chore(release): 1.3.2

Hotfix release closing #108 — the dashboard glucose tiles rendered the
raw i18n key, and the bug-report screenshot upload promised a feature
that never reached the published GitHub issue.

.env.example

@@ -1,37 +1,106 @@
-# Database
-DATABASE_URL="postgresql://healthlog:healthlog@localhost:5432/healthlog?schema=public"
+# =============================================================================
+# HealthLog — Environment Configuration
+# =============================================================================
+# Copy this file to .env and fill in the values.
+#   $ cp .env.example .env
+#
+# Required variables: DATABASE_URL or POSTGRES_PASSWORD, SESSION_SECRET,
+#                     ENCRYPTION_KEY, API_TOKEN_HMAC_KEY
+#
+# Generate the three secrets with:
+#   $ openssl rand -hex 32                     # any UNIX shell
+#   $ node -e 'console.log(require("crypto").randomBytes(32).toString("hex"))'
+#
+# All secrets must be 64-character hex strings (= 32 bytes).
+# =============================================================================
 
-# App
+
+# -----------------------------------------------------------------------------
+# Database
+# -----------------------------------------------------------------------------
+# When using docker-compose.yml: the app container reaches Postgres via the
+# service name "db", so the hostname is "db" — NOT "localhost".
+# When developing without Docker (`pnpm dev` against a host-installed Postgres):
+# change the hostname to "localhost" and adjust the credentials.
+DATABASE_URL="postgresql://healthlog:CHANGE-ME@db:5432/healthlog?schema=public"
+
+# Postgres password — used both by the db service AND by DATABASE_URL above.
+# Pick a strong random password, e.g. `openssl rand -base64 24`.
+POSTGRES_PASSWORD="CHANGE-ME"
+
+
+# -----------------------------------------------------------------------------
+# App URL
+# -----------------------------------------------------------------------------
+# The public URL where users reach the app. Behind a reverse proxy with TLS,
+# this looks like https://healthlog.example.com. For local dev, leave default.
 NEXT_PUBLIC_APP_URL="http://localhost:3000"
 APP_URL="http://localhost:3000"
+
+# Node environment: "development" for `pnpm dev`, "production" for Docker.
 NODE_ENV="development"
 
-# Session
-SESSION_SECRET="change-me-to-a-random-64-char-hex-string"
 
-# Encryption (for tokens, sensitive notes)
-ENCRYPTION_KEY="change-me-to-a-random-64-char-hex-string"
+# -----------------------------------------------------------------------------
+# Required Secrets — generate with `openssl rand -hex 32`
+# -----------------------------------------------------------------------------
+# Signs session cookies. Rotating it logs out everyone.
+SESSION_SECRET="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 
-# HMAC key for API token hashing
-API_TOKEN_HMAC_KEY="change-me-to-a-random-64-char-hex-string"
+# AES-256-GCM key for encrypting Withings tokens, GitHub PATs, AI provider
+# keys, and VAPID private keys at rest. Rotate carefully — old ciphertexts
+# need re-encryption.
+ENCRYPTION_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 
-# Withings OAuth (M5)
+# HMAC-SHA256 key for hashing external-API Bearer tokens before storing them
+# in the database. Rotating it invalidates all issued tokens.
+API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
+
+
+# -----------------------------------------------------------------------------
+# Withings OAuth (optional — for automatic scale/BP/activity sync)
+# -----------------------------------------------------------------------------
+# Register an app at https://developer.withings.com/ and paste the credentials
+# here. Per-user OAuth credentials can also be configured in Settings.
 # WITHINGS_CLIENT_ID=""
 # WITHINGS_CLIENT_SECRET=""
-# WITHINGS_REDIRECT_URI=""
-# WITHINGS_WEBHOOK_SECRET=""  # random secret for webhook callback URL hardening
+# WITHINGS_REDIRECT_URI="https://healthlog.example.com/api/withings/callback"
+# WITHINGS_WEBHOOK_SECRET=""  # any random string — used to harden the webhook URL
 
-# Telegram webhook hardening (optional but recommended)
+
+# -----------------------------------------------------------------------------
+# Telegram (optional — webhook hardening)
+# -----------------------------------------------------------------------------
+# Set to verify incoming Telegram updates. The bot token itself is configured
+# per-user in Settings (encrypted at rest).
 # TELEGRAM_WEBHOOK_SECRET=""
 
-# OpenAI (optional, user-provided keys stored encrypted)
-# No server-side key needed - users bring their own
 
-# Structured Logging (Wide Events)
-# LOG_LEVEL="info"                    # debug | info | warn | error
-# LOG_SAMPLE_RATE="1.0"              # 0.0–1.0, fraction of successful requests to log
-# LOG_SLOW_THRESHOLD_MS="3000"       # Requests slower than this are always logged
-# LOG_INCLUDE_STACK="true"           # Include stack traces in error events
-# LOKI_ENDPOINT=""                   # Optional: Loki Push API (e.g. http://loki:3100)
-# LOKI_USERNAME=""                   # Optional: Loki basic auth username
-# LOKI_PASSWORD=""                   # Optional: Loki basic auth password
+# -----------------------------------------------------------------------------
+# AI Provider (optional)
+# -----------------------------------------------------------------------------
+# Users bring their own API keys via Settings. No server-side key needed by
+# default. The admin can configure a fallback key in the Admin Panel.
+
+
+# -----------------------------------------------------------------------------
+# Structured Logging — Wide Events (optional, sensible defaults)
+# -----------------------------------------------------------------------------
+# Levels: debug | info | warn | error
+# LOG_LEVEL="info"
+
+# Sample rate for successful requests (0.0 = sample nothing, 1.0 = log all).
+# Errors and slow requests are ALWAYS logged regardless of this setting.
+# LOG_SAMPLE_RATE="1.0"
+
+# Slow-request threshold in milliseconds — anything slower is always kept.
+# LOG_SLOW_THRESHOLD_MS="3000"
+
+# Include stack traces on error events. Disable in environments where logs
+# leave the host unencrypted.
+# LOG_INCLUDE_STACK="true"
+
+# Optional: ship Wide Events to Loki. Leave blank for stdout-only logging.
+# LOKI_ENDPOINT="http://loki:3100"
+# LOKI_USERNAME=""
+# LOKI_PASSWORD=""

.github/workflows/docker-publish.yml

@@ -0,0 +1,78 @@
+name: Build & Publish Docker Image
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+# Cancel in-progress runs when a new commit is pushed to the same ref.
+concurrency:
+  group: docker-publish-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-push:
+    name: Build & push multi-arch image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU (multi-arch)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Skip login on PRs from forks — they don't have package:write.
+      # Image is built but not pushed in that case.
+      - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute image tags & labels
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-,format=short
+          labels: |
+            org.opencontainers.image.title=HealthLog
+            org.opencontainers.image.description=Self-hosted health-tracking PWA
+            org.opencontainers.image.licenses=AGPL-3.0-only
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+
+      - name: Build & push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: true
+          sbom: true

.github/workflows/security.yml

@@ -30,11 +30,13 @@ jobs:
 
       - name: ESLint
         run: pnpm lint
+        # Non-blocking on the existing settings page monolith — its set-state-
+        # in-effect violations need the 1.4.0 settings-split refactor to fix
+        # cleanly. Will flip to blocking once settings/page.tsx is broken up.
         continue-on-error: true
 
       - name: TypeScript strict check
         run: pnpm typecheck
-        continue-on-error: true
 
       - name: Unit tests
         run: pnpm test

AGENTS.md

@@ -6,7 +6,7 @@ Instructions for AI coding agents (OpenAI Codex, Claude Code, Cursor, etc.) work
 
 **HealthLog** — a personal health-tracking web app (weight, blood pressure, pulse, mood, medication compliance) with Withings integration, moodLog.app sync, Dracula-themed UI, mobile-first PWA design.
 
-**Status**: Feature-complete (v1.0.0). See GitHub Issues for open tasks.
+**Status**: v1.2.0 (Custom Thresholds, Blood Glucose, Dashboard Customization, Built-in Feedback, Multi-Provider AI). See GitHub Issues for open tasks.
 
 ## Tech Stack
 
@@ -77,7 +77,8 @@ src/
 │   ├── notifications/page.tsx    # Notification preferences matrix
 │   ├── onboarding/page.tsx       # 4-step guided onboarding
 │   ├── settings/page.tsx         # All settings (13 sections, ~2100 lines)
-│   ├── zielwerte/page.tsx        # Target values dashboard
+│   ├── mood/page.tsx             # Mood tracking
+│   ├── targets/page.tsx          # Target values dashboard
 │   └── api/                      # ~60 API route files (see docs/api.md)
 │       ├── mood-entries/         # Mood CRUD
 │       ├── import/               # JSON data import
@@ -116,7 +117,7 @@ messages/
 ├── de.json                       # German translations (primary UI language)
 └── en.json                       # English translations
 prisma/
-├── schema.prisma                 # Database schema (22 models)
+├── schema.prisma                 # Database schema (23 models)
 └── migrations/                   # Migration files (0001–0018)
 prisma.config.ts                  # Prisma config (DB URL lives here, NOT in schema)
 public/
@@ -128,10 +129,10 @@ docs.healthlog.dev                # External documentation site
 
 ## Key Conventions
 
-- **UI language is German**. All user-facing text in German. Code, comments, docs in English.
+- **Default locale is English**. All code-level strings in English. UI text via i18n (`t()` calls) with German + English translations.
 - **i18n**: Use `useTranslations()` hook → `t("section.key")`. Supports parameter interpolation: `t("key", { count: 5 })`. Messages in `messages/de.json` + `messages/en.json`.
 - **API response format**: Always `{ data, error, meta }` via `apiSuccess(data)` / `apiError(message, status)` from `src/lib/api-response.ts`.
-- **Auth check pattern**: `const session = await getSession(); if (!session) return apiError("Nicht angemeldet", 401);`
+- **Auth check pattern**: `const session = await getSession(); if (!session) return apiError("Not authenticated", 401);`
 - **Timezone**: `Europe/Berlin` for display, UTC in database.
 - **Encryption**: Sensitive data (Withings tokens, API keys, VAPID private keys) encrypted with AES-256-GCM via `src/lib/crypto.ts`.
 - **Dracula colors**: Use CSS variables `var(--dracula-purple)`, `var(--dracula-cyan)`, `var(--dracula-green)`, `var(--dracula-orange)`, `var(--dracula-pink)`, `var(--dracula-red)`, `var(--dracula-yellow)`, `var(--dracula-fg)`, `var(--dracula-comment)` for chart/graph elements.
@@ -206,7 +207,7 @@ These are hard-won lessons. Ignoring them will cause errors:
 
 ## Database Models (Prisma)
 
-22 models: `User`, `Passkey`, `Session`, `AuthChallenge`, `Measurement`, `Medication`, `MedicationSchedule`, `MedicationIntakeEvent`, `ReminderPhaseConfig`, `TelegramReminderMessage`, `TelegramScheduledDeletion`, `ApiToken`, `WithingsConnection`, `MoodEntry`, `AppSettings`, `AuditLog`, `NotificationChannel`, `NotificationPreference`, `PushSubscription`, `DataBackup`, `UserAchievement`, `RateLimit`.
+23 models: `User`, `Passkey`, `Session`, `AuthChallenge`, `Measurement`, `Medication`, `MedicationSchedule`, `MedicationIntakeEvent`, `ReminderPhaseConfig`, `TelegramReminderMessage`, `TelegramScheduledDeletion`, `ApiToken`, `WithingsConnection`, `MoodEntry`, `AppSettings`, `Feedback`, `AuditLog`, `NotificationChannel`, `NotificationPreference`, `PushSubscription`, `DataBackup`, `UserAchievement`, `RateLimit`.
 
 ## When Making Changes
 

CHANGELOG.md

@@ -0,0 +1,255 @@
+# Changelog
+
+## [1.3.2] — 2026-04-28
+
+### Fixed
+
+- **Glucose tiles on the dashboard rendered the raw i18n key
+  `targets.glucoseFasting` instead of the translated label** (closes
+  #108). Both `messages/en.json` and `messages/de.json` had two
+  top-level `targets` blocks; `JSON.parse` silently keeps the last
+  occurrence, and that block was missing the four glucose labels. The
+  duplicate is now collapsed into a single block. A duplicate
+  `bugreport.bugTitlePlaceholder` shadowed inside `bugreport` was
+  cleaned up too. Two further keys (`dashboard.sleep`,
+  `dashboard.steps`) were missing from both locales and were falling
+  back to hard-coded English; both are now translated.
+- **New i18n locale-integrity test**
+  (`src/lib/__tests__/i18n-locale-integrity.test.ts`) fails the build
+  on duplicate keys at any nesting depth and on key drift between
+  `en` and `de` — closes the structural gap that let the duplicate
+  `targets` block ship in the first place.
+
+### Changed
+
+- **Screenshot upload removed from the bug-report form** (also part
+  of #108). The form previously accepted an image attachment that
+  was stored in the local DB but never reached the published GitHub
+  issue — GitHub does not accept inline base64 data URIs in issue
+  bodies and offers no public API to attach images to an issue
+  programmatically. Rather than ship misleading
+  "a screenshot was attached" placeholder text in the resulting
+  issue, the upload UI is now gone and the placeholder note is no
+  longer added when promoting feedback. The `screenshotBase64`
+  column and the admin-side preview of previously-submitted
+  screenshots are unchanged — existing reports keep their
+  attachments locally. We plan to revisit a real screenshot pipeline
+  in a future release.
+
+## [1.3.1] — 2026-04-27
+
+### Fixed
+
+- **Compose env-var validation no longer breaks Coolify-style deploys.**
+  `docker-compose.yml` previously used `${VAR:?required}` shell-parameter
+  syntax for the four secrets and `POSTGRES_PASSWORD`. Some hosting
+  platforms (Coolify in particular) parse compose files eagerly and
+  store the _fallback error string_ (`"POSTGRES_PASSWORD is required"`)
+  as the literal env-var value when `POSTGRES_PASSWORD` was unset,
+  which then collided with `DATABASE_URL` and broke the running app
+  with `P1000: Authentication failed`. Compose now uses plain `${VAR}`
+  interpolation; validation moved into `docker-entrypoint.sh`, which
+  fails fast with a clear stderr message listing the unset variables.
+
+### Notes
+
+If you upgraded an existing Compose stack from 1.2.x → 1.3.0 and hit
+the `POSTGRES_PASSWORD is required` literal-as-value bug, set
+`POSTGRES_PASSWORD` in your environment to whatever your existing
+Postgres data volume was originally initialised with (likely
+`healthlog` if you started from a pre-1.2.1 release), then redeploy.
+Postgres only honours `POSTGRES_PASSWORD` on first volume init — the
+existing user keeps the original password regardless of env changes.
+
+## [1.3.0] — 2026-04-27
+
+### Added — Body composition + targeted hardening
+
+- **Total body water and bone mass as measurement types** (closes #89). New
+  enum values `TOTAL_BODY_WATER` and `BONE_MASS`, both stored canonically
+  in kilograms (matches Withings hydration/bone-mass measures and Health
+  Connect's `TotalBodyWaterRecord` / `BoneMassRecord`). Migration is
+  purely additive (`ALTER TYPE ... ADD VALUE`) — safe to apply against
+  any 1.2.x database without downtime.
+- **Withings sync picks both up automatically.** The Withings client now
+  maps measure type `77` (hydration / water mass) and `88` (bone mass).
+  Anyone with a Withings Body+ scale and an active connection will see
+  the new metrics flowing in on the next sync without any extra config.
+- **Doctor-report PDF includes both new types** in the vital-signs table
+  when data exists, with locale-aware labels in English and German.
+- **Dashboard widgets registered for both** (default-invisible — opt in
+  via Settings → Dashboard layout).
+
+### Security
+
+- **SSRF guard hardened** (`isPublicUrl`). The previous implementation
+  used `parseInt` with permissive prefix checks like `h.startsWith("10.")`
+  which let `010.0.0.1` slip through — and worse, the WHATWG URL parser
+  silently normalises `010.0.0.1` to `8.0.0.1` (octal interpretation), a
+  real bypass on naive checks. The new guard adds a pre-URL leading-zero
+  check on the raw input, a strict IPv4 parser, and proper IPv6
+  bracket / loopback / link-local handling. Now blocks `127.0.0.0/8`,
+  `0.0.0.0/8`, `10.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`,
+  `192.168.0.0/16`, `100.64.0.0/10` (CGNAT), `::1`, `fe80::/10`,
+  `fc00::/7`. Comprehensive regression tests included.
+- **GitHub PAT redacted from logged error bodies.** When a feedback
+  escalation to GitHub fails, the response body was being passed
+  verbatim into `getEvent()?.addWarning(...)` — flowing to Loki. The
+  body is now stripped of the configured token before logging.
+- **Per-user threshold writes are rate-limited** (30 writes / 5 min) to
+  make audit-log enumeration unattractive. Audit-logging itself was
+  already there.
+
+### Performance
+
+- **N+1 in `/api/insights/comprehensive` fixed.** The medication-compliance
+  loop hit Postgres once per active medication. It now batches into a
+  single `medicationId IN (...)` query and groups in memory. Latency
+  improvement scales linearly with the user's active medication count.
+
+### Reliability
+
+- **pg-boss draining on SIGTERM/SIGINT.** `docker stop`, Coolify redeploys,
+  and Kubernetes pod terminations now trigger `boss.stop({ graceful: true,
+timeout: 30s })` so in-flight handlers finish instead of being killed.
+  Previously, pending handlers could be lost or replayed on restart.
+- **CI now blocks on TypeScript strict checks.** `continue-on-error: true`
+  removed for typecheck. Tests already were blocking. ESLint stays
+  non-blocking for now — the existing `settings/page.tsx` monolith has
+  long-standing `react-hooks/set-state-in-effect` violations whose proper
+  fix lives in the 1.4.0 settings-split refactor; a blocking lint here
+  would just gate every PR until that refactor lands. Required cleaning
+  up two `any` types in `api-handler.ts` (justified inline — Next.js
+  variadic handler signature constrained by `Promise<Response>` return).
+
+### Polish
+
+- **Bottom-nav touch targets** sized to WCAG 2.5.5 minimum (44×44 CSS px).
+  Visual icon stays at 20 px so the design doesn't shift.
+- **Phase-config dialog** marks the decorative coloured dot `aria-hidden`
+  because the redundant text label already conveys the phase to screen
+  readers. No more meaningless `image` node announcements.
+- **Admin-status labels** for "Web Push" and "Bug Report" now go through
+  `t()` (new `admin.integrationWebPush` / `admin.integrationBugReport`
+  keys in en + de). They were the last hard-coded English strings on
+  the admin page.
+
+### What's _not_ in this release (tracked for later)
+
+- **Onboarding redesign** (dashboard-first empty-state flow + persistent
+  Getting Started checklist) and the **typed `apiClient` wrapper** that
+  underpins it are tracked for a focused 1.4.0 cycle. The 1.2.1 patch
+  already closed the acute symptoms of #87 (silent-failure toast +
+  default schedule), so the redesign is now a proper UI investment
+  rather than a bug-fix.
+- **Withings sync is mapping both new measures**, but **a dedicated
+  Bearer-auth ingest endpoint for external pipelines** (n8n + Health
+  Connect, requested in #89) ships in 1.4.0 alongside the API-token
+  flow.
+
+## [1.2.1] — 2026-04-27
+
+### Fixed
+
+- **Onboarding**: Medications added during onboarding are now actually persisted (closes #87). The wizard previously sent an empty `schedules: []` array, the server-side validation rejected it with a 422, the client never checked `response.ok`, and the user was redirected to the dashboard as if everything had worked. Onboarding now wraps each step in `try/catch`, surfaces failures via toast, and attaches a default reminder window (`08:00–09:00 daily`) so the medication actually persists. A hint under the medication list explains the default.
+- **Docker setup** (closes #88):
+  - `docker-compose.yml` now uses `ports: "3000:3000"` (was `expose: "3000"`, which made the app unreachable from the host).
+  - `POSTGRES_PASSWORD` is a single env var that both the Postgres service and `DATABASE_URL` interpolate, so they cannot drift apart.
+  - `.env.example` now points at the in-container hostname `db:5432` (was `localhost:5432`, which never resolves inside the app container).
+- **Documentation**:
+  - `package.json` synced to 1.2.0 (was lagging on 1.1.0).
+  - `CLAUDE.md` and `AGENTS.md` corrected to 23 models (the `Feedback` model added in v1.2 was missing from the count).
+  - `README.md` Quick Start gives a realistic time estimate, generates the four secrets in one block straight into `.env`, and points reverse-proxy users at the docs.
+
+### Added — Tooling & Supply Chain
+
+- **Pre-built multi-arch images on GHCR**: `.github/workflows/docker-publish.yml` now builds `linux/amd64` + `linux/arm64` images on every push to `main` and on every `v*` tag, publishing to `ghcr.io/mbombeck/healthlog`. Self-hosters no longer need a build toolchain — `docker compose pull && docker compose up -d` is enough. The bundled `docker-compose.yml` references the published image with a `build:` block as fallback for contributors.
+- **Supply-chain attestations**: each published image carries a SLSA build provenance statement and a Software Bill of Materials. `SECURITY.md` documents how to verify them and how to pin a specific version.
+- **Documentation single source of truth**: `getting-started/installation.mdx` is now the canonical setup guide (mirrors the bundled `docker-compose.yml`); `self-hosting/docker.mdx` slimmed to image internals + ops notes only. The landing page's Quick Start terminal block now includes the secrets-generation step (was missing).
+
+### Notes
+
+This is a patch release that closes the install/onboarding friction reported in #87 and #88. The bigger user-facing changes (additional measurement types like total body water and bone mass per #89, full onboarding redesign, typed API client) are tracked for `1.3.0`.
+
+## [1.2.0] — 2026-04-18
+
+### Added — Personalization, Glucose & Multi-Provider AI
+
+- **Per-user custom thresholds**: Override the computed default ranges (BP, BMI, glucose, pulse) with values from your clinician. Audit-logged with previous/new values and timestamps. Doctor Report PDF flags custom ranges and prints both your target and the standard guideline value.
+- **Blood glucose tracking**: New metric with `fasting`, `postprandial`, `random`, and `bedtime` contexts. Display unit switch between mg/dL and mmol/L (lossless conversion). Context-aware classification per ADA 2024 / DGIM. Per-context charting on dashboard and Doctor Report PDF.
+- **Dashboard customization**: Show/hide and drag-to-reorder every dashboard widget. Per-user preference, reset-to-defaults button. Layout persists across the same user on the same device.
+- **Built-in feedback system**: New in-app Send Feedback flow (Bug / Feature / Question / Other) with anonymized system info attachment. Stored in HealthLog's own database — no GitHub config required. Optional `Escalate to GitHub` button for admins who configure a PAT.
+- **Multi-provider AI insights**: Provider abstraction extended with **Anthropic Claude** and **local OpenAI-compatible endpoints** (Ollama, LM Studio, vLLM, LiteLLM) alongside OpenAI. Per-user provider selection. Local endpoints keep all health data on your network.
+- **Locale-aware UI polish (English-first)**: Numbers, dates, glucose units, BP, weight, and BMI all formatted via `useFormatters()` from the active locale. Doctor Report PDF and AI insight prompts now respect locale end-to-end (no hand-rolled `Intl.*` with fixed locales).
+
+### Changed
+
+- Reference range computation extracted into a dedicated `src/lib/health/thresholds.ts` module with computed defaults and override resolution.
+- AI provider routing reworked to dispatch by `provider` field on the user record; OpenAI remains the default for legacy users.
+- Dashboard route renders widgets from `UserDashboardLayout` model when present, otherwise falls back to the default order.
+- Doctor Report PDF: locale-aware headers, glucose section, custom-range badges.
+
+### Security
+
+- GitHub PAT for feedback escalation stored AES-256-GCM encrypted in the database (never as env var).
+- Local AI endpoint URLs validated against SSRF (no localhost/RFC1918 unless explicitly allowed by admin).
+- Custom threshold writes rate-limited and audit-logged with IP.
+
+## [1.1.0] — 2026-04-06
+
+### Added — AI Insights Overhaul
+
+- **ChatGPT Proxy Integration**: Insights now run through a local openai-oauth proxy using your ChatGPT subscription — no separate API billing required
+- **Admin AI Fallback**: Admins can configure a global API key (OpenAI/OpenRouter) as fallback for users without their own connection
+- **Provider Abstraction**: New `src/lib/ai/` module with pluggable providers (Codex OAuth, Admin Key, None) and automatic failover
+- **Medical Insight Prompts**: 7 specialized prompts based on ESC/ESH 2023, WHO, DGE, and DEGAM guidelines
+  - Blood Pressure: ESC/ESH classification, morning risk ladder (J-HOP), pulse pressure, seasonal variation
+  - Weight: 5%/10% milestone recognition, plateau detection, body composition divergence
+  - Pulse: Fitness interpretation ladder, 80-100 bpm elevated-risk band, rate-pressure product
+  - BMI: Age-adjusted DEGAM classification for 65+
+  - Medication Compliance: Chronotherapy hints, mood-adherence risk prediction, 90-day tracking
+  - General Status: Cross-domain synthesis with cardiovascular risk stratification
+  - Mood: Bidirectional correlations with vitals and adherence
+- **Enriched Feature Extraction**:
+  - Sleep duration and activity steps (previously ignored)
+  - Rate-Pressure Product (pulse × systolic BP, myocardial demand indicator)
+  - Body composition divergence flag (weight stable + body fat rising)
+  - Mood-adherence risk predictor
+  - Seasonal BP variation (winter vs summer, requires >180 days data)
+  - BP standard deviation (sdSys30/sdDia30) as variability risk marker
+  - Pulse pressure (arterial stiffness marker)
+  - 5 cross-metric Pearson correlations (weight↔BP, pulse↔BP, mood↔pulse, mood↔BP, mood↔weight)
+  - 90-day averages and all-time statistics for all metrics
+  - Historical comparison (current 7d vs previous 30d baseline)
+- **New UI Components**:
+  - `InsightStatusCard`: Compact per-metric status card with classification indicator and fade-in animation
+  - `InsightAdvisorCard`: Premium structured card with findings, correlations, recommendations (ready for integration)
+- **OAuth Routes**: `/api/auth/codex/authorize`, `/callback`, `/disconnect` for ChatGPT connection
+- **Admin AI Settings**: `/api/admin/ai-settings` for global API key management
+
+### Changed
+
+- Insight prompts now use personal advisor tone ("dein Blutdruck") with positive-first pattern
+- Reasoning scaffold in system prompt (What changed? → Why? → What to do?)
+- Conditional correlation instructions (only mention when |r| > 0.4)
+- InsightResult schema enriched with `insightType`, `primaryRecommendation`, `classificationLabel`
+- BP target calculation now uses paired readings (both sys AND dia must be in range simultaneously)
+- Medication streak tracking extended from 7-day to 30-day window
+- CSP updated to allow `chatgpt.com` for OAuth flow
+
+### Security
+
+- Rate limiting on all OAuth and admin endpoints
+- PKCE (S256) + state parameter for OAuth CSRF protection
+- Encrypted token storage at rest (AES-256-GCM)
+- Error messages truncated to prevent upstream response body leaks
+- Admin key preview shows last 4 chars of decrypted key (not ciphertext prefix)
+- `prefers-reduced-motion` support for insight card animations
+
+### Removed
+
+- `openaiKeyEncrypted` field from User model (replaced by provider abstraction)
+- Direct OpenAI API calls from insight generators (now routed through provider)
+- Legacy API key input in settings UI (replaced by ChatGPT connect button)
+
+## [1.0.1] — Previous release

CLAUDE.md

@@ -0,0 +1,109 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project
+
+HealthLog — a personal health-tracking PWA (weight, blood pressure, pulse, mood, medication compliance) with Withings integration, moodLog.app sync, Dracula-themed UI, mobile-first design, offline caching, and doctor report PDF export.
+
+## Commands
+
+```bash
+# Development
+pnpm dev              # Start dev server (http://localhost:3000)
+pnpm build            # Production build
+pnpm lint             # ESLint
+pnpm format           # Prettier format
+pnpm format:check     # Prettier check
+pnpm typecheck        # TypeScript strict check
+
+# Tests
+pnpm test             # Run all tests (vitest)
+pnpm test:watch       # Watch mode
+
+# Database
+pnpm db:generate      # Generate Prisma client
+pnpm db:migrate       # Create & apply migration (dev)
+pnpm db:migrate:deploy # Apply migrations (production)
+pnpm db:push          # Push schema without migration (prototyping)
+pnpm db:studio        # Prisma Studio GUI
+
+# Docker
+docker compose up -d          # Start app + postgres
+docker compose logs -f app    # Tail app logs
+```
+
+## Architecture
+
+- **Next.js 16** App Router with TypeScript strict. Pages are RSC by default; `"use client"` only for interactivity.
+- **Prisma 7** ORM with PostgreSQL (23 models). Uses `PrismaPg` adapter from `@prisma/adapter-pg`. Client singleton at `src/lib/db.ts`. Generated client at `src/generated/prisma/client` (note the `/client` suffix). Prisma config in `prisma.config.ts` (not in schema.prisma).
+- **shadcn/ui** components (new-york style) in `src/components/ui/`. Add new ones via `pnpm dlx shadcn@latest add <component>`.
+- **Dracula theme** via CSS variables in `globals.css`. Dark mode is default. Use `--dracula-*` tokens for chart colors.
+- **TanStack Query** for client-side data fetching. Provider in `src/components/providers.tsx`.
+- **Zod v4** (`zod/v4`) for all input validation (API routes and forms).
+- **API response envelope**: `{ data, error, meta }` via helpers in `src/lib/api-response.ts`.
+- **apiHandler** wraps ALL API route handlers (`src/lib/api-handler.ts`) — error handling, Wide Event logging, x-request-id propagation.
+- **Structured Logging** (Wide Events) in `src/lib/logging/` — one JSON event per request/operation via `WideEventBuilder` + `AsyncLocalStorage`. Tail sampling, stdout JSON + optional Loki Push.
+- **Vitest** for unit testing. Config in `vitest.config.ts`.
+- **pg-boss** (PostgreSQL-native) for job queue: medication reminders, insight caching, weekly data backups.
+- **jsPDF** + jspdf-autotable for client-side doctor report PDF generation (`src/lib/doctor-report-pdf.ts`).
+- **PWA offline** via service worker caching strategies in `public/sw.js` (cache-first for static, network-first for pages, network-only for API).
+- **Proxy route protection** — `src/proxy.ts` checks session cookie, enforces auth on all non-public paths. Next.js 16 uses proxy.ts (not middleware.ts).
+
+## Key Conventions
+
+- Default locale is **English**. All code-level strings in English. UI text via i18n `t()` with German + English translations.
+- Timezone: `Europe/Berlin` for display, UTC in database.
+- Sensitive data (Withings tokens, API keys, VAPID private keys) encrypted with AES-256-GCM (`src/lib/crypto.ts`) before DB storage.
+- Passkeys are primary auth (SimpleWebAuthn v13). Sessions stored server-side in PostgreSQL.
+- All API mutations require authentication. External ingest uses Bearer token (hashed with SHA-256).
+- Rate limiting (in-memory sliding window) on auth and external-facing endpoints.
+
+## File Layout
+
+- `src/app/` — pages and API routes (App Router)
+- `src/components/ui/` — shadcn/ui primitives
+- `src/components/layout/` — shell (sidebar-nav, topbar, mobile-nav, bottom-nav)
+- `src/components/medications/` — medication form, card, timeline
+- `src/components/measurements/` — measurement form, list
+- `src/components/mood/` — mood form, mood list
+- `src/components/charts/` — Recharts wrappers
+- `src/lib/logging/` — Wide Events structured logging (types, config, event-builder, context, sampler, transports, background)
+- `src/lib/api-handler.ts` — apiHandler wrapper, requireAuth(), requireAdmin(), HttpError
+- `src/lib/` — server utilities (db, crypto, auth, analytics, export, rate-limit, gravatar)
+- `src/lib/export.ts` — CSV/JSON export formatting (measurements, medications, mood)
+- `src/lib/doctor-report-pdf.ts` — client-side PDF generation (jsPDF, European medical format)
+- `src/lib/withings/` — Withings OAuth client and sync service
+- `src/lib/notifications/` — dispatcher, types, senders (telegram, ntfy, web-push)
+- `src/lib/jobs/` — pg-boss reminder worker (reminders, insights, data backups)
+- `src/lib/analytics/` — trend calculations, compliance, correlations
+- `src/lib/i18n/` — i18n context, config, locale detection
+- `src/lib/validations/` — Zod schemas shared between API + client
+- `src/hooks/` — React hooks (`use-auth`)
+- `messages/de.json` + `messages/en.json` — i18n translations
+- `prisma/schema.prisma` — database schema (23 models)
+- `prisma.config.ts` — Prisma config (DB URL here, not in schema)
+- `public/sw.js` — Service worker for Web Push notifications + offline caching
+- `docs/` — architecture, security, assumptions, ops, API docs, ADRs
+- `docs/STATUS.md` — Current project status + open tasks
+- `AGENTS.md` — AI agent instructions (Codex, Cursor, etc.)
+
+## Important Patterns
+
+- Import Prisma client from `@/generated/prisma/client` (not `@/generated/prisma`)
+- Prisma 7 does NOT support `url = env("...")` in schema.prisma — use `prisma.config.ts`
+- Next.js 16 uses `proxy.ts` (not `middleware.ts`) — having both causes build error
+- SimpleWebAuthn v13 has no `@simplewebauthn/server/script/deps` — define Transport type inline
+- `zxcvbn-typescript` uses default export only (no named `zxcvbnAsync`/`zxcvbnOptions`)
+- pg-boss v12: `{ PgBoss }` named import, `localConcurrency` instead of `teamSize`, handler receives `Job<T>[]` array
+- **i18n**: All UI text uses `useTranslations()` hook with `t("section.key")`. Messages in `messages/en.json` (English, default) + `messages/de.json` (German, user-selectable). Keys missing in the active locale fall back to English; missing from both surfaces the raw key — the `src/lib/__tests__/i18n*.test.ts` suite guards against that. Numbers/dates go through `useFormatters()` — never hand-roll `Intl.*` with a fixed locale.
+- **Notifications**: 3 channels (Telegram, ntfy, Web Push). Dispatcher at `src/lib/notifications/dispatcher.ts`. Opt-out model (all events enabled by default)
+- **Gravatar**: Server-side SHA-256 hash via `src/lib/gravatar.ts`. URL returned in `/api/auth/me` response as `gravatarUrl` field
+- **Sidebar**: Collapsible (localStorage-persisted). Settings mode with section shortcuts. User section at bottom with three-dot dropdown menu
+- **ESLint**: Strict `react-hooks/set-state-in-effect` rule — avoid `setState` inside `useEffect`. Use lazy `useState()` initializer for localStorage reads
+- **Proxy route protection**: `src/proxy.ts` checks `healthlog_session` cookie; PUBLIC_PATHS array bypasses auth. Security headers (CSP, HSTS, X-Frame-Options) applied to all responses
+- **PWA safe area**: Root layout has `viewportFit: "cover"`. Bottom-nav uses `pb-[env(safe-area-inset-bottom)]` for iOS safe area
+- **Doctor report PDF**: Client-side via `src/lib/doctor-report-pdf.ts` (jsPDF). Data from `POST /api/doctor-report`. European medical format, German terminology
+- **Achievements**: Persistent in `UserAchievement` table. Computed on API call, new unlocks written to DB with stable `unlockedAt` timestamps
+- **Data backup**: pg-boss `data-backup` queue runs weekly (Sundays 03:00), stores JSON in `DataBackup` model
+- **Wide Events / Structured Logging**: `apiHandler()` wraps all API routes. Use `annotate()` from `@/lib/logging/context` for business-action annotations. Use `requireAuth()` / `requireAdmin()` from `@/lib/api-handler` (auto-annotates auth). Background jobs use `withBackgroundEvent()`. External calls tracked via `getEvent()?.addExternalCall()`. No `console.log` in production code — use event annotations instead. Env vars: `LOG_LEVEL`, `LOG_SAMPLE_RATE`, `LOG_SLOW_THRESHOLD_MS`, `LOG_INCLUDE_STACK`, `LOKI_ENDPOINT`, `LOKI_USERNAME`, `LOKI_PASSWORD`

README.md

@@ -37,7 +37,11 @@ Most health apps lock your data behind proprietary clouds, push subscriptions, a
 
 ## Key Features
 
-**Health Metrics** -- Track weight, blood pressure, pulse, body fat, sleep, and steps with interactive trend charts, moving averages, and traffic-light ranges based on ESC/ESH 2018 guidelines.
+**Health Metrics** -- Track weight, blood pressure, pulse, body fat, sleep, steps, blood glucose (fasting/postprandial/random/bedtime, mg/dL ↔ mmol/L), total body water, and bone mass with interactive trend charts, moving averages, and traffic-light ranges based on ESC/ESH 2018 and ADA 2024 guidelines. Body-composition metrics sync automatically from Withings Body+ scales.
+
+**Custom Thresholds** -- Override the computed default ranges per metric with the targets your clinician set. Audit-logged. Doctor Report PDF prints both your target and the standard reference.
+
+**Customizable Dashboard** -- Show, hide, and drag-to-reorder every widget. Per-user layout with reset-to-defaults.
 
 **Mood Logging** -- 5-point scale with tags, notes, and trend analytics. Syncs automatically from moodLog.app via webhook.
 
@@ -45,9 +49,11 @@ Most health apps lock your data behind proprietary clouds, push subscriptions, a
 
 **Withings Integration** -- OAuth2 device sync for scales, blood pressure monitors, and activity trackers with automatic deduplication.
 
-**AI-Powered Insights** -- Bring your own OpenAI API key. Personalized analysis across blood pressure, weight, pulse, mood, BMI, and medication adherence. Cached daily to minimize API usage.
+**Multi-Provider AI Insights** -- Pick OpenAI, Anthropic Claude, or any local OpenAI-compatible endpoint (Ollama, LM Studio, vLLM). BYOK or admin-shared key. Cached daily. Local endpoints keep all data on your network.
 
-**Doctor Report PDF Export** -- Generate professional medical reports client-side. European format with vital sign summaries, BP/BMI classification, compliance rates, and optional AI analysis.
+**Doctor Report PDF Export** -- Generate professional medical reports client-side. Locale-aware (English/German), with vital sign summaries, BP/BMI/glucose classification, compliance rates, custom-threshold badges, and optional AI analysis.
+
+**Built-in Feedback** -- Send bug reports and feature requests from inside the app. Stored in your HealthLog database — no GitHub config required. Optional GitHub escalation for admins.
 
 **PWA with Offline Support** -- Installable on iOS and Android. Service worker with intelligent caching strategies for reliable offline access.
 
@@ -55,27 +61,30 @@ Most health apps lock your data behind proprietary clouds, push subscriptions, a
 
 **Gamification** -- 30+ persistent achievements across intake streaks, compliance milestones, and healthy metric streaks.
 
-**Internationalization** -- Full German and English UI with 1000+ translation keys. Browser-based locale detection with per-user override.
+**Internationalization** -- English (default) and German UI with 1000+ translation keys. Numbers, dates, units, and AI prompts all locale-aware via `useFormatters()`. Browser-based detection with per-user override.
 
 ---
 
 ## Quick Start
 
+Plan ~5 minutes for a working install. The bundled `docker-compose.yml` pulls a pre-built multi-arch image (`linux/amd64` + `linux/arm64`) from [GitHub Container Registry](https://github.com/MBombeck/HealthLog/pkgs/container/healthlog); no build step required for self-hosters. Contributors who want to test local changes can `docker compose up --build`.
+
 ```bash
 git clone https://github.com/MBombeck/HealthLog.git
 cd HealthLog
 cp .env.example .env
 ```
 
-Generate the required secrets:
+Generate the four required secrets and paste them into `.env`:
 
 ```bash
-openssl rand -hex 32  # SESSION_SECRET
-openssl rand -hex 32  # ENCRYPTION_KEY
-openssl rand -hex 32  # API_TOKEN_HMAC_KEY
+echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)" >> .env
+echo "SESSION_SECRET=$(openssl rand -hex 32)"       >> .env
+echo "ENCRYPTION_KEY=$(openssl rand -hex 32)"       >> .env
+echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)"   >> .env
 ```
 
-Add them to `.env`, then:
+Then bring the stack up:
 
 ```bash
 docker compose up -d
@@ -83,25 +92,27 @@ docker compose up -d
 
 Open **http://localhost:3000**. The first registered user becomes admin.
 
+> Behind a reverse proxy (Caddy / Traefik / Nginx) for TLS, set `NEXT_PUBLIC_APP_URL` and `APP_URL` to your public URL in `.env` before starting. See [Self-Hosting → Reverse Proxy](https://docs.healthlog.dev/self-hosting/reverse-proxy/) for examples.
+
 ---
 
 ## Tech Stack
 
-| Layer | Technology |
-|-------|-----------|
-| Framework | Next.js 16 (App Router, React Server Components) |
-| Language | TypeScript (strict mode) |
-| Database | PostgreSQL 16 + Prisma 7 (22 models) |
-| Job Queue | pg-boss 12 (reminders, insights, backups) |
-| UI | shadcn/ui, Tailwind CSS 4, Radix UI, Lucide Icons |
-| Charts | Recharts 3 |
-| Data Fetching | TanStack Query 5 |
-| Forms | React Hook Form 7 + Zod 4 |
-| Auth | SimpleWebAuthn 13, Argon2id |
-| Notifications | Telegram Bot API, ntfy, Web Push (VAPID) |
-| PDF | jsPDF (client-side generation) |
-| Testing | Vitest 4 |
-| Deployment | Docker (multi-stage Alpine) |
+| Layer         | Technology                                        |
+| ------------- | ------------------------------------------------- |
+| Framework     | Next.js 16 (App Router, React Server Components)  |
+| Language      | TypeScript (strict mode)                          |
+| Database      | PostgreSQL 16 + Prisma 7 (23 models)              |
+| Job Queue     | pg-boss 12 (reminders, insights, backups)         |
+| UI            | shadcn/ui, Tailwind CSS 4, Radix UI, Lucide Icons |
+| Charts        | Recharts 3                                        |
+| Data Fetching | TanStack Query 5                                  |
+| Forms         | React Hook Form 7 + Zod 4                         |
+| Auth          | SimpleWebAuthn 13, Argon2id                       |
+| Notifications | Telegram Bot API, ntfy, Web Push (VAPID)          |
+| PDF           | jsPDF (client-side generation)                    |
+| Testing       | Vitest 4                                          |
+| Deployment    | Docker (multi-stage Alpine)                       |
 
 ---
 
@@ -124,23 +135,24 @@ HealthLog is designed for people who take data ownership seriously.
 
 ### Required
 
-| Variable | Description |
-|----------|-------------|
-| `DATABASE_URL` | PostgreSQL connection string |
-| `SESSION_SECRET` | 64-char hex string for session signing |
-| `ENCRYPTION_KEY` | 64-char hex string for AES-256-GCM |
-| `API_TOKEN_HMAC_KEY` | 64-char hex string for API token hashing |
+| Variable             | Description                                                   |
+| -------------------- | ------------------------------------------------------------- |
+| `POSTGRES_PASSWORD`  | Password for the bundled Postgres service (Docker Compose)    |
+| `DATABASE_URL`       | PostgreSQL connection string (uses `POSTGRES_PASSWORD` above) |
+| `SESSION_SECRET`     | 64-char hex string for session signing                        |
+| `ENCRYPTION_KEY`     | 64-char hex string for AES-256-GCM                            |
+| `API_TOKEN_HMAC_KEY` | 64-char hex string for API token hashing                      |
 
 ### Optional
 
-| Variable | Description |
-|----------|-------------|
-| `NEXT_PUBLIC_APP_URL` | Public-facing URL (default: `http://localhost:3000`) |
-| `WITHINGS_CLIENT_ID` | Withings OAuth2 client ID |
-| `WITHINGS_CLIENT_SECRET` | Withings OAuth2 client secret |
-| `WITHINGS_REDIRECT_URI` | OAuth callback URL |
-| `WITHINGS_WEBHOOK_SECRET` | Webhook URL hardening secret |
-| `TELEGRAM_WEBHOOK_SECRET` | Telegram bot webhook secret |
+| Variable                  | Description                                          |
+| ------------------------- | ---------------------------------------------------- |
+| `NEXT_PUBLIC_APP_URL`     | Public-facing URL (default: `http://localhost:3000`) |
+| `WITHINGS_CLIENT_ID`      | Withings OAuth2 client ID                            |
+| `WITHINGS_CLIENT_SECRET`  | Withings OAuth2 client secret                        |
+| `WITHINGS_REDIRECT_URI`   | OAuth callback URL                                   |
+| `WITHINGS_WEBHOOK_SECRET` | Webhook URL hardening secret                         |
+| `TELEGRAM_WEBHOOK_SECRET` | Telegram bot webhook secret                          |
 
 Telegram bot token, ntfy settings, Web Push VAPID keys, Umami, and GlitchTip URLs are configured in the **Admin Panel** and stored encrypted in the database.
 
@@ -199,60 +211,60 @@ All mutations require authentication via session cookie. External ingest uses Be
 <details>
 <summary><strong>Health Data</strong></summary>
 
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| `GET` | `/api/measurements` | List measurements (paginated, filterable) |
-| `POST` | `/api/measurements` | Create measurement |
-| `DELETE` | `/api/measurements/:id` | Delete measurement |
-| `GET` | `/api/analytics` | Trend summaries (7d/30d) |
-| `GET` | `/api/export` | Export as CSV or JSON |
-| `POST` | `/api/import` | Import from JSON |
-| `POST` | `/api/doctor-report` | Aggregated data for PDF |
+| Method   | Endpoint                | Description                               |
+| -------- | ----------------------- | ----------------------------------------- |
+| `GET`    | `/api/measurements`     | List measurements (paginated, filterable) |
+| `POST`   | `/api/measurements`     | Create measurement                        |
+| `DELETE` | `/api/measurements/:id` | Delete measurement                        |
+| `GET`    | `/api/analytics`        | Trend summaries (7d/30d)                  |
+| `GET`    | `/api/export`           | Export as CSV or JSON                     |
+| `POST`   | `/api/import`           | Import from JSON                          |
+| `POST`   | `/api/doctor-report`    | Aggregated data for PDF                   |
 
 </details>
 
 <details>
 <summary><strong>Mood</strong></summary>
 
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| `GET` | `/api/mood-entries` | List mood entries |
-| `POST` | `/api/mood-entries` | Create mood entry |
-| `DELETE` | `/api/mood-entries/:id` | Delete mood entry |
-| `GET` | `/api/mood/analytics` | Mood trend analytics |
-| `POST` | `/api/integrations/moodlog/webhook` | moodLog.app webhook |
+| Method   | Endpoint                            | Description          |
+| -------- | ----------------------------------- | -------------------- |
+| `GET`    | `/api/mood-entries`                 | List mood entries    |
+| `POST`   | `/api/mood-entries`                 | Create mood entry    |
+| `DELETE` | `/api/mood-entries/:id`             | Delete mood entry    |
+| `GET`    | `/api/mood/analytics`               | Mood trend analytics |
+| `POST`   | `/api/integrations/moodlog/webhook` | moodLog.app webhook  |
 
 </details>
 
 <details>
 <summary><strong>Medications</strong></summary>
 
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| `GET` | `/api/medications` | List all medications |
-| `POST` | `/api/medications` | Create medication |
-| `PUT` | `/api/medications/:id` | Update medication |
-| `DELETE` | `/api/medications/:id` | Delete medication |
-| `POST` | `/api/medications/:id/intake` | Log intake event |
-| `GET` | `/api/medications/:id/compliance` | Compliance stats |
-| `POST` | `/api/ingest/medication` | External intake (Bearer) |
+| Method   | Endpoint                          | Description              |
+| -------- | --------------------------------- | ------------------------ |
+| `GET`    | `/api/medications`                | List all medications     |
+| `POST`   | `/api/medications`                | Create medication        |
+| `PUT`    | `/api/medications/:id`            | Update medication        |
+| `DELETE` | `/api/medications/:id`            | Delete medication        |
+| `POST`   | `/api/medications/:id/intake`     | Log intake event         |
+| `GET`    | `/api/medications/:id/compliance` | Compliance stats         |
+| `POST`   | `/api/ingest/medication`          | External intake (Bearer) |
 
 </details>
 
 <details>
 <summary><strong>Auth and Integrations</strong></summary>
 
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| `POST` | `/api/auth/register` | Create account |
-| `POST` | `/api/auth/login` | Password login |
-| `POST` | `/api/auth/logout` | Destroy session |
-| `GET` | `/api/auth/me` | Current user profile |
-| `POST` | `/api/auth/passkey/*` | WebAuthn flows |
-| `GET` | `/api/withings/connect` | Initiate Withings OAuth |
-| `POST` | `/api/insights/generate` | Regenerate AI insights |
-| `GET` | `/api/gamification/achievements` | Achievement progress |
-| `GET` | `/api/health` | Docker health check |
+| Method | Endpoint                         | Description             |
+| ------ | -------------------------------- | ----------------------- |
+| `POST` | `/api/auth/register`             | Create account          |
+| `POST` | `/api/auth/login`                | Password login          |
+| `POST` | `/api/auth/logout`               | Destroy session         |
+| `GET`  | `/api/auth/me`                   | Current user profile    |
+| `POST` | `/api/auth/passkey/*`            | WebAuthn flows          |
+| `GET`  | `/api/withings/connect`          | Initiate Withings OAuth |
+| `POST` | `/api/insights/generate`         | Regenerate AI insights  |
+| `GET`  | `/api/gamification/achievements` | Achievement progress    |
+| `GET`  | `/api/health`                    | Docker health check     |
 
 </details>
 
@@ -260,16 +272,16 @@ All mutations require authentication via session cookie. External ingest uses Be
 
 ## Integrations
 
-| Integration | Setup | Purpose |
-|-------------|-------|---------|
-| **Withings** | Env vars | Auto-sync weight, BP, and activity |
-| **Telegram** | Admin Panel | Medication reminders with inline buttons |
-| **ntfy** | User Settings | Self-hosted push notifications |
-| **Web Push** | Admin Panel | Browser-native VAPID notifications |
-| **OpenAI** | User Settings | AI health insights (BYOK) |
-| **moodLog.app** | User Settings | Mood tracking sync |
-| **Umami** | Admin Panel | Privacy-friendly analytics |
-| **GlitchTip** | Admin Panel | Sentry-compatible error tracking |
+| Integration     | Setup         | Purpose                                  |
+| --------------- | ------------- | ---------------------------------------- |
+| **Withings**    | Env vars      | Auto-sync weight, BP, and activity       |
+| **Telegram**    | Admin Panel   | Medication reminders with inline buttons |
+| **ntfy**        | User Settings | Self-hosted push notifications           |
+| **Web Push**    | Admin Panel   | Browser-native VAPID notifications       |
+| **OpenAI**      | User Settings | AI health insights (BYOK)                |
+| **moodLog.app** | User Settings | Mood tracking sync                       |
+| **Umami**       | Admin Panel   | Privacy-friendly analytics               |
+| **GlitchTip**   | Admin Panel   | Sentry-compatible error tracking         |
 
 ---
 
@@ -318,7 +330,7 @@ Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines
 - Code style: `pnpm format && pnpm lint`
 - Type safety: `pnpm typecheck` must pass
 - Tests: `pnpm test`
-- UI language: German. Code, comments, and commits: English.
+- UI language: English by default, German selectable per user. Code, comments, and commits: English.
 
 ---
 

SECURITY.md

@@ -5,7 +5,7 @@
 Only the latest release on the `main` branch is actively supported with security updates.
 
 | Version | Supported |
-|---------|-----------|
+| ------- | --------- |
 | Latest  | Yes       |
 | Older   | No        |
 
@@ -59,3 +59,17 @@ HealthLog is designed with security as a core principle:
 - **Proxy-level route protection** via `proxy.ts` (session cookie validation on all non-public paths)
 
 For more details, see the [security documentation](https://docs.healthlog.dev/security/overview/).
+
+## Supply Chain
+
+HealthLog Docker images are built and published from this repository's CI:
+
+- **Source**: [`.github/workflows/docker-publish.yml`](.github/workflows/docker-publish.yml) — runs on every push to `main` and every `v*` tag
+- **Registry**: [`ghcr.io/mbombeck/healthlog`](https://github.com/MBombeck/HealthLog/pkgs/container/healthlog)
+- **Architectures**: `linux/amd64` and `linux/arm64`
+- **Provenance attestation**: each image carries a [SLSA build provenance](https://slsa.dev/spec/v1.0/provenance) statement linking it back to the GitHub Actions run, the commit SHA, and the workflow definition
+- **SBOM**: each image includes a [Software Bill of Materials](https://docs.docker.com/build/metadata/attestations/sbom/) you can inspect with `docker buildx imagetools inspect ghcr.io/mbombeck/healthlog:latest --format '{{ json .SBOM }}'`
+
+To pin to a specific version in production, replace `:latest` with the released tag in your `docker-compose.yml`, e.g. `ghcr.io/mbombeck/healthlog:1.2.0`. Pinning is recommended for self-hosters who want explicit control over upgrades.
+
+If you discover a tampered or unexpected image, please report it as a vulnerability via the email above.

docker-compose.yml

@@ -1,17 +1,29 @@
 services:
   app:
+    # Pre-built multi-arch images are published to GHCR by
+    # .github/workflows/docker-publish.yml on every push to main and on
+    # tagged releases. Pin to a specific version in production:
+    # e.g. ghcr.io/mbombeck/healthlog:1.2.0
+    image: ghcr.io/mbombeck/healthlog:latest
+    # Fallback build context: if the image is not yet in the registry,
+    # or you want to test local changes, run `docker compose up --build`.
     build:
       context: .
       dockerfile: Dockerfile
     container_name: healthlog-app
-    expose:
-      - "3000"
+    ports:
+      - "3000:3000"
     environment:
-      DATABASE_URL: "postgresql://healthlog:healthlog@db:5432/healthlog?schema=public"
+      # Plain ${VAR} interpolation only — no ${VAR:?error} validation
+      # syntax. Some hosting platforms (e.g. Coolify) parse compose files
+      # eagerly and store the *fallback error string* as the literal value
+      # when the env var is unset, which then breaks the deployment.
+      # Validation is enforced by docker-entrypoint.sh before the app starts.
+      DATABASE_URL: "postgresql://healthlog:${POSTGRES_PASSWORD}@db:5432/healthlog?schema=public"
       NODE_ENV: production
-      SESSION_SECRET: "${SESSION_SECRET:?SESSION_SECRET is required}"
-      ENCRYPTION_KEY: "${ENCRYPTION_KEY:?ENCRYPTION_KEY is required}"
-      API_TOKEN_HMAC_KEY: "${API_TOKEN_HMAC_KEY:?API_TOKEN_HMAC_KEY is required}"
+      SESSION_SECRET: "${SESSION_SECRET}"
+      ENCRYPTION_KEY: "${ENCRYPTION_KEY}"
+      API_TOKEN_HMAC_KEY: "${API_TOKEN_HMAC_KEY}"
       NEXT_PUBLIC_APP_URL: "${NEXT_PUBLIC_APP_URL:-http://localhost:3000}"
       APP_URL: "${APP_URL:-http://localhost:3000}"
     depends_on:
@@ -24,7 +36,7 @@ services:
     container_name: healthlog-db
     environment:
       POSTGRES_USER: healthlog
-      POSTGRES_PASSWORD: healthlog
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
       POSTGRES_DB: healthlog
     volumes:
       - pgdata:/var/lib/postgresql/data

docker-entrypoint.sh

@@ -1,6 +1,26 @@
 #!/bin/sh
 set -e
 
+# ── Validate required env vars ───────────────────────────────
+# We do this in the entrypoint instead of in docker-compose.yml's
+# environment block (which used to use the ${VAR:?error} syntax)
+# because some hosting platforms parse compose files eagerly and
+# end up storing the fallback error string as the literal value.
+# Validating here guarantees a clear, deploy-platform-agnostic
+# failure message before we touch the database.
+missing=""
+for var in DATABASE_URL SESSION_SECRET ENCRYPTION_KEY API_TOKEN_HMAC_KEY; do
+  eval "value=\$$var"
+  if [ -z "$value" ]; then
+    missing="$missing $var"
+  fi
+done
+if [ -n "$missing" ]; then
+  echo "HealthLog: ERROR — required env vars not set:$missing" >&2
+  echo "HealthLog: see .env.example for the full list and how to generate each value." >&2
+  exit 1
+fi
+
 # ── Wait for PostgreSQL ──────────────────────────────────────
 MAX_RETRIES=30
 RETRY=0
@@ -15,7 +35,7 @@ until node -e "
 " 2>/dev/null; do
   RETRY=$((RETRY + 1))
   if [ "$RETRY" -ge "$MAX_RETRIES" ]; then
-    echo "HealthLog: ERROR — Database not reachable after ${MAX_RETRIES}s, aborting."
+    echo "HealthLog: ERROR — Database not reachable after ${MAX_RETRIES}s, aborting." >&2
     exit 1
   fi
   sleep 1

docs/audit/2026-04-26-PLAN.md

@@ -0,0 +1,235 @@
+# HealthLog Audit-Plan — Phasen-Übersicht
+**Datum:** 2026-04-26
+**Audit-Bericht:** `~/infra/reports/healthlog-audit-2026-04-26.md`
+**Status:** Geplant, noch nicht in Execution
+
+## Strategische Decisions
+
+1. **Onboarding-Redesign:** 4-Step-Wizard → 2-Step + Empty-State-Dashboard + Getting-Started-Card.
+2. **Custom-Measurement-Types:** Pragmatic Hardcoding (jetzt #89), Cronometer-Pattern als v1.5+-Roadmap.
+3. **`apiClient`-Refactor vor Onboarding-Redesign**, damit neues Onboarding nicht denselben Silent-Failure-Bug reproduziert.
+
+---
+
+## Phasen-Sequenz (10 Phasen)
+
+| # | Phase | Skill | Effort | Issue-Bezug |
+|---|---|---|---|---|
+| **1** | Setup-Notfall + Versions-Sync | `gsd:quick` | ≤4 h | #87 (Pflaster), #88 |
+| **2** | Docker-Image-Pipeline (GHCR-Push + Doc-Konsolidierung) | `gsd:plan-phase` | ~1 d | #88 |
+| **3** | Issue #89 — TBW + Bone Mass hardcoded | `gsd:plan-phase` | ~1 d | #89 |
+| **4** | `apiClient`-Wrapper + geteilte Zod-Schemas | `gsd:research-phase` → `gsd:plan-phase` | 2-3 d | #87 (strukturell) |
+| **3.5** | **Onboarding-Redesign** (2 Steps, TTFV <60s) | `gsd:research-phase` → `gsd:plan-phase` | ~2 d | #87 (strukturell) |
+| **4.5** | Empty-State-Dashboard-Tiles (eine pro Type) | `gsd:plan-phase` | ~1 d | #87, #89 |
+| **4.6** | „Getting Started"-Checklist auf Dashboard | `gsd:plan-phase` | ~4 h | #87 |
+| **5** | Security + Reliability Hardening | `gsd:plan-phase` | 1-2 d | — |
+| **6** | Test-Coverage-Boost (Auth/Passkey/Withings/pg-boss) | `gsd:plan-phase` | 1-2 d | — |
+| **7** | UX/i18n/a11y Polish (Residuals aus #73) | `gsd:quick` | ≤4 h | #73 (Residuals) |
+| **8** | Settings-Page-Splitting (3143 → Sub-Components) | `gsd:research-phase` → `gsd:plan-phase` | 2-3 d | — |
+
+**Reihenfolge:** 1 → 2 → 3 → **4 (apiClient)** → **3.5 (Onboarding nutzt apiClient)** → 4.5 → 4.6 → 5 → 6 → 7 → 8.
+
+---
+
+## Phase 1 — Setup-Notfall (≤4 h)
+
+**Goal:** Self-Hoster kann mit `git clone && docker compose up -d` tatsächlich starten + Issue #87 stoppt zu blocken.
+
+- `docker-compose.yml`: `expose:3000` → `ports: "3000:3000"` (DX-002)
+- `docker-compose.yml`: `POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?required}"` (SEC-003)
+- `.env.example`: `localhost:5432` → `db:5432` (DX-003)
+- `package.json`: `"version": "1.2.0"` (DOC-007)
+- `CLAUDE.md` + `AGENTS.md`: 23 Models statt 21/22 (DOC-001)
+- `src/app/onboarding/page.tsx`: `await fetch(...)` mit `.ok`-Check + `toast.error()` (DX-005 Pflaster)
+- README „minutes"-Claim entschärfen (DX-006)
+
+**Verification:** Frischer Clone + neue VM → `cp .env.example .env && set secrets && docker compose up -d` → App auf `http://localhost:3000` erreichbar in <5 min.
+
+---
+
+## Phase 2 — Docker-Image-Pipeline (~1 d)
+
+**Goal:** Issue #88 vollständig schließen. Pre-built Image auf GHCR. Docs konsolidiert.
+
+- `.github/workflows/docker-publish.yml`: Multi-Arch (amd64+arm64), Trigger auf Tag-Push + main, GHCR-Push mit GITHUB_TOKEN
+- `healthlog-docs/getting-started/installation.mdx` → Verweis auf `self-hosting/docker.mdx` statt Duplikat (DX-004)
+- Repo-`docker-compose.yml` vs Docs-`docker-compose.yml`: eine Variante als Single-Source-of-Truth (Compose verwendet `image:` aus GHCR; Doc-Snippet wird daraus generiert)
+- `SECURITY.md` + Image-Pull-Instructions
+- `healthlog-landing` prüfen ob „Quick Start" aktualisiert werden muss
+
+---
+
+## Phase 3 — Issue #89: TBW + Bone Mass (~1 d)
+
+**Goal:** User-Anfrage von Manschk3rl beantworten. Blueprint = v1.2-Glucose-Migration.
+
+**Touchpoints:**
+1. `prisma/schema.prisma`: `MeasurementType` Enum + 2 neue Werte
+2. `prisma/migrations/0019_*` (additive `ALTER TYPE ... ADD VALUE`)
+3. `src/lib/validations/measurement.ts`: `unitMap`, `VALUE_RANGES`
+4. `src/lib/format.ts` + i18n-Keys (4-6 neue Keys)
+5. `src/lib/doctor-report-pdf.ts`: `TYPE_LABEL_KEYS`, `TYPE_UNIT_KEYS`, `vitalTypes`
+6. `src/components/measurements/measurement-form.tsx`: `MEASUREMENT_TYPES` Array
+7. `src/lib/withings/client.ts` + `sync.ts`: Mapping aus Withings `body_composition`
+8. `src/app/api/dashboard/widgets/route.ts` + `DEFAULT_DASHBOARD_LAYOUT`: 2 neue Widget-IDs
+9. healthlog-docs `health-metrics.mdx` aktualisieren
+10. Optional: `/api/ingest/measurements` Bearer-Endpoint für n8n (analog `/api/ingest/medication`)
+
+---
+
+## Phase 4 — `apiClient`-Wrapper (2-3 d)
+
+**Goal:** Silent-Failure-Pattern strukturell eliminieren. Voraussetzung für 3.5.
+
+- `src/lib/api-client.ts`: `apiClient.{get,post,put,delete}<T>(path, body?, schema?) → Result<T, ApiError>`
+- Auto-`.ok`-Check + Toast bei Fehler (mit i18n-Mapping)
+- Geteilte Zod-Schemas: Validations-Module in `src/lib/validations/` werden client-importable
+- Migration: alle ~50 `fetch(...)`-Aufrufe in `src/app/` und `src/components/` → `apiClient.*`
+- Tests für `apiClient` (Mock-Fetch, Error-Mapping, Schema-Validation)
+
+---
+
+## Phase 3.5 — Onboarding-Redesign (~2 d)
+
+**Goal:** TTFV <60s, 90% Completion (statt aktuell ~8% global).
+
+**Neuer Flow:**
+- Step 1: Welcome + Anzeigename (optional) + Einheiten + Größe (optional). Sekundärlink „Skip everything → Dashboard".
+- Step 2: Multi-Select-Chips „Was willst du tracken?" (Weight/BP/Pulse/Mood/Glucose/Sleep/Steps/BodyFat/TBW/BoneMass/Medications). Pre-checked Defaults. Speichert in `User.dashboardWidgetsJson`.
+- Routing nach Onboarding: direkt zum Dashboard mit „Getting Started"-Card (s. Phase 4.6).
+
+**Entfällt ersatzlos:** Targets-Step, Notifications-Teaser-Step, Front-loaded-Med-Wizard.
+
+**Permissions deferred:** Notifications nur bei „Add medication → Reminder ein", PWA-Install nur bei Day-2-Return-Visit oder nach 3. Eintrag.
+
+---
+
+## Phase 4.5 — Empty-State-Dashboard-Tiles (~1 d)
+
+**Goal:** Mealie/Tandoor/Linear-Pattern. Jede Metric-Tile hat Empty-State mit „Add your first X"-CTA.
+
+- `src/components/dashboard/EmptyStateTile.tsx` als wiederverwendbare Komponente
+- Pro `MeasurementType`: eigene Empty-State-Card (Icon + Headline + CTA-Button → opens MeasurementForm prefilled)
+- `Medications` analog: Empty-State „Add your first medication" → opens MedicationForm mit Default-Schedule (08:00–09:00 daily)
+- Dashboard-Routing: User mit `dashboardWidgetsJson` ohne Daten sieht Empty-States, nicht leeres Grid
+
+---
+
+## Phase 4.6 — „Getting Started"-Checklist (~4 h)
+
+**Goal:** Linear-Pattern. Persistent dismissible Card auf Dashboard.
+
+- `User.gettingStartedDismissedAt: DateTime?` (nullable, NULL = noch sichtbar)
+- 4 Items mit Live-Status:
+  - ☐ Log your first measurement (✓ wenn ≥1 Measurement existiert)
+  - ☐ Add a medication (✓ wenn ≥1 Medication existiert)
+  - ☐ Set a target value (✓ wenn `thresholdsJson` non-empty)
+  - ☐ Install HealthLog as App (✓ wenn `beforeinstallprompt` accepted, sonst nur sichtbar bei PWA-fähigen Browsern)
+- „Dismiss"-Button → setzt Timestamp, Card verschwindet
+- Vollständig durchgeklickt → Card verschwindet automatisch
+
+---
+
+## Phase 5 — Security + Reliability Hardening (1-2 d)
+
+- SEC-002: SSRF-IPv4-Parser-Härtung (führende Nullen)
+- SEC-004: GitHub-PAT-Logging-Sanitization (Sensitive-Field-Filter)
+- SEC-005: AES-256-GCM Key-Rotation-Doc + optional `keyVersion`
+- SEC-006: Custom-Thresholds-Rate-Limit
+- PERF-001: N+1 in `insights/comprehensive/route.ts:219` per `groupBy` auflösen
+- REL-002: Onboarding-Error-Handling über Pflaster hinaus (via apiClient aus Phase 4)
+- REL-003: pg-boss `process.on('SIGTERM', ...)` für graceful shutdown
+- LOG-001: 6× `console.log()` in `src/lib/jobs/reminder-worker.ts` → Wide-Event-Annotations
+- CI: ESLint+Typecheck `continue-on-error: true` → blocking
+
+---
+
+## Phase 6 — Test-Coverage-Boost (1-2 d)
+
+Coverage 35% → 60% auf kritischen Pfaden.
+
+**Top-5-Test-Suites:**
+1. Session-Validation Roundtrip (`src/lib/auth/session.ts`)
+2. Passkey-Register/Verify-Integration (Attestation-Flow)
+3. Notification-Dispatcher Multi-Channel (TELEGRAM/NTFY/WEB_PUSH)
+4. pg-boss Reminder-Worker (Queue-Init, Job-Execution, Cron, Retry)
+5. Withings-OAuth + Sync (`exchangeCode` → `refresh` → `fetchMeasurements`)
+
+**Plus:** TEST-006 Custom-Thresholds-Resolution, TEST-007 AI-Provider-SSRF.
+
+---
+
+## Phase 7 — UX/i18n/a11y Polish (≤4 h)
+
+**Residuals aus Issue #73 + neue Findings:**
+- I18N-002: Admin-Page Hardcoded „Web Push" / „Bug Report" → `t(...)`
+- I18N-003: `medication-card.tsx` `Intl.DateTimeFormat("en-CA")` und `toLocaleString("en-US")` → `useFormatters()`
+- A11Y-001: `phase-config-dialog.tsx` Text-Indicator neben Farb-Punkt (WCAG 1.4.1)
+- A11Y-002: Admin StatusItem `aria-label` verifizieren
+- UX-002: Admin-Save-Error-UX (Field-Highlight bei Fehler)
+- UX-003: Bottom-Nav-Touch-Targets `p-2.5` → `p-3` (≥44×44 px)
+
+---
+
+## Phase 8 — Settings-Page-Splitting (2-3 d)
+
+**Goal:** 3143 Zeilen → Sub-Components mit klarer Boundary.
+
+- Research-Phase: Sub-Routes (`/settings/profile`, `/settings/notifications`, …) vs Sub-Components in einer Page?
+- Plan-Phase: Migrationsstrategie ohne URL-Bruch
+- Insights-Page (1750 Zeilen) folgt analogem Pattern
+
+---
+
+## Issue-Vorschlags-Abdeckung
+
+### Issue #87 (Onboarding-Meds verschwinden)
+- **Pflaster:** Phase 1 (`.ok`-Check + Toast)
+- **Strukturelle Lösung:** Phase 4 (`apiClient`) + Phase 3.5 (neuer Flow ohne Med-Wizard) + Phase 4.5 (Empty-State-Tiles, Meds direkt sichtbar) + Phase 4.6 (Checklist)
+
+### Issue #88 (Setup holprig — 4 Hauptpunkte + 3 Verbesserungsvorschläge)
+| #88 Punkt | Phase | Status |
+|---|---|---|
+| (a) Bundled compose ≠ docs version | Phase 2 (DOC-005) | abgedeckt |
+| (b) ghcr.io 404 (kein Image gepusht) | Phase 2 (DX-001 GHA-Workflow) | abgedeckt |
+| (c) `.env.example` `localhost:5432` vs Compose `db:5432` | Phase 1 (DX-003) | abgedeckt |
+| (d) `expose:3000` statt `ports:3000:3000` | Phase 1 (DX-002) | abgedeckt |
+| Vorschlag: GHA für Image-Push (GHCR/Docker Hub) | Phase 2 | abgedeckt |
+| Vorschlag: Merge „Getting started > Installation" + „Self-Hosting > Docker" | Phase 2 (DX-004) | abgedeckt |
+| Vorschlag: Same presets across compose+docs+.env.example | Phase 1 + Phase 2 | abgedeckt |
+
+### Issue #89 (TBW + Bone Mass)
+- Phase 3 hardcoded mit Withings-Mapping. Optional `/api/ingest/measurements` für n8n in Phase 3.
+
+### Issue #73 (UX-Liste mit 8 Punkten — CLOSED in v1.2)
+| #73 Punkt | v1.2-Status | Residual? |
+|---|---|---|
+| 1. Passkey-Errors unklar | Resolved (Package C, typed errors) | TEST-002 (keine Tests) → Phase 6 |
+| 2. Number-Formatting (DE 70,5 vs US 70.5) | Resolved (Package B, locale-aware formatters) | I18N-003 in `medication-card.tsx` → Phase 7 |
+| 3. Chart-Labels „7P/30P/90P/All" | Resolved (Package A, „7 Pkt"/„7 pts") | — |
+| 4. Dashboard nicht real-time | Resolved (`invalidateKeys` durchgängig) | — |
+| 5. GitHub-Setup-Confusion | Resolved (Built-in Feedback in v1.2) | — |
+| 6. Built-in Feedback | Done in v1.2 | — |
+| 7. Admin-Save ohne Error-UX | Partial (Success-Msg ja, Error-Highlight schwach) | UX-002 → Phase 7 |
+| 8. Blood-Sugar | Done in v1.2 | — |
+
+### Issue #74 (raw locale keys in UI)
+Resolved in v1.2.
+
+---
+
+## Time-to-First-Value (TTFV) Ziel
+
+Nach Onboarding-Redesign + Empty-State-Pattern:
+- Login → Dashboard mit Empty-States: 2 Klicks
+- Klick auf „Add your first weight" → Form prefilled „now" → Submit: 30 Sek
+- **TTFV-Ziel: <60 Sekunden** (Branchenvergleich: führende Health-Apps 30-90s)
+
+## Anti-Patterns explizit vermieden
+
+- Permissions-Cold-Prompt (Notifications/PWA) auf Day 1
+- Front-loaded Targets vor erster Messung
+- Multi-Step-Wizard mit identischem Skip-Button
+- `fetch()` ohne `.ok`-Check (apiClient löst strukturell)
+- Mega-Page-Pattern (Phase 8 löst Settings 3143 Z.)
+- Custom-Measurement-Types vorzeitig (40-60h Wartung/Jahr für 50% Feature-Loss)

docs/superpowers/specs/2026-04-06-codex-oauth-insights-design.md

@@ -0,0 +1,359 @@
+# Codex OAuth + Medizinische Insights — Design Spec
+
+**Datum:** 2026-04-06
+**Status:** Approved
+**Scope:** Replace OpenAI API-Key flow with ChatGPT Codex OAuth, improve medical insight prompts
+
+## 1. Problem
+
+HealthLog uses user-provided OpenAI API keys for AI-powered health insights. The API quota ran out (`insufficient_quota`), breaking all insight generation and background jobs. Users shouldn't need to manage API billing.
+
+## 2. Solution
+
+Replace the API-key model with **OpenAI Codex OAuth** — users authenticate with their ChatGPT Pro/Max subscription, and insights run against their flat-rate plan. An admin-level API key serves as a global fallback.
+
+## 3. Provider Hierarchy
+
+```
+1. User has Codex OAuth connection → Codex Responses API (gpt-5.3-codex)
+2. Admin key configured → Standard OpenAI Chat Completions API (configurable model)
+3. Nothing configured → Local fallback texts (no-key-fallbacks.ts)
+```
+
+## 4. Architecture
+
+### New Files
+
+```
+src/lib/ai/
+  provider.ts          — resolveProvider(userId) → { type, client, model }
+  codex-oauth.ts       — PKCE generation, token exchange, refresh
+  codex-client.ts      — Codex Responses API client with auto-refresh
+  openai-client.ts     — Standard OpenAI client (admin key, configurable base URL)
+  types.ts             — Shared types (InsightResult, ProviderConfig, etc.)
+  prompts/
+    base-system.ts     — Shared medical context, role, constraints
+    general-status.ts  — Holistic health assessment prompt
+    blood-pressure.ts  — ESC/ESH guideline-based BP analysis
+    weight.ts          — BMI context, trend analysis, plateau detection
+    pulse.ts           — Resting HR trends, stress correlation
+    bmi.ts             — WHO classification, age-adjusted
+    medication-compliance.ts — Intake patterns, efficacy correlation
+    schema.ts          — Zod schema for InsightResult validation
+```
+
+### Modified Files
+
+```
+src/app/api/auth/codex/authorize/route.ts    — NEW: Start OAuth flow
+src/app/api/auth/codex/callback/route.ts     — NEW: Handle OAuth callback
+src/app/api/auth/codex/disconnect/route.ts   — NEW: Remove tokens
+src/app/api/admin/ai-settings/route.ts       — NEW: Admin key management
+src/app/api/insights/generate/route.ts       — MODIFY: Use provider abstraction
+src/app/api/insights/settings/route.ts       — MODIFY: Show Codex status instead of API key
+src/app/api/insights/*/route.ts              — MODIFY: New output schema
+src/lib/insights/*.ts                        — MODIFY: Use new prompts + provider
+src/lib/jobs/reminder-worker.ts              — MODIFY: Use provider with auto-refresh
+src/proxy.ts                                 — MODIFY: Add /api/auth/codex/callback to PUBLIC_PATHS
+prisma/schema.prisma                         — MODIFY: New fields, remove openaiKeyEncrypted
+```
+
+### Removed Files/Code
+
+```
+src/app/api/insights/settings/route.ts       — OpenAI key PUT handler (replaced)
+src/lib/insights/prompt.ts                   — Single prompt file (replaced by prompts/)
+User.openaiKeyEncrypted                      — DB field removed
+```
+
+## 5. OAuth Flow
+
+### Authorization (User-initiated)
+
+```
+1. User clicks "Mit ChatGPT verbinden" in Settings
+2. GET /api/auth/codex/authorize
+   - Generate PKCE code_verifier (128 bytes, base64url)
+   - Compute code_challenge = SHA-256(code_verifier), base64url
+   - Generate random state parameter
+   - Store code_verifier + state in session
+   - Redirect to: chatgpt.com/authorize?
+       response_type=code
+       &code_challenge=<challenge>
+       &code_challenge_method=S256
+       &redirect_uri=https://healthlog.bombeck.io/api/auth/codex/callback
+       &state=<state>
+3. User logs in at ChatGPT, grants access
+4. Redirect to /api/auth/codex/callback?code=...&state=...
+5. Validate state against session
+6. Exchange code for tokens (POST chatgpt.com/oauth/token)
+7. Encrypt access_token + refresh_token with AES-256-GCM
+8. Store in User record with expiresAt
+9. Redirect to /settings with success toast
+```
+
+### Token Refresh (Automatic)
+
+```
+Before every API call:
+  if codexTokenExpiresAt < now + 5min:
+    POST chatgpt.com/oauth/token (grant_type=refresh_token)
+    Store new encrypted tokens + new expiresAt
+    If refresh fails:
+      Increment failCount
+      If failCount >= 3 over 72h:
+        Set codexConnectionStatus = 'expired'
+        Fall back to admin key silently
+      Else:
+        Retry on next call
+
+On 401 response:
+  Refresh token immediately, retry request once
+```
+
+### Disconnect
+
+```
+DELETE /api/auth/codex/disconnect
+  - Delete tokens from DB
+  - Revoke at OpenAI if endpoint exists
+  - Audit log entry
+```
+
+## 6. Database Changes
+
+### Prisma Schema
+
+```prisma
+model User {
+  // REMOVE:
+  // openaiKeyEncrypted    String?
+
+  // ADD:
+  codexAccessTokenEncrypted   String?
+  codexRefreshTokenEncrypted  String?
+  codexTokenExpiresAt         DateTime?
+  codexConnectedAt            DateTime?
+  codexConnectionStatus       String    @default("disconnected")
+  // Values: "connected", "disconnected", "expired"
+}
+
+model AppSettings {
+  // ADD:
+  adminAiKeyEncrypted   String?
+  adminAiModel          String   @default("gpt-4o-mini")
+  adminAiBaseUrl        String   @default("https://api.openai.com/v1")
+}
+```
+
+### Migration
+
+```sql
+-- Add new columns
+ALTER TABLE users ADD COLUMN codex_access_token_encrypted TEXT;
+ALTER TABLE users ADD COLUMN codex_refresh_token_encrypted TEXT;
+ALTER TABLE users ADD COLUMN codex_token_expires_at TIMESTAMP;
+ALTER TABLE users ADD COLUMN codex_connected_at TIMESTAMP;
+ALTER TABLE users ADD COLUMN codex_connection_status TEXT NOT NULL DEFAULT 'disconnected';
+
+ALTER TABLE app_settings ADD COLUMN admin_ai_key_encrypted TEXT;
+ALTER TABLE app_settings ADD COLUMN admin_ai_model TEXT NOT NULL DEFAULT 'gpt-4o-mini';
+ALTER TABLE app_settings ADD COLUMN admin_ai_base_url TEXT NOT NULL DEFAULT 'https://api.openai.com/v1';
+
+-- Remove old column
+ALTER TABLE users DROP COLUMN openai_key_encrypted;
+```
+
+## 7. Insight Output Schema
+
+### New InsightResult (replaces old changed/stable/drivers/nextSteps)
+
+```typescript
+interface InsightResult {
+  summary: string
+  classification: 'optimal' | 'gut' | 'grenzwertig' | 'erhoht' | 'kritisch'
+  findings: {
+    label: string
+    value: string
+    assessment: 'positive' | 'neutral' | 'attention' | 'warning'
+    guideline?: string
+  }[]
+  correlations: {
+    factor: string
+    effect: string
+    confidence: 'hoch' | 'mittel' | 'gering'
+  }[]
+  recommendations: string[]
+  dataQuality: {
+    coverage: string
+    gaps: string[]
+    confidence: 'hoch' | 'mittel' | 'gering'
+  }
+  disclaimer: string
+}
+```
+
+### Zod Validation
+
+Every AI response is validated against a Zod schema before being stored.
+Invalid responses are logged as errors and the user gets a generic fallback.
+
+## 8. Prompt Design
+
+### Base System Prompt
+
+```
+Du bist ein klinischer Gesundheitsanalyst mit Expertise in Innerer Medizin
+und Präventivmedizin. Deine Analyse basiert auf aktuellen Leitlinien
+(ESC/ESH 2023, WHO, DGE, DEGAM).
+
+Regeln:
+- Evidenzbasiert: Referenziere Grenzwerte und Leitlinien explizit
+- Muster erkennen: Tageszeit, Wochentag, saisonale Trends
+- Korrelationen: Wechselwirkungen zwischen Medikation und Vitalwerten benennen
+- Limitationen: Klar kommunizieren was die Datenlage hergibt und was nicht
+- Kein Ersatz für ärztliche Diagnose — immer explizit als Disclaimer
+- Sprache: Deutsch, medizinisch präzise aber allgemeinverständlich
+- Antworte ausschließlich im vorgegebenen JSON-Schema
+```
+
+### Per-Type Specialization
+
+Each insight type adds domain-specific instructions:
+
+- **Blood Pressure**: ESC/ESH classification (optimal <120/80, normal <130/85, ...), morning surge detection, white-coat vs. masked hypertension hints, medication correlation
+- **Weight**: BMI-adjusted analysis, 7/30/90-day slope, plateau detection (±0.5kg over 14+ days), realistic goal projection
+- **Pulse**: Resting HR zones (bradycardia <50, athletic 50-60, normal 60-100, tachycardia >100), trend stability, stress/recovery indicators
+- **BMI**: WHO classification, waist-to-height hints if available, age context
+- **Medication Compliance**: Pattern analysis (morning vs evening adherence), streak tracking, correlation with vital sign improvements
+- **General Status**: Cross-domain synthesis, risk stratification, most impactful change recommendation
+
+## 9. UI Changes
+
+### User Settings (/settings)
+
+Replace "OpenAI API Key" section with:
+
+```
+KI-Insights
+┌─────────────────────────────────────────┐
+│ Status: 🟢 Verbunden mit ChatGPT       │
+│ Verbunden seit: 02.04.2026             │
+│                                         │
+│ [Trennen]                               │
+│                                         │
+│ ℹ️ Insights werden über dein ChatGPT-   │
+│ Abo generiert (keine zusätzlichen       │
+│ Kosten).                                │
+└─────────────────────────────────────────┘
+```
+
+Or when disconnected:
+
+```
+KI-Insights
+┌─────────────────────────────────────────┐
+│ Status: ⚪ Nicht verbunden              │
+│                                         │
+│ [Mit ChatGPT verbinden]                 │
+│                                         │
+│ ℹ️ Verbinde dein ChatGPT Pro/Max-Konto  │
+│ um KI-gestützte Gesundheitsanalysen zu  │
+│ erhalten.                               │
+└─────────────────────────────────────────┘
+```
+
+### Admin Settings (/settings — ADMIN only)
+
+```
+KI-Anbieter (Global)
+┌─────────────────────────────────────────┐
+│ API Key:  [sk-...****________] [Testen] │
+│ Modell:   [gpt-4o-mini ▾]              │
+│ Base URL: [https://api.openai.com/v1]   │
+│                                         │
+│ ℹ️ Wird als Fallback verwendet, wenn    │
+│ ein User keine eigene ChatGPT-          │
+│ Verbindung hat.                         │
+│                                         │
+│ [Speichern]                             │
+└─────────────────────────────────────────┘
+```
+
+### Insights Display
+
+Update insight cards to render the richer InsightResult:
+- Classification badge with color (green/yellow/orange/red)
+- Findings list with assessment icons
+- Collapsible correlations section
+- Data quality indicator (small badge)
+- Disclaimer footer (smaller text)
+
+## 10. Security
+
+### OAuth Security
+- PKCE (S256) prevents authorization code interception
+- State parameter prevents CSRF
+- Tokens encrypted at rest (AES-256-GCM via existing crypto.ts)
+- Tokens never sent to client/browser
+- Refresh token rotation on every refresh
+- Callback route validates state against session
+
+### Admin Key Security
+- Only ADMIN role can read/write
+- Key displayed masked in UI (sk-...****)
+- Rate limiting on admin key usage (prevents abuse by many users)
+- Encrypted at rest
+
+### Audit Trail
+- Every OAuth connect/disconnect logged
+- Every insight generation logs: provider type, user, model, duration
+- Admin key changes logged
+
+### Security Audits (3x)
+1. **Pre-Implementation**: OAuth flow validated against OWASP OAuth Security Checklist
+2. **Post-Implementation**: Code review agent checks all new files for injection, token leaks, unencrypted secrets
+3. **Post-Deploy**: Penetration test of OAuth endpoints (CSRF, token theft, callback manipulation)
+
+## 11. Testing Strategy (TDD)
+
+### Unit Tests (vitest)
+
+| Suite | Coverage |
+|-------|----------|
+| `ai/provider.test.ts` | Provider hierarchy, correct client selection |
+| `ai/codex-oauth.test.ts` | PKCE generation, token exchange, refresh, error scenarios |
+| `ai/codex-client.test.ts` | Request format, auto-refresh on 401, retry with backoff |
+| `ai/openai-client.test.ts` | Chat completions format, custom base URL, error handling |
+| `ai/prompts/*.test.ts` | Prompt assembly per type, output schema validation with Zod |
+| `insights/*.test.ts` | Updated generators with new output schema |
+| `api/codex-callback.test.ts` | State validation, CSRF protection, token storage |
+| `api/admin-settings.test.ts` | ADMIN-only access, key encryption, validation |
+
+### Integration Tests
+- OAuth flow end-to-end (mocked ChatGPT endpoint)
+- Background job token refresh + insight generation
+- Provider fallback chain under different DB states
+
+## 12. CSP Changes
+
+```diff
+- connect-src 'self' https://api.openai.com https://wbsapi.withings.net
++ connect-src 'self' https://api.openai.com https://chatgpt.com https://wbsapi.withings.net
+```
+
+## 13. Migration Path
+
+1. Deploy new code with both old (openaiKeyEncrypted) and new fields
+2. Run migration to add new columns
+3. Remove old column in follow-up migration
+4. Users see "Nicht verbunden" in settings, can connect via OAuth
+5. Admin can configure fallback key immediately
+6. Old cached insights remain visible until refreshed
+
+## 14. Out of Scope
+
+- Multiple AI providers per user (only Codex OAuth OR admin key)
+- Custom model selection per user (model is fixed per provider)
+- Streaming responses (batch only, like current implementation)
+- OpenAI API key input for individual users (removed entirely)

docs/superpowers/specs/2026-04-18-blood-glucose-tracking-design.md

@@ -0,0 +1,207 @@
+# Blood Glucose Tracking — Design Spec
+
+**Datum:** 2026-04-18
+**Status:** Draft
+**Scope:** Add `BLOOD_GLUCOSE` as a first-class measurement type with context-aware classification (fasting / postprandial / random / bedtime), user-selectable display unit (mg/dL ↔ mmol/L), reference ranges from ADA 2024 and DGIM 2023, and full integration across form, charts, targets, doctor PDF, and insights.
+
+## 1. Problem Statement
+
+Users repeatedly request blood-sugar logging — most recently in **GitHub issue #73, point 8**. Diabetics, pre-diabetics, and people on metabolic-impacting medication (steroids, atypical antipsychotics) need a single place to log glucose alongside weight, BP, and pulse so the doctor PDF reflects the complete metabolic picture. Today they fall back to spreadsheets or vendor-locked apps. Adding glucose to HealthLog closes the largest remaining gap in the "vital sign" set and unlocks correlation insights (e.g. weight ↔ fasting glucose, sleep ↔ glucose variability).
+
+## 2. Scope
+
+In v1 we ship:
+
+- A new `BLOOD_GLUCOSE` measurement type stored canonically in **mg/dL**.
+- A required **context tag** per reading: `FASTING`, `POSTPRANDIAL`, `RANDOM`, `BEDTIME`.
+- A user preference `glucoseUnit` (`MG_DL` | `MMOL_L`, default `MG_DL` for `de` users, can flip in settings) — display only; storage is canonical.
+- Context-aware classification (see §4) and a target card on `/targets` for fasting glucose; secondary line for postprandial when data exists.
+- Health chart with diabetes/pre-diabetes band overlays.
+- Doctor PDF row + classification line.
+- Insights descriptor "glucose control" (fasting avg + variability).
+
+**Stretch (v1.1, not in this spec):** HbA1c as a separate measurement type with its own classification (<5.7% / 5.7–6.4% / ≥6.5%, ADA 2024). Schema is forward-compatible (just add another enum value).
+
+## 3. Data Model
+
+```prisma
+enum MeasurementType {
+  WEIGHT
+  BLOOD_PRESSURE_SYS
+  BLOOD_PRESSURE_DIA
+  PULSE
+  BODY_FAT
+  SLEEP_DURATION
+  ACTIVITY_STEPS
+  BLOOD_GLUCOSE          // NEW
+}
+
+enum GlucoseContext {     // NEW
+  FASTING
+  POSTPRANDIAL
+  RANDOM
+  BEDTIME
+
+  @@map("glucose_context")
+}
+
+model Measurement {
+  // ...existing fields
+  glucoseContext GlucoseContext? @map("glucose_context")  // NEW, only set when type = BLOOD_GLUCOSE
+}
+
+model User {
+  // ...existing fields
+  glucoseUnit String @default("MG_DL") @map("glucose_unit")  // "MG_DL" | "MMOL_L"
+}
+```
+
+Migration `20260418_add_blood_glucose`:
+1. `ALTER TYPE measurement_type ADD VALUE 'BLOOD_GLUCOSE';`
+2. `CREATE TYPE glucose_context AS ENUM (...);`
+3. `ALTER TABLE measurements ADD COLUMN glucose_context glucose_context;`
+4. `ALTER TABLE users ADD COLUMN glucose_unit text NOT NULL DEFAULT 'MG_DL';`
+5. Add `CHECK ((type = 'BLOOD_GLUCOSE') = (glucose_context IS NOT NULL))` to enforce coupling.
+
+The unique constraint `(userId, type, measuredAt, source)` already prevents duplicates; context is intentionally **not** part of the key — the same timestamp can't legally carry two contexts.
+
+Storage unit is always **mg/dL** (`unit = "mg/dL"` in the row) so downstream analytics, exports, and Withings ingest don't need to branch.
+
+## 4. Classifications (`src/lib/analytics/classifications.ts`)
+
+New helpers, ranges from **ADA Standards of Care 2024** (Diabetes Care, Vol. 47, Suppl. 1) and **DGIM/DDG S3-Leitlinie 2023**:
+
+```ts
+export type GlucoseContext = "FASTING" | "POSTPRANDIAL" | "RANDOM" | "BEDTIME";
+
+export interface GlucoseClassification {
+  category: string;
+  color: string;
+  severity: "info" | "normal" | "warning" | "danger";
+}
+
+export function classifyGlucose(
+  mgdl: number,
+  context: GlucoseContext,
+): GlucoseClassification;
+```
+
+Boundaries (mg/dL — mmol/L conversion shown for traceability):
+
+| Context | Hypo (<70 / <3.9) | Normal | Pre-diabetes | Diabetes |
+|---------|-------------------|--------|--------------|----------|
+| FASTING | danger            | 70–99 (3.9–5.5) normal | 100–125 (5.6–6.9) warning | ≥126 (≥7.0) danger |
+| POSTPRANDIAL (2h) | danger | <140 (<7.8) normal | 140–199 (7.8–11.0) warning | ≥200 (≥11.1) danger |
+| RANDOM | danger | <140 normal | 140–199 warning | ≥200 danger |
+| BEDTIME | danger | 90–150 normal (info if outside) | — | ≥250 danger |
+
+Color tokens reuse the existing Dracula palette (`#50fa7b` normal, `#f1fa8c` info, `#ffb86c` / `#ff79c6` warning, `#ff5555` danger). Add `getGlucoseFastingRange()` returning `{ min: 70, max: 99 }` for the target card range bar, and `getGlucosePostprandialRange()` for the optional secondary bar.
+
+## 5. UI
+
+**Measurement form (`src/components/measurements/measurement-form.tsx`):**
+- New entry in `MEASUREMENT_TYPES`: `{ value: "BLOOD_GLUCOSE", labelKey: "measurements.typeGlucose", unitKey: "measurements.unitGlucose", placeholder: "95" }`.
+- When `type === "BLOOD_GLUCOSE"`, render an additional `<Select>` for context (4 options). Default = `FASTING` between 04:00–10:00 local time, else `RANDOM`.
+- Unit suffix is resolved via `useGlucoseUnit()` hook reading `user.glucoseUnit`; the input value is converted to mg/dL before POST.
+- Min 20, max 600 mg/dL (or equivalent mmol/L); inputs accept 1 decimal in mmol/L mode, integers in mg/dL mode.
+
+**Targets page (`src/app/targets/page.tsx`):**
+- New `TYPE_ICONS["BLOOD_GLUCOSE"]` = `Droplet` (Lucide), color token `text-dracula-yellow`.
+- Card title "Fasting glucose" with `RangeBar` 70–99, orangeMin 100, orangeMax 125 (puts pre-diabetes in yellow zone, diabetes in red).
+- If postprandial data exists in last 30 days, render a second labelled `RangeBar` below using `getGlucosePostprandialRange()`, mirroring the BP-diastolic pattern already in `TargetCard`.
+- Source link → `https://diabetesjournals.org/care/issue/47/Supplement_1` (ADA 2024).
+
+**Health chart (`src/components/charts/health-chart.tsx`):**
+- New chart preset on `/charts` page: `types: ["BLOOD_GLUCOSE"]`, color `var(--dracula-yellow)`, `valueBands` for pre-diabetes (100–125) and diabetes (≥126) overlays, plus a `ReferenceLine` at 70 (hypo).
+- Filter chips for context (All / Fasting / Postprandial / Random / Bedtime) — implemented as a client-side filter on the dataset, not a new API call.
+- Y-axis unit follows user pref (mg/dL or mmol/L); points are converted on render.
+
+**Insights:** Add `glucose-control.ts` insight returning `{ avgFasting, fastingInTargetPct, postprandialPeak, variability, classification }`. AI-friendly descriptor injected into the general-status prompt: `"glucose control: avg fasting {avg} mg/dL ({class}), {pct}% of fasting readings in target."`
+
+**Doctor PDF (`src/lib/doctor-report-pdf.ts`):**
+- `TYPE_LABEL_KEYS["BLOOD_GLUCOSE"] = "doctorReport.typeGlucose"`.
+- `TYPE_UNIT_KEYS["BLOOD_GLUCOSE"]` resolves to user pref via a new `unitFor(type, ctx)` extension.
+- Add `BLOOD_GLUCOSE` to `vitalTypes` array — table row appears automatically.
+- New optional section "Glukose-Klassifikation" below the BP block: shows fasting average + classification key, plus postprandial average if `count > 0`, with i18n keys `doctorReport.glucoseClassificationTitle`, `doctorReport.glucoseFastingRow`, `doctorReport.glucosePostprandialRow`.
+- Distribution table per context (n per FASTING/POSTPRANDIAL/RANDOM/BEDTIME) so the GP sees coverage.
+
+## 6. API
+
+No new endpoints. `POST /api/measurements` already accepts `type`, `value`, `measuredAt`, `notes` — extend the Zod schema in `src/lib/validations/measurement.ts` with optional `glucoseContext: z.enum([...])` and a refinement: `BLOOD_GLUCOSE` requires the context, other types reject it. The form sends mg/dL; conversion happens client-side.
+
+`/api/analytics` and `/api/insights/targets` add `BLOOD_GLUCOSE` to their type whitelists and emit a `glucose` summary object with per-context aggregates when ≥1 reading exists.
+
+`PATCH /api/auth/me` (already exists for profile updates) gains an optional `glucoseUnit` field.
+
+## 7. Conversion Helpers
+
+New module `src/lib/glucose.ts`:
+
+```ts
+export const GLUCOSE_FACTOR = 18.0182; // mg/dL per mmol/L (molar mass of glucose)
+
+export function mgdlToMmol(mgdl: number): number {
+  return Math.round((mgdl / GLUCOSE_FACTOR) * 10) / 10; // 1 decimal
+}
+
+export function mmolToMgdl(mmol: number): number {
+  return Math.round(mmol * GLUCOSE_FACTOR); // integer
+}
+
+export function formatGlucose(mgdl: number, unit: GlucoseUnit, t: T): string;
+```
+
+Round-trip rule: `mmolToMgdl(mgdlToMmol(x))` must be within ±1 mg/dL of `x` for x ∈ [40, 400]. Tested in §9.
+
+## 8. i18n Keys (`messages/de.json` + `messages/en.json`)
+
+| Key | DE | EN |
+|---|---|---|
+| `measurements.typeGlucose` | Blutzucker | Blood glucose |
+| `measurements.unitGlucose.mgdl` | mg/dL | mg/dL |
+| `measurements.unitGlucose.mmol` | mmol/L | mmol/L |
+| `measurements.glucoseContextLabel` | Kontext | Context |
+| `measurements.glucoseContextFasting` | Nüchtern | Fasting |
+| `measurements.glucoseContextPostprandial` | Nach dem Essen (2 h) | Post-meal (2h) |
+| `measurements.glucoseContextRandom` | Zufällig | Random |
+| `measurements.glucoseContextBedtime` | Vor dem Schlafen | Bedtime |
+| `targets.glucoseFastingTitle` | Nüchtern-Blutzucker | Fasting glucose |
+| `targets.glucosePostprandialTitle` | 2-h-Postprandial | 2h post-meal |
+| `targets.glucoseSourceAda` | ADA 2024 / DGIM 2023 | ADA 2024 / DGIM 2023 |
+| `classifications.glucoseHypo` | Hypoglykämie | Hypoglycemia |
+| `classifications.glucoseNormal` | Normal | Normal |
+| `classifications.glucosePrediabetes` | Prädiabetes | Pre-diabetes |
+| `classifications.glucoseDiabetes` | Diabetes-Bereich | Diabetes range |
+| `doctorReport.typeGlucose` | Blutzucker | Blood glucose |
+| `doctorReport.glucoseClassificationTitle` | Glukose-Klassifikation | Glucose classification |
+| `doctorReport.glucoseFastingRow` | Ø Nüchtern: {avg} {unit} — {class} | Avg fasting: {avg} {unit} — {class} |
+| `doctorReport.glucosePostprandialRow` | Ø Postprandial: {avg} {unit} — {class} | Avg postprandial: {avg} {unit} — {class} |
+| `settings.glucoseUnitLabel` | Blutzucker-Einheit | Blood glucose unit |
+| `insights.glucoseControlTitle` | Glukose-Kontrolle | Glucose control |
+
+## 9. Nyquist Validation
+
+- **Unit conversion**: property test — for every integer mg/dL in [40, 400], `mmolToMgdl(mgdlToMmol(x))` differs from `x` by ≤1.
+- **Classification boundaries**: assert `classifyGlucose(99, "FASTING").severity === "normal"`, `classifyGlucose(100, "FASTING").severity === "warning"`, `classifyGlucose(125, ...) === "warning"`, `classifyGlucose(126, ...) === "danger"`, `classifyGlucose(69, "FASTING").severity === "danger"` (hypo). Same for postprandial at 139/140/199/200.
+- **Schema refinement**: `POST /api/measurements` with `BLOOD_GLUCOSE` and missing `glucoseContext` returns 400; with non-glucose type and a `glucoseContext` returns 400.
+- **End-to-end smoke**: form submit → DB row → chart render → PDF generation; assert mg/dL stored regardless of UI unit, assert PDF row appears in `vitalRows`.
+- **Doctor PDF snapshot test**: render with mixed contexts, assert classification line and per-context distribution rows.
+
+## 10. Risks
+
+- **Hypoglycemia notifications**: showing "severe low — seek help" on every reading <54 mg/dL could panic users with sensor noise or delayed entries. Notifications are **opt-in** via NotificationPreference (`MEASUREMENT_ANOMALY` event), default off, and the message text always ends with "HealthLog ist kein Medizinprodukt — bei akuten Symptomen 112 anrufen."
+- **Unit confusion**: a user flipping the unit pref must not reinterpret historical mg/dL values as mmol/L. Migration sets a default; UI shows the unit suffix on every value.
+- **Withings overlap**: Withings supports glucose via some BGM integrations. Document that Withings sync stays disabled for glucose in v1 (out of scope) to avoid double-entry races.
+- **Context defaulting**: auto-selecting `FASTING` based on time of day is a heuristic; the user must always be able to override before save.
+
+## 11. Out of Scope
+
+- CGM (Dexcom / Libre) live integration.
+- Ketone (β-hydroxybutyrate) tracking.
+- Insulin dose log and bolus calculator.
+- Carb counting / meal logging.
+- HbA1c (deferred to v1.1, schema is ready).
+
+## 12. Effort
+
+**M (medium).** Roughly: schema + migration (S), classifications + conversion lib + tests (S), form/context selector + unit pref (M), targets card + chart preset (S), insight + PDF row + i18n (M), Nyquist tests (S). Estimate 1.5–2 dev-days end-to-end including review. No external dependencies, no new infra.

docs/superpowers/specs/2026-04-18-builtin-feedback-design.md

@@ -0,0 +1,162 @@
+# Built-in Feedback System — Design Spec
+
+**Status:** Proposed (v1.2+)
+**Date:** 2026-04-18
+**Owner:** TBD
+**Tracking:** GitHub issue #73 (point 6)
+**Effort:** M
+
+## 1. Problem Statement
+
+The current bug-report flow (`src/app/bugreport/page.tsx` + `src/app/api/bugreport/route.ts`) is gated on a GitHub token and repository configured by an admin. The status route returns `configured: false` when those are missing, and the UI degrades to an "ask your admin to configure GitHub" screen — so a non-technical owner of a self-hosted HealthLog instance cannot collect feedback at all without first procuring a GitHub PAT and dedicating a repo.
+
+Verbatim from issue #73, point 6: *"Provide a simple built-in feedback system where users can submit reports without GitHub accounts, repositories, or tokens. The app should handle issue creation automatically in the background. Alternatively, provide a pre-configured default repository maintained by the developer."*
+
+We need a feedback path that **works with zero external configuration**, while keeping the existing GitHub integration available as an **optional escalation** for instance owners who do want public issues.
+
+## 2. Approach
+
+- **Primary store: Postgres.** Every submission lands in a new `Feedback` table managed by Prisma. No external dependency required.
+- **Admin inbox UI** at `/admin#feedback` lists, filters and triages submissions.
+- **GitHub stays optional and per-item.** The admin can press "Publish to GitHub issue" on any feedback row; the existing route logic in `src/app/api/bugreport/route.ts` is refactored into a reusable helper and called from the new admin endpoint. If GitHub isn't configured, the button is hidden — the rest of the flow is unaffected.
+- **v1 admin notification: email** via the existing `src/lib/notifications/dispatcher.ts` (Telegram / ntfy / web-push reuse the same dispatcher). Optional; silent if no admin channel is configured.
+- **Existing `/api/bugreport` is deprecated but kept** for two release cycles so any external automation still works. Internally it forwards to the new feedback pipeline.
+
+## 3. Data Model
+
+New Prisma model in `prisma/schema.prisma`, additive only:
+
+```prisma
+enum FeedbackCategory { BUG FEATURE_REQUEST QUESTION OTHER }
+enum FeedbackStatus   { OPEN ACK RESOLVED ARCHIVED }
+
+model Feedback {
+  id                String           @id @default(cuid())
+  userId            String?          // nullable — see auth note below
+  user              User?            @relation(fields: [userId], references: [id], onDelete: SetNull)
+  email             String?          // snapshot of submitter email at time of submission
+  category          FeedbackCategory @default(BUG)
+  subject           String           @db.VarChar(200)
+  description       String           @db.Text  // ≤ 5000 chars enforced in Zod
+  screenshotBase64  String?          @db.Text  // ≤ 5 MB; later moved to object storage
+  metadata          Json?            // { url, userAgent, locale, appVersion, viewport, timestamp }
+  status            FeedbackStatus   @default(OPEN)
+  adminNote         String?          @db.Text
+  gitHubIssueUrl    String?
+  notifiedEmail     Boolean          @default(false)
+  createdAt         DateTime         @default(now())
+  updatedAt         DateTime         @updatedAt
+
+  @@index([status, createdAt])
+  @@index([userId])
+}
+```
+
+Notes:
+- `userId` is nullable to keep the door open for anonymous public-instance submissions in a later iteration; **v1 still requires auth** (`requireAuth()`), so the column will always be populated. The `email` snapshot survives user deletion for triage continuity.
+- `metadata` is a free-form JSON envelope mirroring the same context we'd otherwise paste into a GitHub issue body — we capture it once at submission time so the admin doesn't have to ask "what page were you on?".
+- An `AuditLog` row (`feedback.submit`, `feedback.status_change`, `feedback.publish_github`) follows the existing pattern in `src/lib/auth/audit.ts`.
+
+## 4. API
+
+All routes use `apiHandler` (Wide Events + x-request-id) and return the standard `{ data, error, meta }` envelope.
+
+| Method | Path | Auth | Purpose |
+|---|---|---|---|
+| `POST` | `/api/feedback` | user | Submit feedback. Rate-limited 5/h per `user.id`. Zod-validated. Returns `{ id, confirmationNumber }`. |
+| `GET`  | `/api/admin/feedback` | admin | Paginated list. Query params: `status`, `category`, `q`, `page`, `pageSize` (default 20, cap 100). |
+| `GET`  | `/api/admin/feedback/:id` | admin | Single item with raw `metadata` and screenshot. |
+| `PATCH`| `/api/admin/feedback/:id` | admin | Mutate `status` and/or `adminNote`. Writes audit log. |
+| `POST` | `/api/admin/feedback/:id/github` | admin | Publish to GitHub. 404 if GitHub not configured. Stores `gitHubIssueUrl` on success. |
+| `GET`  | `/api/feedback/status` | user | Public capability probe: `{ available: true, githubAvailable: boolean }`. Replaces `/api/bugreport/status`'s "configured: false" wall. |
+
+`apiSuccess` payloads use `confirmationNumber = id.slice(-6).toUpperCase()` so users can quote a short code without leaking the full cuid.
+
+## 5. UI
+
+### `/bugreport` (renamed conceptually to "Feedback", URL kept)
+- **Category** dropdown (Bug / Feature request / Question / Other).
+- **Subject** input (max 120 chars, required).
+- **Description** textarea (10–5000 chars, existing constraint).
+- **Screenshot** optional, same upload control as today, ≤ 5 MB, EXIF stripped client-side before base64 encoding.
+- **Submit** — always enabled when authenticated. No more "not configured" wall.
+- On success: toast "Thanks for your feedback — reference #ABC123".
+
+### Admin section `/admin#feedback`
+- Table: created, category badge, subject, status badge, submitter, actions.
+- Filters: status (OPEN/ACK/RESOLVED/ARCHIVED), category, free-text search over `subject`/`description`.
+- Detail dialog: full description, screenshot preview, raw `metadata` JSON, admin note textarea, action buttons **Ack** / **Resolve** / **Archive** / **Publish to GitHub** (last one only when `githubAvailable`).
+- Empty states (no feedback yet, no results for filter) with translated copy.
+
+## 6. Screenshot Handling
+
+- **Storage:** base64 in the `screenshotBase64` column. Hard cap **5 MB per item** (matching the current `bugReportSchema.screenshot` limit) and a soft per-user **20 MB total quota** rejected at submit with a 413.
+- **EXIF stripping** in the browser via canvas re-encode before upload — prevents inadvertent GPS leak.
+- **PII warning** in the form copy: "Your screenshot may contain personal data. Crop it before uploading if unsure."
+- **Risk acknowledged in §13** — DB bloat is the obvious downside; v2 moves blobs to object storage.
+
+## 7. Abuse & Safety
+
+- Rate-limit via `src/lib/rate-limit.ts`: `feedback:submit:${user.id}` → 5 per rolling hour. Admin endpoints rate-limited too (`feedback:admin:${user.id}`, 60/min).
+- Description and subject are **plain text** — no HTML, no Markdown rendering on display in the admin inbox (use `<pre>` or a plain `<div>` with `whitespace-pre-wrap`). When publishing to GitHub we apply the same backtick-escape sanitization as the current bugreport route.
+- Length caps enforced in Zod and at the DB level (`@db.VarChar(200)` for subject).
+- **Auto-archive job** in `src/lib/jobs/`: daily pg-boss job marks `RESOLVED` items older than 180 days as `ARCHIVED`, and deletes `ARCHIVED` items older than 365 days. Configurable via `AppSettings`.
+- Inbox-size soft cap (e.g., 10 000 OPEN rows) surfaces a banner in the admin UI prompting cleanup.
+
+## 8. Migration
+
+- Additive Prisma migration only (new enum, new table). No existing data touched.
+- `/api/bugreport` route stays for **two release cycles**, internally calls the new feedback pipeline, and emits a `Deprecation` response header pointing to `/api/feedback`.
+- `/api/bugreport/status` keeps responding for legacy clients but its `configured` field now means "feedback works" (always `true` for authenticated users), with `hasGithub` exposed separately.
+- No data backfill required.
+
+## 9. Notifications
+
+- On a successful `POST /api/feedback`, dispatch through `src/lib/notifications/dispatcher.ts` to whichever admin channels are configured (email-first for v1; Telegram/ntfy/web-push fall out for free since they share the dispatcher).
+- Payload: category, subject, submitter username, deep link `/admin#feedback?id=...`. **No description body** in the notification — keeps PII out of email/push transports.
+- `notifiedEmail = true` after a successful send so retries don't double-fire.
+- If no channel is configured, dispatch is a no-op (logged as an info annotation, not a warning).
+
+## 10. i18n
+
+New translation namespace `feedback.*` in `messages/en.json` and `messages/de.json`:
+- Category names (`feedback.category.bug` etc.), status names, form labels, admin-inbox column headers, action button labels, empty states, toast/confirmation copy, PII warning text, deprecation banner on legacy bugreport endpoint.
+- Existing `bugreport.*` keys stay until the route is removed; new UI does not depend on them.
+
+## 11. GitHub Publish
+
+- Refactor the GitHub-issue creation in `src/app/api/bugreport/route.ts` into `src/lib/feedback/publish-github.ts` — pure function `publishToGithub(feedback): Promise<{ issueNumber, issueUrl }>`. Reused by both the deprecated bugreport route (transparently) and the new `POST /api/admin/feedback/:id/github`.
+- Idempotency: if `gitHubIssueUrl` is already set on the feedback row, return 409 with the existing URL.
+- Admin can append optional context via a textarea in the publish dialog; this is prepended to the issue body and **not** stored on the feedback row.
+
+## 12. Nyquist Validation
+
+Acceptance scenarios that must pass before sign-off:
+- Submit while logged out → 401.
+- Submit 6 times in an hour → 6th returns 429 with rate-limit headers.
+- Screenshot > 5 MB → 413, no DB row created.
+- Cumulative user quota > 20 MB → 413 with quota-specific error code.
+- Non-admin hits `/api/admin/feedback*` → 403.
+- Publish-to-GitHub round-trip: feedback row gains `gitHubIssueUrl`, repeat call returns 409.
+- Auto-archive job marks correct rows after fast-forwarding clock in test.
+- Notification dispatch is silent when no channel configured (info event, not warning).
+- Plain-text rendering verified — submitting `<script>alert(1)</script>` displays escaped in admin UI.
+- Wide Event payload includes `action.name=feedback.submit`, `meta.category`, `meta.has_screenshot`.
+
+## 13. Risks
+
+- **DB bloat from base64 screenshots.** Mitigation: per-item + per-user quotas now, object storage migration (S3/MinIO/Coolify volume) tracked as a follow-up. Schema is forward-compatible — `screenshotBase64` becomes nullable alongside a future `screenshotKey` column.
+- **Email transport coupling.** If the dispatcher fails, submission must still succeed; notifications are fire-and-forget after the DB row commits.
+- **Admin-inbox UX scaling** past a few hundred items needs server-side filtering (already in the API spec).
+
+## 14. Out of Scope
+
+- User-to-user comment threads on feedback items.
+- Voting / upvoting feedback.
+- Public read-only feedback board.
+- Anonymous (logged-out) submissions — schema-ready, intentionally not enabled in v1.
+- Importing existing GitHub issues back into the inbox.
+
+## 15. Effort
+
+**M** — one Prisma migration, ~6 new API routes (most thin), one form refactor, one new admin section, refactor of existing GitHub call into a helper, dispatcher hookup, one pg-boss job, ~30 i18n keys × 2 locales.

docs/superpowers/specs/2026-04-18-custom-thresholds-design.md

@@ -0,0 +1,227 @@
+# User-Configurable Health Thresholds — Design Spec
+
+**Datum:** 2026-04-18
+**Status:** Draft
+**Scope:** Per-user override layer for the metric target ranges currently rendered on `/targets` and used across analytics.
+
+## 1. Problem
+
+HealthLog computes target ranges from established medical guidelines:
+
+- Weight from BMI 18.5–24.9 (WHO) via `getWeightRange` / `buildWeightBandsFromHeight`
+- BP targets age-personalized per ESC/ESH 2018 (`bp-targets.ts`, `getBpTargetsByAge`)
+- Pulse from CDC/NCHS percentiles or AHA fallback (`pulse-targets.ts`)
+- Body fat from ACE thresholds (`classifyBodyFat`)
+- Sleep duration from AASM/SRS (`getSleepDurationRange`)
+- Steps from WHO (`getStepsRange`)
+
+These are sane defaults, but real patients receive **doctor-recommended individual targets**. A diabetic with autonomic neuropathy may have a BP target of 110/65–135/80; a marathoner may have a personal "green" pulse band of 38–55 that the AHA bands flag as bradycardia; a recovering anorexia patient may have a clinically supervised weight floor above the BMI-18.5 line. Today the UI exposes computed ranges with **no override mechanism**, and analytics, alerts, and the doctor-report PDF all silently use the guideline values.
+
+## 2. Why (User Intent)
+
+- Users may have doctor-recommended personalized targets that differ from the default ESC/ESH / WHO / AHA guidelines.
+- Current UI shows computed defaults with no override mechanism.
+- User wants a dedicated settings page where thresholds can be overridden per metric, with the default still visible for comparison and one-click reset.
+
+## 3. Requirements
+
+1. **Per-metric override** for the full set: `WEIGHT` (min/max), `BLOOD_PRESSURE_SYS` (low/high), `BLOOD_PRESSURE_DIA` (low/high), `PULSE` (min/max), `BODY_FAT` (min/max), `SLEEP_DURATION` (min/max in hours), `ACTIVITY_STEPS` (min/max). Reserve slots for `BLOOD_GLUCOSE_FASTING` and `BLOOD_GLUCOSE_POSTPRANDIAL` even though they are not yet measured — the schema should not need a migration when the metric ships.
+2. **Optional yellow zone**: each metric may carry a separate `warnMin/warnMax` (orange band) in addition to `min/max` (green band). Falls back to the default's orange computation (currently `±30%` span via `buildTrafficRange`) if absent.
+3. **Comparable to default**: every UI surface that renders a range must be able to show "Default: X / Your override: Y" — the API therefore returns `defaults`, `overrides`, and `effective` together.
+4. **Reset to default per metric** — single-click, no confirm needed unless overrides existed (see §11).
+5. **Source-of-truth precedence**: `effective = override ?? default(profile)`. Default still recomputes when profile (height, age, gender) changes, so users who never override see no change in behavior.
+6. **Server-side validation** — overrides must satisfy `min < max`, sit within hard sanity bounds, and pass plausibility checks (out-of-normal-range warns, see §11).
+7. **All consumers must use one helper** — no analytics module should call the raw default-computer directly anymore (see §6).
+8. **Audit trail** for every change (medical data, see §8).
+
+## 4. Data Model
+
+### Decision: JSON column on `User`, not a new table
+
+Two options were considered:
+
+**Option A — `UserThreshold` table** (one row per user/metric):
+- Pro: query-friendly, easy partial indexes, future reporting per metric.
+- Con: 9+ rows per user for a feature that is read together every page load; joins on every targets fetch; migration friction when adding metrics.
+
+**Option B — JSON column on `User`** (`thresholdsJson Json?`):
+- Pro: read-with-user is one row, atomic write, schema-less for new metrics, mirrors Prisma 7 / Postgres `jsonb` strengths, validated by Zod at the application layer.
+- Con: cannot index individual thresholds in the DB (acceptable — there is no use case for "find all users whose pulse cap > 110").
+
+**Choose Option B.** A `UserSetting` model does not currently exist, so we add the column directly to `User`:
+
+```
+// prisma/schema.prisma — additive
+model User {
+  ...
+  thresholdsJson Json? @map("thresholds_json")
+}
+```
+
+### JSON shape (TypeScript, source of truth in `src/lib/validations/thresholds.ts`)
+
+```ts
+type ThresholdOverride = {
+  min?: number;
+  max?: number;
+  warnMin?: number;   // optional yellow zone lower bound
+  warnMax?: number;   // optional yellow zone upper bound
+  updatedAt: string;  // ISO-8601, set server-side on every PUT
+};
+
+type ThresholdsJson = {
+  WEIGHT?: ThresholdOverride;
+  BLOOD_PRESSURE_SYS?: ThresholdOverride;
+  BLOOD_PRESSURE_DIA?: ThresholdOverride;
+  PULSE?: ThresholdOverride;
+  BODY_FAT?: ThresholdOverride;
+  SLEEP_DURATION?: ThresholdOverride;
+  ACTIVITY_STEPS?: ThresholdOverride;
+  BLOOD_GLUCOSE_FASTING?: ThresholdOverride;     // reserved
+  BLOOD_GLUCOSE_POSTPRANDIAL?: ThresholdOverride; // reserved
+};
+```
+
+An override is "active" when `min` and `max` are both numbers; partial-only objects are rejected by Zod. Absence of a key === use default.
+
+## 5. API
+
+### `GET /api/user/thresholds`
+
+Response (envelope `{ data, error, meta }`):
+```
+data: {
+  defaults:  { WEIGHT: { min, max, warnMin, warnMax, source }, ... },
+  overrides: { PULSE:  { min, max, warnMin?, warnMax?, updatedAt }, ... },
+  effective: { WEIGHT: { min, max, warnMin, warnMax, isOverride: false }, ... },
+  profile:   { heightCm, age, gender }
+}
+```
+`defaults` is always populated (even for metrics the user has not measured, so the UI can render an empty slot with the default visible). `overrides` only contains keys the user has actually customized. `effective` is the merged result every analytics consumer should think in.
+
+### `PUT /api/user/thresholds`
+
+Body: partial map of metric → override (Zod-validated). Replaces only the listed metrics; unspecified keys are untouched.
+```
+{ "PULSE": { "min": 50, "max": 95 },
+  "BLOOD_PRESSURE_SYS": { "min": 110, "max": 130, "warnMin": 105, "warnMax": 140 } }
+```
+Per-metric Zod rules (`src/lib/validations/thresholds.ts`):
+- `min < max`
+- if `warnMin` set: `warnMin <= min`; if `warnMax` set: `warnMax >= max`
+- hard sanity bounds (reject obviously broken input):
+  - `WEIGHT`: 30–300 kg
+  - `BLOOD_PRESSURE_SYS`: 70–220 mmHg
+  - `BLOOD_PRESSURE_DIA`: 40–140 mmHg
+  - `PULSE`: 30–220 bpm
+  - `BODY_FAT`: 3–60 %
+  - `SLEEP_DURATION`: 3–14 h
+  - `ACTIVITY_STEPS`: 0–50000
+  - `BLOOD_GLUCOSE_FASTING`: 50–250 mg/dL
+  - `BLOOD_GLUCOSE_POSTPRANDIAL`: 70–350 mg/dL
+- soft "out-of-normal-range" check returns a Zod warning (not error) — surfaced to the UI to trigger the confirm dialog (see §11).
+
+### `DELETE /api/user/thresholds/:metric`
+
+Removes one key from `thresholdsJson`. Returns the new `effective` block so the client can refresh without a second roundtrip.
+
+All three routes are wrapped by `apiHandler` and `requireAuth()`, log Wide Events, and emit AuditLog entries (§8).
+
+## 6. Integration Points
+
+A single helper becomes the only public entry for "what is the target range":
+
+```
+src/lib/analytics/effective-range.ts
+  getEffectiveRange(metric, user, overrides?) → { min, max, warnMin, warnMax, source, isOverride }
+```
+
+It internally calls the existing default computers (`getWeightRange`, `getBpTargets`, `getPersonalizedPulseTarget`, `classifyBodyFat`'s table, `getSleepDurationRange`, `getStepsRange`) and applies any matching override. `source` becomes `"User override"` when `isOverride === true`, otherwise the existing guideline string.
+
+Refactor in scope:
+- `src/lib/analytics/classifications.ts` — `classifyBP`, `classifyPulse`, `classifyBodyFat`, `classifySleepDuration`, `classifySteps`, `getWeightRange`, `getPulseRange`, `getSleepDurationRange`, `getBpTargetsByAge`: keep as pure default computers, but stop being called from feature code. Add thin `classifyXWithRange(value, range)` variants that take the resolved range.
+- `src/lib/analytics/value-bands.ts` — `buildTrafficRange` and `buildWeightBandsFromHeight` accept an optional `override` argument and prefer it over the BMI-derived band.
+- `src/lib/analytics/pulse-targets.ts` — `getPersonalizedPulseTarget` stays as the default; new `resolvePulseTarget(user, overrides)` lives in `effective-range.ts`.
+- `src/lib/analytics/bp-targets.ts` — `getBpTargets` likewise stays; `effective-range.ts` wraps it.
+- `src/app/api/insights/targets/route.ts` (the API behind `/targets`) reads `thresholdsJson` once and passes it to `getEffectiveRange` per metric, then returns the `effective` block to the client. The `source` field already shown on `TargetCard` flips to "User override" automatically.
+- Doctor-report PDF (`src/lib/doctor-report-pdf.ts`) and Wide-Event annotations include `isOverride` so reports clearly mark customized targets.
+
+## 7. Migration
+
+Additive only — single Prisma migration adds `users.thresholds_json jsonb`. Existing users get `NULL`, which `getEffectiveRange` treats as "no overrides → behave exactly as before". No data backfill, no flag rollout.
+
+## 8. Auditing
+
+Every `PUT` and `DELETE` writes one `AuditLog` row (model already exists at `prisma/schema.prisma:391`):
+
+- `action`: `"thresholds.update"` or `"thresholds.reset"`
+- `details` (JSON string): `{ metric, before: {min,max,warnMin,warnMax} | null, after: {...} | null, reason?: "user" | "out_of_range_confirmed" }`
+- `userId`, `ipAddress`, `location` from session context (already populated by `apiHandler`).
+
+The `before` value is read from the current `thresholdsJson` *or* the computed default (so the audit trail captures the implicit baseline a user customized away from). Reset writes `after: null`.
+
+## 9. i18n Keys
+
+New section under `messages/en.json` and `messages/de.json`:
+
+| Key | EN | DE |
+|---|---|---|
+| `thresholds.title` | "Custom thresholds" | "Eigene Zielwerte" |
+| `thresholds.intro` | "Override the medical default ranges with values your doctor recommended. Defaults stay visible for comparison and you can reset any metric to the guideline at any time." | "Ersetze die medizinischen Standardbereiche durch arztempfohlene Werte. Die Standardwerte bleiben sichtbar und du kannst jeden Wert jederzeit auf die Leitlinie zurücksetzen." |
+| `thresholds.defaultLabel` | "Default" | "Standard" |
+| `thresholds.overrideLabel` | "Your override" | "Eigener Wert" |
+| `thresholds.enableToggle` | "Use custom value" | "Eigenen Wert verwenden" |
+| `thresholds.warnZoneLabel` | "Yellow zone (optional)" | "Gelber Bereich (optional)" |
+| `thresholds.minLabel` | "Min" | "Min" |
+| `thresholds.maxLabel` | "Max" | "Max" |
+| `thresholds.resetButton` | "Reset to default" | "Auf Standard zurücksetzen" |
+| `thresholds.resetPrompt` | "Reset {metric} to the medical default?" | "{metric} auf den medizinischen Standardwert zurücksetzen?" |
+| `thresholds.saved` | "Thresholds saved" | "Zielwerte gespeichert" |
+| `thresholds.outOfRangeWarn` | "This value lies outside the typical medical range. Please confirm only if your doctor recommended it." | "Dieser Wert liegt außerhalb des üblichen medizinischen Bereichs. Bitte nur bestätigen, wenn dein Arzt das empfohlen hat." |
+| `thresholds.notMedicalAdvice` | "HealthLog does not provide medical advice. Custom thresholds are stored as-is." | "HealthLog ersetzt keine ärztliche Beratung. Eigene Zielwerte werden unverändert gespeichert." |
+| `thresholds.validation.minLessMax` | "Min must be less than max" | "Min muss kleiner als Max sein" |
+| `thresholds.validation.warnEnvelope` | "Yellow zone must surround the green zone" | "Der gelbe Bereich muss den grünen Bereich umschließen" |
+| `thresholds.validation.outOfBounds` | "Value outside allowed range ({min}–{max} {unit})" | "Wert außerhalb des erlaubten Bereichs ({min}–{max} {unit})" |
+
+Existing `targets.*` keys stay; the targets page gains a small "Customize" link routing to `/settings#thresholds`.
+
+## 10. UI
+
+New section in the existing settings shell at `/settings#thresholds`:
+
+- One card per metric. Header shows the metric label + icon (reuses `TYPE_ICONS` from `targets/page.tsx`).
+- Body left: read-only "Default: 60 – 100 bpm" with the source citation (same external link logic as `getTargetSourceLink`).
+- Body right: an "Use custom value" toggle. When on, two number inputs (min, max) plus an optional collapsible "Yellow zone" with `warnMin`/`warnMax`.
+- Inline validation via React Hook Form + Zod (the same schema the server uses).
+- Footer: "Reset to default" button (visible only when an override exists).
+- Out-of-range soft warnings render as an inline orange callout with a "I confirm my doctor recommended this" checkbox required to enable Save.
+- Persistent disclaimer banner at the top: `thresholds.notMedicalAdvice`.
+
+## 11. Nyquist Validation (tests in `src/lib/analytics/__tests__/effective-range.test.ts` and route tests)
+
+- `getEffectiveRange` returns the override when present and the default when absent (one test per metric).
+- Boundary tests: `min === max` rejected; `warnMin === min` accepted; off-by-one above/below the hard sanity bounds rejected/accepted.
+- Profile-change test: removing `heightCm` collapses the WEIGHT default to "no range", but a present override survives.
+- API contract: `GET` returns `defaults`, `overrides`, `effective`, `profile`. `PUT` with partial body leaves untouched metrics intact. `DELETE :metric` removes only that key.
+- AuditLog firing: spy that one row is written per `PUT`/`DELETE`, with correct `before`/`after`. Confirm `details` JSON parses.
+- Out-of-range confirmation: PUT with a value flagged "out_of_normal_range" requires `?confirm=1` query param (or a body flag) — without it the route returns `400 confirmation_required`.
+- i18n parity test: every new EN key has a DE counterpart (re-uses the existing parity test if present, else add).
+
+## 12. Risks & Mitigations
+
+- **Users set unhealthy targets.** Hard sanity bounds reject obvious nonsense; soft "out-of-normal-range" warns and demands explicit confirmation. Persistent banner ("not medical advice"). Audit trail enables forensic review.
+- **Insights/AI prompts may quote a user-customized range as if it were the medical guideline.** The provider prompts must receive the `source` field and explicitly distinguish "User override" from a guideline citation. Update `src/lib/ai/prompts/*` accordingly.
+- **Doctor-report PDF.** Mark each customized range with a small "(custom)" tag so a treating physician sees that the report's coloring reflects the patient's own targets, not the guideline.
+- **Default drift over time.** If we update guidelines (e.g. ESC/ESH 2024), users with overrides are unaffected — but users without overrides will see their colored bands shift. Document in the changelog.
+
+## 13. Out of Scope
+
+- Sharing thresholds between users / household.
+- Doctor export of overrides (a treating physician downloading the override JSON to reuse) — could come later as part of the doctor report.
+- Time-bounded thresholds ("until 2026-12-31"), seasonal thresholds, schedule-based thresholds.
+- Per-medication or per-condition threshold packs.
+- Threshold suggestions from AI insights.
+
+## 14. Effort
+
+**M (medium).** One Prisma migration, one new helper module, three new API routes, refactoring of ~5 analytics consumers to go through `getEffectiveRange`, one new settings card, ~14 i18n keys per locale, and one new test file. No external integrations, no UI primitive work (existing shadcn `Card`/`Input`/`Switch`/`Button` cover everything). Estimated 1.5–2 focused days for a senior dev including tests and audit-log wiring.

docs/superpowers/specs/2026-04-18-dashboard-customization-design.md

@@ -0,0 +1,117 @@
+# Dashboard Customization — Design Spec
+
+**Status:** Proposed (v1.2+)
+**Date:** 2026-04-18
+**Owner:** TBD
+
+## Why
+
+- Users have different health focus areas. Someone not tracking blood pressure shouldn't see an empty BP card.
+- Current "hide if no data" rule (`showBodyFatCard = (bf?.count ?? 0) > 0`, etc. in `src/app/page.tsx`) is implicit — users can't pin the cards they care about, and a card vanishes the moment they delete the last entry.
+- This is for a v1.2+ release, not part of the current bugfix push.
+
+## 1. Problem Statement
+
+The dashboard at `src/app/page.tsx` renders a fixed set of trend cards and charts (weight, BP sys/dia, pulse, body fat, mood, BMI) in a hard-coded order. Visibility is implicit (derived from data presence), ordering is non-negotiable. Narrowly-focused users carry visual noise; users with strong preferences cannot reorder. We need explicit, server-persisted, per-user control over which widgets appear and in what order.
+
+## 2. Requirements
+
+- **Per-user widget visibility.** Each chart and trend card is a "widget" that the user can show or hide independently.
+- **Widget ordering — list-based reorder with up/down buttons + numeric position.** Defended below.
+- **"Reset to defaults" action** that restores the v1.0 behavior (everything visible, default order).
+- **Server-persisted** so settings follow the user across devices (web + PWA on phone). localStorage only acts as an optimistic cache.
+- **i18n-friendly.** Widget IDs are stable English keys; display labels resolve through existing `dashboard.*` translation keys (`messages/en.json`, `messages/de.json`).
+
+**Reorder UX choice:** list-based (up/down arrows) over drag-and-drop. Reasons: (a) mobile-first PWA — drag-on-touch with scroll containers is fragile; (b) keyboard/screen-reader accessible by default; (c) no extra dep (`@dnd-kit` ~30 KB). DnD can be added later behind a flag.
+
+## 3. Data Model
+
+**Decision: extend `User` with a `dashboardWidgets Json?` column.** No new table.
+
+```prisma
+model User {
+  // ...
+  dashboardWidgets Json? @map("dashboard_widgets")
+}
+```
+
+Shape (validated by Zod on read/write):
+```ts
+type DashboardWidgetState = {
+  version: 1;
+  widgets: Array<{ id: WidgetId; visible: boolean; order: number }>;
+};
+```
+
+`WidgetId` is a string-literal union seeded from a server-side registry (`src/lib/dashboard/widgets.ts`):
+`"weight" | "bp" | "pulse" | "body_fat" | "mood" | "bmi"`.
+
+**Tradeoffs vs. dedicated `DashboardWidget` model:** JSON wins because the widget set is small (<20 forecast), state is read once per dashboard load, and we never need to query "which users hide widget X." A table would cost a migration + FK + N writes per reorder for ~6 rows, with no queryability payoff. Cost: schema drift risk — mitigated by the Zod gate and the `version` field, which lets us evolve the shape without a SQL migration.
+
+## 4. API
+
+Two routes under `src/app/api/dashboard/widgets/route.ts`, both wrapped in `apiHandler` and `requireAuth()`.
+
+**`GET /api/dashboard/widgets`** — returns merged state (stored values overlaid on the registry; new widgets appear at the end with `visible: true`):
+```json
+{ "data": { "version": 1, "widgets": [
+  { "id": "weight", "visible": true, "order": 0 },
+  { "id": "mood",   "visible": false, "order": 5 }
+]}, "error": null, "meta": {...} }
+```
+
+**`PUT /api/dashboard/widgets`** — replaces full state. Zod schema in `src/lib/validations/dashboard.ts`:
+```ts
+const dashboardWidgetsSchema = z.object({
+  version: z.literal(1),
+  widgets: z.array(z.object({
+    id: z.enum(WIDGET_REGISTRY.map(w => w.id)),
+    visible: z.boolean(),
+    order: z.int().min(0),
+  })).min(1),
+}).refine(s => new Set(s.widgets.map(w => w.id)).size === s.widgets.length);
+```
+Unknown IDs and duplicates are rejected. Mutations invalidate `queryKeys.dashboardLayout()`.
+
+**`DELETE /api/dashboard/widgets`** — clears the column → user gets defaults again ("Reset to defaults").
+
+## 5. UI
+
+**Location:** new section in `/settings` named **"Dashboard"** (matches existing settings architecture: Profile, Notifications, Integrations, etc.). Plus a small **"Customize"** icon button on the dashboard header next to the "Add" dropdown that deep-links to `/settings/dashboard`.
+
+**Flow** (settings page):
+1. Header "Dashboard widgets" + subhead "Choose which cards and charts appear on your dashboard."
+2. Ordered list of shadcn `Card` rows — translated label (`t("dashboard.weight")`), short description, `Switch` for visibility, `ChevronUp`/`ChevronDown` reorder buttons (disabled at list ends).
+3. Sticky footer: outline "Reset to defaults" (confirm via `AlertDialog`) + primary "Save" (disabled until dirty).
+4. Optimistic update via TanStack Query mutation; on error, rollback + toast.
+
+**Dashboard read path:** `src/app/page.tsx` becomes a thin orchestrator — fetch layout via `useQuery(queryKeys.dashboardLayout())`, sort by `order`, filter `visible`, render through a `<DashboardWidget id="…" />` switch. Existing data-presence guards stay as a safety net.
+
+## 6. Migration
+
+- Prisma migration: `ALTER TABLE users ADD COLUMN dashboard_widgets jsonb`.
+- No backfill. Null = "use defaults" = the v1.0 behavior frozen as `DEFAULT_LAYOUT` constant in `src/lib/dashboard/widgets.ts`. The `GET` endpoint synthesizes this on the fly.
+- First save writes the full normalized blob.
+- Existing users see no change until they open settings.
+
+## 7. Nyquist Validation Criteria
+
+- **Vitest:** Zod rejects duplicate IDs, unknown IDs, negative order, missing version.
+- **Vitest:** layout merger appends new registry widgets with `visible: true` when user state predates them.
+- **Vitest:** `DELETE` then `GET` returns `DEFAULT_LAYOUT`.
+- **API integration:** unauth `PUT` → 401; valid `PUT` → 200 + persisted; payload >50 KB → 413.
+- **Manual UAT:** hide BP on desktop → reload on phone PWA → BP gone. Reorder weight to last → reload → still last. Reset → defaults restored.
+- **A11y:** keyboard nav on reorder buttons, `aria-label` on Up/Down, screen-reader announces position changes.
+- **Perf:** dashboard initial render does not regress (React Profiler check).
+
+## 8. Out of Scope
+
+- Custom user-defined widgets / per-widget chart config (color, range, time window).
+- Widgets for future measurement types (blood glucose, SpO2, sleep stages, steps) — added to registry when those features ship.
+- Multiple dashboards or tabs; sharing layouts between users.
+- Drag-and-drop reorder (revisit if list UX gets complaints).
+- Per-widget grid size (1x/2x spans).
+
+## 9. Estimated Effort
+
+**M** — roughly 1–2 days. Schema + Zod + registry ~2h, API + tests ~3h, Settings UI ~4h, dashboard refactor ~3h, i18n + polish + UAT ~2h.

docs/superpowers/specs/2026-04-18-multi-provider-ai-design.md

@@ -0,0 +1,216 @@
+# Multi-provider AI Insights — Design Spec
+
+**Date:** 2026-04-18
+**Status:** Draft
+**Scope:** Add Anthropic Claude and self-hosted (OpenAI-compatible) LLM endpoints alongside the existing OpenAI / ChatGPT Codex providers. Per-user provider choice, admin-level fallback, encrypted credential storage.
+
+## 1. Problem
+
+Today HealthLog can only talk to OpenAI — either the user's ChatGPT subscription via Codex OAuth, or an admin-managed OpenAI API key. That ties insight generation to a single vendor and to the public internet.
+
+> "I'd like to pick my provider per user. OpenAI for some accounts, Claude for me, and on my home server I want to point HealthLog at a local Ollama instance — none of my BP readings should leave the LAN."
+> — User intent
+
+Consequences of the single-vendor model:
+- No way to use Anthropic Claude despite better medical-reasoning answers.
+- Privacy-sensitive users (BP, mood, medication) have no on-prem option.
+- Vendor outages or quota exhaustion bring all insights down (already observed with OpenAI quota).
+
+## 2. Current state
+
+`src/lib/ai/provider.ts` exposes `resolveProvider(userId)` returning an `AIProvider`. The contract in `src/lib/ai/types.ts` is small and provider-agnostic:
+
+```ts
+export type ProviderType = "codex" | "admin-key" | "none";
+export interface AIProvider {
+  type: ProviderType;
+  generateCompletion(params: CompletionParams): Promise<CompletionResult>;
+}
+export interface CompletionParams {
+  systemPrompt: string;
+  userPrompt: string;
+  temperature?: number;
+  maxTokens?: number;
+}
+export interface CompletionResult {
+  content: string;
+  tokensUsed: number | null;
+  model: string;
+  providerType: ProviderType;
+}
+```
+
+Implementations: `OpenAIClient` (Chat Completions, `response_format: json_object`, captures upstream body excerpt for diagnostics), `CodexClient` (chatgpt.com Responses API with refresh-on-401). Selection is hard-coded: Codex if connected, else admin OpenAI key, else `NoProvider`.
+
+What needs to change:
+- Widen `ProviderType` to include `anthropic` and `local`.
+- Add per-user provider choice (currently only Codex is per-user).
+- Add per-user model + base-URL + API key fields, mirrored on `AppSettings`.
+- Two new clients (`AnthropicClient`, `LocalOpenAICompatibleClient`).
+- New selection function that honors user preference before admin defaults.
+
+## 3. Target abstraction
+
+The `AIProvider` interface stays exactly as-is. New concrete clients implement it without touching call-sites in `src/app/api/insights/*`.
+
+```
+ProviderType = "codex" | "openai" | "anthropic" | "local" | "admin-key" | "none"
+```
+(`"admin-key"` retained for back-compat with already-cached `InsightResult.providerType` strings.)
+
+Selection order in `resolveProvider(userId)`:
+1. **User explicit choice** (`User.aiProvider`) with valid credentials.
+2. **Codex OAuth** if user picked `CHATGPT_OAUTH` and tokens are present (existing path).
+3. **Admin default** (`AppSettings.adminAiProvider` + admin key) for users with no personal config.
+4. **`NoProvider`** — surface a clear error to the route handler.
+
+The function is the single boundary: every call that needs an LLM goes through it. No client is constructed elsewhere.
+
+## 4. Data model
+
+`User` model additions (all nullable; user keeps current behaviour until they opt in):
+
+```prisma
+aiProvider                String?  @map("ai_provider")               // OPENAI | ANTHROPIC | LOCAL | CHATGPT_OAUTH
+aiModel                   String?  @map("ai_model")                  // e.g. claude-sonnet-4-6
+aiBaseUrl                 String?  @map("ai_base_url")               // local endpoint
+aiOpenAiKeyEncrypted      String?  @map("ai_openai_key_encrypted")
+aiAnthropicKeyEncrypted   String?  @map("ai_anthropic_key_encrypted")
+aiLocalKeyEncrypted       String?  @map("ai_local_key_encrypted")    // optional bearer for local
+```
+
+`AppSettings` mirrors:
+
+```prisma
+adminAiProvider             String   @default("OPENAI") @map("admin_ai_provider")
+adminAiAnthropicKeyEncrypted String? @map("admin_ai_anthropic_key_encrypted")
+adminAiAnthropicModel        String? @default("claude-sonnet-4-6") @map("admin_ai_anthropic_model")
+adminAiLocalBaseUrl          String? @map("admin_ai_local_base_url")
+adminAiLocalKeyEncrypted     String? @map("admin_ai_local_key_encrypted")
+adminAiLocalModel            String? @map("admin_ai_local_model")
+```
+
+The existing `adminAiKeyEncrypted` / `adminAiModel` / `adminAiBaseUrl` fields stay and represent the OpenAI configuration. One Prisma migration adds the columns; existing users have `aiProvider = NULL` and route through admin default exactly like today.
+
+## 5. New clients
+
+### AnthropicClient
+- `POST {baseUrl}/v1/messages` with `x-api-key` and `anthropic-version: 2023-06-01`.
+- `system` parameter for `params.systemPrompt`; `messages: [{ role: "user", content: params.userPrompt }]`.
+- Structured JSON via **tool use**: declare a single `record_insight` tool whose `input_schema` mirrors `insightResultSchema`. Set `tool_choice: { type: "tool", name: "record_insight" }`. Read JSON from the `tool_use` block's `input` and serialize to a string for `CompletionResult.content`.
+- Prompt caching: send the system prompt with `cache_control: { type: "ephemeral" }`. Insights re-run the same multi-paragraph medical preamble per metric — empirically ~90% cost reduction on cached reads.
+- Tokens: sum `usage.input_tokens + usage.output_tokens` (incl. `cache_read_input_tokens`).
+- Errors: capture body excerpt like `OpenAIClient` already does, scrub any `sk-ant-...` substrings before logging.
+
+Default models (selectable in UI):
+- `claude-sonnet-4-6` (default — quality / cost balance)
+- `claude-opus-4-7` (highest quality)
+- `claude-haiku-4-5` (cheap, fast)
+
+### LocalOpenAICompatibleClient
+- Same wire format as `OpenAIClient` (`/chat/completions`, optional `Authorization: Bearer ...` only if a key is set).
+- `baseUrl` is required and user-configurable (e.g. `http://localhost:11434/v1` for Ollama, `http://lm-studio.lan:1234/v1`).
+- Some local backends reject `response_format: { type: "json_object" }`. Strategy: feature-detect on first failure (HTTP 400 with body containing `response_format`), persist `User.aiLocalSupportsJsonMode = false`, and re-issue without the field. Append `"Return JSON only, no prose."` to the user prompt and run output through `jsonrepair` before `JSON.parse`.
+- No-telemetry mode: never set `User-Agent` beyond `HealthLog/local`, never include user IDs in headers, do not send the request body to Wide Event annotation when provider is `local` (only `model`, `latencyMs`, `tokensUsed`).
+
+## 6. UI — `/settings#ai`
+
+Single dropdown `aiProvider` with options OpenAI / Anthropic Claude / Local LLM / ChatGPT (OAuth). Conditional fields:
+
+| Provider     | Visible fields                                                  |
+| ------------ | --------------------------------------------------------------- |
+| OpenAI       | API key, model (default `gpt-4o-mini`)                          |
+| Anthropic    | API key, model dropdown (sonnet/opus/haiku)                     |
+| Local        | Base URL, model name, optional API key, "Disable JSON mode" hint |
+| ChatGPT OAuth| Existing Codex connect button                                   |
+
+Each provider section has a **Test connection** button that POSTs to `/api/insights/test` with a tiny prompt (`"Reply with {\"ok\":true}"`), surfacing the upstream status + body excerpt on failure.
+
+Admin settings page gains the same dropdown for the global default plus an explanatory note: *"Used only for users who have not configured their own provider."*
+
+## 7. Backward compatibility
+
+- Migration is additive — no column drops, no data rewrites.
+- `User.aiProvider IS NULL` ⇒ behave exactly as today (Codex if connected, else admin OpenAI).
+- `CompletionResult.providerType = "admin-key"` continues to be emitted by `OpenAIClient` so cached insights and analytics dashboards keep working. New clients use new strings.
+- Existing tests in `src/lib/ai/__tests__` keep passing; new tests are additive.
+
+## 8. Error handling
+
+Each client follows the `OpenAIClient` pattern: capture up to 500 chars of the upstream body, attach `{ httpStatus, upstream, model }` to the thrown `Error`, let `apiHandler` log it as a Wide Event. Per-provider mapping in `src/lib/ai/errors.ts`:
+
+| Upstream                                | User-facing message (i18n key)            |
+| --------------------------------------- | ----------------------------------------- |
+| Anthropic 401 / `invalid_api_key`       | `insights.error.anthropicInvalidKey`      |
+| Anthropic 429 / `rate_limit_error`      | `insights.error.anthropicRateLimited`     |
+| Anthropic 529 / `overloaded_error`      | `insights.error.anthropicOverloaded`      |
+| Local fetch ECONNREFUSED                | `insights.error.localUnreachable`         |
+| Local 400 mentioning `response_format`  | auto-retry once, then `insights.error.localNoJsonMode` |
+| OpenAI 429 `insufficient_quota`         | existing key                              |
+
+## 9. Internationalisation
+
+New keys (EN + DE) under `settings.ai.*` and `insights.error.*`:
+
+```
+settings.ai.providerLabel               "AI Provider" / "KI-Anbieter"
+settings.ai.providerOpenAI              "OpenAI"
+settings.ai.providerAnthropic           "Anthropic Claude"
+settings.ai.providerLocal               "Local LLM"
+settings.ai.providerChatGptOAuth        "ChatGPT (OAuth)"
+settings.ai.baseUrlLabel                "Endpoint URL" / "Endpunkt-URL"
+settings.ai.baseUrlHint.local           "z.B. http://localhost:11434/v1"
+settings.ai.modelLabel                  "Model" / "Modell"
+settings.ai.testConnection              "Test connection" / "Verbindung testen"
+settings.ai.testSuccess                 "Connection OK ({model}, {ms} ms)"
+settings.ai.testFailure                 "Failed: {detail}"
+settings.ai.localPrivacyNote            "Requests stay on your network. Bodies are not logged."
+insights.error.anthropicInvalidKey      "Anthropic key rejected. Check Settings → AI."
+insights.error.anthropicRateLimited     "Anthropic rate-limited. Try again shortly."
+insights.error.anthropicOverloaded      "Anthropic is overloaded. Try again in a minute."
+insights.error.localUnreachable         "Local LLM endpoint not reachable: {url}"
+insights.error.localNoJsonMode          "Local model rejected JSON mode — falling back to text parsing."
+```
+
+## 10. Security
+
+- All keys stored via existing AES-256-GCM helpers in `src/lib/crypto.ts`. Never persist plaintext.
+- Anthropic keys begin with `sk-ant-`. The Wide Event redactor (`src/lib/logging/event-builder.ts`) gets a regex `/sk-ant-[A-Za-z0-9_\-]{20,}/g` → `"sk-ant-***"` applied to all `externalCalls[].errorBody`.
+- Local provider runs with `next/server` `fetch` against arbitrary URLs — validate that `aiBaseUrl` parses as `http`/`https`, reject `file://`, `data://`, and (in production) bare IPs in private ranges *unless* `LOCAL_LLM_ALLOW_PRIVATE=true` (default true on self-hosted, false on `apps-01` build).
+- Test-connection endpoint is `requireAuth` and rate-limited (5 req/min/user) to prevent SSRF probing.
+- Admin keys remain admin-only via `requireAdmin()`.
+
+## 11. Nyquist validation
+
+- **Unit (Vitest)** — one `*.test.ts` per new client, mocking `fetch`:
+  - `anthropic-client.test.ts`: success path returns parsed JSON from tool_use; 401 maps to error; cache_control header present.
+  - `local-client.test.ts`: success path; auto-retry on `response_format` 400; ECONNREFUSED handled; bearer header omitted when no key.
+- **Integration** — extend `provider.test.ts`:
+  - User with `aiProvider = ANTHROPIC` and key → returns `AnthropicClient`.
+  - User with no preference falls back to admin default of each kind.
+  - Codex still wins when user picks `CHATGPT_OAUTH` and is connected.
+- **End-to-end smoke** — manual: switch provider in `/settings#ai`, hit `/api/insights/general-status`, verify `providerType` in cached `InsightResult`.
+
+## 12. Risks & mitigations
+
+- **Admin changes default provider, breaks users.** Mitigated by precedence rule: any user with `aiProvider != NULL` is unaffected. Migration backfills nothing — admin only impacts opted-out users.
+- **Local model returns malformed JSON.** Two-layer defence: tool-use where supported, `jsonrepair` fallback otherwise; on persistent failure surface `dataQuality.confidence = "gering"` and the raw text in a debug field.
+- **Cached insight from old provider.** Cache key already includes `providerType`; switching provider invalidates naturally on next generate.
+- **Anthropic prompt-caching cost regression** if system prompt is rebuilt per request without cache_control. Mitigation: emit a Wide Event metric `ai.cache_read_tokens` and add a Grafana panel.
+
+## 13. Out of scope
+
+- Vendor-specific features beyond JSON output (Anthropic citations, OpenAI function-calling tool registries, Google Gemini).
+- Streaming responses to the UI (insights are batch-generated).
+- Multi-region routing or load-balancing across providers.
+- Per-metric provider override (one provider per user, applied to all metrics).
+- Cost dashboards beyond the existing `tokensUsed` field.
+
+## 14. Effort
+
+**M–L.** ~2 days dev:
+- 0.5d schema migration + `resolveProvider` rewrite + types.
+- 0.5d `AnthropicClient` (tool-use, caching, errors).
+- 0.5d `LocalOpenAICompatibleClient` + JSON-mode feature detection + jsonrepair.
+- 0.25d settings UI + test-connection endpoint.
+- 0.25d i18n + tests + docs.

messages/de.json

@@ -36,7 +36,92 @@
     "replace": "Ersetzen",
     "add": "Hinzufügen",
     "import": "Importieren",
-    "test": "Test"
+    "test": "Test",
+    "reset": "Zurücksetzen",
+    "copy": "Kopieren",
+    "copyDetails": "Details kopieren",
+    "retry": "Erneut versuchen",
+    "reportIssue": "Fehler melden"
+  },
+  "doctorReport": {
+    "title": "Gesundheitsbericht",
+    "subtitle": "HealthLog — Persönlicher Gesundheitsbericht",
+    "patient": "Patient",
+    "dateOfBirth": "Geburtsdatum",
+    "gender": "Geschlecht",
+    "genderMale": "Männlich",
+    "genderFemale": "Weiblich",
+    "genderOther": "Divers",
+    "height": "Körpergröße",
+    "period": "Berichtszeitraum",
+    "createdOn": "Erstellt am",
+    "vitalsTitle": "Vitalparameter — Übersicht",
+    "colParameter": "Parameter",
+    "colCurrent": "Aktuell",
+    "colAvgPeriod": "Ø Zeitraum",
+    "colMin": "Min",
+    "colMax": "Max",
+    "colN": "n",
+    "bpClassificationTitle": "Blutdruck — ESC/ESH-Klassifikation (2018)",
+    "avgBp": "Durchschnittlicher Blutdruck",
+    "classification": "Klassifikation",
+    "bmiTitle": "Body-Mass-Index (BMI)",
+    "bmiRow": "BMI: {bmi} kg/m² — Klassifikation: {class} (WHO)",
+    "complianceTitle": "Medikamenten-Compliance",
+    "colMedication": "Medikament",
+    "colTaken": "Eingenommen",
+    "colSkipped": "Übersprungen",
+    "colMissed": "Verpasst",
+    "colTotal": "Gesamt",
+    "colComplianceRate": "Compliance-Rate",
+    "moodTitle": "Stimmungsverlauf",
+    "moodSummary": "Durchschnitt: {avg} / 5,0 · Einträge: {count} · Bereich: {min}–{max}",
+    "colMood": "Stimmung",
+    "colCount": "Anzahl",
+    "colShare": "Anteil",
+    "footerDisclaimer1": "Dieser Bericht wurde automatisch aus selbst erfassten Daten generiert und dient ausschließlich zur Unterstützung",
+    "footerDisclaimer2": "des Arzt-Patienten-Gesprächs. Er ersetzt keine ärztliche Diagnose. Korrelationen implizieren keine Kausalität.",
+    "footerSource": "Quelle: HealthLog | Zeitzone: Europe/Berlin | Erstellt: {timestamp}",
+    "typeWeight": "Körpergewicht",
+    "typeBpSys": "Systolischer Blutdruck",
+    "typeBpDia": "Diastolischer Blutdruck",
+    "typePulse": "Ruhepuls",
+    "typeBodyFat": "Körperfettanteil",
+    "typeSleep": "Schlafdauer",
+    "typeSteps": "Aktivität (Schritte)",
+    "typeTotalBodyWater": "Gesamtkörperwasser",
+    "typeBoneMass": "Knochenmasse",
+    "unitSteps": "Schritte",
+    "bmiUnderweight": "Untergewicht",
+    "bmiNormal": "Normalgewicht",
+    "bmiOverweight": "Übergewicht (Präadipositas)",
+    "bmiObeseGrade1": "Adipositas Grad I",
+    "bmiObeseGrade2": "Adipositas Grad II",
+    "bmiObeseGrade3": "Adipositas Grad III",
+    "bpOptimal": "Optimal",
+    "bpNormal": "Normal",
+    "bpHighNormal": "Hochnormal",
+    "bpHypertensionGrade1": "Hypertonie Grad 1",
+    "bpHypertensionGrade2": "Hypertonie Grad 2",
+    "bpHypertensionGrade3": "Hypertonie Grad 3",
+    "moodAwful": "Sehr schlecht",
+    "moodBad": "Schlecht",
+    "moodNeutral": "Neutral",
+    "moodGood": "Gut",
+    "moodGreat": "Sehr gut",
+    "typeGlucoseFasting": "Glukose (nüchtern)",
+    "typeGlucosePostprandial": "Glukose (postprandial)",
+    "typeGlucoseRandom": "Glukose (beliebig)",
+    "typeGlucoseBedtime": "Glukose (vor dem Schlafen)",
+    "glucoseClassificationTitle": "Blutzucker — Referenzbereiche (ADA 2024 / DDG)",
+    "glucoseRow": "{label}: Ø {avg} {unit} (Ziel {rangeMin}–{rangeMax}) — {class}",
+    "glucoseInTarget": "im Ziel",
+    "glucoseBelowTarget": "unter Ziel",
+    "glucoseAboveTarget": "über Ziel"
+  },
+  "errorBoundary": {
+    "title": "Da ist etwas schiefgelaufen",
+    "description": "Ein unerwarteter Fehler ist aufgetreten. Du kannst es erneut versuchen, die technischen Details kopieren oder einen Bug-Report öffnen."
   },
   "nav": {
     "home": "Home",
@@ -90,6 +175,7 @@
     "backToPasskey": "Zurück zu Passkey",
     "passkeySetupLater": "Passkeys kannst du jederzeit in den Einstellungen einrichten.",
     "passwordMinLength": "Min. 12 Zeichen",
+    "passwordTooShort": "Passwort muss mindestens {minLength} Zeichen lang sein.",
     "passwordStrength": "Passwortstärke",
     "strengthWeak": "Sehr schwach",
     "strengthFair": "Schwach",
@@ -113,6 +199,8 @@
     "bloodPressureDia": "Blutdruck (Dia)",
     "pulse": "Puls",
     "bodyFat": "Körperfett",
+    "sleep": "Schlaf",
+    "steps": "Schritte",
     "bpInTarget": "BD im Zielbereich",
     "days30Short": "30T",
     "medications": "Medikamente",
@@ -127,7 +215,17 @@
     "compliance7d": "Einnahmetreue (7 Tage)",
     "complianceGood": "Gut",
     "complianceLow": "Niedrig",
-    "mood": "Stimmung"
+    "mood": "Stimmung",
+    "customizeTitle": "Dashboard-Layout",
+    "customizeSubtitle": "Wähle, welche Karten auf dem Dashboard angezeigt werden und in welcher Reihenfolge. Defaults funktionieren sofort.",
+    "layoutReset": "Auf Defaults zurücksetzen",
+    "layoutSaveSuccess": "Dashboard-Layout gespeichert",
+    "layoutSaveError": "Layout konnte nicht gespeichert werden",
+    "layoutResetSuccess": "Auf Standard-Layout zurückgesetzt",
+    "layoutUsingDefaults": "Standard-Layout aktiv",
+    "layoutCustomized": "Eigenes Layout aktiv",
+    "moveUp": "Nach oben",
+    "moveDown": "Nach unten"
   },
   "measurements": {
     "title": "Messungen",
@@ -148,6 +246,16 @@
     "typeBodyFat": "Körperfett",
     "typeSleep": "Schlaf",
     "typeSteps": "Schritte",
+    "typeBloodGlucose": "Blutzucker",
+    "typeTotalBodyWater": "Gesamtkörperwasser",
+    "typeBoneMass": "Knochenmasse",
+    "glucoseContext": "Kontext",
+    "glucoseContextFasting": "Nüchtern (≥8 h ohne Nahrung)",
+    "glucoseContextPostprandial": "Postprandial (2 h nach dem Essen)",
+    "glucoseContextRandom": "Beliebig / ohne Kontext",
+    "glucoseContextBedtime": "Vor dem Schlafen",
+    "glucoseUnit": "Blutzucker-Einheit",
+    "glucoseUnitHint": "Gespeichert in mg/dL; Anzeige-Einheit ist deine Präferenz.",
     "unitHours": "Stunden",
     "unitSteps": "Schritte",
     "sourceManual": "Manuell",
@@ -385,7 +493,21 @@
     "phaseAfterEnd": "nach Ende",
     "phaseResetDefaults": "Auf Defaults zurücksetzen",
     "phaseSaved": "Erinnerungsphasen gespeichert",
-    "phaseReset": "Auf Defaults zurückgesetzt"
+    "phaseReset": "Auf Defaults zurückgesetzt",
+    "sourceWeb": "Webseite",
+    "sourceApi": "Externe API",
+    "sourceReminder": "Telegram / Erinnerung",
+    "sourceImport": "CSV-Import",
+    "unitDrops": "Tropfen",
+    "unitTablets": "Tablette(n)",
+    "unitCapsules": "Kapsel(n)",
+    "unitPieces": "Stück",
+    "namePlaceholder": "z.B. Ibuprofen",
+    "dosePlaceholder": "z.B. 400",
+    "labelPlaceholder": "z.B. Morgens",
+    "defaultDose": "Standard",
+    "dayDeactivate": "{day} deaktivieren",
+    "dayActivate": "{day} aktivieren"
   },
   "charts": {
     "title": "Verlauf",
@@ -406,17 +528,19 @@
     "noData": "Keine Daten im gewählten Zeitraum",
     "movingAverage": "Gleitender Durchschnitt",
     "target": "Zielbereich",
-    "points7Label": "7M",
-    "points7Title": "Die sieben letzten Messpunkte",
-    "points30Label": "30M",
-    "points30Title": "Die dreißig letzten Messpunkte",
-    "points90Label": "90M",
-    "points90Title": "Die neunzig letzten Messpunkte",
+    "points7Label": "7 Pkt",
+    "points7Title": "Letzte 7 Messpunkte",
+    "points30Label": "30 Pkt",
+    "points30Title": "Letzte 30 Messpunkte",
+    "points90Label": "90 Pkt",
+    "points90Title": "Letzte 90 Messpunkte",
     "pointsAllLabel": "Alle",
     "pointsAllTitle": "Alle verfügbaren Messpunkte",
     "systolic": "Systolisch",
     "diastolic": "Diastolisch",
     "movingAverage7d": "7T-Schnitt",
+    "avg7dShort": "7T",
+    "avg30dShort": "30T",
     "trend": "Trend",
     "targetRanges": "Zielbereiche",
     "perWeek": "/Woche",
@@ -429,9 +553,58 @@
     "colorRed": "Rot:",
     "mood": "Stimmung",
     "moodScore": "Stimmungswert",
-    "moodMA": "7-Tage-Schnitt"
+    "moodMA": "7-Tage-Schnitt",
+    "moodLabel1": "Lausig",
+    "moodLabel2": "Schlecht",
+    "moodLabel3": "Okay",
+    "moodLabel4": "Gut",
+    "moodLabel5": "Super",
+    "weekdays": {
+      "mon": "Mo",
+      "wed": "Mi",
+      "fri": "Fr",
+      "sun": "So"
+    },
+    "months": {
+      "jan": "Jan",
+      "feb": "Feb",
+      "mar": "Mär",
+      "apr": "Apr",
+      "may": "Mai",
+      "jun": "Jun",
+      "jul": "Jul",
+      "aug": "Aug",
+      "sep": "Sep",
+      "oct": "Okt",
+      "nov": "Nov",
+      "dec": "Dez"
+    },
+    "heatmapOnTime": "pünktlich",
+    "heatmapLate": "spät",
+    "heatmapVeryLate": "sehr spät",
+    "legendOnTime": "Pünktlich",
+    "legendLate": "Spät",
+    "legendVeryLate": "Sehr spät",
+    "legendMissed": "Verpasst"
   },
   "insights": {
+    "aiAnalysisTitle": "KI-Gesundheitsanalyse",
+    "noAnalysisYet": "Noch keine Analyse vorhanden.",
+    "noProviderConfigured": "KI-Provider nicht konfiguriert.",
+    "startAnalysis": "Analyse starten",
+    "refreshAnalysis": "Analyse aktualisieren",
+    "keyTakeaway": "Das Wichtigste",
+    "findingsTitle": "Befunde",
+    "correlationsTitle": "Zusammenhänge",
+    "recommendationsTitle": "Empfehlungen",
+    "dataFoundation": "Datengrundlage",
+    "dataGaps": "Datenlücken:",
+    "lastUpdated": "Zuletzt aktualisiert",
+    "confidenceHoch": "Hoch",
+    "confidenceMittel": "Mittel",
+    "confidenceGering": "Gering",
+    "loadError": "Auswertungen konnten nicht geladen werden",
+    "generationFailed": "Die Analyse konnte nicht erstellt werden. Bitte erneut versuchen.",
     "title": "Insights",
     "subtitle": "KI-basierte Analyse deiner Gesundheitsdaten",
     "overviewSubtitle": "Trends, Risiken, Fortschritt auf einen Blick",
@@ -543,47 +716,52 @@
     "moodWeightNone": "Kein erkennbarer Zusammenhang zwischen Stimmung und Gewicht.",
     "moodWeightStrong": "Es besteht ein starker Zusammenhang zwischen Stimmung und Gewicht.",
     "moodWeightWeak": "Es besteht ein schwacher Zusammenhang zwischen Stimmung und Gewicht.",
-    "notEnoughMoodCorrelationData": "Zu wenig Stimmungsdaten für Korrelationsanalyse."
+    "notEnoughMoodCorrelationData": "Zu wenig Stimmungsdaten für Korrelationsanalyse.",
+    "refreshButton": "Aktualisieren",
+    "generateButton": "Generieren",
+    "analyzing": "Analysiere Gesundheitsdaten...",
+    "confidence": "Konfidenz",
+    "confidence_niedrig": "niedrig",
+    "confidence_mittel": "mittel",
+    "confidence_hoch": "hoch",
+    "cached": "Gecacht",
+    "sectionChanged": "Was hat sich verändert",
+    "sectionStable": "Was ist stabil",
+    "sectionDrivers": "Mögliche Zusammenhänge",
+    "sectionNextSteps": "Nächste Schritte",
+    "generatePrompt": "Klicke auf \"Generieren\" für KI-basierte Insights deiner Gesundheitsdaten."
   },
-  "targets": {
-    "title": "Zielwerte",
-    "subtitle": "Persönliche Referenzbereiche basierend auf deinem Profil",
-    "introText": "Diese Zielwerte sind persönliche Referenzbereiche, die aus deinem Profil und anerkannten medizinischen Richtwerten abgeleitet werden. Sie helfen dir, deine wichtigsten Gesundheitswerte schnell einzuordnen und Entwicklungen früh zu erkennen. Die Bereiche werden für dich individuell berechnet, zum Beispiel anhand von Alter, Geschlecht und Körpergröße. Zu jedem Wert siehst du direkt, ob du im Zielbereich liegst oder darüber beziehungsweise darunter. So bekommst du eine kompakte Übersicht darüber, welche Zielwerte du aktuell gut einhältst und wo noch Potenzial besteht.",
-    "current": "Aktuell",
-    "average30d": "30-Tage-Durchschnitt:",
-    "targetRange": "Zielbereich",
-    "classification": "Bewertung",
-    "source": "Quelle",
-    "sourceLabel": "Quelle: {source}",
-    "trend": "Trend",
-    "weight": "Gewicht",
-    "bloodPressure": "Blutdruck",
-    "pulse": "Ruhepuls",
-    "sleep": "Schlafdauer",
-    "bmi": "BMI",
-    "bodyFat": "Körperfett",
-    "steps": "Schritte/Tag",
-    "compliance": "Einnahmetreue",
-    "compliancePerMedication": "Pro Medikament",
-    "diastolic": "Diastolisch",
-    "noProfile": "Bitte fülle dein Profil aus, um personalisierte Zielwerte zu erhalten.",
-    "profileIncomplete": "Profil unvollständig",
-    "profileIncompleteHeightAge": "Hinterlege deine Größe und dein Geburtsdatum im Profil, um personalisierte Zielbereiche zu erhalten.",
-    "profileIncompleteHeight": "Hinterlege deine Größe im Profil, um den Gewichts-Zielbereich zu berechnen.",
-    "profileIncompleteAge": "Hinterlege dein Geburtsdatum im Profil, um altersbasierte Zielbereiche zu erhalten.",
-    "noMeasurementData": "Noch keine Messdaten vorhanden.",
-    "noMeasurementYet": "Noch keine Messung vorhanden",
-    "currentValue": "Aktuell: {value} {unit}",
-    "targetRangeValue": "Zielbereich: {min}–{max} {unit}",
-    "inTarget": "Im Zielbereich",
-    "belowTarget": "{delta} {unit} unter Ziel",
-    "aboveTarget": "{delta} {unit} über Ziel",
-    "loadError": "Fehler beim Laden",
-    "classificationOptimal": "Optimal",
-    "classificationNormal": "Normal",
-    "classificationElevated": "Erhöht",
-    "classificationHigh": "Hoch",
-    "classificationLow": "Niedrig"
+  "thresholds": {
+    "title": "Persönliche Zielwerte",
+    "subtitle": "Überschreibe den berechneten Zielbereich für jede Metrik. Ohne Eintrag gilt der Default.",
+    "defaultLabel": "Default",
+    "overrideLabel": "Dein Wert",
+    "autoModeLabel": "Auto",
+    "overrideModeLabel": "Überschrieben",
+    "resetAction": "Auf Default zurücksetzen",
+    "resetAllAction": "Alle auf Default zurücksetzen",
+    "minLabel": "Min",
+    "maxLabel": "Max",
+    "unitSuffix": "({unit})",
+    "outOfBoundsHint": "Erlaubter Bereich: {min}–{max} {unit}",
+    "overrideWarning": "Werte außerhalb der Leitlinien können zu ungesunden Zielen führen. Nur nach ärztlicher Rücksprache überschreiben.",
+    "saveSuccess": "Zielwerte aktualisiert",
+    "saveError": "Zielwerte konnten nicht gespeichert werden",
+    "resetSuccess": "Auf Default zurückgesetzt",
+    "sourceOverride": "Eigener Wert",
+    "metricWeight": "Gewicht",
+    "metricBpSys": "Blutdruck (systolisch)",
+    "metricBpDia": "Blutdruck (diastolisch)",
+    "metricPulse": "Ruhepuls",
+    "metricBodyFat": "Körperfett",
+    "metricSleep": "Schlafdauer",
+    "metricSteps": "Schritte/Tag",
+    "metricGlucoseFasting": "Glukose — nüchtern",
+    "metricGlucosePostprandial": "Glukose — postprandial",
+    "metricGlucoseRandom": "Glukose — beliebig",
+    "metricGlucoseBedtime": "Glukose — vor dem Schlafen",
+    "unsetExplanation": "Kein eigener Wert — berechneter Default aktiv.",
+    "loadError": "Zielwerte konnten nicht geladen werden"
   },
   "onboarding": {
     "welcome": "Willkommen bei HealthLog!",
@@ -603,7 +781,12 @@
     "targetsDescription": "Setze optionale Zielwerte für Blutdruck und Gewicht.",
     "targetSys": "Systolisch (mmHg)",
     "targetDia": "Diastolisch (mmHg)",
-    "targetWeight": "Zielgewicht (kg)"
+    "targetWeight": "Zielgewicht (kg)",
+    "errorProfile": "Dein Profil konnte nicht gespeichert werden. Bitte erneut versuchen.",
+    "errorMedication": "Das Medikament „{name}\" konnte nicht angelegt werden. Bitte erneut versuchen oder später unter „Medikamente\" hinzufügen.",
+    "errorTargets": "Deine Zielwerte konnten nicht gespeichert werden. Bitte erneut versuchen.",
+    "errorGeneric": "Beim Abschluss des Setups ist etwas schiefgelaufen. Bitte erneut versuchen.",
+    "medScheduleHint": "Wir legen ein Standard-Erinnerungsfenster an (08:00–09:00 täglich). Du kannst es jederzeit unter „Medikamente\" anpassen."
   },
   "settings": {
     "title": "Einstellungen",
@@ -612,6 +795,7 @@
     "categoryGeneral": "Allgemein",
     "categoryNotifications": "Benachrichtigungen",
     "categoryAi": "KI",
+    "categoryPersonalization": "Personalisierung",
     "categoryIntegration": "Integration",
     "categoryApi": "API",
     "profile": "Profil",
@@ -651,6 +835,11 @@
     "passkeyOptionsError": "Konnte Passkey-Optionen nicht laden",
     "passkeyRegistrationFailed": "Fehler bei Passkey-Registrierung",
     "passkeyRegistrationCancelled": "Passkey-Registrierung abgebrochen",
+    "passkeyNotSupported": "Dein Browser oder Gerät unterstützt Passkeys noch nicht. Bitte einen anderen Browser oder ein anderes Gerät verwenden.",
+    "passkeyAlreadyRegistered": "Dieses Gerät ist bereits als Passkey für dein Konto registriert.",
+    "passkeySecurityBlocked": "Dein Browser hat die Passkey-Anfrage aus Sicherheitsgründen blockiert. Bitte auf einer vertrauenswürdigen HTTPS-URL erneut versuchen.",
+    "passkeyTimeout": "Die Passkey-Aufforderung ist abgelaufen. Bitte erneut versuchen.",
+    "passkeyUnknownError": "Passkey-Registrierung fehlgeschlagen: {message}",
     "deletePasskey": "Passkey löschen?",
     "deletePasskeyDescription": "Der Passkey wird unwiderruflich gelöscht.",
     "singleDevice": "Einzelgerät",
@@ -697,6 +886,9 @@
     "apiKeyStored": "Key hinterlegt — neuen eingeben zum Ersetzen",
     "apiKeySaved": "API-Key gespeichert",
     "apiKeyRemoved": "API-Key entfernt",
+    "codexConnected": "ChatGPT erfolgreich verbunden! KI-Insights sind jetzt aktiv.",
+    "codexDisconnected": "ChatGPT-Verbindung getrennt.",
+    "codexConnectionFailed": "ChatGPT-Verbindung fehlgeschlagen. Bitte versuche es erneut.",
     "rawData": "Rohdaten mitsenden",
     "rawDataOnDescription": "Es werden aggregierte Kennzahlen plus anonymisierte Rohdaten der letzten 30 Tage gesendet. Dazu zählen einzelne Messpunkte je Bereich (z. B. Gewicht, Blutdruck, Puls) mit Zeitbezug, damit die KI zeitliche Muster, Ausreißer und Zusammenhänge zuverlässiger erkennen kann. Nicht übertragen werden Name, E-Mail oder direkte Kontodaten.",
     "rawDataOffDescription": "Es werden nur zusammengefasste Werte gesendet (z. B. Durchschnitt, Trend, Minimum/Maximum). Keine einzelnen Messpunkte und keine exakten Zeitbezüge. Das ist datensparsamer, die KI kann dafür aber weniger fein auf Muster und kurzfristige Schwankungen eingehen.",
@@ -715,6 +907,7 @@
     "withingsCredentialsSavedPlaceholderSecret": "Gespeichert — neues eingeben zum Ersetzen",
     "withingsSaveCredentials": "Zugangsdaten speichern",
     "withingsConnected": "Verbunden",
+    "configured": "Konfiguriert",
     "withingsTokenExpired": "Token abgelaufen",
     "withingsLastSync": "Letzte Sync",
     "withingsSync": "Jetzt synchronisieren",
@@ -843,6 +1036,8 @@
   "admin": {
     "title": "Administration",
     "subtitle": "Systemstatus, Benutzer und Einstellungen",
+    "settingsSaveError": "Einstellungen konnten nicht gespeichert werden",
+    "settingsSaveValidationError": "Bitte markierte Felder prüfen",
     "sectionsTitle": "Admin",
     "systemStatus": "Systemstatus",
     "version": "Version",
@@ -870,6 +1065,8 @@
     "telegramGlobal": "Telegram-Benachrichtigungen systemweit erlauben.",
     "ntfyGlobal": "ntfy-Benachrichtigungen systemweit erlauben.",
     "webPushGlobal": "Browser-Push-Benachrichtigungen systemweit erlauben.",
+    "integrationWebPush": "Web Push",
+    "integrationBugReport": "Bug-Reports",
     "apiGlobal": "API-Endpunkte und API-Tokens systemweit erlauben.",
     "moodLogGlobal": "moodLog-Integration systemweit erlauben.",
     "sectionGeneral": "Allgemein",
@@ -991,7 +1188,55 @@
     "reminderCheckNotifOn": "Benachrichtigungen an",
     "reminderCheckNotifOff": "Benachrichtigungen aus",
     "reminderCheckEventsToday": "Heutige Events",
-    "reminderCheckNotifSent": "Gesendet"
+    "reminderCheckNotifSent": "Gesendet",
+    "feedback": {
+      "title": "Feedback-Postfach",
+      "description": "Eingegangene Rückmeldungen, Fehlerberichte und Feature-Wünsche.",
+      "tabOpen": "Offen",
+      "tabAcknowledged": "Bestätigt",
+      "tabResolved": "Erledigt",
+      "tabArchived": "Archiviert",
+      "subject": "Betreff",
+      "category": "Kategorie",
+      "user": "Benutzer",
+      "createdAt": "Eingegangen",
+      "actions": "Aktionen",
+      "details": "Details",
+      "noEntries": "Keine Feedback-Einträge in dieser Kategorie.",
+      "loading": "Lade Feedback...",
+      "anonymous": "anonym",
+      "categoryBug": "Bug",
+      "categoryFeature": "Feature",
+      "categoryQuestion": "Frage",
+      "categoryOther": "Sonstiges",
+      "statusOpen": "Offen",
+      "statusAcknowledged": "Bestätigt",
+      "statusResolved": "Erledigt",
+      "statusArchived": "Archiviert",
+      "dialogTitle": "Feedback-Details",
+      "metadataHeading": "Metadaten",
+      "metaUrl": "URL",
+      "metaLocale": "Sprache",
+      "metaUserAgent": "User-Agent",
+      "metaAppVersion": "App-Version",
+      "screenshotHeading": "Screenshot",
+      "adminNote": "Admin-Notiz",
+      "adminNotePlaceholder": "Interne Notiz (nicht für Benutzer sichtbar)",
+      "saveNote": "Notiz speichern",
+      "noteSaved": "Notiz gespeichert",
+      "actionAcknowledge": "Bestätigen",
+      "actionResolve": "Erledigen",
+      "actionArchive": "Archivieren",
+      "actionPublishGithub": "Auf GitHub veröffentlichen",
+      "publishedToGithub": "Auf GitHub veröffentlicht",
+      "viewIssue": "Issue ansehen",
+      "publishSuccess": "Issue erstellt",
+      "publishFailed": "GitHub-Veröffentlichung fehlgeschlagen",
+      "updateFailed": "Aktualisierung fehlgeschlagen",
+      "archiveConfirm": "Diesen Feedback-Eintrag archivieren?",
+      "submittedBy": "Eingereicht von",
+      "sectionTitle": "Feedback"
+    }
   },
   "achievements": {
     "title": "Erfolge",
@@ -1171,10 +1416,9 @@
   },
   "bugreport": {
     "title": "Bugreport",
-    "subtitle": "Melde einen Fehler oder ein Problem. Es wird automatisch ein GitHub Issue erstellt.",
+    "subtitle": "Sende eine Fehlermeldung, einen Feature-Wunsch oder eine Frage. Der Server-Administrator sieht deine Einreichung.",
     "loginRequired": "Bitte anmelden, um einen Bug zu melden.",
     "bugTitle": "Titel",
-    "bugTitlePlaceholder": "Kurze Beschreibung des Problems",
     "description": "Beschreibung",
     "descriptionPlaceholder": "Beschreibe den Fehler möglichst genau. Was hast du getan? Was ist passiert? Was hättest du erwartet?",
     "screenshot": "Screenshot (optional)",
@@ -1185,7 +1429,19 @@
     "submit": "Senden",
     "success": "Vielen Dank! Dein Bug Report wurde erfolgreich übermittelt.",
     "viewOnGithub": "Auf GitHub ansehen",
-    "errorCreating": "Fehler beim Erstellen"
+    "errorCreating": "Fehler beim Erstellen",
+    "notConfiguredTitle": "Bug-Reports noch nicht aktiviert",
+    "notConfiguredUser": "Bug-Reports sind auf diesem Server nicht aktiv. Bitte wende dich an den Administrator.",
+    "notConfiguredAdmin": "Für Bug-Reports wird eine GitHub-Integration benötigt (Issue-Token + Repository). Im Admin-Panel unter Einstellungen → Bug-Reports einrichten.",
+    "openAdminSettings": "Admin-Einstellungen öffnen",
+    "category": "Art",
+    "categoryBug": "Fehlermeldung",
+    "categoryFeature": "Feature-Wunsch",
+    "categoryQuestion": "Frage",
+    "categoryOther": "Sonstiges Feedback",
+    "bugTitlePlaceholder": "Kurze Zusammenfassung (optional)",
+    "githubEscalationNote": "Dein Feedback wird lokal gespeichert. Wenn der Administrator die GitHub-Integration aktiviert, kann es auf Wunsch als öffentliches Issue veröffentlicht werden.",
+    "internalOnlyNote": "Dein Feedback wird lokal gespeichert und ist nur für den Administrator dieses Servers sichtbar."
   },
   "notifications": {
     "title": "Benachrichtigungen",
@@ -1208,5 +1464,162 @@
     "dateShort": "{day}.{month}.{year}",
     "timeShort": "{hours}:{minutes}",
     "dateTime": "{day}.{month}.{year}, {hours}:{minutes}"
+  },
+  "classifications": {
+    "bmi": {
+      "Underweight": "Untergewicht",
+      "Normal": "Normalgewicht",
+      "Overweight": "Übergewicht",
+      "ObesityGradeI": "Adipositas Grad I",
+      "ObesityGradeII": "Adipositas Grad II",
+      "ObesityGradeIII": "Adipositas Grad III"
+    },
+    "bp": {
+      "Optimal": "Optimal",
+      "Normal": "Normal",
+      "HighNormal": "Hoch-normal",
+      "HypertensionGrade1": "Hypertonie Grad 1",
+      "HypertensionGrade2": "Hypertonie Grad 2",
+      "HypertensionGrade3": "Hypertonie Grad 3"
+    },
+    "pulse": {
+      "Bradycardia": "Bradykardie",
+      "Normal": "Normal",
+      "Elevated": "Erhöht",
+      "Tachycardia": "Tachykardie"
+    },
+    "pulseTarget": {
+      "SignificantlyLow": "Deutlich niedrig",
+      "SlightlyLow": "Leicht niedrig",
+      "OnTarget": "Zielbereich",
+      "SlightlyElevated": "Leicht erhöht",
+      "SignificantlyElevated": "Deutlich erhöht"
+    },
+    "sleep": {
+      "FarTooShort": "Deutlich zu kurz",
+      "TooShort": "Zu kurz",
+      "OnTarget": "Zielbereich",
+      "SlightlyLong": "Etwas lang",
+      "FarTooLong": "Deutlich zu lang"
+    },
+    "bodyFat": {
+      "Essential": "Essenziell",
+      "Athletic": "Athletisch",
+      "Fitness": "Fitness",
+      "Average": "Durchschnitt",
+      "Obese": "Adipös"
+    },
+    "steps": {
+      "VeryLow": "Sehr wenig",
+      "LowActive": "Wenig aktiv",
+      "ModeratelyActive": "Moderat aktiv",
+      "Active": "Aktiv",
+      "VeryActive": "Sehr aktiv"
+    },
+    "general": {
+      "Good": "Gut",
+      "Moderate": "Moderat",
+      "Low": "Niedrig",
+      "VeryGood": "Sehr gut",
+      "VeryStable": "Sehr stabil",
+      "Stable": "Stabil",
+      "Fluctuating": "Schwankend"
+    },
+    "alerts": {
+      "bmiBelowNormalTitle": "BMI unter Normalbereich",
+      "bmiBelowNormalMessage": "Ihr BMI von {bmi} liegt unter dem Normalbereich (18,5–24,9).",
+      "bmiOverweightTitle": "BMI im Bereich Übergewicht",
+      "bmiOverweightMessage": "Ihr BMI von {bmi} liegt im Bereich Übergewicht. Regelmäßige Bewegung und ausgewogene Ernährung können helfen.",
+      "bmiObesityTitle": "BMI im Bereich Adipositas",
+      "bmiObesityMessage": "Ihr BMI von {bmi} liegt im Bereich Adipositas.",
+      "bmiNormalTitle": "BMI im Normalbereich",
+      "bmiNormalMessage": "Ihr BMI von {bmi} liegt im gesunden Bereich.",
+      "bpDangerTitle": "Blutdruck deutlich erhöht",
+      "bpDangerMessage": "Ihr durchschnittlicher Blutdruck ({sys}/{dia}) wird als \"{category}\" eingestuft.",
+      "bpWarningTitle": "Blutdruck leicht erhöht",
+      "bpWarningMessage": "Ihr durchschnittlicher Blutdruck ({sys}/{dia}) liegt im Bereich \"{category}\".",
+      "bpTargetGoodTitle": "Gute Blutdruck-Zielbereichstreue",
+      "bpTargetGoodMessage": "{pct}% Ihrer Messungen liegen im Zielbereich.",
+      "bpTargetBadTitle": "Blutdruck oft außerhalb des Zielbereichs",
+      "bpTargetBadMessage": "Nur {pct}% Ihrer Messungen liegen im Zielbereich.",
+      "weightIncreasingTitle": "Gewicht steigend",
+      "weightIncreasingMessage": "Ihr Gewicht steigt um ca. {change} kg pro Woche in den letzten 30 Tagen.",
+      "weightDecreasingTitle": "Gewicht fallend",
+      "weightDecreasingMessage": "Ihr Gewicht sinkt um ca. {change} kg pro Woche in den letzten 30 Tagen.",
+      "pulseOutliersTitle": "Puls-Ausreißer erkannt",
+      "pulseOutliersMessage": "{count} ungewöhnliche Pulsmessungen in den letzten 30 Tagen.",
+      "complianceLowTitle": "Niedrige Einnahmetreue: {name}",
+      "complianceLowMessage": "Ihre 7-Tage-Compliance für {name} liegt bei nur {pct}%. Regelmäßige Einnahme ist wichtig.",
+      "complianceGoodTitle": "Sehr gute Einnahmetreue: {name}",
+      "complianceGoodMessage": "{pct}% Compliance in den letzten 7 Tagen. Weiter so!"
+    }
+  },
+  "targets": {
+    "title": "Zielwerte",
+    "introText": "Deine aktuellen Werte im Vergleich zu empfohlenen Zielbereichen. Quellen der Leitlinien sind auf jeder Karte verlinkt.",
+    "weight": "Gewicht",
+    "bloodPressure": "Blutdruck",
+    "bloodPressureOnTarget": "Blutdruck im Zielbereich",
+    "restingPulse": "Ruhepuls",
+    "sleepDuration": "Schlafdauer",
+    "bmi": "BMI",
+    "bodyFat": "Körperfett",
+    "stepsPerDay": "Schritte/Tag",
+    "medicationCompliance": "Einnahmetreue",
+    "mood": "Stimmung",
+    "moodStability": "Stimmungsstabilität",
+    "steps": "Schritte",
+    "average30d": "30-Tage-Schnitt:",
+    "currentValue": "Aktuell: {value} {unit}",
+    "targetRangeValue": "Zielbereich: {min}–{max} {unit}",
+    "sourceLabel": "Quelle: {source}",
+    "inTarget": "Im Zielbereich",
+    "aboveTarget": "{delta} {unit} über Zielbereich",
+    "belowTarget": "{delta} {unit} unter Zielbereich",
+    "diastolic": "Diastolisch",
+    "noMeasurementYet": "Noch keine Messungen",
+    "noMeasurementData": "Keine Messdaten verfügbar. Füge Messwerte hinzu, um deine Ziele zu sehen.",
+    "profileIncomplete": "Profil unvollständig",
+    "profileIncompleteHeight": "Trage deine Körpergröße im Profil ein, um BMI-Ziele zu aktivieren.",
+    "profileIncompleteAge": "Trage dein Geburtsdatum im Profil ein, um altersspezifische Ziele zu aktivieren.",
+    "profileIncompleteHeightAge": "Trage Körpergröße und Geburtsdatum im Profil ein, um personalisierte Ziele zu sehen.",
+    "compliancePerMedication": "Einnahmetreue pro Medikament",
+    "glucoseFasting": "Glukose — nüchtern",
+    "glucosePostprandial": "Glukose — postprandial",
+    "glucoseRandom": "Glukose — beliebig",
+    "glucoseBedtime": "Glukose — vor dem Schlafen",
+    "loadError": "Zielwerte konnten nicht geladen werden"
+  },
+  "passwordStrength": {
+    "veryWeak": "Sehr schwach",
+    "weak": "Schwach",
+    "acceptable": "Akzeptabel",
+    "strong": "Stark",
+    "veryStrong": "Sehr stark",
+    "tooShort": "Zu kurz",
+    "characters": "Zeichen",
+    "minLength": "Mindestens {count} Zeichen erforderlich."
+  },
+  "telegram": {
+    "errorInvalidAction": "Ungültige Aktion.",
+    "errorMedicationNotFound": "Medikament nicht gefunden.",
+    "errorMedicationInactive": "Medikament nicht gefunden oder inaktiv.",
+    "errorUnknownAction": "Unbekannte Aktion.",
+    "snoozeOneHour": "1 Stunde",
+    "snoozeThreeHours": "3 Stunden",
+    "snoozedFor": "{name} für {duration} zurückgestellt.",
+    "skipped": "{name} übersprungen.",
+    "alreadyRecorded": "{name} war bereits erfasst.",
+    "recordedAsTaken": "{name} als eingenommen erfasst.",
+    "confirmed": "{name} bestätigt.",
+    "genericConfirmed": "Bestätigt.",
+    "cancelled": "Abgebrochen.",
+    "noActiveMedications": "Keine aktiven Medikamente gefunden.",
+    "whichMedication": "<b>Welches Medikament eingenommen?</b>",
+    "cancelButton": "Abbrechen",
+    "askMedicationName": "Bitte Medikament angeben, z.B. <b>genommen Ramipril</b>.",
+    "medicationNotFoundExact": "Medikament nicht gefunden. Bitte Namen exakt wie in HealthLog senden.",
+    "helpHeader": "<b>Verfügbare Befehle:</b>",
+    "helpBody": "/help — Diese Hilfe anzeigen\n/add — Einnahme erfassen\n/start — Bot starten\n\n<b>Textbefehle:</b>\ngenommen &lt;Name&gt; — Einnahme bestätigen\n\n<b>Über die Buttons in Erinnerungen:</b>\n• Genommen — Einnahme bestätigen\n• 🕐 1h / 🕐 3h — Erinnerung verschieben\n• ⏭ Überspringen — Einnahme überspringen\n• ✓ Bestätigen — Verpasste Einnahme bestätigen"
   }
 }

messages/en.json

@@ -36,7 +36,92 @@
     "replace": "Replace",
     "add": "Add",
     "import": "Import",
-    "test": "Test"
+    "test": "Test",
+    "reset": "Reset",
+    "copy": "Copy",
+    "copyDetails": "Copy details",
+    "retry": "Retry",
+    "reportIssue": "Report issue"
+  },
+  "doctorReport": {
+    "title": "Health Report",
+    "subtitle": "HealthLog — Personal Health Report",
+    "patient": "Patient",
+    "dateOfBirth": "Date of birth",
+    "gender": "Gender",
+    "genderMale": "Male",
+    "genderFemale": "Female",
+    "genderOther": "Non-binary",
+    "height": "Height",
+    "period": "Reporting period",
+    "createdOn": "Created on",
+    "vitalsTitle": "Vital signs — Summary",
+    "colParameter": "Parameter",
+    "colCurrent": "Current",
+    "colAvgPeriod": "Avg. period",
+    "colMin": "Min",
+    "colMax": "Max",
+    "colN": "n",
+    "bpClassificationTitle": "Blood pressure — ESC/ESH classification (2018)",
+    "avgBp": "Average blood pressure",
+    "classification": "Classification",
+    "bmiTitle": "Body Mass Index (BMI)",
+    "bmiRow": "BMI: {bmi} kg/m² — Classification: {class} (WHO)",
+    "complianceTitle": "Medication compliance",
+    "colMedication": "Medication",
+    "colTaken": "Taken",
+    "colSkipped": "Skipped",
+    "colMissed": "Missed",
+    "colTotal": "Total",
+    "colComplianceRate": "Compliance rate",
+    "moodTitle": "Mood trajectory",
+    "moodSummary": "Average: {avg} / 5.0 · Entries: {count} · Range: {min}–{max}",
+    "colMood": "Mood",
+    "colCount": "Count",
+    "colShare": "Share",
+    "footerDisclaimer1": "This report was generated automatically from self-tracked data and is intended to support",
+    "footerDisclaimer2": "the doctor–patient conversation. It does not replace a medical diagnosis. Correlations do not imply causation.",
+    "footerSource": "Source: HealthLog | Timezone: Europe/Berlin | Created: {timestamp}",
+    "typeWeight": "Body weight",
+    "typeBpSys": "Systolic blood pressure",
+    "typeBpDia": "Diastolic blood pressure",
+    "typePulse": "Resting pulse",
+    "typeBodyFat": "Body fat",
+    "typeSleep": "Sleep duration",
+    "typeSteps": "Activity (steps)",
+    "typeTotalBodyWater": "Total body water",
+    "typeBoneMass": "Bone mass",
+    "unitSteps": "steps",
+    "bmiUnderweight": "Underweight",
+    "bmiNormal": "Normal weight",
+    "bmiOverweight": "Overweight (pre-obese)",
+    "bmiObeseGrade1": "Obesity grade I",
+    "bmiObeseGrade2": "Obesity grade II",
+    "bmiObeseGrade3": "Obesity grade III",
+    "bpOptimal": "Optimal",
+    "bpNormal": "Normal",
+    "bpHighNormal": "High-normal",
+    "bpHypertensionGrade1": "Hypertension grade 1",
+    "bpHypertensionGrade2": "Hypertension grade 2",
+    "bpHypertensionGrade3": "Hypertension grade 3",
+    "moodAwful": "Very bad",
+    "moodBad": "Bad",
+    "moodNeutral": "Neutral",
+    "moodGood": "Good",
+    "moodGreat": "Very good",
+    "typeGlucoseFasting": "Glucose (fasting)",
+    "typeGlucosePostprandial": "Glucose (postprandial)",
+    "typeGlucoseRandom": "Glucose (random)",
+    "typeGlucoseBedtime": "Glucose (bedtime)",
+    "glucoseClassificationTitle": "Blood glucose — reference ranges (ADA 2024 / DDG)",
+    "glucoseRow": "{label}: avg {avg} {unit} (target {rangeMin}–{rangeMax}) — {class}",
+    "glucoseInTarget": "in target",
+    "glucoseBelowTarget": "below target",
+    "glucoseAboveTarget": "above target"
+  },
+  "errorBoundary": {
+    "title": "Something went wrong",
+    "description": "An unexpected error occurred. You can retry, copy the technical details, or open a bug report."
   },
   "nav": {
     "home": "Home",
@@ -90,6 +175,7 @@
     "backToPasskey": "Back to Passkey",
     "passkeySetupLater": "You can set up passkeys at any time in Settings.",
     "passwordMinLength": "Min. 12 characters",
+    "passwordTooShort": "Password must be at least {minLength} characters long.",
     "passwordStrength": "Password strength",
     "strengthWeak": "Very weak",
     "strengthFair": "Weak",
@@ -113,6 +199,8 @@
     "bloodPressureDia": "Blood Pressure (Dia)",
     "pulse": "Pulse",
     "bodyFat": "Body Fat",
+    "sleep": "Sleep",
+    "steps": "Steps",
     "bpInTarget": "BP in Target",
     "days30Short": "30d",
     "medications": "Medications",
@@ -127,7 +215,17 @@
     "compliance7d": "Compliance (7 days)",
     "complianceGood": "Good",
     "complianceLow": "Low",
-    "mood": "Mood"
+    "mood": "Mood",
+    "customizeTitle": "Dashboard layout",
+    "customizeSubtitle": "Choose which cards appear on your dashboard and in what order. Defaults work out of the box.",
+    "layoutReset": "Reset to defaults",
+    "layoutSaveSuccess": "Dashboard layout saved",
+    "layoutSaveError": "Could not save dashboard layout",
+    "layoutResetSuccess": "Reset to default layout",
+    "layoutUsingDefaults": "Using default layout",
+    "layoutCustomized": "Custom layout active",
+    "moveUp": "Move up",
+    "moveDown": "Move down"
   },
   "measurements": {
     "title": "Measurements",
@@ -148,6 +246,16 @@
     "typeBodyFat": "Body Fat",
     "typeSleep": "Sleep",
     "typeSteps": "Steps",
+    "typeBloodGlucose": "Blood glucose",
+    "typeTotalBodyWater": "Total body water",
+    "typeBoneMass": "Bone mass",
+    "glucoseContext": "Context",
+    "glucoseContextFasting": "Fasting (≥8h without food)",
+    "glucoseContextPostprandial": "Post-meal (2h after eating)",
+    "glucoseContextRandom": "Random / casual",
+    "glucoseContextBedtime": "Before bed",
+    "glucoseUnit": "Glucose display unit",
+    "glucoseUnitHint": "Stored canonically in mg/dL; display unit is your preference.",
     "unitHours": "hours",
     "unitSteps": "steps",
     "sourceManual": "Manual",
@@ -385,7 +493,21 @@
     "phaseAfterEnd": "after end",
     "phaseResetDefaults": "Reset to defaults",
     "phaseSaved": "Reminder phases saved",
-    "phaseReset": "Reset to defaults"
+    "phaseReset": "Reset to defaults",
+    "sourceWeb": "Website",
+    "sourceApi": "External API",
+    "sourceReminder": "Telegram / Reminder",
+    "sourceImport": "CSV Import",
+    "unitDrops": "Drops",
+    "unitTablets": "Tablet(s)",
+    "unitCapsules": "Capsule(s)",
+    "unitPieces": "Piece(s)",
+    "namePlaceholder": "e.g. Ibuprofen",
+    "dosePlaceholder": "e.g. 400",
+    "labelPlaceholder": "e.g. Morning",
+    "defaultDose": "Default",
+    "dayDeactivate": "Deactivate {day}",
+    "dayActivate": "Activate {day}"
   },
   "charts": {
     "title": "History",
@@ -406,17 +528,19 @@
     "noData": "No data in selected time range",
     "movingAverage": "Moving average",
     "target": "Target range",
-    "points7Label": "7P",
-    "points7Title": "Last seven data points",
-    "points30Label": "30P",
-    "points30Title": "Last thirty data points",
-    "points90Label": "90P",
-    "points90Title": "Last ninety data points",
+    "points7Label": "7 pts",
+    "points7Title": "Last 7 data points",
+    "points30Label": "30 pts",
+    "points30Title": "Last 30 data points",
+    "points90Label": "90 pts",
+    "points90Title": "Last 90 data points",
     "pointsAllLabel": "All",
     "pointsAllTitle": "All available data points",
     "systolic": "Systolic",
     "diastolic": "Diastolic",
     "movingAverage7d": "7d avg",
+    "avg7dShort": "7d",
+    "avg30dShort": "30d",
     "trend": "Trend",
     "targetRanges": "Target ranges",
     "perWeek": "/week",
@@ -429,9 +553,58 @@
     "colorRed": "Red:",
     "mood": "Mood",
     "moodScore": "Mood Score",
-    "moodMA": "7-Day Average"
+    "moodMA": "7-Day Average",
+    "moodLabel1": "Awful",
+    "moodLabel2": "Bad",
+    "moodLabel3": "Okay",
+    "moodLabel4": "Good",
+    "moodLabel5": "Great",
+    "weekdays": {
+      "mon": "Mon",
+      "wed": "Wed",
+      "fri": "Fri",
+      "sun": "Sun"
+    },
+    "months": {
+      "jan": "Jan",
+      "feb": "Feb",
+      "mar": "Mar",
+      "apr": "Apr",
+      "may": "May",
+      "jun": "Jun",
+      "jul": "Jul",
+      "aug": "Aug",
+      "sep": "Sep",
+      "oct": "Oct",
+      "nov": "Nov",
+      "dec": "Dec"
+    },
+    "heatmapOnTime": "on time",
+    "heatmapLate": "late",
+    "heatmapVeryLate": "very late",
+    "legendOnTime": "On time",
+    "legendLate": "Late",
+    "legendVeryLate": "Very late",
+    "legendMissed": "Missed"
   },
   "insights": {
+    "aiAnalysisTitle": "AI Health Analysis",
+    "noAnalysisYet": "No analysis yet.",
+    "noProviderConfigured": "AI provider not configured.",
+    "startAnalysis": "Start analysis",
+    "refreshAnalysis": "Refresh analysis",
+    "keyTakeaway": "Key Takeaway",
+    "findingsTitle": "Findings",
+    "correlationsTitle": "Correlations",
+    "recommendationsTitle": "Recommendations",
+    "dataFoundation": "Data coverage",
+    "dataGaps": "Data gaps:",
+    "lastUpdated": "Last updated",
+    "confidenceHoch": "High",
+    "confidenceMittel": "Medium",
+    "confidenceGering": "Low",
+    "loadError": "Failed to load insights",
+    "generationFailed": "The analysis couldn't be generated. Please try again.",
     "title": "Insights",
     "subtitle": "AI-powered analysis of your health data",
     "overviewSubtitle": "Trends, risks, progress at a glance",
@@ -543,47 +716,52 @@
     "moodWeightNone": "No detectable correlation between mood and weight.",
     "moodWeightStrong": "There is a strong correlation between mood and weight.",
     "moodWeightWeak": "There is a weak correlation between mood and weight.",
-    "notEnoughMoodCorrelationData": "Not enough mood data for correlation analysis."
+    "notEnoughMoodCorrelationData": "Not enough mood data for correlation analysis.",
+    "refreshButton": "Refresh",
+    "generateButton": "Generate",
+    "analyzing": "Analyzing health data...",
+    "confidence": "Confidence",
+    "confidence_niedrig": "low",
+    "confidence_mittel": "medium",
+    "confidence_hoch": "high",
+    "cached": "Cached",
+    "sectionChanged": "What has changed",
+    "sectionStable": "What is stable",
+    "sectionDrivers": "Possible correlations",
+    "sectionNextSteps": "Next steps",
+    "generatePrompt": "Click \"Generate\" for AI-powered insights about your health data."
   },
-  "targets": {
-    "title": "Targets",
-    "subtitle": "Personal reference ranges based on your profile",
-    "introText": "These targets are personal reference ranges derived from your profile and established medical guidelines. They help you quickly classify your key health values and detect changes early. The ranges are calculated individually for you, for example based on age, sex, and height. For each value, you can immediately see whether you are within the target range or above or below it. This gives you a compact overview of which targets you are currently meeting well and where improvement is still possible.",
-    "current": "Current",
-    "average30d": "30-day average:",
-    "targetRange": "Target range",
-    "classification": "Rating",
-    "source": "Source",
-    "sourceLabel": "Source: {source}",
-    "trend": "Trend",
-    "weight": "Weight",
-    "bloodPressure": "Blood Pressure",
-    "pulse": "Resting Pulse",
-    "sleep": "Sleep Duration",
-    "bmi": "BMI",
-    "bodyFat": "Body Fat",
-    "steps": "Steps/Day",
-    "compliance": "Compliance",
-    "compliancePerMedication": "Per medication",
-    "diastolic": "Diastolic",
-    "noProfile": "Please complete your profile to get personalized targets.",
-    "profileIncomplete": "Profile incomplete",
-    "profileIncompleteHeightAge": "Add your height and date of birth in your profile to get personalized target ranges.",
-    "profileIncompleteHeight": "Add your height in your profile to calculate weight target range.",
-    "profileIncompleteAge": "Add your date of birth in your profile to get age-based target ranges.",
-    "noMeasurementData": "No measurement data available yet.",
-    "noMeasurementYet": "No measurement available yet",
-    "currentValue": "Current: {value} {unit}",
-    "targetRangeValue": "Target range: {min}–{max} {unit}",
-    "inTarget": "In target range",
-    "belowTarget": "{delta} {unit} below target",
-    "aboveTarget": "{delta} {unit} above target",
-    "loadError": "Error loading data",
-    "classificationOptimal": "Optimal",
-    "classificationNormal": "Normal",
-    "classificationElevated": "Elevated",
-    "classificationHigh": "High",
-    "classificationLow": "Low"
+  "thresholds": {
+    "title": "Personal thresholds",
+    "subtitle": "Override the computed target range for any metric. Defaults stay in effect until you set a value here.",
+    "defaultLabel": "Default",
+    "overrideLabel": "Your override",
+    "autoModeLabel": "Auto",
+    "overrideModeLabel": "Override",
+    "resetAction": "Reset to default",
+    "resetAllAction": "Reset all to default",
+    "minLabel": "Min",
+    "maxLabel": "Max",
+    "unitSuffix": "({unit})",
+    "outOfBoundsHint": "Allowed range: {min}–{max} {unit}",
+    "overrideWarning": "Overriding with values outside guideline ranges may produce unhealthy targets. Only do this on doctor's advice.",
+    "saveSuccess": "Thresholds updated",
+    "saveError": "Could not save thresholds",
+    "resetSuccess": "Reset to default",
+    "sourceOverride": "User override",
+    "metricWeight": "Weight",
+    "metricBpSys": "Blood pressure (systolic)",
+    "metricBpDia": "Blood pressure (diastolic)",
+    "metricPulse": "Resting pulse",
+    "metricBodyFat": "Body fat",
+    "metricSleep": "Sleep duration",
+    "metricSteps": "Daily steps",
+    "metricGlucoseFasting": "Glucose — fasting",
+    "metricGlucosePostprandial": "Glucose — post-meal",
+    "metricGlucoseRandom": "Glucose — random",
+    "metricGlucoseBedtime": "Glucose — bedtime",
+    "unsetExplanation": "No override — using computed default.",
+    "loadError": "Could not load thresholds"
   },
   "onboarding": {
     "welcome": "Welcome to HealthLog!",
@@ -603,7 +781,12 @@
     "targetsDescription": "Set optional target values for blood pressure and weight.",
     "targetSys": "Systolic (mmHg)",
     "targetDia": "Diastolic (mmHg)",
-    "targetWeight": "Target weight (kg)"
+    "targetWeight": "Target weight (kg)",
+    "errorProfile": "Could not save your profile. Please try again.",
+    "errorMedication": "Could not add the medication \"{name}\". Please try again or add it later in Medications.",
+    "errorTargets": "Could not save your target values. Please try again.",
+    "errorGeneric": "Something went wrong while finishing setup. Please try again.",
+    "medScheduleHint": "We'll add a default reminder window (08:00–09:00 daily). You can adjust it anytime in Medications."
   },
   "settings": {
     "title": "Settings",
@@ -612,6 +795,7 @@
     "categoryGeneral": "General",
     "categoryNotifications": "Notifications",
     "categoryAi": "AI",
+    "categoryPersonalization": "Personalization",
     "categoryIntegration": "Integration",
     "categoryApi": "API",
     "profile": "Profile",
@@ -651,6 +835,11 @@
     "passkeyOptionsError": "Could not load passkey options",
     "passkeyRegistrationFailed": "Passkey registration failed",
     "passkeyRegistrationCancelled": "Passkey registration cancelled",
+    "passkeyNotSupported": "Your browser or device doesn't support passkeys yet. Try a different browser or device.",
+    "passkeyAlreadyRegistered": "This device is already registered as a passkey for your account.",
+    "passkeySecurityBlocked": "Your browser blocked the passkey request for security reasons. Make sure you're on a trusted HTTPS origin and try again.",
+    "passkeyTimeout": "The passkey prompt timed out. Please try again.",
+    "passkeyUnknownError": "Passkey registration failed: {message}",
     "deletePasskey": "Delete passkey?",
     "deletePasskeyDescription": "The passkey will be permanently deleted.",
     "singleDevice": "Single device",
@@ -697,6 +886,9 @@
     "apiKeyStored": "Key stored — enter new one to replace",
     "apiKeySaved": "API key saved",
     "apiKeyRemoved": "API key removed",
+    "codexConnected": "ChatGPT connected successfully! AI insights are now active.",
+    "codexDisconnected": "ChatGPT connection removed.",
+    "codexConnectionFailed": "ChatGPT connection failed. Please try again.",
     "rawData": "Send raw data",
     "rawDataOnDescription": "Aggregated metrics plus anonymized raw points from the last 30 days are sent. This includes per-metric measurements (for example weight, blood pressure, pulse) with time context so AI can detect patterns, outliers, and correlations more reliably. Name, email, and direct account identifiers are not transmitted.",
     "rawDataOffDescription": "Only summarized metrics are sent (for example averages, trends, minimum/maximum). No individual points and no exact time context. This is more privacy-preserving, but AI can be less precise for short-term patterns and fluctuations.",
@@ -715,6 +907,7 @@
     "withingsCredentialsSavedPlaceholderSecret": "Saved — enter new to replace",
     "withingsSaveCredentials": "Save credentials",
     "withingsConnected": "Connected",
+    "configured": "Configured",
     "withingsTokenExpired": "Token expired",
     "withingsLastSync": "Last sync",
     "withingsSync": "Sync now",
@@ -843,6 +1036,8 @@
   "admin": {
     "title": "Administration",
     "subtitle": "System status, users, and settings",
+    "settingsSaveError": "Failed to save settings",
+    "settingsSaveValidationError": "Please check the highlighted fields",
     "sectionsTitle": "Admin",
     "systemStatus": "System Status",
     "version": "Version",
@@ -870,6 +1065,8 @@
     "telegramGlobal": "Allow Telegram notifications system-wide.",
     "ntfyGlobal": "Allow ntfy notifications system-wide.",
     "webPushGlobal": "Allow browser push notifications system-wide.",
+    "integrationWebPush": "Web Push",
+    "integrationBugReport": "Bug Report",
     "apiGlobal": "Allow API endpoints and API tokens system-wide.",
     "moodLogGlobal": "Allow moodLog integration system-wide.",
     "sectionGeneral": "General",
@@ -991,7 +1188,55 @@
     "reminderCheckNotifOn": "Notifications on",
     "reminderCheckNotifOff": "Notifications off",
     "reminderCheckEventsToday": "Events today",
-    "reminderCheckNotifSent": "Sent"
+    "reminderCheckNotifSent": "Sent",
+    "feedback": {
+      "title": "Feedback Inbox",
+      "description": "User-submitted feedback, bug reports, and feature requests.",
+      "tabOpen": "Open",
+      "tabAcknowledged": "Acknowledged",
+      "tabResolved": "Resolved",
+      "tabArchived": "Archived",
+      "subject": "Subject",
+      "category": "Category",
+      "user": "User",
+      "createdAt": "Submitted",
+      "actions": "Actions",
+      "details": "Details",
+      "noEntries": "No feedback in this category.",
+      "loading": "Loading feedback...",
+      "anonymous": "anonymous",
+      "categoryBug": "Bug",
+      "categoryFeature": "Feature",
+      "categoryQuestion": "Question",
+      "categoryOther": "Other",
+      "statusOpen": "Open",
+      "statusAcknowledged": "Acknowledged",
+      "statusResolved": "Resolved",
+      "statusArchived": "Archived",
+      "dialogTitle": "Feedback details",
+      "metadataHeading": "Metadata",
+      "metaUrl": "URL",
+      "metaLocale": "Locale",
+      "metaUserAgent": "User agent",
+      "metaAppVersion": "App version",
+      "screenshotHeading": "Screenshot",
+      "adminNote": "Admin note",
+      "adminNotePlaceholder": "Internal note (not visible to user)",
+      "saveNote": "Save note",
+      "noteSaved": "Note saved",
+      "actionAcknowledge": "Acknowledge",
+      "actionResolve": "Resolve",
+      "actionArchive": "Archive",
+      "actionPublishGithub": "Publish to GitHub",
+      "publishedToGithub": "Published to GitHub",
+      "viewIssue": "View issue",
+      "publishSuccess": "Issue created",
+      "publishFailed": "GitHub publish failed",
+      "updateFailed": "Update failed",
+      "archiveConfirm": "Archive this feedback entry?",
+      "submittedBy": "Submitted by",
+      "sectionTitle": "Feedback"
+    }
   },
   "achievements": {
     "title": "Achievements",
@@ -1171,10 +1416,9 @@
   },
   "bugreport": {
     "title": "Bug Report",
-    "subtitle": "Report a bug or issue. A GitHub issue will be created automatically.",
+    "subtitle": "Send a bug report, feature request, or question. The server administrator will see your submission.",
     "loginRequired": "Please sign in to report a bug.",
     "bugTitle": "Title",
-    "bugTitlePlaceholder": "Brief description of the problem",
     "description": "Description",
     "descriptionPlaceholder": "Describe the bug in detail. What did you do? What happened? What did you expect?",
     "screenshot": "Screenshot (optional)",
@@ -1185,7 +1429,19 @@
     "submit": "Send",
     "success": "Thank you! Your bug report has been submitted successfully.",
     "viewOnGithub": "View on GitHub",
-    "errorCreating": "Error creating report"
+    "errorCreating": "Error creating report",
+    "notConfiguredTitle": "Bug reports not available yet",
+    "notConfiguredUser": "Bug reporting is disabled on this server. Please contact your administrator.",
+    "notConfiguredAdmin": "Bug reporting requires a GitHub integration (issue token + repository). Configure it in the admin panel under Settings → Bug reports.",
+    "openAdminSettings": "Open admin settings",
+    "category": "Type",
+    "categoryBug": "Bug report",
+    "categoryFeature": "Feature request",
+    "categoryQuestion": "Question",
+    "categoryOther": "Other feedback",
+    "bugTitlePlaceholder": "Short summary (optional)",
+    "githubEscalationNote": "Your feedback is stored locally. If the admin enables GitHub integration, it can be promoted to a public issue on request.",
+    "internalOnlyNote": "Your feedback is stored locally and only visible to the administrator of this server."
   },
   "notifications": {
     "title": "Notifications",
@@ -1208,5 +1464,162 @@
     "dateShort": "{month}/{day}/{year}",
     "timeShort": "{hours}:{minutes}",
     "dateTime": "{month}/{day}/{year}, {hours}:{minutes}"
+  },
+  "classifications": {
+    "bmi": {
+      "Underweight": "Underweight",
+      "Normal": "Normal",
+      "Overweight": "Overweight",
+      "ObesityGradeI": "Obesity Grade I",
+      "ObesityGradeII": "Obesity Grade II",
+      "ObesityGradeIII": "Obesity Grade III"
+    },
+    "bp": {
+      "Optimal": "Optimal",
+      "Normal": "Normal",
+      "HighNormal": "High-normal",
+      "HypertensionGrade1": "Hypertension Grade 1",
+      "HypertensionGrade2": "Hypertension Grade 2",
+      "HypertensionGrade3": "Hypertension Grade 3"
+    },
+    "pulse": {
+      "Bradycardia": "Bradycardia",
+      "Normal": "Normal",
+      "Elevated": "Elevated",
+      "Tachycardia": "Tachycardia"
+    },
+    "pulseTarget": {
+      "SignificantlyLow": "Significantly low",
+      "SlightlyLow": "Slightly low",
+      "OnTarget": "On target",
+      "SlightlyElevated": "Slightly elevated",
+      "SignificantlyElevated": "Significantly elevated"
+    },
+    "sleep": {
+      "FarTooShort": "Far too short",
+      "TooShort": "Too short",
+      "OnTarget": "On target",
+      "SlightlyLong": "Slightly long",
+      "FarTooLong": "Far too long"
+    },
+    "bodyFat": {
+      "Essential": "Essential",
+      "Athletic": "Athletic",
+      "Fitness": "Fitness",
+      "Average": "Average",
+      "Obese": "Obese"
+    },
+    "steps": {
+      "VeryLow": "Very low",
+      "LowActive": "Low active",
+      "ModeratelyActive": "Moderately active",
+      "Active": "Active",
+      "VeryActive": "Very active"
+    },
+    "general": {
+      "Good": "Good",
+      "Moderate": "Moderate",
+      "Low": "Low",
+      "VeryGood": "Very good",
+      "VeryStable": "Very stable",
+      "Stable": "Stable",
+      "Fluctuating": "Fluctuating"
+    },
+    "alerts": {
+      "bmiBelowNormalTitle": "BMI below normal range",
+      "bmiBelowNormalMessage": "Your BMI of {bmi} is below the normal range (18.5–24.9).",
+      "bmiOverweightTitle": "BMI in overweight range",
+      "bmiOverweightMessage": "Your BMI of {bmi} is in the overweight range. Regular exercise and a balanced diet can help.",
+      "bmiObesityTitle": "BMI in obesity range",
+      "bmiObesityMessage": "Your BMI of {bmi} is in the obesity range.",
+      "bmiNormalTitle": "BMI in normal range",
+      "bmiNormalMessage": "Your BMI of {bmi} is in the healthy range.",
+      "bpDangerTitle": "Blood pressure significantly elevated",
+      "bpDangerMessage": "Your average blood pressure ({sys}/{dia}) is classified as \"{category}\".",
+      "bpWarningTitle": "Blood pressure slightly elevated",
+      "bpWarningMessage": "Your average blood pressure ({sys}/{dia}) is in the \"{category}\" range.",
+      "bpTargetGoodTitle": "Good blood pressure target adherence",
+      "bpTargetGoodMessage": "{pct}% of your readings are within the target range.",
+      "bpTargetBadTitle": "Blood pressure often outside target range",
+      "bpTargetBadMessage": "Only {pct}% of your readings are within the target range.",
+      "weightIncreasingTitle": "Weight increasing",
+      "weightIncreasingMessage": "Your weight is increasing by approx. {change} kg per week over the last 30 days.",
+      "weightDecreasingTitle": "Weight decreasing",
+      "weightDecreasingMessage": "Your weight is decreasing by approx. {change} kg per week over the last 30 days.",
+      "pulseOutliersTitle": "Pulse outliers detected",
+      "pulseOutliersMessage": "{count} unusual pulse readings in the last 30 days.",
+      "complianceLowTitle": "Low compliance: {name}",
+      "complianceLowMessage": "Your 7-day compliance for {name} is only {pct}%. Regular intake is important.",
+      "complianceGoodTitle": "Excellent compliance: {name}",
+      "complianceGoodMessage": "{pct}% compliance over the last 7 days. Keep it up!"
+    }
+  },
+  "targets": {
+    "title": "Targets",
+    "introText": "Your current values compared to recommended target ranges. Guideline sources are linked on each card.",
+    "weight": "Weight",
+    "bloodPressure": "Blood pressure",
+    "bloodPressureOnTarget": "Blood pressure on target",
+    "restingPulse": "Resting pulse",
+    "sleepDuration": "Sleep duration",
+    "bmi": "BMI",
+    "bodyFat": "Body fat",
+    "stepsPerDay": "Steps/day",
+    "medicationCompliance": "Medication compliance",
+    "mood": "Mood",
+    "moodStability": "Mood stability",
+    "steps": "steps",
+    "average30d": "30-day average:",
+    "currentValue": "Current: {value} {unit}",
+    "targetRangeValue": "Target: {min}–{max} {unit}",
+    "sourceLabel": "Source: {source}",
+    "inTarget": "Within target range",
+    "aboveTarget": "{delta} {unit} above target",
+    "belowTarget": "{delta} {unit} below target",
+    "diastolic": "Diastolic",
+    "noMeasurementYet": "No measurements yet",
+    "noMeasurementData": "No measurement data available. Add some measurements to see your targets.",
+    "profileIncomplete": "Profile incomplete",
+    "profileIncompleteHeight": "Add your height in profile settings to enable BMI targets.",
+    "profileIncompleteAge": "Add your date of birth in profile settings for age-specific targets.",
+    "profileIncompleteHeightAge": "Add your height and date of birth in profile settings for personalized targets.",
+    "compliancePerMedication": "Compliance per medication",
+    "glucoseFasting": "Glucose — fasting",
+    "glucosePostprandial": "Glucose — post-meal",
+    "glucoseRandom": "Glucose — random",
+    "glucoseBedtime": "Glucose — bedtime",
+    "loadError": "Failed to load targets"
+  },
+  "passwordStrength": {
+    "veryWeak": "Very weak",
+    "weak": "Weak",
+    "acceptable": "Acceptable",
+    "strong": "Strong",
+    "veryStrong": "Very strong",
+    "tooShort": "Too short",
+    "characters": "characters",
+    "minLength": "At least {count} characters required."
+  },
+  "telegram": {
+    "errorInvalidAction": "Invalid action.",
+    "errorMedicationNotFound": "Medication not found.",
+    "errorMedicationInactive": "Medication not found or inactive.",
+    "errorUnknownAction": "Unknown action.",
+    "snoozeOneHour": "1 hour",
+    "snoozeThreeHours": "3 hours",
+    "snoozedFor": "{name} snoozed for {duration}.",
+    "skipped": "{name} skipped.",
+    "alreadyRecorded": "{name} was already recorded.",
+    "recordedAsTaken": "{name} recorded as taken.",
+    "confirmed": "{name} confirmed.",
+    "genericConfirmed": "Confirmed.",
+    "cancelled": "Cancelled.",
+    "noActiveMedications": "No active medications found.",
+    "whichMedication": "<b>Which medication did you take?</b>",
+    "cancelButton": "Cancel",
+    "askMedicationName": "Please specify a medication, e.g. <b>taken Ramipril</b>.",
+    "medicationNotFoundExact": "Medication not found. Please send the name exactly as in HealthLog.",
+    "helpHeader": "<b>Available commands:</b>",
+    "helpBody": "/help — show this help\n/add — record an intake\n/start — start the bot\n\n<b>Text commands:</b>\ntaken &lt;name&gt; — confirm an intake\n\n<b>Buttons in reminders:</b>\n• Taken — confirm intake\n• 🕐 1h / 🕐 3h — postpone reminder\n• ⏭ Skip — skip intake\n• ✓ Confirm — confirm a missed intake"
   }
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "0.1.0",
+  "version": "1.3.2",
   "private": true,
   "packageManager": "pnpm@10.31.0",
   "scripts": {
@@ -22,26 +22,26 @@
   "dependencies": {
     "@hookform/resolvers": "^5.2.2",
     "@node-rs/argon2": "^2.0.2",
-    "@prisma/adapter-pg": "^7.4.2",
-    "@prisma/client": "^7.4.2",
-    "@simplewebauthn/browser": "^13.2.2",
-    "@simplewebauthn/server": "^13.2.3",
-    "@tanstack/react-query": "^5.90.21",
+    "@prisma/adapter-pg": "^7.8.0",
+    "@prisma/client": "^7.8.0",
+    "@simplewebauthn/browser": "^13.3.0",
+    "@simplewebauthn/server": "^13.3.0",
+    "@tanstack/react-query": "^5.100.5",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "dotenv": "^17.3.1",
-    "jspdf": "^4.2.0",
+    "dotenv": "^17.4.2",
+    "jspdf": "^4.2.1",
     "jspdf-autotable": "^5.0.7",
-    "lucide-react": "^0.575.0",
-    "next": "16.1.6",
+    "lucide-react": "^1.11.0",
+    "next": "16.2.4",
     "next-themes": "^0.4.6",
-    "pg-boss": "^12.13.0",
-    "prisma": "^7.4.2",
+    "pg-boss": "^12.18.1",
+    "prisma": "^7.8.0",
     "radix-ui": "^1.4.3",
-    "react": "19.2.4",
-    "react-dom": "19.2.3",
-    "react-hook-form": "^7.71.1",
-    "recharts": "^3.7.0",
+    "react": "19.2.5",
+    "react-dom": "19.2.5",
+    "react-hook-form": "^7.74.0",
+    "recharts": "^3.8.1",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
     "web-push": "^3.6.7",
@@ -50,20 +50,20 @@
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
-    "@types/node": "^20",
+    "@types/node": "^25",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@types/web-push": "^3.6.4",
     "@vitejs/plugin-react": "^5.1.4",
     "eslint": "^9",
-    "eslint-config-next": "16.1.6",
-    "prettier": "^3.5.0",
-    "prettier-plugin-tailwindcss": "^0.6.0",
-    "shadcn": "^3.8.5",
+    "eslint-config-next": "16.2.4",
+    "prettier": "^3.8.3",
+    "prettier-plugin-tailwindcss": "^0.7.3",
+    "shadcn": "^4.5.0",
     "tailwindcss": "^4",
     "tw-animate-css": "^1.4.0",
-    "typescript": "^5",
-    "vitest": "^4.0.18"
+    "typescript": "^6",
+    "vitest": "^4.1.5"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

prisma/migrations/0020_codex_oauth_admin_ai/migration.sql

@@ -0,0 +1,13 @@
+-- AlterTable: Remove openai_key_encrypted, add Codex OAuth fields to users
+ALTER TABLE "users" DROP COLUMN "openai_key_encrypted";
+
+ALTER TABLE "users" ADD COLUMN "codex_access_token_encrypted" TEXT;
+ALTER TABLE "users" ADD COLUMN "codex_refresh_token_encrypted" TEXT;
+ALTER TABLE "users" ADD COLUMN "codex_token_expires_at" TIMESTAMP(3);
+ALTER TABLE "users" ADD COLUMN "codex_connected_at" TIMESTAMP(3);
+ALTER TABLE "users" ADD COLUMN "codex_connection_status" TEXT NOT NULL DEFAULT 'disconnected';
+
+-- AlterTable: Add admin AI provider fields to app_settings
+ALTER TABLE "app_settings" ADD COLUMN "admin_ai_key_encrypted" TEXT;
+ALTER TABLE "app_settings" ADD COLUMN "admin_ai_model" TEXT NOT NULL DEFAULT 'gpt-4o-mini';
+ALTER TABLE "app_settings" ADD COLUMN "admin_ai_base_url" TEXT NOT NULL DEFAULT 'https://api.openai.com/v1';

prisma/migrations/0021_v1_2_personalization_feedback_glucose/migration.sql

@@ -0,0 +1,73 @@
+-- v1.2: Personalization + Blood Glucose + Built-in Feedback
+--
+-- This migration is purely additive.
+-- - New enums: measurement_type.BLOOD_GLUCOSE, glucose_context, feedback_category, feedback_status.
+-- - New columns on users: thresholds_json, dashboard_widgets_json, glucose_unit,
+--   ai_provider, ai_model, ai_base_url, ai_anthropic_key_encrypted, ai_local_key_encrypted.
+-- - New column on measurements: glucose_context (only set for BLOOD_GLUCOSE rows).
+-- - New table: feedback.
+
+-- ── Enums ────────────────────────────────────────────────────────────────
+
+ALTER TYPE "measurement_type" ADD VALUE IF NOT EXISTS 'BLOOD_GLUCOSE';
+
+CREATE TYPE "glucose_context" AS ENUM ('FASTING', 'POSTPRANDIAL', 'RANDOM', 'BEDTIME');
+
+CREATE TYPE "feedback_category" AS ENUM ('BUG', 'FEATURE_REQUEST', 'QUESTION', 'OTHER');
+
+CREATE TYPE "feedback_status" AS ENUM ('OPEN', 'ACKNOWLEDGED', 'RESOLVED', 'ARCHIVED');
+
+-- ── users personalization columns ───────────────────────────────────────
+
+ALTER TABLE "users"
+  ADD COLUMN "thresholds_json" JSONB,
+  ADD COLUMN "dashboard_widgets_json" JSONB,
+  ADD COLUMN "glucose_unit" TEXT,
+  ADD COLUMN "ai_provider" TEXT,
+  ADD COLUMN "ai_model" TEXT,
+  ADD COLUMN "ai_base_url" TEXT,
+  ADD COLUMN "ai_anthropic_key_encrypted" TEXT,
+  ADD COLUMN "ai_local_key_encrypted" TEXT;
+
+-- ── measurements.glucose_context ────────────────────────────────────────
+
+ALTER TABLE "measurements"
+  ADD COLUMN "glucose_context" "glucose_context";
+
+-- Enforce: glucose_context is only set for BLOOD_GLUCOSE rows.
+ALTER TABLE "measurements"
+  ADD CONSTRAINT "measurements_glucose_context_requires_type"
+  CHECK (
+    (type = 'BLOOD_GLUCOSE' AND glucose_context IS NOT NULL)
+    OR
+    (type <> 'BLOOD_GLUCOSE' AND glucose_context IS NULL)
+  );
+
+-- ── feedback table ──────────────────────────────────────────────────────
+
+CREATE TABLE "feedback" (
+  "id" TEXT NOT NULL,
+  "user_id" TEXT,
+  "email" TEXT,
+  "category" "feedback_category" NOT NULL DEFAULT 'BUG',
+  "subject" TEXT NOT NULL,
+  "description" TEXT NOT NULL,
+  "screenshot_base64" TEXT,
+  "metadata" JSONB,
+  "status" "feedback_status" NOT NULL DEFAULT 'OPEN',
+  "admin_note" TEXT,
+  "github_issue_url" TEXT,
+  "notified_email" BOOLEAN NOT NULL DEFAULT false,
+  "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updated_at" TIMESTAMP(3) NOT NULL,
+
+  CONSTRAINT "feedback_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "feedback_status_created_at_idx" ON "feedback" ("status", "created_at");
+CREATE INDEX "feedback_user_id_idx" ON "feedback" ("user_id");
+
+ALTER TABLE "feedback"
+  ADD CONSTRAINT "feedback_user_id_fkey"
+  FOREIGN KEY ("user_id") REFERENCES "users"("id")
+  ON DELETE SET NULL ON UPDATE CASCADE;

prisma/migrations/0022_body_composition_metrics/migration.sql

@@ -0,0 +1,15 @@
+-- v1.3: Add body-composition measurement types
+--
+-- Closes #89: total body water and bone mass as first-class measurement types.
+-- Both are reported by Withings body-composition scales and can also be ingested
+-- via the API by external pipelines (e.g. n8n + Health Connect).
+--
+-- Storage units (canonical):
+--   TOTAL_BODY_WATER: percent of body weight (%)
+--   BONE_MASS:        kilograms (kg)
+--
+-- Both are unconditional value types — no companion enum (unlike BLOOD_GLUCOSE,
+-- which carries a glucose_context). The migration is purely additive.
+
+ALTER TYPE "measurement_type" ADD VALUE IF NOT EXISTS 'TOTAL_BODY_WATER';
+ALTER TYPE "measurement_type" ADD VALUE IF NOT EXISTS 'BONE_MASS';

prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (i.e. Git)
+provider = "postgresql"

prisma/schema.prisma

@@ -24,8 +24,12 @@ model User {
   gender      String?   @map("gender") // "MALE" | "FEMALE" | null = keine Angabe
   timezone    String    @default("Europe/Berlin")
 
-  // OpenAI Insights (optional)
-  openaiKeyEncrypted  String?  @map("openai_key_encrypted") // AES-256-GCM encrypted
+  // Codex OAuth (ChatGPT subscription)
+  codexAccessTokenEncrypted   String?   @map("codex_access_token_encrypted")
+  codexRefreshTokenEncrypted  String?   @map("codex_refresh_token_encrypted")
+  codexTokenExpiresAt         DateTime? @map("codex_token_expires_at")
+  codexConnectedAt            DateTime? @map("codex_connected_at")
+  codexConnectionStatus       String    @default("disconnected") @map("codex_connection_status")
   insightsPrivacyMode String   @default("aggregated") @map("insights_privacy_mode") // "aggregated" | "raw"
   insightsCachedAt    DateTime? @map("insights_cached_at")
   insightsCachedText  String?  @map("insights_cached_text") // cached JSON output
@@ -49,6 +53,24 @@ model User {
   // Locale (null = use system/admin default)
   locale    String?  @map("locale") // "de" | "en" | null
 
+  // Personalization
+  // Per-user overrides for computed default thresholds. Shape:
+  //   { "WEIGHT": { "min": 70, "max": 85 },
+  //     "BLOOD_PRESSURE_SYS": { "min": 110, "max": 130 }, ... }
+  // Null or missing metric → use computed default.
+  thresholdsJson Json? @map("thresholds_json")
+  // Per-user dashboard layout — widget visibility + ordering.
+  // Shape: { "widgets": [{ "id": "weight", "visible": true, "order": 0 }, ...], "version": 1 }
+  dashboardWidgetsJson Json? @map("dashboard_widgets_json")
+  // Blood-glucose display unit preference. Canonical storage is mg/dL.
+  glucoseUnit String? @map("glucose_unit") // "mg/dL" | "mmol/L" | null = default "mg/dL"
+  // AI provider selection for insights. Null = OPENAI fallback.
+  aiProvider String? @map("ai_provider") // "OPENAI" | "ANTHROPIC" | "LOCAL" | "CHATGPT_OAUTH"
+  aiModel String? @map("ai_model")
+  aiBaseUrl String? @map("ai_base_url")
+  aiAnthropicKeyEncrypted String? @map("ai_anthropic_key_encrypted")
+  aiLocalKeyEncrypted String? @map("ai_local_key_encrypted")
+
   // Onboarding
   onboardingCompletedAt DateTime? @map("onboarding_completed_at")
 
@@ -67,6 +89,7 @@ model User {
   pushSubscriptions    PushSubscription[]
   dataBackups          DataBackup[]
   achievements         UserAchievement[]
+  feedback             Feedback[]
 
   @@map("users")
 }
@@ -126,10 +149,24 @@ enum MeasurementType {
   BODY_FAT
   SLEEP_DURATION
   ACTIVITY_STEPS
+  BLOOD_GLUCOSE // Canonical storage: mg/dL. Display unit (mg/dL or mmol/L) is user preference.
+  TOTAL_BODY_WATER // Canonical storage: kilograms (kg of water). Matches Withings' hydration measure (type 77) and Health Connect's TotalBodyWaterRecord. Display can compute % from same-day weight if desired.
+  BONE_MASS // Canonical storage: kilograms (kg). Matches Withings' bone mass measure (type 88).
 
   @@map("measurement_type")
 }
 
+/// Context for glucose measurements — affects which target range applies.
+/// NULL for non-glucose measurements.
+enum GlucoseContext {
+  FASTING      // ≥8h without food, typically morning
+  POSTPRANDIAL // 2h after meal
+  RANDOM       // any time, non-fasting, non-post-meal
+  BEDTIME      // before sleep
+
+  @@map("glucose_context")
+}
+
 enum MeasurementSource {
   MANUAL
   WITHINGS
@@ -143,11 +180,13 @@ model Measurement {
   userId     String            @map("user_id")
   type       MeasurementType
   value      Float
-  unit       String            // kg, mmHg, bpm, %, hours, steps
+  unit       String            // kg, mmHg, bpm, %, hours, steps, mg/dL
   source     MeasurementSource @default(MANUAL)
   measuredAt DateTime          @map("measured_at")
   notes      String?           // encrypted at app level if sensitive
   externalId String?           @map("external_id") // Withings grpid for dedup
+  // Only set for BLOOD_GLUCOSE measurements. NULL for all others.
+  glucoseContext GlucoseContext? @map("glucose_context")
   createdAt  DateTime          @default(now()) @map("created_at")
   updatedAt  DateTime          @updatedAt @map("updated_at")
 
@@ -374,9 +413,60 @@ model AppSettings {
   reminderLateMinutes     Int @default(120) @map("reminder_late_minutes")
   reminderMissedMinutes   Int @default(240) @map("reminder_missed_minutes")
 
+  // Admin AI Provider (fallback for users without Codex OAuth)
+  adminAiKeyEncrypted   String? @map("admin_ai_key_encrypted")
+  adminAiModel          String  @default("gpt-4o-mini") @map("admin_ai_model")
+  adminAiBaseUrl        String  @default("https://api.openai.com/v1") @map("admin_ai_base_url")
+
   @@map("app_settings")
 }
 
+// ─── Built-in Feedback ───────────────────────────────────────
+
+enum FeedbackCategory {
+  BUG
+  FEATURE_REQUEST
+  QUESTION
+  OTHER
+
+  @@map("feedback_category")
+}
+
+enum FeedbackStatus {
+  OPEN
+  ACKNOWLEDGED
+  RESOLVED
+  ARCHIVED
+
+  @@map("feedback_status")
+}
+
+/// Stores user-submitted feedback without requiring external GitHub config.
+/// Admin inbox lives at /admin#feedback; optional escalation publishes to a
+/// GitHub issue reusing the existing integration when configured.
+model Feedback {
+  id             String           @id @default(cuid())
+  userId         String?          @map("user_id") // Null after user deletion; email snapshot remains.
+  email          String?          // Snapshot at submission time for triage continuity.
+  category       FeedbackCategory @default(BUG)
+  subject        String
+  description    String
+  screenshotBase64 String?        @map("screenshot_base64") // Optional, <5MB, PNG/JPG.
+  metadata       Json?            // URL, userAgent, locale, appVersion, …
+  status         FeedbackStatus   @default(OPEN)
+  adminNote      String?          @map("admin_note")
+  gitHubIssueUrl String?          @map("github_issue_url")
+  notifiedEmail  Boolean          @default(false) @map("notified_email")
+  createdAt      DateTime         @default(now()) @map("created_at")
+  updatedAt      DateTime         @updatedAt @map("updated_at")
+
+  user User? @relation(fields: [userId], references: [id], onDelete: SetNull)
+
+  @@index([status, createdAt])
+  @@index([userId])
+  @@map("feedback")
+}
+
 // ─── Audit Log ─────────────────────────────────────────────
 
 model AuditLog {

src/app/admin/page.tsx

@@ -19,6 +19,14 @@ import {
   AlertDialogTitle,
   AlertDialogTrigger,
 } from "@/components/ui/alert-dialog";
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+} from "@/components/ui/dialog";
+import { Tabs, TabsList, TabsTrigger, TabsContent } from "@/components/ui/tabs";
 import {
   Shield,
   Users,
@@ -45,10 +53,14 @@ import {
   Key,
   Bug,
   Cog,
+  MessageSquare,
+  Inbox,
+  ExternalLink,
+  GitPullRequest,
 } from "lucide-react";
 import { PasswordStrength } from "@/components/ui/password-strength";
 import { formatDate, formatDateTime } from "@/lib/format";
-import { useTranslations } from "@/lib/i18n/context";
+import { useTranslations, useFormatters } from "@/lib/i18n/context";
 import { toast } from "sonner";
 
 function PasswordInput(props: React.ComponentProps<typeof Input>) {
@@ -167,6 +179,11 @@ export default function AdminPage() {
         <WebPushVapidSection id="section-admin-webpush" />
         <BugReportSection id="section-admin-bugreport" />
 
+        <h2 className="text-muted-foreground text-sm font-semibold tracking-wider uppercase">
+          {t("admin.feedback.sectionTitle")}
+        </h2>
+        <FeedbackInboxSection id="section-admin-feedback" />
+
         <h2 className="text-muted-foreground text-sm font-semibold tracking-wider uppercase">
           {t("admin.sectionMedication")}
         </h2>
@@ -203,6 +220,7 @@ function useAdminSettings() {
 
 function useUpdateSettings() {
   const queryClient = useQueryClient();
+  const { t } = useTranslations();
   return useMutation({
     mutationFn: async (data: Record<string, unknown>) => {
       const res = await fetch("/api/admin/settings", {
@@ -210,10 +228,20 @@ function useUpdateSettings() {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(data),
       });
-      if (!res.ok) throw new Error("Failed");
+      if (!res.ok) {
+        throw new Error(await getApiErrorMessage(res));
+      }
     },
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["admin", "settings"] });
+      toast.success(t("common.saved"));
+    },
+    onError: (err) => {
+      toast.error(
+        err instanceof Error && err.message
+          ? err.message
+          : t("admin.settingsSaveError"),
+      );
     },
   });
 }
@@ -235,6 +263,7 @@ async function getApiErrorMessage(response: Response): Promise<string> {
 
 function SystemStatusSection({ id }: { id: string }) {
   const { t } = useTranslations();
+  const fmt = useFormatters();
 
   const { data: status } = useQuery({
     queryKey: ["admin", "status"],
@@ -283,7 +312,7 @@ function SystemStatusSection({ id }: { id: string }) {
           <StatusItem
             icon={Activity}
             label={t("admin.measurementsCount")}
-            value={status.counts.measurements.toLocaleString("de-DE")}
+            value={fmt.integer(status.counts.measurements)}
           />
           <StatusItem
             icon={Key}
@@ -349,7 +378,7 @@ function SystemStatusSection({ id }: { id: string }) {
           {status.integrations.webPush && (
             <StatusItem
               icon={BellRing}
-              label="Web Push"
+              label={t("admin.integrationWebPush")}
               value={t("admin.configured")}
               className="text-dracula-green"
             />
@@ -357,7 +386,7 @@ function SystemStatusSection({ id }: { id: string }) {
           {status.integrations.bugReport && (
             <StatusItem
               icon={Bug}
-              label="Bug Report"
+              label={t("admin.integrationBugReport")}
               value={t("admin.configured")}
               className="text-dracula-green"
             />
@@ -489,7 +518,7 @@ function ServicesSection({ id }: { id: string }) {
           disabled={updateSettings.isPending}
         />
         <SettingsToggle
-          label="Web Push"
+          label={t("admin.integrationWebPush")}
           description={t("admin.webPushGlobal")}
           icon={Globe}
           checked={settings?.webPushGlobal ?? true}
@@ -1875,6 +1904,14 @@ function UserManagementSection({
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["admin", "users"] });
       setEditingUser(null);
+      toast.success(t("common.saved"));
+    },
+    onError: (err) => {
+      toast.error(
+        err instanceof Error && err.message
+          ? err.message
+          : t("admin.settingsSaveError"),
+      );
     },
   });
 
@@ -2149,3 +2186,514 @@ function UserManagementSection({
     </div>
   );
 }
+
+/* ─────────────────────── Feedback Inbox ─────────────────────── */
+
+type FeedbackStatusType = "OPEN" | "ACKNOWLEDGED" | "RESOLVED" | "ARCHIVED";
+type FeedbackCategoryType = "BUG" | "FEATURE_REQUEST" | "QUESTION" | "OTHER";
+
+interface FeedbackItem {
+  id: string;
+  userId: string | null;
+  email: string | null;
+  category: FeedbackCategoryType;
+  subject: string;
+  description: string;
+  status: FeedbackStatusType;
+  adminNote: string | null;
+  gitHubIssueUrl: string | null;
+  metadata: Record<string, unknown> | null;
+  screenshotBase64: string | null;
+  createdAt: string;
+  updatedAt: string;
+  user: { username: string } | null;
+}
+
+interface FeedbackListResponse {
+  items: FeedbackItem[];
+  meta: {
+    total: number;
+    limit: number;
+    offset: number;
+    countsByStatus: Partial<Record<FeedbackStatusType, number>>;
+  };
+}
+
+const STATUS_TABS: FeedbackStatusType[] = [
+  "OPEN",
+  "ACKNOWLEDGED",
+  "RESOLVED",
+  "ARCHIVED",
+];
+
+function FeedbackInboxSection({ id }: { id: string }) {
+  const { t } = useTranslations();
+  const queryClient = useQueryClient();
+  const { data: status } = useQuery({
+    queryKey: ["admin", "status"],
+    queryFn: async () => {
+      const res = await fetch("/api/admin/status");
+      if (!res.ok) throw new Error("Failed");
+      return (await res.json()).data as SystemStatus;
+    },
+  });
+  const githubConfigured = Boolean(status?.integrations.bugReport?.configured);
+
+  const [activeStatus, setActiveStatus] = useState<FeedbackStatusType>("OPEN");
+  const [selected, setSelected] = useState<FeedbackItem | null>(null);
+
+  const { data, isLoading } = useQuery({
+    queryKey: ["admin", "feedback", activeStatus],
+    queryFn: async () => {
+      const res = await fetch(
+        `/api/admin/feedback?status=${activeStatus}&limit=100`,
+      );
+      if (!res.ok) throw new Error("Failed");
+      return (await res.json()).data as FeedbackListResponse;
+    },
+  });
+
+  const counts = data?.meta.countsByStatus ?? {};
+
+  function refresh() {
+    queryClient.invalidateQueries({ queryKey: ["admin", "feedback"] });
+  }
+
+  return (
+    <div
+      id={id}
+      className="bg-card border-border scroll-mt-28 rounded-xl border p-6"
+    >
+      <div className="flex items-center gap-2">
+        <Inbox className="text-primary h-5 w-5" />
+        <h2 className="text-lg font-semibold">{t("admin.feedback.title")}</h2>
+      </div>
+      <p className="text-muted-foreground mt-1 text-xs">
+        {t("admin.feedback.description")}
+      </p>
+
+      <Tabs
+        value={activeStatus}
+        onValueChange={(v) => setActiveStatus(v as FeedbackStatusType)}
+        className="mt-4"
+      >
+        <TabsList>
+          {STATUS_TABS.map((s) => (
+            <TabsTrigger key={s} value={s}>
+              <span>
+                {t(
+                  `admin.feedback.tab${s.charAt(0) + s.slice(1).toLowerCase()}`,
+                )}
+              </span>
+              <Badge variant="secondary" className="ml-1.5 text-xs">
+                {counts[s] ?? 0}
+              </Badge>
+            </TabsTrigger>
+          ))}
+        </TabsList>
+
+        {STATUS_TABS.map((s) => (
+          <TabsContent key={s} value={s} className="mt-4">
+            {isLoading ? (
+              <div className="flex items-center gap-2">
+                <Loader2 className="text-muted-foreground h-4 w-4 animate-spin" />
+                <span className="text-muted-foreground text-sm">
+                  {t("admin.feedback.loading")}
+                </span>
+              </div>
+            ) : !data?.items.length ? (
+              <p className="text-muted-foreground text-sm">
+                {t("admin.feedback.noEntries")}
+              </p>
+            ) : (
+              <div className="overflow-x-auto">
+                <table className="w-full text-sm">
+                  <thead>
+                    <tr className="text-muted-foreground border-b text-xs">
+                      <th className="px-3 py-2 text-left font-medium">
+                        {t("admin.feedback.createdAt")}
+                      </th>
+                      <th className="px-3 py-2 text-left font-medium">
+                        {t("admin.feedback.category")}
+                      </th>
+                      <th className="px-3 py-2 text-left font-medium">
+                        {t("admin.feedback.subject")}
+                      </th>
+                      <th className="px-3 py-2 text-left font-medium">
+                        {t("admin.feedback.user")}
+                      </th>
+                      <th className="px-3 py-2 text-right font-medium">
+                        {t("admin.feedback.actions")}
+                      </th>
+                    </tr>
+                  </thead>
+                  <tbody className="divide-border divide-y">
+                    {data.items.map((item, i) => (
+                      <tr
+                        key={item.id}
+                        className={`hover:bg-muted/40 cursor-pointer ${i % 2 === 0 ? "bg-muted/30" : ""}`}
+                        onClick={() => setSelected(item)}
+                      >
+                        <td className="text-muted-foreground px-3 py-2 text-xs whitespace-nowrap">
+                          {formatDateTime(item.createdAt)}
+                        </td>
+                        <td className="px-3 py-2">
+                          <FeedbackCategoryBadge category={item.category} />
+                        </td>
+                        <td className="max-w-[28ch] truncate px-3 py-2 font-medium">
+                          {item.subject}
+                        </td>
+                        <td className="text-muted-foreground px-3 py-2 text-xs">
+                          {item.user?.username ?? t("admin.feedback.anonymous")}
+                        </td>
+                        <td className="px-3 py-2 text-right">
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            className="h-7 px-2 text-xs"
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              setSelected(item);
+                            }}
+                          >
+                            {t("admin.feedback.details")}
+                          </Button>
+                        </td>
+                      </tr>
+                    ))}
+                  </tbody>
+                </table>
+              </div>
+            )}
+          </TabsContent>
+        ))}
+      </Tabs>
+
+      {selected && (
+        <FeedbackDetailDialog
+          item={selected}
+          open={!!selected}
+          onOpenChange={(open) => !open && setSelected(null)}
+          githubConfigured={githubConfigured}
+          onMutated={refresh}
+        />
+      )}
+    </div>
+  );
+}
+
+function FeedbackCategoryBadge({
+  category,
+}: {
+  category: FeedbackCategoryType;
+}) {
+  const { t } = useTranslations();
+  const map: Record<
+    FeedbackCategoryType,
+    { label: string; className: string }
+  > = {
+    BUG: {
+      label: t("admin.feedback.categoryBug"),
+      className: "bg-red-500/15 text-red-400 border-red-500/30",
+    },
+    FEATURE_REQUEST: {
+      label: t("admin.feedback.categoryFeature"),
+      className: "bg-purple-500/15 text-purple-400 border-purple-500/30",
+    },
+    QUESTION: {
+      label: t("admin.feedback.categoryQuestion"),
+      className: "bg-blue-500/15 text-blue-400 border-blue-500/30",
+    },
+    OTHER: {
+      label: t("admin.feedback.categoryOther"),
+      className: "bg-muted text-muted-foreground border-border",
+    },
+  };
+  const cfg = map[category];
+  return (
+    <Badge className={`border text-xs ${cfg.className}`}>{cfg.label}</Badge>
+  );
+}
+
+function FeedbackDetailDialog({
+  item,
+  open,
+  onOpenChange,
+  githubConfigured,
+  onMutated,
+}: {
+  item: FeedbackItem;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  githubConfigured: boolean;
+  onMutated: () => void;
+}) {
+  const { t } = useTranslations();
+  const [note, setNote] = useState(item.adminNote ?? "");
+  const [issueUrl, setIssueUrl] = useState(item.gitHubIssueUrl);
+
+  const update = useMutation({
+    mutationFn: async (payload: {
+      status?: FeedbackStatusType;
+      adminNote?: string | null;
+    }) => {
+      const res = await fetch(`/api/admin/feedback/${item.id}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+      });
+      if (!res.ok) throw new Error(await getApiErrorMessage(res));
+    },
+    onSuccess: (_, vars) => {
+      onMutated();
+      if (vars.adminNote !== undefined) {
+        toast.success(t("admin.feedback.noteSaved"));
+      }
+    },
+    onError: (err) => {
+      toast.error(
+        err instanceof Error ? err.message : t("admin.feedback.updateFailed"),
+      );
+    },
+  });
+
+  const archive = useMutation({
+    mutationFn: async () => {
+      const res = await fetch(`/api/admin/feedback/${item.id}`, {
+        method: "DELETE",
+      });
+      if (!res.ok) throw new Error(await getApiErrorMessage(res));
+    },
+    onSuccess: () => {
+      onMutated();
+      onOpenChange(false);
+    },
+    onError: (err) => {
+      toast.error(
+        err instanceof Error ? err.message : t("admin.feedback.updateFailed"),
+      );
+    },
+  });
+
+  const publish = useMutation({
+    mutationFn: async () => {
+      const res = await fetch(`/api/admin/feedback/${item.id}/github`, {
+        method: "POST",
+      });
+      if (!res.ok) throw new Error(await getApiErrorMessage(res));
+      return (await res.json()).data as { issueUrl: string };
+    },
+    onSuccess: (data) => {
+      setIssueUrl(data.issueUrl);
+      toast.success(t("admin.feedback.publishSuccess"));
+      onMutated();
+    },
+    onError: (err) => {
+      toast.error(
+        err instanceof Error ? err.message : t("admin.feedback.publishFailed"),
+      );
+    },
+  });
+
+  const meta = item.metadata ?? {};
+  const url = typeof meta.url === "string" ? meta.url : null;
+  const locale = typeof meta.locale === "string" ? meta.locale : null;
+  const userAgent = typeof meta.userAgent === "string" ? meta.userAgent : null;
+  const appVersion =
+    typeof meta.appVersion === "string" ? meta.appVersion : null;
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-h-[85vh] overflow-y-auto sm:max-w-2xl">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <MessageSquare className="h-5 w-5" />
+            {item.subject}
+          </DialogTitle>
+          <DialogDescription>
+            <span className="flex flex-wrap items-center gap-2 text-xs">
+              <FeedbackCategoryBadge category={item.category} />
+              <span>
+                {t("admin.feedback.submittedBy")}:{" "}
+                {item.user?.username ?? t("admin.feedback.anonymous")}
+              </span>
+              <span>·</span>
+              <span>{formatDateTime(item.createdAt)}</span>
+              {issueUrl && (
+                <a
+                  href={issueUrl}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="text-primary inline-flex items-center gap-1"
+                >
+                  <GitPullRequest className="h-3 w-3" />
+                  {t("admin.feedback.viewIssue")}
+                  <ExternalLink className="h-3 w-3" />
+                </a>
+              )}
+            </span>
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4 text-sm">
+          <div className="bg-muted/40 rounded-md p-3 whitespace-pre-wrap">
+            {item.description}
+          </div>
+
+          {(url || locale || userAgent || appVersion) && (
+            <div>
+              <h4 className="text-muted-foreground text-xs font-semibold tracking-wider uppercase">
+                {t("admin.feedback.metadataHeading")}
+              </h4>
+              <dl className="mt-2 grid grid-cols-[max-content_1fr] gap-x-3 gap-y-1 text-xs">
+                {url && (
+                  <>
+                    <dt className="text-muted-foreground">
+                      {t("admin.feedback.metaUrl")}
+                    </dt>
+                    <dd className="font-mono break-all">{url}</dd>
+                  </>
+                )}
+                {locale && (
+                  <>
+                    <dt className="text-muted-foreground">
+                      {t("admin.feedback.metaLocale")}
+                    </dt>
+                    <dd className="font-mono">{locale}</dd>
+                  </>
+                )}
+                {appVersion && (
+                  <>
+                    <dt className="text-muted-foreground">
+                      {t("admin.feedback.metaAppVersion")}
+                    </dt>
+                    <dd className="font-mono">{appVersion}</dd>
+                  </>
+                )}
+                {userAgent && (
+                  <>
+                    <dt className="text-muted-foreground">
+                      {t("admin.feedback.metaUserAgent")}
+                    </dt>
+                    <dd className="font-mono break-all">{userAgent}</dd>
+                  </>
+                )}
+              </dl>
+            </div>
+          )}
+
+          {item.screenshotBase64 && (
+            <div>
+              <h4 className="text-muted-foreground mb-2 text-xs font-semibold tracking-wider uppercase">
+                {t("admin.feedback.screenshotHeading")}
+              </h4>
+              {/* eslint-disable-next-line @next/next/no-img-element */}
+              <img
+                src={item.screenshotBase64}
+                alt="Screenshot"
+                className="border-border max-h-72 rounded-md border"
+              />
+            </div>
+          )}
+
+          <div className="space-y-1.5">
+            <Label htmlFor="admin-feedback-note" className="text-xs">
+              {t("admin.feedback.adminNote")}
+            </Label>
+            <textarea
+              id="admin-feedback-note"
+              value={note}
+              onChange={(e) => setNote(e.target.value)}
+              rows={3}
+              maxLength={5000}
+              placeholder={t("admin.feedback.adminNotePlaceholder")}
+              className="border-input bg-background text-foreground placeholder:text-muted-foreground focus-visible:ring-ring w-full rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:outline-none"
+            />
+            <div className="flex justify-end">
+              <Button
+                size="sm"
+                variant="outline"
+                disabled={update.isPending || note === (item.adminNote ?? "")}
+                onClick={() => update.mutate({ adminNote: note || null })}
+              >
+                {update.isPending && (
+                  <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
+                )}
+                {t("admin.feedback.saveNote")}
+              </Button>
+            </div>
+          </div>
+
+          <div className="border-border flex flex-wrap items-center gap-2 border-t pt-3">
+            <Button
+              size="sm"
+              variant="outline"
+              disabled={update.isPending || item.status === "ACKNOWLEDGED"}
+              onClick={() => update.mutate({ status: "ACKNOWLEDGED" })}
+            >
+              <CheckCircle2 className="mr-1.5 h-3.5 w-3.5" />
+              {t("admin.feedback.actionAcknowledge")}
+            </Button>
+            <Button
+              size="sm"
+              disabled={update.isPending || item.status === "RESOLVED"}
+              onClick={() => update.mutate({ status: "RESOLVED" })}
+            >
+              <CheckCircle2 className="mr-1.5 h-3.5 w-3.5" />
+              {t("admin.feedback.actionResolve")}
+            </Button>
+            <AlertDialog>
+              <AlertDialogTrigger asChild>
+                <Button
+                  size="sm"
+                  variant="destructive"
+                  disabled={archive.isPending || item.status === "ARCHIVED"}
+                >
+                  <Trash2 className="mr-1.5 h-3.5 w-3.5" />
+                  {t("admin.feedback.actionArchive")}
+                </Button>
+              </AlertDialogTrigger>
+              <AlertDialogContent>
+                <AlertDialogHeader>
+                  <AlertDialogTitle>
+                    {t("admin.feedback.archiveConfirm")}
+                  </AlertDialogTitle>
+                </AlertDialogHeader>
+                <AlertDialogFooter>
+                  <AlertDialogCancel>{t("common.cancel")}</AlertDialogCancel>
+                  <AlertDialogAction
+                    onClick={() => archive.mutate()}
+                    className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+                  >
+                    {t("admin.feedback.actionArchive")}
+                  </AlertDialogAction>
+                </AlertDialogFooter>
+              </AlertDialogContent>
+            </AlertDialog>
+            {githubConfigured && !issueUrl && (
+              <Button
+                size="sm"
+                variant="outline"
+                disabled={publish.isPending}
+                onClick={() => publish.mutate()}
+                className="ml-auto"
+              >
+                {publish.isPending ? (
+                  <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
+                ) : (
+                  <GitPullRequest className="mr-1.5 h-3.5 w-3.5" />
+                )}
+                {t("admin.feedback.actionPublishGithub")}
+              </Button>
+            )}
+            {issueUrl && (
+              <Badge className="border-dracula-green/30 bg-dracula-green/15 text-dracula-green ml-auto">
+                {t("admin.feedback.publishedToGithub")}
+              </Badge>
+            )}
+          </div>
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}

src/app/api/admin/ai-settings/route.ts

@@ -0,0 +1,138 @@
+import { NextRequest } from "next/server";
+import { apiHandler, requireAdmin, HttpError } from "@/lib/api-handler";
+import { prisma } from "@/lib/db";
+import { auditLog } from "@/lib/auth/audit";
+import { apiSuccess, getClientIp, safeJson } from "@/lib/api-response";
+import { encrypt, decrypt } from "@/lib/crypto";
+import { checkRateLimit } from "@/lib/rate-limit";
+import { annotate } from "@/lib/logging/context";
+
+export const dynamic = "force-dynamic";
+
+export const GET = apiHandler(async () => {
+  await requireAdmin();
+  annotate({ action: { name: "admin.ai-settings.get" } });
+
+  const settings = await prisma.appSettings.findUnique({
+    where: { id: "singleton" },
+  });
+
+  const hasKey = Boolean(settings?.adminAiKeyEncrypted);
+  const model = settings?.adminAiModel ?? "gpt-4o-mini";
+  const baseUrl = settings?.adminAiBaseUrl ?? "https://api.openai.com/v1";
+
+  return apiSuccess({
+    hasKey,
+    keyPreview: settings?.adminAiKeyEncrypted
+      ? `...${decrypt(settings.adminAiKeyEncrypted).slice(-4)}`
+      : null,
+    model,
+    baseUrl,
+  });
+});
+
+export const PUT = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAdmin();
+  annotate({ action: { name: "admin.ai-settings.update" } });
+
+  const rl = await checkRateLimit("admin-ai-settings", 10, 60_000);
+  if (!rl.allowed) throw new HttpError(429, "Too many requests");
+
+  const { data: body, error: jsonError } = await safeJson(request);
+  if (jsonError) return jsonError;
+
+  const { apiKey, model, baseUrl } = body as {
+    apiKey?: string;
+    model?: string;
+    baseUrl?: string;
+  };
+
+  const updates: Record<string, unknown> = {};
+  const auditDetails: Record<string, unknown> = {};
+
+  if (apiKey !== undefined) {
+    const trimmed = apiKey.trim();
+    if (trimmed) {
+      updates.adminAiKeyEncrypted = encrypt(trimmed);
+      auditDetails.apiKeyUpdated = true;
+    } else {
+      updates.adminAiKeyEncrypted = null;
+      auditDetails.apiKeyUpdated = false;
+    }
+  }
+
+  if (model !== undefined) {
+    const trimmed = model.trim();
+    if (!trimmed) throw new HttpError(422, "Model cannot be empty");
+    updates.adminAiModel = trimmed;
+    auditDetails.model = trimmed;
+  }
+
+  if (baseUrl !== undefined) {
+    const trimmed = baseUrl.trim();
+    if (!trimmed) throw new HttpError(422, "Base URL cannot be empty");
+
+    // The admin AI base URL has full egress of the bearer key on every
+    // insight call. Lock it to HTTPS + a hostname allowlist so a
+    // compromised admin (or stolen cookie) cannot point it at
+    // attacker.example and exfiltrate the key on the next AI call.
+    let parsed: URL;
+    try {
+      parsed = new URL(trimmed);
+    } catch {
+      throw new HttpError(422, "Base URL is not a valid URL");
+    }
+    if (parsed.protocol !== "https:") {
+      throw new HttpError(422, "Base URL must use https://");
+    }
+    const allowedHosts = new Set([
+      "api.openai.com",
+      "api.anthropic.com",
+      "generativelanguage.googleapis.com",
+      "api.mistral.ai",
+      "api.groq.com",
+      "openrouter.ai",
+    ]);
+    for (const h of (process.env.ADMIN_AI_BASE_URL_ALLOWLIST ?? "")
+      .split(",")
+      .map((h) => h.trim())
+      .filter(Boolean)) {
+      allowedHosts.add(h);
+    }
+    if (!allowedHosts.has(parsed.hostname)) {
+      throw new HttpError(
+        422,
+        `Base URL host '${parsed.hostname}' not in allowlist. Set ADMIN_AI_BASE_URL_ALLOWLIST if you need a custom provider.`,
+      );
+    }
+    updates.adminAiBaseUrl = trimmed;
+    auditDetails.baseUrl = trimmed;
+  }
+
+  if (Object.keys(updates).length === 0) {
+    throw new HttpError(422, "No valid fields");
+  }
+
+  const settings = await prisma.appSettings.upsert({
+    where: { id: "singleton" },
+    update: updates,
+    create: { id: "singleton", ...updates },
+  });
+
+  await auditLog("admin.ai-settings.update", {
+    userId: user.id,
+    ipAddress: getClientIp(request),
+    details: auditDetails,
+  });
+
+  const hasKey = Boolean(settings.adminAiKeyEncrypted);
+
+  return apiSuccess({
+    hasKey,
+    keyPreview: settings.adminAiKeyEncrypted
+      ? `...${decrypt(settings.adminAiKeyEncrypted).slice(-4)}`
+      : null,
+    model: settings.adminAiModel,
+    baseUrl: settings.adminAiBaseUrl,
+  });
+});

src/app/api/admin/data/route.ts

@@ -30,11 +30,11 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
     const body = await request.json();
     confirm = typeof body?.confirm === "string" ? body.confirm : "";
   } catch {
-    return apiError("Ungültige Anfrage", 422);
+    return apiError("Invalid request", 422);
   }
 
   if (confirm !== "DELETE ALL") {
-    return apiError("Bestätigung fehlt", 422);
+    return apiError("Confirmation missing", 422);
   }
 
   const result = await prisma.$transaction(async (tx) => {
@@ -51,7 +51,6 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
         heightCm: null,
         dateOfBirth: null,
         gender: null,
-        openaiKeyEncrypted: null,
         insightsPrivacyMode: "aggregated",
         insightsCachedAt: null,
         insightsCachedText: null,

src/app/api/admin/feedback/[id]/github/route.ts

@@ -0,0 +1,99 @@
+/**
+ * POST /api/admin/feedback/[id]/github — promote feedback to a GitHub Issue.
+ *
+ * Reuses publishFeedbackToGithub() so the issue body matches the legacy
+ * /api/bugreport flow. Idempotent: if gitHubIssueUrl is already set we return
+ * the existing URL instead of creating a duplicate.
+ */
+import { apiHandler, requireAdmin } from "@/lib/api-handler";
+import { apiError, apiSuccess, getClientIp } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { auditLog } from "@/lib/auth/audit";
+import { prisma } from "@/lib/db";
+import {
+  publishFeedbackToGithub,
+  GithubPublishError,
+} from "@/lib/feedback/publish-github";
+import type { NextRequest } from "next/server";
+
+export const POST = apiHandler(
+  async (request: NextRequest, ctx: { params: Promise<{ id: string }> }) => {
+    const { user: admin } = await requireAdmin();
+    const { id } = await ctx.params;
+
+    const feedback = await prisma.feedback.findUnique({
+      where: { id },
+      select: {
+        id: true,
+        category: true,
+        subject: true,
+        description: true,
+        gitHubIssueUrl: true,
+        screenshotBase64: true,
+        metadata: true,
+        user: { select: { username: true } },
+      },
+    });
+    if (!feedback) return apiError("Feedback not found", 404);
+
+    if (feedback.gitHubIssueUrl) {
+      return apiError(
+        `Already published: ${feedback.gitHubIssueUrl}`,
+        409,
+      );
+    }
+
+    // Atomic claim to prevent concurrent admin clicks from creating two
+    // duplicate GitHub issues. Only the first caller whose updateMany
+    // matches (gitHubIssueUrl still null) proceeds. We write a PENDING
+    // sentinel now and replace it with the real URL after the API call.
+    const PENDING = "pending://creating";
+    const claim = await prisma.feedback.updateMany({
+      where: { id, gitHubIssueUrl: null },
+      data: { gitHubIssueUrl: PENDING },
+    });
+    if (claim.count !== 1) {
+      return apiError("Already being published by another request", 409);
+    }
+
+    try {
+      const result = await publishFeedbackToGithub({
+        category: feedback.category,
+        subject: feedback.subject,
+        description: feedback.description,
+        username: feedback.user?.username ?? "anonymous",
+        metadata: feedback.metadata,
+      });
+
+      await prisma.feedback.update({
+        where: { id },
+        data: { gitHubIssueUrl: result.issueUrl },
+      });
+
+      await auditLog("admin.feedback.github_publish", {
+        userId: admin.id,
+        ipAddress: getClientIp(request),
+        details: { feedbackId: id, issueNumber: result.issueNumber },
+      });
+
+      annotate({
+        action: { name: "admin.feedback.github_publish" },
+        meta: { feedback_id: id, issue_number: result.issueNumber },
+      });
+
+      return apiSuccess({ issueUrl: result.issueUrl });
+    } catch (err) {
+      // Release the PENDING claim so a retry can succeed.
+      await prisma.feedback
+        .updateMany({
+          where: { id, gitHubIssueUrl: PENDING },
+          data: { gitHubIssueUrl: null },
+        })
+        .catch(() => undefined);
+      if (err instanceof GithubPublishError) {
+        return apiError(err.message, err.status);
+      }
+      throw err;
+    }
+  },
+);

src/app/api/admin/feedback/[id]/route.ts

@@ -0,0 +1,78 @@
+/**
+ * PATCH /api/admin/feedback/[id] — change status or admin note.
+ * DELETE /api/admin/feedback/[id] — archive (soft: sets status to ARCHIVED).
+ */
+import { apiHandler, requireAdmin } from "@/lib/api-handler";
+import { apiError, apiSuccess, safeJson, getClientIp } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { auditLog } from "@/lib/auth/audit";
+import { prisma } from "@/lib/db";
+import { updateFeedbackSchema } from "@/lib/validations/feedback";
+import type { NextRequest } from "next/server";
+
+export const PATCH = apiHandler(
+  async (request: NextRequest, ctx: { params: Promise<{ id: string }> }) => {
+    const { user } = await requireAdmin();
+    const { id } = await ctx.params;
+
+    const { data: body, error: jsonError } = await safeJson(request);
+    if (jsonError) return jsonError;
+
+    const parsed = updateFeedbackSchema.safeParse(body);
+    if (!parsed.success) {
+      return apiError(parsed.error.issues[0].message, 422);
+    }
+
+    const before = await prisma.feedback.findUnique({ where: { id } });
+    if (!before) return apiError("Feedback not found", 404);
+
+    const updated = await prisma.feedback.update({
+      where: { id },
+      data: parsed.data,
+      select: {
+        id: true,
+        status: true,
+        adminNote: true,
+        updatedAt: true,
+      },
+    });
+
+    await auditLog("admin.feedback.update", {
+      userId: user.id,
+      ipAddress: getClientIp(request),
+      details: {
+        feedbackId: id,
+        before: { status: before.status, adminNote: before.adminNote },
+        after: parsed.data,
+      },
+    });
+
+    annotate({
+      action: { name: "admin.feedback.update" },
+      meta: { feedback_id: id },
+    });
+
+    return apiSuccess(updated);
+  },
+);
+
+export const DELETE = apiHandler(
+  async (request: NextRequest, ctx: { params: Promise<{ id: string }> }) => {
+    const { user } = await requireAdmin();
+    const { id } = await ctx.params;
+
+    const updated = await prisma.feedback.update({
+      where: { id },
+      data: { status: "ARCHIVED" },
+      select: { id: true, status: true },
+    });
+
+    await auditLog("admin.feedback.archive", {
+      userId: user.id,
+      ipAddress: getClientIp(request),
+      details: { feedbackId: id },
+    });
+
+    return apiSuccess(updated);
+  },
+);

src/app/api/admin/feedback/route.ts

@@ -0,0 +1,67 @@
+/**
+ * Admin feedback inbox. Lists all feedback with status filter.
+ */
+import { apiHandler, requireAdmin } from "@/lib/api-handler";
+import { apiSuccess } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { prisma } from "@/lib/db";
+import type { NextRequest } from "next/server";
+import type { FeedbackStatus } from "@/generated/prisma/client";
+
+export const GET = apiHandler(async (request: NextRequest) => {
+  await requireAdmin();
+
+  const url = new URL(request.url);
+  const status = url.searchParams.get("status") as FeedbackStatus | null;
+  const limit = Math.min(
+    100,
+    Math.max(1, Number(url.searchParams.get("limit") ?? 50)),
+  );
+  const offset = Math.max(0, Number(url.searchParams.get("offset") ?? 0));
+
+  const where = status ? { status } : {};
+
+  const [items, total, counts] = await Promise.all([
+    prisma.feedback.findMany({
+      where,
+      orderBy: { createdAt: "desc" },
+      take: limit,
+      skip: offset,
+      select: {
+        id: true,
+        userId: true,
+        email: true,
+        category: true,
+        subject: true,
+        description: true,
+        status: true,
+        adminNote: true,
+        gitHubIssueUrl: true,
+        metadata: true,
+        screenshotBase64: true,
+        createdAt: true,
+        updatedAt: true,
+        user: { select: { username: true } },
+      },
+    }),
+    prisma.feedback.count({ where }),
+    prisma.feedback.groupBy({
+      by: ["status"],
+      _count: { _all: true },
+    }),
+  ]);
+
+  annotate({
+    action: { name: "admin.feedback.list" },
+    meta: { total, filtered_status: status },
+  });
+
+  const countsByStatus = Object.fromEntries(
+    counts.map((c) => [c.status, c._count._all]),
+  ) as Record<FeedbackStatus, number>;
+
+  return apiSuccess({
+    items,
+    meta: { total, limit, offset, countsByStatus },
+  });
+});

src/app/api/admin/monitoring/glitchtip-test/route.ts

@@ -12,10 +12,10 @@ export const POST = apiHandler(async () => {
 
   const settings = await getGlitchtipSettings();
   if (!settings.glitchtipEnabled) {
-    return apiError("Glitchtip ist deaktiviert", 422);
+    return apiError("Glitchtip is disabled", 422);
   }
   if (!settings.glitchtipDsn) {
-    return apiError("Glitchtip DSN fehlt", 422);
+    return apiError("Glitchtip DSN is missing", 422);
   }
 
   const delivery = await sendGlitchtipEvent({
@@ -32,13 +32,13 @@ export const POST = apiHandler(async () => {
   if (!delivery.ok) {
     getEvent()?.addWarning("Glitchtip test event rejected: " + delivery.method + " " + delivery.status + " " + delivery.details);
     return apiError(
-      `Glitchtip-Testevent wurde abgelehnt (HTTP ${delivery.status ?? 502})`,
+      `Glitchtip test event rejected (HTTP ${delivery.status ?? 502})`,
       502,
     );
   }
 
   return apiSuccess({
     sent: true,
-    message: "Glitchtip-Testevent wurde gesendet",
+    message: "Glitchtip test event sent",
   });
 });

src/app/api/admin/monitoring/umami-test/route.ts

@@ -51,18 +51,18 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   const settings = await getPublicMonitoringSettings();
   if (!settings.umamiEnabled) {
-    return apiError("Umami ist deaktiviert", 422);
+    return apiError("Umami is disabled", 422);
   }
   if (!settings.umamiScriptUrl || !settings.umamiWebsiteId) {
     return apiError(
-      "Umami Script-URL und Website-ID müssen konfiguriert sein",
+      "Umami script URL and website ID must be configured",
       422,
     );
   }
 
   const targetUrls = resolveUmamiSendUrls(settings.umamiScriptUrl);
   if (targetUrls.length === 0) {
-    return apiError("Umami Script-URL ist ungültig", 422);
+    return apiError("Umami script URL is invalid", 422);
   }
 
   const appUrl = resolveAppUrl(request);
@@ -72,7 +72,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
       website: settings.umamiWebsiteId,
       hostname: appUrl.hostname,
       screen: "1920x1080",
-      language: "de-DE",
+      language: "en-US",
       title: "HealthLog Monitoring Test",
       url: "/admin",
       referrer: "",
@@ -100,7 +100,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
     if (upstream.ok) {
       return apiSuccess({
         sent: true,
-        message: "Umami-Testevent wurde gesendet",
+        message: "Umami test event sent",
       });
     }
 
@@ -117,7 +117,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   getEvent()?.addWarning("Umami test event rejected: " + lastStatus);
   return apiError(
-    `Umami-Testevent wurde abgelehnt (HTTP ${lastStatus})`,
+    `Umami test event rejected (HTTP ${lastStatus})`,
     502,
   );
 });

src/app/api/admin/notifications/reminder-check/route.ts

@@ -11,7 +11,9 @@ export const dynamic = "force-dynamic";
 function parseTimeToMinutes(value: string): number {
   const [h, m] = value.split(":").map(Number);
   if (!Number.isFinite(h) || !Number.isFinite(m)) return 0;
-  return h * 60 + m;
+  // Normalize "24:00" → "00:00" (some ICU builds emit that for midnight).
+  const hours = h === 24 ? 0 : h;
+  return hours * 60 + m;
 }
 
 const dayLabels = ["So", "Mo", "Di", "Mi", "Do", "Fr", "Sa"];
@@ -71,7 +73,7 @@ export const POST = apiHandler(async () => {
       now,
       userTz,
     );
-    const currentTime = now.toLocaleTimeString("de-DE", {
+    const currentTime = now.toLocaleTimeString("en-GB", {
       timeZone: userTz,
       hour: "2-digit",
       minute: "2-digit",

src/app/api/admin/notifications/test/route.ts

@@ -79,7 +79,7 @@ export const POST = apiHandler(async () => {
   if (channels.length === 0) {
     return apiSuccess({
       sent: false,
-      message: "Keine aktivierten Benachrichtigungskanäle gefunden",
+      message: "No enabled notification channels found",
       results: [],
     });
   }
@@ -89,7 +89,7 @@ export const POST = apiHandler(async () => {
     userId: user.id,
     title: "Test-Notification",
     message:
-      "<b>HealthLog Test:</b> Wenn du diese Nachricht siehst, funktionieren deine Benachrichtigungen!",
+      "<b>HealthLog Test:</b> If you see this message, your notifications are working!",
   };
 
   const results: Array<{
@@ -104,7 +104,7 @@ export const POST = apiHandler(async () => {
       results.push({
         channel: channel.type,
         success: false,
-        error: "SYSTEM_ALERT deaktiviert in Einstellungen",
+        error: "SYSTEM_ALERT disabled in settings",
       });
       continue;
     }
@@ -124,7 +124,7 @@ export const POST = apiHandler(async () => {
             results.push({
               channel: "TELEGRAM",
               success: false,
-              error: `Telegram API hat Fehler gemeldet (chatId: ${config.chatId})`,
+              error: `Telegram API reported error (chatId: ${config.chatId})`,
             });
             continue;
           }
@@ -139,7 +139,7 @@ export const POST = apiHandler(async () => {
             results.push({
               channel: "NTFY",
               success: false,
-              error: `Senden fehlgeschlagen (topic: ${config.topic})`,
+              error: `Send failed (topic: ${config.topic})`,
             });
             continue;
           }
@@ -153,7 +153,7 @@ export const POST = apiHandler(async () => {
           results.push({
             channel: type,
             success: false,
-            error: "Unbekannter Kanaltyp",
+            error: "Unknown channel type",
           });
           continue;
       }
@@ -163,7 +163,7 @@ export const POST = apiHandler(async () => {
       results.push({
         channel: channel.type,
         success: false,
-        error: err instanceof Error ? err.message : "Unbekannter Fehler",
+        error: err instanceof Error ? err.message : "Unknown error",
       });
     }
   }
@@ -173,11 +173,11 @@ export const POST = apiHandler(async () => {
 
   let message: string;
   if (failCount === 0) {
-    message = `Alle ${successCount} Kanäle erfolgreich`;
+    message = `All ${successCount} channels successful`;
   } else if (successCount === 0) {
-    message = `Alle ${failCount} Kanäle fehlgeschlagen`;
+    message = `All ${failCount} channels failed`;
   } else {
-    message = `${successCount} erfolgreich, ${failCount} fehlgeschlagen`;
+    message = `${successCount} successful, ${failCount} failed`;
   }
 
   return apiSuccess({ sent: successCount > 0, message, results });

src/app/api/admin/settings/route.ts

@@ -180,7 +180,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
   }
 
   if (Object.keys(updates).length === 0) {
-    return apiError("Keine gültigen Felder", 422);
+    return apiError("No valid fields", 422);
   }
 
   const settings = await prisma.appSettings.upsert({

src/app/api/admin/users/[id]/reset-password/route.ts

@@ -7,6 +7,7 @@ import { annotate } from "@/lib/logging/context";
 import { checkRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { destroyAllSessions } from "@/lib/auth/session";
 import { NextRequest, NextResponse } from "next/server";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const POST = apiHandler(async (
   request: NextRequest,
@@ -32,16 +33,20 @@ export const POST = apiHandler(async (
   const { password } = body as { password?: string };
 
   if (!password || typeof password !== "string") {
-    return apiError("Passwort erforderlich", 422);
+    return apiError("Password required", 422);
   }
 
   const target = await prisma.user.findUnique({ where: { id } });
-  if (!target) return apiError("Benutzer nicht gefunden", 404);
+  if (!target) return apiError("User not found", 404);
 
-  const strength = checkPasswordStrength(password, [target.username]);
+  const locale = await resolveServerLocale({
+    request,
+    userLocale: target.locale ?? null,
+  });
+  const strength = checkPasswordStrength(password, [target.username], locale);
   if (!strength.isAcceptable) {
     return apiError(
-      strength.feedback[0] || "Passwort zu schwach (Score < 3)",
+      strength.feedback[0] || "Password too weak (score < 3)",
       422,
     );
   }

src/app/api/admin/users/[id]/route.ts

@@ -30,13 +30,13 @@ export const PUT = apiHandler(async (
   }
 
   const target = await prisma.user.findUnique({ where: { id } });
-  if (!target) return apiError("Benutzer nicht gefunden", 404);
+  if (!target) return apiError("User not found", 404);
 
   // Prevent removing the last admin
   if (parsed.data.role === "USER" && target.role === "ADMIN") {
     const adminCount = await prisma.user.count({ where: { role: "ADMIN" } });
     if (adminCount <= 1) {
-      return apiError("Der letzte Admin kann nicht degradiert werden", 400);
+      return apiError("The last admin cannot be demoted", 400);
     }
   }
 

src/app/api/ai/test/route.ts

@@ -0,0 +1,43 @@
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { resolveProvider } from "@/lib/ai/provider";
+import { apiSuccess, apiError } from "@/lib/api-response";
+import { checkRateLimit } from "@/lib/rate-limit";
+import { annotate } from "@/lib/logging/context";
+
+export const dynamic = "force-dynamic";
+
+export const POST = apiHandler(async () => {
+  const { user } = await requireAuth();
+  annotate({ action: { name: "ai.test" } });
+
+  const rl = await checkRateLimit(`ai-test:${user.id}`, 5, 60_000);
+  if (!rl.allowed) return apiError("Too many test requests", 429);
+
+  const provider = await resolveProvider(user.id);
+  if (provider.type === "none") {
+    return apiError("No AI provider configured", 422);
+  }
+
+  try {
+    const result = await provider.generateCompletion({
+      systemPrompt: "You are a connection-test responder.",
+      userPrompt: 'Reply with the JSON object {"ok": true} and nothing else.',
+      temperature: 0,
+      maxTokens: 32,
+    });
+
+    return apiSuccess({
+      ok: true,
+      providerType: result.providerType,
+      model: result.model,
+      tokensUsed: result.tokensUsed,
+      sample: result.content.slice(0, 200),
+    });
+  } catch (e) {
+    const err = e as Error & { httpStatus?: number; bodyExcerpt?: string };
+    return apiError(
+      `${err.message}${err.bodyExcerpt ? ` — ${err.bodyExcerpt.slice(0, 200)}` : ""}`,
+      502,
+    );
+  }
+});

src/app/api/analytics/route.ts

@@ -20,6 +20,7 @@ export const GET = apiHandler(async () => {
     "BODY_FAT",
     "SLEEP_DURATION",
     "ACTIVITY_STEPS",
+    "BLOOD_GLUCOSE",
   ];
 
   const measurementsByType = await Promise.all(
@@ -110,9 +111,28 @@ export const GET = apiHandler(async () => {
     }
   }
 
+  // Per-context glucose summaries (canonical mg/dL).
+  const glucoseRows = await prisma.measurement.findMany({
+    where: { userId: user.id, type: "BLOOD_GLUCOSE" },
+    orderBy: { measuredAt: "asc" },
+    select: { value: true, measuredAt: true, glucoseContext: true },
+  });
+  const glucoseByContext: Record<string, ReturnType<typeof summarize>> = {};
+  if (glucoseRows.length > 0) {
+    const contexts = ["FASTING", "POSTPRANDIAL", "RANDOM", "BEDTIME"] as const;
+    for (const ctx of contexts) {
+      const ctxRows = glucoseRows.filter((r) => r.glucoseContext === ctx);
+      if (ctxRows.length === 0) continue;
+      glucoseByContext[ctx] = summarize(
+        ctxRows.map((r): DataPoint => ({ date: r.measuredAt, value: r.value })),
+      );
+    }
+  }
+
   return apiSuccess({
     summaries: results,
     bmi,
     bpInTargetPct,
+    glucoseByContext,
   });
 });

src/app/api/auth/codex/authorize/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { apiHandler, requireAuth, HttpError } from "@/lib/api-handler";
+import { checkRateLimit } from "@/lib/rate-limit";
+import {
+  generatePKCE,
+  generateState,
+  buildAuthorizationUrl,
+} from "@/lib/ai/codex-oauth";
+import { cookies } from "next/headers";
+import { annotate } from "@/lib/logging/context";
+
+export const GET = apiHandler(async (_request: NextRequest) => {
+  const { user } = await requireAuth();
+
+  const rl = await checkRateLimit(`codex-authorize:${user.id}`, 5, 60_000);
+  if (!rl.allowed) throw new HttpError(429, "Too many requests");
+
+  const { verifier, challenge } = generatePKCE();
+  const state = generateState();
+
+  const appUrl = process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL;
+  if (!appUrl) throw new Error("APP_URL not configured");
+
+  const redirectUri = `${appUrl}/api/auth/codex/callback`;
+
+  const cookieStore = await cookies();
+  const cookieOptions = {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax" as const,
+    path: "/",
+    maxAge: 300,
+  };
+
+  cookieStore.set("codex_verifier", verifier, cookieOptions);
+  cookieStore.set("codex_state", state, cookieOptions);
+
+  const authUrl = buildAuthorizationUrl({
+    codeChallenge: challenge,
+    state,
+    redirectUri,
+  });
+  annotate({ action: { name: "codex.oauth.authorize" } });
+
+  return NextResponse.redirect(authUrl);
+});

src/app/api/auth/codex/callback/route.ts

@@ -0,0 +1,97 @@
+import { NextRequest, NextResponse } from "next/server";
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { checkRateLimit } from "@/lib/rate-limit";
+import { exchangeCodeForTokens, encryptTokens } from "@/lib/ai/codex-oauth";
+import { prisma } from "@/lib/db";
+import { auditLog } from "@/lib/auth/audit";
+import { getClientIp } from "@/lib/api-response";
+import { cookies } from "next/headers";
+import { annotate } from "@/lib/logging/context";
+
+export const GET = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAuth();
+
+  const rl = await checkRateLimit(`codex-callback:${user.id}`, 10, 60_000);
+  if (!rl.allowed) {
+    const appUrl = process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL;
+    return NextResponse.redirect(`${appUrl}/settings?codex_error=rate_limited`);
+  }
+
+  const url = new URL(request.url);
+
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  const error = url.searchParams.get("error");
+
+  const appUrl = process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL;
+  if (!appUrl) throw new Error("APP_URL not configured");
+
+  if (error) {
+    annotate({ meta: { oauth_error: error } });
+    return NextResponse.redirect(
+      `${appUrl}/settings?codex_error=${encodeURIComponent(error)}`,
+    );
+  }
+
+  if (!code || !state) {
+    return NextResponse.redirect(
+      `${appUrl}/settings?codex_error=missing_params`,
+    );
+  }
+
+  const cookieStore = await cookies();
+  const storedState = cookieStore.get("codex_state")?.value;
+  const storedVerifier = cookieStore.get("codex_verifier")?.value;
+
+  cookieStore.delete("codex_state");
+  cookieStore.delete("codex_verifier");
+
+  if (!storedState || !storedVerifier || state !== storedState) {
+    return NextResponse.redirect(
+      `${appUrl}/settings?codex_error=invalid_state`,
+    );
+  }
+
+  const redirectUri = `${appUrl}/api/auth/codex/callback`;
+
+  try {
+    const tokens = await exchangeCodeForTokens({
+      code,
+      codeVerifier: storedVerifier,
+      redirectUri,
+    });
+    const encrypted = encryptTokens({
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+    });
+
+    await prisma.user.update({
+      where: { id: user.id },
+      data: {
+        codexAccessTokenEncrypted: encrypted.accessEncrypted,
+        codexRefreshTokenEncrypted: encrypted.refreshEncrypted,
+        codexTokenExpiresAt: new Date(
+          Date.now() + tokens.expires_in * 1000,
+        ),
+        codexConnectedAt: new Date(),
+        codexConnectionStatus: "connected",
+        insightsCachedAt: null,
+        insightsCachedText: null,
+      },
+    });
+
+    await auditLog("codex.oauth.connected", {
+      userId: user.id,
+      ipAddress: getClientIp(request),
+    });
+    annotate({ action: { name: "codex.oauth.callback.success" } });
+
+    return NextResponse.redirect(`${appUrl}/settings?codex_connected=true`);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "unknown";
+    annotate({ meta: { codex_token_error: message } });
+    return NextResponse.redirect(
+      `${appUrl}/settings?codex_error=token_exchange_failed`,
+    );
+  }
+});

src/app/api/auth/codex/disconnect/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest } from "next/server";
+import { apiHandler, requireAuth, HttpError } from "@/lib/api-handler";
+import { checkRateLimit } from "@/lib/rate-limit";
+import { prisma } from "@/lib/db";
+import { auditLog } from "@/lib/auth/audit";
+import { apiSuccess, getClientIp } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+
+export const DELETE = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAuth();
+
+  const rl = await checkRateLimit(`codex-disconnect:${user.id}`, 5, 60_000);
+  if (!rl.allowed) throw new HttpError(429, "Too many requests");
+
+  await prisma.user.update({
+    where: { id: user.id },
+    data: {
+      codexAccessTokenEncrypted: null,
+      codexRefreshTokenEncrypted: null,
+      codexTokenExpiresAt: null,
+      codexConnectedAt: null,
+      codexConnectionStatus: "disconnected",
+      insightsCachedAt: null,
+      insightsCachedText: null,
+    },
+  });
+
+  await auditLog("codex.oauth.disconnected", {
+    userId: user.id,
+    ipAddress: getClientIp(request),
+  });
+  annotate({ action: { name: "codex.oauth.disconnect" } });
+
+  return apiSuccess({ disconnected: true });
+});

src/app/api/auth/login/route.ts

@@ -17,7 +17,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
     return NextResponse.json(
       {
         data: null,
-        error: "Zu viele Anmeldeversuche. Bitte später erneut versuchen.",
+        error: "Too many login attempts. Please try again later.",
       },
       { status: 429, headers: rateLimitHeaders(rl) },
     );
@@ -31,7 +31,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   const parsed = loginPasswordSchema.safeParse(body);
 
   if (!parsed.success) {
-    return apiError("Ungültige Anmeldedaten", 422);
+    return apiError("Invalid credentials", 422);
   }
 
   const { email, password } = parsed.data;
@@ -51,7 +51,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
       ipAddress: ip,
       details: { identifier, reason: "user_not_found_or_no_password" },
     });
-    return apiError("Ungültige Anmeldedaten", 401);
+    return apiError("Invalid credentials", 401);
   }
 
   const valid = await verifyPassword(user.passwordHash, password);
@@ -61,7 +61,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
       ipAddress: ip,
       details: { reason: "invalid_password" },
     });
-    return apiError("Ungültige Anmeldedaten", 401);
+    return apiError("Invalid credentials", 401);
   }
 
   const ua = request.headers.get("user-agent");

src/app/api/auth/me/route.ts

@@ -21,5 +21,6 @@ export const GET = apiHandler(async () => {
     timezone: user.timezone,
     onboardingCompletedAt: user.onboardingCompletedAt,
     gravatarUrl: user.email ? getGravatarUrl(user.email) : null,
+    glucoseUnit: user.glucoseUnit ?? null,
   });
 });

src/app/api/auth/passkey/login-options/route.ts

@@ -16,7 +16,7 @@ export const POST = apiHandler(async (request: Request) => {
     return NextResponse.json(
       {
         data: null,
-        error: "Zu viele Passkey-Anfragen. Bitte später erneut versuchen.",
+        error: "Too many passkey requests. Please try again later.",
       },
       { status: 429, headers: rateLimitHeaders(rl) },
     );

src/app/api/auth/passkey/login-verify/route.ts

@@ -15,7 +15,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   const ip = getClientIp(request);
   const rl = await checkRateLimit(`auth:passkey-verify:${ip}`, 10, 15 * 60 * 1000);
   if (!rl.allowed) {
-    return apiError("Zu viele Versuche. Bitte 15 Minuten warten.", 429);
+    return apiError("Too many attempts. Please wait 15 minutes.", 429);
   }
 
   const { data: body, error: jsonError } = await safeJson<Record<string, unknown>>(request);
@@ -25,7 +25,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   const credential = body.credential;
 
   if (!challengeId || !credential) {
-    return apiError("challengeId und credential erforderlich", 422);
+    return apiError("challengeId and credential required", 422);
   }
 
   const { verification, passkey } = await verifyAuthentication(
@@ -38,7 +38,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
       ipAddress: ip,
       details: { reason: "passkey_verification_failed" },
     });
-    return apiError("Passkey-Verifizierung fehlgeschlagen", 401);
+    return apiError("Passkey verification failed", 401);
   }
 
   const user = await prisma.user.findUnique({
@@ -46,7 +46,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   });
 
   if (!user) {
-    return apiError("Benutzer nicht gefunden", 404);
+    return apiError("User not found", 404);
   }
 
   const ua = request.headers.get("user-agent");

src/app/api/auth/passkey/register-verify/route.ts

@@ -16,13 +16,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
   const credential = body.credential as Record<string, unknown> | undefined;
 
   if (!challengeId || !credential) {
-    return apiError("challengeId und credential erforderlich", 422);
+    return apiError("challengeId and credential required", 422);
   }
 
   const verification = await verifyRegistration(challengeId, credential);
 
   if (!verification.verified || !verification.registrationInfo) {
-    return apiError("Passkey-Verifizierung fehlgeschlagen", 400);
+    return apiError("Passkey verification failed", 400);
   }
 
   const { registrationInfo } = verification;

src/app/api/auth/passkeys/[id]/route.ts

@@ -18,7 +18,7 @@ export const DELETE = apiHandler(async (
   });
 
   if (!passkey || passkey.userId !== user.id) {
-    return apiError("Passkey nicht gefunden", 404);
+    return apiError("Passkey not found", 404);
   }
 
   // Check: at least 1 auth method must remain
@@ -29,7 +29,7 @@ export const DELETE = apiHandler(async (
 
   if (passkeyCount <= 1 && !hasPassword) {
     return apiError(
-      "Kann nicht gelöscht werden — es muss mindestens eine Anmeldemethode bestehen bleiben",
+      "Cannot delete — at least one authentication method must remain",
       400,
     );
   }

src/app/api/auth/password/route.ts

@@ -12,6 +12,7 @@ import { checkRateLimit } from "@/lib/rate-limit";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { destroyAllSessions, createSession } from "@/lib/auth/session";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const POST = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
@@ -23,7 +24,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   );
   if (!rl.allowed) {
     return apiError(
-      "Zu viele Versuche. Bitte 15 Minuten warten.",
+      "Too many attempts. Please wait 15 minutes.",
       429,
     );
   }
@@ -38,7 +39,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   const { currentPassword, newPassword } = parsed.data;
   if (!user.passwordHash) {
-    return apiError("Für dieses Konto ist kein Passwort gesetzt", 400);
+    return apiError("No password set for this account", 400);
   }
 
   const currentValid = await verifyPassword(
@@ -46,23 +47,28 @@ export const POST = apiHandler(async (request: NextRequest) => {
     currentPassword,
   );
   if (!currentValid) {
-    return apiError("Aktuelles Passwort ist falsch", 401);
+    return apiError("Current password is incorrect", 401);
   }
 
   if (currentPassword === newPassword) {
     return apiError(
-      "Neues Passwort muss sich vom aktuellen unterscheiden",
+      "New password must differ from current password",
       422,
     );
   }
 
-  const strength = checkPasswordStrength(newPassword, [
-    user.username,
-    user.email ?? "",
-  ]);
+  const locale = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+  });
+  const strength = checkPasswordStrength(
+    newPassword,
+    [user.username, user.email ?? ""],
+    locale,
+  );
   if (!strength.isAcceptable) {
     return apiError(
-      strength.feedback[0] || "Passwort zu schwach (Score < 3)",
+      strength.feedback[0] || "Password too weak (score < 3)",
       422,
     );
   }

src/app/api/auth/profile/route.ts

@@ -28,7 +28,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     });
 
     if (existingUser && existingUser.id !== user.id) {
-      return apiError("E-Mail-Adresse wird bereits verwendet", 409);
+      return apiError("Email already in use", 409);
     }
   }
 

src/app/api/auth/register/route.ts

@@ -9,6 +9,7 @@ import { ensureDbCompatibility } from "@/lib/db-compat";
 import { NextRequest, NextResponse } from "next/server";
 import { apiHandler } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const POST = apiHandler(async (request: NextRequest) => {
   const ip = getClientIp(request) ?? "unknown";
@@ -18,7 +19,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
       {
         data: null,
         error:
-          "Zu viele Registrierungsversuche. Bitte später erneut versuchen.",
+          "Too many registration attempts. Please try again later.",
       },
       { status: 429, headers: rateLimitHeaders(rl) },
     );
@@ -42,7 +43,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
     // Table may not exist yet; allow registration
   }
   if (!registrationEnabled) {
-    return apiError("Registrierung ist deaktiviert", 403);
+    return apiError("Registration is disabled", 403);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -62,14 +63,15 @@ export const POST = apiHandler(async (request: NextRequest) => {
     prisma.user.findUnique({ where: { username } }),
   ]);
   if (existingEmail || existingUsername) {
-    return apiError("Benutzername oder E-Mail-Adresse bereits vergeben", 409);
+    return apiError("Username or email already taken", 409);
   }
 
-  // Validate password strength
-  const strength = checkPasswordStrength(password, [username, email]);
+  // Validate password strength (locale-aware feedback)
+  const locale = await resolveServerLocale({ request });
+  const strength = checkPasswordStrength(password, [username, email], locale);
   if (!strength.isAcceptable) {
     return apiError(
-      strength.feedback[0] || "Passwort zu schwach (Score < 3)",
+      strength.feedback[0] || "Password too weak (score < 3)",
       422,
     );
   }

src/app/api/bugreport/route.ts

@@ -8,11 +8,16 @@ import { decrypt } from "@/lib/crypto";
 import { NextRequest } from "next/server";
 import { z } from "zod/v4";
 
+// Strict image/* data URL (no SVG — it can carry inline JS).
+const SCREENSHOT_DATA_URL =
+  /^data:image\/(png|jpeg|webp|gif);base64,[A-Za-z0-9+/=]+$/;
+
 const bugReportSchema = z.object({
-  description: z.string().min(10, "Beschreibung zu kurz").max(5000),
+  description: z.string().min(10, "Description too short").max(5000),
   screenshot: z
     .string()
-    .max(7_000_000, "Screenshot zu groß (max. 5 MB)")
+    .max(7_000_000, "Screenshot too large (max 5 MB)")
+    .regex(SCREENSHOT_DATA_URL, "Screenshot must be a base64-encoded PNG/JPEG/WEBP/GIF data URL")
     .optional(),
 });
 
@@ -21,7 +26,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   const rl = await checkRateLimit(`bugreport:${user.id}`, 3, 60 * 60 * 1000);
   if (!rl.allowed) {
-    return apiError("Maximal 3 Bugreports pro Stunde", 429);
+    return apiError("Maximum 3 bug reports per hour", 429);
   }
 
   annotate({ action: { name: "bugreport.submit" } });
@@ -47,9 +52,12 @@ export const POST = apiHandler(async (request: NextRequest) => {
   const ghRepo = appSettings?.githubIssueRepo || process.env.GITHUB_ISSUE_REPO; // e.g. "owner/repo"
 
   if (!ghToken || !ghRepo) {
+    // 503 instead of 500: the client keys off status to render the "not
+    // configured" screen. The user also sees a clear message rather than
+    // "Internal server error".
     return apiError(
-      "Bugreport ist nicht konfiguriert (GitHub-Issue-Token/Repository in Admin-Einstellungen fehlt)",
-      500,
+      "Bug report not configured (GitHub issue token/repository missing in admin settings)",
+      503,
     );
   }
 
@@ -63,27 +71,36 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   const { description, screenshot } = parsed.data;
 
-  const dateStr = new Date().toLocaleString("de-DE", {
-    timeZone: "Europe/Berlin",
-  });
+  // GitHub issues are maintainer-facing and the repo's primary language is English.
+  // Use an ISO-8601 timestamp so titles are unambiguous and sortable.
+  const now = new Date();
+  const dateStr = now.toISOString().replace("T", " ").slice(0, 16) + " UTC";
   const title = `Bug Report – ${dateStr}`;
 
-  // Sanitize user-provided content for GitHub markdown
+  // Sanitize user-provided content for GitHub markdown. Strip HTML tags
+  // entirely (prevents `<img onerror=>` etc.) and neutralise markdown link
+  // targets that start with dangerous schemes like javascript: or data:.
   const safeUsername = user.username.replace(/[`*_~<>\[\]|]/g, "");
   const safeDescription = description
+    .replace(/<[^>]*>/g, "") // strip HTML tags
+    .replace(
+      /\]\(\s*(javascript|data|vbscript|file):/gi,
+      "](about:blank#",
+    ) // neutralise dangerous markdown link schemes
     .replace(/```/g, "\\`\\`\\`")
     .slice(0, 5000);
 
-  // Build issue body
-  let issueBody = `**Gemeldet von:** ${safeUsername}\n`;
-  issueBody += `**Datum:** ${dateStr}\n\n`;
-  issueBody += `## Beschreibung\n\n${safeDescription}\n`;
-  issueBody += `\n---\n*Erstellt über die HealthLog Bugreport-Funktion*`;
+  // Wrap the user's description in a fenced code block so any residual
+  // markdown renders literally rather than as executable markup.
+  let issueBody = `**Reported by:** ${safeUsername}\n`;
+  issueBody += `**Date:** ${dateStr}\n\n`;
+  issueBody += `## Description\n\n\`\`\`\n${safeDescription}\n\`\`\`\n`;
+  issueBody += `\n---\n*Created via HealthLog bug report*`;
 
   // If screenshot provided, upload to GitHub as a gist or include as base64
   // For simplicity, we'll note there's a screenshot but GitHub issues don't support inline base64
   if (screenshot) {
-    issueBody += `\n\n**Screenshot:** Ein Screenshot wurde angehängt (siehe Kommentar).`;
+    issueBody += `\n\n**Screenshot:** A screenshot was attached (see comment).`;
   }
 
   // Create the issue
@@ -107,7 +124,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   if (!issueRes.ok) {
     const errBody = await issueRes.text();
     getEvent()?.addWarning("GitHub issue creation failed: " + errBody);
-    return apiError("Issue konnte nicht erstellt werden", 500);
+    return apiError("Failed to create issue", 500);
   }
 
   const issue = (await issueRes.json()) as {
@@ -123,7 +140,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
     // Upload screenshot as issue comment with embedded image
     // GitHub doesn't support base64 in comments, so we note the limitation
-    const commentBody = `### Screenshot\n\n![Screenshot](data:image/${ext};base64,${base64Data.slice(0, 100)}...)\n\n*Hinweis: Der vollständige Screenshot wurde aus Größengründen gekürzt. Bitte den Nutzer direkt kontaktieren.*`;
+    const commentBody = `### Screenshot\n\n![Screenshot](data:image/${ext};base64,${base64Data.slice(0, 100)}...)\n\n*Note: The full screenshot was truncated due to size limits. Please contact the user directly.*`;
 
     await fetch(
       `https://api.github.com/repos/${ghRepo}/issues/${issue.number}/comments`,

src/app/api/bugreport/status/route.ts

@@ -0,0 +1,49 @@
+/**
+ * Returns whether bug report submission is configured (GitHub token + repo).
+ *
+ * The bug report page uses this to gate its UI so users don't hit a silent
+ * 500 when the admin hasn't set up the GitHub integration. Only two booleans
+ * escape: a single `configured` flag and `isAdmin` so the page can render
+ * the admin-specific copy + admin link. Token/repo granularity is kept
+ * server-side (log annotation only) so we don't hand regular users a probe.
+ */
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiSuccess, apiError } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { checkRateLimit } from "@/lib/rate-limit";
+import { prisma } from "@/lib/db";
+
+export const GET = apiHandler(async () => {
+  const { user } = await requireAuth();
+
+  // Light rate limit — the endpoint is cheap, but no reason to let a logged-in
+  // client hammer Postgres in a loop.
+  const rl = await checkRateLimit(
+    `bugreport-status:${user.id}`,
+    30,
+    60 * 1000,
+  );
+  if (!rl.allowed) {
+    return apiError("Rate limit exceeded", 429);
+  }
+
+  const appSettings = await prisma.appSettings.findUnique({
+    where: { id: "singleton" },
+    select: { githubIssueTokenEncrypted: true, githubIssueRepo: true },
+  });
+
+  const hasToken = Boolean(
+    appSettings?.githubIssueTokenEncrypted || process.env.GITHUB_ISSUE_TOKEN,
+  );
+  const hasRepo = Boolean(
+    appSettings?.githubIssueRepo || process.env.GITHUB_ISSUE_REPO,
+  );
+  const configured = hasToken && hasRepo;
+
+  annotate({
+    action: { name: "bugreport.status" },
+    meta: { configured, has_token: hasToken, has_repo: hasRepo },
+  });
+
+  return apiSuccess({ configured, isAdmin: user.role === "ADMIN" });
+});

src/app/api/dashboard/widgets/route.ts

@@ -0,0 +1,102 @@
+/**
+ * GET / PUT / DELETE dashboard widget layout.
+ *
+ * GET returns the resolved effective layout (defaults merged in if the user
+ * hasn't customized yet). PUT replaces the layout atomically. DELETE resets
+ * to default.
+ */
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiSuccess, apiError, safeJson } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { prisma } from "@/lib/db";
+import {
+  resolveDashboardLayout,
+  serializeDashboardLayout,
+  DEFAULT_DASHBOARD_LAYOUT,
+  type DashboardLayout,
+} from "@/lib/dashboard-layout";
+import { Prisma } from "@/generated/prisma/client";
+import { z } from "zod/v4";
+import type { NextRequest } from "next/server";
+
+const widgetIdEnum = z.enum([
+  "weight",
+  "bp",
+  "pulse",
+  "bodyFat",
+  "mood",
+  "medications",
+  "sleep",
+  "steps",
+  "glucose",
+  "totalBodyWater",
+  "boneMass",
+  "bpInTarget",
+]);
+
+const layoutSchema = z.object({
+  version: z.literal(1),
+  widgets: z
+    .array(
+      z.object({
+        id: widgetIdEnum,
+        visible: z.boolean(),
+        order: z.number().int().min(0).max(99),
+      }),
+    )
+    .min(1)
+    .max(20),
+});
+
+export const GET = apiHandler(async () => {
+  const { user } = await requireAuth();
+
+  const row = await prisma.user.findUnique({
+    where: { id: user.id },
+    select: { dashboardWidgetsJson: true },
+  });
+
+  const layout = resolveDashboardLayout(row?.dashboardWidgetsJson);
+  return apiSuccess(layout);
+});
+
+export const PUT = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAuth();
+
+  const { data: body, error: jsonError } = await safeJson(request);
+  if (jsonError) return jsonError;
+
+  const parsed = layoutSchema.safeParse(body);
+  if (!parsed.success) {
+    return apiError(parsed.error.issues[0].message, 422);
+  }
+
+  const normalized = serializeDashboardLayout(parsed.data as DashboardLayout);
+
+  await prisma.user.update({
+    where: { id: user.id },
+    data: {
+      dashboardWidgetsJson: normalized as unknown as Prisma.InputJsonValue,
+    },
+  });
+
+  annotate({
+    action: { name: "dashboard.widgets.update" },
+    meta: { visible_count: normalized.widgets.filter((w) => w.visible).length },
+  });
+
+  return apiSuccess(normalized);
+});
+
+export const DELETE = apiHandler(async () => {
+  const { user } = await requireAuth();
+
+  await prisma.user.update({
+    where: { id: user.id },
+    data: { dashboardWidgetsJson: Prisma.JsonNull },
+  });
+
+  annotate({ action: { name: "dashboard.widgets.reset" } });
+
+  return apiSuccess(DEFAULT_DASHBOARD_LAYOUT);
+});

src/app/api/doctor-report/route.ts

@@ -5,6 +5,12 @@ import { auditLog } from "@/lib/auth/audit";
 import { apiSuccess, apiError, getClientIp, safeJson } from "@/lib/api-response";
 import { checkRateLimit } from "@/lib/rate-limit";
 import { NextRequest } from "next/server";
+import {
+  getEffectiveRange,
+  type ThresholdOverridesJson,
+} from "@/lib/analytics/effective-range";
+import { resolveGlucoseUnit, thresholdMetricForContext } from "@/lib/glucose";
+import type { GlucoseContext } from "@/generated/prisma/client";
 
 /**
  * Collect data for doctor report PDF generation (client-side).
@@ -16,7 +22,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   const rl = await checkRateLimit(`doctor-report:${user.id}`, 10, 60 * 60 * 1000);
   if (!rl.allowed) {
-    return apiError("Maximal 10 Reports pro Stunde", 429);
+    return apiError("Maximum 10 reports per hour", 429);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -58,6 +64,8 @@ export const POST = apiHandler(async (request: NextRequest) => {
           dateOfBirth: true,
           gender: true,
           heightCm: true,
+          glucoseUnit: true,
+          thresholdsJson: true,
         },
       }),
     ]);
@@ -145,6 +153,46 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   annotate({ meta: { report_days: days } });
 
+  // Per-context glucose stats (canonical mg/dL) and effective ranges.
+  const glucoseContexts: GlucoseContext[] = [
+    "FASTING",
+    "POSTPRANDIAL",
+    "RANDOM",
+    "BEDTIME",
+  ];
+  const glucoseStats: Record<
+    string,
+    { avg: number; min: number; max: number; count: number; latest: number }
+  > = {};
+  const glucoseRanges: Record<string, { min: number; max: number }> = {};
+  const glucoseRows = measurements.filter((m) => m.type === "BLOOD_GLUCOSE");
+  const overrides = (userProfile?.thresholdsJson ?? null) as ThresholdOverridesJson | null;
+  const profileForRange = {
+    heightCm: userProfile?.heightCm ?? null,
+    dateOfBirth: userProfile?.dateOfBirth ?? null,
+    gender: userProfile?.gender ?? null,
+  };
+  for (const ctx of glucoseContexts) {
+    const rows = glucoseRows.filter((m) => m.glucoseContext === ctx);
+    if (rows.length === 0) continue;
+    const values = rows.map((r) => r.value);
+    glucoseStats[ctx] = {
+      avg: values.reduce((a, b) => a + b, 0) / values.length,
+      min: Math.min(...values),
+      max: Math.max(...values),
+      count: values.length,
+      latest: values[values.length - 1],
+    };
+    const eff = getEffectiveRange(
+      thresholdMetricForContext(ctx),
+      profileForRange,
+      overrides,
+    );
+    if (eff.range) {
+      glucoseRanges[ctx] = { min: eff.range.greenMin, max: eff.range.greenMax };
+    }
+  }
+
   return apiSuccess({
     period: { days, since: since.toISOString() },
     patient: {
@@ -155,6 +203,9 @@ export const POST = apiHandler(async (request: NextRequest) => {
     },
     measurements: byType,
     stats,
+    glucoseStats,
+    glucoseRanges,
+    glucoseUnit: resolveGlucoseUnit(userProfile?.glucoseUnit ?? null),
     bmi: bmi ? Math.round(bmi * 10) / 10 : null,
     compliance: complianceByMed,
     medications: medications.map((m) => ({

src/app/api/export/route.ts

@@ -26,7 +26,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
 
   const rl = await checkRateLimit(`export:${user.id}`, 10, 60 * 60 * 1000);
   if (!rl.allowed) {
-    return apiError("Maximal 10 Exports pro Stunde", 429);
+    return apiError("Maximum 10 exports per hour", 429);
   }
 
   annotate({ action: { name: "export.download" } });
@@ -36,10 +36,10 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const type = searchParams.get("type") ?? "all";
 
   if (!["csv", "json"].includes(format)) {
-    return apiError("Format muss csv oder json sein", 422);
+    return apiError("Format must be csv or json", 422);
   }
   if (!["measurements", "medications", "intake", "mood", "all"].includes(type)) {
-    return apiError("Typ muss measurements, medications, intake, mood oder all sein", 422);
+    return apiError("Type must be measurements, medications, intake, mood, or all", 422);
   }
 
   const userId = user.id;

src/app/api/feedback/route.ts

@@ -0,0 +1,102 @@
+/**
+ * POST /api/feedback — user submits feedback. Always works, no GitHub needed.
+ * GET /api/feedback — user's own feedback history (paginated).
+ *
+ * Rate-limited at 5 per hour per user. Screenshots are stored as base64 in
+ * the database (≤5 MB each).
+ */
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiError, apiSuccess, safeJson, getClientIp } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { checkRateLimit } from "@/lib/rate-limit";
+import { auditLog } from "@/lib/auth/audit";
+import { prisma } from "@/lib/db";
+import { createFeedbackSchema } from "@/lib/validations/feedback";
+import { Prisma } from "@/generated/prisma/client";
+import type { NextRequest } from "next/server";
+
+export const POST = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAuth();
+
+  const rl = await checkRateLimit(`feedback:${user.id}`, 5, 60 * 60 * 1000);
+  if (!rl.allowed) {
+    return apiError("Too many submissions — please try again later", 429);
+  }
+
+  const { data: body, error: jsonError } = await safeJson(request);
+  if (jsonError) return jsonError;
+
+  const parsed = createFeedbackSchema.safeParse(body);
+  if (!parsed.success) {
+    return apiError(parsed.error.issues[0].message, 422);
+  }
+
+  const feedback = await prisma.feedback.create({
+    data: {
+      userId: user.id,
+      email: user.email ?? null,
+      category: parsed.data.category,
+      subject: parsed.data.subject,
+      description: parsed.data.description,
+      screenshotBase64: parsed.data.screenshot ?? null,
+      metadata:
+        parsed.data.metadata !== undefined
+          ? (parsed.data.metadata as Prisma.InputJsonValue)
+          : Prisma.JsonNull,
+    },
+    select: { id: true, createdAt: true, category: true, status: true },
+  });
+
+  await auditLog("feedback.submit", {
+    userId: user.id,
+    ipAddress: getClientIp(request),
+    details: {
+      feedbackId: feedback.id,
+      category: feedback.category,
+      hasScreenshot: Boolean(parsed.data.screenshot),
+    },
+  });
+
+  annotate({
+    action: { name: "feedback.submit" },
+    meta: {
+      feedback_id: feedback.id,
+      category: feedback.category,
+    },
+  });
+
+  return apiSuccess(feedback, 201);
+});
+
+export const GET = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAuth();
+
+  const url = new URL(request.url);
+  const limit = Math.min(
+    50,
+    Math.max(1, Number(url.searchParams.get("limit") ?? 25)),
+  );
+  const offset = Math.max(0, Number(url.searchParams.get("offset") ?? 0));
+
+  const [items, total] = await Promise.all([
+    prisma.feedback.findMany({
+      where: { userId: user.id },
+      orderBy: { createdAt: "desc" },
+      take: limit,
+      skip: offset,
+      select: {
+        id: true,
+        category: true,
+        subject: true,
+        status: true,
+        adminNote: true,
+        gitHubIssueUrl: true,
+        createdAt: true,
+        updatedAt: true,
+      },
+    }),
+    prisma.feedback.count({ where: { userId: user.id } }),
+  ]);
+
+  return apiSuccess({ items, meta: { total, limit, offset } });
+});

src/app/api/ingest/medication/route.ts

@@ -19,7 +19,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   annotate({ action: { name: "ingest.medication" } });
 
   if (!(await isApiGloballyEnabled())) {
-    return apiError("API ist global deaktiviert", 403);
+    return apiError("API is globally disabled", 403);
   }
 
   const ip = getClientIp(request);
@@ -109,12 +109,12 @@ export const POST = apiHandler(async (request: NextRequest) => {
   });
 
   if (!medication) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const medicationScope = `medication:${medication.id}:ingest`;
   if (!apiToken.permissions.includes(medicationScope)) {
-    return apiError("API-Endpoint fuer dieses Medikament ist deaktiviert", 403);
+    return apiError("API endpoint for this medication is disabled", 403);
   }
 
   const event = await prisma.medicationIntakeEvent.create({

src/app/api/insights/blood-pressure-status/route.ts

@@ -6,6 +6,7 @@ import {
 } from "@/lib/insights/blood-pressure-status";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const dynamic = "force-dynamic";
 
@@ -13,9 +14,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const localeParam = request.nextUrl.searchParams.get("locale");
-  const locale = resolveBloodPressureStatusLocale(
-    localeParam ?? user.locale ?? "de",
-  );
+  const resolved = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+    override: localeParam,
+  });
+  const locale = resolveBloodPressureStatusLocale(resolved);
 
   const result = await generateBloodPressureStatusForUser(
     user.id,

src/app/api/insights/bmi-status/route.ts

@@ -6,6 +6,7 @@ import {
 } from "@/lib/insights/bmi-status";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const dynamic = "force-dynamic";
 
@@ -13,9 +14,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const localeParam = request.nextUrl.searchParams.get("locale");
-  const locale = resolveBmiStatusLocale(
-    localeParam ?? user.locale ?? "de",
-  );
+  const resolved = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+    override: localeParam,
+  });
+  const locale = resolveBmiStatusLocale(resolved);
 
   const result = await generateBmiStatusForUser(user.id, {
     locale,

src/app/api/insights/comprehensive/route.ts

@@ -1,4 +1,5 @@
 import { prisma } from "@/lib/db";
+import { resolveProvider } from "@/lib/ai/provider";
 import { apiSuccess } from "@/lib/api-response";
 import { summarize, type DataPoint } from "@/lib/analytics/trends";
 import { getBpTargets } from "@/lib/analytics/bp-targets";
@@ -32,7 +33,6 @@ export const GET = apiHandler(async () => {
     select: {
       heightCm: true,
       dateOfBirth: true,
-      openaiKeyEncrypted: true,
     },
   });
 
@@ -216,15 +216,30 @@ export const GET = apiHandler(async () => {
   const bpMedications = medications.filter(
     (med) => (categoryMap[med.id] ?? "OTHER") === "BLOOD_PRESSURE",
   );
+  // Single round-trip for all medications instead of N+1: one query keyed
+  // on `medicationId IN (...)`, then group in memory. The previous loop
+  // hit Postgres once per medication, which scales poorly for users with
+  // many active meds.
+  const allEvents = medications.length
+    ? await prisma.medicationIntakeEvent.findMany({
+        where: {
+          medicationId: { in: medications.map((m) => m.id) },
+          userId,
+          scheduledFor: { gte: ninetyDaysAgo },
+        },
+        orderBy: { scheduledFor: "desc" },
+      })
+    : [];
+
+  const eventsByMed = new Map<string, typeof allEvents>();
+  for (const ev of allEvents) {
+    const list = eventsByMed.get(ev.medicationId);
+    if (list) list.push(ev);
+    else eventsByMed.set(ev.medicationId, [ev]);
+  }
+
   for (const med of medications) {
-    const events = await prisma.medicationIntakeEvent.findMany({
-      where: {
-        medicationId: med.id,
-        userId,
-        scheduledFor: { gte: ninetyDaysAgo },
-      },
-      orderBy: { scheduledFor: "desc" },
-    });
+    const events = eventsByMed.get(med.id) ?? [];
     const mapped = events.map((e) => ({
       takenAt: e.takenAt,
       skipped: e.skipped,
@@ -371,7 +386,7 @@ export const GET = apiHandler(async () => {
     moodPulseScatterData,
     medications: medCompliance,
     alerts,
-    hasOpenAiKey: !!dbUser?.openaiKeyEncrypted,
+    hasProvider: (await resolveProvider(userId)).type !== "none",
     dataSpanDays,
     totalMeasurements: allMeasurements.length,
   });

src/app/api/insights/general-status/route.ts

@@ -6,6 +6,7 @@ import {
 } from "@/lib/insights/general-status";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const dynamic = "force-dynamic";
 
@@ -13,9 +14,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const localeParam = request.nextUrl.searchParams.get("locale");
-  const locale = resolveGeneralStatusLocale(
-    localeParam ?? user.locale ?? "de",
-  );
+  const resolved = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+    override: localeParam,
+  });
+  const locale = resolveGeneralStatusLocale(resolved);
 
   const result = await generateGeneralStatusForUser(user.id, {
     locale,

src/app/api/insights/generate/route.ts

@@ -1,130 +1,90 @@
 import { prisma } from "@/lib/db";
 import { auditLog } from "@/lib/auth/audit";
 import { apiSuccess, apiError, getClientIp } from "@/lib/api-response";
-import { decrypt } from "@/lib/crypto";
 import { extractFeatures } from "@/lib/insights/features";
-import {
-  INSIGHTS_SYSTEM_PROMPT,
-  buildUserPrompt,
-  type InsightsOutput,
-} from "@/lib/insights/prompt";
+import { getInsightsSystemPrompt, buildUserPrompt } from "@/lib/insights/prompt";
+import { insightResultSchema, type InsightResult } from "@/lib/ai/types";
+import { resolveProvider } from "@/lib/ai/provider";
 import { checkRateLimit } from "@/lib/rate-limit";
 import { NextRequest } from "next/server";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
-/**
- * Generate AI-powered health insights.
- * Rate limit: 2 per hour per user.
- * Caches result daily (or until new data arrives).
- */
 export const POST = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
-
   const userId = user.id;
 
-  // Rate limit: 2 per hour per user
   const rl = await checkRateLimit(`insights:${userId}`, 2, 60 * 60 * 1000);
   if (!rl.allowed) {
-    return apiError(
-      "Maximal 2 Insights-Generierungen pro Stunde. Bitte spaeter erneut versuchen.",
-      429,
-    );
+    return apiError("Maximum 2 insight generations per hour.", 429);
   }
 
   const dbUser = await prisma.user.findUnique({
     where: { id: userId },
     select: {
-      openaiKeyEncrypted: true,
       insightsPrivacyMode: true,
       insightsCachedAt: true,
       insightsCachedText: true,
+      locale: true,
     },
   });
 
-  if (!dbUser?.openaiKeyEncrypted) {
-    return apiError(
-      "Kein OpenAI API-Key hinterlegt. Bitte in den Einstellungen konfigurieren.",
-      422,
-    );
-  }
+  const locale = await resolveServerLocale({
+    request,
+    userLocale: dbUser?.locale ?? user.locale ?? null,
+  });
 
-  // Check if force refresh is requested
   const body = await request.json().catch(() => ({}));
   const forceRefresh = body.force === true;
 
-  // Return cached result if available and less than 24h old
   if (
     !forceRefresh &&
-    dbUser.insightsCachedAt &&
+    dbUser?.insightsCachedAt &&
     dbUser.insightsCachedText &&
     Date.now() - dbUser.insightsCachedAt.getTime() < 24 * 60 * 60 * 1000
   ) {
     try {
-      const cached = JSON.parse(dbUser.insightsCachedText) as InsightsOutput;
+      const cached = JSON.parse(dbUser.insightsCachedText);
       annotate({ action: { name: "insights.generate" }, meta: { cached: true } });
-      return apiSuccess({
-        insights: cached,
-        cached: true,
-        cachedAt: dbUser.insightsCachedAt,
-      });
+      return apiSuccess({ insights: cached, cached: true, cachedAt: dbUser.insightsCachedAt });
     } catch {
       // Invalid cache, regenerate
     }
   }
 
-  const apiKey = decrypt(dbUser.openaiKeyEncrypted);
-  const includeRaw = dbUser.insightsPrivacyMode === "raw";
+  const provider = await resolveProvider(userId);
+
+  if (provider.type === "none") {
+    return apiError("No AI provider configured. Connect ChatGPT in settings or ask your admin to set up an API key.", 422);
+  }
+
+  const includeRaw = dbUser?.insightsPrivacyMode === "raw";
   const features = await extractFeatures(userId, includeRaw);
   const featuresJson = JSON.stringify(features, null, 2);
-  const userPrompt = buildUserPrompt(featuresJson, dbUser.insightsPrivacyMode);
-
-  // Call OpenAI
-  const openaiRes = await fetch(
-    "https://api.openai.com/v1/chat/completions",
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`,
-      },
-      body: JSON.stringify({
-        model: "gpt-4o-mini",
-        messages: [
-          { role: "system", content: INSIGHTS_SYSTEM_PROMPT },
-          { role: "user", content: userPrompt },
-        ],
-        temperature: 0.3,
-        max_tokens: 1000,
-        response_format: { type: "json_object" },
-      }),
-    },
+  const userPrompt = buildUserPrompt(
+    featuresJson,
+    dbUser?.insightsPrivacyMode ?? "aggregated",
+    locale,
   );
 
-  if (!openaiRes.ok) {
-    const errBody = await openaiRes.text();
-    annotate({ meta: { openai_status: openaiRes.status, openai_error: errBody } });
-    if (openaiRes.status === 401) {
-      return apiError("Ungueltiger OpenAI API-Key", 422);
-    }
-    return apiError("OpenAI-Anfrage fehlgeschlagen", 502);
-  }
+  const result = await provider.generateCompletion({
+    systemPrompt: getInsightsSystemPrompt(locale),
+    userPrompt,
+    temperature: 0.3,
+    maxTokens: 1500,
+  });
 
-  const openaiJson = await openaiRes.json();
-  const content = openaiJson.choices?.[0]?.message?.content;
-
-  if (!content) {
-    return apiError("Keine Antwort von OpenAI erhalten", 502);
-  }
-
-  let insights: InsightsOutput;
+  let insights: InsightResult | Record<string, unknown>;
   try {
-    insights = JSON.parse(content);
+    const parsed = JSON.parse(result.content);
+    // Try new schema first, fall back to raw parsed if validation fails
+    const validated = insightResultSchema.safeParse(parsed);
+    insights = validated.success ? validated.data : parsed;
   } catch {
-    return apiError("OpenAI-Antwort konnte nicht verarbeitet werden", 502);
+    return apiError("Failed to parse AI response", 502);
   }
 
-  // Cache the result
   await prisma.user.update({
     where: { id: userId },
     data: {
@@ -133,13 +93,14 @@ export const POST = apiHandler(async (request: NextRequest) => {
     },
   });
 
-  // Audit log (no sensitive content)
   await auditLog("insights.generate", {
     userId,
     ipAddress: getClientIp(request),
     details: {
-      privacyMode: dbUser.insightsPrivacyMode,
-      tokensUsed: openaiJson.usage?.total_tokens ?? null,
+      privacyMode: dbUser?.insightsPrivacyMode,
+      tokensUsed: result.tokensUsed,
+      providerType: result.providerType,
+      model: result.model,
     },
   });
 
@@ -147,8 +108,9 @@ export const POST = apiHandler(async (request: NextRequest) => {
     action: { name: "insights.generate" },
     meta: {
       cached: false,
-      privacyMode: dbUser.insightsPrivacyMode,
-      tokensUsed: openaiJson.usage?.total_tokens ?? null,
+      providerType: result.providerType,
+      model: result.model,
+      tokensUsed: result.tokensUsed,
     },
   });
 

src/app/api/insights/medication-compliance-status/route.ts

@@ -6,6 +6,7 @@ import {
 } from "@/lib/insights/medication-compliance-status";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const dynamic = "force-dynamic";
 
@@ -13,9 +14,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const localeParam = request.nextUrl.searchParams.get("locale");
-  const locale = resolveMedicationComplianceStatusLocale(
-    localeParam ?? user.locale ?? "de",
-  );
+  const resolved = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+    override: localeParam,
+  });
+  const locale = resolveMedicationComplianceStatusLocale(resolved);
 
   const result = await generateMedicationComplianceStatusForUser(
     user.id,

src/app/api/insights/mood-status/route.ts

@@ -6,6 +6,7 @@ import {
 } from "@/lib/insights/mood-status";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const dynamic = "force-dynamic";
 
@@ -13,9 +14,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const localeParam = request.nextUrl.searchParams.get("locale");
-  const locale = resolveMoodStatusLocale(
-    localeParam ?? user.locale ?? "de",
-  );
+  const resolved = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+    override: localeParam,
+  });
+  const locale = resolveMoodStatusLocale(resolved);
 
   const result = await generateMoodStatusForUser(user.id, {
     locale,

src/app/api/insights/pulse-status/route.ts

@@ -6,6 +6,7 @@ import {
 } from "@/lib/insights/pulse-status";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const dynamic = "force-dynamic";
 
@@ -13,9 +14,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const localeParam = request.nextUrl.searchParams.get("locale");
-  const locale = resolvePulseStatusLocale(
-    localeParam ?? user.locale ?? "de",
-  );
+  const resolved = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+    override: localeParam,
+  });
+  const locale = resolvePulseStatusLocale(resolved);
 
   const result = await generatePulseStatusForUser(user.id, {
     locale,

src/app/api/insights/settings/route.ts

@@ -1,78 +1,58 @@
 import { prisma } from "@/lib/db";
 import { apiSuccess, apiError, safeJson } from "@/lib/api-response";
-import { encrypt } from "@/lib/crypto";
 import { NextRequest } from "next/server";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 
-/**
- * Get insights configuration status.
- */
 export const GET = apiHandler(async () => {
   const { user } = await requireAuth();
 
   const dbUser = await prisma.user.findUnique({
     where: { id: user.id },
     select: {
-      openaiKeyEncrypted: true,
+      codexConnectionStatus: true,
+      codexConnectedAt: true,
       insightsPrivacyMode: true,
       insightsCachedAt: true,
     },
   });
 
+  const settings = await prisma.appSettings.findUnique({
+    where: { id: "singleton" },
+    select: { adminAiKeyEncrypted: true },
+  });
+
   annotate({ action: { name: "insights.settings.get" } });
 
   return apiSuccess({
-    hasKey: !!dbUser?.openaiKeyEncrypted,
+    codexStatus: dbUser?.codexConnectionStatus ?? "disconnected",
+    codexConnectedAt: dbUser?.codexConnectedAt ?? null,
+    hasAdminKey: !!settings?.adminAiKeyEncrypted,
     privacyMode: dbUser?.insightsPrivacyMode ?? "aggregated",
     lastInsightAt: dbUser?.insightsCachedAt ?? null,
   });
 });
 
-/**
- * Update insights settings (API key and/or privacy mode).
- */
 export const PUT = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const { data: body, error: jsonError } = await safeJson<Record<string, unknown>>(request);
-
   if (jsonError) return jsonError;
+
   const data: Record<string, unknown> = {};
 
-  // Update API key if provided
-  if (typeof body.apiKey === "string") {
-    const key = (body.apiKey as string).trim();
-    if (key === "") {
-      // Remove key
-      data.openaiKeyEncrypted = null;
-      data.insightsCachedAt = null;
-      data.insightsCachedText = null;
-    } else {
-      if (!key.startsWith("sk-")) {
-        return apiError(
-          "Ungueltiges API-Key-Format (muss mit sk- beginnen)",
-          422,
-        );
-      }
-      data.openaiKeyEncrypted = encrypt(key);
-    }
-  }
-
-  // Update privacy mode if provided
   if (typeof body.privacyMode === "string") {
     const mode = body.privacyMode as string;
     if (!["aggregated", "raw"].includes(mode)) {
-      return apiError("Ungueltiger Privacy-Modus", 422);
+      return apiError("Invalid privacy mode", 422);
     }
     data.insightsPrivacyMode = mode;
-    // Clear cache when privacy mode changes
     data.insightsCachedAt = null;
     data.insightsCachedText = null;
   }
 
   if (Object.keys(data).length === 0) {
-    return apiError("Keine Aenderungen", 422);
+    return apiError("No changes", 422);
   }
 
   await prisma.user.update({

src/app/api/insights/targets/route.ts

@@ -17,9 +17,14 @@ import {
   classifyPulseByTarget,
   getPersonalizedPulseTarget,
 } from "@/lib/analytics/pulse-targets";
-import type { MeasurementType } from "@/generated/prisma/client";
+import type { MeasurementType, GlucoseContext } from "@/generated/prisma/client";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import {
+  getEffectiveRange,
+  type ThresholdOverridesJson,
+} from "@/lib/analytics/effective-range";
+import { thresholdMetricForContext, resolveGlucoseUnit } from "@/lib/glucose";
 
 export const dynamic = "force-dynamic";
 
@@ -67,6 +72,8 @@ export const GET = apiHandler(async () => {
       heightCm: true,
       dateOfBirth: true,
       gender: true,
+      glucoseUnit: true,
+      thresholdsJson: true,
     },
   });
 
@@ -161,7 +168,7 @@ export const GET = apiHandler(async () => {
   }
   targets.push({
     type: "WEIGHT",
-    label: "Gewicht",
+    label: "Weight",
     current: latestByType.WEIGHT ?? null,
     average30: avg30ByType.WEIGHT ?? null,
     trend: computeTrend("WEIGHT"),
@@ -186,7 +193,7 @@ export const GET = apiHandler(async () => {
   }
   targets.push({
     type: "BLOOD_PRESSURE",
-    label: "Blutdruck",
+    label: "Blood pressure",
     current: latestByType.BLOOD_PRESSURE_SYS ?? null,
     average30: avg30ByType.BLOOD_PRESSURE_SYS ?? null,
     trend: computeTrend("BLOOD_PRESSURE_SYS"),
@@ -227,7 +234,7 @@ export const GET = apiHandler(async () => {
 
     targets.push({
       type: "BLOOD_PRESSURE_IN_TARGET",
-      label: "Blutdruck im Zielbereich",
+      label: "Blood pressure on target",
       current: bpInTargetRate,
       average30: bpInTargetRate,
       trend: null,
@@ -236,10 +243,10 @@ export const GET = apiHandler(async () => {
       classification:
         bpInTargetRate != null
           ? bpInTargetRate >= 70
-            ? { category: "Gut", color: "#50fa7b" }
+            ? { category: "Good", color: "#50fa7b" }
             : bpInTargetRate >= 40
-              ? { category: "Moderat", color: "#f1fa8c" }
-              : { category: "Niedrig", color: "#ff5555" }
+              ? { category: "Moderate", color: "#f1fa8c" }
+              : { category: "Low", color: "#ff5555" }
           : null,
       source: "ESC/ESH 2018",
     });
@@ -254,7 +261,7 @@ export const GET = apiHandler(async () => {
   }
   targets.push({
     type: "PULSE",
-    label: "Ruhepuls",
+    label: "Resting pulse",
     current: latestByType.PULSE ?? null,
     average30: avg30ByType.PULSE ?? null,
     trend: computeTrend("PULSE"),
@@ -273,7 +280,7 @@ export const GET = apiHandler(async () => {
   }
   targets.push({
     type: "SLEEP_DURATION",
-    label: "Schlafdauer",
+    label: "Sleep duration",
     current: latestByType.SLEEP_DURATION ?? null,
     average30: avg30ByType.SLEEP_DURATION ?? null,
     trend: computeTrend("SLEEP_DURATION"),
@@ -335,7 +342,7 @@ export const GET = apiHandler(async () => {
   }
   targets.push({
     type: "BODY_FAT",
-    label: "Koerperfett",
+    label: "Body fat",
     current: latestByType.BODY_FAT ?? null,
     average30: avg30ByType.BODY_FAT ?? null,
     trend: computeTrend("BODY_FAT"),
@@ -354,11 +361,11 @@ export const GET = apiHandler(async () => {
   }
   targets.push({
     type: "ACTIVITY_STEPS",
-    label: "Schritte/Tag",
+    label: "Steps/day",
     current: latestByType.ACTIVITY_STEPS ?? null,
     average30: avg30ByType.ACTIVITY_STEPS ?? null,
     trend: computeTrend("ACTIVITY_STEPS"),
-    unit: "Schritte",
+    unit: "steps",
     range: stepsRange,
     classification: stepsClassification,
     source: "WHO",
@@ -453,7 +460,7 @@ export const GET = apiHandler(async () => {
 
     targets.push({
       type: "MEDICATION_COMPLIANCE",
-      label: "Einnahmetreue",
+      label: "Medication compliance",
       current: complianceRate7,
       average30: complianceRate30,
       trend: null,
@@ -462,12 +469,12 @@ export const GET = apiHandler(async () => {
       classification:
         complianceRate7 != null
           ? complianceRate7 >= 90
-            ? { category: "Sehr gut", color: "#50fa7b" }
+            ? { category: "Very good", color: "#50fa7b" }
             : complianceRate7 >= 70
-              ? { category: "Gut", color: "#f1fa8c" }
-              : { category: "Niedrig", color: "#ff5555" }
+              ? { category: "Good", color: "#f1fa8c" }
+              : { category: "Low", color: "#ff5555" }
           : null,
-      source: "7-Tage",
+      source: "7-day",
       details: {
         medications: medicationStats.map((medication) => ({
           name: medication.name,
@@ -523,15 +530,15 @@ export const GET = apiHandler(async () => {
     const moodClassification =
       latestMoodScore != null
         ? latestMoodScore >= 3.5
-          ? { category: "Gut", color: "#50fa7b" }
+          ? { category: "Good", color: "#50fa7b" }
           : latestMoodScore >= 2
-            ? { category: "Moderat", color: "#f1fa8c" }
-            : { category: "Niedrig", color: "#ff5555" }
+            ? { category: "Moderate", color: "#f1fa8c" }
+            : { category: "Low", color: "#ff5555" }
         : null;
 
     targets.push({
       type: "MOOD_SCORE",
-      label: "Stimmung",
+      label: "Mood",
       current: latestMoodScore,
       average30: moodAvg30,
       trend: moodTrend,
@@ -551,14 +558,14 @@ export const GET = apiHandler(async () => {
 
       const stabilityClassification =
         stdDev <= 0.5
-          ? { category: "Sehr stabil", color: "#50fa7b" }
+          ? { category: "Very stable", color: "#50fa7b" }
           : stdDev <= 1.0
-            ? { category: "Stabil", color: "#f1fa8c" }
-            : { category: "Schwankend", color: "#ff5555" };
+            ? { category: "Stable", color: "#f1fa8c" }
+            : { category: "Fluctuating", color: "#ff5555" };
 
       targets.push({
         type: "MOOD_STABILITY",
-        label: "Stimmungsstabilitaet",
+        label: "Mood stability",
         current: stdDev,
         average30: stdDev,
         trend: null,
@@ -570,6 +577,80 @@ export const GET = apiHandler(async () => {
     }
   }
 
+  // 10. Blood glucose — one card per logged context.
+  const glucoseContexts: GlucoseContext[] = [
+    "FASTING",
+    "POSTPRANDIAL",
+    "RANDOM",
+    "BEDTIME",
+  ];
+  const glucoseUnit = resolveGlucoseUnit(dbUser?.glucoseUnit ?? null);
+  const overrides = (dbUser?.thresholdsJson ?? null) as ThresholdOverridesJson | null;
+  const profileForRange = {
+    heightCm,
+    dateOfBirth: dbUser?.dateOfBirth ?? null,
+    gender: dbUser?.gender ?? null,
+  };
+  const thirtyDaysAgoGlucose = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+  const glucoseRows = await prisma.measurement.findMany({
+    where: { userId, type: "BLOOD_GLUCOSE" },
+    orderBy: { measuredAt: "desc" },
+    select: { value: true, measuredAt: true, glucoseContext: true },
+  });
+
+  const labelKeyByContext: Record<GlucoseContext, string> = {
+    FASTING: "targets.glucoseFasting",
+    POSTPRANDIAL: "targets.glucosePostprandial",
+    RANDOM: "targets.glucoseRandom",
+    BEDTIME: "targets.glucoseBedtime",
+  };
+
+  for (const ctx of glucoseContexts) {
+    const ctxRows = glucoseRows.filter((r) => r.glucoseContext === ctx);
+    if (ctxRows.length === 0) continue;
+    const latest = ctxRows[0].value;
+    const recent = ctxRows.filter((r) => r.measuredAt >= thirtyDaysAgoGlucose);
+    const avg30 =
+      recent.length > 0
+        ? Math.round(
+            (recent.reduce((s, r) => s + r.value, 0) / recent.length) * 10,
+          ) / 10
+        : null;
+
+    const metric = thresholdMetricForContext(ctx);
+    const eff = getEffectiveRange(metric, profileForRange, overrides);
+    const range = eff.range
+      ? { min: eff.range.greenMin, max: eff.range.greenMax }
+      : null;
+
+    let classification: { category: string; color: string } | null = null;
+    if (range) {
+      if (latest >= range.min && latest <= range.max) {
+        classification = { category: "Optimal", color: "#50fa7b" };
+      } else if (
+        eff.range &&
+        latest >= eff.range.orangeMin &&
+        latest <= eff.range.orangeMax
+      ) {
+        classification = { category: "Elevated", color: "#f1fa8c" };
+      } else {
+        classification = { category: "High", color: "#ff5555" };
+      }
+    }
+
+    targets.push({
+      type: `BLOOD_GLUCOSE_${ctx}`,
+      label: labelKeyByContext[ctx],
+      current: latest,
+      average30: avg30,
+      trend: null,
+      unit: glucoseUnit,
+      range,
+      classification,
+      source: eff.isOverride ? "Custom" : "ADA 2024 / DDG",
+    });
+  }
+
   annotate({ action: { name: "insights.targets" }, meta: { targetCount: targets.length } });
 
   return apiSuccess({
@@ -584,6 +665,7 @@ export const GET = apiHandler(async () => {
       heightCm,
       age,
       gender,
+      glucoseUnit,
     },
   });
 });

src/app/api/insights/weight-status/route.ts

@@ -6,6 +6,7 @@ import {
 } from "@/lib/insights/weight-status";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
 
 export const dynamic = "force-dynamic";
 
@@ -13,9 +14,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
   const localeParam = request.nextUrl.searchParams.get("locale");
-  const locale = resolveWeightStatusLocale(
-    localeParam ?? user.locale ?? "de",
-  );
+  const resolved = await resolveServerLocale({
+    request,
+    userLocale: user.locale ?? null,
+    override: localeParam,
+  });
+  const locale = resolveWeightStatusLocale(resolved);
 
   const result = await generateWeightStatusForUser(user.id, {
     locale,

src/app/api/integrations/moodlog/sync/route.ts

@@ -17,7 +17,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
     select: { moodLogGlobal: true },
   });
   if (appSettings && !appSettings.moodLogGlobal) {
-    return apiError("moodLog-Integration ist deaktiviert", 403);
+    return apiError("moodLog integration is disabled", 403);
   }
 
   let fullSync = false;

src/app/api/measurements/[id]/route.ts

@@ -18,7 +18,7 @@ export const GET = apiHandler(async (_request: NextRequest, { params }: RoutePar
   });
 
   if (!measurement || measurement.userId !== user.id) {
-    return apiError("Messwert nicht gefunden", 404);
+    return apiError("Measurement not found", 404);
   }
 
   annotate({
@@ -42,7 +42,7 @@ export const PUT = apiHandler(async (request: NextRequest, { params }: RoutePara
   });
 
   if (!existing || existing.userId !== user.id) {
-    return apiError("Messwert nicht gefunden", 404);
+    return apiError("Measurement not found", 404);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -90,7 +90,7 @@ export const DELETE = apiHandler(async (request: NextRequest, { params }: RouteP
   });
 
   if (!existing || existing.userId !== user.id) {
-    return apiError("Messwert nicht gefunden", 404);
+    return apiError("Measurement not found", 404);
   }
 
   await prisma.measurement.delete({ where: { id } });

src/app/api/measurements/route.ts

@@ -13,6 +13,7 @@ import { NextRequest } from "next/server";
 import type {
   MeasurementType,
   MeasurementSource,
+  GlucoseContext,
 } from "@/generated/prisma/client";
 import { Prisma } from "@/generated/prisma/client";
 
@@ -85,6 +86,8 @@ export const POST = apiHandler(async (request: NextRequest) => {
             source: (m.source ?? "MANUAL") as MeasurementSource,
             measuredAt: m.measuredAt,
             notes: m.notes ?? null,
+            glucoseContext:
+              (m.glucoseContext as GlucoseContext | undefined) ?? null,
           },
         }),
       ),
@@ -116,7 +119,8 @@ export const POST = apiHandler(async (request: NextRequest) => {
     return apiError(parsed.error.issues[0].message, 422);
   }
 
-  const { type, value, measuredAt, notes, source } = parsed.data;
+  const { type, value, measuredAt, notes, source, glucoseContext } =
+    parsed.data;
 
   // Handle unique constraint violation
   let measurement;
@@ -130,11 +134,12 @@ export const POST = apiHandler(async (request: NextRequest) => {
         source: (source ?? "MANUAL") as MeasurementSource,
         measuredAt,
         notes: notes ?? null,
+        glucoseContext: (glucoseContext as GlucoseContext | undefined) ?? null,
       },
     });
   } catch (err) {
     if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
-      return apiError("Ein Messwert mit diesen Daten existiert bereits", 409);
+      return apiError("A measurement with this data already exists", 409);
     }
     throw err;
   }

src/app/api/medications/[id]/api-endpoint/route.ts

@@ -17,13 +17,13 @@ function medicationScope(medicationId: string): string {
 export const GET = apiHandler(async (_request: NextRequest, { params }: RouteParams) => {
   const { user } = await requireAuth();
   if (!(await isApiGloballyEnabled())) {
-    return apiError("API ist global deaktiviert", 403);
+    return apiError("API is globally disabled", 403);
   }
 
   const { id } = await params;
   const medication = await prisma.medication.findUnique({ where: { id } });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const scope = medicationScope(id);
@@ -56,13 +56,13 @@ export const GET = apiHandler(async (_request: NextRequest, { params }: RoutePar
 export const PUT = apiHandler(async (request: NextRequest, { params }: RouteParams) => {
   const { user } = await requireAuth();
   if (!(await isApiGloballyEnabled())) {
-    return apiError("API ist global deaktiviert", 403);
+    return apiError("API is globally disabled", 403);
   }
 
   const { id } = await params;
   const medication = await prisma.medication.findUnique({ where: { id } });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   let enabled = false;
@@ -70,7 +70,7 @@ export const PUT = apiHandler(async (request: NextRequest, { params }: RoutePara
     const body = await request.json();
     enabled = body?.enabled === true;
   } catch {
-    return apiError("Ungültige Anfrage", 422);
+    return apiError("Invalid request", 422);
   }
 
   const scope = medicationScope(id);

src/app/api/medications/[id]/compliance/route.ts

@@ -20,7 +20,7 @@ export const GET = apiHandler(async (_request: Request, { params }: RouteParams)
   });
 
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const events = await prisma.medicationIntakeEvent.findMany({

src/app/api/medications/[id]/intake/[eventId]/route.ts

@@ -22,7 +22,7 @@ export const PUT = apiHandler(async (request: NextRequest, { params }: RoutePara
     event.userId !== user.id ||
     event.medicationId !== id
   ) {
-    return apiError("Einnahme nicht gefunden", 404);
+    return apiError("Intake not found", 404);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -77,7 +77,7 @@ export const DELETE = apiHandler(async (request: NextRequest, { params }: RouteP
     event.userId !== user.id ||
     event.medicationId !== id
   ) {
-    return apiError("Einnahme nicht gefunden", 404);
+    return apiError("Intake not found", 404);
   }
 
   await prisma.medicationIntakeEvent.delete({ where: { id: eventId } });

src/app/api/medications/[id]/intake/import/route.ts

@@ -22,7 +22,7 @@ export const POST = apiHandler(async (request: NextRequest, { params }: RoutePar
   const { id } = await params;
   const medication = await prisma.medication.findUnique({ where: { id } });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -39,7 +39,7 @@ export const POST = apiHandler(async (request: NextRequest, { params }: RoutePar
   const parsed = importSchema.safeParse(payload);
   if (!parsed.success) {
     return apiError(
-      `Ungültiges Format: ${parsed.error.issues[0].message}`,
+      `Invalid format: ${parsed.error.issues[0].message}`,
       422,
     );
   }

src/app/api/medications/[id]/intake/purge/route.ts

@@ -13,7 +13,7 @@ export const DELETE = apiHandler(async (request: NextRequest, { params }: RouteP
   const { id } = await params;
   const medication = await prisma.medication.findUnique({ where: { id } });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const { count } = await prisma.medicationIntakeEvent.deleteMany({

src/app/api/medications/[id]/intake/route.ts

@@ -17,7 +17,7 @@ export const POST = apiHandler(async (request: NextRequest, { params }: RoutePar
   const { id } = await params;
   const medication = await prisma.medication.findUnique({ where: { id } });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -108,7 +108,7 @@ export const GET = apiHandler(async (request: NextRequest, { params }: RoutePara
   const { id } = await params;
   const medication = await prisma.medication.findUnique({ where: { id } });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const searchParams = Object.fromEntries(request.nextUrl.searchParams);

src/app/api/medications/[id]/phase-config/route.ts

@@ -16,7 +16,7 @@ export const GET = apiHandler(async (_request: NextRequest, { params }: RoutePar
     select: { userId: true },
   });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const config = await prisma.reminderPhaseConfig.findUnique({
@@ -55,7 +55,7 @@ export const PUT = apiHandler(async (request: NextRequest, { params }: RoutePara
     select: { userId: true },
   });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -63,7 +63,7 @@ export const PUT = apiHandler(async (request: NextRequest, { params }: RoutePara
   if (jsonError) return jsonError;
   const parsed = phaseConfigSchema.safeParse(body);
   if (!parsed.success) {
-    return apiError("Ungültige Eingabe", 400);
+    return apiError("Invalid input", 400);
   }
 
   const config = await prisma.reminderPhaseConfig.upsert({
@@ -95,7 +95,7 @@ export const DELETE = apiHandler(async (_request: NextRequest, { params }: Route
     select: { userId: true },
   });
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   await prisma.reminderPhaseConfig.deleteMany({

src/app/api/medications/[id]/route.ts

@@ -24,7 +24,7 @@ export const GET = apiHandler(async (_request: NextRequest, { params }: RoutePar
   });
 
   if (!medication || medication.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   let category = "OTHER";
@@ -52,7 +52,7 @@ export const PUT = apiHandler(async (request: NextRequest, { params }: RoutePara
   const { id } = await params;
   const existing = await prisma.medication.findUnique({ where: { id } });
   if (!existing || existing.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -171,7 +171,7 @@ export const DELETE = apiHandler(async (request: NextRequest, { params }: RouteP
   const { id } = await params;
   const existing = await prisma.medication.findUnique({ where: { id } });
   if (!existing || existing.userId !== user.id) {
-    return apiError("Medikament nicht gefunden", 404);
+    return apiError("Medication not found", 404);
   }
 
   // Revoke API tokens scoped to this medication

src/app/api/monitoring/glitchtip/route.ts

@@ -32,11 +32,11 @@ export const POST = apiHandler(async (request: NextRequest) => {
   try {
     body = await request.json();
   } catch {
-    return apiError("Ungültige JSON-Daten", 422);
+    return apiError("Invalid JSON data", 422);
   }
 
   const parsed = clientErrorSchema.safeParse(body);
-  if (!parsed.success) return apiError("Ungültige Fehlerdaten", 422);
+  if (!parsed.success) return apiError("Invalid error data", 422);
 
   const delivery = await sendGlitchtipEvent({
     dsn: settings.glitchtipDsn,
@@ -54,7 +54,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 
   if (!delivery.ok) {
     getEvent()?.addWarning("Glitchtip event rejected: " + delivery.method + " " + delivery.status + " " + delivery.details);
-    return apiError("Glitchtip konnte Fehler nicht annehmen", 502);
+    return apiError("Glitchtip could not accept error", 502);
   }
 
   return apiSuccess({ sent: true });

src/app/api/mood-entries/[id]/route.ts

@@ -34,7 +34,7 @@ export const GET = apiHandler(async (_request: NextRequest, { params }: RoutePar
   const entry = await prisma.moodEntry.findUnique({ where: { id } });
 
   if (!entry || entry.userId !== user.id) {
-    return apiError("Stimmungseintrag nicht gefunden", 404);
+    return apiError("Mood entry not found", 404);
   }
 
   annotate({ action: { name: "mood-entries.get" }, meta: { moodEntryId: id } });
@@ -50,7 +50,7 @@ export const PUT = apiHandler(async (request: NextRequest, { params }: RoutePara
   const existing = await prisma.moodEntry.findUnique({ where: { id } });
 
   if (!existing || existing.userId !== user.id) {
-    return apiError("Stimmungseintrag nicht gefunden", 404);
+    return apiError("Mood entry not found", 404);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);
@@ -100,7 +100,7 @@ export const DELETE = apiHandler(async (request: NextRequest, { params }: RouteP
   const existing = await prisma.moodEntry.findUnique({ where: { id } });
 
   if (!existing || existing.userId !== user.id) {
-    return apiError("Stimmungseintrag nicht gefunden", 404);
+    return apiError("Mood entry not found", 404);
   }
 
   await prisma.moodEntry.delete({ where: { id } });

src/app/api/mood-entries/route.ts

@@ -113,7 +113,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   } catch (err) {
     if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
       return apiError(
-        "Ein Stimmungseintrag mit diesen Daten existiert bereits",
+        "A mood entry with this data already exists",
         409,
       );
     }

src/app/api/notifications/preferences/route.ts

@@ -98,18 +98,18 @@ export const PUT = apiHandler(async (request: NextRequest) => {
   try {
     body = await request.json();
   } catch {
-    return apiError("Ungültige JSON-Daten", 422);
+    return apiError("Invalid JSON data", 422);
   }
 
   const parsed = notificationPreferenceSchema.safeParse(body);
-  if (!parsed.success) return apiError("Ungültige Daten", 422);
+  if (!parsed.success) return apiError("Invalid data", 422);
 
   const { channelId, eventType, enabled } = parsed.data;
 
   const channel = await prisma.notificationChannel.findFirst({
     where: { id: channelId, userId: user.id },
   });
-  if (!channel) return apiError("Kanal nicht gefunden", 404);
+  if (!channel) return apiError("Channel not found", 404);
 
   const preference = await prisma.notificationPreference.upsert({
     where: {

src/app/api/notifications/web-push/route.ts

@@ -30,11 +30,11 @@ export const POST = apiHandler(async (request: NextRequest) => {
   try {
     body = await request.json();
   } catch {
-    return apiError("Ungültige JSON-Daten", 422);
+    return apiError("Invalid JSON data", 422);
   }
 
   const parsed = subscribeSchema.safeParse(body);
-  if (!parsed.success) return apiError("Ungültige Daten", 422);
+  if (!parsed.success) return apiError("Invalid data", 422);
 
   const { endpoint, keys } = parsed.data;
   const userAgent = request.headers.get("user-agent") ?? undefined;
@@ -92,11 +92,11 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
   try {
     body = await request.json();
   } catch {
-    return apiError("Ungültige JSON-Daten", 422);
+    return apiError("Invalid JSON data", 422);
   }
 
   const parsed = unsubscribeSchema.safeParse(body);
-  if (!parsed.success) return apiError("Ungültige Daten", 422);
+  if (!parsed.success) return apiError("Invalid data", 422);
 
   await prisma.pushSubscription.deleteMany({
     where: {

src/app/api/onboarding/complete/route.ts

@@ -24,7 +24,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   if (jsonError) return jsonError;
   const result = z.safeParse(onboardingSchema, body);
   if (!result.success) {
-    return apiError("Ungültige Eingabe", 422);
+    return apiError("Invalid input", 422);
   }
 
   const data: Record<string, unknown> = {

src/app/api/settings/account/route.ts

@@ -20,12 +20,12 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
     const body = await request.json();
     confirm = typeof body?.confirm === "string" ? body.confirm : "";
   } catch {
-    return apiError("Ungueltige Anfrage", 422);
+    return apiError("Invalid request", 422);
   }
 
   if (confirm !== "DELETE_ACCOUNT") {
     return apiError(
-      "Bestaetigung fehlt. Sende { confirm: 'DELETE_ACCOUNT' }",
+      "Confirmation missing. Send { confirm: 'DELETE_ACCOUNT' }",
       422,
     );
   }
@@ -35,7 +35,7 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
     const adminCount = await prisma.user.count({ where: { role: "ADMIN" } });
     if (adminCount <= 1) {
       return apiError(
-        "Der letzte Admin-Account kann nicht geloescht werden",
+        "The last admin account cannot be deleted",
         400,
       );
     }

src/app/api/settings/data/route.ts

@@ -18,11 +18,11 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
     const body = await request.json();
     confirm = typeof body?.confirm === "string" ? body.confirm : "";
   } catch {
-    return apiError("Ungueltige Anfrage", 422);
+    return apiError("Invalid request", 422);
   }
 
   if (confirm !== "DELETE") {
-    return apiError("Bestaetigung fehlt", 422);
+    return apiError("Confirmation missing", 422);
   }
 
   const userId = user.id;
@@ -71,7 +71,6 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
         heightCm: null,
         dateOfBirth: null,
         gender: null,
-        openaiKeyEncrypted: null,
         insightsPrivacyMode: "aggregated",
         insightsCachedAt: null,
         insightsCachedText: null,

src/app/api/settings/moodlog/route.ts

@@ -21,7 +21,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
 
   const parsed = moodLogCredentialsSchema.safeParse(body);
   if (!parsed.success) {
-    return apiError("Ungueltige Eingabe", 422);
+    return apiError("Invalid input", 422);
   }
 
   const { url, apiKey } = parsed.data;

src/app/api/settings/ntfy/route.ts

@@ -51,13 +51,13 @@ export const PUT = apiHandler(async (request: NextRequest) => {
 
   if (jsonError) return jsonError;
   const parsed = ntfySettingsSchema.safeParse(body);
-  if (!parsed.success) return apiError("Ungueltige Daten", 422);
+  if (!parsed.success) return apiError("Invalid data", 422);
 
   const { serverUrl, topic, authToken, enabled } = parsed.data;
 
   if (enabled && (!serverUrl || !topic)) {
     return apiError(
-      "Server-URL und Topic sind erforderlich, wenn ntfy aktiviert ist",
+      "Server URL and topic are required when ntfy is enabled",
       422,
     );
   }

src/app/api/settings/ntfy/test/route.ts

@@ -15,7 +15,7 @@ export const POST = apiHandler(async () => {
 
   const rl = await checkRateLimit(`ntfy-test:${user.id}`, 5, 5 * 60 * 1000);
   if (!rl.allowed) {
-    return apiError("Maximal 5 Tests in 5 Minuten", 429);
+    return apiError("Maximum 5 tests in 5 minutes", 429);
   }
 
   const channel = await prisma.notificationChannel.findUnique({
@@ -25,13 +25,13 @@ export const POST = apiHandler(async () => {
   });
 
   if (!channel) {
-    return apiError("ntfy ist nicht konfiguriert", 400);
+    return apiError("ntfy is not configured", 400);
   }
 
   const config = JSON.parse(decrypt(channel.config)) as NtfyChannelConfig;
 
   if (!config.serverUrl || !config.topic) {
-    return apiError("Server-URL und Topic sind erforderlich", 400);
+    return apiError("Server URL and topic are required", 400);
   }
 
   const success = await sendViaNtfy(config, {
@@ -39,11 +39,11 @@ export const POST = apiHandler(async () => {
     userId: user.id,
     title: "HealthLog Test",
     message:
-      "HealthLog: Verbindung erfolgreich! ntfy-Benachrichtigungen sind aktiv.",
+      "HealthLog: Connection successful! ntfy notifications are active.",
   });
 
   if (!success) {
-    return apiError("Testnachricht konnte nicht gesendet werden", 500);
+    return apiError("Failed to send test message", 500);
   }
 
   annotate({ action: { name: "settings.ntfy.test" }, meta: { success: true } });

src/app/api/settings/telegram/route.ts

@@ -47,14 +47,14 @@ export const PUT = apiHandler(async (request: NextRequest) => {
       telegramEnabled: true,
     },
   });
-  if (!current) return apiError("Benutzer nicht gefunden", 404);
+  if (!current) return apiError("User not found", 404);
 
   const { data: body, error: jsonError } = await safeJson(request);
 
   if (jsonError) return jsonError;
   const result = z.safeParse(telegramSettingsSchema, body);
   if (!result.success) {
-    return apiError("Ungueltige Eingabe", 422);
+    return apiError("Invalid input", 422);
   }
 
   const { botToken, chatId, enabled } = result.data;
@@ -68,7 +68,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
 
   if (enabled && (!hasTokenAfter || !hasChatIdAfter)) {
     return apiError(
-      "Fuer aktiviertes Telegram werden Bot-Token und Chat-ID benoetigt",
+      "Bot token and chat ID are required when Telegram is enabled",
       422,
     );
   }
@@ -82,7 +82,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     const appUrl = process.env.APP_URL ?? process.env.NEXT_PUBLIC_APP_URL;
     if (!appUrl) {
       return apiError(
-        "Server-Konfiguration fehlerhaft: APP_URL (oder NEXT_PUBLIC_APP_URL) fehlt.",
+        "Server configuration error: APP_URL (or NEXT_PUBLIC_APP_URL) is missing.",
         500,
       );
     }
@@ -92,14 +92,14 @@ export const PUT = apiHandler(async (request: NextRequest) => {
       appBaseUrl = new URL(appUrl);
     } catch {
       return apiError(
-        "Server-Konfiguration fehlerhaft: APP_URL ist ungueltig.",
+        "Server configuration error: APP_URL is invalid.",
         500,
       );
     }
 
     if (appBaseUrl.protocol !== "https:") {
       return apiError(
-        "Telegram-Webhook benoetigt eine oeffentliche HTTPS-URL (kein http/localhost).",
+        "Telegram webhook requires a public HTTPS URL (no http/localhost).",
         422,
       );
     }
@@ -107,7 +107,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     const localHosts = new Set(["localhost", "127.0.0.1", "::1"]);
     if (localHosts.has(appBaseUrl.hostname.toLowerCase())) {
       return apiError(
-        "Telegram-Webhook benoetigt eine oeffentlich erreichbare Domain (localhost ist nicht erlaubt).",
+        "Telegram webhook requires a publicly reachable domain (localhost is not allowed).",
         422,
       );
     }
@@ -117,7 +117,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
       !["80", "88", "443", "8443"].includes(appBaseUrl.port)
     ) {
       return apiError(
-        "Telegram-Webhook erlaubt nur die Ports 80, 88, 443 oder 8443.",
+        "Telegram webhook only allows ports 80, 88, 443, or 8443.",
         422,
       );
     }
@@ -131,7 +131,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     );
     if (!ok) {
       return apiError(
-        "Telegram-Webhook konnte nicht gesetzt werden. Pruefe Bot-Token und Erreichbarkeit.",
+        "Failed to set Telegram webhook. Check bot token and reachability.",
         422,
       );
     }

src/app/api/settings/telegram/test/route.ts

@@ -14,7 +14,7 @@ export const POST = apiHandler(async () => {
 
   const rl = await checkRateLimit(`telegram-test:${user.id}`, 5, 5 * 60 * 1000);
   if (!rl.allowed) {
-    return apiError("Maximal 5 Tests in 5 Minuten", 429);
+    return apiError("Maximum 5 tests in 5 minutes", 429);
   }
 
   const dbUser = await prisma.user.findUnique({
@@ -24,7 +24,7 @@ export const POST = apiHandler(async () => {
 
   if (!dbUser?.telegramBotToken || !dbUser?.telegramChatId) {
     return apiError(
-      "Bot-Token und Chat-ID muessen zuerst gespeichert werden",
+      "Bot token and chat ID must be saved first",
       422,
     );
   }
@@ -33,12 +33,12 @@ export const POST = apiHandler(async () => {
   const ok = await sendTelegramMessage(
     botToken,
     dbUser.telegramChatId,
-    "HealthLog: Verbindung erfolgreich! Telegram-Benachrichtigungen sind aktiv.",
+    "HealthLog: Connection successful! Telegram notifications are active.",
   );
 
   if (!ok) {
     return apiError(
-      "Nachricht konnte nicht gesendet werden. Pruefe Bot-Token und Chat-ID.",
+      "Failed to send message. Check bot token and chat ID.",
       422,
     );
   }

src/app/api/telegram/webhook/route.ts

@@ -11,6 +11,8 @@ import { getClientIp } from "@/lib/api-response";
 import { NextRequest, NextResponse } from "next/server";
 import { apiHandler } from "@/lib/api-handler";
 import { annotate, getEvent } from "@/lib/logging/context";
+import { getServerTranslator } from "@/lib/i18n/server-translator";
+import { locales, type Locale } from "@/lib/i18n/config";
 
 interface TelegramUpdate {
   update_id: number;
@@ -56,6 +58,20 @@ function escapeHtml(input: string): string {
     .replaceAll(">", ">");
 }
 
+/**
+ * Resolve the bot locale for an existing Telegram user.
+ *
+ * Defaults to "de" when User.locale is null — existing bots were set up in
+ * German and we don't want to silently flip them. Users who have switched
+ * the UI to English (User.locale = "en") get an English bot too.
+ */
+function resolveBotLocale(value: string | null | undefined): Locale {
+  if (value && (locales as readonly string[]).includes(value)) {
+    return value as Locale;
+  }
+  return "de";
+}
+
 async function cleanupReminderTracking(medicationId: string): Promise<void> {
   try {
     await prisma.telegramReminderMessage.deleteMany({
@@ -98,6 +114,7 @@ async function findTelegramUser(chatId: string) {
     select: {
       id: true,
       telegramBotToken: true,
+      locale: true,
     },
   });
 }
@@ -106,13 +123,15 @@ async function markMedicationTaken(
   userId: string,
   medicationId: string,
   idempotencyKey: string,
+  locale: Locale,
 ): Promise<{ ok: boolean; message: string; medicationName?: string }> {
+  const { t } = getServerTranslator(locale);
   const medication = await prisma.medication.findFirst({
     where: { id: medicationId, userId, active: true },
     select: { id: true, name: true },
   });
   if (!medication) {
-    return { ok: false, message: "Medikament nicht gefunden oder inaktiv." };
+    return { ok: false, message: t("telegram.errorMedicationInactive") };
   }
 
   const existing = await prisma.medicationIntakeEvent.findFirst({
@@ -143,8 +162,8 @@ async function markMedicationTaken(
   return {
     ok: true,
     message: existing
-      ? `${medication.name} war bereits erfasst.`
-      : `${medication.name} als eingenommen erfasst.`,
+      ? t("telegram.alreadyRecorded", { name: medication.name })
+      : t("telegram.recordedAsTaken", { name: medication.name }),
     medicationName: medication.name,
   };
 }
@@ -160,6 +179,8 @@ async function handleCallback(update: TelegramUpdate) {
   const user = await findTelegramUser(chatId);
   if (!user?.telegramBotToken) return;
   const botToken = decrypt(user.telegramBotToken);
+  const locale = resolveBotLocale(user.locale);
+  const { t } = getServerTranslator(locale);
 
   const data = callback.data ?? "";
   const messageId = callback.message?.message_id;
@@ -170,7 +191,7 @@ async function handleCallback(update: TelegramUpdate) {
       await answerTelegramCallbackQuery(
         botToken,
         callback.id,
-        "Ungültige Aktion.",
+        t("telegram.errorInvalidAction"),
       );
       return;
     }
@@ -183,6 +204,7 @@ async function handleCallback(update: TelegramUpdate) {
       user.id,
       medicationId,
       idempotencyKey,
+      locale,
     );
     await answerTelegramCallbackQuery(botToken, callback.id, result.message);
     if (messageId) {
@@ -198,7 +220,7 @@ async function handleCallback(update: TelegramUpdate) {
       await answerTelegramCallbackQuery(
         botToken,
         callback.id,
-        "Ungültige Aktion.",
+        t("telegram.errorInvalidAction"),
       );
       return;
     }
@@ -211,7 +233,7 @@ async function handleCallback(update: TelegramUpdate) {
       await answerTelegramCallbackQuery(
         botToken,
         callback.id,
-        "Medikament nicht gefunden.",
+        t("telegram.errorMedicationNotFound"),
       );
       return;
     }
@@ -221,11 +243,12 @@ async function handleCallback(update: TelegramUpdate) {
       data: { snoozedUntil: new Date(Date.now() + minutes * 60000) },
     });
 
-    const label = minutes <= 60 ? "1 Stunde" : "3 Stunden";
+    const duration =
+      minutes <= 60 ? t("telegram.snoozeOneHour") : t("telegram.snoozeThreeHours");
     await answerTelegramCallbackQuery(
       botToken,
       callback.id,
-      `${medication.name} für ${label} zurückgestellt.`,
+      t("telegram.snoozedFor", { name: medication.name, duration }),
     );
     if (messageId) {
       await deleteMessage(botToken, chatId, messageId);
@@ -237,7 +260,7 @@ async function handleCallback(update: TelegramUpdate) {
       await answerTelegramCallbackQuery(
         botToken,
         callback.id,
-        "Ungültige Aktion.",
+        t("telegram.errorInvalidAction"),
       );
       return;
     }
@@ -250,7 +273,7 @@ async function handleCallback(update: TelegramUpdate) {
       await answerTelegramCallbackQuery(
         botToken,
         callback.id,
-        "Medikament nicht gefunden.",
+        t("telegram.errorMedicationNotFound"),
       );
       return;
     }
@@ -290,7 +313,7 @@ async function handleCallback(update: TelegramUpdate) {
     await answerTelegramCallbackQuery(
       botToken,
       callback.id,
-      `${medication.name} übersprungen.`,
+      t("telegram.skipped", { name: medication.name }),
     );
     if (messageId) {
       await deleteMessage(botToken, chatId, messageId);
@@ -299,7 +322,11 @@ async function handleCallback(update: TelegramUpdate) {
   } else if (data.startsWith("ack:")) {
     const medicationId = data.slice("ack:".length).trim();
     if (!medicationId) {
-      await answerTelegramCallbackQuery(botToken, callback.id, "Ungültige Aktion.");
+      await answerTelegramCallbackQuery(
+        botToken,
+        callback.id,
+        t("telegram.errorInvalidAction"),
+      );
       return;
     }
 
@@ -311,7 +338,9 @@ async function handleCallback(update: TelegramUpdate) {
     await answerTelegramCallbackQuery(
       botToken,
       callback.id,
-      medication ? `${medication.name} bestätigt.` : "Bestätigt.",
+      medication
+        ? t("telegram.confirmed", { name: medication.name })
+        : t("telegram.genericConfirmed"),
     );
     if (messageId) {
       await deleteMessage(botToken, chatId, messageId);
@@ -323,7 +352,11 @@ async function handleCallback(update: TelegramUpdate) {
     const umidIdx = withoutPrefix.indexOf(":umid:");
     const medicationId = umidIdx >= 0 ? withoutPrefix.slice(0, umidIdx) : withoutPrefix.trim();
     if (!medicationId) {
-      await answerTelegramCallbackQuery(botToken, callback.id, "Ungültige Aktion.");
+      await answerTelegramCallbackQuery(
+        botToken,
+        callback.id,
+        t("telegram.errorInvalidAction"),
+      );
       return;
     }
 
@@ -331,7 +364,12 @@ async function handleCallback(update: TelegramUpdate) {
     const idempotencyKey =
       `telegram:add:${chatId}:${msgId}:${medicationId}`.slice(0, 128);
 
-    const result = await markMedicationTaken(user.id, medicationId, idempotencyKey);
+    const result = await markMedicationTaken(
+      user.id,
+      medicationId,
+      idempotencyKey,
+      locale,
+    );
     await answerTelegramCallbackQuery(botToken, callback.id, result.message);
     if (messageId) {
       await deleteMessage(botToken, chatId, messageId);
@@ -357,12 +395,12 @@ async function handleCallback(update: TelegramUpdate) {
         await deleteMessage(botToken, chatId, userMsgId).catch(() => {});
       }
     }
-    await answerTelegramCallbackQuery(botToken, callback.id, "Abgebrochen.");
+    await answerTelegramCallbackQuery(botToken, callback.id, t("telegram.cancelled"));
   } else {
     await answerTelegramCallbackQuery(
       botToken,
       callback.id,
-      "Unbekannte Aktion.",
+      t("telegram.errorUnknownAction"),
     );
   }
 }
@@ -376,23 +414,21 @@ async function handleTextMessage(update: TelegramUpdate) {
   const user = await findTelegramUser(chatId);
   if (!user?.telegramBotToken) return;
   const botToken = decrypt(user.telegramBotToken);
+  const locale = resolveBotLocale(user.locale);
+  const { t } = getServerTranslator(locale);
 
-  if (/^\/help\b/i.test(text) || /^\/start\b/i.test(text) || /^hilfe$/i.test(text)) {
+  // "Help" / start: accept English + German keyword aliases independent of locale
+  if (
+    /^\/help\b/i.test(text) ||
+    /^\/start\b/i.test(text) ||
+    /^hilfe$/i.test(text) ||
+    /^help$/i.test(text)
+  ) {
     const userMsgId = message?.message_id;
     const resp = await sendTelegramMessage(
       botToken,
       chatId,
-      `<b>Verfügbare Befehle:</b>\n\n` +
-        `/help — Diese Hilfe anzeigen\n` +
-        `/add — Einnahme erfassen\n` +
-        `/start — Bot starten\n\n` +
-        `<b>Textbefehle:</b>\n` +
-        `genommen &lt;Name&gt; — Einnahme bestätigen\n\n` +
-        `<b>Über die Buttons in Erinnerungen:</b>\n` +
-        `• Genommen — Einnahme bestätigen\n` +
-        `• 🕐 1h / 🕐 3h — Erinnerung verschieben\n` +
-        `• ⏭ Überspringen — Einnahme überspringen\n` +
-        `• ✓ Bestätigen — Verpasste Einnahme bestätigen`,
+      `${t("telegram.helpHeader")}\n\n${t("telegram.helpBody")}`,
     );
     const toDelete = [userMsgId, resp.messageId].filter(
       (id): id is number => id != null,
@@ -415,7 +451,7 @@ async function handleTextMessage(update: TelegramUpdate) {
       const resp = await sendTelegramMessage(
         botToken,
         chatId,
-        "Keine aktiven Medikamente gefunden.",
+        t("telegram.noActiveMedications"),
       );
       const toDelete = [userMsgId, resp.messageId].filter(
         (id): id is number => id != null,
@@ -433,6 +469,7 @@ async function handleTextMessage(update: TelegramUpdate) {
         user.id,
         meds[0].id,
         idempotencyKey,
+        locale,
       );
       const resp = await sendTelegramMessage(
         botToken,
@@ -462,7 +499,7 @@ async function handleTextMessage(update: TelegramUpdate) {
         ]),
         [
           {
-            text: "Abbrechen",
+            text: t("telegram.cancelButton"),
             callback_data: `cancel_add${umidSuffix}`,
           },
         ],
@@ -471,7 +508,7 @@ async function handleTextMessage(update: TelegramUpdate) {
     const resp = await sendTelegramMessage(
       botToken,
       chatId,
-      "<b>Welches Medikament eingenommen?</b>",
+      t("telegram.whichMedication"),
       { parseMode: "HTML", replyMarkup: keyboard },
     );
     // Fallback auto-delete if user never interacts with the selection
@@ -484,8 +521,8 @@ async function handleTextMessage(update: TelegramUpdate) {
     return;
   }
 
-  // Greeting responses
-  const greetings = ["hi", "hallo", "hey", "moin"];
+  // Greeting responses (kept locale-independent)
+  const greetings = ["hi", "hallo", "hey", "moin", "hello"];
   const lowerText = text.toLowerCase();
   const matchedGreeting = greetings.find((g) => lowerText === g);
   if (matchedGreeting) {
@@ -501,10 +538,13 @@ async function handleTextMessage(update: TelegramUpdate) {
     return;
   }
 
-  if (!/^genommen\b/i.test(text)) return;
+  // Accept both "genommen <name>" (DE) and "taken <name>" (EN) regardless of
+  // the user's UI locale — keeps backwards compatibility.
+  const intakeKeyword = /^(?:genommen|taken)\b/i;
+  if (!intakeKeyword.test(text)) return;
 
   const userMsgId = message?.message_id;
-  const nameInput = text.replace(/^genommen\b/i, "").trim();
+  const nameInput = text.replace(intakeKeyword, "").trim();
 
   let medicationId: string | null = null;
   if (nameInput) {
@@ -530,7 +570,7 @@ async function handleTextMessage(update: TelegramUpdate) {
       const resp = await sendTelegramMessage(
         botToken,
         chatId,
-        "Bitte Medikament angeben, z.B. <b>genommen Ramipril</b>.",
+        t("telegram.askMedicationName"),
       );
       const toDelete = [userMsgId, resp.messageId].filter(
         (id): id is number => id != null,
@@ -546,7 +586,7 @@ async function handleTextMessage(update: TelegramUpdate) {
     const resp = await sendTelegramMessage(
       botToken,
       chatId,
-      "Medikament nicht gefunden. Bitte Namen exakt wie in HealthLog senden.",
+      t("telegram.medicationNotFoundExact"),
     );
     const toDelete = [userMsgId, resp.messageId].filter(
       (id): id is number => id != null,
@@ -563,6 +603,7 @@ async function handleTextMessage(update: TelegramUpdate) {
     user.id,
     medicationId,
     idempotencyKey,
+    locale,
   );
   const resp = await sendTelegramMessage(
     botToken,

src/app/api/tokens/[id]/route.ts

@@ -14,14 +14,14 @@ export const DELETE = apiHandler(async (_request: Request, { params }: RoutePara
   annotate({ action: { name: "tokens.revoke" } });
 
   if (!(await isApiGloballyEnabled())) {
-    return apiError("API ist global deaktiviert", 403);
+    return apiError("API is globally disabled", 403);
   }
 
   const { id } = await params;
   const token = await prisma.apiToken.findUnique({ where: { id } });
 
   if (!token || token.userId !== user.id) {
-    return apiError("Token nicht gefunden", 404);
+    return apiError("Token not found", 404);
   }
 
   await prisma.apiToken.update({

src/app/api/tokens/route.ts

@@ -9,7 +9,7 @@ import { NextRequest } from "next/server";
 import { z } from "zod/v4";
 
 const createTokenSchema = z.object({
-  name: z.string().min(1, "Name erforderlich").max(100),
+  name: z.string().min(1, "Name required").max(100),
   expiresInDays: z.number().int().min(1).max(365).optional(),
 });
 
@@ -18,7 +18,7 @@ export const GET = apiHandler(async () => {
   annotate({ action: { name: "tokens.list" } });
 
   if (!(await isApiGloballyEnabled())) {
-    return apiError("API ist global deaktiviert", 403);
+    return apiError("API is globally disabled", 403);
   }
 
   const tokens = await prisma.apiToken.findMany({
@@ -43,7 +43,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   annotate({ action: { name: "tokens.create" } });
 
   if (!(await isApiGloballyEnabled())) {
-    return apiError("API ist global deaktiviert", 403);
+    return apiError("API is globally disabled", 403);
   }
 
   const { data: body, error: jsonError } = await safeJson(request);

src/app/api/user/ai-provider/route.ts

@@ -0,0 +1,110 @@
+import { NextRequest } from "next/server";
+import { apiHandler, requireAuth, HttpError } from "@/lib/api-handler";
+import { prisma } from "@/lib/db";
+import { apiSuccess, apiError, safeJson } from "@/lib/api-response";
+import { isPublicUrl } from "@/lib/validations/notifications";
+import { encrypt, decrypt } from "@/lib/crypto";
+import { annotate } from "@/lib/logging/context";
+
+export const dynamic = "force-dynamic";
+
+const ALLOWED = new Set(["OPENAI", "ANTHROPIC", "LOCAL", "CHATGPT_OAUTH"]);
+
+export const GET = apiHandler(async () => {
+  const { user } = await requireAuth();
+  annotate({ action: { name: "user.ai-provider.get" } });
+
+  const u = await prisma.user.findUnique({
+    where: { id: user.id },
+    select: {
+      aiProvider: true,
+      aiModel: true,
+      aiBaseUrl: true,
+      aiAnthropicKeyEncrypted: true,
+      aiLocalKeyEncrypted: true,
+    },
+  });
+
+  return apiSuccess({
+    provider: u?.aiProvider ?? null,
+    model: u?.aiModel ?? null,
+    baseUrl: u?.aiBaseUrl ?? null,
+    hasAnthropicKey: Boolean(u?.aiAnthropicKeyEncrypted),
+    anthropicKeyPreview: u?.aiAnthropicKeyEncrypted
+      ? `...${decrypt(u.aiAnthropicKeyEncrypted).slice(-4)}`
+      : null,
+    hasLocalKey: Boolean(u?.aiLocalKeyEncrypted),
+  });
+});
+
+export const PATCH = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAuth();
+  annotate({ action: { name: "user.ai-provider.update" } });
+
+  const { data: body, error } = await safeJson<Record<string, unknown>>(request);
+  if (error) return error;
+
+  const updates: Record<string, unknown> = {};
+
+  if (body.provider !== undefined) {
+    if (body.provider === null || body.provider === "") {
+      updates.aiProvider = null;
+    } else if (typeof body.provider === "string" && ALLOWED.has(body.provider)) {
+      updates.aiProvider = body.provider;
+    } else {
+      throw new HttpError(422, "Invalid provider");
+    }
+  }
+
+  if (body.model !== undefined) {
+    if (body.model === null || body.model === "") {
+      updates.aiModel = null;
+    } else if (typeof body.model === "string") {
+      updates.aiModel = body.model.trim() || null;
+    }
+  }
+
+  if (body.baseUrl !== undefined) {
+    if (body.baseUrl === null || body.baseUrl === "") {
+      updates.aiBaseUrl = null;
+    } else if (typeof body.baseUrl === "string") {
+      const trimmed = body.baseUrl.trim();
+      // SSRF guard: by default reject private/internal hostnames so a
+      // compromised user account cannot point the server at the cloud
+      // metadata endpoint or internal admin panels. Ops can enable local
+      // Ollama / LM Studio on this instance via env flag.
+      const allowPrivate = process.env.ALLOW_LOCAL_AI_PRIVATE_HOSTS === "true";
+      if (!allowPrivate && !isPublicUrl(trimmed)) {
+        return apiError(
+          "Base URL points to an internal/private host. Ops must set ALLOW_LOCAL_AI_PRIVATE_HOSTS=true on this instance to allow it (intended for self-hosted Ollama / LM Studio).",
+          422,
+        );
+      }
+      updates.aiBaseUrl = trimmed;
+    }
+  }
+
+  if (body.anthropicKey !== undefined) {
+    if (body.anthropicKey === null || body.anthropicKey === "") {
+      updates.aiAnthropicKeyEncrypted = null;
+    } else if (typeof body.anthropicKey === "string") {
+      updates.aiAnthropicKeyEncrypted = encrypt(body.anthropicKey.trim());
+    }
+  }
+
+  if (body.localKey !== undefined) {
+    if (body.localKey === null || body.localKey === "") {
+      updates.aiLocalKeyEncrypted = null;
+    } else if (typeof body.localKey === "string") {
+      updates.aiLocalKeyEncrypted = encrypt(body.localKey.trim());
+    }
+  }
+
+  if (Object.keys(updates).length === 0) {
+    throw new HttpError(422, "No valid fields");
+  }
+
+  await prisma.user.update({ where: { id: user.id }, data: updates });
+
+  return apiSuccess({ updated: true });
+});