins Frontend.
+  _supabaseAuth = createClient(url, key, opts);
+} else {
+  console.warn('supabase.js: kein SUPABASE_URL/SERVICE_KEY — DB-loser Betrieb (auth: local erwartet).');
+}
+
+export const supabase = _supabase;
+export const supabaseAuth = _supabaseAuth;

cms/core/api/src/util.js

@@ -0,0 +1,6 @@
+// Serverfehler protokollieren, aber dem Client nur eine generische Meldung
+// geben — keine DB-/Stack-Interna nach außen (Info-Leak vermeiden).
+export function serverError(c, where, err, status = 500) {
+  console.error(`[${where}]`, err?.message || err);
+  return c.json({ error: 'Serverfehler' }, status);
+}

cms/core/api/test/auth-local.test.js

@@ -0,0 +1,67 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { rm, readFile } from 'node:fs/promises';
+
+// Isolated users file + a known secret BEFORE importing the module (it reads env
+// at import time). No Supabase needed — this is the DB-less path.
+const USERS = join(tmpdir(), `cms-users-${process.pid}.json`);
+process.env.USERS_FILE = USERS;
+process.env.JWT_SECRET ||= 'test-secret-xyz';
+
+const local = await import('../src/auth-local.js');
+const { verify } = await import('hono/jwt');
+
+test.after(async () => { await rm(USERS, { force: true }); });
+
+test('create → list → login mints a GoTrue-shaped, verifiable token', async () => {
+  const id = await local.createUser({ email: 'Karim@Example.com', password: 'hunter2', role: 'admin' });
+  assert.ok(id);
+  const list = await local.listUsers(['someone@else.com']);
+  assert.equal(list.length, 1);
+  assert.equal(list[0].email, 'Karim@Example.com');
+  assert.equal(list[0].role, 'admin');
+
+  // wrong password rejected, right password accepted (case-insensitive email)
+  assert.equal(await local.login('karim@example.com', 'nope'), null);
+  const res = await local.login('karim@example.com', 'hunter2');
+  assert.ok(res?.access_token);
+  assert.equal(res.user.email, 'Karim@Example.com');
+
+  const claims = await verify(res.access_token, process.env.JWT_SECRET, 'HS256');
+  assert.equal(claims.sub, id);
+  assert.equal(claims.email, 'Karim@Example.com');
+  assert.equal(claims.app_metadata.role, 'admin'); // same shape auth.js/roleOf read
+  assert.ok(claims.exp > Math.floor(Date.now() / 1000));
+});
+
+test('passwords are bcrypt-hashed at rest (never plaintext)', async () => {
+  const raw = JSON.parse(await readFile(USERS, 'utf8'));
+  assert.match(raw[0].password, /^\$2[aby]\$/); // bcrypt hash prefix
+  assert.notEqual(raw[0].password, 'hunter2');
+});
+
+test('countByRole reflects roles; fixed-admin email forced to admin', async () => {
+  await local.createUser({ email: 'red@x.com', password: 'pw', role: 'editor' });
+  const counts = await local.countByRole([]);
+  assert.equal(counts.total, 2);
+  assert.equal(counts.admin, 1);
+  assert.equal(counts.editor, 1);
+  // an env-admin email overrides the stored role in the listing
+  const forced = await local.listUsers(['red@x.com']);
+  assert.equal(forced.find((u) => u.email === 'red@x.com').role, 'admin');
+});
+
+test('update + delete', async () => {
+  const id = await local.createUser({ email: 'tmp@x.com', password: 'pw' });
+  await local.updateUser(id, { role: 'editor' });
+  assert.equal((await local.listUsers([])).find((u) => u.id === id).role, 'editor');
+  await local.deleteUser(id);
+  assert.equal((await local.listUsers([])).some((u) => u.id === id), false);
+  await assert.rejects(() => local.deleteUser('nope'), /nicht gefunden/);
+});
+
+test('duplicate email rejected', async () => {
+  await assert.rejects(() => local.createUser({ email: 'red@x.com', password: 'pw' }), /existiert bereits/);
+});

cms/core/api/test/auth.test.js

@@ -0,0 +1,68 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+// Env vor dem Import setzen: supabase.js bricht ohne URL/Key ab, ADMIN_EMAILS
+// und JWT_SECRET werden beim Modul-Load gelesen.
+process.env.SUPABASE_URL ||= 'http://localhost';
+process.env.SUPABASE_SERVICE_KEY ||= 'dummy';
+process.env.JWT_SECRET = 'test-secret';
+process.env.ADMIN_EMAILS = 'boss@x.ch';
+
+const { roleOf, requireAuth } = await import('../src/auth.js');
+const { sign } = await import('hono/jwt');
+
+test('roleOf: Admin aus ADMIN_EMAILS', () => {
+  assert.equal(roleOf({ email: 'boss@x.ch' }), 'admin');
+  assert.equal(roleOf({ email: 'BOSS@X.CH' }), 'admin');
+});
+
+test('roleOf: Rolle aus app_metadata', () => {
+  assert.equal(roleOf({ email: 'a@x.ch', app_metadata: { role: 'admin' } }), 'admin');
+  assert.equal(roleOf({ email: 'a@x.ch', app_metadata: { role: 'editor' } }), 'editor');
+  assert.equal(roleOf({ email: 'a@x.ch' }), 'user');
+});
+
+// Minimaler Hono-Kontext-Stub.
+function fakeCtx(authHeader) {
+  const store = {};
+  return {
+    req: { header: (h) => (h === 'Authorization' ? authHeader : undefined) },
+    set: (k, v) => { store[k] = v; },
+    get: (k) => store[k],
+    json: (body, status = 200) => ({ __status: status, body }),
+  };
+}
+
+test('requireAuth: gültiges Token wird lokal verifiziert', async () => {
+  const token = await sign(
+    { sub: 'u1', email: 'A@x.ch', app_metadata: { role: 'editor' }, exp: Math.floor(Date.now() / 1000) + 60 },
+    'test-secret', 'HS256');
+  let passed = false;
+  const c = fakeCtx('Bearer ' + token);
+  await requireAuth(c, async () => { passed = true; });
+  assert.equal(passed, true);
+  assert.equal(c.get('email'), 'a@x.ch');           // kleingeschrieben
+  assert.equal(c.get('role'), 'editor');
+  assert.equal(c.get('canModerate'), true);
+  assert.equal(c.get('isAdmin'), false);
+});
+
+test('requireAuth: fehlendes Token → 401', async () => {
+  const c = fakeCtx('');
+  const r = await requireAuth(c, async () => { throw new Error('darf nicht laufen'); });
+  assert.equal(r.__status, 401);
+});
+
+test('requireAuth: kaputtes/falsch signiertes Token → 401', async () => {
+  const bad = await sign({ sub: 'u1', exp: Math.floor(Date.now() / 1000) + 60 }, 'falsches-secret', 'HS256');
+  for (const t of ['Bearer garbage', 'Bearer ' + bad]) {
+    const r = await requireAuth(fakeCtx(t), async () => { throw new Error('darf nicht laufen'); });
+    assert.equal(r.__status, 401);
+  }
+});
+
+test('requireAuth: abgelaufenes Token → 401', async () => {
+  const expired = await sign({ sub: 'u1', exp: Math.floor(Date.now() / 1000) - 10 }, 'test-secret', 'HS256');
+  const r = await requireAuth(fakeCtx('Bearer ' + expired), async () => { throw new Error('darf nicht laufen'); });
+  assert.equal(r.__status, 401);
+});

cms/core/api/test/coalesce.test.js

@@ -0,0 +1,46 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+const { coalesce } = await import('../src/coalesce.js');
+
+const tick = (ms = 5) => new Promise((r) => setTimeout(r, ms));
+
+test('coalesce: nie mehr als ein Lauf gleichzeitig pro Key', async () => {
+  let active = 0, maxActive = 0, runs = 0;
+  const fn = async () => { active++; maxActive = Math.max(maxActive, active); await tick(10); runs++; active--; return runs; };
+
+  // 5 gleichzeitige Aufrufe.
+  await Promise.all(Array.from({ length: 5 }, () => coalesce('k1', fn)));
+  assert.equal(maxActive, 1, 'parallele Läufe');
+  // Erster Lauf bedient den ersten Aufruf; die 4 während des Laufs eingetroffenen
+  // teilen sich GENAU EINEN nachgelagerten Lauf → insgesamt 2.
+  assert.equal(runs, 2);
+});
+
+test('coalesce: Wartende teilen sich das Ergebnis des nachgelagerten Laufs', async () => {
+  let n = 0;
+  const fn = async () => { await tick(10); return ++n; };
+  const first = coalesce('k2', fn);          // startet sofort → Ergebnis 1
+  await tick(2);                              // sicherstellen, dass er läuft
+  const a = coalesce('k2', fn);              // wartet → nachgelagerter Lauf
+  const b = coalesce('k2', fn);              // wartet → selber Lauf wie a
+  assert.equal(await first, 1);
+  const [ra, rb] = await Promise.all([a, b]);
+  assert.equal(ra, 2);
+  assert.equal(rb, 2);                        // a und b teilen sich Lauf 2
+});
+
+test('coalesce: Fehler wird an die Wartenden propagiert, Key bleibt nutzbar', async () => {
+  let fail = true;
+  const fn = async () => { await tick(5); if (fail) throw new Error('boom'); return 'ok'; };
+  await assert.rejects(() => coalesce('k3', fn), /boom/);
+  fail = false;
+  assert.equal(await coalesce('k3', fn), 'ok');   // danach wieder verwendbar
+});
+
+test('coalesce: verschiedene Keys laufen unabhängig', async () => {
+  const fn = async () => { await tick(5); return 'done'; };
+  const [x, y] = await Promise.all([coalesce('kA', fn), coalesce('kB', fn)]);
+  assert.equal(x, 'done');
+  assert.equal(y, 'done');
+});

cms/core/api/test/collections.test.js

@@ -0,0 +1,101 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { classify, buildPath, compareEntries } from '../src/collections.js';
+import openbureau from '../../examples/openbureau.config.js';
+import kgva from '../../examples/kgva.config.js';
+
+const ob = openbureau.collections;
+const kg = kgva.collections;
+
+// --- openbureau: must reproduce the original hard-coded classify() 1:1 ---
+
+test('classify (openbureau): Beitrag = archiv/<section>/<slug>', () => {
+  assert.deepEqual(classify('archiv/software/stack.md', ob), { kind: 'beitrag', section: 'software' });
+  assert.deepEqual(classify('archiv/buerofuehrung/x.md', ob), { kind: 'beitrag', section: 'buerofuehrung' });
+});
+
+test('classify (openbureau): Library = library/<slug>, section konstant', () => {
+  assert.deepEqual(classify('library/stack.md', ob), { kind: 'biblio', section: 'library' });
+});
+
+test('classify (openbureau): _index.md = Rubrik, section = Elternordner|home', () => {
+  assert.deepEqual(classify('_index.md', ob), { kind: 'rubrik', section: 'home' });
+  assert.deepEqual(classify('software/_index.md', ob), { kind: 'rubrik', section: 'software' });
+});
+
+test('classify (openbureau): alles andere = Seite (fallback)', () => {
+  assert.deepEqual(classify('manifest.md', ob), { kind: 'seite', section: null });
+  // _index hat Vorrang vor jedem Pfad-Pattern (wie im Original)
+  assert.deepEqual(classify('library/_index.md', ob), { kind: 'rubrik', section: 'library' });
+  // archiv strikt drei-tief: tiefer faellt auf Seite (Original: len !== 3)
+  assert.deepEqual(classify('archiv/software/a/b.md', ob), { kind: 'seite', section: null });
+});
+
+test('buildPath (openbureau): aus Pfad-Pattern + Formulardaten', () => {
+  assert.equal(buildPath('beitrag', { section: 'software', slug: 'neu' }, ob), 'archiv/software/neu.md');
+  assert.equal(buildPath('biblio', { slug: 'stack' }, ob), 'library/stack.md');
+  assert.equal(buildPath('seite', { slug: 'impressum' }, ob), 'impressum.md');
+  assert.equal(buildPath('beitrag', { section: 'software', slug: '' }, ob), '');
+});
+
+test('compareEntries (openbureau): Reihenfolge Beitrag<Library<Seite<Rubrik', () => {
+  const items = [
+    { kind: 'rubrik', date: null, title: 'R' },
+    { kind: 'seite', date: null, title: 'S' },
+    { kind: 'beitrag', date: '2024-01-01', title: 'B' },
+    { kind: 'biblio', date: null, title: 'L' },
+  ];
+  const sorted = [...items].sort(compareEntries(ob)).map((e) => e.kind);
+  assert.deepEqual(sorted, ['beitrag', 'biblio', 'seite', 'rubrik']);
+});
+
+test('compareEntries: gleiche kind -> Datum absteigend, dann Titel', () => {
+  const items = [
+    { kind: 'beitrag', date: '2023-05-01', title: 'B' },
+    { kind: 'beitrag', date: '2024-05-01', title: 'A' },
+    { kind: 'beitrag', date: '2024-05-01', title: 'C' },
+  ];
+  const sorted = [...items].sort(compareEntries(ob)).map((e) => e.title);
+  assert.deepEqual(sorted, ['A', 'C', 'B']);
+});
+
+// --- kgva: a different content model, same engine ---
+
+test('classify (kgva): Portfolio / Fallback-Page / Index-Section', () => {
+  assert.deepEqual(classify('portfolio/projekt.md', kg), { kind: 'project', section: 'portfolio' });
+  assert.deepEqual(classify('ueber.md', kg), { kind: 'page', section: null });
+  assert.deepEqual(classify('_index.md', kg), { kind: 'section', section: 'home' });
+  assert.deepEqual(classify('arbeiten/_index.md', kg), { kind: 'section', section: 'arbeiten' });
+});
+
+test('buildPath (kgva)', () => {
+  assert.equal(buildPath('project', { slug: 'haus' }, kg), 'portfolio/haus.md');
+  assert.equal(buildPath('page', { slug: 'ueber' }, kg), 'ueber.md');
+});
+
+import { contentStats } from '../src/collections.js';
+
+test('contentStats (openbureau): statKey-Zähler + entwuerfe = Beitrag-Entwürfe', () => {
+  const entries = [
+    { kind: 'beitrag', draft: false },
+    { kind: 'beitrag', draft: true },
+    { kind: 'beitrag', draft: true },
+    { kind: 'biblio', draft: true },   // Library-Entwurf zählt NICHT als entwuerfe
+    { kind: 'seite', draft: false },
+    { kind: 'rubrik', draft: false },
+  ];
+  assert.deepEqual(contentStats(entries, ob), {
+    beitraege: 3, entwuerfe: 2, library: 1, rubriken: 1, seiten: 1,
+  });
+});
+
+test('contentStats (kgva): nur deklarierte statKeys, kein entwuerfe', () => {
+  const entries = [
+    { kind: 'project', draft: true },
+    { kind: 'project', draft: false },
+    { kind: 'page', draft: false },     // page hat keinen statKey
+    { kind: 'section', draft: false },  // section hat keinen statKey
+  ];
+  assert.deepEqual(contentStats(entries, kg), { projects: 2 });
+});

cms/core/api/test/cutover.test.js

@@ -0,0 +1,40 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { fileURLToPath } from 'node:url';
+
+// Stage-5 cutover: index.js/stats.js/publish.js no longer hard-code the dialog;
+// they go through the shared plugin manager singleton (src/plugins.js), loaded
+// from config.plugins. This proves the singleton + the rewired route modules
+// resolve (guards the moved-file import paths) — handlers aren't called, so
+// dummy supabase/JWT env is enough, as in dialog-plugin.test.js.
+process.env.CMS_CONFIG ||= fileURLToPath(new URL('../../examples/openbureau.config.js', import.meta.url));
+process.env.SUPABASE_URL ||= 'http://localhost';
+process.env.SUPABASE_SERVICE_KEY ||= 'x';
+process.env.JWT_SECRET ||= 'x';
+process.env.SITE_DIR ||= '/tmp/nosite';
+
+const { manager } = await import('../src/plugins.js');
+
+test('plugins.js: manager loaded from config.plugins (openbureau → dialog)', () => {
+  assert.deepEqual(manager.names(), ['dialog']);
+  assert.equal(manager.has('dialog'), true);
+});
+
+test('cutover: stats.js still resolves with the manager dependency', async () => {
+  const stats = (await import('../src/routes/stats.js')).default;
+  assert.equal(typeof stats.fetch, 'function'); // a Hono app
+});
+
+test('cutover: publish.js still resolves with the manager dependency', async () => {
+  const publish = (await import('../src/routes/publish.js')).default;
+  assert.equal(typeof publish.fetch, 'function');
+});
+
+test('cutover: collectStats exposes dialog under its plugin name', async () => {
+  // Counts hit a dummy supabase → each count() swallows the error and returns 0,
+  // but the SHAPE (the stats.js contract) must hold: { dialog: { forums, … } }.
+  const merged = await manager.collectStats({});
+  assert.deepEqual(merged.dialog, { forums: 0, threads: 0, comments: 0 });
+  const dialog = merged.dialog || { forums: 0, threads: 0, comments: 0 };
+  assert.deepEqual(Object.keys(dialog).sort(), ['comments', 'forums', 'threads']);
+});

cms/core/api/test/dialog-plugin.test.js

@@ -0,0 +1,53 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Hono } from 'hono';
+
+// The dialog modules import supabase.js, which exits without these; dummies are
+// enough since this test only checks structure/mounting, never calls a handler.
+process.env.SUPABASE_URL ||= 'http://localhost';
+process.env.SUPABASE_SERVICE_KEY ||= 'x';
+process.env.JWT_SECRET ||= 'x';
+process.env.SITE_DIR ||= '/tmp/nosite';
+
+const { loadPlugins } = await import('../src/plugin-manager.js');
+const m = await loadPlugins(['dialog']);
+
+test('dialog plugin loads with a valid manifest', () => {
+  assert.deepEqual(m.names(), ['dialog']);
+  assert.equal(m.has('dialog'), true);
+});
+
+test('dialog: route tiers as in index.js', () => {
+  const routes = m.plugins[0].routes;
+  const pub = routes.filter((r) => r.public).map((r) => `${r.method || 'route'} ${r.path}`);
+  const priv = routes.filter((r) => !r.public).map((r) => `${r.method || 'route'} ${r.path}`);
+  assert.deepEqual(pub, [
+    'get /comments', 'get /forums', 'get /forums/:slug', 'get /recent', 'get /thread', 'post /auth/login',
+  ]);
+  assert.deepEqual(priv, [
+    'post /comments', 'delete /comments/:id', 'post /threads', 'route /mod', 'route /admin/forums',
+  ]);
+});
+
+test('dialog: widget login is rate-limited', () => {
+  const loginRoute = m.plugins[0].routes.find((r) => r.path === '/auth/login');
+  assert.equal(loginRoute.public, true);
+  assert.equal(Array.isArray(loginRoute.use) && loginRoute.use.length, 1);
+});
+
+test('dialog: lifecycle hooks + stats present', () => {
+  const p = m.plugins[0];
+  assert.equal(typeof p.onBoot, 'function');
+  assert.equal(typeof p.onPublish, 'function');
+  assert.equal(typeof p.stats, 'function');
+});
+
+test('dialog: mounts into the pipeline without throwing', () => {
+  const app = new Hono();
+  const requireAdmin = async (c, next) => next();
+  assert.doesNotThrow(() => {
+    m.mountPublic(app);
+    app.use('/api/*', async (c, next) => next());
+    m.mountPrivate(app, '/api', requireAdmin);
+  });
+});

cms/core/api/test/files.test.js

@@ -0,0 +1,41 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+const { safeRel, normAuthors, hasAccess, urlFor } = await import('../src/files.js');
+
+test('safeRel: gültiger relativer .md-Pfad bleibt erhalten', () => {
+  assert.equal(safeRel('library/software/stack.md'), 'library/software/stack.md');
+  assert.equal(safeRel('a/./b.md'), 'a/b.md');
+});
+
+test('safeRel: Path-Traversal wird abgelehnt', () => {
+  assert.throws(() => safeRel('../etc/passwd.md'));
+  assert.throws(() => safeRel('a/../../b.md'));
+  assert.throws(() => safeRel('/absolut.md'));
+});
+
+test('safeRel: nur .md erlaubt, leer/falsch wirft', () => {
+  assert.throws(() => safeRel('note.txt'));
+  assert.throws(() => safeRel(''));
+  assert.throws(() => safeRel(null));
+});
+
+test('normAuthors: String/Array/Leer normalisieren', () => {
+  assert.deepEqual(normAuthors('a@x.ch'), ['a@x.ch']);
+  assert.deepEqual(normAuthors(['a@x.ch', 'b@y.ch']), ['a@x.ch', 'b@y.ch']);
+  assert.deepEqual(normAuthors(null), []);
+  assert.deepEqual(normAuthors([]), []);
+});
+
+test('hasAccess: case-insensitive Mitgliedschaft', () => {
+  assert.equal(hasAccess(['Karim@x.ch'], 'karim@x.ch'), true);
+  assert.equal(hasAccess(['a@x.ch'], 'b@y.ch'), false);
+  assert.equal(hasAccess([], 'a@x.ch'), false);
+});
+
+test('urlFor: Hugo-URLs aus relativem Pfad', () => {
+  assert.equal(urlFor('_index.md'), '/');
+  assert.equal(urlFor('manifest.md'), '/manifest/');
+  assert.equal(urlFor('library/software/stack.md'), '/library/software/stack/');
+  assert.equal(urlFor('software/_index.md'), '/software/');
+});

cms/core/api/test/migrate.test.js

@@ -0,0 +1,77 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { runMigrations } from '../src/migrate.js';
+import { createManager } from '../src/plugin-manager.js';
+
+// Dialog modules import supabase.js, which exits without these (loadPlugins for
+// the real dialog manifest in the last test touches them transitively).
+process.env.SUPABASE_URL ||= 'http://localhost';
+process.env.SUPABASE_SERVICE_KEY ||= 'x';
+process.env.JWT_SECRET ||= 'x';
+process.env.SITE_DIR ||= '/tmp/nosite';
+
+// A fake SQL executor over an in-memory schema_migrations set. Records every
+// non-bookkeeping statement so we can assert what actually ran.
+function fakeExec(seed = []) {
+  const applied = new Set(seed);
+  const ran = [];
+  const exec = async (text, params) => {
+    if (/^\s*SELECT 1 FROM public\.schema_migrations/i.test(text)) {
+      return applied.has(params[0]) ? [{ '?column?': 1 }] : [];
+    }
+    if (/^\s*INSERT INTO public\.schema_migrations/i.test(text)) { applied.add(params[0]); return []; }
+    if (/^\s*(CREATE TABLE IF NOT EXISTS public\.schema_migrations|BEGIN|COMMIT|ROLLBACK)/i.test(text)) return [];
+    ran.push(text); // the actual migration file SQL
+    return [];
+  };
+  return { exec, ran, applied };
+}
+
+test('no declared migrations → no-op, never needs a DB', async () => {
+  const mgr = createManager([{ name: 'kgva-ish' }]); // no migrations
+  const res = await runMigrations(mgr, {}); // no exec, no databaseUrl — must not throw
+  assert.deepEqual(res, { applied: [], skipped: [], pending: false });
+});
+
+test('declared migrations but no DATABASE_URL → pending, nothing applied', async () => {
+  const mgr = createManager([{ name: 'p', migrations: ['001.sql'], __dir: new URL('file:///x/') }]);
+  const warns = [];
+  const res = await runMigrations(mgr, { log: { warn: (m) => warns.push(m) } });
+  assert.equal(res.pending, true);
+  assert.deepEqual(res.skipped, ['p/001.sql']);
+  assert.equal(res.applied.length, 0);
+  assert.match(warns[0], /DATABASE_URL fehlt/);
+});
+
+test('fresh apply: real dialog migration runs once and is recorded', async () => {
+  const { loadPlugins } = await import('../src/plugin-manager.js');
+  const mgr = await loadPlugins(['dialog']); // real manifest → real 001_dialog.sql url
+  const fx = fakeExec();
+  const res = await runMigrations(mgr, { exec: fx.exec, log: {} });
+  assert.deepEqual(res.applied, ['dialog/001_dialog.sql']);
+  assert.deepEqual(res.skipped, []);
+  assert.equal(fx.ran.length, 1);
+  assert.match(fx.ran[0], /create table if not exists public\.forums/i); // the captured DDL
+  assert.equal(fx.applied.has('dialog/001_dialog.sql'), true);
+});
+
+test('idempotent: already-recorded migration is skipped, file SQL not re-run', async () => {
+  const { loadPlugins } = await import('../src/plugin-manager.js');
+  const mgr = await loadPlugins(['dialog']);
+  const fx = fakeExec(['dialog/001_dialog.sql']); // pretend already applied
+  const res = await runMigrations(mgr, { exec: fx.exec, log: {} });
+  assert.deepEqual(res.skipped, ['dialog/001_dialog.sql']);
+  assert.deepEqual(res.applied, []);
+  assert.equal(fx.ran.length, 0); // file SQL never executed again
+});
+
+test('a failing migration rolls back and surfaces the id', async () => {
+  const mgr = createManager([{ name: 'boom', migrations: ['x.sql'], __dir: new URL('file:///does-not-exist/') }]);
+  const calls = [];
+  const exec = async (text) => {
+    calls.push(text.trim().split(/\s+/).slice(0, 2).join(' '));
+    return [];
+  };
+  // readFile on the missing url throws before BEGIN; ensure the error names the id.
+  await assert.rejects(() => runMigrations(mgr, { exec, log: {} }), /boom\/x\.sql/);
+});

cms/core/api/test/plugin-manager.test.js

@@ -0,0 +1,113 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Hono } from 'hono';
+import { createManager } from '../src/plugin-manager.js';
+
+// Tiny sub-app that answers GET / with a fixed text.
+function mk(text) { const a = new Hono(); a.get('/', (c) => c.text(text)); return a; }
+
+function fixture() {
+  const state = { booted: false, published: null, previewed: null };
+  const demo = {
+    name: 'demo',
+    routes: [
+      // sub-app routes
+      { path: '/demo-pub', app: mk('pub'), public: true },
+      { path: '/demo-priv', app: mk('priv') },
+      { path: '/demo-adm', app: mk('adm'), admin: true },
+      // handler routes (method + handler)
+      { method: 'get', path: '/h-pub', handler: (c) => c.text('hpub'), public: true },
+      { method: 'post', path: '/h-priv', handler: (c) => c.text('hpriv') },
+      // per-route middleware (e.g. a rate limit)
+      {
+        method: 'post', path: '/h-limited', public: true,
+        use: [async (c, next) => (c.req.header('x-pass') ? next() : c.json({ e: 'limited' }, 429))],
+        handler: (c) => c.text('ok'),
+      },
+    ],
+    onBoot: async () => { state.booted = true; },
+    onPublish: async (_ctx, p) => { state.published = p.path; },
+    onPreview: async (_ctx, p) => { state.previewed = p.path; },
+    stats: async () => ({ widgets: 3 }),
+    migrations: ['001_demo.sql'],
+  };
+  return { demo, state };
+}
+
+// Build the same pipeline as index.js: public → requireAuth → private(+admin).
+function buildApp(m) {
+  const app = new Hono();
+  m.mountPublic(app);
+  app.use('/api/*', async (c, next) => (c.req.header('x-auth') ? next() : c.json({ error: 'no auth' }, 401)));
+  const requireAdmin = async (c, next) => (c.req.header('x-admin') ? next() : c.json({ error: 'no admin' }, 403));
+  m.mountPrivate(app, '/api', requireAdmin);
+  return app;
+}
+
+test('manager: names / has', () => {
+  const { demo } = fixture();
+  const m = createManager([demo]);
+  assert.deepEqual(m.names(), ['demo']);
+  assert.equal(m.has('demo'), true);
+  assert.equal(m.has('nope'), false);
+});
+
+test('manager: public routes reachable WITHOUT auth (sub-app + handler)', async () => {
+  const app = buildApp(createManager([fixture().demo]));
+  const sub = await app.request('/api/demo-pub');
+  assert.equal(sub.status, 200); assert.equal(await sub.text(), 'pub');
+  const h = await app.request('/api/h-pub');
+  assert.equal(h.status, 200); assert.equal(await h.text(), 'hpub');
+});
+
+test('manager: private routes require auth (sub-app + handler)', async () => {
+  const app = buildApp(createManager([fixture().demo]));
+  assert.equal((await app.request('/api/demo-priv')).status, 401);
+  assert.equal((await app.request('/api/h-priv', { method: 'POST' })).status, 401);
+  const ok = await app.request('/api/h-priv', { method: 'POST', headers: { 'x-auth': '1' } });
+  assert.equal(ok.status, 200); assert.equal(await ok.text(), 'hpriv');
+});
+
+test('manager: admin route guarded by requireAdmin', async () => {
+  const app = buildApp(createManager([fixture().demo]));
+  assert.equal((await app.request('/api/demo-adm', { headers: { 'x-auth': '1' } })).status, 403);
+  const ok = await app.request('/api/demo-adm', { headers: { 'x-auth': '1', 'x-admin': '1' } });
+  assert.equal(ok.status, 200); assert.equal(await ok.text(), 'adm');
+});
+
+test('manager: per-route use middleware runs (rate-limit style)', async () => {
+  const app = buildApp(createManager([fixture().demo]));
+  assert.equal((await app.request('/api/h-limited', { method: 'POST' })).status, 429);
+  const ok = await app.request('/api/h-limited', { method: 'POST', headers: { 'x-pass': '1' } });
+  assert.equal(ok.status, 200); assert.equal(await ok.text(), 'ok');
+});
+
+test('manager: lifecycle hooks run', async () => {
+  const { demo, state } = fixture();
+  const m = createManager([demo]);
+  await m.runBoot({});
+  await m.runPublish({}, { path: 'a.md' });
+  await m.runPreview({}, { path: 'b.md' });
+  assert.equal(state.booted, true);
+  assert.equal(state.published, 'a.md');
+  assert.equal(state.previewed, 'b.md');
+});
+
+test('manager: stats merged under plugin name', async () => {
+  const m = createManager([fixture().demo]);
+  assert.deepEqual(await m.collectStats({}), { demo: { widgets: 3 } });
+});
+
+test('manager: declared migrations surfaced', () => {
+  const m = createManager([fixture().demo]);
+  assert.deepEqual(m.migrations(), [{ plugin: 'demo', file: '001_demo.sql', url: null }]);
+});
+
+test('manager: empty plugin set is a no-op', async () => {
+  const m = createManager([]);
+  assert.deepEqual(m.names(), []);
+  assert.deepEqual(await m.collectStats({}), {});
+  assert.deepEqual(m.migrations(), []);
+  const app = buildApp(m);
+  assert.equal((await app.request('/api/anything', { headers: { 'x-auth': '1' } })).status, 404);
+});

cms/core/api/test/ratelimit.test.js

@@ -0,0 +1,44 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+const { rateLimit } = await import('../src/ratelimit.js');
+
+function fakeCtx() {
+  const headers = {};
+  return {
+    req: { header: () => undefined },
+    header: (k, v) => { headers[k] = v; },
+    json: (body, status = 200) => ({ __status: status, body }),
+    _headers: headers,
+  };
+}
+
+test('rateLimit: blockt nach Überschreiten mit 429 + Retry-After', async () => {
+  const mw = rateLimit({ max: 2, windowMs: 10_000, keyFn: () => 'fix' });
+  let calls = 0;
+  const run = async () => { const c = fakeCtx(); const r = await mw(c, async () => { calls++; }); return { c, r }; };
+
+  assert.equal((await run()).r, undefined);   // 1 → durch (next, kein Return)
+  assert.equal((await run()).r, undefined);   // 2 → durch
+  const { c, r } = await run();               // 3 → blockiert
+  assert.equal(r.__status, 429);
+  assert.ok(c._headers['Retry-After']);
+  assert.equal(calls, 2);                      // next nur zweimal aufgerufen
+});
+
+test('rateLimit: getrennte Schlüssel zählen getrennt', async () => {
+  let key = 'a';
+  const mw = rateLimit({ max: 1, windowMs: 10_000, keyFn: () => key });
+  assert.equal((await mw(fakeCtx(), async () => {})), undefined);      // a:1 ok
+  assert.equal((await mw(fakeCtx(), async () => {})).__status, 429);   // a:2 blockiert
+  key = 'b';
+  assert.equal((await mw(fakeCtx(), async () => {})), undefined);      // b:1 ok
+});
+
+test('rateLimit: Fenster läuft ab → wieder frei', async () => {
+  const mw = rateLimit({ max: 1, windowMs: 30, keyFn: () => 'win' });
+  assert.equal((await mw(fakeCtx(), async () => {})), undefined);
+  assert.equal((await mw(fakeCtx(), async () => {})).__status, 429);
+  await new Promise((r) => setTimeout(r, 40));
+  assert.equal((await mw(fakeCtx(), async () => {})), undefined);      // Fenster neu
+});

cms/core/api/test/system.test.js

@@ -0,0 +1,31 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { fileURLToPath } from 'node:url';
+
+process.env.CMS_CONFIG ||= fileURLToPath(new URL('../../examples/openbureau.config.js', import.meta.url));
+process.env.SUPABASE_URL ||= 'http://localhost';
+process.env.SUPABASE_SERVICE_KEY ||= 'x';
+process.env.JWT_SECRET ||= 'x';
+process.env.SITE_DIR ||= '/tmp/nosite';
+
+const { systemInfo } = await import('../src/routes/system.js');
+
+test('systemInfo reflects core version, plugins and content model', () => {
+  const info = systemInfo({ version: '0.6.0', hugo: '0.161.1+extended' });
+  assert.equal(info.core.name, 'openbureau-core');
+  assert.equal(info.core.version, '0.6.0');
+  assert.equal(info.site, 'openbureau');
+  assert.equal(info.auth, 'supabase'); // openbureau.config.js sets auth: 'supabase'
+  assert.equal(info.hugo, '0.161.1+extended');
+  assert.deepEqual(info.admins, ['karim@gabrielevarano.ch']);
+  // dialog plugin is active with its routes + the one migration
+  const dialog = info.plugins.find((p) => p.name === 'dialog');
+  assert.ok(dialog, 'dialog plugin listed');
+  assert.ok(dialog.routes > 0);
+  assert.equal(dialog.migrations, 1);
+  // content model surfaced from the config collections
+  assert.deepEqual(info.collections.map((c) => c.kind).sort(), ['beitrag', 'biblio', 'rubrik', 'seite']);
+  const beitrag = info.collections.find((c) => c.kind === 'beitrag');
+  assert.equal(beitrag.label, 'Beiträge');
+  assert.ok(beitrag.fields > 0);
+});

cms/core/examples/kgva.config.js

@@ -0,0 +1,46 @@
+// karimgabrielevarano.xyz — second consumer of openbureau-core.
+// No dialog plugin; a portfolio-shaped content model.
+export default {
+  site: 'kgva',
+  auth: 'local', // DB-less: file-based users + self-signed JWTs (no Supabase/Postgres)
+  admins: ['karim@gabrielevarano.ch'],
+  plugins: [],
+
+  collections: [
+    {
+      kind: 'project', label: 'Portfolio', order: 0,
+      path: 'portfolio/:slug',
+      statKey: 'projects',
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'slug', type: 'slug' },
+        { name: 'date', type: 'date' },
+        { name: 'draft', type: 'bool', default: true },
+        { name: 'thumbnail', type: 'image' },
+        { name: 'studies', type: 'string', hint: '/studies/hslu/ba/semester_05' },
+        { name: 'schools', type: 'list' },
+        { name: 'degrees', type: 'list' },
+        { name: 'semesters', type: 'list' },
+        { name: 'video', type: 'string', hint: '/media/x.mp4' },
+        { name: 'images', type: 'list', of: { src: 'image', name: 'string' } },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'page', label: 'Pages', order: 1, fallback: true,
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'description', type: 'string' },
+        { name: 'layout', type: 'string' },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'section', label: 'Sections', order: 2, index: true,
+      fields: [
+        { name: 'title', type: 'string' },
+        { name: 'description', type: 'string' },
+      ],
+    },
+  ],
+};

cms/core/examples/openbureau.config.js

@@ -0,0 +1,74 @@
+// openbureau site — reproduces the current hard-coded content model 1:1.
+// Once the engine is config-driven, openbureau consumes openbureau-core with
+// exactly this config and behaves as today.
+export default {
+  site: 'openbureau',
+  admins: ['karim@gabrielevarano.ch'],
+  plugins: ['dialog'], // comment/forum subsystem (library ↔ threads sync)
+
+  collections: [
+    {
+      kind: 'beitrag', label: 'Beiträge', order: 0,
+      path: 'archiv/:section/:slug',
+      sections: ['buerofuehrung', 'software', 'theorie'],
+      statKey: 'beitraege',
+      draftStatKey: 'entwuerfe', // Beitrag-Entwürfe als eigener Zähler (Dashboard)
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'section', type: 'select', options: ['buerofuehrung', 'software', 'theorie'] },
+        { name: 'slug', type: 'slug' },
+        { name: 'date', type: 'date' },
+        { name: 'weight', type: 'number' },
+        { name: 'color', type: 'color' },
+        { name: 'layout', type: 'select', options: ['text', 'image', 'icon'], default: 'text' },
+        { name: 'tags', type: 'list' },
+        { name: 'summary', type: 'text' },
+        { name: 'cover_image', type: 'image' },
+        { name: 'authors', type: 'list' },
+        { name: 'toc', type: 'bool' },
+        { name: 'draft', type: 'bool', default: true },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'biblio', label: 'Library', order: 1,
+      path: 'library/:slug',
+      statKey: 'library',
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'slug', type: 'slug' },
+        { name: 'date', type: 'date' },
+        { name: 'tags', type: 'list' },
+        { name: 'summary', type: 'text' },
+        { name: 'cover_image', type: 'image' },
+        { name: 'external', type: 'string' },
+        { name: 'group', type: 'string' },
+        { name: 'authors', type: 'list' },
+        { name: 'draft', type: 'bool', default: true },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'rubrik', label: 'Rubriken', order: 3, index: true,
+      statKey: 'rubriken',
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'color', type: 'color' },
+        { name: 'layout', type: 'string' },
+        { name: 'weight', type: 'number' },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'seite', label: 'Seiten', order: 2, fallback: true,
+      statKey: 'seiten',
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'layout', type: 'string' },
+        { name: 'toc', type: 'bool' },
+        { name: 'draft', type: 'bool', default: true },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+  ],
+};

cms/db/schema.sql

@@ -31,6 +31,7 @@ create index if not exists posts_section_idx on public.posts (section);
 -- RLS aktivieren; die api nutzt den Service-Key (umgeht RLS). Wenn das
 -- Frontend später direkt liest, hier gezielte Policies ergänzen.
 alter table public.posts enable row level security;
+revoke all on public.posts from anon, authenticated;
 
 -- ── Dialog / Diskussionen ───────────────────────────────────────────────
 -- Thread = Pfad des Beitrags (z.B. /library/software/stack/). Flache Wortmeldungen
@@ -46,9 +47,25 @@ create table if not exists public.comments (
   created_at    timestamptz not null default now(),
   deleted       boolean not null default false
 );
+-- Position/Rolle bei OPENBUREAU (optional, neben dem Namen angezeigt).
+alter table public.comments add column if not exists author_role text;
 create index if not exists comments_thread_idx on public.comments (thread, created_at);
 alter table public.comments enable row level security;
-grant all on public.comments to anon, authenticated, service_role;
+-- Nur die Node-API (service_role) greift auf die Tabellen zu; der Browser geht
+-- ausschliesslich über /api/*. anon/authenticated bekommen KEINE Tabellenrechte,
+-- damit das öffentlich erreichbare /rest/v1 auch bei künftigen RLS-Policies dicht
+-- bleibt (Defense-in-Depth, nicht nur "RLS ohne Policy").
+grant all on public.comments to service_role;
+revoke all on public.comments from anon, authenticated;
+
+-- Aggregat je Thread (Anzahl + letzte Aktivität). Spart der API den Full-Table-
+-- Scan + JS-Aggregation bei jedem Forum-Aufruf; Postgres zählt direkt.
+create or replace view public.comment_stats as
+  select thread, count(*)::int as count, max(created_at) as last
+  from public.comments
+  where not deleted
+  group by thread;
+grant select on public.comment_stats to service_role;
 
 -- ── Foren / Subforen ────────────────────────────────────────────────────
 -- Kategorien, in denen Threads leben. Admin-verwaltet. `kind=library` ist die
@@ -64,7 +81,8 @@ create table if not exists public.forums (
   created_at  timestamptz not null default now()
 );
 alter table public.forums enable row level security;
-grant all on public.forums to anon, authenticated, service_role;
+grant all on public.forums to service_role;
+revoke all on public.forums from anon, authenticated;
 
 -- ── Threads (Diskussionen) ──────────────────────────────────────────────
 -- key = stabiler Bezeichner, den comments.thread referenziert:
@@ -85,7 +103,8 @@ create table if not exists public.threads (
 );
 create index if not exists threads_forum_idx on public.threads (forum_id);
 alter table public.threads enable row level security;
-grant all on public.threads to anon, authenticated, service_role;
+grant all on public.threads to service_role;
+revoke all on public.threads from anon, authenticated;
 
 -- Seed-Kategorien (idempotent; im Admin umbenenn-/erweiterbar).
 insert into public.forums (slug, name, sort, kind) values

cms/db/seed-demo.sql

@@ -0,0 +1,142 @@
+-- OPENBUREAU — OPTIONALER Demo-Inhalt fürs Forum (Dialog).
+-- ─────────────────────────────────────────────────────────────────────────
+-- NICHT Teil der Migration: bewusst getrennt von schema.sql, damit die
+-- Produktion sauber bleibt. Nur bei Bedarf manuell einspielen, z.B.:
+--
+--   docker compose exec -T db \
+--     psql -U supabase_admin -d postgres < db/seed-demo.sql
+--
+-- Idempotent: feste UUIDs + ON CONFLICT DO NOTHING → mehrfaches Einspielen
+-- erzeugt keine Duplikate. Demo-Wortmeldungen haben user_id = NULL (keine
+-- echten Konten); author_name/author_role sind nur Anzeigetext.
+--
+-- Wieder entfernen: siehe DELETE-Block ganz unten (auskommentiert).
+-- ─────────────────────────────────────────────────────────────────────────
+
+-- ── Threads ───────────────────────────────────────────────────────────────
+insert into public.threads (id, forum_id, key, title, url, kind, author_name, created_at) values
+  ('a1111111-1111-1111-1111-111111111101',
+   (select id from public.forums where slug = 'allgemein'),
+   't/a1111111-1111-1111-1111-111111111101',
+   'Willkommen im OPENBUREAU-Dialog',
+   '/dialog/?thread=t%2Fa1111111-1111-1111-1111-111111111101',
+   'forum', 'Karim', now() - interval '9 days'),
+
+  ('a2222222-2222-2222-2222-222222222202',
+   (select id from public.forums where slug = 'projekte'),
+   't/a2222222-2222-2222-2222-222222222202',
+   'Altbausanierung Zürich — Materialwahl Innendämmung',
+   '/dialog/?thread=t%2Fa2222222-2222-2222-2222-222222222202',
+   'forum', 'Karim', now() - interval '6 days'),
+
+  ('a3333333-3333-3333-3333-333333333303',
+   (select id from public.forums where slug = 'technik'),
+   't/a3333333-3333-3333-3333-333333333303',
+   'Hugo-Build-Zeiten bei großen Bildmengen',
+   '/dialog/?thread=t%2Fa3333333-3333-3333-3333-333333333303',
+   'forum', 'Mara', now() - interval '3 days'),
+
+  ('a4444444-4444-4444-4444-444444444404',
+   (select id from public.forums where slug = 'off-topic'),
+   't/a4444444-4444-4444-4444-444444444404',
+   'Welches Architekturbuch hat euch geprägt?',
+   '/dialog/?thread=t%2Fa4444444-4444-4444-4444-444444444404',
+   'forum', 'Jonas', now() - interval '2 days')
+on conflict (key) do nothing;
+
+-- ── Wortmeldungen ─────────────────────────────────────────────────────────
+-- parent_id verweist auf eine andere Wortmeldung (Antwort-Bezug).
+insert into public.comments (id, thread, parent_id, author_name, author_role, body, created_at) values
+  -- Thread 1: Willkommen
+  ('c1111111-0000-0000-0000-000000000001',
+   't/a1111111-1111-1111-1111-111111111101', null, 'Karim', 'Gründer',
+   'Hallo zusammen — dieser Bereich ist für den offenen Austausch rund ums Büro: Projekte, Methoden, Werkzeuge. Lest euch ein, schreibt mit.',
+   now() - interval '9 days'),
+  ('c1111111-0000-0000-0000-000000000002',
+   't/a1111111-1111-1111-1111-111111111101',
+   'c1111111-0000-0000-0000-000000000001', 'Mara', 'Projektarchitektin',
+   'Schön, dass es losgeht. Gibt es eine Empfehlung, wie wir Projektdiskussionen von allgemeinem Plausch trennen?',
+   now() - interval '8 days'),
+  ('c1111111-0000-0000-0000-000000000003',
+   't/a1111111-1111-1111-1111-111111111101',
+   'c1111111-0000-0000-0000-000000000002', 'Karim', 'Gründer',
+   'Genau dafür gibt es die Kategorie „Projekte". „Off-Topic" ist für alles andere.',
+   now() - interval '8 days'),
+
+  -- Thread 2: Innendämmung
+  ('c2222222-0000-0000-0000-000000000001',
+   't/a2222222-2222-2222-2222-222222222202', null, 'Karim', 'Gründer',
+   'Beim Altbau an der Seestrasse steht die Innendämmung an. Kalziumsilikat oder mineralischer Dämmputz? Erfahrungen mit Feuchteverhalten?',
+   now() - interval '6 days'),
+  ('c2222222-0000-0000-0000-000000000002',
+   't/a2222222-2222-2222-2222-222222222202',
+   'c2222222-0000-0000-0000-000000000001', 'Mara', 'Projektarchitektin',
+   'Kalziumsilikat ist diffusionsoffen und kapillaraktiv — bei den Bestandswänden dort würde ich das vorziehen. Wichtig ist die Detailausbildung an den Holzbalkenköpfen.',
+   now() - interval '5 days'),
+  ('c2222222-0000-0000-0000-000000000003',
+   't/a2222222-2222-2222-2222-222222222202',
+   'c2222222-0000-0000-0000-000000000002', 'Jonas', 'Bauleiter',
+   'Plus eins für Kalziumsilikat. Ich hänge nächste Woche die hygrothermische Simulation an, dann sehen wir die Tauwasserbilanz.',
+   now() - interval '4 days'),
+
+  -- Thread 3: Hugo-Builds
+  ('c3333333-0000-0000-0000-000000000001',
+   't/a3333333-3333-3333-3333-333333333303', null, 'Mara', 'Projektarchitektin',
+   'Seit die Projektgalerien dazugekommen sind, dauert der Build spürbar länger. Hat jemand die Bildverarbeitung schon optimiert?',
+   now() - interval '3 days'),
+  ('c3333333-0000-0000-0000-000000000002',
+   't/a3333333-3333-3333-3333-333333333303',
+   'c3333333-0000-0000-0000-000000000001', 'Karim', 'Gründer',
+   'Hugo cached die Image-Resizes unter resources/. Solange der Ordner erhalten bleibt, werden nur neue Bilder neu gerechnet — das war bei uns der größte Hebel.',
+   now() - interval '2 days'),
+
+  -- Thread 4: Architekturbuch
+  ('c4444444-0000-0000-0000-000000000001',
+   't/a4444444-4444-4444-4444-444444444404', null, 'Jonas', 'Bauleiter',
+   'Bei mir war es „Atmosphären" von Peter Zumthor — schmal, aber prägend. Was hat euch geformt?',
+   now() - interval '2 days'),
+  ('c4444444-0000-0000-0000-000000000002',
+   't/a4444444-4444-4444-4444-444444444404',
+   'c4444444-0000-0000-0000-000000000001', 'Mara', 'Projektarchitektin',
+   '„Complexity and Contradiction" von Venturi — hat mein Verständnis von Fassaden komplett verschoben.',
+   now() - interval '1 day')
+on conflict (id) do nothing;
+
+-- ── Wortmeldungen auf den Musterbeiträgen (Dialog am Artikel) ─────────────
+-- thread = Beitrags-URL (Library-Beiträge werden als Threads gespiegelt).
+insert into public.comments (id, thread, parent_id, author_name, author_role, body, created_at) values
+  ('d1111111-0000-0000-0000-000000000001',
+   '/library/theorie/muster-typologie-fussnoten/', null, 'Mara', 'Projektarchitektin',
+   'Schöne Verdichtung. Würdest du Léon Krier hier dazustellen, oder ist das eine andere Debatte?',
+   now() - interval '4 days'),
+  ('d1111111-0000-0000-0000-000000000002',
+   '/library/theorie/muster-typologie-fussnoten/',
+   'd1111111-0000-0000-0000-000000000001', 'Karim', 'Gründer',
+   'Eigene Debatte — Krier zielt auf die Wiederherstellung der Stadt. Hier ging es mir nur um Typus vs. Modell.',
+   now() - interval '3 days'),
+
+  ('d2222222-0000-0000-0000-000000000001',
+   '/library/buerofuehrung/muster-offen-arbeiten/', null, 'Jonas', 'Bauleiter',
+   'Die Lizenzfrage unterschätzen viele. Gut, das einmal klar getrennt zu sehen.',
+   now() - interval '2 days'),
+
+  ('d3333333-0000-0000-0000-000000000001',
+   '/library/software/muster-werkzeugkette/', null, 'Mara', 'Projektarchitektin',
+   'Ein Befehl ist Gold wert. Läuft der Build bei euch auch im CMS-Container?',
+   now() - interval '1 day'),
+  ('d3333333-0000-0000-0000-000000000002',
+   '/library/software/muster-werkzeugkette/',
+   'd3333333-0000-0000-0000-000000000001', 'Karim', 'Gründer',
+   'Genau — der Container hat das Hugo-Binary, Publish baut public/ direkt.',
+   now() - interval '12 hours')
+on conflict (id) do nothing;
+
+-- ── Demo-Inhalt wieder entfernen (bei Bedarf auskommentieren) ──────────────
+-- delete from public.comments where id::text like 'c_______-0000-0000-0000-%';
+-- delete from public.comments where id::text like 'd_______-0000-0000-0000-%';
+-- delete from public.threads  where key in (
+--   't/a1111111-1111-1111-1111-111111111101',
+--   't/a2222222-2222-2222-2222-222222222202',
+--   't/a3333333-3333-3333-3333-333333333303',
+--   't/a4444444-4444-4444-4444-444444444404');
+-- (Musterbeitrag-Threads verschwinden mit den .md-Dateien automatisch.)

cms/docker-compose.yml

@@ -6,7 +6,10 @@
 #   2. JWT_SECRET + POSTGRES_PASSWORD setzen (openssl rand -hex 32)
 #   3. node scripts/generate-keys.mjs   → ANON_KEY + SERVICE_ROLE_KEY in .env
 #   4. SITE_URL + API_EXTERNAL_URL auf die LAN-/Domain-Adresse setzen
+#   5. kong.yml: __CORS_ORIGIN__ durch SITE_URL ersetzen (Browser-Origin)
+#   6. BIND_ADDR: 127.0.0.1 hinter Reverse-Proxy, 0.0.0.0 für LAN-Direkt
 #
+# (Das Proxmox-Script erledigt 1–6 automatisch.)
 # Dann:  docker compose up -d --build
 #
 # Abweichung von RAPPORT: realtime + storage weggelassen (nutzt das CMS nicht).
@@ -86,6 +89,10 @@ services:
       # Single-Author: Self-Signup aus. User wird per Admin-API angelegt
       # (Kommando steht im README / LXC-Output).
       GOTRUE_DISABLE_SIGNUP: "true"
+      # Brute-Force-Bremse aufs /token: das öffentliche Login läuft direkt gegen
+      # GoTrue (nicht über das Node-Rate-Limit), daher hier kappen — max. 100
+      # Token-Anfragen / 5 Min. Reichlich für einen Autor, bremst Rateversuche.
+      GOTRUE_RATE_LIMIT_TOKEN_REFRESH: "100"
       GOTRUE_JWT_ADMIN_ROLES: service_role
       GOTRUE_JWT_AUD: authenticated
       GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
@@ -129,15 +136,20 @@ services:
     volumes:
       - ./kong.yml:/var/lib/kong/kong.yml:ro
     ports:
-      - "${KONG_HTTP_PORT:-8000}:8000"
-      - "${KONG_HTTPS_PORT:-8443}:8443"
+      # Standard 127.0.0.1: nur lokal/Reverse-Proxy erreichbar. Für LAN-Direkt-
+      # zugriff ohne Proxy BIND_ADDR=0.0.0.0 in .env setzen.
+      - "${BIND_ADDR:-127.0.0.1}:${KONG_HTTP_PORT:-8000}:8000"
+      - "${BIND_ADDR:-127.0.0.1}:${KONG_HTTPS_PORT:-8443}:8443"
 
   # ════════════════════════════════════════════════════════════════════════
   # CMS — Node-API + Hugo-Binary + Admin-SPA, serviert die Site
   # ════════════════════════════════════════════════════════════════════════
   cms:
     build:
-      context: .
+      # openbureau consumes openbureau-core, vendored via git subtree at cms/core.
+      # Build context = core's root so core's own Dockerfile picks up core/admin +
+      # core/api (the generic engine), not this site's files.
+      context: ./core
       dockerfile: api/Dockerfile
       args:
         # Browser-seitig (Admin-SPA, zur Build-Zeit): öffentliche Supabase-URL.
@@ -156,8 +168,15 @@ services:
       # Server-seitig: intern über Kong, mit Service-Key.
       SUPABASE_URL: http://kong:8000
       SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
+      # Für lokale JWT-Verifikation (kein GoTrue-Roundtrip pro Request).
+      JWT_SECRET: ${JWT_SECRET}
       ADMIN_EMAILS: ${ADMIN_EMAILS:-}
       SITE_DIR: /site
+      # Tells core which content model + plugins this site has (schema-driven engine).
+      # Lives in the mounted repo (/site = repo root). DATABASE_URL is intentionally
+      # unset: the stack's `migrate` service owns the schema (db/schema.sql incl. the
+      # dialog tables), so core's plugin migration runner stays a no-op here.
+      CMS_CONFIG: /site/cms/openbureau.config.js
       PORT: 3000
       GIT_PUBLISH: ${GIT_PUBLISH:-false}
       GIT_REMOTE: ${GIT_REMOTE:-origin}
@@ -168,7 +187,8 @@ services:
       # Repo-Root: api schreibt content/ und baut public/ + preview/.
       - ..:/site
     ports:
-      - "${APP_PORT:-8080}:3000"
+      # Wie Kong: standardmäßig nur 127.0.0.1 (hinter Reverse-Proxy).
+      - "${BIND_ADDR:-127.0.0.1}:${APP_PORT:-8080}:3000"
 
 volumes:
   postgres-data:

cms/kong.yml

@@ -15,6 +15,16 @@ services:
           - /auth/v1/
     plugins:
       - name: cors
+        config:
+          # Nur die eigene Browser-Origin erlauben (nicht „*"). __CORS_ORIGIN__
+          # wird beim Provisionieren auf SITE_URL gesetzt (siehe Proxmox-Script);
+          # bei Domain/HTTPS-Wechsel hier bzw. in .env mitziehen.
+          origins:
+            - __CORS_ORIGIN__
+          methods: [GET, POST, PUT, PATCH, DELETE, OPTIONS]
+          headers: [Accept, Authorization, Content-Type, apikey, x-client-info, x-supabase-api-version]
+          credentials: false
+          max_age: 3600
 
   - name: rest-v1
     url: http://rest:3000/
@@ -25,3 +35,13 @@ services:
           - /rest/v1/
     plugins:
       - name: cors
+        config:
+          # Nur die eigene Browser-Origin erlauben (nicht „*"). __CORS_ORIGIN__
+          # wird beim Provisionieren auf SITE_URL gesetzt (siehe Proxmox-Script);
+          # bei Domain/HTTPS-Wechsel hier bzw. in .env mitziehen.
+          origins:
+            - __CORS_ORIGIN__
+          methods: [GET, POST, PUT, PATCH, DELETE, OPTIONS]
+          headers: [Accept, Authorization, Content-Type, apikey, x-client-info, x-supabase-api-version]
+          credentials: false
+          max_age: 3600

cms/openbureau.config.js

@@ -0,0 +1,75 @@
+// openbureau site config — what this site's content model + plugins are.
+// Consumed by openbureau-core (vendored at cms/core) via CMS_CONFIG. Reproduces
+// the previously hard-coded content model 1:1 (proven by core's collections test).
+export default {
+  site: 'openbureau',
+  auth: 'supabase', // GoTrue/Supabase login (the stack provides it); core default
+  admins: ['karim@gabrielevarano.ch'],
+  plugins: ['dialog'], // comment/forum subsystem (library ↔ threads sync)
+
+  collections: [
+    {
+      kind: 'beitrag', label: 'Beiträge', order: 0,
+      path: 'archiv/:section/:slug',
+      sections: ['buerofuehrung', 'software', 'theorie'],
+      statKey: 'beitraege',
+      draftStatKey: 'entwuerfe', // Beitrag-Entwürfe als eigener Zähler (Dashboard)
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'section', type: 'select', options: ['buerofuehrung', 'software', 'theorie'] },
+        { name: 'slug', type: 'slug' },
+        { name: 'date', type: 'date' },
+        { name: 'weight', type: 'number' },
+        { name: 'color', type: 'color' },
+        { name: 'layout', type: 'select', options: ['text', 'image', 'icon'], default: 'text' },
+        { name: 'tags', type: 'list' },
+        { name: 'summary', type: 'text' },
+        { name: 'cover_image', type: 'image' },
+        { name: 'authors', type: 'list' },
+        { name: 'toc', type: 'bool' },
+        { name: 'draft', type: 'bool', default: true },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'biblio', label: 'Library', order: 1,
+      path: 'library/:slug',
+      statKey: 'library',
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'slug', type: 'slug' },
+        { name: 'date', type: 'date' },
+        { name: 'tags', type: 'list' },
+        { name: 'summary', type: 'text' },
+        { name: 'cover_image', type: 'image' },
+        { name: 'external', type: 'string' },
+        { name: 'group', type: 'string' },
+        { name: 'authors', type: 'list' },
+        { name: 'draft', type: 'bool', default: true },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'rubrik', label: 'Rubriken', order: 3, index: true,
+      statKey: 'rubriken',
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'color', type: 'color' },
+        { name: 'layout', type: 'string' },
+        { name: 'weight', type: 'number' },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+    {
+      kind: 'seite', label: 'Seiten', order: 2, fallback: true,
+      statKey: 'seiten',
+      fields: [
+        { name: 'title', type: 'string', required: true },
+        { name: 'layout', type: 'string' },
+        { name: 'toc', type: 'bool' },
+        { name: 'draft', type: 'bool', default: true },
+        { name: 'body', type: 'markdown' },
+      ],
+    },
+  ],
+};

cms/proxmox/create-openbureau-lxc.sh

@@ -13,23 +13,30 @@
 set -euo pipefail
 
 ############################  CONFIG  ############################
+# Alle Werte sind per Umgebungsvariable überschreibbar, z.B.:
+#   ROOTFS_STORAGE=local-zfs HOSTNAME=openbureau-dev SITE_DOMAIN=dev.openbureau.ch \
+#   IP=192.168.1.134/24 GATEWAY=192.168.1.1 bash create-openbureau-lxc.sh
 CTID="${CTID:-$(pvesh get /cluster/nextid)}"
-HOSTNAME="openbureau"
+HOSTNAME="${HOSTNAME:-openbureau}"
 
 # Storage
-TEMPLATE_STORAGE="local"
-ROOTFS_STORAGE="local-lvm"
-DISK_GB="20"            # Supabase + CMS
+TEMPLATE_STORAGE="${TEMPLATE_STORAGE:-local}"
+ROOTFS_STORAGE="${ROOTFS_STORAGE:-local-lvm}"
+DISK_GB="${DISK_GB:-20}"            # Supabase + CMS
 
 # Ressourcen
-RAM_MB="4096"
-SWAP_MB="1024"
-CORES="2"
+RAM_MB="${RAM_MB:-4096}"
+SWAP_MB="${SWAP_MB:-1024}"
+CORES="${CORES:-2}"
 
 # Netzwerk
-BRIDGE="vmbr0"
-IP="dhcp"               # "dhcp" ODER statisch z.B. "192.168.1.50/24"
-GATEWAY=""              # nur bei statischer IP
+BRIDGE="${BRIDGE:-vmbr0}"
+IP="${IP:-dhcp}"               # "dhcp" ODER statisch z.B. "192.168.1.50/24"
+GATEWAY="${GATEWAY:-}"         # nur bei statischer IP
+
+# Öffentliche Domain hinter einem Reverse-Proxy (Caddy o.ä.) mit Pfad-Routing
+# (/auth/* + /rest/* → :8000, Rest → :8080). Leer = LAN-Direktzugriff per IP:Port.
+SITE_DOMAIN="${SITE_DOMAIN:-}"
 
 # Zugang
 SSH_PUBKEY_FILE="${SSH_PUBKEY_FILE:-$HOME/.ssh/id_ed25519.pub}"
@@ -142,24 +149,59 @@ pct exec "$CTID" -- bash -euo pipefail -c "
     sed -i \"s|^ANON_KEY=.*|ANON_KEY=\${ANON}|\" .env
     sed -i \"s|^SERVICE_ROLE_KEY=.*|SERVICE_ROLE_KEY=\${SVC}|\" .env
 
-    # URLs auf die Container-IP setzen
+    # URLs setzen — bei gesetzter SITE_DOMAIN auf die öffentliche HTTPS-Domain
+    # (Browser ruft /auth/* + /rest/* same-origin auf, der Proxy routet sie an
+    # :8000), sonst auf die Container-IP fürs LAN.
     HOSTIP=\$(hostname -I | awk '{print \$1}')
-    sed -i \"s|^SITE_URL=.*|SITE_URL=http://\${HOSTIP}:8080|\" .env
-    sed -i \"s|^API_EXTERNAL_URL=.*|API_EXTERNAL_URL=http://\${HOSTIP}:8000|\" .env
+    SITE_DOMAIN='${SITE_DOMAIN}'
+    if [ -n \"\$SITE_DOMAIN\" ]; then
+      SITE_URL=\"https://\$SITE_DOMAIN\"; API_URL=\"https://\$SITE_DOMAIN\"
+    else
+      SITE_URL=\"http://\${HOSTIP}:8080\"; API_URL=\"http://\${HOSTIP}:8000\"
+    fi
+    sed -i \"s|^SITE_URL=.*|SITE_URL=\${SITE_URL}|\" .env
+    sed -i \"s|^API_EXTERNAL_URL=.*|API_EXTERNAL_URL=\${API_URL}|\" .env
     sed -i \"s|^ADMIN_EMAILS=.*|ADMIN_EMAILS=${ADMIN_EMAIL}|\" .env
+    # Auf allen Interfaces lauschen, damit Reverse-Proxy bzw. LAN drankommen.
+    sed -i \"s|^BIND_ADDR=.*|BIND_ADDR=0.0.0.0|\" .env
+    # CORS auf die Browser-Origin (= SITE_URL) festnageln statt „*\".
+    sed -i \"s|__CORS_ORIGIN__|\${SITE_URL}|g\" kong.yml
     echo 'OK: .env generiert.'
   fi
 
+  # Der CMS-Container läuft als non-root (uid 1000). Das gemountete Repo muss
+  # ihm gehören, damit Hugo public/ bauen und content/ schreiben kann.
+  chown -R 1000:1000 '${APP_DIR}'
+
   if [ '${COMPOSE_UP}' = 'true' ]; then
     echo '→ Baue + starte Stack (dauert beim ersten Mal ein paar Minuten)…'
     docker compose up -d --build
   fi
+
+  # Tägliches DB-Backup (3:15 Uhr) — Dialog-Daten liegen NUR in Postgres.
+  printf 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n15 3 * * * root cd ${APP_DIR}/cms && bash scripts/backup-db.sh >> /var/log/openbureau-backup.log 2>&1\n' > /etc/cron.d/openbureau-backup
+  echo 'OK: tägliches DB-Backup eingerichtet (/etc/cron.d/openbureau-backup).'
 "
 
 # --- 5. Abschluss --------------------------------------------------------
 IPADDR="$(pct exec "$CTID" -- hostname -I 2>/dev/null | awk '{print $1}')"
 say "Fertig. LXC $CTID läuft${IPADDR:+ unter $IPADDR}."
 
+if [ -n "$SITE_DOMAIN" ]; then
+cat <<EOF
+
+Öffentlich: https://${SITE_DOMAIN}   (sobald der Reverse-Proxy auf ${IPADDR:-<ip>} zeigt)
+  Caddy-Block:  ${SITE_DOMAIN} {
+                  # Nur /auth/* muss public ans Gateway (Browser-Login). Daten
+                  # laufen über /api/* (Node spricht kong intern an). /rest, /storage,
+                  # /realtime NICHT exponieren — unnötige Angriffsfläche.
+                  @auth path /auth/*
+                  reverse_proxy @auth ${IPADDR:-<ip>}:8000
+                  reverse_proxy ${IPADDR:-<ip>}:8080
+                }
+EOF
+fi
+
 cat <<EOF
 
 Admin:    http://${IPADDR:-<ip>}:8080/admin/

cms/scripts/backup-db.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# OPENBUREAU — Backup der Postgres-DB.
+#
+# WICHTIG: Foren, Threads und Wortmeldungen (Dialog) leben NUR in Postgres —
+# anders als content/*.md sind sie NICHT in Git. Ohne Backup sind sie beim
+# Verlust des Volumes weg. Dieses Skript dumpt die ganze DB komprimiert weg.
+#
+# Auf dem Host/LXC im cms/-Verzeichnis ausführen (oder per Cron, siehe README):
+#   bash scripts/backup-db.sh
+#
+# Wiederherstellen:
+#   gunzip -c backups/openbureau-<TS>.sql.gz \
+#     | docker compose exec -T db psql -U supabase_admin -d postgres
+set -euo pipefail
+
+# Ins cms/-Verzeichnis (eine Ebene über scripts/).
+cd "$(dirname "$0")/.."
+
+DIR="${BACKUP_DIR:-./backups}"
+KEEP="${BACKUP_KEEP:-14}"        # wie viele Dumps behalten
+mkdir -p "$DIR"
+
+TS="$(date +%Y%m%d-%H%M%S)"
+OUT="$DIR/openbureau-$TS.sql.gz"
+
+docker compose exec -T db pg_dump -U supabase_admin -d postgres | gzip > "$OUT"
+echo "✓ Backup: $OUT ($(du -h "$OUT" | cut -f1))"
+
+# Rotation: nur die letzten $KEEP Dumps behalten.
+ls -1t "$DIR"/openbureau-*.sql.gz 2>/dev/null | tail -n +$((KEEP + 1)) | xargs -r rm -f

cms/update.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# OPENBUREAU — Update im LXC in einem Rutsch.
+# Statt `git pull` direkt: holt den Code, rendert die Deploy-Config, setzt die
+# Dateirechte für den non-root-Container und startet den Stack neu.
+#
+# Im Container (als root) ausführen:
+#   bash /opt/openbureau/cms/update.sh
+set -euo pipefail
+
+# Repo-Root = eine Ebene über diesem Skript (cms/..).
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+# Git läuft hier als root auf einem Repo, das dem Container-User (uid 1000)
+# gehört → ohne das meckert Git über „dubious ownership".
+git config --global --add safe.directory "$ROOT" 2>/dev/null || true
+
+echo "→ git pull…"
+# kong.yml wird beim Deploy lokal gerendert (CORS-Origin eingesetzt). Vor dem
+# Pull auf die versionierte Vorlage (mit __CORS_ORIGIN__) zurücksetzen, sonst
+# kollidiert der Pull mit der lokalen Änderung.
+git checkout -- cms/kong.yml 2>/dev/null || true
+git pull --ff-only
+
+cd "$ROOT/cms"
+
+# CORS-Origin aus SITE_URL (.env) in kong.yml einsetzen — eine Quelle der Wahrheit.
+ORIGIN="$(grep -E '^SITE_URL=' .env | head -1 | cut -d= -f2-)"
+if [ -n "${ORIGIN:-}" ]; then
+  sed -i "s|__CORS_ORIGIN__|${ORIGIN}|g" kong.yml
+  echo "✓ CORS-Origin gesetzt: ${ORIGIN}"
+else
+  echo "WARN: SITE_URL in .env nicht gefunden — kong.yml-Origin bleibt Platzhalter."
+fi
+
+# Der CMS-Container läuft als uid 1000 und muss das ganze Repo schreiben können
+# (Hugo baut public/, schreibt content/). git pull als root zieht neue Dateien
+# als root → hier wieder geradeziehen.
+chown -R 1000:1000 "$ROOT"
+echo "✓ Dateirechte (uid 1000) gesetzt."
+
+echo "→ docker compose up…"
+docker compose up -d --build
+# kong liest die declarative config nur beim Start — nach kong.yml-Änderung neu.
+docker compose restart kong
+echo "✓ Stack neu gestartet."
+
+# Kurzer Healthcheck (localhost im LXC, unabhängig von BIND_ADDR).
+PORT="$(grep -E '^APP_PORT=' .env | head -1 | cut -d= -f2-)"; PORT="${PORT:-8080}"
+sleep 2
+if curl -fsS -I "http://127.0.0.1:${PORT}/" >/dev/null 2>&1; then
+  echo "✓ Seite antwortet auf :${PORT}."
+else
+  echo "WARN: Seite antwortet (noch) nicht auf :${PORT} — 'docker compose ps' prüfen."
+fi

content/archiv/_index.md

@@ -0,0 +1,6 @@
+---
+title: "Archiv"
+description: "Fertige Texte des Büros, nach Thema geordnet."
+---
+
+Fertige Texte, nach Thema geordnet. Das **Journal** auf der Startseite zeigt dieselben Inhalte chronologisch.

content/archiv/buerofuehrung/muster-offen-arbeiten.md

@@ -0,0 +1,17 @@
+---
+title: "Im Offenen arbeiten"
+date: 2026-05-30
+tags: ["büroführung", "open-source", "muster"]
+summary: "Warum ein offenes Büro robuster ist — und wie Lizenzen das absichern. (Musterbeitrag mit Fußnoten.)"
+color: sakura
+layout: text
+---
+
+Offen zu arbeiten heißt nicht, alles zu verschenken. Es heißt, die Grundlagen so zu teilen, dass andere darauf aufbauen können — und dass die Arbeit den Wechsel von Werkzeugen, Mitarbeitenden und Jahren übersteht.
+
+Die rechtliche Absicherung dafür sind Lizenzen. Inhalte auf OPENBUREAU stehen unter CC BY-SA,[^ccbysa] der Code überwiegend unter AGPL oder MIT.[^agpl] Beide sorgen dafür, dass Offenheit weitergegeben wird, statt verloren zu gehen.
+
+Verwandt: Der [Werkzeug-Stack](/archiv/software/stack/) zeigt, womit wir das konkret tun.
+
+[^ccbysa]: Creative Commons, *Attribution-ShareAlike 4.0 International* (CC BY-SA 4.0), <https://creativecommons.org/licenses/by-sa/4.0/>.
+[^agpl]: Free Software Foundation, *GNU Affero General Public License v3.0*, 2007.

content/archiv/software/eigene-werkzeuge.md

@@ -14,4 +14,4 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor i
 
 Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
 
-Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet — [Werkzeuge](/library/werkzeuge).
+Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet — [Werkzeuge](/archiv/werkzeuge).

content/archiv/software/muster-werkzeugkette.md

@@ -0,0 +1,21 @@
+---
+title: "Die Werkzeugkette"
+date: 2026-06-01
+tags: ["software", "werkzeuge", "muster"]
+summary: "Wie DOSSIER, RAPPORT und die Site zusammenspielen. (Musterbeitrag mit Fußnoten und Code.)"
+color: yuyake
+layout: text
+---
+
+Die Werkzeuge des Büros sind keine Inseln, sondern eine Kette: [DOSSIER](/archiv/software/dossier/) hält die Projektdaten, [RAPPORT](/archiv/software/rapport/) erzeugt Berichte daraus, und diese Site veröffentlicht, was öffentlich sein soll.
+
+Der Build ist bewusst banal — ein Befehl:[^hugo]
+
+```sh
+hugo --minify --destination public
+```
+
+Alles dateibasiert, alles versioniert. Wer den Stand von gestern braucht, fragt Git, nicht ein Backup.[^git]
+
+[^hugo]: Hugo, *The world's fastest framework for building websites*, <https://gohugo.io>.
+[^git]: Versionierung ersetzt kein Backup — aber sie macht jede Änderung nachvollziehbar; siehe „Verlauf" unter jedem Beitrag.

content/archiv/software/proxmox-schritt-fuer-schritt.md

@@ -0,0 +1,118 @@
+---
+title: "Proxmox, Schritt für Schritt"
+date: 2026-06-02
+tags: ["software", "proxmox", "self-hosting", "anleitung", "lxc"]
+summary: "Wie aus einer gebrauchten Kiste die Infrastruktur eines Architekturbüros wird — mit den Skripten, die einen Dienst in Minuten aufstellen."
+color: kusa
+layout: text
+---
+
+Die Kiste aus dem [ersten Teil](/archiv/software/server-im-eigenen-haus/) muss man nicht streicheln können, um sie zu verstehen. Es genügt ein Bild: Proxmox macht aus einem Rechner ein Mehrfamilienhaus. Das Haus ist die Maschine, die Wohnungen sind die Container, und in jeder Wohnung lebt genau ein Dienst — die Website, die Zeiterfassung, der Dateispeicher. Niemand stört den anderen, jeder hat seine eigene Tür, und zieht eine Partei aus, bleiben die übrigen, wo sie sind.
+
+Dieser Text zeigt, wie man das Haus baut und die erste Wohnung bezieht. Er setzt keine Erfahrung mit Servern voraus, nur die Bereitschaft, einen Befehl abzutippen und zu lesen, was er antwortet.
+
+## Das Fundament
+
+Proxmox VE ist im Kern ein Debian-Linux mit einer Weboberfläche und der Fähigkeit, zweierlei Sorten Wohnungen zu vermieten: vollwertige virtuelle Maschinen und — das ist unser Fall — Linux-Container, sogenannte LXC. Ein Container teilt sich den Kern des Wirts und ist deshalb sparsam: Vier Gigabyte Arbeitsspeicher reichen für einen ausgewachsenen Dienst, ein Dutzend davon laufen auf gewöhnlicher Bürohardware.
+
+Installiert wird Proxmox einmalig vom USB-Stick, so wie man ein Betriebssystem installiert. Das ist gut dokumentiert und hier nicht das Thema. Ab dem Moment, in dem die Weboberfläche unter `https://<ip>:8006` erscheint, beginnt der interessante Teil.
+
+## Das Muster: ein Container, ein Dienst, ein Befehl
+
+Wir richten keinen Dienst von Hand ein. Jeder Handgriff, den man zweimal macht, gehört in ein Skript — schon weil man ihn sonst beim Wiederaufsetzen vergisst. Unser Muster, von Dienst zu Dienst gleich, lautet:
+
+1. einen **unprivilegierten** LXC anlegen (er darf weniger, also kann weniger schiefgehen),
+2. ihn so einstellen, dass **Docker** darin läuft (`nesting` und `keyctl`),
+3. den Dienst als **Docker-Compose-Stack** hineinstellen,
+4. alle **Geheimnisse automatisch erzeugen** lassen, nichts von Hand eintippen,
+5. ein **Backup** einrichten, bevor überhaupt Daten da sind.
+
+Das ist die ganze Liturgie. Wer sie einmal in ein Skript gegossen hat, stellt den nächsten Dienst hin, indem er das Skript ruft.
+
+## Die erste Wohnung: unser CMS
+
+Diese Website ist das Musterbeispiel. Ein einziger Befehl, abgesetzt auf dem Proxmox-Wirt als `root`, baut den ganzen Container — Docker, das Repository, sämtliche Schlüssel, der laufende Stack:
+
+```bash
+bash <(curl -fsSL https://git.kgva.ch/karim/OPENBUREAU/raw/branch/main/cms/proxmox/create-openbureau-lxc.sh)
+```
+
+Das Skript fragt nur nach Speicherort, Netzwerkbrücke und IP — Enter übernimmt je den Vorschlag — und ist nach wenigen Minuten fertig. Am Ende nennt es die Adressen: den Editor unter `…:8080/admin/`, die Website unter `…:8080/`.
+
+Spannend ist nicht der Einzeiler, sondern was er tut. Das [vollständige Skript](https://git.kgva.ch/karim/OPENBUREAU/src/branch/main/cms/proxmox/create-openbureau-lxc.sh) liest sich von oben nach unten wie ein Protokoll. Den Container anlegen, mit den zwei Schaltern, die Docker erlauben:
+
+```bash
+pct create "$CTID" "$TEMPLATE_REF" \
+  --hostname openbureau \
+  --cores 2 --memory 4096 --swap 1024 \
+  --rootfs "local-lvm:20" \
+  --net0 "name=eth0,bridge=vmbr0,ip=dhcp" \
+  --unprivileged 1 \
+  --features "nesting=1,keyctl=1" \
+  --onboot 1
+```
+
+Dann, im Container, Docker installieren, das Repository ziehen und — der Teil, der einem die durchwachte Nacht erspart — die Geheimnisse erzeugen, statt sie von Hand zu setzen:
+
+```bash
+curl -fsSL https://get.docker.com | sh
+systemctl enable --now docker
+git clone https://git.kgva.ch/karim/OPENBUREAU.git /opt/openbureau
+
+cd /opt/openbureau/cms
+cp .env.example .env
+sed -i "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=$(openssl rand -hex 32)|" .env
+sed -i "s|^JWT_SECRET=.*|JWT_SECRET=$(openssl rand -hex 32)|"             .env
+docker compose up -d --build
+```
+
+Und schliesslich, noch bevor der erste Beitrag geschrieben ist, das tägliche Backup — denn das Forum lebt allein in der Datenbank, nicht im Git:
+
+```bash
+printf '15 3 * * * root cd /opt/openbureau/cms && bash scripts/backup-db.sh\n' \
+  > /etc/cron.d/openbureau-backup
+```
+
+Kein Schritt davon ist klug; jeder ist nur aufgeschrieben. Das ist der ganze Trick.
+
+## Ein Menü statt Handarbeit
+
+Weil das Muster sich von Dienst zu Dienst wiederholt, haben wir es ein einziges Mal in ein Installationsskript gegossen. Es ruft sich genauso wie das CMS-Skript — ein Einzeiler auf dem Proxmox-Wirt, als `root` —, nur legt es kein bestimmtes Programm fest, sondern fragt, was man haben will:
+
+```bash
+bash <(curl -fsSL https://git.kgva.ch/karim/OPENBUREAU/raw/branch/main/proxmox/install.sh)
+```
+
+Zuerst fragt es nicht nach Technik, sondern nach dem Vorhaben: ein ganzes Büro einrichten, bloss Office 365 und die Synology ersetzen, nur die öffentliche Website — oder, für jene, die genau wissen, was sie wollen, einzeln auswählen. Aus der Antwort leitet das Skript ab, welche Container es braucht, und baut sie der Reihe nach. Jeder bekommt seine eigene Wohnung; für jede erledigt das Skript dasselbe, was oben Schritt für Schritt stand: Template holen, unprivilegierten Container anlegen, Docker hineinlegen, den Dienst starten.
+
+Wer das Menü überspringen will, hängt den gewünschten Dienst direkt an:
+
+```bash
+… install.sh nextcloud                      # nur Nextcloud
+… install.sh empty dateien 200 8192         # leerer Docker-LXC, 200 GB / 8 GB RAM
+… install.sh git git.kgva.ch/karim/RAPPORT-SERVER.git rapport
+```
+
+Hinter dem Menü steckt keine grosse Maschine, sondern ein Bündel kleiner, eigenständiger Skripte — eines pro Dienst. Die Suite ist nur der Dialog, der sie der Reihe nach aufruft. Wer das Menü gar nicht braucht, lädt das einzelne Skript direkt:
+
+```bash
+bash <(curl -fsSL …/proxmox/nextcloud-lxc.sh)        # 500 GB / 8 GB RAM
+bash <(curl -fsSL …/proxmox/empty-lxc.sh) dateien 200 8192
+bash <(curl -fsSL …/proxmox/git-compose-lxc.sh) git.kgva.ch/karim/RAPPORT-SERVER.git rapport
+```
+
+Jedes dieser Skripte ist in sich geschlossen und tut, was oben Schritt für Schritt stand: Template holen, unprivilegierten Container anlegen, Docker hineinlegen, den Dienst starten. Genau diese Wiederholbarkeit ist der Sinn der Übung — ein Dienst, den man nicht mit einem Befehl neu aufsetzen kann, ist ein Dienst, vor dem man sich beim nächsten Mal fürchtet.
+
+## Office 365 und die Synology ersetzen: Nextcloud
+
+Der grösste Brocken verdient einen eigenen Blick, weil er am meisten ersetzt. [Nextcloud](https://nextcloud.com) übernimmt in einem Aufwasch, wofür sonst zwei Abos und eine NAS herhalten: die Dateiablage mit Synchronisation auf alle Geräte — das OneDrive- und Synology-Drive-Erbe —, gemeinsame Kalender und Kontakte, dazu über das eingebaute Office das Bearbeiten von Dokumenten und Tabellen im Browser, zu zweit am selben Text.
+
+Im Menü ist es ein Haken, von Hand der Befehl oben. Was dann läuft, ist die offizielle All-in-One-Variante: ein verwalteter Container, der die übrigen selbst aufsetzt. Den Rest erledigt die Weboberfläche unter Port 8080 — sie vergibt das Admin-Passwort, fragt die Domain ab und startet die eigentlichen Dienste. Ohne eigene Domain erreicht man das Ganze vorerst im lokalen Netz; für den Zugriff von aussen kommt später ein Reverse-Proxy davor, dasselbe Prinzip, das auch unser CMS hinter TLS bringt.
+
+Damit ist die Rechnung geschlossen: Mail, Kalender, Kontakte, Dateien, gemeinsame Dokumente — alles, wofür das Büro bisher Monat für Monat pro Kopf bezahlt hat, läuft im Schrank. Und unsere eigenen Werkzeuge, RAPPORT und DOSSIER, ziehen über denselben Git-Eintrag im Menü nach, weil sie demselben Muster folgen wie alles andere.
+
+## Das Backup ist kein Anhang
+
+Ein Satz zum Schluss, der eigentlich an den Anfang gehört. Selbst zu hosten heisst, selbst für die Sicherung geradezustehen. Zweierlei greift bei uns ineinander. Innerhalb jedes Dienstes sichert ein nächtlicher cron-Lauf die Datenbank weg — bei dieser Website das Forum, bei Nextcloud die Metadaten. Und für die Container als Ganzes nimmt der **Proxmox Backup Server** allabendlich einen Schnappschuss, aus dem sich eine ganze Wohnung in Minuten wiederherstellen lässt, sollte sie einmal abbrennen.
+
+Ein Backup, das man nie zurückgespielt hat, ist eine Hoffnung, kein Backup. Darum gehört der erste Wiederherstellungs-Versuch an den Tag, an dem der Dienst aufgesetzt wird — nicht an den Tag, an dem man ihn braucht.

content/archiv/software/server-im-eigenen-haus.md

@@ -0,0 +1,36 @@
+---
+title: "Server im eigenen Haus"
+date: 2026-06-02
+tags: ["software", "proxmox", "self-hosting", "infrastruktur"]
+summary: "Warum unsere Dienste auf einer eigenen Kiste laufen statt bei Microsoft, Google oder Synology — und was das mit Architektur zu tun hat."
+color: yuyake
+layout: text
+---
+
+Im Schrank neben dem Plotter steht jetzt eine Kiste. Kein schönes Gerät, ein ausgemusterter Bürorechner mit zu vielen Lüftern, der leise vor sich hin rauscht. Auf ihm liegt, was sonst über ein halbes Dutzend Abonnements verteilt wäre: die Korrespondenz, die Pläne, die Zeiterfassung, diese Website. Das Büro hat seine Daten nach Hause geholt.
+
+Lange war das anders, und lange fiel es nicht auf. Ein Architekturbüro produziert Daten, bevor es das erste Gebäude produziert — Wettbewerbsbeiträge, Pläne in dreissig Revisionen, Honorarabrechnungen, die Korrespondenz mit Bauherrschaft und Amt. Dieser Bestand wächst still, und ebenso still ist er in die Cloud gewandert. Microsoft 365 für Mail und Dokumente, OneDrive oder die Synology im Keller für die Dateien, ein gemietetes CRM für die Adressen. Jedes Stück für sich vernünftig, zusammen ein Büro, dessen Substanz auf fremden Servern liegt, zu Bedingungen, die ein anderer schreibt.
+
+Das funktioniert tadellos. Es ist bequem. Und es heisst, dass das Gedächtnis des Büros zur Miete wohnt.
+
+## Die Praxis besitzt ihre Werkzeuge
+
+Dass wir das umdrehen, ist keine Prinzipienreiterei, sondern eine Konsequenz aus dem [Manifest](/manifest/): Ein Büro offen zu führen heisst auch, die eigenen Werkzeuge zu besitzen — so wie ein Schreiner seine Hobel besitzt und nicht pro Span bezahlt. Wer die Werkzeuge mietet, mietet am Ende die eigene Arbeitsweise.
+
+Der Hobel ist in diesem Fall die Kiste im Schrank. Darauf läuft Proxmox, eine quelloffene Software, die aus einem gewöhnlichen Rechner viele kleine, sauber getrennte Maschinen macht. In jeder steckt ein Dienst: diese Website samt dem Editor, mit dem dieser Text geschrieben wurde; RAPPORT, unsere Zeiterfassung; DOSSIER, die Projektablage; der Dateispeicher, der die Synology ablöst; Kalender, Kontakte, Mail. Alles offen, alles auf den eigenen Platten. Was vorher Monat für Monat pro Kopf abgebucht wurde, deckt die gebrauchte Hardware in unter einem Jahr.
+
+## Was das mit Architektur zu tun hat
+
+Mehr, als es zunächst scheint. Wo die Daten einer Bauherrschaft liegen, ist keine Geschmacksfrage, sondern eine des Anstands und des Datenschutzes. Eine Maschine im eigenen Haus beantwortet die Frage, wo die anvertrauten Unterlagen sind, mit einem Fingerzeig auf den Schrank — nicht mit einem Verweis auf Rechenzentren in einer anderen Rechtsordnung.
+
+Dazu kommt die schlichte Unkündbarkeit. Verdoppelt ein Anbieter den Preis, streicht eine Funktion oder stellt das Produkt ein, ist das sein gutes Recht; man steht daneben und zahlt. Bei uns gibt es nichts, das gekündigt werden kann. Die Formate sind offen — die Texte dieser Bibliothek etwa sind schlichte Textdateien, lesbar auch dann, wenn unser ganzer Apparat einmal verschwindet.
+
+Und schliesslich behandelt ein offenes Büro seine Infrastruktur wie einen Entwurf: Man versteht sie, ändert sie, dokumentiert sie. Dieser Aufbau ist deshalb kein Betriebsgeheimnis, sondern steht [unter freier Lizenz](/lizenz/) offen. Wer sein Büro ähnlich einrichten will, kopiert unsere Skripte und macht weiter.
+
+## Der Preis der Selbstverständlichkeit
+
+Bleibt die unbequeme Seite, und sie gehört in jeden ehrlichen Text dieser Art: Man wird sein eigener Hauswart. Backups laufen nicht mehr von allein, Aktualisierungen muss jemand einspielen, und fällt der Strom, klingelt kein Support.
+
+Tragbar finden wir das aus zwei Gründen. Der Aufwand ist kleiner, als er klingt, sobald die Handgriffe automatisiert sind — einen neuen Dienst aufzusetzen ist bei uns ein einziger Befehl und kein verlorener Nachmittag. Und die Kontrolle ist den Rest wert: Lieber für ein Backup geradestehen, das man versteht, als sich auf eines verlassen, das man nie gesehen hat.
+
+Wie die Kiste im Schrank konkret eingerichtet ist — die Maschine, die Container, die Befehle, mit denen ein Dienst in Minuten steht — steht im zweiten Teil: [Proxmox, Schritt für Schritt](/archiv/software/proxmox-schritt-fuer-schritt/).

content/archiv/software/stack.md

@@ -28,7 +28,7 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor i
 
 ## Lorem Ipsum IV
 
-- **[DOSSIER](/library/software/dossier/)** — lorem ipsum.
-- **[RAPPORT](/library/software/rapport/)** — dolor sit amet.
+- **[DOSSIER](/archiv/software/dossier/)** — lorem ipsum.
+- **[RAPPORT](/archiv/software/rapport/)** — dolor sit amet.
 
 — sed ut perspiciatis unde omnis iste natus error sit voluptatem.

content/archiv/theorie/muster-typologie-fussnoten.md

@@ -0,0 +1,18 @@
+---
+title: "Typus und Modell"
+date: 2026-05-28
+tags: ["theorie", "typologie", "muster"]
+summary: "Eine kurze Unterscheidung — und warum sie fürs Entwerfen praktisch ist. (Musterbeitrag mit Fußnoten.)"
+color: kusa
+layout: text
+---
+
+Quatremère de Quincy trennte im frühen 19. Jahrhundert *Typus* und *Modell*: Das Modell ist die exakte Vorlage zum Kopieren, der Typus dagegen ein Prinzip, das viele verschiedene Werke begründen kann.[^quatremere]
+
+Rafael Moneo griff diese Idee 1978 wieder auf und machte sie für die Praxis brauchbar — der Typus ist kein Käfig, sondern ein Ausgangspunkt, gegen den man entwirft.[^moneo] Aldo Rossi schließlich verband den Typus mit der Stadt: als dauerhaftes Element, das den Wandel überdauert.[^rossi]
+
+Fürs Büro heißt das konkret: Wer den Typus einer Aufgabe versteht, entwirft nicht aus dem Nichts, sondern variiert bewusst. Das spart Zeit und macht Entscheidungen begründbar.
+
+[^quatremere]: Antoine-Chrysostome Quatremère de Quincy, *Encyclopédie méthodique. Architecture*, Bd. 3, Paris 1825, Stichwort „Type".
+[^moneo]: Rafael Moneo, „On Typology", in: *Oppositions* 13 (1978), S. 22–45.
+[^rossi]: Aldo Rossi, *L'architettura della città*, Padua 1966.

content/impressum.md

@@ -0,0 +1,45 @@
+---
+title: "Impressum"
+toc: false
+showreadingtime: false
+aliases:
+  - /datenschutz/
+---
+
+## Kontakt
+
+[karim@gabrielevarano.ch](mailto:karim@gabrielevarano.ch)
+
+Oder direkt im [Dialog](/dialog/).
+
+## Verantwortlich
+
+Karim Varano\
+Fluhmühlerain 1\
+6015 Luzern
+
+Privatperson
+
+## Datenschutz
+
+OPENBUREAU ist selbst-gehostet — ohne Werbung, ohne Tracker, ohne Analyse-Dienste Dritter. So wenig Daten wie möglich zu erheben, ist Teil der Idee.
+
+### Beim Besuch der Seite
+
+Beim Aufruf werden technische Zugriffsdaten (IP-Adresse, Zeitpunkt, aufgerufene Seite, Browsertyp) kurzzeitig in Server-Logs erfasst — ausschließlich für Betrieb und Sicherheit. Diese Daten werden nicht mit anderen Quellen zusammengeführt, nicht für Werbung verwendet und nicht an Dritte weitergegeben.
+
+Es kommen **keine** Tracking-Cookies, **keine** Analyse-Werkzeuge (etwa Google Analytics) und **keine** Werbenetzwerke zum Einsatz.
+
+### Dialog (Mitschreiben)
+
+Lesen ist anonym. Wer im [Dialog](/dialog/) mitschreibt, legt ein Konto an: dafür werden eine E-Mail-Adresse und ein angezeigter Name gespeichert. Deine Wortmeldungen erscheinen mit diesem Namen öffentlich. Nach dem Login wird ein Sitzungs-Token lokal in deinem Browser (localStorage) abgelegt — kein serverseitiges Tracking.
+
+Diese Daten liegen auf eigener Infrastruktur in Luzern (self-hosted) und werden nicht an Dritte weitergegeben.
+
+### Deine Rechte
+
+Nach dem Schweizer Datenschutzgesetz (revDSG) hast du das Recht auf Auskunft, Berichtigung und Löschung deiner Daten — eine kurze Mail genügt. Beschwerden kannst du beim Eidgenössischen Datenschutz- und Öffentlichkeitsbeauftragten (EDÖB) einreichen.
+
+### Offenheit
+
+Die Seite ist quelloffen; der Code ist einsehbar. Zu Lizenzen und Technik siehe [Colophon](/colophon/).

content/library/_index.md

@@ -1,7 +1,6 @@
 ---
 title: "Library"
-description: "Die Bibliothek von OPENBUREAU — Texte, Notizen, Recherchen."
+summary: "Notizen zu Abläufen, Begriffen und Werkzeugen des Büros."
 ---
 
-Die Library ist die Sammlung. Alles, was gelesen und geschrieben wird, lebt hier.
-Texte werden thematisch organisiert; das **Journal** auf der Startseite zeigt dieselben Inhalte chronologisch.
+Notizen zu Abläufen, Begriffen und Werkzeugen aus dem Büroalltag. Fertige Texte stehen im [Archiv](/archiv/). Ergänzungen im CMS oder direkt im Repository.

content/library/dateiablage.md

@@ -0,0 +1,25 @@
+---
+title: "Dateiablage & Benennung"
+group: "Konventionen"
+summary: "Wie Projektdateien heissen, damit man sie in fünf Jahren noch findet."
+toc: true
+---
+
+Eine Konvention ist nur dann eine, wenn sich alle daran halten. Dies ist ein Vorschlag, kein Gesetz — verbessern erwünscht.
+
+## Projektordner
+
+Jedes Projekt liegt unter `Projekte/JJJJ_Nummer_Kurzname/`, z. B. `2026_014_Mehrfamilienhaus-Seeblick/`. Das Jahr vorne sortiert chronologisch, die Nummer ist eindeutig, der Kurzname macht es lesbar.
+
+## Dateinamen
+
+`JJMMTT_Projekt_Inhalt_vNN` — Datum zuerst (sortiert sich selbst), dann was es ist, dann die Version:
+
+- `260604_Seeblick_Grundriss-EG_v03.pdf`
+- `260604_Seeblick_Kostenschaetzung_v01.xlsx`
+
+Keine Umlaute, keine Leerzeichen, keine Sonderzeichen — Bindestrich trennt Wörter, Unterstrich trennt Felder.
+
+## Versionen
+
+`vNN` zählt hoch, nichts wird überschrieben. Die jeweils gültige Fassung bekommt keinen Sonderstatus im Namen — das erledigt das Datum. Wer mit Git arbeitet, lässt die Versionsnummer weg und vertraut der Historie.

content/library/typus.md

@@ -0,0 +1,14 @@
+---
+title: "Typus"
+group: "Begriffe"
+summary: "Ein Prinzip, das viele Werke begründet — nicht die Vorlage zum Kopieren."
+---
+
+Der **Typus** ist nicht das fertige Vorbild, sondern das zugrunde liegende Prinzip einer Bauaufgabe: das, was eine Markthalle zur Markthalle macht, unabhängig von Ort, Material und Epoche. Vom *Modell* unterscheidet er sich darin, dass man ihn nicht kopiert, sondern gegen ihn entwirft.[^quatremere]
+
+Fürs Büro ist der Typus ein Werkzeug der Ökonomie: Wer den Typus einer Aufgabe kennt, beginnt nicht bei null, sondern variiert bewusst — und kann die eigenen Entscheidungen begründen.[^moneo]
+
+Ausführlicher im Archiv: [Typus und Modell](/archiv/theorie/muster-typologie-fussnoten/).
+
+[^quatremere]: Antoine-Chrysostome Quatremère de Quincy, *Encyclopédie méthodique. Architecture*, Bd. 3, Paris 1825, Stichwort „Type".
+[^moneo]: Rafael Moneo, „On Typology", in: *Oppositions* 13 (1978), S. 22–45.

content/library/wie-die-library-funktioniert.md

@@ -0,0 +1,24 @@
+---
+title: "Wie die Library funktioniert"
+group: "Werkstatt"
+summary: "Kleine Seiten, klare Titel, viele Verweise."
+toc: true
+---
+
+Die Library ist kein Lexikon, das jemand fertigstellt, sondern ein gemeinsames Gedächtnis, das beim Arbeiten entsteht. Ein paar Konventionen halten sie übersichtlich.
+
+## Eine Seite, ein Begriff
+
+Lieber viele kleine Seiten als wenige grosse. Eine Seite behandelt einen Begriff, einen Handgriff, eine Entscheidung. Passt etwas nicht mehr auf eine Bildschirmseite, wird es meist zwei Themen sein.
+
+## Verweise
+
+Seiten verweisen mit gewöhnlichen Markdown-Links aufeinander — `[Typus](/library/typus/)` — und gerne auch ins [Archiv](/archiv/), wenn ein Gedanke dort ausführlicher steht. Verlinken ist die eigentliche Arbeit: Eine Notiz, auf die nichts zeigt, findet niemand.
+
+## Gruppen
+
+Das Feld `group` im Frontmatter sortiert eine Seite in einen Bereich der Übersicht — z. B. `group: "Begriffe"`. Seiten ohne Gruppe landen unter „Allgemein". Mehr Struktur braucht es selten.
+
+## Bearbeiten
+
+Jede Seite hat unten einen **bearbeiten**-Link, der direkt ins Repository führt. Wer lieber im Redaktions-Editor arbeitet, legt eine Seite vom Typ *Library* an und füllt Titel, Gruppe und Text.

content/lizenz/_index.md

@@ -0,0 +1,11 @@
+---
+title: "Lizenzen"
+description: "Unter welchen Lizenzen OPENBUREAU steht."
+toc: false
+showreadingtime: false
+---
+
+OPENBUREAU ist komplett offen lizenziert:
+
+- **Code** — [GNU AGPL v3.0](/lizenz/agpl-3.0/)
+- **Inhalte (Texte, Bilder)** — [CC BY-SA 4.0](/lizenz/cc-by-sa-4.0/)

content/lizenz/agpl-3.0.md

@@ -0,0 +1,673 @@
+---
+title: "GNU AGPL v3.0"
+description: "Lizenz des OPENBUREAU-Codes."
+toc: false
+showreadingtime: false
+---
+
+Der **Code** von OPENBUREAU steht unter der GNU Affero General Public License, Version 3.
+
+```text
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
+
+```