release v0.4.0: bump image tags and chart appVersion

- timeline: unified dir="ltr" container; buffer and progress as stacked absolute fills in correct z-order
- playhead: physical left property instead of insetInlineStart (fixes RTL mirroring)
- control bar: dir="ltr" explicit groups — left: play/rewind/volume/speed, right: theater/fullscreen
- rewind: replace flipped SkipBack with Rewind icon; seek indicator at physical right-8
- ambient effect: removed entirely (canvas, rAF loop, state, constants, toggle)
- settings menu: removed (speed accessible via pill; ambient gone)
- restart button: removed

.gitea/job-image/Dockerfile

@@ -0,0 +1,14 @@
+# CI job image for the Gitea Actions runners.
+#
+# JS actions (actions/checkout, docker/build-push-action) execute INSIDE the
+# job container and need node; builds talk to the runner's daemon through the
+# mounted /var/run/docker.sock, so this image needs the docker CLI + buildx
+# but no daemon. Baking them in means jobs never download binaries at runtime:
+# download.docker.com and github.com releases are unreachable (connection
+# reset) from the cluster's network.
+#
+# Tagged as src.panahifar.ir/ahp/act-job:20 (node 20 / bookworm).
+FROM node:20-bookworm
+
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker:27-cli /usr/local/libexec/docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx

.gitea/workflows/build-and-push.yaml

@@ -0,0 +1,90 @@
+name: build-and-push
+
+# On a version tag push (v*), build both images and publish them to the
+# Gitea container registry. Argo CD then rolls them out via
+# deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
+#
+# Requires a registered Gitea Actions runner, a `REGISTRY_TOKEN` secret
+# (Gitea access token with write:package scope) so docker login can push to
+# the registry.
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: src.panahifar.ir
+  BACKEND_IMAGE: ahp/pargar-backend
+  FRONTEND_IMAGE: ahp/pargar-frontend
+  # Single credential location shared by login + build steps (the job runs
+  # in a container whose HOME can differ between steps).
+  DOCKER_CONFIG: /tmp/.docker
+
+jobs:
+  build:
+    # Gitea runners match on their registered labels (default: linux-amd64)
+    runs-on: linux-amd64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Image tag (strip leading v)
+        id: meta
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      # Builds run docker-outside-of-docker through the runner-mounted
+      # /var/run/docker.sock. The apollo runner's job image (act-job:20,
+      # .gitea/job-image) already ships the docker CLI + buildx in system
+      # plugin paths; runners on other networks fall back to installing them
+      # at runtime (needs access to download.docker.com + github.com, and the
+      # plugin must land where docker looks with DOCKER_CONFIG set).
+      - name: Set up Docker CLI (preinstalled on apollo; install elsewhere)
+        run: |
+          set -eu
+          if [ ! -S /var/run/docker.sock ]; then
+            echo "::error::/var/run/docker.sock is not mounted in the job container - the act_runner config must mount it (docker_host: \"\" auto-mounts it)."
+            exit 1
+          fi
+          if ! command -v docker >/dev/null 2>&1 || ! docker buildx version >/dev/null 2>&1; then
+            curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
+            mkdir -p /root/.docker/cli-plugins /usr/local/libexec/docker/cli-plugins
+            curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
+            cp /root/.docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
+            chmod +x /root/.docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
+          fi
+          docker version
+          docker buildx version
+
+      - name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and push backend
+        uses: docker/build-push-action@v6
+        with:
+          context: ./backend
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:${{ steps.meta.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:latest
+
+      - name: Build and push frontend
+        uses: docker/build-push-action@v6
+        with:
+          context: ./frontend
+          push: true
+          # Empty = same-origin API/WS through the Traefik reverse proxy
+          # (the production topology). Override via repo variables if needed.
+          build-args: |
+            NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
+            NEXT_PUBLIC_WS_URL=${{ vars.NEXT_PUBLIC_WS_URL }}
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:${{ steps.meta.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:latest

README.md

@@ -10,7 +10,6 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/Panahifarah/pargar/releases/tag/v0.1.3"><img src="https://img.shields.io/github/v/tag/Panahifarah/pargar?label=release&color=5B4CDB" alt="release" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-AGPL--3.0-5B4CDB" alt="AGPL-3.0" /></a>
 </p>
 

assets/svg/compass.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1024" height="1024" viewBox="0 0 1024 1024">
+  <title>Compass master</title>
+  <image width="1024" height="1024" href="png/1024x1024.png" xlink:href="png/1024x1024.png"/>
+</svg>

backend/internal/api/account.go

@@ -0,0 +1,172 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"pargar/backend/internal/store"
+)
+
+const msgUsernameCooldown = "سقف سه تغییر نام کاربری پر شده است. تا پایان مهلت نمی‌توانید دوباره نام کاربری را عوض کنید."
+
+func (s *Server) handleUpdateUsername(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	var req struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if strings.TrimSpace(req.Password) != "" {
+		writeErr(w, http.StatusBadRequest, "تغییر گذرواژه از این مسیر ممکن نیست")
+		return
+	}
+	username := strings.ToLower(strings.TrimSpace(req.Username))
+	if username == "" {
+		writeErr(w, http.StatusBadRequest, "شناسه کاربری الزامی است")
+		return
+	}
+	if !validUsername(username) {
+		writeErr(w, http.StatusBadRequest, msgUsernameInvalid)
+		return
+	}
+	user, err := s.store.ChangeUsername(r.Context(), me.ID, username, time.Now())
+	if err != nil {
+		var cool *store.UsernameCooldownError
+		if errors.As(err, &cool) {
+			writeJSON(w, http.StatusTooManyRequests, map[string]any{
+				"error":                    msgUsernameCooldown,
+				"code":                     "username_cooldown",
+				"requestId":                requestIDFromWriter(w),
+				"usernameCooldownUntil":    cool.Until,
+				"usernameChangesRemaining": 0,
+			})
+			return
+		}
+		if errors.Is(err, store.ErrUsernameTaken) {
+			writeErr(w, http.StatusConflict, "این شناسه قبلاً گرفته شده است")
+			return
+		}
+		writeErr(w, http.StatusInternalServerError, "تغییر نام کاربری ممکن نشد")
+		return
+	}
+	s.signUserMedia(user)
+	writeJSON(w, http.StatusOK, map[string]any{
+		"user":                     user,
+		"usernameChangesRemaining": user.UsernameChangesRemaining,
+		"usernameCooldownUntil":    user.UsernameCooldownUntil,
+	})
+}
+
+func (s *Server) handleUpdateAccount(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	var req struct {
+		CurrentPassword string  `json:"currentPassword"`
+		Password        string  `json:"password"`
+		Phone           *string `json:"phone"`
+		Name            *string `json:"name"`
+		Email           *string `json:"email"`
+		Role            *string `json:"role"`
+		Username        *string `json:"username"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if req.Role != nil && strings.TrimSpace(*req.Role) != me.Role.String() {
+		writeErr(w, http.StatusForbidden, "نقش از این مسیر تغییر نمی‌کند")
+		return
+	}
+	if req.Username != nil {
+		next := strings.ToLower(strings.TrimSpace(*req.Username))
+		if next != "" && next != strings.ToLower(me.Username) {
+			writeErr(w, http.StatusBadRequest, "نام کاربری از این مسیر تغییر نمی‌کند")
+			return
+		}
+	}
+
+	hash := ""
+	changingPassword := strings.TrimSpace(req.Password) != ""
+	if changingPassword {
+		if !s.auth.CheckPassword(me.PasswordHash, req.CurrentPassword) {
+			writeErr(w, http.StatusForbidden, "گذرواژه فعلی نادرست است")
+			return
+		}
+		if utf8.RuneCountInString(req.Password) < minPasswordLen {
+			writeErr(w, http.StatusBadRequest, msgPasswordShort)
+			return
+		}
+		if len(req.Password) > maxPasswordLen {
+			writeErr(w, http.StatusBadRequest, msgPasswordLong)
+			return
+		}
+		var err error
+		hash, err = s.auth.HashPassword(req.Password)
+		if err != nil {
+			writeErr(w, http.StatusInternalServerError, "تغییر گذرواژه ممکن نشد")
+			return
+		}
+	}
+
+	name := ""
+	if req.Name != nil {
+		name = strings.TrimSpace(*req.Name)
+		if msg := validatePersonName(name); msg != "" {
+			writeErr(w, http.StatusBadRequest, msg)
+			return
+		}
+	}
+
+	email := ""
+	if req.Email != nil {
+		email = strings.ToLower(strings.TrimSpace(*req.Email))
+		if !validEmail(email) {
+			writeErr(w, http.StatusBadRequest, msgEmailInvalid)
+			return
+		}
+		if !strings.EqualFold(email, me.Email) {
+			if _, err := s.store.GetUserByEmail(r.Context(), email); err == nil {
+				writeErr(w, http.StatusConflict, "این ایمیل قبلاً ثبت شده است")
+				return
+			} else if !errors.Is(err, store.ErrNotFound) {
+				writeErr(w, http.StatusInternalServerError, "ذخیره حساب ممکن نشد")
+				return
+			}
+		}
+	}
+
+	phone := me.Phone
+	if req.Phone != nil {
+		phone = normalizePhone(*req.Phone)
+		if !validPhone(phone) {
+			writeErr(w, http.StatusBadRequest, msgPhoneInvalid)
+			return
+		}
+		if phone != "" && phone != me.Phone {
+			if _, err := s.store.GetUserByPhone(r.Context(), phone); err == nil {
+				writeErr(w, http.StatusConflict, "این شماره تلفن قبلاً ثبت شده است")
+				return
+			} else if !errors.Is(err, store.ErrNotFound) {
+				writeErr(w, http.StatusInternalServerError, "ذخیره حساب ممکن نشد")
+				return
+			}
+		}
+	}
+
+	user, err := s.store.UpdateUser(r.Context(), me.ID, name, email, "", hash, phone, "", "", me.Role, me.Hearts, me.XP)
+	if err != nil {
+		if store.IsUniqueViolation(err) {
+			writeErr(w, http.StatusConflict, "این مقدار قبلاً ثبت شده است")
+			return
+		}
+		writeErr(w, http.StatusInternalServerError, "ذخیره حساب ممکن نشد")
+		return
+	}
+	s.signUserMedia(user)
+	writeJSON(w, http.StatusOK, map[string]any{"user": user})
+}

backend/internal/api/account_freeze.go

@@ -0,0 +1,105 @@
+package api
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+
+	"pargar/backend/internal/models"
+	"pargar/backend/internal/observability"
+	"pargar/backend/internal/store"
+)
+
+const (
+	msgAccountClosedLogin = "حساب بسته شده است و ورود ممکن نیست"
+	msgFreezeAlready      = "حساب همین حالا فریز است"
+	msgAccountClosed      = "حساب بسته شده است"
+	msgUnfreezeClosed     = "مهلت فریز تمام شده و لغو فریز ممکن نیست"
+	msgUnfreezeNone       = "حساب فریز نیست"
+	msgDeleteNotFrozen    = "حذف دائمی فقط برای حساب فریز یا بسته ممکن است"
+)
+
+// settleAccount writes closed_at when a freeze has passed the 30-day window.
+func (s *Server) settleAccount(ctx context.Context, u *models.User) *models.User {
+	if u == nil || u.ClosedAt != nil || u.FrozenAt == nil || !u.IsClosed {
+		return u
+	}
+	next, err := s.store.MarkAccountClosed(ctx, u.ID)
+	if err != nil || next == nil {
+		return u
+	}
+	return next
+}
+
+func (s *Server) handleFreezeAccount(w http.ResponseWriter, r *http.Request) {
+	me := s.settleAccount(r.Context(), currentUser(r))
+	var req struct {
+		CurrentPassword string `json:"currentPassword"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if strings.TrimSpace(req.CurrentPassword) == "" {
+		writeErr(w, http.StatusBadRequest, "گذرواژه فعلی الزامی است")
+		return
+	}
+	if !s.auth.CheckPassword(me.PasswordHash, req.CurrentPassword) {
+		writeErr(w, http.StatusForbidden, "گذرواژه فعلی نادرست است")
+		return
+	}
+	if me.IsClosed {
+		writeErr(w, http.StatusConflict, msgAccountClosed)
+		return
+	}
+	if me.IsFrozen {
+		writeErr(w, http.StatusConflict, msgFreezeAlready)
+		return
+	}
+	user, err := s.store.FreezeUser(r.Context(), me.ID)
+	if err != nil {
+		if errors.Is(err, store.ErrAccountClosed) {
+			writeErr(w, http.StatusConflict, msgAccountClosed)
+			return
+		}
+		if errors.Is(err, store.ErrAccountFrozen) {
+			writeErr(w, http.StatusConflict, msgFreezeAlready)
+			return
+		}
+		writeErr(w, http.StatusInternalServerError, "فریز حساب ممکن نشد")
+		return
+	}
+	observability.Activity("account.frozen", "user_id", user.ID)
+	s.signUserMedia(user)
+	writeJSON(w, http.StatusOK, map[string]any{"user": user})
+}
+
+func (s *Server) handleUnfreezeAccount(w http.ResponseWriter, r *http.Request) {
+	me := s.settleAccount(r.Context(), currentUser(r))
+	if me.IsClosed {
+		writeErr(w, http.StatusConflict, msgUnfreezeClosed)
+		return
+	}
+	if !me.IsFrozen {
+		writeErr(w, http.StatusConflict, msgUnfreezeNone)
+		return
+	}
+	user, err := s.store.UnfreezeUser(r.Context(), me.ID)
+	if err != nil {
+		if errors.Is(err, store.ErrAccountClosed) {
+			_, _ = s.store.MarkAccountClosed(r.Context(), me.ID)
+			writeErr(w, http.StatusConflict, msgUnfreezeClosed)
+			return
+		}
+		if errors.Is(err, store.ErrAccountNotFrozen) {
+			writeErr(w, http.StatusConflict, msgUnfreezeNone)
+			return
+		}
+		writeErr(w, http.StatusInternalServerError, "لغو فریز ممکن نشد")
+		return
+	}
+	observability.Activity("account.unfrozen", "user_id", user.ID)
+	s.signUserMedia(user)
+	writeJSON(w, http.StatusOK, map[string]any{"user": user})
+}

backend/internal/api/account_freeze_test.go

@@ -0,0 +1,102 @@
+package api_test
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestAccountFreeze(t *testing.T) {
+	e := setup(t)
+	token, uid := register(t, e, "Freeze", "freeze@test.dev")
+
+	code, missing := e.do(t, "POST", "/api/me/freeze", token, map[string]any{})
+	missingMsg, _ := missing["error"].(string)
+	if code == http.StatusOK || !strings.Contains(missingMsg, "گذرواژه") {
+		t.Fatalf("freeze without password: %d %q", code, missingMsg)
+	}
+	code, wrong := e.do(t, "POST", "/api/me/freeze", token, map[string]any{"currentPassword": "not-the-password"})
+	wrongMsg, _ := wrong["error"].(string)
+	if code != http.StatusForbidden || !strings.Contains(wrongMsg, "گذرواژه") || !strings.Contains(wrongMsg, "نادرست") {
+		t.Fatalf("freeze with wrong password: %d %q", code, wrongMsg)
+	}
+	var untouched *time.Time
+	if err := e.pool.QueryRow(context.Background(), `SELECT frozen_at FROM users WHERE id=$1`, uid).Scan(&untouched); err != nil {
+		t.Fatal(err)
+	}
+	if untouched != nil {
+		t.Fatal("failed freeze wrote frozen_at")
+	}
+
+	code, body := e.do(t, "POST", "/api/me/freeze", token, map[string]any{"currentPassword": "password123"})
+	if code != http.StatusOK {
+		t.Fatalf("freeze: %d %v", code, body["error"])
+	}
+	user := body["user"].(map[string]any)
+	frozenAt, _ := user["frozenAt"].(string)
+	if frozenAt == "" || user["isFrozen"] != true || user["isClosed"] == true {
+		t.Fatalf("freeze state: frozenAt=%v isFrozen=%v isClosed=%v", user["frozenAt"], user["isFrozen"], user["isClosed"])
+	}
+	if user["isLocked"] == true {
+		t.Fatal("freeze reused the admin lock flag")
+	}
+	var stored *time.Time
+	if err := e.pool.QueryRow(context.Background(), `SELECT frozen_at FROM users WHERE id=$1`, uid).Scan(&stored); err != nil {
+		t.Fatal(err)
+	}
+	if stored == nil || stored.IsZero() {
+		t.Fatal("frozen_at was not stored")
+	}
+
+	code, profile := e.do(t, "GET", "/api/users/"+itoa(uid), token, nil)
+	if code != http.StatusOK {
+		t.Fatalf("profile: %d %v", code, profile["error"])
+	}
+	pub := profile["user"].(map[string]any)
+	if pub["isFrozen"] != true {
+		t.Fatalf("public profile missing freeze flag: %v", pub["isFrozen"])
+	}
+	if _, ok := pub["email"]; ok {
+		t.Fatalf("public profile leaked email: %v", pub["email"])
+	}
+
+	_ = login(t, e, "freeze@test.dev")
+
+	code, body = e.do(t, "POST", "/api/me/unfreeze", token, map[string]any{})
+	if code != http.StatusOK {
+		t.Fatalf("unfreeze: %d %v", code, body["error"])
+	}
+	cleared := body["user"].(map[string]any)
+	if cleared["isFrozen"] == true || cleared["frozenAt"] != nil {
+		t.Fatalf("unfreeze left a timestamp: %v", cleared["frozenAt"])
+	}
+	var after *time.Time
+	if err := e.pool.QueryRow(context.Background(), `SELECT frozen_at FROM users WHERE id=$1`, uid).Scan(&after); err != nil {
+		t.Fatal(err)
+	}
+	if after != nil {
+		t.Fatalf("frozen_at still set: %s", after.Format(time.RFC3339))
+	}
+
+	if _, err := e.pool.Exec(context.Background(), `UPDATE users SET closed_at = now() WHERE id=$1`, uid); err != nil {
+		t.Fatal(err)
+	}
+	code, denied := e.do(t, "POST", "/api/auth/login", "", loginBody(t, e, "freeze@test.dev", "password123"))
+	errMsg, _ := denied["error"].(string)
+	if code != http.StatusForbidden || !strings.Contains(errMsg, "بسته") || !strings.Contains(errMsg, "ورود") {
+		t.Fatalf("closed login: %d %q", code, errMsg)
+	}
+
+	code, undo := e.do(t, "POST", "/api/me/unfreeze", token, map[string]any{})
+	undoMsg, _ := undo["error"].(string)
+	if code != http.StatusConflict || !strings.Contains(undoMsg, "لغو فریز") {
+		t.Fatalf("unfreeze after close: %d %q", code, undoMsg)
+	}
+
+	code, forbidden := e.do(t, "DELETE", "/api/admin/users/"+itoa(uid), token, nil)
+	if code != http.StatusForbidden {
+		t.Fatalf("student permanent delete: %d %v", code, forbidden["error"])
+	}
+}

backend/internal/api/account_username_test.go

@@ -0,0 +1,186 @@
+package api_test
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestAccountUsernameQuota(t *testing.T) {
+	e := setup(t)
+	token, uid := register(t, e, "Quota", "quota@test.dev")
+
+	code, body := e.do(t, "PUT", "/api/me/username", token, map[string]any{"username": "quota"})
+	if code != http.StatusOK {
+		t.Fatalf("same username: %d %v", code, body["error"])
+	}
+	if body["usernameChangesRemaining"].(float64) != 3 {
+		t.Fatalf("same username consumed a slot: %v", body["usernameChangesRemaining"])
+	}
+
+	for i, next := range []string{"quotaone", "quotatwo", "quotathree"} {
+		code, body = e.do(t, "PUT", "/api/me/username", token, map[string]any{"username": next})
+		if code != http.StatusOK {
+			t.Fatalf("change %d: %d %v", i+1, code, body["error"])
+		}
+		user := body["user"].(map[string]any)
+		if user["username"] != next {
+			t.Fatalf("username: %v", user["username"])
+		}
+		wantRemaining := float64(2 - i)
+		if body["usernameChangesRemaining"].(float64) != wantRemaining {
+			t.Fatalf("remaining after change %d: %v", i+1, body["usernameChangesRemaining"])
+		}
+	}
+	if body["usernameCooldownUntil"] == nil || body["usernameCooldownUntil"] == "" {
+		t.Fatalf("third change should start cooldown: %v", body["usernameCooldownUntil"])
+	}
+
+	code, blocked := e.do(t, "PUT", "/api/me/username", token, map[string]any{"username": "quotafour"})
+	errMsg, _ := blocked["error"].(string)
+	if code != http.StatusTooManyRequests || !strings.Contains(errMsg, "نام کاربری") || !strings.Contains(errMsg, "مهلت") {
+		t.Fatalf("fourth change: %d %q", code, errMsg)
+	}
+
+	code, me := e.do(t, "GET", "/api/auth/me", token, nil)
+	if code != http.StatusOK {
+		t.Fatalf("me: %d", code)
+	}
+	if me["user"].(map[string]any)["username"] != "quotathree" {
+		t.Fatalf("username changed during cooldown: %v", me["user"].(map[string]any)["username"])
+	}
+
+	if _, err := e.pool.Exec(context.Background(), `UPDATE users SET username_cooldown_until = now() - interval '1 second' WHERE id=$1`, uid); err != nil {
+		t.Fatal(err)
+	}
+	code, body = e.do(t, "PUT", "/api/me/username", token, map[string]any{"username": "quotafour"})
+	if code != http.StatusOK {
+		t.Fatalf("after cooldown: %d %v", code, body["error"])
+	}
+	if body["user"].(map[string]any)["username"] != "quotafour" {
+		t.Fatalf("username after cooldown: %v", body["user"])
+	}
+	if body["usernameChangesRemaining"].(float64) != 2 {
+		t.Fatalf("allowance should reset then consume one: %v", body["usernameChangesRemaining"])
+	}
+
+	code, denied := e.do(t, "PUT", "/api/me/account", token, map[string]any{"password": "replacement-pass"})
+	if code != http.StatusForbidden {
+		t.Fatalf("password change without current password: %d %v", code, denied["error"])
+	}
+	_ = login(t, e, "quota@test.dev")
+
+	code, rejected := e.do(t, "PUT", "/api/me/username", token, map[string]any{
+		"username": "quotafive",
+		"password": "should-be-ignored",
+	})
+	if code != http.StatusBadRequest {
+		t.Fatalf("username endpoint accepted a password: %d %v", code, rejected["error"])
+	}
+	code, me = e.do(t, "GET", "/api/auth/me", token, nil)
+	if code != http.StatusOK || me["user"].(map[string]any)["username"] != "quotafour" {
+		t.Fatalf("username changed via password field: %d %v", code, me["user"])
+	}
+}
+
+func TestAccountIdentityWithoutPassword(t *testing.T) {
+	e := setup(t)
+	token, _ := register(t, e, "Identity", "identity@test.dev")
+
+	code, me := e.do(t, "GET", "/api/auth/me", token, nil)
+	if code != http.StatusOK {
+		t.Fatalf("me: %d", code)
+	}
+	before := me["user"].(map[string]any)
+	username, _ := before["username"].(string)
+	role, _ := before["role"].(string)
+
+	code, body := e.do(t, "PUT", "/api/me/account", token, map[string]any{
+		"name":  "هویت تازه",
+		"email": "identity-new@test.dev",
+		"phone": "09120001122",
+	})
+	if code != http.StatusOK {
+		t.Fatalf("identity save: %d %v", code, body["error"])
+	}
+	user := body["user"].(map[string]any)
+	if user["name"] != "هویت تازه" || user["email"] != "identity-new@test.dev" || user["phone"] != "09120001122" {
+		t.Fatalf("saved identity: name=%v email=%v phone=%v", user["name"], user["email"], user["phone"])
+	}
+	if user["username"] != username || user["role"] != role {
+		t.Fatalf("username or role changed: username=%v role=%v", user["username"], user["role"])
+	}
+	if user["securityQuestion"] != before["securityQuestion"] {
+		t.Fatalf("security question changed: %v", user["securityQuestion"])
+	}
+	_ = login(t, e, "identity-new@test.dev")
+
+	code, same := e.do(t, "PUT", "/api/me/account", token, map[string]any{
+		"name":  "هویت تازه",
+		"email": "identity-new@test.dev",
+		"phone": "09120001122",
+	})
+	if code != http.StatusOK {
+		t.Fatalf("same identity: %d %v", code, same["error"])
+	}
+
+	_, _ = register(t, e, "Other", "taken-mail@test.dev")
+	code, dup := e.do(t, "PUT", "/api/me/account", token, map[string]any{"email": "taken-mail@test.dev"})
+	if code != http.StatusConflict {
+		t.Fatalf("duplicate email: %d %v", code, dup["error"])
+	}
+	code, bad := e.do(t, "PUT", "/api/me/account", token, map[string]any{"email": "not-an-email"})
+	if code != http.StatusBadRequest {
+		t.Fatalf("invalid email: %d %v", code, bad["error"])
+	}
+	code, phoneBad := e.do(t, "PUT", "/api/me/account", token, map[string]any{"phone": "123"})
+	if code != http.StatusBadRequest {
+		t.Fatalf("invalid phone: %d %v", code, phoneBad["error"])
+	}
+
+	code, roleBody := e.do(t, "PUT", "/api/me/account", token, map[string]any{"role": "admin", "name": "نباید ذخیره شود"})
+	if code != http.StatusForbidden {
+		t.Fatalf("role change: %d %v", code, roleBody["error"])
+	}
+	code, userBody := e.do(t, "PUT", "/api/me/account", token, map[string]any{"username": "hijackname"})
+	if code != http.StatusBadRequest {
+		t.Fatalf("username via account: %d %v", code, userBody["error"])
+	}
+
+	code, me = e.do(t, "GET", "/api/auth/me", token, nil)
+	if code != http.StatusOK {
+		t.Fatalf("me after rejects: %d", code)
+	}
+	after := me["user"].(map[string]any)
+	if after["role"] != role || after["username"] != username || after["name"] != "هویت تازه" || after["email"] != "identity-new@test.dev" {
+		t.Fatalf("account mutated by rejected fields: %v", after)
+	}
+
+	code, denied := e.do(t, "PUT", "/api/me/account", token, map[string]any{"password": "replacement-pass"})
+	if code != http.StatusForbidden {
+		t.Fatalf("password without current: %d %v", code, denied["error"])
+	}
+	_ = login(t, e, "identity-new@test.dev")
+
+	code, changed := e.do(t, "PUT", "/api/me/account", token, map[string]any{
+		"currentPassword": "password123",
+		"password":        "replacement-pass",
+	})
+	if code != http.StatusOK {
+		t.Fatalf("password with current: %d %v", code, changed["error"])
+	}
+	kept := changed["user"].(map[string]any)
+	if kept["name"] != "هویت تازه" || kept["email"] != "identity-new@test.dev" || kept["phone"] != "09120001122" || kept["role"] != role {
+		t.Fatalf("password save changed identity: %v", kept)
+	}
+	code, session := e.do(t, "POST", "/api/auth/login", "", loginBody(t, e, "identity-new@test.dev", "replacement-pass"))
+	if code != http.StatusOK || session["accessToken"] == nil {
+		t.Fatalf("login after password change: %d %v", code, session["error"])
+	}
+	code, old := e.do(t, "POST", "/api/auth/login", "", loginBody(t, e, "identity-new@test.dev", "password123"))
+	if code == http.StatusOK {
+		t.Fatalf("previous password still works: %d", code)
+	}
+	_ = old["error"]
+}

backend/internal/api/admin.go

@@ -33,6 +33,7 @@ func (s *Server) handleAdminGetUser(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusNotFound, "کاربر پیدا نشد")
 		return
 	}
+	u = s.settleAccount(r.Context(), u)
 	writeJSON(w, http.StatusOK, map[string]any{"user": u})
 }
 
@@ -442,6 +443,16 @@ func (s *Server) handleAdminDeleteUser(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusForbidden, "دسترسی کافی ندارید")
 		return
 	}
+	target, err := s.store.GetUserByID(r.Context(), id)
+	if err != nil {
+		writeErr(w, http.StatusNotFound, "کاربر پیدا نشد")
+		return
+	}
+	target = s.settleAccount(r.Context(), target)
+	if !target.IsFrozen && !target.IsClosed {
+		writeErr(w, http.StatusConflict, msgDeleteNotFrozen)
+		return
+	}
 	if err := s.store.DeleteUser(r.Context(), id); err != nil {
 		writeErr(w, http.StatusInternalServerError, "حذف کاربر ممکن نشد")
 		return
@@ -564,6 +575,38 @@ func (s *Server) handleAdminDeleteLesson(w http.ResponseWriter, r *http.Request)
 	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
 }
 
+func (s *Server) handleAdminPublishLesson(w http.ResponseWriter, r *http.Request) {
+	id := routeID(r, "id")
+	var body struct {
+		Publish bool `json:"publish"`
+	}
+	if err := bodyJSON(r, &body); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if err := s.store.PublishLesson(r.Context(), id, body.Publish); err != nil {
+		writeErr(w, http.StatusInternalServerError, "به‌روزرسانی وضعیت درس ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleAdminPublishChapter(w http.ResponseWriter, r *http.Request) {
+	id := routeID(r, "id")
+	var body struct {
+		Publish bool `json:"publish"`
+	}
+	if err := bodyJSON(r, &body); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if err := s.store.PublishChapter(r.Context(), id, body.Publish); err != nil {
+		writeErr(w, http.StatusInternalServerError, "به‌روزرسانی وضعیت فصل ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
 // ---- questions ----
 
 func (s *Server) handleAdminListQuestions(w http.ResponseWriter, r *http.Request) {
@@ -837,58 +880,3 @@ func validateAdminEvent(e *models.Event, create bool) string {
 	_ = create
 	return ""
 }
-
-// ---- announcements ----
-
-func (s *Server) handleAdminAnnounce(w http.ResponseWriter, r *http.Request) {
-	var req struct {
-		Title    string `json:"title"`
-		Body     string `json:"body"`
-		Route    string `json:"route"`
-		Category string `json:"category"`
-	}
-	if err := bodyJSON(r, &req); err != nil {
-		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
-		return
-	}
-	req.Title = strings.TrimSpace(req.Title)
-	req.Body = strings.TrimSpace(req.Body)
-	req.Route = strings.TrimSpace(req.Route)
-	if utf8.RuneCountInString(req.Title) < 3 {
-		writeErr(w, http.StatusBadRequest, "عنوان اطلاعیه خیلی کوتاه است")
-		return
-	}
-	if utf8.RuneCountInString(req.Title) > 200 {
-		writeErr(w, http.StatusBadRequest, "عنوان اطلاعیه خیلی طولانی است")
-		return
-	}
-	if utf8.RuneCountInString(req.Body) < 8 {
-		writeErr(w, http.StatusBadRequest, "متن اطلاعیه خیلی کوتاه است")
-		return
-	}
-	if utf8.RuneCountInString(req.Body) > 500 {
-		writeErr(w, http.StatusBadRequest, "متن اطلاعیه خیلی طولانی است")
-		return
-	}
-	if req.Category == "" {
-		req.Category = "event"
-	}
-	switch req.Category {
-	case "event", "progress", "gamification", "mentor":
-	default:
-		writeErr(w, http.StatusBadRequest, "دستهٔ اطلاعیه نامعتبر است")
-		return
-	}
-	userIDs, err := s.store.AllActiveUserIDs(r.Context())
-	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "بارگذاری کاربران ممکن نشد")
-		return
-	}
-	go func() {
-		for _, uid := range userIDs {
-			_ = s.notify.Notify(context.Background(), uid, req.Category, "announcement",
-				req.Title, req.Body, req.Route, nil)
-		}
-	}()
-	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "recipients": len(userIDs)})
-}

backend/internal/api/auth.go

@@ -175,6 +175,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusForbidden, "حساب غیرفعال است")
 		return
 	}
+	user = s.settleAccount(r.Context(), user)
+	if user.IsClosed {
+		observability.Logins.WithLabelValues("closed").Inc()
+		writeErr(w, http.StatusForbidden, msgAccountClosedLogin)
+		return
+	}
 	refreshTTL := s.auth.refreshTTL(req.RememberMe)
 	access, refresh, err := s.auth.IssueForUserTTL(r.Context(), user, refreshTTL)
 	if err != nil {
@@ -222,6 +228,12 @@ func (s *Server) handleRefresh(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusUnauthorized, "حساب غیرفعال است")
 		return
 	}
+	user = s.settleAccount(r.Context(), user)
+	if user.IsClosed {
+		s.clearSessionCookies(w)
+		writeErr(w, http.StatusForbidden, msgAccountClosedLogin)
+		return
+	}
 	// Preserve remember-me vs short session when rotating the refresh token.
 	ttl := s.cfg.RefreshTokenTTLSession
 	if lifetime >= 48*time.Hour {
@@ -266,6 +278,7 @@ func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		user = hearts
 	}
+	user = s.settleAccount(r.Context(), user)
 	s.signUserMedia(user)
 	writeJSON(w, http.StatusOK, map[string]any{"user": user})
 }

backend/internal/api/certificate.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
-	"time"
 
 	"pargar/backend/internal/models"
 	"pargar/backend/internal/observability"
@@ -22,7 +21,24 @@ func newPublicID() (string, error) {
 	return hex.EncodeToString(b), nil
 }
 
+func (s *Server) certEnabled(ctx context.Context) bool {
+	if v, err := s.store.GetSetting(ctx, "certificate_enabled"); err == nil {
+		return v == "true" || v == "1"
+	}
+	return true
+}
+
+// certRequiresApproval always returns true — certificates are never auto-issued.
+// The DB setting is kept for observability but cannot override the hard gate.
+func (s *Server) certRequiresApproval(_ context.Context) bool { return true }
+
+// issueCertificateIfEligible creates a pending certificate row when the user has
+// completed the curriculum. It never issues (publishes) the certificate directly;
+// that step requires explicit admin action via handleAdminIssueCertificate.
 func (s *Server) issueCertificateIfEligible(ctx context.Context, user *models.User) (*models.Certificate, bool, error) {
+	if !s.certEnabled(ctx) {
+		return nil, false, nil
+	}
 	ok, err := s.store.HasCompletedCurriculum(ctx, user.ID)
 	if err != nil {
 		return nil, false, err
@@ -37,15 +53,12 @@ func (s *Server) issueCertificateIfEligible(ctx context.Context, user *models.Us
 	} else if err != store.ErrNotFound {
 		return nil, false, err
 	}
-	publicID, err := newPublicID()
+	// Always create a pending row — never auto-issue.
+	cert, err := s.store.CreatePendingCertificate(ctx, user.ID, user.Name)
 	if err != nil {
 		return nil, false, err
 	}
-	cert, err := s.store.CreateCertificate(ctx, user.ID, publicID, user.Name)
-	if err != nil {
-		return nil, false, err
-	}
-	return cert, true, nil
+	return cert, cert.Status == "pending", nil
 }
 
 func (s *Server) handleIssueCertificate(w http.ResponseWriter, r *http.Request) {
@@ -101,7 +114,7 @@ func (s *Server) handlePublicCertificate(w http.ResponseWriter, r *http.Request)
 		return
 	}
 	cert, err := s.store.GetCertificateByPublicID(r.Context(), publicID)
-	if err != nil || cert.RevokedAt != nil {
+	if err != nil || cert.RevokedAt != nil || cert.Status != "issued" {
 		writeErr(w, http.StatusNotFound, "گواهینامه پیدا نشد")
 		return
 	}
@@ -140,90 +153,66 @@ func (s *Server) physicalSettings(ctx context.Context) map[string]any {
 }
 
 func (s *Server) handleRequestPhysicalCertificate(w http.ResponseWriter, r *http.Request) {
-	u := currentUser(r)
-	settings := s.physicalSettings(r.Context())
-	if enabled, _ := settings["enabled"].(bool); !enabled {
-		writeErr(w, http.StatusBadRequest, "درخواست نسخه فیزیکی فعلاً فعال نیست")
-		return
-	}
-	cert, err := s.store.GetCertificateByUser(r.Context(), u.ID)
-	if err != nil || cert.RevokedAt != nil {
-		writeErr(w, http.StatusConflict, "ابتدا گواهینامه دیجیتال را دریافت کنید")
-		return
-	}
-	days, _ := settings["windowDays"].(int)
-	if days <= 0 {
-		days = 30
-	}
-	windowEnds := cert.IssuedAt.Add(time.Duration(days) * 24 * time.Hour)
-	if time.Now().After(windowEnds) {
-		writeErr(w, http.StatusConflict, "مهلت درخواست نسخه فیزیکی به پایان رسیده است")
-		return
-	}
-	if existing, err := s.store.GetLatestPhysicalOrder(r.Context(), u.ID); err == nil {
-		if existing.Status != models.PhysicalCancelled {
-			writeErr(w, http.StatusConflict, "سفارش فیزیکی فعال دارید")
-			return
-		}
-	}
-	var req struct {
-		RecipientName string `json:"recipientName"`
-		Phone         string `json:"phone"`
-		Address       string `json:"address"`
-		City          string `json:"city"`
-		PostalCode    string `json:"postalCode"`
-	}
-	if err := bodyJSON(r, &req); err != nil {
-		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
-		return
-	}
-	ship := models.CertificatePhysicalOrder{
-		RecipientName: strings.TrimSpace(req.RecipientName),
-		Phone:         normalizePhone(req.Phone),
-		Address:       strings.TrimSpace(req.Address),
-		City:          strings.TrimSpace(req.City),
-		PostalCode:    strings.TrimSpace(req.PostalCode),
-	}
-	if ship.RecipientName == "" {
-		ship.RecipientName = u.Name
-	}
-	if ship.Phone == "" {
-		ship.Phone = normalizePhone(u.Phone)
-	}
-	if ship.Phone == "" || !validPhone(ship.Phone) {
-		writeErr(w, http.StatusBadRequest, msgPhoneInvalid)
-		return
-	}
-	if ship.Address == "" || ship.City == "" {
-		writeErr(w, http.StatusBadRequest, "آدرس و شهر برای ارسال الزامی است")
-		return
-	}
-	if len(ship.Address) > 500 || len(ship.City) > 80 || len(ship.RecipientName) > 120 {
-		writeErr(w, http.StatusBadRequest, "اطلاعات ارسال بیش از حد طولانی است")
-		return
-	}
-	order, err := s.store.CreatePhysicalOrder(r.Context(), cert.ID, u.ID, windowEnds, ship)
+	writeErr(w, http.StatusGone, "سفارش فیزیکی موقتاً غیرفعال است")
+}
+
+func (s *Server) handleAdminIssueCertificate(w http.ResponseWriter, r *http.Request) {
+	userID := routeID(r, "id")
+	u, err := s.store.GetUserByID(r.Context(), userID)
 	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "ثبت درخواست ممکن نشد")
+		writeErr(w, http.StatusNotFound, "کاربر پیدا نشد")
+		return
+	}
+	existing, err := s.store.GetCertificateByUser(r.Context(), userID)
+	if err != nil && err != store.ErrNotFound {
+		writeInternalErr(w, "cert.admin.issue", err, "بارگذاری گواهینامه ممکن نشد")
+		return
+	}
+	if existing != nil && existing.RevokedAt == nil && existing.Status == "issued" {
+		writeErr(w, http.StatusConflict, "گواهینامه قبلاً صادر شده است")
+		return
+	}
+	publicID, err := newPublicID()
+	if err != nil {
+		writeInternalErr(w, "cert.admin.pubid", err, "تولید شناسه ممکن نشد")
+		return
+	}
+	var cert *models.Certificate
+	if existing != nil {
+		cert, err = s.store.IssuePendingCertificate(r.Context(), userID, publicID, u.Name)
+	} else {
+		cert, err = s.store.CreateCertificate(r.Context(), userID, publicID, u.Name)
+	}
+	if err != nil {
+		writeInternalErr(w, "cert.admin.create", err, "صدور گواهینامه ممکن نشد")
 		return
 	}
-	staff, _ := s.store.ListMentors(r.Context())
 	go func() {
-		for _, m := range staff {
-			if m.Role != models.RoleAdmin {
-				continue
-			}
-			_ = s.notify.Notify(context.Background(), m.ID, "progress", "physical_order",
-				"سفارش گواهینامه فیزیکی", u.Name+" درخواست نسخه فیزیکی ثبت کرد.", "/admin",
-				map[string]any{"orderId": order.ID, "userId": u.ID})
-		}
+		_ = s.notify.Notify(context.Background(), userID, "progress", "certificate_issued",
+			"گواهینامه صادر شد", "گواهینامه پرگار شما صادر شد. برای مشاهده به صفحه گواهینامه مراجعه کنید.", "/cap",
+			map[string]any{"publicId": cert.PublicID})
 	}()
-	observability.Activity("certificate.physical_requested", "user_id", u.ID, "order_id", order.ID)
-	writeJSON(w, http.StatusCreated, map[string]any{
-		"order":    order,
-		"message":  "پس از واریز با ادمین هماهنگ کنید",
-		"physical": settings,
-	})
+	observability.Activity("certificate.admin_issued", "user_id", userID, "actor_id", currentUser(r).ID)
+	writeJSON(w, http.StatusOK, map[string]any{"certificate": cert})
+}
+
+func (s *Server) handleAdminRevokeCertificate(w http.ResponseWriter, r *http.Request) {
+	userID := routeID(r, "id")
+	if err := s.store.RevokeCertificate(r.Context(), userID); err != nil {
+		writeInternalErr(w, "cert.admin.revoke", err, "لغو گواهینامه ممکن نشد")
+		return
+	}
+	observability.Activity("certificate.admin_revoked", "user_id", userID, "actor_id", currentUser(r).ID)
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleAdminListPendingCertificates(w http.ResponseWriter, r *http.Request) {
+	certs, err := s.store.ListCertificatesByStatus(r.Context(), "pending")
+	if err != nil {
+		writeInternalErr(w, "cert.admin.pending", err, "بارگذاری گواهینامه‌های در انتظار ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"certificates": certs})
 }
 
 func (s *Server) handleAdminListPhysicalOrders(w http.ResponseWriter, r *http.Request) {

backend/internal/api/certificate_test.go

@@ -0,0 +1,50 @@
+package api_test
+
+import (
+	"context"
+	"net/http"
+	"testing"
+)
+
+// TestPendingCertDoesNotShortCircuitCurriculumCheck ensures that a pending
+// certificate does not satisfy HasCompletedCurriculum. Only an issued
+// (non-revoked) certificate should bypass the lesson-completion check.
+func TestPendingCertDoesNotShortCircuitCurriculumCheck(t *testing.T) {
+	e := setup(t)
+	token, uid := register(t, e, "CertPending", "cert-pending@test.dev")
+	admin := login(t, e, bootstrapAdminEmail)
+
+	// Forcibly create a pending certificate in the DB (simulating a student
+	// who triggered issueCertificateIfEligible via quiz submit).
+	_, err := e.pool.Exec(context.Background(),
+		`INSERT INTO certificates (user_id, full_name, status)
+		 VALUES ($1, 'CertPending', 'pending')
+		 ON CONFLICT DO NOTHING`, uid)
+	if err != nil {
+		t.Fatalf("insert pending cert: %v", err)
+	}
+
+	// The student has NOT passed any lessons — eligible must be false.
+	code, body := e.do(t, "GET", "/api/me/certificate", token, nil)
+	if code != http.StatusOK {
+		t.Fatalf("get cert: %d %v", code, body)
+	}
+	if body["eligible"] != false {
+		t.Fatalf("pending cert must not make student eligible; got eligible=%v", body["eligible"])
+	}
+
+	// Admin issues the certificate manually.
+	code, _ = e.do(t, "POST", "/api/admin/users/"+itoa(uid)+"/certificate/issue", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("admin issue: %d", code)
+	}
+
+	// Physical order endpoint must return 410 Gone.
+	code, _ = e.do(t, "POST", "/api/me/certificate/physical", token, map[string]any{
+		"recipientName": "Test", "phone": "09123456789", "address": "addr",
+		"city": "tehran", "postalCode": "1234567890",
+	})
+	if code != http.StatusGone {
+		t.Fatalf("physical endpoint must be disabled (410), got %d", code)
+	}
+}

backend/internal/api/chat.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -18,38 +19,59 @@ const maxUploadSize = 25 << 20 // 25 MB
 
 func (s *Server) handleListMentors(w http.ResponseWriter, r *http.Request) {
 	actor := currentUser(r)
-	var mentors []models.User
-	var err error
-	if actor.Role == models.RoleMentor || actor.Role == models.RoleAdmin {
-		mentors, _, err = s.store.ListUsers(r.Context(), "", "", 100, 0)
-	} else {
-		mentors, err = s.store.ListMentors(r.Context())
+	page := parsePageParams(r)
+	if page.PageSize < 20 {
+		page.PageSize = 20
+		page.Offset = (page.Page - 1) * page.PageSize
 	}
+	roles := []string{models.RoleMentor.String(), models.RoleAdmin.String()}
+	if actor.Role == models.RoleMentor || actor.Role == models.RoleAdmin {
+		roles = []string{models.RoleStudent.String(), models.RoleMentor.String(), models.RoleAdmin.String()}
+	}
+	people, total, err := s.store.ListActiveByRoles(r.Context(), roles, page.PageSize, page.Offset)
 	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "بارگذاری منتورها ممکن نشد")
+		writeErr(w, http.StatusInternalServerError, "بارگذاری افراد ممکن نشد")
 		return
 	}
-	safe := make([]map[string]any, 0, len(mentors))
-	for _, m := range mentors {
-		if m.ID == actor.ID || !m.IsActive {
-			continue
+	ids := make([]int64, 0, len(people))
+	for _, m := range people {
+		if m.ID != actor.ID {
+			ids = append(ids, m.ID)
 		}
-		if actor.Role == models.RoleStudent && m.Role != models.RoleMentor && m.Role != models.RoleAdmin {
+	}
+	seen, _ := s.store.LastSeenByIDs(r.Context(), ids)
+	safe := make([]map[string]any, 0, len(people))
+	for _, m := range people {
+		if m.ID == actor.ID {
 			continue
 		}
 		s.signUserMedia(&m)
-		safe = append(safe, map[string]any{
+		item := map[string]any{
 			"id": m.ID, "name": m.Name, "email": m.Email, "role": m.Role,
 			"avatarVariant": m.AvatarVariant, "avatarPalette": m.AvatarPalette, "avatarPhoto": m.AvatarPhoto,
-		})
+			"online": s.hub.Online(m.ID),
+		}
+		if ts, ok := seen[m.ID]; ok && !ts.IsZero() {
+			item["lastSeen"] = ts.UTC()
+		}
+		safe = append(safe, item)
 	}
-	writeJSON(w, http.StatusOK, map[string]any{"mentors": safe})
+	writeJSON(w, http.StatusOK, map[string]any{
+		"mentors":  safe,
+		"total":    total,
+		"page":     page.Page,
+		"pageSize": page.PageSize,
+	})
 }
 
 type conversation struct {
-	Partner     map[string]any      `json:"partner"`
-	LastMessage *models.ChatMessage `json:"lastMessage,omitempty"`
-	UnreadCount int                 `json:"unreadCount"`
+	Partner      map[string]any      `json:"partner"`
+	LastMessage  *models.ChatMessage `json:"lastMessage,omitempty"`
+	UnreadCount  int                 `json:"unreadCount"`
+	MessageCount int                 `json:"messageCount"`
+	PinnedRank   *int                `json:"pinnedRank"`
+	Muted        bool                `json:"muted"`
+	Archived     bool                `json:"archived"`
 }
 
 func (s *Server) handleConversations(w http.ResponseWriter, r *http.Request) {
@@ -94,11 +116,23 @@ func (s *Server) handleConversations(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	showArchived := r.URL.Query().Get("archived") == "1"
+	partnerIDs := make([]int64, 0, len(partners))
+	for _, p := range partners {
+		if p.ID != u.ID {
+			partnerIDs = append(partnerIDs, p.ID)
+		}
+	}
+	seen, _ := s.store.LastSeenByIDs(r.Context(), partnerIDs)
 	out := make([]conversation, 0, len(partners))
 	for _, p := range partners {
 		if !s.canChatWith(r.Context(), u, p.ID) {
 			continue
 		}
+		pref := s.store.ChatPref(r.Context(), u.ID, p.ID)
+		if pref.Archived != showArchived {
+			continue
+		}
 		msgs, err := s.store.ListChatMessages(r.Context(), u.ID, p.ID, 0, 100)
 		if err != nil {
 			continue
@@ -118,23 +152,95 @@ func (s *Server) handleConversations(w http.ResponseWriter, r *http.Request) {
 			s.signUserMedia(tmp)
 			photo = tmp.AvatarPhoto
 		}
+		name := p.Name
+		saved := p.ID == u.ID
+		if saved {
+			name = "پیام‌های ذخیره‌شده"
+		}
+		partner := map[string]any{
+			"id": p.ID, "name": name, "email": p.Email, "role": p.Role,
+			"avatarVariant": p.AvatarVariant, "avatarPalette": p.AvatarPalette, "avatarPhoto": photo,
+			"online": !saved && s.hub.Online(p.ID), "saved": saved,
+		}
+		if !saved {
+			if ts, ok := seen[p.ID]; ok && !ts.IsZero() {
+				partner["lastSeen"] = ts.UTC()
+			}
+		}
 		conv := conversation{
-			Partner: map[string]any{
-				"id": p.ID, "name": p.Name, "email": p.Email, "role": p.Role,
-				"avatarVariant": p.AvatarVariant, "avatarPalette": p.AvatarPalette, "avatarPhoto": photo,
-				"online": s.hub.Online(p.ID),
-			},
-			UnreadCount: unread,
+			Partner:      partner,
+			UnreadCount:  unread,
+			MessageCount: len(msgs),
+			PinnedRank:   pref.PinnedRank,
+			Muted:        pref.Muted,
+			Archived:     pref.Archived,
 		}
 		if last != nil {
 			conv.LastMessage = last
 		}
 		out = append(out, conv)
 	}
+	if !showArchived {
+		hasSelf := false
+		for _, c := range out {
+			if id, _ := c.Partner["id"].(int64); id == u.ID {
+				hasSelf = true
+				break
+			}
+		}
+		if !hasSelf {
+			out = append(out, conversation{
+				Partner: map[string]any{
+					"id": u.ID, "name": "پیام‌های ذخیره‌شده", "email": u.Email, "role": u.Role,
+					"avatarVariant": u.AvatarVariant, "avatarPalette": u.AvatarPalette, "avatarPhoto": u.AvatarPhoto,
+					"online": false, "saved": true,
+				},
+			})
+		}
+	}
 	if out == nil {
 		out = []conversation{}
 	}
-	writeJSON(w, http.StatusOK, map[string]any{"conversations": out})
+	sort.SliceStable(out, func(i, j int) bool {
+		pi, pj := out[i].PinnedRank, out[j].PinnedRank
+		if (pi != nil) != (pj != nil) {
+			return pi != nil
+		}
+		if pi != nil && pj != nil && *pi != *pj {
+			return *pi < *pj
+		}
+		ti := time.Time{}
+		tj := time.Time{}
+		if out[i].LastMessage != nil {
+			ti = out[i].LastMessage.CreatedAt
+		}
+		if out[j].LastMessage != nil {
+			tj = out[j].LastMessage.CreatedAt
+		}
+		return ti.After(tj)
+	})
+	total := len(out)
+	slice := out
+	page := pageParams{Page: 1, PageSize: total}
+	if r.URL.Query().Get("page") != "" || r.URL.Query().Get("pageSize") != "" {
+		page = parsePageParams(r)
+		start := page.Offset
+		if start > total {
+			start = total
+		}
+		end := start + page.PageSize
+		if end > total {
+			end = total
+		}
+		slice = out[start:end]
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"conversations": slice,
+		"total":         total,
+		"page":          page.Page,
+		"pageSize":      page.PageSize,
+		"mutedAll":      s.store.ChatMutedAll(r.Context(), u.ID),
+	})
 }
 
 func (s *Server) handleChatMessages(w http.ResponseWriter, r *http.Request) {
@@ -224,43 +330,22 @@ func (s *Server) handleChatSend(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var req struct {
-		Body       string             `json:"body"`
-		ReplyTo    *int64             `json:"replyTo"`
-		Attachment *models.Attachment `json:"attachment,omitempty"`
+		Body        string              `json:"body"`
+		ReplyTo     *int64              `json:"replyTo"`
+		Attachment  *models.Attachment  `json:"attachment,omitempty"`
+		Attachments []models.Attachment `json:"attachments,omitempty"`
 	}
 	if err := bodyJSON(r, &req); err != nil {
 		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
 		return
 	}
 	req.Body = strings.TrimSpace(req.Body)
-	if att := req.Attachment; att != nil {
-		if att.Size > maxUploadSize {
-			writeErr(w, http.StatusBadRequest, "حجم پیوست بیش از حد مجاز است")
-			return
-		}
-		att.Type = strings.ToLower(att.Type)
-		if att.Type != "image" && att.Type != "video" && att.Type != "audio" && att.Type != "file" {
-			writeErr(w, http.StatusBadRequest, "نوع پیوست پشتیبانی نمی‌شود")
-			return
-		}
-		if att.URL == "" || !strings.Contains(att.URL, "/media/") {
-			writeErr(w, http.StatusBadRequest, "نشانی پیوست نامعتبر است")
-			return
-		}
-		key := mediaKeyFromURL(att.URL)
-		if !mediaKeyOwnedByUser(key, u.ID) {
-			writeErr(w, http.StatusBadRequest, "پیوست متعلق به شما نیست")
-			return
-		}
-		// Persist without signature query — re-signed when messages are returned.
-		if q := strings.Index(att.URL, "?"); q >= 0 {
-			att.URL = att.URL[:q]
-		}
-		if att.Name == "" {
-			att.Name = "file"
-		}
+	atts, attErr := prepareChatAttachments(u.ID, req.Attachment, req.Attachments)
+	if attErr != "" {
+		writeErr(w, http.StatusBadRequest, attErr)
+		return
 	}
-	if req.Body == "" && req.Attachment == nil {
+	if req.Body == "" && len(atts) == 0 {
 		writeErr(w, http.StatusBadRequest, "پیام باید شامل متن یا فایل باشد")
 		return
 	}
@@ -281,7 +366,7 @@ func (s *Server) handleChatSend(w http.ResponseWriter, r *http.Request) {
 		mentorID = u.ID
 	}
 
-	msg, err := s.store.AddChatMessage(r.Context(), studentID, mentorID, u.Role, req.Body, req.ReplyTo, req.Attachment)
+	msg, err := s.store.AddChatMessage(r.Context(), studentID, mentorID, u.Role, req.Body, req.ReplyTo, atts)
 	if err != nil {
 		writeErr(w, http.StatusInternalServerError, "ارسال پیام ممکن نشد")
 		return
@@ -291,6 +376,7 @@ func (s *Server) handleChatSend(w http.ResponseWriter, r *http.Request) {
 	// live push chat_message to both participants
 	s.hub.Push(u.ID, map[string]any{"type": "chat_message", "item": msg, "from": u.ID})
 	s.hub.Push(partnerID, map[string]any{"type": "chat_message", "item": msg, "from": u.ID})
+	s.noteBotReply(r, partnerID, req.Body)
 
 	// notify the recipient
 	if u.Role == models.RoleMentor || u.Role == models.RoleAdmin {
@@ -352,8 +438,14 @@ func (s *Server) handleChatEdit(w http.ResponseWriter, r *http.Request) {
 	}
 	msgID := routeID(r, "id")
 	var req struct {
-		Body       string             `json:"body"`
-		Attachment *models.Attachment `json:"attachment,omitempty"`
+		Body           string              `json:"body"`
+		Attachment     *models.Attachment  `json:"attachment,omitempty"`
+		AddAttachments []models.Attachment `json:"addAttachments,omitempty"`
+		RemoveIndexes  []int               `json:"removeIndexes,omitempty"`
+		Replacements   []struct {
+			Index      int               `json:"index"`
+			Attachment models.Attachment `json:"attachment"`
+		} `json:"replacements,omitempty"`
 	}
 	if err := bodyJSON(r, &req); err != nil {
 		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
@@ -365,36 +457,73 @@ func (s *Server) handleChatEdit(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	var (
-		msg *models.ChatMessage
-		err error
-	)
-	if req.Attachment != nil {
-		att := req.Attachment
-		att.Type = strings.ToLower(strings.TrimSpace(att.Type))
-		if att.Type != "image" && att.Type != "video" && att.Type != "audio" {
-			writeErr(w, http.StatusBadRequest, "فقط عکس، ویدیو یا صدا را می‌توان جایگزین کرد")
-			return
-		}
-		key := mediaKeyFromURL(att.URL)
-		if key == "" || !mediaKeyOwnedByUser(key, u.ID) {
-			writeErr(w, http.StatusBadRequest, "پیوست متعلق به شما نیست")
-			return
-		}
-		if q := strings.Index(att.URL, "?"); q >= 0 {
-			att.URL = att.URL[:q]
-		}
-		if att.Name == "" {
-			att.Name = "file"
-		}
-		msg, err = s.store.ReplaceChatAttachment(r.Context(), u.ID, partner, msgID, u.Role, req.Body, att.Type, att.URL, att.Name, att.Size)
-	} else {
-		if req.Body == "" {
-			writeErr(w, http.StatusBadRequest, "پیام باید بین ۱ تا ۴۰۰۰ نویسه باشد")
-			return
-		}
-		msg, err = s.store.EditChatMessage(r.Context(), u.ID, partner, msgID, u.Role, req.Body)
+	current, err := s.store.GetOwnChatMessage(r.Context(), u.ID, partner, msgID, u.Role)
+	if errors.Is(err, store.ErrNotFound) {
+		writeErr(w, http.StatusNotFound, "پیام پیدا نشد")
+		return
 	}
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ویرایش پیام ممکن نشد")
+		return
+	}
+
+	existing := storedAttachments(current)
+	drop := map[int]struct{}{}
+	for _, index := range req.RemoveIndexes {
+		if index < 0 || index >= len(existing) {
+			writeErr(w, http.StatusBadRequest, "پیوست انتخاب‌شده پیدا نشد")
+			return
+		}
+		drop[index] = struct{}{}
+	}
+	for _, rep := range req.Replacements {
+		if _, removed := drop[rep.Index]; removed {
+			continue
+		}
+		if rep.Index < 0 || rep.Index >= len(existing) {
+			writeErr(w, http.StatusBadRequest, "پیوست انتخاب‌شده پیدا نشد")
+			return
+		}
+		prepared, attErr := prepareChatAttachments(u.ID, &rep.Attachment, nil)
+		if attErr != "" {
+			writeErr(w, http.StatusBadRequest, attErr)
+			return
+		}
+		if prepared[0].Type != existing[rep.Index].Type {
+			writeErr(w, http.StatusBadRequest, "فایل جدید باید از همان نوع باشد")
+			return
+		}
+		existing[rep.Index] = prepared[0]
+	}
+
+	toAdd := req.AddAttachments
+	if req.Attachment != nil {
+		toAdd = append(toAdd, *req.Attachment)
+	}
+	added, attErr := prepareChatAttachments(u.ID, nil, toAdd)
+	if attErr != "" {
+		writeErr(w, http.StatusBadRequest, attErr)
+		return
+	}
+
+	final := make([]models.Attachment, 0, len(existing)+len(added))
+	for i, att := range existing {
+		if _, removed := drop[i]; removed {
+			continue
+		}
+		final = append(final, att)
+	}
+	final = append(final, added...)
+	if len(final) > maxChatAttachments {
+		writeErr(w, http.StatusBadRequest, "در هر پیام حداکثر ۱۰ پیوست می‌توان فرستاد")
+		return
+	}
+	if req.Body == "" && len(final) == 0 {
+		writeErr(w, http.StatusBadRequest, "پیام باید متن یا پیوست داشته باشد")
+		return
+	}
+
+	msg, err := s.store.SaveEditedChatMessage(r.Context(), u.ID, partner, msgID, u.Role, req.Body, final)
 	if errors.Is(err, store.ErrNotFound) {
 		writeErr(w, http.StatusNotFound, "پیام پیدا نشد")
 		return
@@ -566,9 +695,12 @@ func (s *Server) markIncomingChatRead(ctx context.Context, reader *models.User,
 }
 
 func (s *Server) canChatWith(ctx context.Context, actor *models.User, partnerID int64) bool {
-	if actor == nil || partnerID <= 0 || actor.ID == partnerID {
+	if actor == nil || partnerID <= 0 {
 		return false
 	}
+	if actor.ID == partnerID {
+		return true
+	}
 	partner, err := s.store.GetUserByID(ctx, partnerID)
 	if err != nil || !partner.IsActive {
 		return false
@@ -586,10 +718,75 @@ func (s *Server) resignChatMessages(msgs []models.ChatMessage) {
 }
 
 func (s *Server) resignChatMessage(msg *models.ChatMessage) {
-	if msg == nil || msg.Attachment == nil || msg.Attachment.URL == "" {
+	if msg == nil {
 		return
 	}
-	msg.Attachment.URL = s.signExistingMediaURL(msg.Attachment.URL)
+	for i := range msg.Attachments {
+		if msg.Attachments[i].URL != "" {
+			msg.Attachments[i].URL = s.signExistingMediaURL(msg.Attachments[i].URL)
+		}
+	}
+	if len(msg.Attachments) > 0 {
+		first := msg.Attachments[0]
+		msg.Attachment = &first
+		return
+	}
+	if msg.Attachment != nil && msg.Attachment.URL != "" {
+		msg.Attachment.URL = s.signExistingMediaURL(msg.Attachment.URL)
+	}
+}
+
+func storedAttachments(m *models.ChatMessage) []models.Attachment {
+	if m == nil {
+		return nil
+	}
+	if len(m.Attachments) > 0 {
+		out := make([]models.Attachment, len(m.Attachments))
+		copy(out, m.Attachments)
+		return out
+	}
+	if m.Attachment != nil && m.Attachment.URL != "" {
+		return []models.Attachment{*m.Attachment}
+	}
+	return nil
+}
+
+const maxChatAttachments = 10
+
+func prepareChatAttachments(ownerID int64, single *models.Attachment, many []models.Attachment) ([]models.Attachment, string) {
+	atts := many
+	if len(atts) == 0 && single != nil {
+		atts = []models.Attachment{*single}
+	}
+	if len(atts) > maxChatAttachments {
+		return nil, "در هر پیام حداکثر ۱۰ پیوست می‌توان فرستاد"
+	}
+	out := make([]models.Attachment, 0, len(atts))
+	for i := range atts {
+		att := atts[i]
+		if att.Size > maxUploadSize {
+			return nil, "حجم پیوست بیش از حد مجاز است"
+		}
+		att.Type = strings.ToLower(strings.TrimSpace(att.Type))
+		if att.Type != "image" && att.Type != "video" && att.Type != "audio" && att.Type != "file" {
+			return nil, "نوع پیوست پشتیبانی نمی‌شود"
+		}
+		if att.URL == "" || !strings.Contains(att.URL, "/media/") {
+			return nil, "نشانی پیوست نامعتبر است"
+		}
+		key := mediaKeyFromURL(att.URL)
+		if !mediaKeyOwnedByUser(key, ownerID) {
+			return nil, "پیوست متعلق به شما نیست"
+		}
+		if q := strings.Index(att.URL, "?"); q >= 0 {
+			att.URL = att.URL[:q]
+		}
+		if strings.TrimSpace(att.Name) == "" {
+			att.Name = "file"
+		}
+		out = append(out, att)
+	}
+	return out, ""
 }
 
 func itoa(v int64) string {

backend/internal/api/chat_export.go

@@ -13,6 +13,7 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"pargar/backend/internal/models"
@@ -49,16 +50,17 @@ type chatExportAttachment struct {
 }
 
 type chatExportMessage struct {
-	ID         int64                 `json:"id,omitempty"`
-	Body       string                `json:"body"`
-	SenderRole string                `json:"senderRole"`
-	CreatedAt  time.Time             `json:"createdAt"`
-	ReadAt     *time.Time            `json:"readAt,omitempty"`
-	ReplyTo    *int64                `json:"replyTo,omitempty"`
-	Pinned     bool                  `json:"pinned"`
-	PinnedAt   *time.Time            `json:"pinnedAt,omitempty"`
-	EditedAt   *time.Time            `json:"editedAt,omitempty"`
-	Attachment *chatExportAttachment `json:"attachment,omitempty"`
+	ID          int64                  `json:"id,omitempty"`
+	Body        string                 `json:"body"`
+	SenderRole  string                 `json:"senderRole"`
+	CreatedAt   time.Time              `json:"createdAt"`
+	ReadAt      *time.Time             `json:"readAt,omitempty"`
+	ReplyTo     *int64                 `json:"replyTo,omitempty"`
+	Pinned      bool                   `json:"pinned"`
+	PinnedAt    *time.Time             `json:"pinnedAt,omitempty"`
+	EditedAt    *time.Time             `json:"editedAt,omitempty"`
+	Attachment  *chatExportAttachment  `json:"attachment,omitempty"`
+	Attachments []chatExportAttachment `json:"attachments,omitempty"`
 }
 
 type chatExportConversation struct {
@@ -186,20 +188,25 @@ func (s *Server) buildProjectChatExport(r *http.Request) (*chatExportPayload, []
 					PinnedAt:   m.PinnedAt,
 					EditedAt:   m.EditedAt,
 				}
-				if m.Attachment != nil {
-					att := &chatExportAttachment{
-						Type: m.Attachment.Type,
-						Name: m.Attachment.Name,
-						Size: m.Attachment.Size,
-					}
-					key := mediaKeyFromURL(m.Attachment.URL)
+				list := m.Attachments
+				if len(list) == 0 && m.Attachment != nil {
+					list = []models.Attachment{*m.Attachment}
+				}
+				exported := make([]chatExportAttachment, 0, len(list))
+				for i, src := range list {
+					att := chatExportAttachment{Type: src.Type, Name: src.Name, Size: src.Size}
+					key := mediaKeyFromURL(src.URL)
 					if key == "" {
 						att.Missing = true
 					} else {
+						label := safeExportFilename(src.Name)
+						if len(list) > 1 {
+							label = fmt.Sprintf("%d-%s", i+1, label)
+						}
 						rel := filepath.ToSlash(filepath.Join(
 							"attachments",
 							convKey,
-							fmt.Sprintf("%d-%s", m.ID, safeExportFilename(m.Attachment.Name)),
+							fmt.Sprintf("%d-%s", m.ID, label),
 						))
 						rc, _, _, err := s.storage.Open(key)
 						if err != nil {
@@ -210,7 +217,14 @@ func (s *Server) buildProjectChatExport(r *http.Request) (*chatExportPayload, []
 							files = append(files, zipAttachmentFile{Path: rel, Key: key})
 						}
 					}
-					item.Attachment = att
+					exported = append(exported, att)
+				}
+				if len(exported) > 0 {
+					first := exported[0]
+					item.Attachment = &first
+					if len(exported) > 1 {
+						item.Attachments = exported
+					}
 				}
 				batch = append(batch, item)
 			}
@@ -373,11 +387,17 @@ func (s *Server) handleAdminChatExportRestore(w http.ResponseWriter, r *http.Req
 			if created.IsZero() {
 				created = time.Now().UTC()
 			}
-			var att *models.Attachment
-			if m.Attachment != nil {
-				att = s.materializeRestoredAttachment(studentID, m.Attachment, zipFiles)
+			srcs := m.Attachments
+			if len(srcs) == 0 && m.Attachment != nil {
+				srcs = []chatExportAttachment{*m.Attachment}
 			}
-			if _, err := s.store.ImportChatMessage(r.Context(), studentID, mentorID, role, m.Body, att, created, m.Pinned); err != nil {
+			atts := make([]models.Attachment, 0, len(srcs))
+			for i := range srcs {
+				if got := s.materializeRestoredAttachment(studentID, &srcs[i], zipFiles); got != nil {
+					atts = append(atts, *got)
+				}
+			}
+			if _, err := s.store.ImportChatMessage(r.Context(), studentID, mentorID, role, m.Body, atts, created, m.Pinned); err != nil {
 				continue
 			}
 			imported++
@@ -459,6 +479,8 @@ type bytesFile struct {
 
 func (b bytesFile) Close() error { return nil }
 
+var restoreMediaSeq atomic.Uint64
+
 func (s *Server) materializeRestoredAttachment(ownerID int64, src *chatExportAttachment, zipFiles map[string][]byte) *models.Attachment {
 	if src == nil {
 		return nil
@@ -476,7 +498,7 @@ func (s *Server) materializeRestoredAttachment(ownerID int64, src *chatExportAtt
 	if src.Path != "" && zipFiles != nil {
 		path := filepath.ToSlash(src.Path)
 		if raw, ok := zipFiles[path]; ok && len(raw) > 0 {
-			key := fmt.Sprintf("chats/%d-%d%s", ownerID, time.Now().UnixNano(), filepath.Ext(name))
+			key := fmt.Sprintf("chats/%d-%d-%d%s", ownerID, time.Now().UnixNano(), restoreMediaSeq.Add(1), filepath.Ext(name))
 			url, err := s.storage.Save(key, bytesFile{Reader: bytes.NewReader(raw)}, int64(len(raw)))
 			if err == nil {
 				return &models.Attachment{

backend/internal/api/community.go

@@ -1,65 +1,13 @@
 package api
 
 import (
-	"context"
 	"net/http"
-	"strings"
-
-	"pargar/backend/internal/models"
 )
 
 func (s *Server) handleCommunity(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-
-	donationEnabled := s.cfg.DonationEnabled
-	if v, err := s.store.GetSetting(ctx, "donation_enabled"); err == nil {
-		donationEnabled = v == "true" || v == "1"
-	}
-	note := s.cfg.DonationNote
-	if v, err := s.store.GetSetting(ctx, "donation_note"); err == nil && strings.TrimSpace(v) != "" {
-		note = strings.TrimSpace(v)
-	}
-	if strings.TrimSpace(note) == "" {
-		note = "اگر مایلید از مسیر حمایت کنید، وارد شوید و در گفتگو با تیم هماهنگ کنید — جزئیات فقط خصوصی رد و بدل می‌شود."
-	}
-
-	var contactID any
-	if u, err := s.Authenticate(r); err == nil && u != nil {
-		if id := s.donationContactID(ctx, u); id > 0 {
-			contactID = id
-		}
-	}
-
 	writeJSON(w, http.StatusOK, map[string]any{
-		"donation": map[string]any{
-			"enabled":   donationEnabled,
-			"note":      note,
-			"mode":      "chat",
-			"contactId": contactID,
-			"draft":     "سلام؛ دربارهٔ حمایت مالی / دونیت هماهنگ کنیم.",
-		},
+		"socials":      s.loadSocials(ctx),
+		"contributors": s.loadContributors(ctx),
 	})
 }
-
-func (s *Server) donationContactID(ctx context.Context, actor *models.User) int64 {
-	staff, err := s.store.ListMentors(ctx)
-	if err != nil {
-		return 0
-	}
-	var adminID, mentorID int64
-	for _, m := range staff {
-		if m.ID == actor.ID {
-			continue
-		}
-		if m.Role == models.RoleAdmin && adminID == 0 {
-			adminID = m.ID
-		}
-		if m.Role == models.RoleMentor && mentorID == 0 {
-			mentorID = m.ID
-		}
-	}
-	if adminID != 0 {
-		return adminID
-	}
-	return mentorID
-}

backend/internal/api/community_test.go

@@ -11,18 +11,15 @@ func TestCommunityEndpointPublic(t *testing.T) {
 	if code != http.StatusOK {
 		t.Fatalf("community: %d %v", code, body)
 	}
-	don, ok := body["donation"].(map[string]any)
+	socials, ok := body["socials"].([]any)
 	if !ok {
-		t.Fatalf("missing donation: %v", body)
+		t.Fatalf("missing socials: %v", body)
 	}
-	if _, ok := don["enabled"]; !ok {
-		t.Fatalf("missing donation.enabled: %v", don)
+	if socials == nil {
+		t.Fatal("socials must be a list")
 	}
-	if don["mode"] != "chat" {
-		t.Fatalf("donation.mode want chat, got %v", don["mode"])
-	}
-	if _, hasCard := don["cardNumber"]; hasCard {
-		t.Fatal("public card number must not be exposed")
+	if _, hasDonation := body["donation"]; hasDonation {
+		t.Fatal("donation must not be exposed")
 	}
 	// Telegram channel surface was removed from the product.
 	if _, hasChannel := body["channel"]; hasChannel {

backend/internal/api/flow_test.go

@@ -3,6 +3,7 @@ package api_test
 import (
 	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 )
 
@@ -189,26 +190,39 @@ func TestQuizFailLocksAccountAndMentorUnlocks(t *testing.T) {
 	token, uid := register(t, e, "Struggle", "struggle@test.dev")
 
 	watchToUnlock(t, e, token, 1)
+	adminEarly := login(t, e, bootstrapAdminEmail)
+	code, _ := e.do(t, "PUT", "/api/admin/users/"+itoa(uid), adminEarly, map[string]any{"hearts": 3})
+	if code != http.StatusOK {
+		t.Fatalf("set hearts: %d", code)
+	}
 
-	// all-wrong answers burn 3 hearts -> account locked
-	code, result := e.do(t, "POST", "/api/lessons/1/quiz/submit", token, map[string]any{"answers": []int{0, 0, 0}})
+	// all-wrong answers spend the starting hearts. Zero does not lock by default.
+	var result map[string]any
+	code, result = e.do(t, "POST", "/api/lessons/1/quiz/submit", token, map[string]any{"answers": []int{0, 0, 0}})
 	if code != http.StatusOK {
 		t.Fatalf("submit: %d", code)
 	}
 	if result["heartsLeft"].(float64) != 0 {
 		t.Fatalf("expected 0 hearts")
 	}
-	if result["locked"] != true {
-		t.Fatalf("expected locked")
+	if result["locked"] == true {
+		t.Fatalf("empty hearts must not lock by default")
 	}
 
-	// locked users can no longer send heartbeats (423)
 	code, _ = e.do(t, "POST", "/api/lessons/1/heartbeat", token, map[string]any{"position": 45, "delta": 1, "seq": 9})
-	if code != http.StatusLocked {
-		t.Fatalf("expected 423 while locked, got %d", code)
+	if code == http.StatusLocked {
+		t.Fatalf("heartbeat should stay open while waiting for a heart")
+	}
+	code, _ = e.do(t, "POST", "/api/lessons/1/quiz/submit", token, map[string]any{"answers": []int{0, 0, 0}})
+	if code != http.StatusForbidden {
+		t.Fatalf("expected quiz blocked at 0 hearts, got %d", code)
 	}
 
-	// locked users may request staff review (does not unlock); only staff unlocks
+	// A manual lock still accepts a review request. Empty hearts alone do not.
+	code, _ = e.do(t, "POST", "/api/admin/users/"+itoa(uid)+"/lock", adminEarly, nil)
+	if code != http.StatusOK {
+		t.Fatalf("manual lock: %d", code)
+	}
 	code, body := e.do(t, "POST", "/api/me/request-unlock", token, map[string]any{"note": "لطفاً بررسی کنید"})
 	if code != http.StatusCreated && code != http.StatusOK {
 		t.Fatalf("unlock request: %d %v", code, body)
@@ -248,8 +262,8 @@ func TestQuizFailLocksAccountAndMentorUnlocks(t *testing.T) {
 	if code != http.StatusOK || u["isLocked"] != false {
 		t.Fatalf("user should be unlocked: %v", u["isLocked"])
 	}
-	if u["hearts"].(float64) != 3 {
-		t.Fatalf("hearts should be restored to 3, got %v", u["hearts"])
+	if u["hearts"].(float64) != 5 {
+		t.Fatalf("hearts should be restored to 5, got %v", u["hearts"])
 	}
 }
 
@@ -264,12 +278,12 @@ func TestAdminHeartOverflowLocksAndCapsAccount(t *testing.T) {
 	}
 	uid := int64(body["items"].([]any)[0].(map[string]any)["id"].(float64))
 
-	code, body = e.do(t, "PUT", "/api/admin/users/"+itoa(uid), admin, map[string]any{"hearts": 4})
+	code, body = e.do(t, "PUT", "/api/admin/users/"+itoa(uid), admin, map[string]any{"hearts": 9})
 	if code != http.StatusOK {
 		t.Fatalf("update user: %d", code)
 	}
 	user := body["user"].(map[string]any)
-	if user["hearts"].(float64) != 3 || user["isLocked"] != true {
+	if user["hearts"].(float64) != 5 || user["isLocked"] != true {
 		t.Fatalf("overflow must cap hearts and lock account: %v", user)
 	}
 
@@ -278,7 +292,7 @@ func TestAdminHeartOverflowLocksAndCapsAccount(t *testing.T) {
 		t.Fatalf("me: %d", code)
 	}
 	user = body["user"].(map[string]any)
-	if user["hearts"].(float64) != 3 || user["isLocked"] != true {
+	if user["hearts"].(float64) != 5 || user["isLocked"] != true {
 		t.Fatalf("persisted overflow guard failed: %v", user)
 	}
 }
@@ -382,11 +396,13 @@ func TestChatRecipientPermissions(t *testing.T) {
 	}
 	mentorID := int64(body["user"].(map[string]any)["id"].(float64))
 
-	for _, target := range []int64{studentID, otherStudentID} {
-		code, _ = e.do(t, "POST", "/api/chats/"+itoa(target)+"/messages", studentToken, map[string]any{"body": "not allowed"})
-		if code != http.StatusForbidden {
-			t.Fatalf("student→student must be forbidden, got %d", code)
-		}
+	code, _ = e.do(t, "POST", "/api/chats/"+itoa(studentID)+"/messages", studentToken, map[string]any{"body": "saved"})
+	if code != http.StatusCreated {
+		t.Fatalf("saved messages: %d", code)
+	}
+	code, _ = e.do(t, "POST", "/api/chats/"+itoa(otherStudentID)+"/messages", studentToken, map[string]any{"body": "not allowed"})
+	if code != http.StatusForbidden {
+		t.Fatalf("student→student must be forbidden, got %d", code)
 	}
 	code, _ = e.do(t, "POST", "/api/chats/"+itoa(mentorID)+"/messages", studentToken, map[string]any{"body": "ok"})
 	if code != http.StatusCreated {
@@ -566,17 +582,16 @@ func TestAdminSettingsAndSponsors(t *testing.T) {
 
 	code, body := e.do(t, "PUT", "/api/admin/settings", admin, map[string]any{
 		"settings": map[string]any{
-			"donation_enabled": "true",
-			"donation_note":    "یادداشت تست",
-			"sponsors":         `[{"name":"حامی یک","url":"https://example.com","blurb":"حمایت"}]`,
+			"social_links": `[{"name":"تلگرام","url":"https://t.me/pargar"}]`,
+			"sponsors":     `[{"name":"حامی یک","url":"https://example.com","blurb":"حمایت"}]`,
 		},
 	})
 	if code != http.StatusOK {
 		t.Fatalf("put settings: %d %v", code, body)
 	}
 	settings := body["settings"].(map[string]any)
-	if settings["donation_note"] != "یادداشت تست" {
-		t.Fatalf("donation note not saved: %v", settings["donation_note"])
+	if !strings.Contains(settings["social_links"].(string), "تلگرام") {
+		t.Fatalf("social links not saved: %v", settings["social_links"])
 	}
 
 	code, body = e.do(t, "GET", "/api/sponsors", "", nil)
@@ -595,8 +610,8 @@ func TestAdminSettingsAndSponsors(t *testing.T) {
 	if _, ok := body["channel"]; ok {
 		t.Fatalf("community must not expose telegram channel: %v", body["channel"])
 	}
-	donation := body["donation"].(map[string]any)
-	if donation["note"] != "یادداشت تست" {
-		t.Fatalf("community donation note: %v", donation["note"])
+	socials, _ := body["socials"].([]any)
+	if len(socials) != 1 || socials[0].(map[string]any)["name"] != "تلگرام" {
+		t.Fatalf("community socials: %v", body["socials"])
 	}
 }

backend/internal/api/leaderboard.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	"net/http"
+	"sort"
 	"strconv"
 	"time"
 
@@ -15,21 +16,40 @@ type lbEntry struct {
 	Email         string  `json:"email"`
 	XP            float64 `json:"xp"`
 	Rank          int     `json:"rank"`
+	Tier          string  `json:"tier"`
 	AvatarVariant string  `json:"avatarVariant"`
 	AvatarPalette string  `json:"avatarPalette"`
 	AvatarPhoto   string  `json:"avatarPhoto,omitempty"`
 }
 
+// tierFromRank assigns a league tier based on rank relative to total participants.
+// Thresholds: rank 1 = champion, top 10% = gold, top 30% = silver, rest = bronze.
+func tierFromRank(rank, total int) string {
+	if rank <= 0 || total <= 0 {
+		return "bronze"
+	}
+	if rank == 1 {
+		return "champion"
+	}
+	if rank*10 <= total {
+		return "gold"
+	}
+	if rank*10 <= total*3 {
+		return "silver"
+	}
+	return "bronze"
+}
+
 func (s *Server) handleWeeklyLeaderboard(w http.ResponseWriter, r *http.Request) {
 	u := currentUser(r)
 	key := "lb:" + service.ISOWeek(time.Now())
 
-	entries := make([]lbEntry, 0, 20)
 	type scored struct {
 		userID int64
 		xp     float64
 	}
 	var scoredList []scored
+	var totalParticipants int64
 
 	if s.redis != nil {
 		z, err := s.redis.ZRevRangeWithScores(context.Background(), key, 0, 19).Result()
@@ -39,12 +59,16 @@ func (s *Server) handleWeeklyLeaderboard(w http.ResponseWriter, r *http.Request)
 				scoredList = append(scoredList, scored{userID: id, xp: member.Score})
 			}
 		}
+		if count, err := s.redis.ZCard(context.Background(), key).Result(); err == nil {
+			totalParticipants = count
+		}
 	}
 
-	// fallback to DB if redis empty (e.g. dev bootstrap)
+	// Fallback to DB if Redis is empty (e.g. dev bootstrap).
 	if len(scoredList) == 0 {
-		rows, err := s.store.Pool().Query(context.Background(), `
-			SELECT user_id, xp FROM weekly_leaderboard WHERE week=$1 ORDER BY xp DESC LIMIT 20`,
+		rows, err := s.store.Pool().Query(context.Background(),
+			`SELECT user_id, xp FROM weekly_leaderboard WHERE week=$1
+			 ORDER BY xp DESC, user_id ASC LIMIT 20`,
 			service.ISOWeek(time.Now()))
 		if err == nil {
 			for rows.Next() {
@@ -56,30 +80,56 @@ func (s *Server) handleWeeklyLeaderboard(w http.ResponseWriter, r *http.Request)
 			}
 			rows.Close()
 		}
+		if err := s.store.Pool().QueryRow(context.Background(),
+			`SELECT COUNT(*) FROM weekly_leaderboard WHERE week=$1`,
+			service.ISOWeek(time.Now())).Scan(&totalParticipants); err != nil {
+			totalParticipants = int64(len(scoredList))
+		}
 	}
 
+	// Deterministic tie-breaking: XP descending, then user_id ascending.
+	sort.SliceStable(scoredList, func(i, j int) bool {
+		if scoredList[i].xp != scoredList[j].xp {
+			return scoredList[i].xp > scoredList[j].xp
+		}
+		return scoredList[i].userID < scoredList[j].userID
+	})
+
+	ids := make([]int64, len(scoredList))
 	for i, sc := range scoredList {
-		usr, err := s.store.GetUserByID(context.Background(), sc.userID)
-		if err != nil {
+		ids[i] = sc.userID
+	}
+	usersMap, _ := s.store.GetUsersByIDs(context.Background(), ids)
+
+	entries := make([]lbEntry, 0, len(scoredList))
+	for i, sc := range scoredList {
+		usr, ok := usersMap[sc.userID]
+		if !ok {
 			continue
 		}
 		s.signUserMedia(usr)
+		rank := i + 1
 		entries = append(entries, lbEntry{
-			UserID: sc.userID, Name: usr.Name, Email: usr.Email, XP: sc.xp, Rank: i + 1,
-			AvatarVariant: usr.AvatarVariant, AvatarPalette: usr.AvatarPalette, AvatarPhoto: usr.AvatarPhoto,
+			UserID:        sc.userID,
+			Name:          usr.Name,
+			Email:         usr.Email,
+			XP:            sc.xp,
+			Rank:          rank,
+			Tier:          tierFromRank(rank, int(totalParticipants)),
+			AvatarVariant: usr.AvatarVariant,
+			AvatarPalette: usr.AvatarPalette,
+			AvatarPhoto:   usr.AvatarPhoto,
 		})
 	}
 
-	// my position
+	// Current user's position (may be outside top 20).
 	myRank := -1
 	var myXP float64
 	if s.redis != nil {
-		rank, err := s.redis.ZRevRank(context.Background(), key, strconv.FormatInt(u.ID, 10)).Result()
-		if err == nil {
+		if rank, err := s.redis.ZRevRank(context.Background(), key, strconv.FormatInt(u.ID, 10)).Result(); err == nil {
 			myRank = int(rank) + 1
 		}
-		score, err := s.redis.ZScore(context.Background(), key, strconv.FormatInt(u.ID, 10)).Result()
-		if err == nil {
+		if score, err := s.redis.ZScore(context.Background(), key, strconv.FormatInt(u.ID, 10)).Result(); err == nil {
 			myXP = score
 		}
 	}
@@ -88,8 +138,14 @@ func (s *Server) handleWeeklyLeaderboard(w http.ResponseWriter, r *http.Request)
 		entries = []lbEntry{}
 	}
 	writeJSON(w, http.StatusOK, map[string]any{
-		"week":    service.ISOWeek(time.Now()),
-		"entries": entries,
-		"me":      map[string]any{"rank": myRank, "xp": myXP, "streak": u.StreakCurrent},
+		"week":              service.ISOWeek(time.Now()),
+		"entries":           entries,
+		"totalParticipants": totalParticipants,
+		"me": map[string]any{
+			"rank":   myRank,
+			"xp":     myXP,
+			"streak": u.StreakCurrent,
+			"tier":   tierFromRank(myRank, int(totalParticipants)),
+		},
 	})
 }

backend/internal/api/leaderboard_test.go

@@ -0,0 +1,31 @@
+package api
+
+import "testing"
+
+func TestTierFromRank(t *testing.T) {
+	cases := []struct {
+		rank, total int
+		want        string
+	}{
+		{1, 1, "champion"},
+		{1, 100, "champion"},
+		{1, 0, "bronze"},    // zero total → bronze (guard)
+		{0, 100, "bronze"},  // zero rank → bronze (guard)
+		{10, 100, "gold"},   // exactly 10%
+		{11, 100, "silver"}, // 11%
+		{30, 100, "silver"}, // exactly 30%
+		{31, 100, "bronze"}, // 31%
+		{5, 50, "gold"},     // 10%
+		{15, 50, "silver"},  // exactly 30%
+		{16, 50, "bronze"},  // 32% → bronze
+		{50, 100, "bronze"},
+		{2, 10, "silver"},   // 20% → silver
+		{1, 10, "champion"},
+	}
+	for _, c := range cases {
+		got := tierFromRank(c.rank, c.total)
+		if got != c.want {
+			t.Errorf("tierFromRank(%d, %d) = %q; want %q", c.rank, c.total, got, c.want)
+		}
+	}
+}

backend/internal/api/me_export.go

@@ -0,0 +1,604 @@
+package api
+
+import (
+	"archive/zip"
+	"context"
+	"encoding/json"
+	"fmt"
+	"html"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"pargar/backend/internal/models"
+	"pargar/backend/internal/observability"
+)
+
+const (
+	meExportHTMLBase       int64 = 8 * 1024
+	meExportHTMLPerMessage int64 = 512
+)
+
+func (s *Server) handleMeExport(w http.ResponseWriter, r *http.Request) {
+	u := currentUser(r)
+	if u == nil {
+		writeErr(w, http.StatusUnauthorized, "ابتدا وارد شوید")
+		return
+	}
+	partnerID, ok := meExportChatID(r)
+	if !ok {
+		writeErr(w, http.StatusBadRequest, "گفتگو را مشخص کنید")
+		return
+	}
+	if !s.canChatWith(r.Context(), u, partnerID) {
+		writeErr(w, http.StatusNotFound, "گفتگو پیدا نشد")
+		return
+	}
+	if r.URL.Query().Get("meta") == "1" {
+		n, last, err := s.estimateMeExportBytes(r.Context(), u.ID, partnerID)
+		if err != nil {
+			writeErr(w, http.StatusInternalServerError, "برآورد حجم خروجی ممکن نشد")
+			return
+		}
+		payload := map[string]any{"bytes": n, "chat": partnerID}
+		if last != nil && !last.IsZero() {
+			payload["lastAt"] = last.UTC()
+		}
+		writeJSON(w, http.StatusOK, payload)
+		return
+	}
+	if err := s.writeMeChatHTMLZip(w, r, u, partnerID); err != nil {
+		observability.L().Error("me.export_zip", "error", err, "user_id", u.ID, "chat", partnerID)
+	}
+}
+
+func meExportChatID(r *http.Request) (int64, bool) {
+	raw := strings.TrimSpace(r.URL.Query().Get("chat"))
+	if raw == "" {
+		return 0, false
+	}
+	id, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil || id <= 0 {
+		return 0, false
+	}
+	return id, true
+}
+
+func (s *Server) estimateMeExportBytes(ctx context.Context, userID, partnerID int64) (int64, *time.Time, error) {
+	var messages, media int64
+	var last *time.Time
+	err := s.store.Pool().QueryRow(ctx, `
+		SELECT
+			count(*)::bigint,
+			COALESCE(SUM(
+				CASE
+					WHEN attachments IS NOT NULL
+						AND jsonb_typeof(attachments) = 'array'
+						AND jsonb_array_length(attachments) > 0
+					THEN COALESCE((
+						SELECT SUM(GREATEST(COALESCE((elem->>'size')::bigint, 0), 0))
+						FROM jsonb_array_elements(attachments) AS elem
+					), 0)
+					ELSE GREATEST(COALESCE(attachment_size, 0), 0)
+				END
+			), 0)::bigint,
+			MAX(created_at)
+		FROM chat_messages
+		WHERE (user_id = $1 AND mentor_id = $2) OR (user_id = $2 AND mentor_id = $1)`, userID, partnerID).Scan(&messages, &media, &last)
+	if err != nil {
+		return 0, nil, err
+	}
+	return media + meExportHTMLBase + messages*meExportHTMLPerMessage, last, nil
+}
+
+type meExportMessage struct {
+	ID          int64
+	UserID      int64
+	MentorID    int64
+	SenderRole  string
+	Body        string
+	CreatedAt   time.Time
+	StudentName string
+	MentorName  string
+	Atts        []models.Attachment
+}
+
+type meExportFile struct {
+	Path string
+	Key  string
+}
+
+type mePlaced struct {
+	msg meExportMessage
+	rel []string
+}
+
+func (s *Server) writeMeChatHTMLZip(w http.ResponseWriter, r *http.Request, u *models.User, partnerID int64) error {
+	title := "پیام‌های ذخیره‌شده"
+	if partnerID != u.ID {
+		partner, err := s.store.GetUserByID(r.Context(), partnerID)
+		if err != nil {
+			writeErr(w, http.StatusNotFound, "گفتگو پیدا نشد")
+			return err
+		}
+		title = strings.TrimSpace(partner.Name)
+		if title == "" {
+			title = "گفتگو"
+		}
+	}
+	rows, err := s.store.Pool().Query(r.Context(), `
+		SELECT m.id, m.user_id, m.mentor_id, m.sender_role, m.body, m.created_at,
+			m.attachment_type, m.attachment_url, m.attachment_name, m.attachment_size, m.attachments,
+			COALESCE(su.name, ''), COALESCE(mu.name, '')
+		FROM chat_messages m
+		LEFT JOIN users su ON su.id = m.user_id
+		LEFT JOIN users mu ON mu.id = m.mentor_id
+		WHERE (m.user_id = $1 AND m.mentor_id = $2) OR (m.user_id = $2 AND m.mentor_id = $1)
+		ORDER BY m.created_at ASC, m.id ASC`, u.ID, partnerID)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+	defer rows.Close()
+
+	var messages []meExportMessage
+	for rows.Next() {
+		var m meExportMessage
+		var attType, attURL, attName *string
+		var attSize *int64
+		var rawAtts []byte
+		if err := rows.Scan(
+			&m.ID, &m.UserID, &m.MentorID, &m.SenderRole, &m.Body, &m.CreatedAt,
+			&attType, &attURL, &attName, &attSize, &rawAtts,
+			&m.StudentName, &m.MentorName,
+		); err != nil {
+			continue
+		}
+		m.Atts = decodeExportAttachments(rawAtts, attType, attURL, attName, attSize)
+		messages = append(messages, m)
+	}
+	if err := rows.Err(); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+
+	placed := make([]mePlaced, 0, len(messages))
+	var files []meExportFile
+	seen := map[string]bool{}
+	for _, m := range messages {
+		item := mePlaced{msg: m, rel: make([]string, len(m.Atts))}
+		for i, att := range m.Atts {
+			key := mediaKeyFromURL(att.URL)
+			if key == "" || strings.Contains(key, "..") || !exportKeyAllowed(key, u.ID, m.UserID, m.MentorID) || !s.storage.Exists(key) {
+				continue
+			}
+			label := safeExportFilename(att.Name)
+			rel := filepath.ToSlash(filepath.Join("media", fmt.Sprintf("%d-%d-%s", m.ID, i+1, label)))
+			if seen[rel] {
+				rel = filepath.ToSlash(filepath.Join("media", fmt.Sprintf("%d-%d-b-%s", m.ID, i+1, label)))
+			}
+			seen[rel] = true
+			item.rel[i] = rel
+			files = append(files, meExportFile{Path: rel, Key: key})
+		}
+		placed = append(placed, item)
+	}
+
+	doc := renderMeExportHTML(u, title, placed)
+	tmp, err := os.CreateTemp("", "pargar-chats-*.zip")
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+	tmpName := tmp.Name()
+	defer func() {
+		_ = tmp.Close()
+		_ = os.Remove(tmpName)
+	}()
+
+	zw := zip.NewWriter(tmp)
+	hw, err := zw.CreateHeader(&zip.FileHeader{
+		Name:     "index.html",
+		Method:   zip.Deflate,
+		Modified: time.Now().UTC(),
+	})
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+	if _, err := io.WriteString(hw, doc); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+	for _, f := range files {
+		rc, _, _, err := s.storage.Open(f.Key)
+		if err != nil {
+			continue
+		}
+		aw, err := zw.CreateHeader(&zip.FileHeader{
+			Name:     f.Path,
+			Method:   zip.Deflate,
+			Modified: time.Now().UTC(),
+		})
+		if err != nil {
+			_ = rc.Close()
+			writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+			return err
+		}
+		_, copyErr := io.Copy(aw, rc)
+		_ = rc.Close()
+		if copyErr != nil {
+			writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+			return copyErr
+		}
+	}
+	if err := zw.Close(); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+	if _, err := tmp.Seek(0, io.SeekStart); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+	info, err := tmp.Stat()
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت خروجی گفتگوها ممکن نشد")
+		return err
+	}
+	w.Header().Set("Content-Type", "application/zip")
+	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="pargar-chat-%d.zip"`, partnerID))
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("Cache-Control", "private, no-store")
+	w.Header().Set("Content-Length", strconv.FormatInt(info.Size(), 10))
+	w.WriteHeader(http.StatusOK)
+	_, err = io.Copy(w, tmp)
+	return err
+}
+
+func exportKeyAllowed(key string, me, studentID, mentorID int64) bool {
+	return mediaKeyOwnedByUser(key, me) || mediaKeyOwnedByUser(key, studentID) || mediaKeyOwnedByUser(key, mentorID)
+}
+
+func decodeExportAttachments(raw []byte, attType, attURL, attName *string, attSize *int64) []models.Attachment {
+	if len(raw) > 0 && string(raw) != "null" && string(raw) != "[]" {
+		var list []models.Attachment
+		if err := json.Unmarshal(raw, &list); err == nil && len(list) > 0 {
+			return list
+		}
+	}
+	if attURL != nil && *attURL != "" {
+		size := int64(0)
+		if attSize != nil {
+			size = *attSize
+		}
+		typ, name := "", ""
+		if attType != nil {
+			typ = *attType
+		}
+		if attName != nil {
+			name = *attName
+		}
+		return []models.Attachment{{Type: typ, URL: *attURL, Name: name, Size: size}}
+	}
+	return nil
+}
+
+func renderMeExportHTML(owner *models.User, title string, messages []mePlaced) string {
+	var b strings.Builder
+	b.WriteString(`<!doctype html>
+<html lang="fa" dir="rtl">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>`)
+	b.WriteString(html.EscapeString(title))
+	b.WriteString(`</title>
+<style>
+  :root { color-scheme: light; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    background: #eceef8;
+    color: #2a2745;
+    font-family: Vazirmatn, "IRANSans", Tahoma, sans-serif;
+  }
+  .sheet {
+    max-width: 440px;
+    margin: 24px auto 40px;
+    overflow: hidden;
+    background: #f7f7fc;
+    border: 1px solid rgba(255,255,255,.75);
+    border-radius: 26px;
+    box-shadow: 0 24px 70px -18px rgba(42,39,69,.35);
+  }
+  header.bar {
+    position: relative;
+    padding: 16px 16px 12px;
+    background: rgba(255,255,255,.78);
+    border-bottom: 1px solid #e3e5f2;
+  }
+  header.bar::before {
+    content: "";
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 3px;
+    background: linear-gradient(to left, #6d63f0, #ec6fa9, #f2a437);
+  }
+  header.bar h1 { margin: 0; font-size: .95rem; font-weight: 800; }
+  header.bar p { margin: 3px 0 0; color: #6b6c8a; font-size: .75rem; }
+  .log { min-height: 240px; padding: 12px 12px 18px; }
+  .day { display: flex; justify-content: center; margin: 10px 0 8px; }
+  .day span {
+    border: 1px solid #d9dbe9;
+    background: rgba(255,255,255,.9);
+    color: #6b6c8a;
+    border-radius: 999px;
+    padding: 3px 10px;
+    font-size: 10px;
+    font-weight: 700;
+  }
+  article.msg { display: flex; margin: 0 0 6px; }
+  article.msg.mine { justify-content: flex-start; }
+  article.msg.theirs { justify-content: flex-end; }
+  .stack { display: flex; flex-direction: column; max-width: min(78%, 20rem); }
+  article.mine .stack { align-items: flex-start; }
+  article.theirs .stack { align-items: flex-end; }
+  .who { margin: 0 6px 3px; font-size: 11px; font-weight: 800; color: #6b6c8a; }
+  .bubble {
+    width: fit-content;
+    max-width: 100%;
+    padding: 8px 14px;
+    font-size: .875rem;
+    line-height: 1.65;
+  }
+  article.mine .bubble {
+    background: #6d63f0;
+    color: #fff;
+    border-radius: 18px 6px 18px 18px;
+    box-shadow: 0 1px 1px rgba(0,0,0,.12);
+  }
+  article.theirs .bubble {
+    background: #fff;
+    color: #2a2745;
+    border: 1px solid #d9dbe9;
+    border-radius: 6px 18px 18px 18px;
+    box-shadow: 0 1px 1px rgba(0,0,0,.06);
+  }
+  .body {
+    margin: 0;
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+    word-break: break-word;
+    unicode-bidi: plaintext;
+  }
+  time { display: block; margin-top: 4px; font-size: 10px; line-height: 1; opacity: .78; }
+  article.mine time { text-align: right; }
+  article.theirs time { text-align: left; }
+  img, video {
+    display: block;
+    max-width: min(100%, 240px);
+    height: auto;
+    border-radius: 12px;
+    margin-top: 6px;
+  }
+  audio { display: block; width: min(100%, 240px); margin-top: 6px; }
+  .file, .missing { margin: 6px 0 0; font-size: .82rem; }
+  article.mine a { color: #fff; }
+  article.theirs a { color: #4c45c6; }
+  .missing { opacity: .85; }
+  .empty { margin: 28px 8px; text-align: center; color: #6b6c8a; font-size: .875rem; }
+</style>
+</head>
+<body>
+<main class="sheet">
+<header class="bar">
+  <h1>`)
+	b.WriteString(html.EscapeString(title))
+	b.WriteString(`</h1>
+  <p>خروجی پرگار · `)
+	b.WriteString(html.EscapeString(formatJalaliStamp(time.Now())))
+	b.WriteString(`</p>
+</header>
+<div class="log">
+`)
+	if len(messages) == 0 {
+		b.WriteString(`<p class="empty">هنوز پیامی در این گفتگو نیست.</p>`)
+	}
+	var hasPrev bool
+	var prevMine bool
+	var prevAt time.Time
+	for _, item := range messages {
+		mine := meExportIsMine(owner.ID, item.msg)
+		if !hasPrev || !sameExportDay(prevAt, item.msg.CreatedAt) {
+			b.WriteString(`<div class="day"><span>`)
+			b.WriteString(html.EscapeString(formatJalaliDay(item.msg.CreatedAt)))
+			b.WriteString(`</span></div>`)
+		}
+		showName := !hasPrev || prevMine != mine || !sameExportDay(prevAt, item.msg.CreatedAt)
+		cls := "theirs"
+		if mine {
+			cls = "mine"
+		}
+		b.WriteString(`<article class="msg ` + cls + `"><div class="stack">`)
+		if showName {
+			b.WriteString(`<p class="who">`)
+			b.WriteString(html.EscapeString(meExportSenderName(owner, item.msg)))
+			b.WriteString(`</p>`)
+		}
+		b.WriteString(`<div class="bubble">`)
+		if strings.TrimSpace(item.msg.Body) != "" {
+			b.WriteString(`<p class="body">` + escapeExportBody(item.msg.Body) + `</p>`)
+		}
+		for i, att := range item.msg.Atts {
+			rel := ""
+			if i < len(item.rel) {
+				rel = item.rel[i]
+			}
+			b.WriteString(renderExportAttachment(att, rel))
+		}
+		b.WriteString(`<time datetime="` + html.EscapeString(item.msg.CreatedAt.UTC().Format(time.RFC3339)) + `">`)
+		b.WriteString(html.EscapeString(formatJalaliStamp(item.msg.CreatedAt)))
+		b.WriteString(`</time></div></div></article>`)
+		hasPrev = true
+		prevMine = mine
+		prevAt = item.msg.CreatedAt
+	}
+	b.WriteString(`</div>
+</main>
+</body>
+</html>
+`)
+	return b.String()
+}
+
+func meExportSenderName(me *models.User, m meExportMessage) string {
+	if meExportIsMine(me.ID, m) {
+		name := strings.TrimSpace(me.Name)
+		if name == "" {
+			return "شما"
+		}
+		return name
+	}
+	name := m.StudentName
+	if me.ID == m.UserID {
+		name = m.MentorName
+	}
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return "گفتگو"
+	}
+	return name
+}
+
+func sameExportDay(a, b time.Time) bool {
+	al := a.In(tehranLocation())
+	bl := b.In(tehranLocation())
+	return al.Year() == bl.Year() && al.Month() == bl.Month() && al.Day() == bl.Day()
+}
+
+func formatJalaliDay(t time.Time) string {
+	if t.IsZero() {
+		return ""
+	}
+	local := t.In(tehranLocation())
+	_, jm, jd := gregorianToJalali(local.Year(), int(local.Month()), local.Day())
+	month := "ماه"
+	if jm >= 1 && jm <= len(jalaliMonthNames) {
+		month = jalaliMonthNames[jm-1]
+	}
+	return persianDigits(jd) + " " + month
+}
+
+func meExportIsMine(meID int64, m meExportMessage) bool {
+	if m.UserID == m.MentorID {
+		return true
+	}
+	role := models.Role(m.SenderRole)
+	if meID == m.UserID && role == models.RoleStudent {
+		return true
+	}
+	if meID == m.MentorID && (role == models.RoleMentor || role == models.RoleAdmin) {
+		return true
+	}
+	return false
+}
+
+func escapeExportBody(s string) string {
+	return html.EscapeString(s)
+}
+
+func renderExportAttachment(att models.Attachment, rel string) string {
+	name := strings.TrimSpace(att.Name)
+	if name == "" {
+		name = "فایل"
+	}
+	safe := html.EscapeString(name)
+	if rel == "" {
+		return `<p class="missing">فایل همراه موجود نیست: ` + safe + `</p>`
+	}
+	src := html.EscapeString(rel)
+	switch strings.ToLower(strings.TrimSpace(att.Type)) {
+	case "image":
+		return `<img src="` + src + `" alt="` + safe + `">`
+	case "audio":
+		return `<audio controls preload="metadata" src="` + src + `"></audio>`
+	case "video":
+		return `<video controls preload="metadata" src="` + src + `"></video>`
+	default:
+		return `<p class="file"><a href="` + src + `">` + safe + `</a></p>`
+	}
+}
+
+func formatJalaliStamp(t time.Time) string {
+	if t.IsZero() {
+		return ""
+	}
+	local := t.In(tehranLocation())
+	_, jm, jd := gregorianToJalali(local.Year(), int(local.Month()), local.Day())
+	month := "ماه"
+	if jm >= 1 && jm <= len(jalaliMonthNames) {
+		month = jalaliMonthNames[jm-1]
+	}
+	return persianDigits(jd) + " " + month + " · " + persianDigits2(local.Hour()) + ":" + persianDigits2(local.Minute())
+}
+
+func tehranLocation() *time.Location {
+	loc, err := time.LoadLocation("Asia/Tehran")
+	if err != nil {
+		return time.FixedZone("IRST", 3*3600+30*60)
+	}
+	return loc
+}
+
+var jalaliMonthNames = []string{
+	"فروردین", "اردیبهشت", "خرداد", "تیر", "مرداد", "شهریور",
+	"مهر", "آبان", "آذر", "دی", "بهمن", "اسفند",
+}
+
+func persianDigits(n int) string {
+	if n < 0 {
+		n = 0
+	}
+	return strings.Map(func(r rune) rune {
+		if r >= '0' && r <= '9' {
+			return '۰' + (r - '0')
+		}
+		return r
+	}, strconv.Itoa(n))
+}
+
+func persianDigits2(n int) string {
+	if n < 0 {
+		n = 0
+	}
+	return persianDigits(n/10) + persianDigits(n%10)
+}
+
+func gregorianToJalali(gy, gm, gd int) (jy, jm, jd int) {
+	gdm := [12]int{0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334}
+	gy2 := gy
+	if gm > 2 {
+		gy2 = gy + 1
+	}
+	days := 355666 + 365*gy + (gy2+3)/4 - (gy2+99)/100 + (gy2+399)/400 + gd + gdm[gm-1]
+	jy = -1595 + 33*(days/12053)
+	days %= 12053
+	jy += 4 * (days / 1461)
+	days %= 1461
+	if days > 365 {
+		jy += (days - 1) / 365
+		days = (days - 1) % 365
+	}
+	if days < 186 {
+		jm = 1 + days/31
+		jd = 1 + days%31
+		return jy, jm, jd
+	}
+	jm = 7 + (days-186)/30
+	jd = 1 + (days-186)%30
+	return jy, jm, jd
+}

backend/internal/api/me_export_test.go

@@ -0,0 +1,254 @@
+package api_test
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestMeChatHTMLZipExport(t *testing.T) {
+	e := setup(t)
+	student, studentID := register(t, e, "Export Student", "me-export@test.dev")
+	other, otherID := register(t, e, "Other Student", "me-export-other@test.dev")
+	admin := login(t, e, bootstrapAdminEmail)
+	code, body := e.do(t, "POST", "/api/admin/users", admin, map[string]any{
+		"name": "Mentor Export", "email": "mentor-export@test.dev", "username": "mentorexport",
+		"password": "password123", "role": "mentor",
+		"securityQuestion": "نام حیوان خانگی؟", "securityAnswer": "rex",
+	})
+	if code != http.StatusCreated {
+		t.Fatalf("create mentor: %d %v", code, body)
+	}
+	mentorID := int64(body["user"].(map[string]any)["id"].(float64))
+	mentor := login(t, e, "mentor-export@test.dev")
+
+	png, err := base64.StdEncoding.DecodeString("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==")
+	if err != nil || len(png) < 8 {
+		t.Fatalf("png: %v len=%d", err, len(png))
+	}
+	wav := make([]byte, 44)
+	copy(wav, []byte("RIFF"))
+	copy(wav[8:], []byte("WAVE"))
+	note := []byte("note-bytes")
+
+	code, upImg := uploadChatFile(t, e, student, "shot.png", png)
+	if code != http.StatusCreated {
+		t.Fatalf("png upload: %d %v", code, upImg)
+	}
+	code, upNote := uploadChatFile(t, e, student, "notes.txt", note)
+	if code != http.StatusCreated {
+		t.Fatalf("txt upload: %d %v", code, upNote)
+	}
+	code, upVoice := uploadChatFile(t, e, student, "voice-note.wav", wav)
+	if code != http.StatusCreated {
+		t.Fatalf("wav upload: %d %v", code, upVoice)
+	}
+
+	code, sent := e.do(t, "POST", "/api/chats/"+itoa(mentorID)+"/messages", student, map[string]any{
+		"body":        "<b>راز</b>\nخط دوم",
+		"attachments": []any{upImg["attachment"], upNote["attachment"]},
+	})
+	if code != http.StatusCreated {
+		t.Fatalf("send: %d %v", code, sent)
+	}
+	msgID := int64(sent["message"].(map[string]any)["id"].(float64))
+	if _, err := e.pool.Exec(context.Background(), `UPDATE chat_messages SET created_at = $1 WHERE id = $2`, "2026-03-21 12:00:00+00", msgID); err != nil {
+		t.Fatal(err)
+	}
+	code, voice := e.do(t, "POST", "/api/chats/"+itoa(mentorID)+"/messages", student, map[string]any{
+		"body":       "صدا",
+		"attachment": upVoice["attachment"],
+	})
+	if code != http.StatusCreated {
+		t.Fatalf("voice: %d %v", code, voice)
+	}
+	if _, err := e.pool.Exec(context.Background(), `
+		INSERT INTO chat_messages (user_id, mentor_id, sender_role, body, attachment_type, attachment_url, attachment_name, attachment_size)
+		VALUES ($1, $2, 'student', 'گمشده', 'audio', 'http://localhost:8080/media/chats/999-missing.wav', 'gone.wav', 5000)`,
+		studentID, mentorID); err != nil {
+		t.Fatal(err)
+	}
+	code, saved := e.do(t, "POST", "/api/chats/"+itoa(studentID)+"/messages", student, map[string]any{"body": "یادداشت خصوصی"})
+	if code != http.StatusCreated {
+		t.Fatalf("saved: %d %v", code, saved)
+	}
+	code, reply := e.do(t, "POST", "/api/chats/"+itoa(studentID)+"/messages", mentor, map[string]any{"body": "از منتور"})
+	if code != http.StatusCreated {
+		t.Fatalf("reply: %d %v", code, reply)
+	}
+
+	code, _ = e.do(t, "GET", "/api/me/export?meta=1", student, nil)
+	if code != http.StatusBadRequest {
+		t.Fatalf("meta without chat: %d", code)
+	}
+	code, _, raw := e.doRaw(t, "GET", "/api/me/export", student, nil)
+	if code != http.StatusBadRequest || (len(raw) >= 2 && raw[0] == 'P' && raw[1] == 'K') {
+		t.Fatalf("export without chat should not be a zip: %d", code)
+	}
+
+	code, meta := e.do(t, "GET", "/api/me/export?meta=1&chat="+itoa(mentorID), student, nil)
+	if code != http.StatusOK {
+		t.Fatalf("meta: %d %v", code, meta)
+	}
+	approx := int64(meta["bytes"].(float64))
+	floor := int64(len(png) + len(wav) + len(note) + 5000)
+	if approx < floor {
+		t.Fatalf("estimate %d < media floor %d", approx, floor)
+	}
+	if int64(meta["chat"].(float64)) != mentorID {
+		t.Fatalf("meta chat: %v", meta["chat"])
+	}
+	code, savedMeta := e.do(t, "GET", "/api/me/export?meta=1&chat="+itoa(studentID), student, nil)
+	if code != http.StatusOK || int64(savedMeta["bytes"].(float64)) >= approx {
+		t.Fatalf("saved meta should be only that chat: %d %v", code, savedMeta)
+	}
+
+	code, ct, raw := e.doRaw(t, "GET", "/api/me/export?chat="+itoa(mentorID), student, nil)
+	if code != http.StatusOK {
+		t.Fatalf("zip: %d %s", code, ct)
+	}
+	if ct != "application/zip" || len(raw) < 2 || raw[0] != 'P' || raw[1] != 'K' {
+		t.Fatalf("not a zip: %s %d", ct, len(raw))
+	}
+	zr, err := zip.NewReader(bytes.NewReader(raw), int64(len(raw)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var htmlDoc string
+	var sawImage, sawAudio, sawNote bool
+	for _, f := range zr.File {
+		if strings.Contains(f.Name, "gone.wav") || strings.Contains(f.Name, "missing") {
+			t.Fatalf("missing media was packed: %s", f.Name)
+		}
+		rc, err := f.Open()
+		if err != nil {
+			t.Fatal(err)
+		}
+		blob, _ := io.ReadAll(rc)
+		_ = rc.Close()
+		switch {
+		case f.Name == "index.html":
+			htmlDoc = string(blob)
+		case strings.HasSuffix(f.Name, ".png"):
+			sawImage = bytes.Equal(blob, png)
+		case strings.HasSuffix(f.Name, ".wav"):
+			sawAudio = bytes.Equal(blob, wav)
+		case strings.HasSuffix(f.Name, ".txt"):
+			sawNote = bytes.Equal(blob, note)
+		}
+	}
+	if htmlDoc == "" || !sawImage || !sawAudio || !sawNote {
+		t.Fatalf("zip parts image=%v audio=%v note=%v html=%d", sawImage, sawAudio, sawNote, len(htmlDoc))
+	}
+	if !strings.Contains(htmlDoc, `lang="fa"`) || !strings.Contains(htmlDoc, `dir="rtl"`) {
+		t.Fatal("html is not a persian rtl document")
+	}
+	if strings.Contains(htmlDoc, "<b>راز") || !strings.Contains(htmlDoc, "&lt;b&gt;راز&lt;/b&gt;") {
+		t.Fatal("user text was not escaped")
+	}
+	if !strings.Contains(htmlDoc, "&lt;b&gt;راز&lt;/b&gt;\nخط دوم") {
+		t.Fatal("newline was not kept in the bubble")
+	}
+	if !strings.Contains(htmlDoc, "white-space: pre-wrap") {
+		t.Fatal("bubble text does not keep whitespace")
+	}
+	if !strings.Contains(htmlDoc, `class="msg mine"`) || !strings.Contains(htmlDoc, `class="msg theirs"`) {
+		t.Fatal("own and partner bubbles are missing")
+	}
+	if !strings.Contains(htmlDoc, "#6d63f0") {
+		t.Fatal("own bubble is not the chat primary color")
+	}
+	if !strings.Contains(htmlDoc, ">Mentor Export</h1>") || !strings.Contains(htmlDoc, "Export Student") || !strings.Contains(htmlDoc, "از منتور") {
+		t.Fatal("single conversation header or sender names missing")
+	}
+	if strings.Contains(htmlDoc, "یادداشت خصوصی") || strings.Contains(htmlDoc, "گفتگوهای پرگار") {
+		t.Fatal("export included another conversation")
+	}
+	if !strings.Contains(htmlDoc, "<img ") || !strings.Contains(htmlDoc, `src="media/`) {
+		t.Fatal("image is not inlined with a relative src")
+	}
+	if !strings.Contains(htmlDoc, "<audio controls") {
+		t.Fatal("voice has no native audio control")
+	}
+	if !strings.Contains(htmlDoc, "<a href=\"media/") {
+		t.Fatal("other file is not a relative link")
+	}
+	if !strings.Contains(htmlDoc, "۱ فروردین · ۱۵:۳۰") {
+		t.Fatal("jalali stamp missing")
+	}
+	if !strings.Contains(htmlDoc, "فایل همراه موجود نیست") || !strings.Contains(htmlDoc, "gone.wav") {
+		t.Fatal("missing file was not reported in the transcript")
+	}
+
+	code, ct, savedRaw := e.doRaw(t, "GET", "/api/me/export?chat="+itoa(studentID), student, nil)
+	if code != http.StatusOK || ct != "application/zip" || len(savedRaw) < 2 || savedRaw[0] != 'P' {
+		t.Fatalf("saved zip: %d %s", code, ct)
+	}
+	savedZip, err := zip.NewReader(bytes.NewReader(savedRaw), int64(len(savedRaw)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var savedHTML string
+	for _, f := range savedZip.File {
+		if strings.HasSuffix(f.Name, ".png") || strings.HasSuffix(f.Name, ".wav") || strings.HasSuffix(f.Name, ".txt") {
+			t.Fatalf("saved chat packed another conversation's media: %s", f.Name)
+		}
+		if f.Name != "index.html" {
+			continue
+		}
+		rc, err := f.Open()
+		if err != nil {
+			t.Fatal(err)
+		}
+		blob, _ := io.ReadAll(rc)
+		_ = rc.Close()
+		savedHTML = string(blob)
+	}
+	if !strings.Contains(savedHTML, "پیام‌های ذخیره‌شده") || !strings.Contains(savedHTML, "یادداشت خصوصی") {
+		t.Fatal("saved chat export is missing its own transcript")
+	}
+	if strings.Contains(savedHTML, "راز") || strings.Contains(savedHTML, "از منتور") {
+		t.Fatal("saved chat export included the mentor thread")
+	}
+
+	code, _, _ = e.doRaw(t, "GET", "/api/me/export?chat="+itoa(studentID), other, nil)
+	if code != http.StatusNotFound {
+		t.Fatalf("other user chat: %d", code)
+	}
+	code, _, otherRaw := e.doRaw(t, "GET", "/api/me/export?chat="+itoa(otherID), other, nil)
+	if code != http.StatusOK || len(otherRaw) < 2 || otherRaw[0] != 'P' {
+		t.Fatalf("other user own export failed: %d", code)
+	}
+	otherZip, err := zip.NewReader(bytes.NewReader(otherRaw), int64(len(otherRaw)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range otherZip.File {
+		rc, err := f.Open()
+		if err != nil {
+			t.Fatal(err)
+		}
+		blob, _ := io.ReadAll(rc)
+		_ = rc.Close()
+		if bytes.Contains(blob, []byte("راز")) || bytes.Contains(blob, []byte("یادداشت خصوصی")) {
+			t.Fatalf("other user export leaked %s", f.Name)
+		}
+	}
+	code, mentorMeta := e.do(t, "GET", "/api/me/export?meta=1&chat="+itoa(studentID), mentor, nil)
+	if code != http.StatusOK || int64(mentorMeta["bytes"].(float64)) < floor {
+		t.Fatalf("mentor meta: %d %v", code, mentorMeta)
+	}
+	code, _ = e.do(t, "GET", "/api/me/export?chat=999999", student, nil)
+	if code != http.StatusNotFound {
+		t.Fatalf("missing partner: %d", code)
+	}
+	code, _, _ = e.doRaw(t, "GET", "/api/me/export?chat="+itoa(mentorID), "", nil)
+	if code != http.StatusUnauthorized {
+		t.Fatalf("anon: %d", code)
+	}
+}

backend/internal/api/me_export_time_test.go

@@ -0,0 +1,27 @@
+package api
+
+import (
+	"testing"
+	"time"
+)
+
+func TestGregorianToJalaliKnownDates(t *testing.T) {
+	cases := []struct {
+		y, m, d    int
+		jy, jm, jd int
+	}{
+		{2026, 3, 21, 1405, 1, 1},
+		{2026, 10, 10, 1405, 7, 18},
+		{2024, 3, 20, 1403, 1, 1},
+	}
+	for _, c := range cases {
+		jy, jm, jd := gregorianToJalali(c.y, c.m, c.d)
+		if jy != c.jy || jm != c.jm || jd != c.jd {
+			t.Fatalf("%04d-%02d-%02d: got %d-%d-%d want %d-%d-%d", c.y, c.m, c.d, jy, jm, jd, c.jy, c.jm, c.jd)
+		}
+	}
+	stamp := formatJalaliStamp(time.Date(2026, 3, 21, 12, 0, 0, 0, time.UTC))
+	if stamp != "۱ فروردین · ۱۵:۳۰" {
+		t.Fatalf("stamp: %q", stamp)
+	}
+}

backend/internal/api/product.go

@@ -0,0 +1,738 @@
+package api
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"runtime/debug"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/jackc/pgx/v5"
+
+	"pargar/backend/internal/models"
+	"pargar/backend/internal/store"
+)
+
+var announcementCategories = map[string]bool{
+	"event": true, "progress": true, "gamification": true, "mentor": true,
+	"urgent": true, "curriculum": true, "community": true, "system": true,
+}
+
+func (s *Server) handleAdminAnnounce(w http.ResponseWriter, r *http.Request) {
+	s.createAnnouncement(w, r)
+}
+
+func (s *Server) handleAdminListAnnouncements(w http.ResponseWriter, r *http.Request) {
+	list, err := s.store.ListAnnouncements(r.Context())
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری اطلاعیه‌ها ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"announcements": announceViews(list)})
+}
+
+func (s *Server) handleAdminUpdateAnnouncement(w http.ResponseWriter, r *http.Request) {
+	id := routeID(r, "id")
+	a, ok := s.readAnnouncement(w, r)
+	if !ok {
+		return
+	}
+	a.ID = id
+	if err := s.store.UpdateAnnouncement(r.Context(), a); err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			writeErr(w, http.StatusNotFound, "اطلاعیه پیدا نشد")
+			return
+		}
+		writeErr(w, http.StatusInternalServerError, "ویرایش اطلاعیه ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleAdminDeleteAnnouncement(w http.ResponseWriter, r *http.Request) {
+	id := routeID(r, "id")
+	if err := s.store.DeleteAnnouncement(r.Context(), id); err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			writeErr(w, http.StatusNotFound, "اطلاعیه پیدا نشد")
+			return
+		}
+		writeErr(w, http.StatusInternalServerError, "حذف اطلاعیه ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handlePinnedAnnouncement(w http.ResponseWriter, r *http.Request) {
+	list, err := s.store.RecentAnnouncements(r.Context(), 8)
+	var pinned any
+	if err == nil {
+		for _, a := range list {
+			if a.Pinned {
+				pinned = announceViews([]store.Announcement{a})[0]
+				break
+			}
+		}
+	}
+	if pinned == nil {
+		if a, perr := s.store.PinnedAnnouncement(r.Context()); perr == nil {
+			pinned = announceViews([]store.Announcement{*a})[0]
+		}
+	}
+	views := []map[string]any{}
+	if err == nil {
+		views = announceViews(list)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"announcement": pinned, "announcements": views})
+}
+
+func (s *Server) createAnnouncement(w http.ResponseWriter, r *http.Request) {
+	a, ok := s.readAnnouncement(w, r)
+	if !ok {
+		return
+	}
+	a.CreatedBy = currentUser(r).ID
+	if err := s.store.CreateAnnouncement(r.Context(), &a); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ثبت اطلاعیه ممکن نشد")
+		return
+	}
+	ids, err := s.store.AllActiveUserIDs(r.Context())
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری کاربران ممکن نشد")
+		return
+	}
+	go func() {
+		for _, uid := range ids {
+			n := &models.Notification{
+				UserID: uid, Category: a.Category, Type: "announcement",
+				Title: a.Title, Body: a.Body, Route: a.Route,
+			}
+			if err := s.store.CreateNotification(context.Background(), n); err == nil {
+				_ = s.store.AttachAnnouncement(context.Background(), n.ID, a.ID)
+			}
+		}
+	}()
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "id": a.ID, "recipients": len(ids)})
+}
+
+func (s *Server) readAnnouncement(w http.ResponseWriter, r *http.Request) (store.Announcement, bool) {
+	var req struct {
+		Title    string `json:"title"`
+		Body     string `json:"body"`
+		Route    string `json:"route"`
+		Category string `json:"category"`
+		Pinned   bool   `json:"pinned"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return store.Announcement{}, false
+	}
+	req.Title = strings.TrimSpace(req.Title)
+	req.Body = strings.TrimSpace(req.Body)
+	req.Route = strings.TrimSpace(req.Route)
+	if req.Category == "" {
+		req.Category = "event"
+	}
+	if !announcementCategories[req.Category] {
+		writeErr(w, http.StatusBadRequest, "دستهٔ اطلاعیه نامعتبر است")
+		return store.Announcement{}, false
+	}
+	if utf8.RuneCountInString(req.Title) < 3 || utf8.RuneCountInString(req.Title) > 200 {
+		writeErr(w, http.StatusBadRequest, "عنوان اطلاعیه نامعتبر است")
+		return store.Announcement{}, false
+	}
+	if utf8.RuneCountInString(req.Body) < 8 || utf8.RuneCountInString(req.Body) > 4000 {
+		writeErr(w, http.StatusBadRequest, "متن اطلاعیه نامعتبر است")
+		return store.Announcement{}, false
+	}
+	if req.Route != "" && !strings.HasPrefix(req.Route, "/") {
+		writeErr(w, http.StatusBadRequest, "مسیر باید با / شروع شود")
+		return store.Announcement{}, false
+	}
+	return store.Announcement{
+		Title: req.Title, Body: req.Body, Category: req.Category, Route: req.Route, Pinned: req.Pinned,
+	}, true
+}
+
+func announceViews(list []store.Announcement) []map[string]any {
+	if list == nil {
+		return []map[string]any{}
+	}
+	out := make([]map[string]any, 0, len(list))
+	for _, a := range list {
+		out = append(out, map[string]any{
+			"id": a.ID, "title": a.Title, "body": a.Body, "category": a.Category,
+			"route": a.Route, "pinned": a.Pinned, "createdAt": a.CreatedAt, "updatedAt": a.UpdatedAt,
+		})
+	}
+	return out
+}
+
+func (s *Server) handleChatPrefs(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	partner := routeID(r, "partner")
+	if !s.canChatWith(r.Context(), me, partner) {
+		writeErr(w, http.StatusForbidden, "شما اجازهٔ گفتگو با این کاربر را ندارید")
+		return
+	}
+	var req struct {
+		PinnedRank *int `json:"pinnedRank"`
+		Muted      bool `json:"muted"`
+		Archived   bool `json:"archived"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if err := s.store.UpsertChatPref(r.Context(), me.ID, partner, req.PinnedRank, req.Muted, req.Archived); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ذخیره تنظیم گفتگو ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleChatMuteAll(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Muted bool `json:"muted"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if err := s.store.SetChatMutedAll(r.Context(), currentUser(r).ID, req.Muted); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ذخیره ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "muted": req.Muted})
+}
+
+func (s *Server) handleChatPeek(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	partner := routeID(r, "partner")
+	if !s.canChatWith(r.Context(), me, partner) {
+		writeErr(w, http.StatusForbidden, "شما اجازهٔ گفتگو با این کاربر را ندارید")
+		return
+	}
+	msgs, err := s.store.ListChatMessages(r.Context(), me.ID, partner, 0, 8)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "پیش‌نمایش ممکن نشد")
+		return
+	}
+	if len(msgs) > 8 {
+		msgs = msgs[len(msgs)-8:]
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"messages": msgs})
+}
+
+func (s *Server) handleChatUnread(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	partner := routeID(r, "partner")
+	if err := s.store.MarkChatUnread(r.Context(), me.ID, partner, me.Role.String()); err != nil {
+		writeErr(w, http.StatusInternalServerError, "بازگشت به نخوانده ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleChatDeleteBoth(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	partner := routeID(r, "partner")
+	if r.URL.Query().Get("confirm") != "both" {
+		writeErr(w, http.StatusBadRequest, "برای پاک کردن دو طرفه confirm=both لازم است")
+		return
+	}
+	if !s.canChatWith(r.Context(), me, partner) && me.Role != models.RoleAdmin {
+		writeErr(w, http.StatusForbidden, "اجازه ندارید")
+		return
+	}
+	if err := s.store.DeleteChatBoth(r.Context(), me.ID, partner); err != nil {
+		writeErr(w, http.StatusInternalServerError, "حذف گفتگو ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleChatBroadcast(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	if !me.Role.IsStaff() {
+		writeErr(w, http.StatusForbidden, "فقط مسئول دوره می‌تواند پیام همگانی بفرستد")
+		return
+	}
+	var req struct {
+		Body    string  `json:"body"`
+		UserIDs []int64 `json:"userIds"`
+		All     bool    `json:"all"`
+	}
+	if err := bodyJSON(r, &req); err != nil || strings.TrimSpace(req.Body) == "" {
+		writeErr(w, http.StatusBadRequest, "متن پیام لازم است")
+		return
+	}
+	ids := req.UserIDs
+	if req.All {
+		var err error
+		ids, err = s.store.AllActiveUserIDs(r.Context())
+		if err != nil {
+			writeErr(w, http.StatusInternalServerError, "بارگذاری کاربران ممکن نشد")
+			return
+		}
+	}
+	sent := 0
+	for _, id := range ids {
+		if id == me.ID || !s.canChatWith(r.Context(), me, id) {
+			continue
+		}
+		studentID, mentorID := id, me.ID
+		if me.Role == models.RoleStudent {
+			studentID, mentorID = me.ID, id
+		}
+		if _, err := s.store.AddChatMessage(r.Context(), studentID, mentorID, me.Role, strings.TrimSpace(req.Body), nil, nil); err == nil {
+			sent++
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"sent": sent})
+}
+
+func (s *Server) handleSaveMessage(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Body           string `json:"body"`
+		AttachmentURL  string `json:"attachmentUrl"`
+		AttachmentType string `json:"attachmentType"`
+		AttachmentName string `json:"attachmentName"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	if strings.TrimSpace(req.Body) == "" && req.AttachmentURL == "" {
+		writeErr(w, http.StatusBadRequest, "پیامی برای ذخیره نیست")
+		return
+	}
+	me := currentUser(r)
+	var att *models.Attachment
+	if req.AttachmentURL != "" {
+		url := req.AttachmentURL
+		if q := strings.Index(url, "?"); q >= 0 {
+			url = url[:q]
+		}
+		att = &models.Attachment{Type: req.AttachmentType, URL: url, Name: req.AttachmentName}
+	}
+	var saved []models.Attachment
+	if att != nil {
+		saved = []models.Attachment{*att}
+	}
+	if _, err := s.store.AddChatMessage(r.Context(), me.ID, me.ID, me.Role, strings.TrimSpace(req.Body), nil, saved); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ذخیره ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleListSaved(w http.ResponseWriter, r *http.Request) {
+	list, err := s.store.ListSaved(r.Context(), currentUser(r).ID)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"messages": list})
+}
+
+func (s *Server) handleGetMeProfile(w http.ResponseWriter, r *http.Request) {
+	p, err := s.store.GetProfileExtras(r.Context(), currentUser(r).ID)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری پروفایل ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"profile": s.profileView(p)})
+}
+
+func (s *Server) handlePutMeProfile(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Banner       *string         `json:"banner"`
+		Public       *bool           `json:"public"`
+		ShowActivity *bool           `json:"showActivity"`
+		ShowStats    *bool           `json:"showStats"`
+		ShowPath     *bool           `json:"showPath"`
+		ShowBadges   *bool           `json:"showBadges"`
+		SocialLinks  json.RawMessage `json:"socialLinks"`
+		Theme        *string         `json:"theme"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	cur, err := s.store.GetProfileExtras(r.Context(), currentUser(r).ID)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری پروفایل ممکن نشد")
+		return
+	}
+	if req.Banner != nil {
+		cur.Banner = strings.TrimSpace(*req.Banner)
+	}
+	if req.Public != nil {
+		cur.Public = *req.Public
+	}
+	if req.ShowActivity != nil {
+		cur.ShowActivity = *req.ShowActivity
+	}
+	if req.ShowStats != nil {
+		cur.ShowStats = *req.ShowStats
+	}
+	if req.ShowPath != nil {
+		cur.ShowPath = *req.ShowPath
+	}
+	if req.ShowBadges != nil {
+		cur.ShowBadges = *req.ShowBadges
+	}
+	if req.Theme != nil {
+		cur.Theme = strings.TrimSpace(*req.Theme)
+	}
+	if len(req.SocialLinks) > 0 {
+		var links []map[string]string
+		if err := json.Unmarshal(req.SocialLinks, &links); err != nil || len(links) > 5 {
+			writeErr(w, http.StatusBadRequest, "حداکثر ۵ لینک شخصی مجاز است")
+			return
+		}
+		cur.SocialLinks = req.SocialLinks
+	}
+	if i := strings.Index(cur.Banner, "?"); i >= 0 {
+		cur.Banner = cur.Banner[:i]
+	}
+	if err := s.store.SaveProfileExtras(r.Context(), currentUser(r).ID, cur); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ذخیره پروفایل ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"profile": s.profileView(cur)})
+}
+
+func (s *Server) profileView(p store.ProfileExtras) map[string]any {
+	links := json.RawMessage(p.SocialLinks)
+	if len(links) == 0 {
+		links = json.RawMessage(`[]`)
+	}
+	banner := p.Banner
+	if i := strings.Index(banner, "?"); i >= 0 {
+		banner = banner[:i]
+	}
+	return map[string]any{
+		"banner": s.signExistingMediaURL(banner), "public": p.Public, "showActivity": p.ShowActivity,
+		"showStats": p.ShowStats, "showPath": p.ShowPath, "showBadges": p.ShowBadges,
+		"socialLinks": json.RawMessage(links), "theme": p.Theme,
+	}
+}
+
+func (s *Server) handleMeAchievements(w http.ResponseWriter, r *http.Request) {
+	u := currentUser(r)
+	writeJSON(w, http.StatusOK, map[string]any{"achievements": s.achievementsFor(r.Context(), u)})
+}
+
+func (s *Server) achievementsFor(ctx context.Context, u *models.User) []map[string]any {
+	passed := 0
+	_ = s.store.Pool().QueryRow(ctx, `SELECT count(*) FROM lesson_progress WHERE user_id=$1 AND passed_quiz`, u.ID).Scan(&passed)
+	certs := 0
+	_ = s.store.Pool().QueryRow(ctx, `SELECT count(*) FROM certificates WHERE user_id=$1 AND revoked_at IS NULL`, u.ID).Scan(&certs)
+	items := []struct {
+		id, title string
+		on        bool
+	}{
+		{"first_pass", "اولین قبولی", passed > 0},
+		{"chapter_done", "اتمام فصل", s.finishedChapter(ctx, u.ID)},
+		{"streak_7", "استمرار هفت‌روزه", u.StreakCurrent >= 7 || u.StreakLongest >= 7},
+		{"course_done", "پایان دوره", certs > 0},
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, it := range items {
+		out = append(out, map[string]any{"id": it.id, "title": it.title, "unlocked": it.on})
+	}
+	return out
+}
+
+func (s *Server) finishedChapter(ctx context.Context, userID int64) bool {
+	var n int
+	err := s.store.Pool().QueryRow(ctx, `
+		SELECT count(*) FROM chapters c
+		WHERE EXISTS (SELECT 1 FROM lessons l WHERE l.chapter_id=c.id)
+		  AND NOT EXISTS (
+			SELECT 1 FROM lessons l
+			LEFT JOIN lesson_progress p ON p.lesson_id=l.id AND p.user_id=$1
+			WHERE l.chapter_id=c.id AND COALESCE(p.passed_quiz, false)=false
+		  )`, userID).Scan(&n)
+	return err == nil && n > 0
+}
+
+func (s *Server) handleMeActivity(w http.ResponseWriter, r *http.Request) {
+	rows, err := s.store.Pool().Query(r.Context(), `
+		SELECT day::text, count(*) FROM (
+			SELECT created_at::date AS day FROM quiz_attempts WHERE user_id=$1
+			UNION ALL
+			SELECT created_at::date FROM chat_messages WHERE user_id=$1 OR mentor_id=$1
+		) d
+		WHERE day >= current_date - 120
+		GROUP BY day ORDER BY day`, currentUser(r).ID)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری فعالیت ممکن نشد")
+		return
+	}
+	defer rows.Close()
+	var days []map[string]any
+	for rows.Next() {
+		var day string
+		var n int
+		if err := rows.Scan(&day, &n); err != nil {
+			continue
+		}
+		days = append(days, map[string]any{"day": day, "count": n})
+	}
+	if days == nil {
+		days = []map[string]any{}
+	}
+	week, month := 0, 0
+	_ = s.store.Pool().QueryRow(r.Context(), `
+		SELECT
+			count(*) FILTER (WHERE day >= current_date - 6),
+			count(*) FILTER (WHERE day >= current_date - 29)
+		FROM (
+			SELECT DISTINCT created_at::date AS day FROM quiz_attempts WHERE user_id=$1
+			UNION
+			SELECT DISTINCT created_at::date FROM chat_messages WHERE user_id=$1 OR mentor_id=$1
+		) d`, currentUser(r).ID).Scan(&week, &month)
+	writeJSON(w, http.StatusOK, map[string]any{"days": days, "weekDays": week, "monthDays": month})
+}
+
+
+func (s *Server) handleMeta(w http.ResponseWriter, r *http.Request) {
+	env := "production"
+	if s.cfg.DevMode {
+		env = "development"
+	}
+	version, built := appBuild()
+	writeJSON(w, http.StatusOK, map[string]any{
+		"version": version,
+		"built":   built,
+		"env":     env,
+		"health":  "ok",
+	})
+}
+
+func appBuild() (version, built string) {
+	version = "0.2.1"
+	built = "dev"
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return version, built
+	}
+	for _, setting := range info.Settings {
+		if setting.Key == "vcs.time" && len(setting.Value) >= 10 {
+			built = setting.Value[:10]
+		}
+		if setting.Key == "vcs.revision" && len(setting.Value) >= 7 {
+			version = "0.2.1+" + setting.Value[:7]
+		}
+	}
+	return version, built
+}
+
+func (s *Server) handleAdminListBots(w http.ResponseWriter, r *http.Request) {
+	p := parsePageParams(r)
+	p.PageSize = 8
+	p.Offset = (p.Page - 1) * p.PageSize
+
+	var total int64
+	if err := s.store.Pool().QueryRow(r.Context(), `SELECT count(*) FROM bot_tokens`).Scan(&total); err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری کلیدها ممکن نشد")
+		return
+	}
+	rows, err := s.store.Pool().Query(r.Context(), `
+		SELECT bt.id, bt.bot_user_id, COALESCE(u.name, ''), bt.created_at, bt.revoked_at IS NULL, bt.request_count
+		FROM bot_tokens bt
+		JOIN users u ON u.id = bt.bot_user_id
+		ORDER BY bt.id DESC
+		LIMIT $1 OFFSET $2`, p.PageSize, p.Offset)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری کلیدها ممکن نشد")
+		return
+	}
+	defer rows.Close()
+	items := make([]map[string]any, 0)
+	for rows.Next() {
+		var id, botID, requestCount int64
+		var name string
+		var createdAt time.Time
+		var active bool
+		if rows.Scan(&id, &botID, &name, &createdAt, &active, &requestCount) != nil {
+			continue
+		}
+		items = append(items, map[string]any{
+			"id":           id,
+			"botId":        botID,
+			"name":         name,
+			"createdAt":    createdAt,
+			"active":       active,
+			"requestCount": requestCount,
+		})
+	}
+	writePage(w, items, total, p)
+}
+
+func (s *Server) handleAdminSetBotActive(w http.ResponseWriter, r *http.Request) {
+	id := routeID(r, "id")
+	if id == 0 {
+		writeErr(w, http.StatusBadRequest, "شناسه نامعتبر است")
+		return
+	}
+	var req struct {
+		Active bool `json:"active"`
+	}
+	if err := bodyJSON(r, &req); err != nil {
+		writeErr(w, http.StatusBadRequest, "دادهٔ ارسالی نامعتبر است")
+		return
+	}
+	var err error
+	var updated int64
+	if req.Active {
+		tag, execErr := s.store.Pool().Exec(r.Context(), `UPDATE bot_tokens SET revoked_at=NULL WHERE id=$1`, id)
+		err = execErr
+		updated = tag.RowsAffected()
+	} else {
+		tag, execErr := s.store.Pool().Exec(r.Context(), `UPDATE bot_tokens SET revoked_at=COALESCE(revoked_at, now()) WHERE id=$1`, id)
+		err = execErr
+		updated = tag.RowsAffected()
+	}
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "به‌روزرسانی ممکن نشد")
+		return
+	}
+	if updated == 0 {
+		writeErr(w, http.StatusNotFound, "کلید پیدا نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "active": req.Active})
+}
+
+func (s *Server) handleCreateBot(w http.ResponseWriter, r *http.Request) {
+	me := currentUser(r)
+	var req struct {
+		Name string `json:"name"`
+	}
+	_ = bodyJSON(r, &req)
+	name := strings.TrimSpace(req.Name)
+	if name == "" {
+		name = "ربات پرگار"
+	}
+	raw := make([]byte, 24)
+	_, _ = rand.Read(raw)
+	token := hex.EncodeToString(raw)
+	sum := sha256.Sum256([]byte(token))
+	hash := hex.EncodeToString(sum[:])
+	email := "bot-" + token[:8] + "@bots.pargar.local"
+	bot, err := s.store.CreateUser(r.Context(), name, email, "bot"+token[:6], hash, "", "", "", models.RoleMentor)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ساخت ربات ممکن نشد")
+		return
+	}
+	if _, err := s.store.Pool().Exec(r.Context(), `
+		INSERT INTO bot_tokens (bot_user_id, owner_id, token_hash) VALUES ($1,$2,$3)`, bot.ID, me.ID, hash); err != nil {
+		writeErr(w, http.StatusInternalServerError, "ثبت توکن ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusCreated, map[string]any{"botId": bot.ID, "token": token})
+}
+
+func (s *Server) botFromRequest(r *http.Request) (int64, int64, bool) {
+	token := strings.TrimSpace(r.Header.Get("X-Bot-Token"))
+	if token == "" {
+		return 0, 0, false
+	}
+	sum := sha256.Sum256([]byte(token))
+	hash := hex.EncodeToString(sum[:])
+	var botID, ownerID int64
+	var active bool
+	err := s.store.Pool().QueryRow(r.Context(), `
+		SELECT bot_user_id, owner_id, revoked_at IS NULL FROM bot_tokens WHERE token_hash=$1`, hash).Scan(&botID, &ownerID, &active)
+	if err != nil || !active {
+		return 0, 0, false
+	}
+	_, _ = s.store.Pool().Exec(r.Context(), `
+		UPDATE bot_tokens SET request_count = request_count + 1 WHERE token_hash=$1 AND revoked_at IS NULL`, hash)
+	return botID, ownerID, true
+}
+
+func (s *Server) handleBotSend(w http.ResponseWriter, r *http.Request) {
+	botID, _, ok := s.botFromRequest(r)
+	if !ok {
+		writeErr(w, http.StatusUnauthorized, "توکن ربات نامعتبر است")
+		return
+	}
+	var req struct {
+		UserID  int64  `json:"userId"`
+		Text    string `json:"text"`
+		Buttons []any  `json:"buttons"`
+	}
+	if err := bodyJSON(r, &req); err != nil || req.UserID == 0 || strings.TrimSpace(req.Text) == "" {
+		writeErr(w, http.StatusBadRequest, "userId و text لازم است")
+		return
+	}
+	buttons, _ := json.Marshal(req.Buttons)
+	var id int64
+	err := s.store.Pool().QueryRow(r.Context(), `
+		INSERT INTO chat_messages (user_id, mentor_id, sender_role, body, buttons)
+		VALUES ($1,$2,'mentor',$3,$4) RETURNING id`,
+		req.UserID, botID, strings.TrimSpace(req.Text), buttons).Scan(&id)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ارسال ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"messageId": id})
+}
+
+func (s *Server) handleBotUpdates(w http.ResponseWriter, r *http.Request) {
+	botID, _, ok := s.botFromRequest(r)
+	if !ok {
+		writeErr(w, http.StatusUnauthorized, "توکن ربات نامعتبر است")
+		return
+	}
+	after, _ := strconv.ParseInt(r.URL.Query().Get("offset"), 10, 64)
+	rows, err := s.store.Pool().Query(r.Context(), `
+		SELECT id, payload, created_at FROM bot_updates WHERE bot_user_id=$1 AND id>$2 ORDER BY id LIMIT 50`, botID, after)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "بارگذاری ممکن نشد")
+		return
+	}
+	defer rows.Close()
+	var updates []map[string]any
+	for rows.Next() {
+		var id int64
+		var payload json.RawMessage
+		var at time.Time
+		if rows.Scan(&id, &payload, &at) == nil {
+			updates = append(updates, map[string]any{"id": id, "payload": json.RawMessage(payload), "createdAt": at})
+		}
+	}
+	if updates == nil {
+		updates = []map[string]any{}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"updates": updates})
+}
+
+func (s *Server) recordBotReply(ctx context.Context, from *models.User, partnerID int64, body string) {
+	var ownerID int64
+	err := s.store.Pool().QueryRow(ctx, `SELECT owner_id FROM bot_tokens WHERE bot_user_id=$1`, partnerID).Scan(&ownerID)
+	if err != nil {
+		return
+	}
+	payload, _ := json.Marshal(map[string]any{"from": from.ID, "name": from.Name, "text": body})
+	_, _ = s.store.Pool().Exec(ctx, `INSERT INTO bot_updates (bot_user_id, payload) VALUES ($1,$2)`, partnerID, payload)
+	_ = ownerID
+}
+
+func (s *Server) noteBotReply(r *http.Request, partner int64, body string) {
+	s.recordBotReply(r.Context(), currentUser(r), partner, body)
+}
+
+// silence unused import if pgx is only used by callers
+var _ = pgx.ErrNoRows

backend/internal/api/product_pass_test.go

@@ -0,0 +1,458 @@
+package api_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestAnnouncementRecordEditDeleteAndPin(t *testing.T) {
+	e := setup(t)
+	admin := login(t, e, bootstrapAdminEmail)
+	student, _ := register(t, e, "Ann", "ann@test.dev")
+	code, created := e.do(t, "POST", "/api/admin/announce", admin, map[string]any{
+		"title": "اطلاعیه تازه", "body": "متن **مارک‌داون** برای همه.", "category": "urgent", "route": "", "pinned": true,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("create: %d %v", code, created)
+	}
+	id := int64(created["id"].(float64))
+	code, list := e.do(t, "GET", "/api/admin/announcements", admin, nil)
+	if code != http.StatusOK || len(list["announcements"].([]any)) == 0 {
+		t.Fatalf("list: %d %v", code, list)
+	}
+	code, pin := e.do(t, "GET", "/api/announcements/pinned", student, nil)
+	if code != http.StatusOK {
+		t.Fatalf("pin: %d %v", code, pin)
+	}
+	item := pin["announcement"].(map[string]any)
+	if item["title"] != "اطلاعیه تازه" {
+		t.Fatalf("pinned title: %v", item)
+	}
+	code, second := e.do(t, "POST", "/api/admin/announce", admin, map[string]any{
+		"title": "اطلاعیه دوم", "body": "متن دوم برای اسلاید.", "category": "event", "route": "", "pinned": false,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("second: %d %v", code, second)
+	}
+	code, slidesRes := e.do(t, "GET", "/api/announcements/pinned", student, nil)
+	slides, _ := slidesRes["announcements"].([]any)
+	if code != http.StatusOK || len(slides) < 2 {
+		t.Fatalf("slides: %d %v", code, slidesRes["announcements"])
+	}
+	code, _ = e.do(t, "PUT", "/api/admin/announcements/"+itoa(id), admin, map[string]any{
+		"title": "اطلاعیه ویرایش‌شده", "body": "متن ویرایش‌شده برای رونوشت.", "category": "curriculum", "route": "/cap", "pinned": true,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("update: %d", code)
+	}
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		code, pin = e.do(t, "GET", "/api/announcements/pinned", student, nil)
+		if code == http.StatusOK {
+			if got, _ := pin["announcement"].(map[string]any); got != nil && got["title"] == "اطلاعیه ویرایش‌شده" {
+				break
+			}
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+	code, _ = e.do(t, "DELETE", "/api/admin/announcements/"+itoa(id), admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("delete: %d", code)
+	}
+}
+
+func TestHeartsRegenerateAndDoNotLock(t *testing.T) {
+	e := setup(t)
+	token, uid := register(t, e, "Heart", "heart@test.dev")
+	admin := login(t, e, bootstrapAdminEmail)
+	code, _ := e.do(t, "PUT", "/api/admin/users/"+itoa(uid), admin, map[string]any{"hearts": 0})
+	if code != http.StatusOK {
+		t.Fatalf("set hearts: %d", code)
+	}
+	if _, err := e.pool.Exec(context.Background(), `UPDATE users SET hearts_updated_at = now() - interval '5 hours' WHERE id=$1`, uid); err != nil {
+		t.Fatal(err)
+	}
+	code, me := e.do(t, "GET", "/api/auth/me", token, nil)
+	if code != http.StatusOK {
+		t.Fatalf("me: %d", code)
+	}
+	user := me["user"].(map[string]any)
+	if user["hearts"].(float64) < 1 {
+		t.Fatalf("expected a returned heart, got %v", user["hearts"])
+	}
+	if user["isLocked"] == true {
+		t.Fatal("zero hearts must not lock by default")
+	}
+	code, _ = e.do(t, "PUT", "/api/admin/settings", admin, map[string]any{
+		"settings": map[string]string{"hearts_max": "5", "hearts_regen_minutes": "240", "hearts_lock_on_empty": "false"},
+	})
+	if code != http.StatusOK {
+		t.Fatalf("settings: %d", code)
+	}
+}
+
+func TestProfilePrivateByDefault(t *testing.T) {
+	e := setup(t)
+	viewer, _ := register(t, e, "Viewer", "viewer@test.dev")
+	_, other := register(t, e, "Hidden", "hidden@test.dev")
+	code, body := e.do(t, "GET", "/api/users/"+itoa(other), viewer, nil)
+	if code != http.StatusOK {
+		t.Fatalf("profile: %d %v", code, body)
+	}
+	user := body["user"].(map[string]any)
+	if user["private"] != true {
+		t.Fatalf("expected private profile, got %v", user)
+	}
+	if _, ok := user["xp"]; ok {
+		t.Fatalf("private profile leaked xp: %v", user)
+	}
+}
+
+func TestMentorDirectoryUsesRealRoles(t *testing.T) {
+	e := setup(t)
+	admin := login(t, e, bootstrapAdminEmail)
+	_, uid := register(t, e, "StudentRow", "row@test.dev")
+	code, body := e.do(t, "GET", "/api/mentors?page=1&pageSize=50", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("mentors: %d %v", code, body)
+	}
+	found := false
+	for _, raw := range body["mentors"].([]any) {
+		row := raw.(map[string]any)
+		if int64(row["id"].(float64)) == uid {
+			found = true
+			if row["role"] != "student" {
+				t.Fatalf("role: %v", row["role"])
+			}
+		}
+	}
+	if !found {
+		t.Fatal("student missing from staff directory")
+	}
+}
+
+func TestSavedMessageBecomesSelfChat(t *testing.T) {
+	e := setup(t)
+	token, uid := register(t, e, "Saver", "saver@test.dev")
+	code, body := e.do(t, "POST", "/api/me/saved", token, map[string]any{"body": "برای بعد"})
+	if code != http.StatusOK {
+		t.Fatalf("save: %d %v", code, body)
+	}
+	code, body = e.do(t, "GET", "/api/chats/"+itoa(uid)+"/messages", token, nil)
+	if code != http.StatusOK {
+		t.Fatalf("self chat: %d %v", code, body)
+	}
+	msgs, _ := body["messages"].([]any)
+	if len(msgs) == 0 {
+		t.Fatal("saved text missing from self chat")
+	}
+	last := msgs[len(msgs)-1].(map[string]any)
+	if last["body"] != "برای بعد" {
+		t.Fatalf("body: %v", last["body"])
+	}
+}
+
+func TestBroadcastCanTargetSomePeople(t *testing.T) {
+	e := setup(t)
+	admin := login(t, e, bootstrapAdminEmail)
+	student, sid := register(t, e, "One", "one@test.dev")
+	code, me := e.do(t, "GET", "/api/auth/me", admin, nil)
+	if code != http.StatusOK {
+		t.Fatal(code)
+	}
+	adminID := int64(me["user"].(map[string]any)["id"].(float64))
+	code, body := e.do(t, "POST", "/api/chats/broadcast", admin, map[string]any{
+		"body": "فقط برای تو", "userIds": []int64{sid},
+	})
+	if code != http.StatusOK || body["sent"].(float64) != 1 {
+		t.Fatalf("broadcast: %d %v", code, body)
+	}
+	code, thread := e.do(t, "GET", "/api/chats/"+itoa(adminID)+"/messages", student, nil)
+	if code != http.StatusOK {
+		t.Fatalf("thread: %d %v", code, thread)
+	}
+	found := false
+	for _, raw := range thread["messages"].([]any) {
+		if raw.(map[string]any)["body"] == "فقط برای تو" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("targeted broadcast missing")
+	}
+}
+
+func TestChatPinAndBotReply(t *testing.T) {
+	e := setup(t)
+	admin := login(t, e, bootstrapAdminEmail)
+	student, sid := register(t, e, "Chatty", "chatty@test.dev")
+	code, _ := e.do(t, "PUT", "/api/chats/"+itoa(sid)+"/prefs", admin, map[string]any{
+		"pinnedRank": 1, "muted": true, "archived": false,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("prefs: %d", code)
+	}
+	code, conv := e.do(t, "GET", "/api/chats/conversations?page=1&pageSize=20", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("conversations: %d %v", code, conv)
+	}
+	code, bot := e.do(t, "POST", "/api/admin/bots", admin, map[string]any{"name": "ربات آزمون"})
+	if code != http.StatusCreated {
+		t.Fatalf("bot: %d %v", code, bot)
+	}
+	token := bot["token"].(string)
+	botID := int64(bot["botId"].(float64))
+	code, sent := e.doHeaders(t, "POST", "/api/bot/send", "", map[string]string{"X-Bot-Token": token}, map[string]any{
+		"userId": sid, "text": "سلام از ربات", "buttons": []any{map[string]string{"text": "باشه"}},
+	})
+	if code != http.StatusOK {
+		t.Fatalf("bot send: %d %v", code, sent)
+	}
+	code, _ = e.do(t, "POST", "/api/chats/"+itoa(botID)+"/messages", student, map[string]any{"body": "جواب هنرجو"})
+	if code != http.StatusOK && code != http.StatusCreated {
+		t.Fatalf("reply: %d", code)
+	}
+	code, updates := e.doHeaders(t, "GET", "/api/bot/updates", "", map[string]string{"X-Bot-Token": token}, nil)
+	if code != http.StatusOK || len(updates["updates"].([]any)) == 0 {
+		t.Fatalf("updates: %d %v", code, updates)
+	}
+}
+
+func TestLastSeenAndPinnedReorder(t *testing.T) {
+	e := setup(t)
+	admin := login(t, e, bootstrapAdminEmail)
+	_, alpha := register(t, e, "آلفا", "alpha-pin@test.dev")
+	_, beta := register(t, e, "بتا", "beta-pin@test.dev")
+	for _, id := range []int64{alpha, beta} {
+		code, body := e.do(t, "POST", "/api/chats/"+itoa(id)+"/messages", admin, map[string]any{"body": "سلام"})
+		if code != http.StatusCreated && code != http.StatusOK {
+			t.Fatalf("message %d: %d %v", id, code, body)
+		}
+	}
+	code, _ := e.do(t, "PUT", "/api/chats/"+itoa(alpha)+"/prefs", admin, map[string]any{
+		"pinnedRank": 0, "muted": false, "archived": false,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("pin alpha: %d", code)
+	}
+	code, _ = e.do(t, "PUT", "/api/chats/"+itoa(beta)+"/prefs", admin, map[string]any{
+		"pinnedRank": 1, "muted": false, "archived": false,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("pin beta: %d", code)
+	}
+	code, _ = e.do(t, "PUT", "/api/chats/"+itoa(alpha)+"/prefs", admin, map[string]any{
+		"pinnedRank": 1, "muted": false, "archived": false,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("swap alpha: %d", code)
+	}
+	code, _ = e.do(t, "PUT", "/api/chats/"+itoa(beta)+"/prefs", admin, map[string]any{
+		"pinnedRank": 0, "muted": false, "archived": false,
+	})
+	if code != http.StatusOK {
+		t.Fatalf("swap beta: %d", code)
+	}
+	code, conv := e.do(t, "GET", "/api/chats/conversations", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("conversations: %d %v", code, conv)
+	}
+	var pinned []float64
+	for _, raw := range conv["conversations"].([]any) {
+		row := raw.(map[string]any)
+		partner := row["partner"].(map[string]any)
+		id := partner["id"].(float64)
+		if id != float64(alpha) && id != float64(beta) {
+			continue
+		}
+		rank, ok := row["pinnedRank"].(float64)
+		if !ok {
+			t.Fatalf("missing pinnedRank for %v", id)
+		}
+		pinned = append(pinned, id)
+		if id == float64(beta) && rank != 0 {
+			t.Fatalf("beta rank: %v", rank)
+		}
+		if id == float64(alpha) && rank != 1 {
+			t.Fatalf("alpha rank: %v", rank)
+		}
+	}
+	if len(pinned) != 2 || pinned[0] != float64(beta) {
+		t.Fatalf("pin order: %v", pinned)
+	}
+
+	seenAt := time.Now().Add(-2 * time.Hour).UTC()
+	if _, err := e.pool.Exec(context.Background(), `UPDATE users SET last_seen_at=$2 WHERE id=$1`, alpha, seenAt); err != nil {
+		t.Fatalf("last seen: %v", err)
+	}
+	code, people := e.do(t, "GET", "/api/mentors?page=1&pageSize=50", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("mentors: %d %v", code, people)
+	}
+	var found bool
+	for _, raw := range people["mentors"].([]any) {
+		person := raw.(map[string]any)
+		if person["id"].(float64) != float64(alpha) {
+			continue
+		}
+		found = true
+		stamp, _ := person["lastSeen"].(string)
+		if stamp == "" {
+			t.Fatalf("lastSeen missing: %v", person)
+		}
+		parsed, err := time.Parse(time.RFC3339, stamp)
+		if err != nil {
+			parsed, err = time.Parse(time.RFC3339Nano, stamp)
+		}
+		if err != nil || parsed.Sub(seenAt).Abs() > time.Minute {
+			t.Fatalf("lastSeen %q: %v", stamp, err)
+		}
+	}
+	if !found {
+		t.Fatal("alpha missing from mentors")
+	}
+}
+
+func TestBotAPIKeys(t *testing.T) {
+	e := setup(t)
+	admin := login(t, e, bootstrapAdminEmail)
+	_, sid := register(t, e, "BotPeer", "bot-peer@test.dev")
+
+	code, created := e.do(t, "POST", "/api/admin/bots", admin, map[string]any{"name": "تست"})
+	if code != http.StatusCreated {
+		t.Fatalf("create: %d", code)
+	}
+	secret, _ := created["token"].(string)
+	if len(secret) < 32 {
+		t.Fatal("create did not return a secret")
+	}
+	if created["botId"] == nil {
+		t.Fatal("botId missing")
+	}
+	botUserID := created["botId"].(float64)
+	code, people := e.do(t, "GET", "/api/mentors?page=1&pageSize=50", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("mentors: %d %v", code, people["error"])
+	}
+	for _, raw := range people["mentors"].([]any) {
+		person := raw.(map[string]any)
+		if person["id"].(float64) == botUserID {
+			t.Fatal("bot appeared in the mentor directory")
+		}
+	}
+
+	code, list := e.do(t, "GET", "/api/admin/bots?page=1&pageSize=8", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("list: %d", code)
+	}
+	if list["pageSize"] != float64(8) {
+		t.Fatalf("pageSize: %v", list["pageSize"])
+	}
+	assertBotListHidesSecret(t, list, secret)
+	item := findBotItem(t, list, "تست")
+	createdAt, _ := item["createdAt"].(string)
+	if item["active"] != true || item["requestCount"] != float64(0) || createdAt == "" {
+		t.Fatalf("row shape: active=%v count=%v hasCreated=%v", item["active"], item["requestCount"], createdAt != "")
+	}
+	id := int64(item["id"].(float64))
+
+	code, _ = e.doHeaders(t, "POST", "/api/bot/send", "", map[string]string{"X-Bot-Token": "not-a-real-token"}, map[string]any{
+		"userId": sid, "text": "نباید بشمرد",
+	})
+	if code != http.StatusUnauthorized {
+		t.Fatalf("bad token: %d", code)
+	}
+
+	code, sent := e.doHeaders(t, "POST", "/api/bot/send", "", map[string]string{"X-Bot-Token": secret}, map[string]any{
+		"userId": sid, "text": "سلام از ربات", "buttons": []any{map[string]string{"text": "باشه"}},
+	})
+	if code != http.StatusOK {
+		t.Fatalf("send: %d %v", code, sent["error"])
+	}
+	code, list = e.do(t, "GET", "/api/admin/bots?page=1&pageSize=8", admin, nil)
+	if code != http.StatusOK {
+		t.Fatalf("list after send: %d", code)
+	}
+	assertBotListHidesSecret(t, list, secret)
+	item = findBotItem(t, list, "تست")
+	if item["requestCount"] != float64(1) {
+		t.Fatalf("requestCount after send: %v", item["requestCount"])
+	}
+
+	code, updates := e.doHeaders(t, "GET", "/api/bot/updates", "", map[string]string{"X-Bot-Token": secret}, nil)
+	if code != http.StatusOK {
+		t.Fatalf("updates: %d %v", code, updates["error"])
+	}
+	code, list = e.do(t, "GET", "/api/admin/bots?page=1&pageSize=8", admin, nil)
+	item = findBotItem(t, list, "تست")
+	if item["requestCount"] != float64(2) {
+		t.Fatalf("requestCount after updates: %v", item["requestCount"])
+	}
+
+	code, stopped := e.do(t, "PUT", "/api/admin/bots/"+itoa(id), admin, map[string]any{"active": false})
+	if code != http.StatusOK || stopped["active"] != false {
+		t.Fatalf("stop: %d %v", code, stopped["error"])
+	}
+	code, _ = e.doHeaders(t, "POST", "/api/bot/send", "", map[string]string{"X-Bot-Token": secret}, map[string]any{
+		"userId": sid, "text": "بعد از توقف",
+	})
+	if code != http.StatusUnauthorized {
+		t.Fatalf("stopped send: %d", code)
+	}
+	code, _ = e.doHeaders(t, "GET", "/api/bot/updates", "", map[string]string{"X-Bot-Token": secret}, nil)
+	if code != http.StatusUnauthorized {
+		t.Fatalf("stopped updates: %d", code)
+	}
+	code, list = e.do(t, "GET", "/api/admin/bots?page=1&pageSize=8", admin, nil)
+	assertBotListHidesSecret(t, list, secret)
+	item = findBotItem(t, list, "تست")
+	if item["active"] != false || item["requestCount"] != float64(2) {
+		t.Fatalf("after stop: active=%v count=%v", item["active"], item["requestCount"])
+	}
+}
+
+func findBotItem(t *testing.T, list map[string]any, name string) map[string]any {
+	t.Helper()
+	items, _ := list["items"].([]any)
+	for _, raw := range items {
+		row, _ := raw.(map[string]any)
+		if row["name"] == name {
+			return row
+		}
+	}
+	t.Fatalf("missing bot %s", name)
+	return nil
+}
+
+func assertBotListHidesSecret(t *testing.T, list map[string]any, secret string) {
+	t.Helper()
+	raw, err := json.Marshal(list)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if secret != "" && strings.Contains(string(raw), secret) {
+		t.Fatal("list included the bot secret")
+	}
+	var walk func(any)
+	walk = func(v any) {
+		switch x := v.(type) {
+		case map[string]any:
+			for k, child := range x {
+				switch k {
+				case "token", "tokenHash", "token_hash", "secret":
+					t.Fatalf("unexpected field %s", k)
+				}
+				walk(child)
+			}
+		case []any:
+			for _, child := range x {
+				walk(child)
+			}
+		}
+	}
+	walk(list)
+}

backend/internal/api/profile.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"encoding/json"
 	"errors"
 	"net/http"
 
@@ -22,21 +23,45 @@ func (s *Server) handlePublicProfile(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusInternalServerError, "بارگذاری پروفایل ممکن نشد")
 		return
 	}
+	u = s.settleAccount(r.Context(), u)
 	s.signUserMedia(u)
-	writeJSON(w, http.StatusOK, map[string]any{
-		"user": map[string]any{
-			"id":            u.ID,
-			"name":          u.Name,
-			"username":      u.Username,
-			"role":          u.Role,
-			"xp":            u.XP,
-			"hearts":        u.Hearts,
-			"streakCurrent": u.StreakCurrent,
-			"streakLongest": u.StreakLongest,
-			"avatarVariant": u.AvatarVariant,
-			"avatarPalette": u.AvatarPalette,
-			"avatarPhoto":   u.AvatarPhoto,
-			"isLocked":      u.IsLocked,
-		},
-	})
+	me := currentUser(r)
+	extras, err := s.store.GetProfileExtras(r.Context(), u.ID)
+	if err != nil {
+		extras = store.ProfileExtras{}
+	}
+	full := me.ID == u.ID || me.Role.IsStaff()
+	if !full && !extras.Public {
+		writeJSON(w, http.StatusOK, map[string]any{
+			"user": map[string]any{
+				"id": u.ID, "name": u.Name, "role": u.Role,
+				"avatarVariant": u.AvatarVariant, "avatarPalette": u.AvatarPalette, "avatarPhoto": u.AvatarPhoto,
+				"private": true, "isFrozen": u.IsFrozen, "isClosed": u.IsClosed,
+			},
+		})
+		return
+	}
+	view := map[string]any{
+		"id": u.ID, "name": u.Name, "username": u.Username, "role": u.Role,
+		"avatarVariant": u.AvatarVariant, "avatarPalette": u.AvatarPalette, "avatarPhoto": u.AvatarPhoto,
+		"private": false, "public": extras.Public,
+		"createdAt": u.CreatedAt,
+		"isFrozen":  u.IsFrozen, "isClosed": u.IsClosed,
+	}
+	if full || extras.ShowStats {
+		view["xp"] = u.XP
+		view["hearts"] = u.Hearts
+		view["streakCurrent"] = u.StreakCurrent
+		view["streakLongest"] = u.StreakLongest
+		view["isLocked"] = u.IsLocked
+	}
+	if full || extras.Public {
+		view["banner"] = s.signExistingMediaURL(extras.Banner)
+		links := extras.SocialLinks
+		if len(links) == 0 {
+			links = []byte(`[]`)
+		}
+		view["socialLinks"] = json.RawMessage(links)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"user": view})
 }

backend/internal/api/quiz.go

@@ -77,6 +77,10 @@ func (s *Server) handleQuizSubmit(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusForbidden, service.ErrQuizNotUnlocked.Error())
 		return
 	}
+	if !pg.PassedQuiz && !u.Role.IsStaff() && u.Hearts <= 0 {
+		writeErr(w, http.StatusForbidden, "جان‌ها تمام شده است. تا بازگشت یک جان صبر کنید.")
+		return
+	}
 
 	var req quizSubmitRequest
 	if err := bodyJSON(r, &req); err != nil {
@@ -154,16 +158,13 @@ func (s *Server) handleQuizSubmit(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 			if cert, created, cerr := s.issueCertificateIfEligible(r.Context(), activeUser); cerr == nil && created && cert != nil {
-				observability.Activity("certificate.issued", "user_id", u.ID, "public_id", cert.PublicID)
-				go func() {
-					_ = s.notify.Notify(context.Background(), u.ID, "progress", "certificate_issued",
-						"گواهینامه آماده است", "دوره را به پایان رساندید. گواهینامه دیجیتال شما صادر شد.", "/c/"+cert.PublicID, nil)
-				}()
+				observability.Activity("certificate.pending", "user_id", u.ID)
+				_ = s.notify.Notify(r.Context(), u.ID, "progress", "certificate_pending",
+					"درخواست گواهینامه ثبت شد", "دوره را با موفقیت به پایان رساندید. درخواست گواهینامه شما ثبت شد و پس از تأیید مدیریت صادر خواهد شد.", "/profile", nil)
+				_ = cert // pending; no publicId yet
 			}
-			go func() {
-				s.notifyQuizPassed(u.ID, lesson.Title, id, activeUser.StreakCurrent)
-				_ = s.notifyUnlockedLessons(u.ID, id)
-			}()
+			s.notifyQuizPassed(u.ID, lesson.Title, id, activeUser.StreakCurrent)
+			_ = s.notifyUnlockedLessons(u.ID, id)
 		}
 	} else if pg.PassedQuiz {
 		// Already cleared — practice attempts do not burn hearts.

backend/internal/api/rate_limit.go

@@ -282,8 +282,11 @@ func (s *Server) perUserRateLimit(limit int64, scope string, next http.HandlerFu
 // allowWSHandshake enforces a per-IP budget on WebSocket upgrades.
 // Returns false when the caller should receive 429 (already written by caller).
 func (s *Server) allowWSHandshake(r *http.Request) bool {
+	if s.cfg.DevMode {
+		return true
+	}
 	if s.redis == nil {
-		return s.cfg.DevMode
+		return false
 	}
 	ip := clientAddress(r)
 	if ip == "" {

backend/internal/api/router.go

@@ -101,8 +101,12 @@ func newRouter(s *Server) http.Handler {
 	mux.HandleFunc("POST /api/admin/users/{id}/reset-password", admin(s.handleAdminResetPassword))
 	mux.HandleFunc("GET /api/admin/physical-orders", admin(s.handleAdminListPhysicalOrders))
 	mux.HandleFunc("PUT /api/admin/physical-orders/{id}", admin(s.handleAdminUpdatePhysicalOrder))
+	mux.HandleFunc("GET /api/admin/certificates/pending", staff(s.handleAdminListPendingCertificates))
+	mux.HandleFunc("POST /api/admin/users/{id}/certificate/issue", staff(s.handleAdminIssueCertificate))
+	mux.HandleFunc("POST /api/admin/users/{id}/certificate/revoke", staff(s.handleAdminRevokeCertificate))
 	mux.HandleFunc("GET /api/admin/settings", admin(s.handleAdminGetSettings))
 	mux.HandleFunc("PUT /api/admin/settings", admin(s.handleAdminPutSettings))
+	mux.HandleFunc("POST /api/admin/contributor-avatar", admin(s.handleAdminContributorAvatarUpload))
 	mux.HandleFunc("GET /api/admin/chat-export", admin(s.handleAdminChatExport))
 	mux.HandleFunc("GET /api/admin/chat-export/stats", admin(s.handleAdminChatExportStats))
 	mux.HandleFunc("POST /api/admin/chat-export/restore", admin(s.handleAdminChatExportRestore))
@@ -127,11 +131,13 @@ func newRouter(s *Server) http.Handler {
 	mux.HandleFunc("POST /api/admin/chapters", staff(s.handleAdminCreateChapter))
 	mux.HandleFunc("PUT /api/admin/chapters/{id}", staff(s.handleAdminUpdateChapter))
 	mux.HandleFunc("DELETE /api/admin/chapters/{id}", staff(s.handleAdminDeleteChapter))
+	mux.HandleFunc("POST /api/admin/chapters/{id}/publish", staff(s.handleAdminPublishChapter))
 
 	mux.HandleFunc("GET /api/admin/lessons", staff(s.handleAdminListLessons))
 	mux.HandleFunc("POST /api/admin/lessons", staff(s.handleAdminCreateLesson))
 	mux.HandleFunc("PUT /api/admin/lessons/{id}", staff(s.handleAdminUpdateLesson))
 	mux.HandleFunc("DELETE /api/admin/lessons/{id}", staff(s.handleAdminDeleteLesson))
+	mux.HandleFunc("POST /api/admin/lessons/{id}/publish", staff(s.handleAdminPublishLesson))
 	mux.HandleFunc("GET /api/admin/lessons/{id}/questions", staff(s.handleAdminListQuestions))
 	mux.HandleFunc("POST /api/admin/lessons/{id}/questions", staff(s.handleAdminCreateQuestion))
 	mux.HandleFunc("PUT /api/admin/questions/{id}", staff(s.handleAdminUpdateQuestion))
@@ -152,6 +158,33 @@ func newRouter(s *Server) http.Handler {
 	mux.HandleFunc("DELETE /api/admin/challenges/{id}", admin(s.handleAdminDeleteChallenge))
 
 	mux.HandleFunc("POST /api/admin/announce", admin(s.handleAdminAnnounce))
+	mux.HandleFunc("GET /api/admin/announcements", admin(s.handleAdminListAnnouncements))
+	mux.HandleFunc("PUT /api/admin/announcements/{id}", admin(s.handleAdminUpdateAnnouncement))
+	mux.HandleFunc("DELETE /api/admin/announcements/{id}", admin(s.handleAdminDeleteAnnouncement))
+	mux.HandleFunc("GET /api/admin/bots", admin(s.handleAdminListBots))
+	mux.HandleFunc("POST /api/admin/bots", admin(s.handleCreateBot))
+	mux.HandleFunc("PUT /api/admin/bots/{id}", admin(s.handleAdminSetBotActive))
+	mux.HandleFunc("GET /api/announcements/pinned", s.requireAuth(s.handlePinnedAnnouncement))
+	mux.HandleFunc("PUT /api/chats/{partner}/prefs", s.requireAuth(s.handleChatPrefs))
+	mux.HandleFunc("POST /api/chats/mute-all", s.requireAuth(s.handleChatMuteAll))
+	mux.HandleFunc("GET /api/chats/{partner}/peek", s.requireAuth(s.handleChatPeek))
+	mux.HandleFunc("POST /api/chats/{partner}/unread", s.requireAuth(s.handleChatUnread))
+	mux.HandleFunc("DELETE /api/chats/{partner}", s.requireAuth(s.handleChatDeleteBoth))
+	mux.HandleFunc("POST /api/chats/broadcast", s.requireAuth(s.handleChatBroadcast))
+	mux.HandleFunc("GET /api/me/saved", s.requireAuth(s.handleListSaved))
+	mux.HandleFunc("POST /api/me/saved", s.requireAuth(s.handleSaveMessage))
+	mux.HandleFunc("GET /api/me/profile", s.requireAuth(s.handleGetMeProfile))
+	mux.HandleFunc("PUT /api/me/profile", s.requireAuth(s.handlePutMeProfile))
+	mux.HandleFunc("PUT /api/me/account", s.requireAuth(s.handleUpdateAccount))
+	mux.HandleFunc("POST /api/me/freeze", s.requireAuth(s.handleFreezeAccount))
+	mux.HandleFunc("POST /api/me/unfreeze", s.requireAuth(s.handleUnfreezeAccount))
+	mux.HandleFunc("PUT /api/me/username", s.requireAuth(s.handleUpdateUsername))
+	mux.HandleFunc("GET /api/me/achievements", s.requireAuth(s.handleMeAchievements))
+	mux.HandleFunc("GET /api/me/activity", s.requireAuth(s.handleMeActivity))
+	mux.HandleFunc("GET /api/me/export", s.requireAuth(s.handleMeExport))
+	mux.HandleFunc("GET /api/meta", s.handleMeta)
+	mux.HandleFunc("POST /api/bot/send", s.handleBotSend)
+	mux.HandleFunc("GET /api/bot/updates", s.handleBotUpdates)
 
 	return mux
 }

backend/internal/api/server.go

@@ -1,10 +1,12 @@
 package api
 
 import (
+	"context"
 	"net"
 	"net/http"
 	"net/url"
 	"strings"
+	"time"
 
 	"github.com/gorilla/websocket"
 	"github.com/redis/go-redis/v9"
@@ -31,6 +33,11 @@ type Server struct {
 
 func NewServer(cfg *config.Config, st *store.Store, rdb *redis.Client, stg storage.Storage) *Server {
 	hub := NewHub(rdb)
+	hub.SetSeen(func(userID int64) {
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		_ = st.TouchLastSeen(ctx, userID)
+	})
 	notifier := service.NewNotifier(st, hub)
 	trustedProxyConfig = cfg
 	return &Server{

backend/internal/api/settings.go

@@ -3,12 +3,15 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 	"unicode/utf8"
 
 	"pargar/backend/internal/observability"
+	"pargar/backend/internal/store"
 )
 
 func (s *Server) handleGetSponsors(w http.ResponseWriter, r *http.Request) {
@@ -41,12 +44,192 @@ func (s *Server) loadSponsors(ctx context.Context) []map[string]string {
 	return out
 }
 
+func (s *Server) loadSocials(ctx context.Context) []map[string]string {
+	raw, err := s.store.GetSetting(ctx, "social_links")
+	if err != nil || strings.TrimSpace(raw) == "" {
+		return []map[string]string{}
+	}
+	var list []map[string]string
+	if err := json.Unmarshal([]byte(raw), &list); err != nil {
+		return []map[string]string{}
+	}
+	out := make([]map[string]string, 0, len(list))
+	for _, item := range list {
+		name := strings.TrimSpace(item["name"])
+		url := strings.TrimSpace(item["url"])
+		if name == "" || url == "" {
+			continue
+		}
+		out = append(out, map[string]string{"name": name, "url": url})
+	}
+	return out
+}
+
+func validateSocialLinks(v string) string {
+	if v == "" {
+		return ""
+	}
+	var tmp []map[string]string
+	if err := json.Unmarshal([]byte(v), &tmp); err != nil {
+		return "فرمت شبکه‌ها نامعتبر است"
+	}
+	if len(tmp) > 8 {
+		return "حداکثر ۸ شبکه مجاز است"
+	}
+	for _, item := range tmp {
+		name := strings.TrimSpace(item["name"])
+		url := strings.TrimSpace(item["url"])
+		if name == "" || url == "" {
+			return "نام و لینک شبکه الزامی است"
+		}
+		if utf8.RuneCountInString(name) > 40 {
+			return "نام شبکه خیلی طولانی است"
+		}
+		if !strings.HasPrefix(url, "https://") && !strings.HasPrefix(url, "http://") {
+			return "لینک شبکه باید با http شروع شود"
+		}
+		if utf8.RuneCountInString(url) > 500 {
+			return "لینک شبکه خیلی طولانی است"
+		}
+	}
+	return ""
+}
+
+func (s *Server) loadContributors(ctx context.Context) []map[string]any {
+	raw, err := s.store.GetSetting(ctx, "contributors")
+	if err != nil || strings.TrimSpace(raw) == "" {
+		return []map[string]any{}
+	}
+	var list []map[string]any
+	if err := json.Unmarshal([]byte(raw), &list); err != nil {
+		return []map[string]any{}
+	}
+	out := make([]map[string]any, 0, len(list))
+	for _, item := range list {
+		name, _ := item["name"].(string)
+		if strings.TrimSpace(name) == "" {
+			continue
+		}
+		role, _ := item["role"].(string)
+		bio, _ := item["bio"].(string)
+		url, _ := item["url"].(string)
+		avatar, _ := item["avatar"].(string)
+		contributions, _ := item["contributions"].([]any)
+		cats := make([]string, 0, len(contributions))
+		for _, c := range contributions {
+			if s, ok := c.(string); ok && s != "" {
+				cats = append(cats, s)
+			}
+		}
+		out = append(out, map[string]any{
+			"name":          strings.TrimSpace(name),
+			"role":          strings.TrimSpace(role),
+			"bio":           strings.TrimSpace(bio),
+			"url":           strings.TrimSpace(url),
+			"avatar":        strings.TrimSpace(avatar),
+			"contributions": cats,
+		})
+	}
+	return out
+}
+
+func validateContributors(v string) string {
+	if v == "" || v == "[]" {
+		return ""
+	}
+	var tmp []map[string]any
+	if err := json.Unmarshal([]byte(v), &tmp); err != nil {
+		return "فرمت مشارکت‌کنندگان نامعتبر است"
+	}
+	if len(tmp) > 50 {
+		return "حداکثر ۵۰ مشارکت‌کننده مجاز است"
+	}
+	for _, item := range tmp {
+		name, _ := item["name"].(string)
+		if strings.TrimSpace(name) == "" {
+			return "نام مشارکت‌کننده الزامی است"
+		}
+		if utf8.RuneCountInString(strings.TrimSpace(name)) > 100 {
+			return "نام مشارکت‌کننده خیلی طولانی است"
+		}
+		if role, _ := item["role"].(string); utf8.RuneCountInString(strings.TrimSpace(role)) > 100 {
+			return "نقش مشارکت‌کننده خیلی طولانی است"
+		}
+		if bio, _ := item["bio"].(string); utf8.RuneCountInString(strings.TrimSpace(bio)) > 300 {
+			return "بیوگرافی خیلی طولانی است"
+		}
+		if url, _ := item["url"].(string); url != "" {
+			u := strings.TrimSpace(url)
+			if !strings.HasPrefix(u, "https://") && !strings.HasPrefix(u, "http://") {
+				return "لینک پروفایل باید با http شروع شود"
+			}
+			if utf8.RuneCountInString(u) > 500 {
+				return "لینک پروفایل خیلی طولانی است"
+			}
+		}
+		if contributions, ok := item["contributions"].([]any); ok {
+			if len(contributions) > 20 {
+				return "حداکثر ۲۰ دسته مشارکت برای هر نفر مجاز است"
+			}
+			for _, c := range contributions {
+				s, ok := c.(string)
+				if !ok {
+					return "دسته مشارکت باید رشته باشد"
+				}
+				s = strings.TrimSpace(s)
+				if s == "" {
+					return "دسته مشارکت نمی‌تواند خالی باشد"
+				}
+				if utf8.RuneCountInString(s) > 50 {
+					return "دسته مشارکت خیلی طولانی است"
+				}
+			}
+		}
+	}
+	return ""
+}
+
+func (s *Server) handleAdminContributorAvatarUpload(w http.ResponseWriter, r *http.Request) {
+	const maxSize = 6 << 20
+	r.Body = http.MaxBytesReader(w, r.Body, maxSize+1<<20)
+	if err := r.ParseMultipartForm(maxSize + 1<<20); err != nil {
+		writeErr(w, http.StatusRequestEntityTooLarge, "حجم فایل بیش از حد مجاز است")
+		return
+	}
+	file, h, err := r.FormFile("file")
+	if err != nil {
+		writeErr(w, http.StatusBadRequest, "فایل ارسال نشده است")
+		return
+	}
+	defer file.Close()
+	if h.Size > maxSize {
+		writeErr(w, http.StatusRequestEntityTooLarge, "حجم فایل باید کمتر از ۶ مگابایت باشد")
+		return
+	}
+	accepted, err := acceptAvatarImage(h, file)
+	if err != nil {
+		writeErr(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	key := fmt.Sprintf("contributor-avatars/%d%s", time.Now().UnixNano(), accepted.Ext)
+	rawURL, err := s.storage.Save(key, file, h.Size)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "ذخیرهٔ فایل ممکن نشد")
+		return
+	}
+	writeJSON(w, http.StatusCreated, map[string]any{"url": s.signExistingMediaURL(rawURL)})
+}
+
 func (s *Server) handleAdminGetSettings(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	keys := []string{
-		"donation_enabled", "donation_note",
 		"physical_cert_enabled", "physical_cert_price_irr", "physical_cert_window_days",
 		"sponsors",
+		"social_links",
+		"contributors",
+		"hearts_max",
+		"hearts_regen_minutes",
+		"hearts_lock_on_empty",
 		"registration_enabled",
 		"registration_require_whitelist",
 	}
@@ -58,15 +241,17 @@ func (s *Server) handleAdminGetSettings(w http.ResponseWriter, r *http.Request)
 			out[k] = ""
 		}
 	}
-	if strings.TrimSpace(out["donation_note"]) == "" {
-		out["donation_note"] = s.cfg.DonationNote
+	if strings.TrimSpace(out["social_links"]) == "" {
+		out["social_links"] = "[]"
 	}
-	if strings.TrimSpace(out["donation_enabled"]) == "" {
-		if s.cfg.DonationEnabled {
-			out["donation_enabled"] = "true"
-		} else {
-			out["donation_enabled"] = "false"
-		}
+	if strings.TrimSpace(out["hearts_max"]) == "" {
+		out["hearts_max"] = "5"
+	}
+	if strings.TrimSpace(out["hearts_regen_minutes"]) == "" {
+		out["hearts_regen_minutes"] = "240"
+	}
+	if strings.TrimSpace(out["hearts_lock_on_empty"]) == "" {
+		out["hearts_lock_on_empty"] = "false"
 	}
 	if strings.TrimSpace(out["physical_cert_enabled"]) == "" {
 		if s.cfg.PhysicalCertEnabled {
@@ -99,14 +284,17 @@ func (s *Server) handleAdminPutSettings(w http.ResponseWriter, r *http.Request)
 		return
 	}
 	allowed := map[string]bool{
-		"donation_enabled":               true,
-		"donation_note":                  true,
 		"physical_cert_enabled":          true,
 		"physical_cert_price_irr":        true,
 		"physical_cert_window_days":      true,
 		"sponsors":                       true,
 		"registration_enabled":           true,
 		"registration_require_whitelist": true,
+		"social_links":                   true,
+		"contributors":                   true,
+		"hearts_max":                     true,
+		"hearts_regen_minutes":           true,
+		"hearts_lock_on_empty":           true,
 	}
 	for k, v := range req.Settings {
 		if !allowed[k] {
@@ -114,7 +302,7 @@ func (s *Server) handleAdminPutSettings(w http.ResponseWriter, r *http.Request)
 		}
 		v = strings.TrimSpace(v)
 		switch k {
-		case "donation_enabled", "physical_cert_enabled", "registration_enabled", "registration_require_whitelist":
+		case "physical_cert_enabled", "registration_enabled", "registration_require_whitelist", "hearts_lock_on_empty":
 			if v == "1" || strings.EqualFold(v, "true") || v == "yes" {
 				v = "true"
 			} else {
@@ -162,9 +350,29 @@ func (s *Server) handleAdminPutSettings(w http.ResponseWriter, r *http.Request)
 					return
 				}
 			}
-		case "donation_note":
-			if utf8.RuneCountInString(v) > 2000 {
-				writeErr(w, http.StatusBadRequest, "یادداشت دونیت خیلی طولانی است")
+		case "social_links":
+			if msg := validateSocialLinks(v); msg != "" {
+				writeErr(w, http.StatusBadRequest, msg)
+				return
+			}
+		case "contributors":
+			if v == "" {
+				v = "[]"
+			}
+			if msg := validateContributors(v); msg != "" {
+				writeErr(w, http.StatusBadRequest, msg)
+				return
+			}
+		case "hearts_max":
+			n, err := strconv.Atoi(v)
+			if err != nil || n < 1 || n > store.MaxHearts {
+				writeErr(w, http.StatusBadRequest, "سقف قلب باید بین ۱ تا ۵ باشد")
+				return
+			}
+		case "hearts_regen_minutes":
+			n, err := strconv.Atoi(v)
+			if err != nil || n < 5 || n > 24*60 {
+				writeErr(w, http.StatusBadRequest, "فاصله بازگشت قلب باید بین ۵ تا ۱۴۴۰ دقیقه باشد")
 				return
 			}
 		}

backend/internal/api/surfaces_test.go

@@ -80,41 +80,88 @@ func TestChatReplaceAttachment(t *testing.T) {
 	msgID := int64(msg["id"].(float64))
 	oldPath := mediaPath(msg["attachment"].(map[string]any)["url"])
 
+	code, body = e.do(t, "PUT", "/api/chats/"+itoa(adminID)+"/messages/"+itoa(msgID), student, map[string]any{
+		"body": "کپشن صدا",
+	})
+	if code != 200 {
+		t.Fatalf("caption: %d %v", code, body)
+	}
+	captioned := body["message"].(map[string]any)
+	if captioned["body"] != "کپشن صدا" || captioned["editedAt"] == nil {
+		t.Fatalf("caption edit: %v", captioned)
+	}
+	if mediaPath(captioned["attachment"].(map[string]any)["url"]) != oldPath {
+		t.Fatalf("caption edit replaced the file: %v", captioned)
+	}
+
+	code, body = e.do(t, "PUT", "/api/chats/"+itoa(adminID)+"/messages/"+itoa(msgID), student, map[string]any{
+		"body": "",
+	})
+	if code != 200 {
+		t.Fatalf("clear caption: %d %v", code, body)
+	}
+	cleared := body["message"].(map[string]any)
+	if cleared["body"] != "" || mediaPath(cleared["attachment"].(map[string]any)["url"]) != oldPath {
+		t.Fatalf("empty caption should keep the file: %v", cleared)
+	}
+
 	png[8] = 0x01
 	code, up = uploadChatFile(t, e, student, "two.png", png)
+	if code != 201 {
+		t.Fatalf("upload extra: %d %v", code, up)
+	}
+	extra := up["attachment"].(map[string]any)
+	code, body = e.do(t, "PUT", "/api/chats/"+itoa(adminID)+"/messages/"+itoa(msgID), student, map[string]any{
+		"body":       "کپشن صدا",
+		"attachment": extra,
+	})
+	if code != 200 {
+		t.Fatalf("append: %d %v", code, body)
+	}
+	appended := body["message"].(map[string]any)
+	appendedAtts := appended["attachments"].([]any)
+	if len(appendedAtts) != 2 || mediaPath(appendedAtts[0].(map[string]any)["url"]) != oldPath {
+		t.Fatalf("append wiped the original: %v", appended)
+	}
+	if mediaPath(appendedAtts[1].(map[string]any)["url"]) == "" || mediaPath(appendedAtts[1].(map[string]any)["url"]) == oldPath {
+		t.Fatalf("appended file: %v", appendedAtts)
+	}
+
+	png[8] = 0x02
+	code, up = uploadChatFile(t, e, student, "three.png", png)
 	if code != 201 {
 		t.Fatalf("upload replacement: %d %v", code, up)
 	}
 	next := up["attachment"].(map[string]any)
-
 	code, body = e.do(t, "PUT", "/api/chats/"+itoa(adminID)+"/messages/"+itoa(msgID), student, map[string]any{
-		"body":       "",
-		"attachment": next,
+		"body":         "کپشن صدا",
+		"replacements": []any{map[string]any{"index": 0, "attachment": next}},
 	})
 	if code != 200 {
 		t.Fatalf("replace: %d %v", code, body)
 	}
 	edited := body["message"].(map[string]any)
-	newPath := mediaPath(edited["attachment"].(map[string]any)["url"])
-	if edited["editedAt"] == nil || newPath == "" || newPath == oldPath {
-		t.Fatalf("expected a replaced attachment, old %s new %v", oldPath, edited)
+	editedAtts := edited["attachments"].([]any)
+	newPath := mediaPath(editedAtts[0].(map[string]any)["url"])
+	if edited["editedAt"] == nil || len(editedAtts) != 2 || newPath == "" || newPath == oldPath {
+		t.Fatalf("expected only the first file to be replaced, got %v", edited)
 	}
-	if edited["attachment"].(map[string]any)["type"] != "image" {
-		t.Fatalf("type: %v", edited["attachment"])
+	if mediaPath(editedAtts[1].(map[string]any)["url"]) != mediaPath(extra["url"]) {
+		t.Fatalf("replace dropped the added file: %v", editedAtts)
 	}
 
 	wrong := map[string]any{"type": "video", "url": next["url"], "name": "clip.mp4", "size": next["size"]}
 	code, _ = e.do(t, "PUT", "/api/chats/"+itoa(adminID)+"/messages/"+itoa(msgID), student, map[string]any{
-		"body":       "",
-		"attachment": wrong,
+		"body":         "کپشن صدا",
+		"replacements": []any{map[string]any{"index": 0, "attachment": wrong}},
 	})
-	if code != 404 {
-		t.Fatalf("different kind should miss: %d", code)
+	if code != 400 {
+		t.Fatalf("different kind should be rejected: %d", code)
 	}
 
 	code, _ = e.do(t, "PUT", "/api/chats/"+itoa(adminID)+"/messages/"+itoa(msgID), student, map[string]any{
-		"body":       "",
-		"attachment": map[string]any{"type": "file", "url": next["url"], "name": "x.pdf", "size": 1},
+		"body":         "",
+		"replacements": []any{map[string]any{"index": 0, "attachment": map[string]any{"type": "file", "url": next["url"], "name": "x.pdf", "size": 1}}},
 	})
 	if code != 400 {
 		t.Fatalf("file replace: %d", code)
@@ -124,8 +171,8 @@ func TestChatReplaceAttachment(t *testing.T) {
 		"body":       "",
 		"attachment": next,
 	})
-	if code != 400 {
-		t.Fatalf("partner replace: %d", code)
+	if code != 404 {
+		t.Fatalf("partner edit should be rejected: %d", code)
 	}
 }
 
@@ -179,6 +226,110 @@ func TestChatReadMarksOnlyIncoming(t *testing.T) {
 	}
 }
 
+func TestChatSendMultipleAttachments(t *testing.T) {
+	e := setup(t)
+	student, _ := register(t, e, "Album Student", "album-student@test.dev")
+	admin := login(t, e, bootstrapAdminEmail)
+	code, me := e.do(t, "GET", "/api/auth/me", admin, nil)
+	if code != 200 {
+		t.Fatalf("me: %d %v", code, me)
+	}
+	adminID := int64(me["user"].(map[string]any)["id"].(float64))
+
+	png := []byte{0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00}
+	code, up1 := uploadChatFile(t, e, student, "one.png", png)
+	if code != 201 {
+		t.Fatalf("upload one: %d %v", code, up1)
+	}
+	png[8] = 0x01
+	code, up2 := uploadChatFile(t, e, student, "two.png", png)
+	if code != 201 {
+		t.Fatalf("upload two: %d %v", code, up2)
+	}
+	a := up1["attachment"].(map[string]any)
+	b := up2["attachment"].(map[string]any)
+
+	code, body := e.do(t, "POST", "/api/chats/"+itoa(adminID)+"/messages", student, map[string]any{
+		"body":        "کپشن مشترک",
+		"attachments": []any{a, b},
+	})
+	if code != 201 {
+		t.Fatalf("send album: %d %v", code, body)
+	}
+	msg := body["message"].(map[string]any)
+	if msg["body"] != "کپشن مشترک" {
+		t.Fatalf("caption: %v", msg["body"])
+	}
+	atts := msg["attachments"].([]any)
+	if len(atts) != 2 {
+		t.Fatalf("attachments: %v", msg["attachments"])
+	}
+	if mediaPath(atts[0].(map[string]any)["url"]) == "" || mediaPath(atts[0].(map[string]any)["url"]) == mediaPath(atts[1].(map[string]any)["url"]) {
+		t.Fatalf("photo urls: %v", atts)
+	}
+	if mediaPath(msg["attachment"].(map[string]any)["url"]) != mediaPath(atts[0].(map[string]any)["url"]) {
+		t.Fatalf("first attachment should mirror the album: %v", msg["attachment"])
+	}
+	msgID := int64(msg["id"].(float64))
+
+	code, body = e.do(t, "GET", "/api/chats/"+itoa(adminID)+"/messages", student, nil)
+	if code != 200 {
+		t.Fatalf("list: %d %v", code, body)
+	}
+	listed := chatMsg(t, body, msgID)
+	if listed["readAt"] != nil {
+		t.Fatalf("own album was marked seen: %v", listed)
+	}
+	listedAtts := listed["attachments"].([]any)
+	if len(listedAtts) != 2 || listed["body"] != "کپشن مشترک" {
+		t.Fatalf("listed album: %v", listed)
+	}
+
+	code, body = e.do(t, "PUT", "/api/chats/"+itoa(adminID)+"/messages/"+itoa(msgID), student, map[string]any{
+		"body": "کپشن ویرایش‌شده",
+	})
+	if code != 200 {
+		t.Fatalf("album caption: %d %v", code, body)
+	}
+	albumEdit := body["message"].(map[string]any)
+	albumAtts := albumEdit["attachments"].([]any)
+	if albumEdit["body"] != "کپشن ویرایش‌شده" || len(albumAtts) != 2 {
+		t.Fatalf("album caption edit: %v", albumEdit)
+	}
+	if mediaPath(albumAtts[0].(map[string]any)["url"]) != mediaPath(atts[0].(map[string]any)["url"]) ||
+		mediaPath(albumAtts[1].(map[string]any)["url"]) != mediaPath(atts[1].(map[string]any)["url"]) {
+		t.Fatalf("album caption edit changed photos: %v", albumAtts)
+	}
+
+	code, up3 := uploadChatFile(t, e, student, "notes.txt", []byte("hello"))
+	if code != 201 {
+		t.Fatalf("upload txt: %d %v", code, up3)
+	}
+	code, up4 := uploadChatFile(t, e, student, "more.txt", []byte("world"))
+	if code != 201 {
+		t.Fatalf("upload txt 2: %d %v", code, up4)
+	}
+	code, body = e.do(t, "POST", "/api/chats/"+itoa(adminID)+"/messages", student, map[string]any{
+		"attachments": []any{up3["attachment"], up4["attachment"]},
+	})
+	if code != 201 {
+		t.Fatalf("send files: %d %v", code, body)
+	}
+	files := body["message"].(map[string]any)["attachments"].([]any)
+	if len(files) != 2 || files[0].(map[string]any)["type"] != "file" || files[1].(map[string]any)["name"] != "more.txt" {
+		t.Fatalf("files: %v", files)
+	}
+
+	many := make([]any, 0, 11)
+	for i := 0; i < 11; i++ {
+		many = append(many, a)
+	}
+	code, _ = e.do(t, "POST", "/api/chats/"+itoa(adminID)+"/messages", student, map[string]any{"attachments": many})
+	if code != 400 {
+		t.Fatalf("too many: %d", code)
+	}
+}
+
 func chatMsg(t *testing.T, body map[string]any, id int64) map[string]any {
 	t.Helper()
 	for _, raw := range body["messages"].([]any) {

backend/internal/api/tree.go

@@ -57,6 +57,23 @@ func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// Compute progress aggregates using only active+published lessons as the denominator so
+	// that frontend and backend always agree on the percentage.
+	totalActive, completedActive := 0, 0
+	for _, l := range lessons {
+		if !l.IsActive || !l.IsPublished {
+			continue
+		}
+		totalActive++
+		if p, ok := progress[l.ID]; ok && p.PassedQuiz {
+			completedActive++
+		}
+	}
+	var progressPct float64
+	if totalActive > 0 {
+		progressPct = float64(completedActive) / float64(totalActive) * 100
+	}
+
 	out := make([]chapterView, 0, len(chapters))
 	for _, ch := range chapters {
 		cv := chapterView{Chapter: ch, Lessons: []lessonView{}}
@@ -84,7 +101,10 @@ func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
 	}
 
 	writeJSON(w, http.StatusOK, map[string]any{
-		"chapters": out,
+		"chapters":        out,
+		"totalLessons":    totalActive,
+		"completedLessons": completedActive,
+		"progressPct":     progressPct,
 		"me": map[string]any{
 			"xp":       u.XP,
 			"streak":   u.StreakCurrent,
@@ -244,7 +264,7 @@ func (s *Server) allowLessonAccess(w http.ResponseWriter, r *http.Request, lesso
 		writeErrCode(w, http.StatusLocked, CodeLocked, service.ErrLocked.Error())
 		return false
 	}
-	if !lesson.IsActive && !u.Role.IsStaff() {
+	if (!lesson.IsActive || !lesson.IsPublished) && !u.Role.IsStaff() {
 		writeErrCode(w, http.StatusNotFound, CodeNotFound, "درس پیدا نشد")
 		return false
 	}

backend/internal/api/ws.go

@@ -16,9 +16,10 @@ const pushChannel = "pargar:push"
 // Hub manages per-user websocket connections and fans out messages.
 // Messages are published on a shared Redis channel so all instances deliver to their own local clients.
 type Hub struct {
-	mu    sync.RWMutex
-	conns map[int64]map[*Client]struct{}
-	rdb   *redis.Client
+	mu     sync.RWMutex
+	conns  map[int64]map[*Client]struct{}
+	rdb    *redis.Client
+	onSeen func(userID int64)
 }
 
 type Client struct {
@@ -84,6 +85,26 @@ func (h *Hub) Online(userID int64) bool {
 	return len(h.conns[userID]) > 0
 }
 
+// SetSeen records a callback invoked when a user connects, stays connected, or disconnects.
+func (h *Hub) SetSeen(fn func(userID int64)) {
+	h.mu.Lock()
+	h.onSeen = fn
+	h.mu.Unlock()
+}
+
+func (h *Hub) noteSeen(userID int64) {
+	if userID == 0 {
+		return
+	}
+	h.mu.RLock()
+	fn := h.onSeen
+	h.mu.RUnlock()
+	if fn == nil {
+		return
+	}
+	go fn(userID)
+}
+
 // Register adds a new client connection for a user.
 func (h *Hub) Register(userID int64, conn *websocket.Conn) *Client {
 	c := &Client{hub: h, conn: conn, user: userID, send: make(chan []byte, 16)}
@@ -93,23 +114,29 @@ func (h *Hub) Register(userID int64, conn *websocket.Conn) *Client {
 	}
 	h.conns[userID][c] = struct{}{}
 	h.mu.Unlock()
+	h.noteSeen(userID)
 	go c.writePump()
 	go c.readPump()
 	return c
 }
 
 func (h *Hub) Unregister(c *Client) {
+	offline := false
 	h.mu.Lock()
 	if set, ok := h.conns[c.user]; ok {
 		if _, ok := set[c]; ok {
 			delete(set, c)
 			if len(set) == 0 {
 				delete(h.conns, c.user)
+				offline = true
 			}
 		}
 	}
 	h.mu.Unlock()
 	close(c.send)
+	if offline {
+		h.noteSeen(c.user)
+	}
 }
 
 // close unregisters the client and closes its connection exactly once,
@@ -148,6 +175,7 @@ func (c *Client) writePump() {
 			if err := c.conn.WriteMessage(websocket.PingMessage, nil); err != nil {
 				return
 			}
+			c.hub.noteSeen(c.user)
 		}
 	}
 }

backend/internal/db/migrate.go

@@ -11,9 +11,26 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
+// migrateLockID is held for the whole migration pass so two replicas cannot
+// apply the same file at once. The lock lives on one pooled connection and
+// is released when that session ends.
+const migrateLockID int64 = 764727013
+
 // Migrate runs all *.sql files in the migrations fs in lexicographic order.
 // Tracks applied migrations in schema_migrations.
 func Migrate(ctx context.Context, pool *pgxpool.Pool, migrations fs.FS) error {
+	conn, err := pool.Acquire(ctx)
+	if err != nil {
+		return fmt.Errorf("migrate lock: %w", err)
+	}
+	defer conn.Release()
+	if _, err := conn.Exec(ctx, `SELECT pg_advisory_lock($1)`, migrateLockID); err != nil {
+		return fmt.Errorf("migrate lock: %w", err)
+	}
+	defer func() {
+		_, _ = conn.Exec(context.Background(), `SELECT pg_advisory_unlock($1)`, migrateLockID)
+	}()
+
 	if _, err := pool.Exec(ctx, `CREATE TABLE IF NOT EXISTS schema_migrations (version TEXT PRIMARY KEY, applied_at TIMESTAMPTZ NOT NULL DEFAULT now())`); err != nil {
 		return fmt.Errorf("create migrations table: %w", err)
 	}

backend/internal/db/migrate_upgrade_test.go

@@ -0,0 +1,192 @@
+package db
+
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"testing/fstest"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func TestMigrateFromV013Schema(t *testing.T) {
+	user := os.Getenv("POSTGRES_USER")
+	password := os.Getenv("POSTGRES_PASSWORD")
+	if user == "" || password == "" {
+		t.Skip("postgres env not set")
+	}
+	host := "127.0.0.1"
+	port := "5432"
+	adminURL := fmt.Sprintf("postgres://%s:%s@%s:%s/postgres?sslmode=disable", user, password, host, port)
+	ctx := context.Background()
+	admin, err := pgxpool.New(ctx, adminURL)
+	if err != nil {
+		t.Skipf("postgres unavailable: %v", err)
+	}
+	defer admin.Close()
+	if err := admin.Ping(ctx); err != nil {
+		t.Skipf("postgres unavailable: %v", err)
+	}
+
+	const name = "pargar_upgrade_test"
+	_, _ = admin.Exec(ctx, `DROP DATABASE IF EXISTS `+name+` WITH (FORCE)`)
+	if _, err := admin.Exec(ctx, `CREATE DATABASE `+name); err != nil {
+		t.Fatalf("create database: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = admin.Exec(context.Background(), `DROP DATABASE IF EXISTS `+name+` WITH (FORCE)`)
+	})
+
+	url := fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=disable", user, password, host, port, name)
+	pool, err := Connect(ctx, url)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer pool.Close()
+
+	sub, err := fs.Sub(MigrationFiles, "migrations")
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacy := fstest.MapFS{}
+	entries, err := fs.ReadDir(sub, ".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".sql") || entry.Name() >= "0023" {
+			continue
+		}
+		body, err := fs.ReadFile(sub, entry.Name())
+		if err != nil {
+			t.Fatal(err)
+		}
+		legacy[entry.Name()] = &fstest.MapFile{Data: body}
+	}
+	if len(legacy) == 0 {
+		t.Fatal("no v0.1.3 migrations")
+	}
+	if err := Migrate(ctx, pool, legacy); err != nil {
+		t.Fatalf("migrate through 0022: %v", err)
+	}
+
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO users (name, email, username, password_hash, role, hearts)
+		VALUES ('legacy', 'legacy@example.com', 'legacy', 'x', 'student', 3)`); err != nil {
+		t.Fatalf("seed hearts=3: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO users (name, email, username, password_hash, role, hearts)
+		VALUES ('over', 'over@example.com', 'over', 'x', 'student', 5)`); err == nil {
+		t.Fatal("hearts=5 was accepted on the v0.1.3 constraint")
+	}
+
+	if err := Migrate(ctx, pool, sub); err != nil {
+		t.Fatalf("upgrade 0023-0028: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO users (name, email, username, password_hash, role, hearts)
+		VALUES ('over', 'over@example.com', 'over', 'x', 'student', 5)`); err != nil {
+		t.Fatalf("hearts=5 after upgrade: %v", err)
+	}
+
+	var hearts int
+	var locked bool
+	if err := pool.QueryRow(ctx, `SELECT hearts, is_locked FROM users WHERE email='legacy@example.com'`).Scan(&hearts, &locked); err != nil {
+		t.Fatal(err)
+	}
+	if hearts != 3 || locked {
+		t.Fatalf("legacy account changed: hearts=%d locked=%v", hearts, locked)
+	}
+
+	var constraint string
+	if err := pool.QueryRow(ctx, `SELECT pg_get_constraintdef(oid) FROM pg_constraint WHERE conname='users_hearts_max'`).Scan(&constraint); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(constraint, "5") {
+		t.Fatalf("hearts constraint: %s", constraint)
+	}
+
+	var labels string
+	if err := pool.QueryRow(ctx, `
+		SELECT string_agg(e.enumlabel, ',' ORDER BY e.enumsortorder)
+		FROM pg_enum e
+		JOIN pg_type t ON t.oid = e.enumtypid
+		WHERE t.typname = 'notif_category'`).Scan(&labels); err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"urgent", "curriculum", "community", "system"} {
+		if !strings.Contains(labels, want) {
+			t.Fatalf("enum %s missing from %s", want, labels)
+		}
+	}
+
+	var cols int
+	if err := pool.QueryRow(ctx, `
+		SELECT count(*) FROM information_schema.columns
+		WHERE table_name='users' AND column_name IN ('last_seen_at','username_change_count','frozen_at','closed_at')`).Scan(&cols); err != nil {
+		t.Fatal(err)
+	}
+	if cols != 4 {
+		t.Fatalf("user columns: %d", cols)
+	}
+	var attachments bool
+	if err := pool.QueryRow(ctx, `
+		SELECT EXISTS (
+			SELECT 1 FROM information_schema.columns
+			WHERE table_name='chat_messages' AND column_name='attachments'
+		)`).Scan(&attachments); err != nil {
+		t.Fatal(err)
+	}
+	if !attachments {
+		t.Fatal("chat attachments column missing")
+	}
+	var botCols int
+	if err := pool.QueryRow(ctx, `
+		SELECT count(*) FROM information_schema.columns
+		WHERE table_name='bot_tokens' AND column_name IN ('request_count','revoked_at')`).Scan(&botCols); err != nil {
+		t.Fatal(err)
+	}
+	if botCols != 2 {
+		t.Fatalf("bot token columns: %d", botCols)
+	}
+
+	var before int
+	if err := pool.QueryRow(ctx, `SELECT count(*) FROM schema_migrations`).Scan(&before); err != nil {
+		t.Fatal(err)
+	}
+	if err := Migrate(ctx, pool, sub); err != nil {
+		t.Fatalf("second migrate: %v", err)
+	}
+	var after int
+	if err := pool.QueryRow(ctx, `SELECT count(*) FROM schema_migrations`).Scan(&after); err != nil {
+		t.Fatal(err)
+	}
+	if before != after {
+		t.Fatalf("repeat migrate wrote rows: %d -> %d", before, after)
+	}
+
+	lockCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	var wg sync.WaitGroup
+	errCh := make(chan error, 2)
+	for range 2 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errCh <- Migrate(lockCtx, pool, sub)
+		}()
+	}
+	wg.Wait()
+	close(errCh)
+	for err := range errCh {
+		if err != nil {
+			t.Fatalf("parallel migrate: %v", err)
+		}
+	}
+}

backend/internal/db/migrations/0023_product_pass.sql

@@ -0,0 +1,71 @@
+ALTER TYPE notif_category ADD VALUE IF NOT EXISTS 'urgent';
+ALTER TYPE notif_category ADD VALUE IF NOT EXISTS 'curriculum';
+ALTER TYPE notif_category ADD VALUE IF NOT EXISTS 'community';
+ALTER TYPE notif_category ADD VALUE IF NOT EXISTS 'system';
+
+CREATE TABLE IF NOT EXISTS announcements (
+    id         BIGSERIAL PRIMARY KEY,
+    title      TEXT NOT NULL,
+    body       TEXT NOT NULL,
+    category   TEXT NOT NULL DEFAULT 'event',
+    route      TEXT NOT NULL DEFAULT '',
+    pinned     BOOLEAN NOT NULL DEFAULT false,
+    created_by BIGINT REFERENCES users(id),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+ALTER TABLE notifications ADD COLUMN IF NOT EXISTS announcement_id BIGINT REFERENCES announcements(id) ON DELETE CASCADE;
+
+CREATE TABLE IF NOT EXISTS chat_prefs (
+    user_id     BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    partner_id  BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    pinned_rank INT,
+    muted       BOOLEAN NOT NULL DEFAULT false,
+    archived    BOOLEAN NOT NULL DEFAULT false,
+    PRIMARY KEY (user_id, partner_id)
+);
+
+ALTER TABLE users ADD COLUMN IF NOT EXISTS chat_muted_all BOOLEAN NOT NULL DEFAULT false;
+
+CREATE TABLE IF NOT EXISTS saved_messages (
+    id               BIGSERIAL PRIMARY KEY,
+    user_id          BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    body             TEXT NOT NULL DEFAULT '',
+    attachment_url   TEXT NOT NULL DEFAULT '',
+    attachment_type  TEXT NOT NULL DEFAULT '',
+    attachment_name  TEXT NOT NULL DEFAULT '',
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS user_profiles (
+    user_id         BIGINT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    banner_photo    TEXT NOT NULL DEFAULT '',
+    profile_public  BOOLEAN NOT NULL DEFAULT false,
+    show_activity   BOOLEAN NOT NULL DEFAULT true,
+    show_stats      BOOLEAN NOT NULL DEFAULT true,
+    show_path       BOOLEAN NOT NULL DEFAULT true,
+    show_badges     BOOLEAN NOT NULL DEFAULT true,
+    social_links    JSONB NOT NULL DEFAULT '[]',
+    theme           TEXT NOT NULL DEFAULT 'system'
+);
+
+CREATE TABLE IF NOT EXISTS bot_tokens (
+    id          BIGSERIAL PRIMARY KEY,
+    bot_user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    owner_id    BIGINT NOT NULL REFERENCES users(id),
+    token_hash  TEXT NOT NULL UNIQUE,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS bot_updates (
+    id          BIGSERIAL PRIMARY KEY,
+    bot_user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    payload     JSONB NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+ALTER TABLE chat_messages ADD COLUMN IF NOT EXISTS buttons JSONB NOT NULL DEFAULT '[]';
+ALTER TABLE users ALTER COLUMN hearts SET DEFAULT 5;
+ALTER TABLE users DROP CONSTRAINT IF EXISTS users_hearts_max;
+ALTER TABLE users ADD CONSTRAINT users_hearts_max CHECK (hearts BETWEEN 0 AND 5);

backend/internal/db/migrations/0024_last_seen.sql

@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN IF NOT EXISTS last_seen_at TIMESTAMPTZ;

backend/internal/db/migrations/0025_chat_attachments_json.sql

@@ -0,0 +1,2 @@
+ALTER TABLE chat_messages
+    ADD COLUMN IF NOT EXISTS attachments JSONB;

backend/internal/db/migrations/0026_username_change_quota.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN IF NOT EXISTS username_change_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE users ADD COLUMN IF NOT EXISTS username_cooldown_until TIMESTAMPTZ;

backend/internal/db/migrations/0027_account_freeze.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN IF NOT EXISTS frozen_at TIMESTAMPTZ;
+ALTER TABLE users ADD COLUMN IF NOT EXISTS closed_at TIMESTAMPTZ;

backend/internal/db/migrations/0028_bot_token_admin.sql

@@ -0,0 +1,2 @@
+ALTER TABLE bot_tokens ADD COLUMN IF NOT EXISTS request_count BIGINT NOT NULL DEFAULT 0;
+ALTER TABLE bot_tokens ADD COLUMN IF NOT EXISTS revoked_at TIMESTAMPTZ;

backend/internal/db/migrations/0029_lesson_delete_cascades.sql

@@ -0,0 +1,26 @@
+-- 0029_lesson_delete_cascades.sql
+-- Make deleting a lesson (directly, or via its chapter) work cleanly.
+--
+-- Previously only mcq_questions cascaded; watch/quiz history blocked the delete
+-- with a 500. Progress/history rows now go away with the lesson, while lessons
+-- that merely *required* the deleted one are unlinked (never deleted).
+
+ALTER TABLE watch_sessions DROP CONSTRAINT IF EXISTS watch_sessions_lesson_id_fkey;
+ALTER TABLE watch_sessions ADD CONSTRAINT watch_sessions_lesson_id_fkey
+    FOREIGN KEY (lesson_id) REFERENCES lessons(id) ON DELETE CASCADE;
+
+ALTER TABLE watch_heartbeats DROP CONSTRAINT IF EXISTS watch_heartbeats_lesson_id_fkey;
+ALTER TABLE watch_heartbeats ADD CONSTRAINT watch_heartbeats_lesson_id_fkey
+    FOREIGN KEY (lesson_id) REFERENCES lessons(id) ON DELETE CASCADE;
+
+ALTER TABLE lesson_progress DROP CONSTRAINT IF EXISTS lesson_progress_lesson_id_fkey;
+ALTER TABLE lesson_progress ADD CONSTRAINT lesson_progress_lesson_id_fkey
+    FOREIGN KEY (lesson_id) REFERENCES lessons(id) ON DELETE CASCADE;
+
+ALTER TABLE quiz_attempts DROP CONSTRAINT IF EXISTS quiz_attempts_lesson_id_fkey;
+ALTER TABLE quiz_attempts ADD CONSTRAINT quiz_attempts_lesson_id_fkey
+    FOREIGN KEY (lesson_id) REFERENCES lessons(id) ON DELETE CASCADE;
+
+ALTER TABLE lessons DROP CONSTRAINT IF EXISTS lessons_requires_lesson_id_fkey;
+ALTER TABLE lessons ADD CONSTRAINT lessons_requires_lesson_id_fkey
+    FOREIGN KEY (requires_lesson_id) REFERENCES lessons(id) ON DELETE SET NULL;

backend/internal/db/migrations/0030_lesson_draft_status.sql

@@ -0,0 +1,9 @@
+-- Add draft/published state to chapters and lessons.
+-- Existing content is published immediately so nothing goes dark on deploy.
+-- New lessons created via the admin API default to is_published = false (draft).
+
+ALTER TABLE lessons  ADD COLUMN IF NOT EXISTS is_published BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE chapters ADD COLUMN IF NOT EXISTS is_published BOOLEAN NOT NULL DEFAULT false;
+
+UPDATE lessons  SET is_published = true;
+UPDATE chapters SET is_published = true;

backend/internal/db/migrations/0031_certificate_approval.sql

@@ -0,0 +1,13 @@
+-- Add manual approval flow for certificates.
+-- Existing certs keep status='issued'. New completions create status='pending'
+-- until an admin or mentor explicitly issues the certificate.
+
+ALTER TABLE certificates ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'issued';
+ALTER TABLE certificates ALTER COLUMN public_id DROP NOT NULL;
+
+UPDATE certificates SET status = 'issued';
+
+INSERT INTO app_settings (key, value) VALUES
+  ('certificate_enabled', 'true'),
+  ('certificate_requires_approval', 'true')
+ON CONFLICT (key) DO NOTHING;

backend/internal/db/migrations/0032_contributors.sql

@@ -0,0 +1,6 @@
+-- Add contributors setting key. Seed one verified entry (sole git author).
+-- Admins can update via the site settings panel.
+INSERT INTO app_settings (key, value) VALUES (
+  'contributors',
+  '[{"name":"Amir Husayn Panahifar","role":"بنیان‌گذار و توسعه‌دهنده","bio":"","url":"","avatar":"","contributions":["code"]}]'
+) ON CONFLICT (key) DO NOTHING;

backend/internal/models/models.go

@@ -21,41 +21,97 @@ func (r Role) IsStaff() bool {
 }
 
 type User struct {
-	ID                 int64      `json:"id"`
-	Email              string     `json:"email"`
-	Username           string     `json:"username"`
-	PasswordHash       string     `json:"-"`
-	Name               string     `json:"name"`
-	Role               Role       `json:"role"`
-	XP                 int        `json:"xp"`
-	Hearts             int        `json:"hearts"`
-	HeartsUpdatedAt    time.Time  `json:"heartsUpdatedAt"`
-	StreakCurrent      int        `json:"streakCurrent"`
-	StreakLongest      int        `json:"streakLongest"`
-	LastActivityDate   *time.Time `json:"lastActivityDate,omitempty"`
-	IsLocked           bool       `json:"isLocked"`
-	LockedAt           *time.Time `json:"lockedAt,omitempty"`
-	UnlockedBy         *int64     `json:"unlockedBy,omitempty"`
-	IsActive           bool       `json:"isActive"`
-	AvatarVariant      string     `json:"avatarVariant"`
-	AvatarPalette      string     `json:"avatarPalette"`
-	AvatarPhoto        string     `json:"avatarPhoto,omitempty"`
-	Phone              string     `json:"phone"`
-	TelegramID         *int64     `json:"-"`
-	TelegramUsername   string     `json:"-"`
-	SecurityQuestion   string     `json:"securityQuestion,omitempty"`
-	SecurityAnswerHash string     `json:"-"`
-	HasSecurityAnswer  bool       `json:"hasSecurityAnswer"`
-	CreatedAt          time.Time  `json:"createdAt"`
+	ID                       int64      `json:"id"`
+	Email                    string     `json:"email"`
+	Username                 string     `json:"username"`
+	PasswordHash             string     `json:"-"`
+	Name                     string     `json:"name"`
+	Role                     Role       `json:"role"`
+	XP                       int        `json:"xp"`
+	Hearts                   int        `json:"hearts"`
+	HeartsUpdatedAt          time.Time  `json:"heartsUpdatedAt"`
+	StreakCurrent            int        `json:"streakCurrent"`
+	StreakLongest            int        `json:"streakLongest"`
+	LastActivityDate         *time.Time `json:"lastActivityDate,omitempty"`
+	IsLocked                 bool       `json:"isLocked"`
+	LockedAt                 *time.Time `json:"lockedAt,omitempty"`
+	UnlockedBy               *int64     `json:"unlockedBy,omitempty"`
+	IsActive                 bool       `json:"isActive"`
+	AvatarVariant            string     `json:"avatarVariant"`
+	AvatarPalette            string     `json:"avatarPalette"`
+	AvatarPhoto              string     `json:"avatarPhoto,omitempty"`
+	Phone                    string     `json:"phone"`
+	TelegramID               *int64     `json:"-"`
+	TelegramUsername         string     `json:"-"`
+	SecurityQuestion         string     `json:"securityQuestion,omitempty"`
+	SecurityAnswerHash       string     `json:"-"`
+	HasSecurityAnswer        bool       `json:"hasSecurityAnswer"`
+	CreatedAt                time.Time  `json:"createdAt"`
+	UsernameChangeCount      int        `json:"-"`
+	UsernameCooldownUntil    *time.Time `json:"usernameCooldownUntil,omitempty"`
+	UsernameChangesRemaining int        `json:"usernameChangesRemaining"`
+	FrozenAt                 *time.Time `json:"frozenAt,omitempty"`
+	ClosedAt                 *time.Time `json:"closedAt,omitempty"`
+	IsFrozen                 bool       `json:"isFrozen"`
+	IsClosed                 bool       `json:"isClosed"`
+	ClosesAt                 *time.Time `json:"closesAt,omitempty"`
+}
+
+const (
+	UsernameChangeLimit    = 3
+	UsernameChangeCooldown = 7 * 24 * time.Hour
+	AccountFreezeGraceDays = 30
+)
+
+// ApplyUsernameQuota fills UsernameChangesRemaining from the stored count.
+// An expired cooldown clears the allowance so the next window starts at the limit.
+func (u *User) ApplyUsernameQuota(now time.Time) {
+	if u.UsernameCooldownUntil != nil && !now.Before(*u.UsernameCooldownUntil) {
+		u.UsernameChangeCount = 0
+		u.UsernameCooldownUntil = nil
+	}
+	if u.UsernameCooldownUntil != nil && now.Before(*u.UsernameCooldownUntil) {
+		u.UsernameChangesRemaining = 0
+		return
+	}
+	remaining := UsernameChangeLimit - u.UsernameChangeCount
+	if remaining < 0 {
+		remaining = 0
+	}
+	u.UsernameChangesRemaining = remaining
+}
+
+// ApplyFreezeState derives freeze and closure from frozen_at and closed_at.
+// Frozen is frozen_at set, closed_at empty, and now still inside the 30-day window.
+// Closed is closed_at set, or the window having elapsed.
+func (u *User) ApplyFreezeState(now time.Time) {
+	u.IsFrozen = false
+	u.IsClosed = false
+	u.ClosesAt = nil
+	if u.ClosedAt != nil {
+		u.IsClosed = true
+		return
+	}
+	if u.FrozenAt == nil {
+		return
+	}
+	closes := u.FrozenAt.AddDate(0, 0, AccountFreezeGraceDays)
+	if !now.Before(closes) {
+		u.IsClosed = true
+		return
+	}
+	u.IsFrozen = true
+	u.ClosesAt = &closes
 }
 
 type Certificate struct {
 	ID        int64      `json:"id"`
 	UserID    int64      `json:"userId"`
-	PublicID  string     `json:"publicId"`
+	PublicID  string     `json:"publicId,omitempty"`
 	FullName  string     `json:"fullName"`
 	IssuedAt  time.Time  `json:"issuedAt"`
 	RevokedAt *time.Time `json:"revokedAt,omitempty"`
+	Status    string     `json:"status"`
 }
 
 type PhysicalOrderStatus string
@@ -109,6 +165,7 @@ type Chapter struct {
 	Description string `json:"description"`
 	Icon        string `json:"icon"`
 	SortOrder   int    `json:"sortOrder"`
+	IsPublished bool   `json:"isPublished"`
 }
 
 type Lesson struct {
@@ -125,6 +182,7 @@ type Lesson struct {
 	SortOrder              int    `json:"sortOrder"`
 	XPReward               int    `json:"xpReward"`
 	IsActive               bool   `json:"isActive"`
+	IsPublished            bool   `json:"isPublished"`
 }
 
 type MCQQuestion struct {
@@ -209,19 +267,21 @@ type Challenge struct {
 }
 
 type ChatMessage struct {
-	ID         int64          `json:"id"`
-	UserID     int64          `json:"userId"`
-	MentorID   int64          `json:"mentorId"`
-	SenderRole Role           `json:"senderRole"`
-	Body       string         `json:"body"`
-	ReadAt     *time.Time     `json:"readAt,omitempty"`
-	CreatedAt  time.Time      `json:"createdAt"`
-	ReplyTo    *int64         `json:"replyTo,omitempty"`
-	PinnedAt   *time.Time     `json:"pinnedAt,omitempty"`
-	Pinned     bool           `json:"pinned"`
-	EditedAt   *time.Time     `json:"editedAt,omitempty"`
-	Attachment *Attachment    `json:"attachment,omitempty"`
-	Reactions  []ChatReaction `json:"reactions,omitempty"`
+	ID          int64           `json:"id"`
+	UserID      int64           `json:"userId"`
+	MentorID    int64           `json:"mentorId"`
+	SenderRole  Role            `json:"senderRole"`
+	Body        string          `json:"body"`
+	ReadAt      *time.Time      `json:"readAt,omitempty"`
+	CreatedAt   time.Time       `json:"createdAt"`
+	ReplyTo     *int64          `json:"replyTo,omitempty"`
+	PinnedAt    *time.Time      `json:"pinnedAt,omitempty"`
+	Pinned      bool            `json:"pinned"`
+	EditedAt    *time.Time      `json:"editedAt,omitempty"`
+	Attachment  *Attachment     `json:"attachment,omitempty"`
+	Attachments []Attachment    `json:"attachments,omitempty"`
+	Reactions   []ChatReaction  `json:"reactions,omitempty"`
+	Buttons     json.RawMessage `json:"buttons,omitempty"`
 }
 
 type ChatReaction struct {

backend/internal/service/hearts.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"strconv"
 	"time"
 
 	"pargar/backend/internal/config"
@@ -9,19 +10,62 @@ import (
 	"pargar/backend/internal/store"
 )
 
-// HeartsService manages the fixed 3-heart pool and lockout.
-// Hearts do not regenerate over time — only a mentor/admin unlock restores them.
+// HeartsService manages a regenerating heart pool.
+// Reaching zero waits for the next heart unless an admin turns lock-on-empty on.
 type HeartsService struct {
 	store *store.Store
 }
 
+type HeartPolicy struct {
+	Max       int
+	Every     time.Duration
+	LockEmpty bool
+}
+
 func NewHeartsService(st *store.Store, _ *config.Config) *HeartsService {
 	return &HeartsService{store: st}
 }
 
-// RefreshHearts is a no-op kept for call-site compatibility.
-// The game has no timed heart refill; the stored count is authoritative.
-func (h *HeartsService) RefreshHearts(_ context.Context, u *models.User) (*models.User, error) {
+func (h *HeartsService) Policy(ctx context.Context) HeartPolicy {
+	p := HeartPolicy{Max: store.MaxHearts, Every: 4 * time.Hour, LockEmpty: false}
+	if v, err := h.store.GetSetting(ctx, "hearts_max"); err == nil {
+		if n, convErr := strconv.Atoi(v); convErr == nil && n >= 1 && n <= store.MaxHearts {
+			p.Max = n
+		}
+	}
+	if v, err := h.store.GetSetting(ctx, "hearts_regen_minutes"); err == nil {
+		if n, convErr := strconv.Atoi(v); convErr == nil && n >= 5 && n <= 24*60 {
+			p.Every = time.Duration(n) * time.Minute
+		}
+	}
+	if v, err := h.store.GetSetting(ctx, "hearts_lock_on_empty"); err == nil {
+		p.LockEmpty = v == "true" || v == "1"
+	}
+	return p
+}
+
+// RefreshHearts adds hearts that have come due since hearts_updated_at.
+func (h *HeartsService) RefreshHearts(ctx context.Context, u *models.User) (*models.User, error) {
+	if u == nil || u.Role.IsStaff() {
+		return u, nil
+	}
+	p := h.Policy(ctx)
+	if u.Hearts >= p.Max || u.HeartsUpdatedAt.IsZero() {
+		return u, nil
+	}
+	gain := int(time.Since(u.HeartsUpdatedAt) / p.Every)
+	if gain <= 0 {
+		return u, nil
+	}
+	next := u.Hearts + gain
+	if next > p.Max {
+		next = p.Max
+	}
+	if err := h.store.SetHearts(ctx, u.ID, next); err != nil {
+		return u, err
+	}
+	u.Hearts = next
+	u.HeartsUpdatedAt = time.Now()
 	return u, nil
 }
 
@@ -45,7 +89,7 @@ func (h *HeartsService) ConsumeHearts(ctx context.Context, u *models.User, loss
 		return nil, 0, err
 	}
 	u.Hearts = cur
-	if cur == 0 && !u.IsLocked {
+	if cur == 0 && h.Policy(ctx).LockEmpty && !u.IsLocked {
 		locked, err := h.store.LockUser(ctx, u.ID)
 		if err != nil {
 			return nil, 0, err

backend/internal/store/product.go

@@ -0,0 +1,277 @@
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"time"
+)
+
+type Announcement struct {
+	ID        int64
+	Title     string
+	Body      string
+	Category  string
+	Route     string
+	Pinned    bool
+	CreatedBy int64
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+func (s *Store) CreateAnnouncement(ctx context.Context, a *Announcement) error {
+	if a.Pinned {
+		_, _ = s.pool.Exec(ctx, `UPDATE announcements SET pinned=false WHERE pinned`)
+	}
+	return s.pool.QueryRow(ctx, `
+		INSERT INTO announcements (title, body, category, route, pinned, created_by)
+		VALUES ($1,$2,$3,$4,$5,$6)
+		RETURNING id, created_at, updated_at`,
+		a.Title, a.Body, a.Category, a.Route, a.Pinned, a.CreatedBy,
+	).Scan(&a.ID, &a.CreatedAt, &a.UpdatedAt)
+}
+
+func (s *Store) ListAnnouncements(ctx context.Context) ([]Announcement, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT id, title, body, category, route, pinned, COALESCE(created_by,0), created_at, updated_at
+		FROM announcements ORDER BY pinned DESC, id DESC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Announcement
+	for rows.Next() {
+		var a Announcement
+		if err := rows.Scan(&a.ID, &a.Title, &a.Body, &a.Category, &a.Route, &a.Pinned, &a.CreatedBy, &a.CreatedAt, &a.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, a)
+	}
+	return out, rows.Err()
+}
+
+func (s *Store) UpdateAnnouncement(ctx context.Context, a Announcement) error {
+	if a.Pinned {
+		_, _ = s.pool.Exec(ctx, `UPDATE announcements SET pinned=false WHERE pinned AND id<>$1`, a.ID)
+	}
+	tag, err := s.pool.Exec(ctx, `
+		UPDATE announcements
+		SET title=$2, body=$3, category=$4, route=$5, pinned=$6, updated_at=now()
+		WHERE id=$1`, a.ID, a.Title, a.Body, a.Category, a.Route, a.Pinned)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	_, err = s.pool.Exec(ctx, `
+		UPDATE notifications
+		SET title=$2, body=$3, category=$4::notif_category, route=$5
+		WHERE announcement_id=$1`, a.ID, a.Title, a.Body, a.Category, a.Route)
+	return err
+}
+
+func (s *Store) DeleteAnnouncement(ctx context.Context, id int64) error {
+	tag, err := s.pool.Exec(ctx, `DELETE FROM announcements WHERE id=$1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *Store) RecentAnnouncements(ctx context.Context, limit int) ([]Announcement, error) {
+	if limit <= 0 || limit > 20 {
+		limit = 8
+	}
+	rows, err := s.pool.Query(ctx, `
+		SELECT id, title, body, category, route, pinned, COALESCE(created_by,0), created_at, updated_at
+		FROM announcements ORDER BY pinned DESC, id DESC LIMIT $1`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Announcement
+	for rows.Next() {
+		var a Announcement
+		if err := rows.Scan(&a.ID, &a.Title, &a.Body, &a.Category, &a.Route, &a.Pinned, &a.CreatedBy, &a.CreatedAt, &a.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, a)
+	}
+	return out, rows.Err()
+}
+
+func (s *Store) PinnedAnnouncement(ctx context.Context) (*Announcement, error) {
+	var a Announcement
+	err := s.pool.QueryRow(ctx, `
+		SELECT id, title, body, category, route, pinned, COALESCE(created_by,0), created_at, updated_at
+		FROM announcements WHERE pinned ORDER BY updated_at DESC LIMIT 1`).
+		Scan(&a.ID, &a.Title, &a.Body, &a.Category, &a.Route, &a.Pinned, &a.CreatedBy, &a.CreatedAt, &a.UpdatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &a, nil
+}
+
+func (s *Store) AttachAnnouncement(ctx context.Context, notifID, announcementID int64) error {
+	_, err := s.pool.Exec(ctx, `UPDATE notifications SET announcement_id=$2 WHERE id=$1`, notifID, announcementID)
+	return err
+}
+
+type ChatPref struct {
+	PinnedRank *int
+	Muted      bool
+	Archived   bool
+}
+
+func (s *Store) UpsertChatPref(ctx context.Context, userID, partnerID int64, rank *int, muted, archived bool) error {
+	_, err := s.pool.Exec(ctx, `
+		INSERT INTO chat_prefs (user_id, partner_id, pinned_rank, muted, archived)
+		VALUES ($1,$2,$3,$4,$5)
+		ON CONFLICT (user_id, partner_id) DO UPDATE
+		SET pinned_rank=$3, muted=$4, archived=$5`, userID, partnerID, rank, muted, archived)
+	return err
+}
+
+func (s *Store) ChatPref(ctx context.Context, userID, partnerID int64) ChatPref {
+	var p ChatPref
+	_ = s.pool.QueryRow(ctx, `
+		SELECT pinned_rank, muted, archived FROM chat_prefs WHERE user_id=$1 AND partner_id=$2`,
+		userID, partnerID).Scan(&p.PinnedRank, &p.Muted, &p.Archived)
+	return p
+}
+
+func (s *Store) SetChatMutedAll(ctx context.Context, userID int64, muted bool) error {
+	_, err := s.pool.Exec(ctx, `UPDATE users SET chat_muted_all=$2 WHERE id=$1`, userID, muted)
+	return err
+}
+
+func (s *Store) ChatMutedAll(ctx context.Context, userID int64) bool {
+	var v bool
+	_ = s.pool.QueryRow(ctx, `SELECT chat_muted_all FROM users WHERE id=$1`, userID).Scan(&v)
+	return v
+}
+
+func (s *Store) TouchLastSeen(ctx context.Context, userID int64) error {
+	_, err := s.pool.Exec(ctx, `UPDATE users SET last_seen_at = now() WHERE id=$1`, userID)
+	return err
+}
+
+func (s *Store) LastSeenByIDs(ctx context.Context, ids []int64) (map[int64]time.Time, error) {
+	out := map[int64]time.Time{}
+	if len(ids) == 0 {
+		return out, nil
+	}
+	rows, err := s.pool.Query(ctx, `
+		SELECT id, last_seen_at FROM users
+		WHERE id = ANY($1::bigint[]) AND last_seen_at IS NOT NULL`, ids)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var id int64
+		var ts time.Time
+		if err := rows.Scan(&id, &ts); err != nil {
+			return nil, err
+		}
+		out[id] = ts
+	}
+	return out, rows.Err()
+}
+
+func (s *Store) MarkChatUnread(ctx context.Context, meID, partnerID int64, meRole string) error {
+	_, err := s.pool.Exec(ctx, `
+		UPDATE chat_messages SET read_at=NULL
+		WHERE read_at IS NOT NULL
+		  AND sender_role <> $3
+		  AND ((user_id=$1 AND mentor_id=$2) OR (user_id=$2 AND mentor_id=$1))`,
+		meID, partnerID, meRole)
+	return err
+}
+
+func (s *Store) DeleteChatBoth(ctx context.Context, a, b int64) error {
+	_, err := s.pool.Exec(ctx, `
+		DELETE FROM chat_messages
+		WHERE (user_id=$1 AND mentor_id=$2) OR (user_id=$2 AND mentor_id=$1)`, a, b)
+	return err
+}
+
+func (s *Store) SaveMessage(ctx context.Context, userID int64, body, url, kind, name string) error {
+	_, err := s.pool.Exec(ctx, `
+		INSERT INTO saved_messages (user_id, body, attachment_url, attachment_type, attachment_name)
+		VALUES ($1,$2,$3,$4,$5)`, userID, body, url, kind, name)
+	return err
+}
+
+func (s *Store) ListSaved(ctx context.Context, userID int64) ([]map[string]any, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT id, body, attachment_url, attachment_type, attachment_name, created_at
+		FROM saved_messages WHERE user_id=$1 ORDER BY id DESC LIMIT 100`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []map[string]any
+	for rows.Next() {
+		var id int64
+		var body, url, kind, name string
+		var at time.Time
+		if err := rows.Scan(&id, &body, &url, &kind, &name, &at); err != nil {
+			return nil, err
+		}
+		out = append(out, map[string]any{
+			"id": id, "body": body, "attachmentUrl": url, "attachmentType": kind, "attachmentName": name, "createdAt": at,
+		})
+	}
+	if out == nil {
+		out = []map[string]any{}
+	}
+	return out, rows.Err()
+}
+
+type ProfileExtras struct {
+	Banner       string
+	Public       bool
+	ShowActivity bool
+	ShowStats    bool
+	ShowPath     bool
+	ShowBadges   bool
+	SocialLinks  json.RawMessage
+	Theme        string
+}
+
+func (s *Store) EnsureProfile(ctx context.Context, userID int64) error {
+	_, err := s.pool.Exec(ctx, `INSERT INTO user_profiles (user_id) VALUES ($1) ON CONFLICT DO NOTHING`, userID)
+	return err
+}
+
+func (s *Store) GetProfileExtras(ctx context.Context, userID int64) (ProfileExtras, error) {
+	if err := s.EnsureProfile(ctx, userID); err != nil {
+		return ProfileExtras{}, err
+	}
+	var p ProfileExtras
+	err := s.pool.QueryRow(ctx, `
+		SELECT banner_photo, profile_public, show_activity, show_stats, show_path, show_badges, social_links, theme
+		FROM user_profiles WHERE user_id=$1`, userID).
+		Scan(&p.Banner, &p.Public, &p.ShowActivity, &p.ShowStats, &p.ShowPath, &p.ShowBadges, &p.SocialLinks, &p.Theme)
+	return p, err
+}
+
+func (s *Store) SaveProfileExtras(ctx context.Context, userID int64, p ProfileExtras) error {
+	if err := s.EnsureProfile(ctx, userID); err != nil {
+		return err
+	}
+	if len(p.SocialLinks) == 0 {
+		p.SocialLinks = json.RawMessage(`[]`)
+	}
+	_, err := s.pool.Exec(ctx, `
+		UPDATE user_profiles SET
+			banner_photo=$2, profile_public=$3, show_activity=$4, show_stats=$5,
+			show_path=$6, show_badges=$7, social_links=$8, theme=$9
+		WHERE user_id=$1`,
+		userID, p.Banner, p.Public, p.ShowActivity, p.ShowStats, p.ShowPath, p.ShowBadges, p.SocialLinks, p.Theme)
+	return err
+}

backend/internal/store/store.go

@@ -17,8 +17,19 @@ import (
 
 var ErrNotFound = errors.New("not found")
 var ErrPinLimit = errors.New("pin limit")
+var ErrUsernameTaken = errors.New("username taken")
+var ErrAccountFrozen = errors.New("account frozen")
+var ErrAccountClosed = errors.New("account closed")
+var ErrAccountNotFrozen = errors.New("account not frozen")
 
-const MaxHearts = 3
+// UsernameCooldownError means the caller already used the username-change allowance.
+type UsernameCooldownError struct {
+	Until time.Time
+}
+
+func (e *UsernameCooldownError) Error() string { return "username cooldown" }
+
+const MaxHearts = 5
 
 type Store struct {
 	pool *pgxpool.Pool
@@ -80,18 +91,26 @@ func scanUser(row rowScanner) (*models.User, error) {
 		&u.LastActivityDate, &u.IsLocked, &u.LockedAt, &u.UnlockedBy, &u.IsActive,
 		&u.AvatarVariant, &u.AvatarPalette, &u.AvatarPhoto,
 		&u.Phone, &u.TelegramID, &u.TelegramUsername, &u.SecurityQuestion, &u.SecurityAnswerHash,
-		&u.CreatedAt)
+		&u.CreatedAt, &u.UsernameChangeCount, &u.UsernameCooldownUntil,
+		&u.FrozenAt, &u.ClosedAt)
 	if err != nil {
 		return nil, err
 	}
 	u.HasSecurityAnswer = u.SecurityAnswerHash != ""
+	now := time.Now()
+	u.ApplyUsernameQuota(now)
+	u.ApplyFreezeState(now)
 	return &u, nil
 }
 
+// humanOnly keeps bot accounts, which share the mentor role, out of people lists.
+const humanOnly = `NOT EXISTS (SELECT 1 FROM bot_tokens WHERE bot_user_id = users.id)`
+
 const userCols = `id, name, email, username, password_hash, role, xp, hearts, hearts_updated_at,
 	streak_current, streak_longest, last_activity_date, is_locked, locked_at,
 	unlocked_by, is_active, avatar_variant, avatar_palette, avatar_photo,
-	phone, telegram_id, telegram_username, security_question, security_answer_hash, created_at`
+	phone, telegram_id, telegram_username, security_question, security_answer_hash, created_at,
+	username_change_count, username_cooldown_until, frozen_at, closed_at`
 
 func (s *Store) GetUserByEmail(ctx context.Context, email string) (*models.User, error) {
 	row := s.pool.QueryRow(ctx, `SELECT `+userCols+` FROM users WHERE email=$1`, email)
@@ -129,6 +148,27 @@ func (s *Store) GetUserByID(ctx context.Context, id int64) (*models.User, error)
 	return u, err
 }
 
+// GetUsersByIDs fetches multiple users in a single query. Missing IDs are silently skipped.
+func (s *Store) GetUsersByIDs(ctx context.Context, ids []int64) (map[int64]*models.User, error) {
+	if len(ids) == 0 {
+		return map[int64]*models.User{}, nil
+	}
+	rows, err := s.pool.Query(ctx, `SELECT `+userCols+` FROM users WHERE id = ANY($1)`, ids)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make(map[int64]*models.User, len(ids))
+	for rows.Next() {
+		u, err := scanUser(rows)
+		if err != nil {
+			continue
+		}
+		out[u.ID] = u
+	}
+	return out, rows.Err()
+}
+
 func (s *Store) UpdateUserStats(ctx context.Context, userID int64, xp int, streak int, streakLongest int, lastActivity *time.Time) error {
 	_, err := s.pool.Exec(ctx, `
 		UPDATE users SET xp=$1, streak_current=$2, streak_longest=$3, last_activity_date=$4
@@ -195,7 +235,7 @@ func (s *Store) LockUser(ctx context.Context, userID int64) (*models.User, error
 
 func (s *Store) UnlockUser(ctx context.Context, userID int64, by int64) (*models.User, error) {
 	row := s.pool.QueryRow(ctx, `
-		UPDATE users SET is_locked=false, locked_at=NULL, unlocked_by=$1, hearts=3, hearts_updated_at=now()
+		UPDATE users SET is_locked=false, locked_at=NULL, unlocked_by=$1, hearts=5, hearts_updated_at=now()
 		WHERE id=$2 RETURNING `+userCols, by, userID)
 	u, err := scanUser(row)
 	if errors.Is(err, pgx.ErrNoRows) {
@@ -204,6 +244,65 @@ func (s *Store) UnlockUser(ctx context.Context, userID int64, by int64) (*models
 	return u, err
 }
 
+// FreezeUser records the start of the 30-day self-service freeze. It does not touch is_locked.
+func (s *Store) FreezeUser(ctx context.Context, id int64) (*models.User, error) {
+	row := s.pool.QueryRow(ctx, `
+		UPDATE users SET frozen_at = now()
+		WHERE id=$1 AND frozen_at IS NULL AND closed_at IS NULL
+		RETURNING `+userCols, id)
+	u, err := scanUser(row)
+	if errors.Is(err, pgx.ErrNoRows) {
+		existing, gerr := s.GetUserByID(ctx, id)
+		if gerr != nil {
+			return nil, gerr
+		}
+		if existing.IsClosed {
+			return nil, ErrAccountClosed
+		}
+		return nil, ErrAccountFrozen
+	}
+	return u, err
+}
+
+// UnfreezeUser clears frozen_at only while the 30-day window is still open and the account is not closed.
+func (s *Store) UnfreezeUser(ctx context.Context, id int64) (*models.User, error) {
+	row := s.pool.QueryRow(ctx, `
+		UPDATE users SET frozen_at = NULL
+		WHERE id=$1
+		  AND closed_at IS NULL
+		  AND frozen_at IS NOT NULL
+		  AND now() < frozen_at + interval '30 days'
+		RETURNING `+userCols, id)
+	u, err := scanUser(row)
+	if errors.Is(err, pgx.ErrNoRows) {
+		existing, gerr := s.GetUserByID(ctx, id)
+		if gerr != nil {
+			return nil, gerr
+		}
+		if existing.IsClosed {
+			return nil, ErrAccountClosed
+		}
+		return nil, ErrAccountNotFrozen
+	}
+	return u, err
+}
+
+// MarkAccountClosed sets closed_at once the freeze window has elapsed. A no-op returns the current user.
+func (s *Store) MarkAccountClosed(ctx context.Context, id int64) (*models.User, error) {
+	row := s.pool.QueryRow(ctx, `
+		UPDATE users SET closed_at = now()
+		WHERE id=$1
+		  AND closed_at IS NULL
+		  AND frozen_at IS NOT NULL
+		  AND now() >= frozen_at + interval '30 days'
+		RETURNING `+userCols, id)
+	u, err := scanUser(row)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return s.GetUserByID(ctx, id)
+	}
+	return u, err
+}
+
 func (s *Store) ListUsers(ctx context.Context, query string, role string, limit, offset int) ([]models.User, int64, error) {
 	if limit <= 0 {
 		limit = 10
@@ -214,7 +313,7 @@ func (s *Store) ListUsers(ctx context.Context, query string, role string, limit,
 	if offset < 0 {
 		offset = 0
 	}
-	where := `($1='' OR name ILIKE '%'||$1||'%' OR email ILIKE '%'||$1||'%' OR username ILIKE '%'||$1||'%')`
+	where := `($1='' OR name ILIKE '%'||$1||'%' OR email ILIKE '%'||$1||'%' OR username ILIKE '%'||$1||'%') AND ` + humanOnly
 	args := []any{query}
 	if role != "" {
 		args = append(args, role)
@@ -246,8 +345,47 @@ func (s *Store) ListUsers(ctx context.Context, query string, role string, limit,
 	return out, total, rows.Err()
 }
 
+// ListActiveByRoles returns active users whose role is in roles, ordered by name.
+func (s *Store) ListActiveByRoles(ctx context.Context, roles []string, limit, offset int) ([]models.User, int64, error) {
+	if limit <= 0 {
+		limit = 20
+	}
+	if limit > 50 {
+		limit = 50
+	}
+	if offset < 0 {
+		offset = 0
+	}
+	if len(roles) == 0 {
+		return []models.User{}, 0, nil
+	}
+	var total int64
+	if err := s.pool.QueryRow(ctx, `
+		SELECT COUNT(*) FROM users WHERE is_active AND role::text = ANY($1::text[]) AND `+humanOnly, roles).Scan(&total); err != nil {
+		return nil, 0, err
+	}
+	rows, err := s.pool.Query(ctx, `
+		SELECT `+userCols+` FROM users
+		WHERE is_active AND role::text = ANY($1::text[]) AND `+humanOnly+`
+		ORDER BY name ASC
+		LIMIT $2 OFFSET $3`, roles, limit, offset)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer rows.Close()
+	var out []models.User
+	for rows.Next() {
+		u, err := scanUser(rows)
+		if err != nil {
+			return nil, 0, err
+		}
+		out = append(out, *u)
+	}
+	return out, total, rows.Err()
+}
+
 func (s *Store) ListMentors(ctx context.Context) ([]models.User, error) {
-	rows, err := s.pool.Query(ctx, `SELECT `+userCols+` FROM users WHERE role IN ('mentor','admin') AND is_active ORDER BY name`)
+	rows, err := s.pool.Query(ctx, `SELECT `+userCols+` FROM users WHERE role IN ('mentor','admin') AND is_active AND `+humanOnly+` ORDER BY name`)
 	if err != nil {
 		return nil, err
 	}
@@ -294,6 +432,101 @@ func (s *Store) UpdateUser(ctx context.Context, id int64, name, email, username,
 	return u, err
 }
 
+// ChangeUsername sets a new username and consumes one allowance slot.
+// The same username is a no-op. The third change in a window starts a cooldown;
+// after that cooldown the allowance returns to the limit.
+func (s *Store) ChangeUsername(ctx context.Context, id int64, username string, now time.Time) (*models.User, error) {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback(ctx)
+
+	var current string
+	var count int
+	var until *time.Time
+	err = tx.QueryRow(ctx, `
+		SELECT username, username_change_count, username_cooldown_until
+		FROM users WHERE id=$1 FOR UPDATE`, id).Scan(&current, &count, &until)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	reset := false
+	if until != nil && !now.Before(*until) {
+		count = 0
+		until = nil
+		reset = true
+	}
+
+	if strings.EqualFold(current, username) {
+		if reset {
+			if _, err := tx.Exec(ctx, `
+				UPDATE users SET username_change_count=0, username_cooldown_until=NULL WHERE id=$1`, id); err != nil {
+				return nil, err
+			}
+		}
+		if err := tx.Commit(ctx); err != nil {
+			return nil, err
+		}
+		return s.GetUserByID(ctx, id)
+	}
+
+	if count >= models.UsernameChangeLimit {
+		if until == nil {
+			t := now.Add(models.UsernameChangeCooldown)
+			until = &t
+			if _, err := tx.Exec(ctx, `
+				UPDATE users SET username_change_count=$2, username_cooldown_until=$3 WHERE id=$1`,
+				id, count, until); err != nil {
+				return nil, err
+			}
+			if err := tx.Commit(ctx); err != nil {
+				return nil, err
+			}
+		}
+		return nil, &UsernameCooldownError{Until: *until}
+	}
+
+	var taken int64
+	err = tx.QueryRow(ctx, `SELECT id FROM users WHERE lower(username)=lower($1) AND id<>$2`, username, id).Scan(&taken)
+	if err == nil {
+		return nil, ErrUsernameTaken
+	}
+	if !errors.Is(err, pgx.ErrNoRows) {
+		return nil, err
+	}
+
+	count++
+	var nextUntil *time.Time
+	if count >= models.UsernameChangeLimit {
+		t := now.Add(models.UsernameChangeCooldown)
+		nextUntil = &t
+	}
+	row := tx.QueryRow(ctx, `
+		UPDATE users
+		SET username=$2, username_change_count=$3, username_cooldown_until=$4
+		WHERE id=$1
+		RETURNING `+userCols, id, username, count, nextUntil)
+	u, err := scanUser(row)
+	if err != nil {
+		if isUniqueViolation(err) {
+			return nil, ErrUsernameTaken
+		}
+		return nil, err
+	}
+	if err := tx.Commit(ctx); err != nil {
+		if isUniqueViolation(err) {
+			return nil, ErrUsernameTaken
+		}
+		return nil, err
+	}
+	return u, nil
+}
+
 func (s *Store) GetUserByPhone(ctx context.Context, phone string) (*models.User, error) {
 	phone = strings.TrimSpace(phone)
 	if phone == "" {
@@ -406,7 +639,7 @@ func IsUniqueViolation(err error) bool {
 
 func (s *Store) CountActiveLessons(ctx context.Context) (int, error) {
 	var n int
-	err := s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM lessons WHERE is_active`).Scan(&n)
+	err := s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM lessons WHERE is_active AND is_published`).Scan(&n)
 	return n, err
 }
 
@@ -415,11 +648,17 @@ func (s *Store) CountPassedActiveLessons(ctx context.Context, userID int64) (int
 	err := s.pool.QueryRow(ctx, `
 		SELECT COUNT(*) FROM lesson_progress lp
 		JOIN lessons l ON l.id = lp.lesson_id
-		WHERE lp.user_id=$1 AND lp.passed_quiz AND l.is_active`, userID).Scan(&n)
+		WHERE lp.user_id=$1 AND lp.passed_quiz AND l.is_active AND l.is_published`, userID).Scan(&n)
 	return n, err
 }
 
 func (s *Store) HasCompletedCurriculum(ctx context.Context, userID int64) (bool, error) {
+	// An issued (non-revoked) certificate is permanent proof of completion regardless
+	// of subsequent curriculum changes (e.g. new lessons added after the student finished).
+	// Pending certs do NOT count — they haven't been approved yet.
+	if cert, err := s.GetCertificateByUser(ctx, userID); err == nil && cert.RevokedAt == nil && cert.Status == "issued" {
+		return true, nil
+	}
 	active, err := s.CountActiveLessons(ctx)
 	if err != nil {
 		return false, err
@@ -436,42 +675,106 @@ func (s *Store) HasCompletedCurriculum(ctx context.Context, userID int64) (bool,
 
 func (s *Store) GetCertificateByUser(ctx context.Context, userID int64) (*models.Certificate, error) {
 	row := s.pool.QueryRow(ctx, `
-		SELECT id, user_id, public_id, full_name, issued_at, revoked_at
+		SELECT id, user_id, public_id, full_name, issued_at, revoked_at, status
 		FROM certificates WHERE user_id=$1`, userID)
 	return scanCertificate(row)
 }
 
 func (s *Store) GetCertificateByPublicID(ctx context.Context, publicID string) (*models.Certificate, error) {
 	row := s.pool.QueryRow(ctx, `
-		SELECT id, user_id, public_id, full_name, issued_at, revoked_at
-		FROM certificates WHERE public_id=$1`, publicID)
+		SELECT id, user_id, public_id, full_name, issued_at, revoked_at, status
+		FROM certificates WHERE public_id=$1 AND status='issued'`, publicID)
 	return scanCertificate(row)
 }
 
 func scanCertificate(row rowScanner) (*models.Certificate, error) {
 	var c models.Certificate
-	err := row.Scan(&c.ID, &c.UserID, &c.PublicID, &c.FullName, &c.IssuedAt, &c.RevokedAt)
+	var publicID *string
+	err := row.Scan(&c.ID, &c.UserID, &publicID, &c.FullName, &c.IssuedAt, &c.RevokedAt, &c.Status)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrNotFound
 	}
 	if err != nil {
 		return nil, err
 	}
+	if publicID != nil {
+		c.PublicID = *publicID
+	}
 	return &c, nil
 }
 
 func (s *Store) CreateCertificate(ctx context.Context, userID int64, publicID, fullName string) (*models.Certificate, error) {
 	row := s.pool.QueryRow(ctx, `
-		INSERT INTO certificates (user_id, public_id, full_name)
-		VALUES ($1, $2, $3)
+		INSERT INTO certificates (user_id, public_id, full_name, status)
+		VALUES ($1, $2, $3, 'issued')
 		ON CONFLICT (user_id) DO UPDATE SET
 			full_name = EXCLUDED.full_name,
+			public_id = EXCLUDED.public_id,
+			status = 'issued',
 			revoked_at = NULL
-		RETURNING id, user_id, public_id, full_name, issued_at, revoked_at`,
+		RETURNING id, user_id, public_id, full_name, issued_at, revoked_at, status`,
 		userID, publicID, fullName)
 	return scanCertificate(row)
 }
 
+func (s *Store) CreatePendingCertificate(ctx context.Context, userID int64, fullName string) (*models.Certificate, error) {
+	row := s.pool.QueryRow(ctx, `
+		INSERT INTO certificates (user_id, public_id, full_name, status)
+		VALUES ($1, NULL, $2, 'pending')
+		ON CONFLICT (user_id) DO NOTHING
+		RETURNING id, user_id, public_id, full_name, issued_at, revoked_at, status`,
+		userID, fullName)
+	cert, err := scanCertificate(row)
+	if errors.Is(err, ErrNotFound) {
+		return s.GetCertificateByUser(ctx, userID)
+	}
+	return cert, err
+}
+
+func (s *Store) IssuePendingCertificate(ctx context.Context, userID int64, publicID, fullName string) (*models.Certificate, error) {
+	row := s.pool.QueryRow(ctx, `
+		UPDATE certificates SET
+			public_id = $1,
+			full_name = $2,
+			status = 'issued',
+			revoked_at = NULL,
+			issued_at = NOW()
+		WHERE user_id = $3
+		RETURNING id, user_id, public_id, full_name, issued_at, revoked_at, status`,
+		publicID, fullName, userID)
+	return scanCertificate(row)
+}
+
+func (s *Store) RevokeCertificate(ctx context.Context, userID int64) error {
+	_, err := s.pool.Exec(ctx, `UPDATE certificates SET revoked_at=NOW() WHERE user_id=$1`, userID)
+	return err
+}
+
+func (s *Store) ListCertificatesByStatus(ctx context.Context, status string) ([]models.Certificate, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT c.id, c.user_id, c.public_id, c.full_name, c.issued_at, c.revoked_at, c.status
+		FROM certificates c
+		WHERE c.status=$1 AND c.revoked_at IS NULL
+		ORDER BY c.issued_at DESC`, status)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []models.Certificate
+	for rows.Next() {
+		var c models.Certificate
+		var publicID *string
+		if err := rows.Scan(&c.ID, &c.UserID, &publicID, &c.FullName, &c.IssuedAt, &c.RevokedAt, &c.Status); err != nil {
+			return nil, err
+		}
+		if publicID != nil {
+			c.PublicID = *publicID
+		}
+		out = append(out, c)
+	}
+	return out, rows.Err()
+}
+
 const physicalOrderCols = `id, certificate_id, user_id, status, note,
 	recipient_name, phone, address, city, postal_code, tracking_code,
 	window_ends_at, created_at, updated_at`
@@ -667,16 +970,22 @@ func (s *Store) DeleteUser(ctx context.Context, id int64) error {
 // ---- Chapters / Lessons / Questions ----
 
 func (s *Store) CreateChapter(ctx context.Context, c *models.Chapter) (int64, error) {
+	c.IsPublished = false
 	err := s.pool.QueryRow(ctx, `
-		INSERT INTO chapters (title, description, icon, sort_order) VALUES ($1,$2,$3,$4) RETURNING id`,
-		c.Title, c.Description, c.Icon, c.SortOrder).Scan(&c.ID)
+		INSERT INTO chapters (title, description, icon, sort_order, is_published) VALUES ($1,$2,$3,$4,$5) RETURNING id`,
+		c.Title, c.Description, c.Icon, c.SortOrder, c.IsPublished).Scan(&c.ID)
 	return c.ID, err
 }
 
 func (s *Store) UpdateChapter(ctx context.Context, id int64, c *models.Chapter) error {
 	_, err := s.pool.Exec(ctx, `
-		UPDATE chapters SET title=$1, description=$2, icon=$3, sort_order=$4 WHERE id=$5`,
-		c.Title, c.Description, c.Icon, c.SortOrder, id)
+		UPDATE chapters SET title=$1, description=$2, icon=$3, sort_order=$4, is_published=$5 WHERE id=$6`,
+		c.Title, c.Description, c.Icon, c.SortOrder, c.IsPublished, id)
+	return err
+}
+
+func (s *Store) PublishChapter(ctx context.Context, id int64, publish bool) error {
+	_, err := s.pool.Exec(ctx, `UPDATE chapters SET is_published=$1 WHERE id=$2`, publish, id)
 	return err
 }
 
@@ -686,7 +995,7 @@ func (s *Store) DeleteChapter(ctx context.Context, id int64) error {
 }
 
 func (s *Store) ListChapters(ctx context.Context) ([]models.Chapter, error) {
-	rows, err := s.pool.Query(ctx, `SELECT id, title, description, icon, sort_order FROM chapters ORDER BY sort_order, id`)
+	rows, err := s.pool.Query(ctx, `SELECT id, title, description, icon, sort_order, is_published FROM chapters ORDER BY sort_order, id`)
 	if err != nil {
 		return nil, err
 	}
@@ -694,7 +1003,7 @@ func (s *Store) ListChapters(ctx context.Context) ([]models.Chapter, error) {
 	var out []models.Chapter
 	for rows.Next() {
 		var c models.Chapter
-		if err := rows.Scan(&c.ID, &c.Title, &c.Description, &c.Icon, &c.SortOrder); err != nil {
+		if err := rows.Scan(&c.ID, &c.Title, &c.Description, &c.Icon, &c.SortOrder, &c.IsPublished); err != nil {
 			return nil, err
 		}
 		out = append(out, c)
@@ -703,22 +1012,28 @@ func (s *Store) ListChapters(ctx context.Context) ([]models.Chapter, error) {
 }
 
 func (s *Store) CreateLesson(ctx context.Context, l *models.Lesson) (int64, error) {
+	l.IsPublished = false
 	err := s.pool.QueryRow(ctx, `
 		INSERT INTO lessons (chapter_id, title, description, video_key, duration_seconds,
-			completion_threshold_pct, requires_lesson_id, x, y, sort_order, xp_reward, is_active)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) RETURNING id`,
+			completion_threshold_pct, requires_lesson_id, x, y, sort_order, xp_reward, is_active, is_published)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13) RETURNING id`,
 		l.ChapterID, l.Title, l.Description, l.VideoKey, l.DurationSeconds,
-		l.CompletionThresholdPct, l.RequiresLessonID, l.X, l.Y, l.SortOrder, l.XPReward, l.IsActive).Scan(&l.ID)
+		l.CompletionThresholdPct, l.RequiresLessonID, l.X, l.Y, l.SortOrder, l.XPReward, l.IsActive, l.IsPublished).Scan(&l.ID)
 	return l.ID, err
 }
 
 func (s *Store) UpdateLesson(ctx context.Context, id int64, l *models.Lesson) error {
 	_, err := s.pool.Exec(ctx, `
 		UPDATE lessons SET chapter_id=$1, title=$2, description=$3, video_key=$4, duration_seconds=$5,
-			completion_threshold_pct=$6, requires_lesson_id=$7, x=$8, y=$9, sort_order=$10, xp_reward=$11, is_active=$12
-		WHERE id=$13`,
+			completion_threshold_pct=$6, requires_lesson_id=$7, x=$8, y=$9, sort_order=$10, xp_reward=$11, is_active=$12, is_published=$13
+		WHERE id=$14`,
 		l.ChapterID, l.Title, l.Description, l.VideoKey, l.DurationSeconds,
-		l.CompletionThresholdPct, l.RequiresLessonID, l.X, l.Y, l.SortOrder, l.XPReward, l.IsActive, id)
+		l.CompletionThresholdPct, l.RequiresLessonID, l.X, l.Y, l.SortOrder, l.XPReward, l.IsActive, l.IsPublished, id)
+	return err
+}
+
+func (s *Store) PublishLesson(ctx context.Context, id int64, publish bool) error {
+	_, err := s.pool.Exec(ctx, `UPDATE lessons SET is_published=$1 WHERE id=$2`, publish, id)
 	return err
 }
 
@@ -730,11 +1045,11 @@ func (s *Store) DeleteLesson(ctx context.Context, id int64) error {
 func (s *Store) GetLesson(ctx context.Context, id int64) (*models.Lesson, error) {
 	row := s.pool.QueryRow(ctx, `
 		SELECT id, chapter_id, title, description, video_key, duration_seconds,
-			completion_threshold_pct, requires_lesson_id, x, y, sort_order, xp_reward, is_active
+			completion_threshold_pct, requires_lesson_id, x, y, sort_order, xp_reward, is_active, is_published
 		FROM lessons WHERE id=$1`, id)
 	var l models.Lesson
 	err := row.Scan(&l.ID, &l.ChapterID, &l.Title, &l.Description, &l.VideoKey, &l.DurationSeconds,
-		&l.CompletionThresholdPct, &l.RequiresLessonID, &l.X, &l.Y, &l.SortOrder, &l.XPReward, &l.IsActive)
+		&l.CompletionThresholdPct, &l.RequiresLessonID, &l.X, &l.Y, &l.SortOrder, &l.XPReward, &l.IsActive, &l.IsPublished)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrNotFound
 	}
@@ -743,9 +1058,9 @@ func (s *Store) GetLesson(ctx context.Context, id int64) (*models.Lesson, error)
 
 func (s *Store) ListLessons(ctx context.Context, includeInactive bool) ([]models.Lesson, error) {
 	q := `SELECT id, chapter_id, title, description, video_key, duration_seconds,
-		completion_threshold_pct, requires_lesson_id, x, y, sort_order, xp_reward, is_active FROM lessons`
+		completion_threshold_pct, requires_lesson_id, x, y, sort_order, xp_reward, is_active, is_published FROM lessons`
 	if !includeInactive {
-		q += ` WHERE is_active`
+		q += ` WHERE is_active AND is_published`
 	}
 	q += ` ORDER BY chapter_id, sort_order, id`
 	rows, err := s.pool.Query(ctx, q)
@@ -757,7 +1072,7 @@ func (s *Store) ListLessons(ctx context.Context, includeInactive bool) ([]models
 	for rows.Next() {
 		var l models.Lesson
 		if err := rows.Scan(&l.ID, &l.ChapterID, &l.Title, &l.Description, &l.VideoKey, &l.DurationSeconds,
-			&l.CompletionThresholdPct, &l.RequiresLessonID, &l.X, &l.Y, &l.SortOrder, &l.XPReward, &l.IsActive); err != nil {
+			&l.CompletionThresholdPct, &l.RequiresLessonID, &l.X, &l.Y, &l.SortOrder, &l.XPReward, &l.IsActive, &l.IsPublished); err != nil {
 			return nil, err
 		}
 		out = append(out, l)
@@ -1072,29 +1387,48 @@ func (s *Store) EventRsvpUsers(ctx context.Context, eventID int64) ([]models.Use
 
 // ---- Chat ----
 
-func (s *Store) AddChatMessage(ctx context.Context, userID, mentorID int64, senderRole models.Role, body string, replyTo *int64, att *models.Attachment) (*models.ChatMessage, error) {
-	var attType, attURL, attName *string
-	var attSize *int64
-	if att != nil {
-		attType, attURL, attName = &att.Type, &att.URL, &att.Name
-		attSize = &att.Size
+func packChatAttachments(atts []models.Attachment) (typ, url, name *string, size *int64, raw []byte) {
+	if len(atts) == 0 {
+		return nil, nil, nil, nil, nil
+	}
+	first := atts[0]
+	typ = new(string)
+	*typ = first.Type
+	url = new(string)
+	*url = first.URL
+	name = new(string)
+	*name = first.Name
+	sz := first.Size
+	size = &sz
+	if len(atts) > 1 {
+		if b, err := json.Marshal(atts); err == nil {
+			raw = b
+		}
+	}
+	return
+}
+
+func (s *Store) AddChatMessage(ctx context.Context, userID, mentorID int64, senderRole models.Role, body string, replyTo *int64, atts []models.Attachment) (*models.ChatMessage, error) {
+	attType, attURL, attName, attSize, raw := packChatAttachments(atts)
+	var rawArg any
+	if len(raw) > 0 {
+		rawArg = string(raw)
 	}
 	row := s.pool.QueryRow(ctx, `
-		INSERT INTO chat_messages (user_id, mentor_id, sender_role, body, reply_to, attachment_type, attachment_url, attachment_name, attachment_size)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+		INSERT INTO chat_messages (user_id, mentor_id, sender_role, body, reply_to, attachment_type, attachment_url, attachment_name, attachment_size, attachments)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10::jsonb)
 		RETURNING id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at`,
-		userID, mentorID, senderRole.String(), body, replyTo, attType, attURL, attName, attSize)
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments`,
+		userID, mentorID, senderRole.String(), body, replyTo, attType, attURL, attName, attSize, rawArg)
 	return scanMessage(row)
 }
 
 // ImportChatMessage inserts a historical message (backup restore), preserving created_at / pin.
-func (s *Store) ImportChatMessage(ctx context.Context, userID, mentorID int64, senderRole models.Role, body string, att *models.Attachment, createdAt time.Time, pinned bool) (*models.ChatMessage, error) {
-	var attType, attURL, attName *string
-	var attSize *int64
-	if att != nil {
-		attType, attURL, attName = &att.Type, &att.URL, &att.Name
-		attSize = &att.Size
+func (s *Store) ImportChatMessage(ctx context.Context, userID, mentorID int64, senderRole models.Role, body string, atts []models.Attachment, createdAt time.Time, pinned bool) (*models.ChatMessage, error) {
+	attType, attURL, attName, attSize, raw := packChatAttachments(atts)
+	var rawArg any
+	if len(raw) > 0 {
+		rawArg = string(raw)
 	}
 	if createdAt.IsZero() {
 		createdAt = time.Now().UTC()
@@ -1105,11 +1439,11 @@ func (s *Store) ImportChatMessage(ctx context.Context, userID, mentorID int64, s
 		pinnedAt = &t
 	}
 	row := s.pool.QueryRow(ctx, `
-		INSERT INTO chat_messages (user_id, mentor_id, sender_role, body, attachment_type, attachment_url, attachment_name, attachment_size, created_at, pinned_at)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
+		INSERT INTO chat_messages (user_id, mentor_id, sender_role, body, attachment_type, attachment_url, attachment_name, attachment_size, attachments, created_at, pinned_at)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10,$11)
 		RETURNING id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at`,
-		userID, mentorID, senderRole.String(), body, attType, attURL, attName, attSize, createdAt, pinnedAt)
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments`,
+		userID, mentorID, senderRole.String(), body, attType, attURL, attName, attSize, rawArg, createdAt, pinnedAt)
 	return scanMessage(row)
 }
 
@@ -1155,18 +1489,28 @@ func (s *Store) DeleteChatMessage(ctx context.Context, meID, partnerID, msgID in
 // ReplaceChatAttachment swaps the photo, video, or voice on one of my messages and marks it edited.
 // The new type must match the current attachment.
 func (s *Store) ReplaceChatAttachment(ctx context.Context, meID, partnerID, msgID int64, meRole models.Role, body, attType, attURL, attName string, attSize int64) (*models.ChatMessage, error) {
+	elem, err := json.Marshal(models.Attachment{Type: attType, URL: attURL, Name: attName, Size: attSize})
+	if err != nil {
+		return nil, err
+	}
 	row := s.pool.QueryRow(ctx, `
 		UPDATE chat_messages
 		SET body=$1, edited_at=now(),
-		    attachment_type=$2, attachment_url=$3, attachment_name=$4, attachment_size=$5
-		WHERE id=$6
-		  AND ((user_id=$7 AND mentor_id=$8) OR (user_id=$8 AND mentor_id=$7))
-		  AND sender_role=$9
-		  AND (user_id=$7 OR mentor_id=$7)
+		    attachment_type=$2, attachment_url=$3, attachment_name=$4, attachment_size=$5,
+		    attachments = CASE
+		        WHEN attachments IS NULL THEN attachments
+		        WHEN jsonb_typeof(attachments) <> 'array' THEN attachments
+		        WHEN jsonb_array_length(attachments) = 0 THEN attachments
+		        ELSE jsonb_set(attachments, '{0}', $6::jsonb, false)
+		    END
+		WHERE id=$7
+		  AND ((user_id=$8 AND mentor_id=$9) OR (user_id=$9 AND mentor_id=$8))
+		  AND sender_role=$10
+		  AND (user_id=$8 OR mentor_id=$8)
 		  AND attachment_type=$2
 		RETURNING id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at`,
-		body, attType, attURL, attName, attSize, msgID, meID, partnerID, meRole.String())
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments`,
+		body, attType, attURL, attName, attSize, string(elem), msgID, meID, partnerID, meRole.String())
 	m, err := scanMessage(row)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrNotFound
@@ -1185,7 +1529,7 @@ func (s *Store) EditChatMessage(ctx context.Context, meID, partnerID, msgID int6
 		  AND (user_id=$3 OR mentor_id=$3)
 		  AND ($1 <> '' OR attachment_url IS NOT NULL)
 		RETURNING id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at`,
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments`,
 		body, msgID, meID, partnerID, meRole.String())
 	m, err := scanMessage(row)
 	if errors.Is(err, pgx.ErrNoRows) {
@@ -1194,6 +1538,51 @@ func (s *Store) EditChatMessage(ctx context.Context, meID, partnerID, msgID int6
 	return m, err
 }
 
+// GetOwnChatMessage loads one of my messages in this conversation, including its attachments.
+func (s *Store) GetOwnChatMessage(ctx context.Context, meID, partnerID, msgID int64, meRole models.Role) (*models.ChatMessage, error) {
+	row := s.pool.QueryRow(ctx, `
+		SELECT id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments
+		FROM chat_messages
+		WHERE id=$1
+		  AND ((user_id=$2 AND mentor_id=$3) OR (user_id=$3 AND mentor_id=$2))
+		  AND sender_role=$4
+		  AND (user_id=$2 OR mentor_id=$2)`,
+		msgID, meID, partnerID, meRole.String())
+	m, err := scanMessage(row)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	return m, err
+}
+
+// SaveEditedChatMessage writes the caption and the full attachment set for one of my messages.
+// Callers pass the attachments that should remain; an empty list is stored as no attachment.
+func (s *Store) SaveEditedChatMessage(ctx context.Context, meID, partnerID, msgID int64, meRole models.Role, body string, atts []models.Attachment) (*models.ChatMessage, error) {
+	attType, attURL, attName, attSize, raw := packChatAttachments(atts)
+	var rawArg any
+	if len(raw) > 0 {
+		rawArg = string(raw)
+	}
+	row := s.pool.QueryRow(ctx, `
+		UPDATE chat_messages
+		SET body=$1, edited_at=now(),
+		    attachment_type=$2, attachment_url=$3, attachment_name=$4, attachment_size=$5,
+		    attachments=$6::jsonb
+		WHERE id=$7
+		  AND ((user_id=$8 AND mentor_id=$9) OR (user_id=$9 AND mentor_id=$8))
+		  AND sender_role=$10
+		  AND (user_id=$8 OR mentor_id=$8)
+		RETURNING id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments`,
+		body, attType, attURL, attName, attSize, rawArg, msgID, meID, partnerID, meRole.String())
+	m, err := scanMessage(row)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	return m, err
+}
+
 const maxPinnedMessages = 3
 
 // TogglePinChatMessage pins or unpins a message. If already at the pin limit,
@@ -1216,7 +1605,7 @@ func (s *Store) TogglePinChatMessage(ctx context.Context, meID, partnerID, msgID
 		out := s.pool.QueryRow(ctx, `
 			UPDATE chat_messages SET pinned_at=NULL WHERE id=$1
 			RETURNING id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-				attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at`, msgID)
+				attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments`, msgID)
 		return scanMessage(out)
 	}
 	var n int
@@ -1244,7 +1633,7 @@ func (s *Store) TogglePinChatMessage(ctx context.Context, meID, partnerID, msgID
 	out := s.pool.QueryRow(ctx, `
 		UPDATE chat_messages SET pinned_at=now() WHERE id=$1
 		RETURNING id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at`, msgID)
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments`, msgID)
 	return scanMessage(out)
 }
 
@@ -1252,7 +1641,7 @@ func (s *Store) TogglePinChatMessage(ctx context.Context, meID, partnerID, msgID
 func (s *Store) ListPinnedChatMessages(ctx context.Context, userID, mentorID int64) ([]models.ChatMessage, error) {
 	rows, err := s.pool.Query(ctx, `
 		SELECT id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments
 		FROM chat_messages
 		WHERE pinned_at IS NOT NULL
 		  AND ((user_id=$1 AND mentor_id=$2) OR (user_id=$2 AND mentor_id=$1))
@@ -1278,7 +1667,7 @@ func (s *Store) ListPinnedChatMessages(ctx context.Context, userID, mentorID int
 func (s *Store) ListChatMessages(ctx context.Context, userID, mentorID, before, limit int64) ([]models.ChatMessage, error) {
 	rows, err := s.pool.Query(ctx, `
 		SELECT id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments
 		FROM chat_messages
 		WHERE ((user_id=$1 AND mentor_id=$2) OR (user_id=$2 AND mentor_id=$1))
 		  AND ($3 = 0 OR id < $3)
@@ -1326,7 +1715,7 @@ func (s *Store) ListChatMessagesAround(ctx context.Context, userID, partnerID, a
 
 	older, err := s.pool.Query(ctx, `
 		SELECT id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments
 		FROM chat_messages
 		WHERE ((user_id=$1 AND mentor_id=$2) OR (user_id=$2 AND mentor_id=$1))
 		  AND id <= $3
@@ -1358,7 +1747,7 @@ func (s *Store) ListChatMessagesAround(ctx context.Context, userID, partnerID, a
 
 	newer, err := s.pool.Query(ctx, `
 		SELECT id, user_id, mentor_id, sender_role, body, read_at, created_at, reply_to,
-			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at
+			attachment_type, attachment_url, attachment_name, attachment_size, pinned_at, edited_at, buttons, attachments
 		FROM chat_messages
 		WHERE ((user_id=$1 AND mentor_id=$2) OR (user_id=$2 AND mentor_id=$1))
 		  AND id > $3
@@ -1399,14 +1788,27 @@ func scanMessage(row messageScanner) (*models.ChatMessage, error) {
 	var m models.ChatMessage
 	var attType, attURL, attName *string
 	var attSize *int64
+	var buttons []byte
+	var rawAtts []byte
 	if err := row.Scan(
 		&m.ID, &m.UserID, &m.MentorID, &m.SenderRole, &m.Body, &m.ReadAt, &m.CreatedAt, &m.ReplyTo,
-		&attType, &attURL, &attName, &attSize, &m.PinnedAt, &m.EditedAt,
+		&attType, &attURL, &attName, &attSize, &m.PinnedAt, &m.EditedAt, &buttons, &rawAtts,
 	); err != nil {
 		return nil, err
 	}
+	if len(buttons) > 0 && string(buttons) != "[]" && string(buttons) != "null" {
+		m.Buttons = buttons
+	}
 	m.Pinned = m.PinnedAt != nil
-	if attURL != nil && *attURL != "" {
+	if len(rawAtts) > 0 && string(rawAtts) != "null" && string(rawAtts) != "[]" {
+		var list []models.Attachment
+		if err := json.Unmarshal(rawAtts, &list); err == nil && len(list) > 0 {
+			m.Attachments = list
+			first := list[0]
+			m.Attachment = &first
+		}
+	}
+	if m.Attachment == nil && attURL != nil && *attURL != "" {
 		m.Attachment = &models.Attachment{
 			Type: derefStr(attType), URL: *attURL, Name: derefStr(attName), Size: derefInt(attSize),
 		}

deploy/compose/compose.dev.yaml

@@ -33,6 +33,7 @@ services:
     environment:
       DEV_MODE: ${DEV_MODE:-false}
       SEED_CURRICULUM: ${SEED_CURRICULUM:-false}
+      CAPTCHA_EXPOSE_ANSWER: ${CAPTCHA_EXPOSE_ANSWER:-false}
     deploy:
       resources:
         limits:
@@ -63,6 +64,11 @@ services:
       - --entrypoints.web.http.redirections.entrypoint.permanent=true
       - --entrypoints.web.http.aliasHeadersStrategy=delete
       - --entrypoints.websecure.http.aliasHeadersStrategy=delete
+      # Allow slow, large uploads (admin video ≤ 200MB); default is 60s.
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=3600
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=3600
+      # Disable HTTP/2 so WebSocket upgrades work from Chromium (RFC 8441 not enabled).
+      - --entrypoints.websecure.http2.maxConcurrentStreams=0
       # Dev: Traefik default certificate (browser warning expected on localhost).
       - --api.dashboard=true
       - --api.insecure=true

deploy/compose/compose.prod.yaml

@@ -71,6 +71,9 @@ services:
       - --entrypoints.web.http.redirections.entrypoint.permanent=true
       - --entrypoints.web.http.aliasHeadersStrategy=delete
       - --entrypoints.websecure.http.aliasHeadersStrategy=delete
+      # Allow slow, large uploads (admin video ≤ 200MB); default is 60s.
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=3600
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=3600
       - --certificatesresolvers.le.acme.email=${ACME_EMAIL:?ACME_EMAIL must be set}
       - --certificatesresolvers.le.acme.storage=/data/acme.json
       - --certificatesresolvers.le.acme.httpchallenge=true

deploy/helm/pargar/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: pargar
 description: Pargar gated LMS - Go API, Next.js frontend, Postgres, Redis, S3-compatible storage
 type: application
-version: 0.2.1
-appVersion: "0.1.3"
+version: 0.2.4
+appVersion: "0.4.0"
 keywords:
   - lms
   - pargar

deploy/helm/pargar/templates/secret-data.yaml

@@ -8,7 +8,10 @@
 {{- else if and .Values.postgres.auth.password (not (hasPrefix "change-me" .Values.postgres.auth.password)) (ne .Values.postgres.auth.password "") }}
   {{- $pgPass = .Values.postgres.auth.password }}
 {{- else }}
-  {{- $pgPass = randAlphaNum 32 }}
+  {{- /* Fail loudly instead of silently minting a random password: under
+         Argo CD (helm template) `lookup` is always empty, and a random
+         value would diverge from the live service on every render. */}}
+  {{- fail "postgres.auth.password must be set: no existing pargar-postgres secret was found and .Values.postgres.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -30,7 +33,7 @@ stringData:
 {{- else if and .Values.redis.auth.password (not (hasPrefix "change-me" .Values.redis.auth.password)) (ne .Values.redis.auth.password "") }}
   {{- $rdPass = .Values.redis.auth.password }}
 {{- else }}
-  {{- $rdPass = randAlphaNum 32 }}
+  {{- fail "redis.auth.password must be set: no existing pargar-redis secret was found and .Values.redis.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -56,7 +59,7 @@ stringData:
 {{- else if and .Values.rustfs.auth.secretKey (not (hasPrefix "change-me" .Values.rustfs.auth.secretKey)) (ne .Values.rustfs.auth.secretKey "") }}
   {{- $secret = .Values.rustfs.auth.secretKey }}
 {{- else }}
-  {{- $secret = randAlphaNum 40 }}
+  {{- fail "rustfs.auth.secretKey must be set: no existing pargar-rustfs secret was found and .Values.rustfs.auth.secretKey is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret

deploy/helm/pargar/templates/servicemonitor.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.backend.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "pargar.fullname" . }}-backend
+  labels:
+    {{- include "pargar.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  selector:
+    matchLabels:
+      {{- include "pargar.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: backend
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: {{ .Values.backend.metrics.serviceMonitor.interval | default "30s" }}
+      scheme: http
+      # /metrics answers 401 without it; Prometheus sends it as
+      # Authorization: Bearer <token>.
+      authorization:
+        type: Bearer
+        credentials:
+          name: {{ include "pargar.appSecretName" . }}
+          key: metrics-token
+{{- end }}

deploy/helm/pargar/values-apollo.yaml

@@ -0,0 +1,85 @@
+backend:
+  autoscaling:
+    enabled: false
+  env:
+    devMode: "false"
+    donationEnabled: "true"
+    otelEndpoint: http://tempo.infra.svc.cluster.local:4318
+    physicalCertEnabled: "false"
+    seedCurriculum: "false"
+  existingSecret: pargar-app
+  image:
+    pullPolicy: IfNotPresent
+    repository: pargar-backend
+    tag: 0.4.0
+  metrics:
+    serviceMonitor:
+      enabled: true
+      interval: 30s
+  podDisruptionBudget:
+    enabled: true
+    minAvailable: 1
+  replicaCount: 3
+  resources:
+    limits:
+      cpu: "1"
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+backup:
+  enabled: true
+  persistence:
+    size: 2Gi
+  retentionDays: 7
+  schedule: 0 3 * * *
+certManager:
+  enabled: false
+frontend:
+  autoscaling:
+    enabled: false
+  image:
+    pullPolicy: IfNotPresent
+    repository: pargar-frontend
+    tag: 0.4.0
+  podDisruptionBudget:
+    enabled: false
+  replicaCount: 2
+  resources:
+    limits:
+      cpu: "1"
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+global:
+  domain: pargar.panahifar.ir
+  frontendOrigins: https://pargar.panahifar.ir
+  # Images published by .gitea/workflows/build-and-push.yaml on tag push.
+  imageRegistry: src.panahifar.ir/ahp
+  publicUrl: https://pargar.panahifar.ir
+# Gitea packages are private: kubelet pulls need secret `gitea-pull`
+# (docker-registry secret for src.panahifar.ir, created in ns pargar).
+imagePullSecrets:
+  - name: gitea-pull
+ingress:
+  enabled: true
+  tls:
+    enabled: true
+    existingSecret: pargar-wildcard-tls
+  useIngressRoute: true
+networkPolicy:
+  enabled: false
+postgres:
+  enabled: true
+  persistence:
+    size: 10Gi
+redis:
+  enabled: true
+  persistence:
+    size: 2Gi
+rustfs:
+  consoleEnable: false
+  enabled: true
+  persistence:
+    size: 20Gi

deploy/helm/pargar/values-prod.yaml

@@ -3,26 +3,27 @@
 #     -f deploy/helm/pargar/values-prod.yaml
 #
 # Prerequisites:
-#   - images pushed to ghcr.io/pargar/{backend,frontend}:<tag>
+#   - images pushed to src.panahifar.ir/ahp/{pargar-backend,pargar-frontend}:<tag>
+#     (by .gitea/workflows/build-and-push.yaml on a v* tag push)
 #   - Secret pargar-app (jwt-secret, admin-password, metrics-token, database-url, redis-url,
 #     storage-access-key, storage-secret-key)
 #   - cert-manager ClusterIssuer letsencrypt-prod
-#   - imagePullSecrets if the registry is private
+#   - imagePullSecrets if the Gitea package registry visibility is private
 
 global:
   domain: app.example.com
   publicUrl: https://app.example.com
   frontendOrigins: "https://app.example.com"
-  imageRegistry: ghcr.io/pargar
+  imageRegistry: src.panahifar.ir/ahp
 
 imagePullSecrets:
-  - name: ghcr-pull
+  - name: gitea-pull
 
 backend:
   replicaCount: 2
   image:
-    repository: backend
-    tag: "0.1.3"
+    repository: pargar-backend
+    tag: "0.2.1"
     pullPolicy: IfNotPresent
   existingSecret: pargar-app
   env:
@@ -48,8 +49,8 @@ backend:
 frontend:
   replicaCount: 2
   image:
-    repository: frontend
-    tag: "0.1.3"
+    repository: pargar-frontend
+    tag: "0.2.1"
     pullPolicy: IfNotPresent
   resources:
     requests:

deploy/helm/pargar/values.yaml

@@ -25,6 +25,13 @@ backend:
     pullPolicy: IfNotPresent
   service:
     port: 8080
+  metrics:
+    # Prometheus Operator ServiceMonitor. /metrics is bearer-protected by
+    # METRICS_TOKEN, so the endpoint carries authorization credentials
+    # (pargar-app secret) instead of scraping anonymously.
+    serviceMonitor:
+      enabled: false
+      interval: 30s
   resources:
     requests:
       cpu: 50m

deploy/k3s/traefik-helmchartconfig.yaml

@@ -0,0 +1,43 @@
+# k3s Traefik customisation (HelmChartConfig for the built-in `traefik` chart).
+#
+# Apply with:  kubectl apply -f deploy/k3s/traefik-helmchartconfig.yaml
+#
+# Why: Traefik's entrypoint `readTimeout` defaults to 60s and covers reading the
+# *entire request including the body*. Admin video uploads (up to 200MB) that take
+# longer than 60s were cut off with a 502 before reaching the backend. Raise it to
+# 1 hour (use 0 to disable entirely).
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  failurePolicy: reinstall
+  valuesContent: |-
+    # ACCESSLOG tile -> ON; access logs go to container stdout (kubectl logs).
+    # Key is logs.access.enabled on the chart k3s ships (40.1.5);
+    # the top-level accessLog.enabled only exists on newer chart versions.
+    logs:
+      access:
+        enabled: true
+    # Allow IngressRoutes to reference Services living in other namespaces,
+    # e.g. argocd-server in `argocd`.
+    providers:
+      kubernetesCRD:
+        allowCrossNamespace: true
+    deployment:
+      podAnnotations:
+        # fix: metrics entrypoint listens on :9100, annotation said 8082
+        prometheus.io/port: "9100"
+        prometheus.io/scrape: "true"
+    # Allow slow, large uploads (admin video upload ≤ 200MB) to finish.
+    # Default is 60s; 3600s = 1h. Set to 0 to disable the cap.
+    ports:
+      web:
+        transport:
+          respondingTimeouts:
+            readTimeout: 3600
+      websecure:
+        transport:
+          respondingTimeouts:
+            readTimeout: 3600

frontend/e2e/.auth-state.json

@@ -0,0 +1 @@
+{"available":true,"accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1aWQiOjEsInJvbGUiOiJhZG1pbiIsInN1YiI6IjEiLCJleHAiOjE3OTI0OTc0MjcsImlhdCI6MTc5MjQ5NjUyN30.0RuGRaPhMeQ36aHrn_x2iAgJPpyH7pfXGr_cOOOeG1c","refreshToken":"e4059f725d0648ae77b0147835296228c5bba0d0bcda638ebb9a65adeed6c5f72e56d0da268de11d34393e9d4ea96acb","user":{"id":1,"email":"admin@example.com","username":"admin","name":"Admin","role":"admin","xp":0,"hearts":5,"heartsUpdatedAt":"2026-10-18T06:49:58.329935Z","streakCurrent":0,"streakLongest":0,"isLocked":false,"isActive":true,"avatarVariant":"beam","avatarPalette":"","phone":"","hasSecurityAnswer":false,"createdAt":"2026-10-18T06:49:58.329935Z","usernameChangesRemaining":3,"isFrozen":false,"isClosed":false}}

frontend/e2e/auth.spec.ts

@@ -0,0 +1,79 @@
+import { test, expect } from "@playwright/test";
+import { ADMIN_EMAIL, ADMIN_PASSWORD, BASE, requireAuth, injectAuth, apiLogin } from "./helpers";
+
+test.describe("Auth — public endpoints", () => {
+  test("login page renders", async ({ page }) => {
+    await page.goto("/login");
+    await expect(page).toHaveTitle(/.+/);
+    const hasForm = await page.locator("form, input[type=password]").count();
+    expect(hasForm).toBeGreaterThan(0);
+  });
+
+  test("protected routes reject unauthenticated requests", async ({ page }) => {
+    const routes = ["/api/tree", "/api/leaderboard/weekly", "/api/notifications"];
+    for (const route of routes) {
+      const res = await page.request.get(`${BASE}${route}`);
+      expect(res.status(), `${route} should be 401`).toBe(401);
+    }
+  });
+
+  test("invalid credentials: bad captcha → 400, bad password → 401", async ({ page }) => {
+    // Bad captcha answer returns 400
+    const r1 = await page.request.post(`${BASE}/api/auth/login`, {
+      data: { username: "x", password: "x", challengeId: "fake", captchaAnswer: "wrong" },
+    });
+    expect([400, 429]).toContain(r1.status());
+
+    // Correct captcha, wrong password → 401
+    const auth = requireAuth();
+    const captchaRes = await page.request.get(`${BASE}/api/auth/captcha`);
+    const { challengeId, answer } = await captchaRes.json();
+    const r2 = await page.request.post(`${BASE}/api/auth/login`, {
+      data: { username: ADMIN_EMAIL, password: "definitely-wrong", challengeId, captchaAnswer: answer },
+    });
+    expect(r2.status()).toBe(401);
+  });
+});
+
+test.describe("Auth — requires working CAPTCHA", () => {
+  test("admin login via API succeeds and /me returns admin role", async ({ page }) => {
+    const auth = requireAuth();
+    const res = await page.request.get(`${BASE}/api/auth/me`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+    });
+    expect(res.status()).toBe(200);
+    const body = await res.json();
+    expect(body.user.role).toBe("admin");
+  });
+
+  test("logout invalidates refresh token", async ({ page }) => {
+    requireAuth();
+    // Issue a fresh session for this test only (don't use the shared token)
+    const captchaRes = await page.request.get(`${BASE}/api/auth/captcha`);
+    const { challengeId, answer } = await captchaRes.json();
+    if (!answer) { test.skip(true, "CAPTCHA not solvable"); return; }
+
+    const loginRes = await page.request.post(`${BASE}/api/auth/login`, {
+      data: { username: ADMIN_EMAIL, password: ADMIN_PASSWORD, challengeId, captchaAnswer: answer },
+    });
+    const { accessToken, refreshToken } = await loginRes.json();
+
+    const logout = await page.request.post(`${BASE}/api/auth/logout`, {
+      data: { refreshToken },
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    expect(logout.status()).toBe(200);
+
+    const refresh = await page.request.post(`${BASE}/api/auth/refresh`, {
+      data: { refreshToken },
+    });
+    expect(refresh.status()).toBe(401);
+  });
+
+  test("cap page loads and stays off /login", async ({ page }) => {
+    await injectAuth(page);
+    await page.goto("/cap");
+    await page.waitForLoadState("networkidle", { timeout: 15_000 });
+    expect(page.url()).not.toContain("/login");
+  });
+});

frontend/e2e/chat.spec.ts

@@ -0,0 +1,65 @@
+import { test, expect } from "@playwright/test";
+import { BASE, requireAuth, injectAuth } from "./helpers";
+
+test.describe("Chat", () => {
+  test("conversations endpoint returns list", async ({ page }) => {
+    const auth = requireAuth();
+    const res = await page.request.get(`${BASE}/api/chats/conversations`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+    });
+    expect(res.status()).toBe(200);
+    const data = await res.json();
+    expect(data).toHaveProperty("conversations");
+    expect(Array.isArray(data.conversations)).toBe(true);
+  });
+
+  test("student→student chat is rejected (IDOR guard)", async ({ page }) => {
+    const auth = requireAuth();
+    const adminId = auth.user!.id;
+
+    // Create a student
+    const u1 = await page.request.post(`${BASE}/api/admin/users`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+      data: {
+        name: "ChatTest", email: "chat-idor@e2e.test", username: "chat_idor_e2e",
+        password: "TestPass123!", role: "student",
+        securityQuestion: "Q", securityAnswer: "A",
+      },
+    });
+    // 201 = created, 409 = already exists from prior run — both are fine
+    if (u1.status() !== 201 && u1.status() !== 409) {
+      test.skip(true, `Unexpected status creating test user: ${u1.status()}`);
+      return;
+    }
+
+    const studentId = u1.status() === 201
+      ? (await u1.json()).user.id
+      : null;
+
+    if (!studentId) { test.skip(true, "Could not get student ID"); return; }
+
+    // Log in as the student
+    const captchaRes = await page.request.get(`${BASE}/api/auth/captcha`);
+    const { challengeId, answer } = await captchaRes.json();
+    if (!answer) { test.skip(true, "CAPTCHA not solvable"); return; }
+
+    const loginRes = await page.request.post(`${BASE}/api/auth/login`, {
+      data: { username: "chat_idor_e2e", password: "TestPass123!", challengeId, captchaAnswer: answer },
+    });
+    const studentSession = await loginRes.json();
+    if (!studentSession.accessToken) { test.skip(true, "Student login failed"); return; }
+
+    // Student tries to read another student's conversations — must fail
+    const forbidden = await page.request.get(`${BASE}/api/chats/${studentId}/messages`, {
+      headers: { Authorization: `Bearer ${studentSession.accessToken}` },
+    });
+    expect([403, 404]).toContain(forbidden.status());
+  });
+
+  test("chat page renders without redirect to /login", async ({ page }) => {
+    await injectAuth(page);
+    await page.goto("/unwrap?tab=chats");
+    await page.waitForLoadState("networkidle", { timeout: 15_000 });
+    expect(page.url()).not.toContain("/login");
+  });
+});

frontend/e2e/global-setup.ts

@@ -0,0 +1,59 @@
+import { chromium } from "@playwright/test";
+import { ADMIN_EMAIL, ADMIN_PASSWORD, BASE } from "./helpers";
+import * as fs from "fs";
+import * as path from "path";
+
+const AUTH_FILE = path.join(__dirname, ".auth-state.json");
+
+export default async function globalSetup() {
+  // If answer is not exposed in captcha, skip auth — tests requiring auth will skip themselves.
+  const browser = await chromium.launch({
+    executablePath: `${process.env.HOME}/.cache/ms-playwright/chromium_headless_shell-1234/chrome-headless-shell-linux64/chrome-headless-shell`,
+    args: ["--no-sandbox", "--disable-dev-shm-usage"],
+  });
+  const context = await browser.newContext({ ignoreHTTPSErrors: true });
+  const page = await context.newPage();
+
+  try {
+    const captchaRes = await page.request.get(`${BASE}/api/auth/captcha`);
+    const captchaData = await captchaRes.json();
+
+    if (!captchaData.answer) {
+      console.warn("\n⚠ CAPTCHA_EXPOSE_ANSWER not set — restart the API container to enable auth tests.\n  Run: ./scripts/compose-dev.sh restart api\n");
+      fs.writeFileSync(AUTH_FILE, JSON.stringify({ available: false }));
+      await browser.close();
+      return;
+    }
+
+    const loginRes = await page.request.post(`${BASE}/api/auth/login`, {
+      data: {
+        username: ADMIN_EMAIL,
+        password: ADMIN_PASSWORD,
+        challengeId: captchaData.challengeId,
+        captchaAnswer: captchaData.answer,
+        rememberMe: true,
+      },
+    });
+    const body = await loginRes.json();
+
+    if (!body.accessToken) {
+      console.warn("\n⚠ Admin login failed in global setup:", JSON.stringify(body));
+      fs.writeFileSync(AUTH_FILE, JSON.stringify({ available: false }));
+      await browser.close();
+      return;
+    }
+
+    fs.writeFileSync(AUTH_FILE, JSON.stringify({
+      available: true,
+      accessToken: body.accessToken,
+      refreshToken: body.refreshToken,
+      user: body.user,
+    }));
+    console.log("\n✓ Auth state cached for test suite\n");
+  } catch (e) {
+    fs.writeFileSync(AUTH_FILE, JSON.stringify({ available: false }));
+    console.warn("\n⚠ Global setup failed:", e);
+  }
+
+  await browser.close();
+}

frontend/e2e/helpers.ts

@@ -0,0 +1,83 @@
+import { type Page, test } from "@playwright/test";
+import * as fs from "fs";
+import * as path from "path";
+
+export const ADMIN_EMAIL = "admin";
+export const ADMIN_PASSWORD = "wZW64CUbXbv9679dmR1FIbz3";
+export const BASE = "https://localhost";
+
+const AUTH_FILE = path.join(__dirname, ".auth-state.json");
+
+interface AuthState {
+  available: boolean;
+  accessToken?: string;
+  refreshToken?: string;
+  user?: { id: number; role: string; email: string };
+}
+
+export function loadAuth(): AuthState {
+  try {
+    return JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8")) as AuthState;
+  } catch {
+    return { available: false };
+  }
+}
+
+/** Skip this test if auth is not available (CAPTCHA not exposed). */
+export function requireAuth(): AuthState {
+  const auth = loadAuth();
+  if (!auth.available) {
+    test.skip(true, "Auth not available — restart API with CAPTCHA_EXPOSE_ANSWER=true");
+  }
+  return auth;
+}
+
+/** Inject cached auth cookies into the page context. */
+export async function injectAuth(page: Page): Promise<AuthState> {
+  const auth = requireAuth();
+  // Seed Zustand persist store so the app hydrates with a valid user (skips redirect)
+  await page.addInitScript(({ user }) => {
+    try {
+      localStorage.setItem(
+        "pargar.auth",
+        JSON.stringify({ state: { user }, version: 0 }),
+      );
+    } catch {}
+  }, { user: auth.user });
+  await page.context().addCookies([
+    { name: "pargar_access", value: auth.accessToken!, domain: "localhost", path: "/", secure: true, sameSite: "Lax" },
+    { name: "pargar_refresh", value: auth.refreshToken!, domain: "localhost", path: "/", secure: true, httpOnly: true, sameSite: "Lax" },
+  ]);
+  return auth;
+}
+
+export async function loginAs(page: Page, identity: string, password: string) {
+  const captchaRes = await page.request.get(`${BASE}/api/auth/captcha`);
+  const captchaData = await captchaRes.json();
+  const answer: string = captchaData.answer ?? "";
+  const challengeId: string = captchaData.challengeId ?? "";
+
+  const loginRes = await page.request.post(`${BASE}/api/auth/login`, {
+    data: { username: identity, password, challengeId, captchaAnswer: answer, rememberMe: false },
+  });
+  const loginBody = await loginRes.json();
+
+  if (!loginBody.accessToken) {
+    throw new Error(`Login failed for ${identity}: ${JSON.stringify(loginBody)}`);
+  }
+
+  await page.context().addCookies([
+    { name: "access_token", value: loginBody.accessToken, domain: "localhost", path: "/", secure: true, sameSite: "Lax" },
+    { name: "refresh_token", value: loginBody.refreshToken, domain: "localhost", path: "/", secure: true, httpOnly: true, sameSite: "Lax" },
+  ]);
+  return loginBody;
+}
+
+export async function apiLogin(page: Page, identity: string, password: string) {
+  const captchaRes = await page.request.get(`${BASE}/api/auth/captcha`);
+  const { challengeId, answer } = await captchaRes.json();
+  const res = await page.request.post(`${BASE}/api/auth/login`, {
+    data: { username: identity, password, challengeId, captchaAnswer: answer, rememberMe: false },
+  });
+  return res.json();
+}

frontend/e2e/leaderboard.spec.ts

@@ -0,0 +1,37 @@
+import { test, expect } from "@playwright/test";
+import { BASE, requireAuth, injectAuth } from "./helpers";
+
+test.describe("Leaderboard", () => {
+  test("weekly leaderboard returns valid shape", async ({ page }) => {
+    const auth = requireAuth();
+    const res = await page.request.get(`${BASE}/api/leaderboard/weekly`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+    });
+    expect(res.status()).toBe(200);
+    const data = await res.json();
+    expect(data).toHaveProperty("week");
+    expect(data).toHaveProperty("entries");
+    expect(data).toHaveProperty("totalParticipants");
+    expect(data).toHaveProperty("me");
+    expect(Array.isArray(data.entries)).toBe(true);
+  });
+
+  test("leaderboard entries have tier field", async ({ page }) => {
+    const auth = requireAuth();
+    const res = await page.request.get(`${BASE}/api/leaderboard/weekly`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+    });
+    const data = await res.json();
+    for (const entry of data.entries) {
+      expect(["champion", "gold", "silver", "bronze"]).toContain(entry.tier);
+      expect(entry.rank).toBeGreaterThanOrEqual(1);
+    }
+  });
+
+  test("leaderboard page renders without redirect to /login", async ({ page }) => {
+    await injectAuth(page);
+    await page.goto("/leaderboard");
+    await page.waitForLoadState("networkidle", { timeout: 15_000 });
+    expect(page.url()).not.toContain("/login");
+  });
+});

frontend/e2e/responsive.spec.ts

@@ -0,0 +1,49 @@
+import { test, expect } from "@playwright/test";
+import { requireAuth, injectAuth } from "./helpers";
+
+const VIEWPORTS = [
+  { name: "mobile-sm (375px)", width: 375, height: 812 },
+  { name: "mobile-lg (430px)", width: 430, height: 932 },
+  { name: "tablet (768px)", width: 768, height: 1024 },
+  { name: "desktop (1280px)", width: 1280, height: 800 },
+  { name: "desktop-xl (1440px)", width: 1440, height: 900 },
+];
+
+const ROUTES = ["/cap", "/leaderboard", "/community", "/settings", "/notifications"];
+
+for (const vp of VIEWPORTS) {
+  test(`no horizontal overflow — ${vp.name}`, async ({ page }) => {
+    requireAuth();
+    await page.setViewportSize({ width: vp.width, height: vp.height });
+    await injectAuth(page);
+
+    for (const route of ROUTES) {
+      await page.goto(route);
+      await page.waitForLoadState("networkidle", { timeout: 15_000 });
+
+      const overflow = await page.evaluate(() => {
+        return document.documentElement.scrollWidth > document.documentElement.clientWidth;
+      });
+      expect(overflow, `Horizontal overflow at ${route} / ${vp.name}`).toBe(false);
+    }
+  });
+
+  test(`no interactive elements clipped off-screen — ${vp.name}`, async ({ page }) => {
+    requireAuth();
+    await page.setViewportSize({ width: vp.width, height: vp.height });
+    await injectAuth(page);
+
+    await page.goto("/cap");
+    await page.waitForLoadState("networkidle", { timeout: 15_000 });
+
+    const clipped = await page.evaluate((vpWidth) => {
+      return Array.from(document.querySelectorAll("button, a, input"))
+        .filter((el) => {
+          const r = el.getBoundingClientRect();
+          return r.right < 0 || r.left > vpWidth + 50;
+        }).length;
+    }, vp.width);
+
+    expect(clipped, `${clipped} elements clipped at ${vp.name}`).toBe(0);
+  });
+}

frontend/e2e/video.spec.ts

@@ -0,0 +1,75 @@
+import { test, expect } from "@playwright/test";
+import { BASE, requireAuth, injectAuth } from "./helpers";
+
+test.describe("Video player & media signing", () => {
+  test("lesson endpoint returns a signed videoUrl", async ({ page }) => {
+    const auth = requireAuth();
+    const treeRes = await page.request.get(`${BASE}/api/tree`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+    });
+    expect(treeRes.status()).toBe(200);
+    const tree = await treeRes.json();
+    const firstLesson = tree.chapters?.[0]?.lessons?.[0];
+    if (!firstLesson) { test.skip(true, "No lessons in tree"); return; }
+
+    const lessonRes = await page.request.get(`${BASE}/api/lessons/${firstLesson.id}`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+    });
+    expect(lessonRes.status()).toBe(200);
+    const lesson = await lessonRes.json();
+
+    expect(lesson.videoUrl).toBeTruthy();
+    expect(lesson.videoUrl).toMatch(/^https?:\/\//);
+
+    // Must be signed (has query params) or served via /media/ proxy
+    const url = new URL(lesson.videoUrl);
+    const isSigned = url.searchParams.size > 0 || lesson.videoUrl.includes("/media/");
+    expect(isSigned, `videoUrl not signed: ${lesson.videoUrl}`).toBe(true);
+  });
+
+  test("player page renders without JS errors for first lesson", async ({ page }) => {
+    const auth = requireAuth();
+    const treeRes = await page.request.get(`${BASE}/api/tree`, {
+      headers: { Authorization: `Bearer ${auth.accessToken}` },
+    });
+    const tree = await treeRes.json();
+    const firstLesson = tree.chapters?.[0]?.lessons?.[0];
+    if (!firstLesson) { test.skip(true, "No lessons in tree"); return; }
+
+    const jsErrors: string[] = [];
+    page.on("pageerror", (err) => jsErrors.push(err.message));
+
+    await injectAuth(page);
+    await page.goto(`/player/${firstLesson.id}`);
+    await page.waitForLoadState("networkidle", { timeout: 20_000 });
+
+    // Filter known expected media errors (video load failures in headless are expected)
+    const realErrors = jsErrors.filter(
+      (e) => !e.includes("video") && !e.includes("media") && !e.includes("hls") && !e.includes("AbortError")
+    );
+    expect(realErrors, `JS errors on player page: ${realErrors.join(", ")}`).toHaveLength(0);
+  });
+
+  test("admin videos panel fires no media requests on grid load", async ({ page }) => {
+    requireAuth();
+    const videoRequests: string[] = [];
+    page.on("request", (req) => {
+      if (req.resourceType() === "media" || /\.(mp4|m3u8|ts)(\?|$)/.test(req.url())) {
+        videoRequests.push(req.url());
+      }
+    });
+
+    await injectAuth(page);
+    await page.goto("/admin");
+    await page.waitForLoadState("networkidle", { timeout: 15_000 });
+
+    // Click Videos tab if present
+    const videosTab = page.getByRole("button", { name: /ویدیو/i });
+    if (await videosTab.count() > 0) {
+      await videosTab.first().click();
+      await page.waitForLoadState("networkidle", { timeout: 10_000 });
+    }
+
+    expect(videoRequests, `Unexpected media requests on grid load: ${videoRequests.join(", ")}`).toHaveLength(0);
+  });
+});

frontend/e2e/websocket.spec.ts

@@ -0,0 +1,56 @@
+import * as tls from "tls";
+import { test, expect } from "@playwright/test";
+import { BASE, requireAuth } from "./helpers";
+
+test.describe("WebSocket", () => {
+  // Test WS via raw TLS to avoid browser HTTP/2 and Node.js http module quirks.
+  test("WS handshake with valid token succeeds", async () => {
+    const auth = requireAuth();
+
+    const statusCode = await new Promise<number>((resolve) => {
+      const socket = tls.connect(
+        { host: "localhost", port: 443, rejectUnauthorized: false },
+        () => {
+          const handshake = [
+            "GET /api/ws HTTP/1.1",
+            "Host: localhost",
+            "Upgrade: websocket",
+            "Connection: Upgrade",
+            "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==",
+            "Sec-WebSocket-Version: 13",
+            `Authorization: Bearer ${auth.accessToken!}`,
+            "",
+            "",
+          ].join("\r\n");
+          socket.write(handshake);
+        },
+      );
+      let buf = "";
+      socket.on("data", (chunk) => {
+        buf += chunk.toString();
+        const firstLine = buf.split("\r\n")[0] ?? "";
+        const m = firstLine.match(/HTTP\/1\.\d\s+(\d+)/);
+        if (m) {
+          socket.destroy();
+          resolve(parseInt(m[1], 10));
+        }
+      });
+      socket.on("error", () => resolve(0));
+      setTimeout(() => { socket.destroy(); resolve(0); }, 8000);
+    });
+
+    expect(statusCode, `WS upgrade returned ${statusCode}`).toBe(101);
+  });
+
+  test("WS handshake without token is rejected", async ({ page }) => {
+    const result = await page.evaluate((wsUrl) => {
+      return new Promise<{ code: number }>((resolve) => {
+        const ws = new WebSocket(wsUrl);
+        ws.onclose = (e) => resolve({ code: e.code });
+        setTimeout(() => resolve({ code: -1 }), 6000);
+      });
+    }, BASE.replace("https", "wss") + "/api/ws");
+
+    expect(result.code).not.toBe(1000);
+  });
+});

frontend/package.json

@@ -20,13 +20,20 @@
     "@radix-ui/react-switch": "^1.1.2",
     "@radix-ui/react-tabs": "^1.1.2",
     "@tanstack/react-query": "^5.62.0",
+    "@tiptap/extension-placeholder": "^3.32.0",
+    "@tiptap/react": "^3.32.0",
+    "@tiptap/starter-kit": "^3.32.0",
+    "@types/dompurify": "^3.0.5",
     "boring-avatars": "^2.0.4",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.1.0",
+    "dompurify": "^3.4.17",
     "emoji-datasource-apple": "^15.1.2",
     "framer-motion": "^12.0.0",
+    "hls.js": "^1.7.3",
     "lucide-react": "^0.468.0",
+    "marked": "^18.1.1",
     "next": "15.5.27",
     "next-themes": "^0.4.4",
     "react": "^19.0.0",
@@ -34,10 +41,12 @@
     "react-multi-date-picker": "^4.5.2",
     "sonner": "^1.7.1",
     "tailwind-merge": "^2.6.0",
+    "tiptap-markdown": "^0.9.0",
     "tw-animate-css": "^1.4.0",
     "zustand": "^5.0.2"
   },
   "devDependencies": {
+    "@playwright/test": "^1.64.1",
     "@tailwindcss/postcss": "^4.0.0",
     "@types/node": "^22.10.0",
     "@types/react": "^19.0.0",

frontend/playwright.config.ts

@@ -0,0 +1,31 @@
+import { defineConfig, devices } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./e2e",
+  timeout: 30_000,
+  retries: 0,
+  workers: 1,
+  globalSetup: "./e2e/global-setup.ts",
+  reporter: [["list"], ["html", { open: "never", outputFolder: "playwright-report" }]],
+  use: {
+    baseURL: "https://localhost",
+    ignoreHTTPSErrors: true,
+    screenshot: "only-on-failure",
+    video: "off",
+    trace: "retain-on-failure",
+    locale: "fa-IR",
+  },
+  projects: [
+    {
+      name: "chromium",
+      use: {
+        browserName: "chromium",
+        viewport: { width: 1280, height: 800 },
+        launchOptions: {
+          executablePath: `${process.env.HOME}/.cache/ms-playwright/chromium_headless_shell-1234/chrome-headless-shell-linux64/chrome-headless-shell`,
+          args: ["--no-sandbox", "--disable-dev-shm-usage", "--disable-http2"],
+        },
+      },
+    },
+  ],
+});

frontend/src/app/admin/bot-docs/page.tsx

@@ -0,0 +1,115 @@
+"use client";
+
+import { useEffect } from "react";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useAuth } from "@/lib/auth-store";
+
+export default function BotDocsPage() {
+  const user = useAuth((s) => s.user);
+  const router = useRouter();
+
+  useEffect(() => {
+    if (user && user.role !== "admin") {
+      router.replace("/admin");
+    }
+  }, [user, router]);
+
+  if (!user || user.role !== "admin") {
+    return null;
+  }
+
+  return (
+    <div className="mx-auto max-w-3xl space-y-4">
+      <header className="space-y-2">
+        <p className="text-xs font-bold text-muted-foreground">
+          <Link href="/admin?tab=bots" className="underline-offset-4 hover:underline">
+            ربات
+          </Link>
+        </p>
+        <h1 className="text-2xl font-black tracking-tight">راهنمای ربات</h1>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          با یک کلید API می‌توانید از بیرون پرگار به هنرجو پیام بفرستید و جواب‌های او را بخوانید.
+        </p>
+      </header>
+
+      <section className="space-y-3 rounded-2xl border border-border bg-card p-5">
+        <h2 className="text-base font-black">ساخت کلید</h2>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          در مدیریت، بخش ربات، یک نام بگذارید و «ساخت ربات» را بزنید. پاسخ ساخت شامل فیلد <Code>token</Code> است.
+          توکن فقط یک بار نشان داده می‌شود. بعد از بستن یا بارگذاری دوبارهٔ صفحه دیگر برنمی‌گردد؛ سرور فقط هش آن را نگه می‌دارد.
+        </p>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          هر ردیف نام، زمان ساخت، وضعیت و تعداد درخواست‌های تأییدشده را نشان می‌دهد. با «توقف» کلید متوقف می‌شود و با «فعال‌کردن» دوباره کار می‌کند.
+        </p>
+      </section>
+
+      <section className="space-y-3 rounded-2xl border border-border bg-card p-5">
+        <h2 className="text-base font-black">احراز هویت</h2>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          هر دو مسیر زیر هدر <Code>X-Bot-Token</Code> می‌خواهند. توکن خالی، ناشناس یا متوقف با وضعیت ۴۰۱ و پیام «توکن ربات نامعتبر است» رد می‌شود.
+          درخواست ناموفق در شمارنده حساب نمی‌شود. هر فراخوانی که توکن فعالش پذیرفته شود، یک واحد به شمار درخواست همان کلید اضافه می‌کند.
+        </p>
+      </section>
+
+      <section className="space-y-3 rounded-2xl border border-border bg-card p-5">
+        <h2 className="text-base font-black">ارسال پیام</h2>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          <Code>POST /api/bot/send</Code> پیامی از طرف ربات در گفتگوی هنرجو می‌سازد. بدنه JSON:
+        </p>
+        <ul className="list-disc space-y-1 pe-5 text-sm leading-relaxed text-muted-foreground">
+          <li>
+            <Code>userId</Code> شناسهٔ عددی هنرجو. لازم است.
+          </li>
+          <li>
+            <Code>text</Code> متن پیام. لازم است و نباید خالی باشد.
+          </li>
+          <li>
+            <Code>buttons</Code> آرایهٔ دکمه‌ها. هر عضو شیئی با فیلد <Code>text</Code> است. در گفتگو، زدن دکمه همان متن را به عنوان پیام هنرجو برای ربات می‌فرستد.
+          </li>
+        </ul>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          پاسخ موفق: <Code>{`{ "messageId": 123 }`}</Code>. اگر <Code>userId</Code> یا <Code>text</Code> نباشد، وضعیت ۴۰۰ و پیام «userId و text لازم است».
+        </p>
+        <Example
+          title="نمونه"
+          code={`curl -X POST /api/bot/send \\
+  -H 'Content-Type: application/json' \\
+  -H 'X-Bot-Token: YOUR_TOKEN' \\
+  -d '{"userId":12,"text":"سلام","buttons":[{"text":"باشه"}]}'`}
+        />
+      </section>
+
+      <section className="space-y-3 rounded-2xl border border-border bg-card p-5">
+        <h2 className="text-base font-black">خواندن پاسخ‌ها</h2>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          <Code>GET /api/bot/updates</Code> صف پاسخ‌هایی را برمی‌گرداند که هنرجو برای این ربات فرستاده است؛ چه متن آزاد، چه متن یک دکمه.
+          پارامتر <Code>offset</Code> آخرین شناسه‌ای است که قبلاً دیده‌اید. فقط ردیف‌های با <Code>id</Code> بزرگ‌تر برمی‌گردند، حداکثر ۵۰ تا. اگر نفرستید، از صفر شروع می‌شود.
+        </p>
+        <p className="text-sm leading-relaxed text-muted-foreground">
+          پاسخ: <Code>{`{ "updates": [ { "id": 1, "payload": { "from": 12, "name": "نام", "text": "جواب" }, "createdAt": "..." } ] }`}</Code>.
+          <Code>from</Code> شناسهٔ فرستنده است، <Code>name</Code> نام او و <Code>text</Code> متن پیام. اگر چیزی نباشد، <Code>updates</Code> آرایهٔ خالی است.
+        </p>
+      </section>
+    </div>
+  );
+}
+
+function Code({ children }: { children: string }) {
+  return (
+    <code dir="ltr" className="rounded-md bg-muted px-1.5 py-0.5 font-mono text-[0.8em]">
+      {children}
+    </code>
+  );
+}
+
+function Example({ title, code }: { title: string; code: string }) {
+  return (
+    <div className="space-y-2">
+      <p className="text-xs font-bold text-muted-foreground">{title}</p>
+      <pre dir="ltr" className="overflow-x-auto rounded-2xl border border-border bg-muted/40 p-3 text-left font-mono text-xs leading-relaxed">
+        {code}
+      </pre>
+    </div>
+  );
+}

frontend/src/app/c/[id]/page.tsx

@@ -1,45 +1,23 @@
 "use client";
 
-import { useQuery, useQueryClient } from "@tanstack/react-query";
-import Link from "next/link";
+import { useQuery } from "@tanstack/react-query";
 import { useParams } from "next/navigation";
-import { Loader2, Package } from "lucide-react";
+import { Loader2 } from "lucide-react";
 import { CertificateCard } from "@/components/certificate-card";
-import { Button } from "@/components/ui/button";
-import { Input } from "@/components/ui/input";
+import { NotFoundState, notFoundSentence } from "@/components/not-found-state";
 import { http, toUserError } from "@/lib/api";
 import { useAuth } from "@/lib/auth-store";
-import type { Certificate, CertificatePhysicalOrder, PhysicalCertSettings } from "@/lib/types";
-import { toast } from "@/components/providers";
-import { formatFaNumber } from "@/lib/utils";
-import { clampPhoneInput, normalizePhone, PHONE_INPUT_MAX_LEN } from "@/lib/validation";
-import { useEffect, useState } from "react";
+import type { Certificate } from "@/lib/types";
 
 type PublicCertResponse = {
   certificate: { publicId: string; fullName: string; issuedAt: string };
   course: string;
 };
 
-const STATUS_LABEL: Record<string, string> = {
-  requested: "درخواست‌شده — منتظر تأیید پرداخت",
-  paid: "پرداخت تأیید شد — در صف ارسال",
-  shipped: "ارسال شد",
-  cancelled: "لغو شده",
-};
-
 export default function CertificatePage() {
   const params = useParams<{ id: string }>();
   const publicId = params?.id ?? "";
   const authUser = useAuth((s) => s.user);
-  const qc = useQueryClient();
-  const [requesting, setRequesting] = useState(false);
-  const [form, setForm] = useState({
-    recipientName: "",
-    phone: "",
-    address: "",
-    city: "",
-    postalCode: "",
-  });
 
   const { data, isLoading, error } = useQuery({
     queryKey: ["certificate", publicId],
@@ -50,42 +28,12 @@ export default function CertificatePage() {
 
   const { data: mine } = useQuery({
     queryKey: ["me", "certificate"],
-    queryFn: () =>
-      http.get<{
-        certificate: Certificate | null;
-        physicalOrder: CertificatePhysicalOrder | null;
-        physical: PhysicalCertSettings;
-      }>("/api/me/certificate"),
+    queryFn: () => http.get<{ certificate: Certificate | null }>("/api/me/certificate"),
     enabled: !!authUser,
   });
 
   const isOwner = !!authUser && mine?.certificate?.publicId === publicId;
 
-  useEffect(() => {
-    if (!isOwner || !authUser) return;
-    setForm((f) => ({
-      ...f,
-      recipientName: f.recipientName || authUser.name || "",
-      phone: f.phone || authUser.phone || "",
-    }));
-  }, [isOwner, authUser]);
-
-  const requestPhysical = async () => {
-    setRequesting(true);
-    try {
-      await http.post("/api/me/certificate/physical", {
-        ...form,
-        phone: normalizePhone(form.phone),
-      });
-      toast.success("درخواست ثبت شد — پس از واریز با ادمین هماهنگ کنید");
-      qc.invalidateQueries({ queryKey: ["me", "certificate"] });
-    } catch (e) {
-      toast.error(toUserError(e));
-    } finally {
-      setRequesting(false);
-    }
-  };
-
   if (isLoading) {
     return (
       <div className="flex min-h-[60vh] items-center justify-center">
@@ -96,27 +44,20 @@ export default function CertificatePage() {
 
   if (error || !data?.certificate) {
     return (
-      <div className="mx-auto max-w-lg px-4 py-16 text-center">
-        <p className="text-lg font-bold">گواهینامه پیدا نشد</p>
-        <Button asChild className="mt-4" variant="outline">
-          <Link href="/">بازگشت</Link>
-        </Button>
-      </div>
+      <NotFoundState
+        title="گواهینامه پیدا نشد"
+        description={notFoundSentence(
+          error ? toUserError(error, "") : "",
+          "این گواهینامه در سامانه نیست.",
+          "گواهینامه پیدا نشد",
+        )}
+        href="/"
+        actionLabel="بازگشت به خانه"
+      />
     );
   }
 
   const cert = data.certificate;
-  const order = isOwner ? mine?.physicalOrder : null;
-  const physical = isOwner ? mine?.physical : null;
-  const windowEndsAt = mine?.certificate?.issuedAt
-    ? new Date(mine.certificate.issuedAt).getTime() + (physical?.windowDays ?? 30) * 86400000
-    : 0;
-  const windowStillOpen = !windowEndsAt || Date.now() < windowEndsAt;
-  const windowOpen =
-    physical?.enabled &&
-    windowStillOpen &&
-    (!order || order.status === "cancelled") &&
-    !!mine?.certificate;
 
   return (
     <CertificateCard
@@ -126,94 +67,7 @@ export default function CertificatePage() {
         issuedAt: cert.issuedAt,
         course: data.course,
       }}
-      showOwnerLinks={!!authUser}
-    >
-      {isOwner && physical?.enabled && (
-        <div className="mt-8 space-y-3 border-t border-border pt-6">
-          <p className="flex items-center gap-2 text-sm font-bold">
-            <Package className="h-4 w-4" /> نسخه فیزیکی
-          </p>
-          <p className="text-xs text-muted-foreground">
-            قیمت حدودی {formatFaNumber(physical.priceIrr)} ریال · مهلت درخواست{" "}
-            {formatFaNumber(physical.windowDays)} روز از صدور
-            {windowEndsAt ? ` (تا ${new Date(windowEndsAt).toLocaleDateString("fa-IR")})` : ""}.
-            پرداخت آنلاین در سامانه نداریم. پس از واریز بیرونی با ادمین هماهنگ کنید تا وضعیت سفارش به‌روز شود.
-          </p>
-          {order && order.status !== "cancelled" ? (
-            <div className="space-y-2 rounded-xl border border-border bg-muted/30 p-3 text-sm">
-              <p>
-                وضعیت: <span className="font-medium">{STATUS_LABEL[order.status] ?? order.status}</span>
-              </p>
-              {order.trackingCode && (
-                <p className="font-mono text-xs" dir="ltr">
-                  کد پیگیری: {order.trackingCode}
-                </p>
-              )}
-              {order.city && (
-                <p className="text-xs text-muted-foreground">
-                  ارسال به {order.recipientName || "—"} · {order.city}
-                </p>
-              )}
-              {order.note && <p className="text-xs text-muted-foreground">یادداشت ادمین: {order.note}</p>}
-              <Button
-                size="sm"
-                variant="outline"
-                onClick={() =>
-                  window.dispatchEvent(new CustomEvent("pargar:chat", { detail: { open: true } }))
-                }
-              >
-                هماهنگی با تیم
-              </Button>
-            </div>
-          ) : windowOpen ? (
-            <div className="space-y-2">
-              <div className="grid gap-2 sm:grid-cols-2">
-                <Input
-                  placeholder="نام گیرنده"
-                  value={form.recipientName}
-                  onChange={(e) => setForm((f) => ({ ...f, recipientName: e.target.value }))}
-                />
-                <Input
-                  placeholder="موبایل"
-                  value={form.phone}
-                  onChange={(e) => setForm((f) => ({ ...f, phone: clampPhoneInput(e.target.value) }))}
-                  dir="ltr"
-                  inputMode="tel"
-                  maxLength={PHONE_INPUT_MAX_LEN}
-                  className="text-left"
-                />
-                <Input
-                  placeholder="شهر"
-                  value={form.city}
-                  onChange={(e) => setForm((f) => ({ ...f, city: e.target.value }))}
-                />
-                <Input
-                  placeholder="کد پستی"
-                  value={form.postalCode}
-                  onChange={(e) => setForm((f) => ({ ...f, postalCode: e.target.value }))}
-                  dir="ltr"
-                />
-              </div>
-              <textarea
-                className="min-h-[72px] w-full rounded-md border border-input bg-background px-3 py-2 text-sm"
-                placeholder="آدرس کامل پستی"
-                value={form.address}
-                onChange={(e) => setForm((f) => ({ ...f, address: e.target.value }))}
-              />
-              <Button
-                size="sm"
-                disabled={requesting || !form.address.trim() || !form.city.trim()}
-                onClick={() => void requestPhysical()}
-              >
-                {requesting ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Package className="h-3.5 w-3.5" />}
-                ثبت درخواست نسخه فیزیکی
-              </Button>
-            </div>
-          ) : !windowStillOpen ? (
-            <p className="text-sm text-muted-foreground">مهلت درخواست نسخه فیزیکی به پایان رسیده است.</p>
-          ) : null}
-        </div>
-      )}
-    </CertificateCard>
+      showOwnerLinks={isOwner}
+    />
   );
 }

frontend/src/app/cap/page.tsx

@@ -2,7 +2,7 @@
 
 import { useRouter, useSearchParams } from "next/navigation";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { Suspense, useEffect, useRef } from "react";
+import { Suspense, useEffect, useLayoutEffect, useRef, useState } from "react";
 import {
   Award,
   ArrowLeft,
@@ -13,7 +13,6 @@ import {
   Heart,
   Lock,
   MessageSquare,
-  Package,
   PlayCircle,
   Sparkles,
   TrendingUp,
@@ -22,12 +21,13 @@ import {
 import { SkillTree } from "@/components/skill-tree";
 import { Skeleton } from "@/components/ui/skeleton";
 import { http, toUserError } from "@/lib/api";
-import type { Certificate, CertificatePhysicalOrder, MeetingEvent, PhysicalCertSettings, TreeData, TreeLesson } from "@/lib/types";
+import type { Certificate, MeetingEvent, TreeData, TreeLesson } from "@/lib/types";
 import { Button } from "@/components/ui/button";
 import { useAuth } from "@/lib/auth-store";
 import { cn, formatFaNumber, formatStreakLabel } from "@/lib/utils";
 import { clampHearts, hasInfiniteHearts, INFINITE_HEARTS_LABEL, MAX_HEARTS } from "@/lib/hearts";
 import { toast } from "@/components/providers";
+import { SafeMarkdown } from "@/components/safe-markdown";
 
 export default function CapPage() {
   return (
@@ -57,8 +57,8 @@ function CapPageInner() {
   });
 
   const allLessons = (data?.chapters ?? []).flatMap((ch) => ch.lessons ?? []);
-  const completedCount = allLessons.filter((l) => l.progress?.passedQuiz).length;
-  const curriculumDone = allLessons.length > 0 && completedCount === allLessons.length;
+  const completedCount = data?.completedLessons ?? allLessons.filter((l) => l.progress?.passedQuiz).length;
+  const curriculumDone = (data?.progressPct ?? 0) >= 100;
 
   useEffect(() => {
     const lesson = params.get("lesson");
@@ -69,22 +69,10 @@ function CapPageInner() {
 
   const { data: certData } = useQuery({
     queryKey: ["me", "certificate"],
-    queryFn: () =>
-      http.get<{
-        certificate: Certificate | null;
-        physicalOrder: CertificatePhysicalOrder | null;
-        physical: PhysicalCertSettings;
-      }>("/api/me/certificate"),
+    queryFn: () => http.get<{ certificate: Certificate | null }>("/api/me/certificate"),
     enabled: !!user && curriculumDone,
   });
 
-  useEffect(() => {
-    if (!curriculumDone || !user) return;
-    void http
-      .post("/api/me/certificate/issue", {})
-      .then(() => qc.invalidateQueries({ queryKey: ["me", "certificate"] }))
-      .catch((e) => toast.error(toUserError(e, "صدور گواهینامه ممکن نشد")));
-  }, [curriculumDone, user, qc]);
 
   if (isLoading) {
     return <CapSkeleton />;
@@ -101,20 +89,10 @@ function CapPageInner() {
   const firstLocked = all.find((l) => l.locked);
   const done = curriculumDone;
 
-  const pct = all.length ? Math.round((completedCount / all.length) * 100) : 0;
+  const pct = Math.round(data?.progressPct ?? 0);
   const hearts = clampHearts(me?.hearts ?? user?.hearts ?? MAX_HEARTS);
   const lowHearts = !hasInfiniteHearts(user?.role) && hearts > 0 && hearts <= 1;
   const nextEvent = (eventsData?.events ?? [])[0];
-  const physicalOpen =
-    done &&
-    certData?.physical?.enabled &&
-    !!certData.certificate &&
-    (!certData.physicalOrder || certData.physicalOrder.status === "cancelled") &&
-    (!certData.certificate.issuedAt ||
-      Date.now() <
-        new Date(certData.certificate.issuedAt).getTime() +
-          (certData.physical.windowDays || 30) * 24 * 60 * 60 * 1000);
-
   const next = nextAction(inProgress, readyQuiz, openAndNew, firstLocked, done);
 
   return (
@@ -150,6 +128,8 @@ function CapPageInner() {
         </div>
       </div>
 
+      <PinnedAnnouncement />
+
       {lowHearts && (
         <div className="flex flex-wrap items-center justify-between gap-3 rounded-2xl border-2 border-destructive/30 bg-destructive/5 px-5 py-4">
           <div className="flex items-start gap-3">
@@ -157,7 +137,7 @@ function CapPageInner() {
             <div>
               <p className="text-sm font-extrabold text-destructive">فقط {formatFaNumber(hearts)} جان مانده</p>
               <p className="text-xs text-muted-foreground">
-                یک اشتباه دیگر حساب را قفل می‌کند. قبل از آزمون مطمئن شوید؛ اگر گیر کردید با منتور حرف بزنید.
+                جان‌ها خودشان برمی‌گردند. تا برگشتن یک جان، آزمون تازه صبر می‌کند.
               </p>
             </div>
           </div>
@@ -178,33 +158,29 @@ function CapPageInner() {
           <div>
             <p className="text-sm font-extrabold">دوره را تمام کردید</p>
             <p className="text-xs text-muted-foreground">
-              گواهینامه دیجیتال آماده است
-              {physicalOpen ? " — می‌توانید نسخه فیزیکی هم درخواست کنید." : "."}
+              {certData?.certificate?.status === "pending"
+                ? "درخواست گواهینامه ثبت شد — پس از تأیید تیم آموزش صادر می‌شود."
+                : certData?.certificate?.status === "issued"
+                  ? "گواهینامه دیجیتال آماده است."
+                  : "گواهینامه دیجیتال آماده است."}
             </p>
           </div>
-          <div className="flex flex-wrap gap-2">
-            <Button
-              onClick={() => {
-                const id = certData?.certificate?.publicId;
-                if (id) router.push(`/c/${id}`);
-                else {
-                  void http
-                    .post<{ certificate: { publicId: string } }>("/api/me/certificate/issue", {})
-                    .then((r) => {
-                      if (r.certificate?.publicId) router.push(`/c/${r.certificate.publicId}`);
-                    })
-                    .catch((e) => toast.error(toUserError(e, "صدور گواهینامه ممکن نشد")));
-                }
-              }}
-            >
+          {certData?.certificate?.status === "issued" && certData.certificate.publicId ? (
+            <Button onClick={() => router.push(`/c/${certData.certificate!.publicId!}`)}>
               <Award className="h-4 w-4" /> مشاهده گواهینامه
             </Button>
-            {physicalOpen && certData?.certificate?.publicId && (
-              <Button variant="outline" onClick={() => router.push(`/c/${certData.certificate!.publicId}`)}>
-                <Package className="h-4 w-4" /> نسخه فیزیکی
-              </Button>
-            )}
-          </div>
+          ) : certData?.certificate?.status !== "pending" ? (
+            <Button
+              onClick={() => {
+                void http
+                  .post("/api/me/certificate/issue", {})
+                  .then(() => qc.invalidateQueries({ queryKey: ["me", "certificate"] }))
+                  .catch((e) => toast.error(toUserError(e, "صدور گواهینامه ممکن نشد")));
+              }}
+            >
+              <Award className="h-4 w-4" /> دریافت گواهینامه
+            </Button>
+          ) : null}
         </div>
       )}
 
@@ -450,6 +426,244 @@ function CapSkeleton() {
   );
 }
 
+type CapAnnouncement = { title: string; body: string; route: string };
+
+function PinnedAnnouncement() {
+  const router = useRouter();
+  const scroller = useRef<HTMLDivElement>(null);
+  const gesture = useRef<{
+    x: number;
+    y: number;
+    scroll: number;
+    index: number;
+    pointerId: number;
+    axis: "x" | "y" | null;
+    dx: number;
+  } | null>(null);
+  const moved = useRef(0);
+  const [index, setIndex] = useState(0);
+  const q = useQuery({
+    queryKey: ["announcement-pinned"],
+    queryFn: () =>
+      http.get<{ announcement: CapAnnouncement | null; announcements?: CapAnnouncement[] }>("/api/announcements/pinned"),
+  });
+  const items = q.data?.announcements?.length
+    ? q.data.announcements
+    : q.data?.announcement
+      ? [q.data.announcement]
+      : [];
+  const count = items.length;
+  const indexRef = useRef(0);
+  const hoverRef = useRef(false);
+  const downRef = useRef(false);
+  const programmatic = useRef(0);
+  const scrollSeq = useRef(0);
+  const wantScroll = useRef(false);
+  const scrollBehavior = useRef<ScrollBehavior>("smooth");
+  const [epoch, setEpoch] = useState(0);
+
+  const stride = (el: HTMLDivElement) => {
+    const card = el.firstElementChild as HTMLElement | null;
+    const gap = 12;
+    return (card?.offsetWidth || el.clientWidth || 1) + gap;
+  };
+
+  const goTo = (next: number, behavior: ScrollBehavior = "smooth") => {
+    if (count < 2) return;
+    const i = ((next % count) + count) % count;
+    const from = indexRef.current;
+    const neighbor = Math.abs(i - from) === 1;
+    scrollBehavior.current = neighbor && behavior === "smooth" ? "smooth" : "auto";
+    wantScroll.current = true;
+    indexRef.current = i;
+    setIndex(i);
+    setEpoch((n) => n + 1);
+  };
+
+  const stepBy = (delta: number) => {
+    const from = indexRef.current;
+    const dest = from + delta < 0 ? count - 1 : from + delta >= count ? 0 : from + delta;
+    goTo(dest, Math.abs(dest - from) === 1 ? "smooth" : "auto");
+  };
+
+  const stepRef = useRef(stepBy);
+  stepRef.current = stepBy;
+
+  useLayoutEffect(() => {
+    const el = scroller.current;
+    if (!el || count < 2 || !wantScroll.current) return;
+    wantScroll.current = false;
+    const token = scrollSeq.current + 1;
+    scrollSeq.current = token;
+    programmatic.current = token;
+    const left = indexRef.current * stride(el);
+    let settledOnce = false;
+    const finish = (force: boolean) => {
+      if (settledOnce || scrollSeq.current !== token) return;
+      if (gesture.current?.axis === "x") return;
+      const target = indexRef.current * stride(el);
+      const settled = Math.abs(el.scrollLeft - target) <= 2;
+      if (!settled && !force) return;
+      if (!settled) {
+        el.style.scrollBehavior = "auto";
+        el.scrollLeft = target;
+      }
+      settledOnce = true;
+      if (programmatic.current === token) programmatic.current = 0;
+      el.removeEventListener("scrollend", onEnd);
+    };
+    const onEnd = () => {
+      if (scrollSeq.current !== token || !programmatic.current) return;
+      finish(false);
+    };
+    el.addEventListener("scrollend", onEnd);
+    el.style.scrollBehavior = scrollBehavior.current === "smooth" ? "smooth" : "auto";
+    el.scrollTo({ left, behavior: scrollBehavior.current });
+    const soon = window.setTimeout(() => finish(false), scrollBehavior.current === "auto" ? 40 : 700);
+    const later = window.setTimeout(() => finish(true), 1200);
+    return () => {
+      window.clearTimeout(soon);
+      window.clearTimeout(later);
+      el.removeEventListener("scrollend", onEnd);
+    };
+  }, [index, epoch, count]);
+
+  useEffect(() => {
+    if (count < 2) return;
+    const id = window.setInterval(() => {
+      if (hoverRef.current || downRef.current) return;
+      stepRef.current(1);
+    }, 6000);
+    return () => window.clearInterval(id);
+  }, [count, epoch]);
+
+  if (count === 0) return null;
+
+  const hold = (hover: boolean | null, down: boolean | null) => {
+    if (hover != null) hoverRef.current = hover;
+    if (down != null) downRef.current = down;
+  };
+
+  const go = (next: number) => goTo(next);
+
+  const onTrackPointerDown = (e: React.PointerEvent<HTMLDivElement>) => {
+    if (e.button !== 0) return;
+    const el = scroller.current;
+    if (!el) return;
+    gesture.current = {
+      x: e.clientX,
+      y: e.clientY,
+      scroll: el.scrollLeft,
+      index: indexRef.current,
+      pointerId: e.pointerId,
+      axis: null,
+      dx: 0,
+    };
+    moved.current = 0;
+  };
+
+  const onTrackPointerMove = (e: React.PointerEvent<HTMLDivElement>) => {
+    const g = gesture.current;
+    if (!g || g.pointerId !== e.pointerId) return;
+    const dx = e.clientX - g.x;
+    const dy = e.clientY - g.y;
+    g.dx = dx;
+    if (g.axis == null) {
+      if (Math.abs(dx) < 8 && Math.abs(dy) < 8) return;
+      g.axis = Math.abs(dx) > Math.abs(dy) ? "x" : "y";
+    }
+    if (g.axis !== "x" || count < 2) return;
+    const el = scroller.current;
+    if (!el) return;
+    if (!el.hasPointerCapture(e.pointerId)) el.setPointerCapture(e.pointerId);
+    const width = stride(el);
+    const max = width * (count - 1);
+    const pulled = g.scroll - dx;
+    const limited = Math.min(g.scroll + width, Math.max(g.scroll - width, pulled));
+    el.style.scrollBehavior = "auto";
+    el.scrollLeft = Math.min(max, Math.max(0, limited));
+  };
+
+  const onTrackPointerUp = (e: React.PointerEvent<HTMLDivElement>) => {
+    const g = gesture.current;
+    if (!g || g.pointerId !== e.pointerId) return;
+    moved.current = Math.max(Math.abs(g.dx), Math.abs(e.clientY - g.y));
+    const el = scroller.current;
+    if (el?.hasPointerCapture(e.pointerId)) el.releasePointerCapture(e.pointerId);
+    if (g.axis !== "x" || count < 2) {
+      gesture.current = null;
+      if (el) el.style.scrollBehavior = "";
+      return;
+    }
+    const threshold = 40;
+    let next = g.index;
+    if (g.dx <= -threshold) next = g.index + 1;
+    else if (g.dx >= threshold) next = g.index - 1;
+    go(next);
+    gesture.current = null;
+  };
+
+  return (
+    <div
+      className="relative"
+      onPointerEnter={() => hold(true, null)}
+      onPointerLeave={() => {
+        if (gesture.current?.axis === "x") {
+          hold(false, null);
+          return;
+        }
+        hold(false, false);
+        setEpoch((n) => n + 1);
+      }}
+      onPointerDown={() => hold(null, true)}
+      onPointerUp={() => hold(null, false)}
+      onPointerCancel={() => hold(null, false)}
+    >
+      <div
+        ref={scroller}
+        dir="ltr"
+        style={{ direction: "ltr" }}
+        className="flex gap-3 touch-pan-y select-none overflow-hidden [scrollbar-width:none] [&::-webkit-scrollbar]:hidden"
+        onPointerDown={onTrackPointerDown}
+        onPointerMove={onTrackPointerMove}
+        onPointerUp={onTrackPointerUp}
+        onPointerCancel={onTrackPointerUp}
+      >
+        {items.map((a, i) => (
+          <button
+            key={`${a.title}-${i}`}
+            type="button"
+            dir="rtl"
+            draggable={false}
+            onClick={() => {
+              if (Math.abs(moved.current) > 12) return;
+              if (a.route) router.push(a.route);
+            }}
+            className="block w-[calc(100%-2rem)] min-w-[calc(100%-2rem)] max-w-[calc(100%-2rem)] shrink-0 touch-pan-y rounded-2xl border-2 border-primary/30 bg-primary/5 px-5 py-4 text-start"
+          >
+            <p className="text-xs font-bold text-primary">اطلاعیه</p>
+            <p className="mt-1 text-base font-black">{a.title}</p>
+            <SafeMarkdown text={a.body} lines={3} className="mt-1 text-sm text-muted-foreground" />
+          </button>
+        ))}
+      </div>
+      {items.length > 1 && (
+        <div className="mt-2 flex items-center justify-center gap-1.5">
+          {items.map((a, i) => (
+            <button
+              key={`${a.title}-dot-${i}`}
+              type="button"
+              aria-label={`اطلاعیه ${i + 1}`}
+              onClick={() => go(i)}
+              className={cn("h-1.5 rounded-full transition-all", i === index ? "w-4 bg-primary" : "w-1.5 bg-primary/30")}
+            />
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
+
 function ZapIcon(props: { className?: string }) {
   return (
     <svg viewBox="0 0 24 24" fill="currentColor" {...props}>

frontend/src/app/globals.css

@@ -254,6 +254,31 @@
     border-radius: 999px;
     border-width: 0;
   }
+  textarea.chat-composer {
+    unicode-bidi: plaintext;
+    text-align: start;
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+    field-sizing: content;
+    max-height: 16rem;
+    overflow-y: auto;
+  }
+  textarea.chat-composer:placeholder-shown {
+    direction: rtl;
+    text-align: right;
+  }
+  textarea.chat-composer::placeholder {
+    unicode-bidi: plaintext;
+    text-align: start;
+  }
+  .chat-bubble-text {
+    unicode-bidi: plaintext;
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+    word-break: break-word;
+    max-width: 100%;
+    text-align: start;
+  }
   .section-kicker {
     display: flex;
     align-items: center;

frontend/src/app/layout.tsx

@@ -1,4 +1,4 @@
-import type { Metadata } from "next";
+import type { Metadata, Viewport } from "next";
 import localFont from "next/font/local";
 import "./globals.css";
 import { Providers } from "@/components/providers";
@@ -35,6 +35,21 @@ const vazirmatnLatin = localFont({
 export const metadata: Metadata = {
   title: "پرگار",
   description: "مسیر یادگیری واقعی پرگار",
+  icons: {
+    icon: [
+      { url: "/favicon.ico" },
+      { url: "/icon-192.png", sizes: "192x192", type: "image/png" },
+      { url: "/icon-512.png", sizes: "512x512", type: "image/png" },
+    ],
+    apple: { url: "/apple-touch-icon.png", sizes: "180x180", type: "image/png" },
+  },
+};
+
+export const viewport: Viewport = {
+  width: "device-width",
+  initialScale: 1,
+  viewportFit: "cover",
+  interactiveWidget: "resizes-content",
 };
 
 export default function RootLayout({ children }: { children: React.ReactNode }) {

frontend/src/app/lockout/page.tsx

@@ -8,6 +8,7 @@ import { api, http, toUserError } from "@/lib/api";
 import { MAX_HEARTS, clampHearts, hasInfiniteHearts } from "@/lib/hearts";
 import type { Mentor, User } from "@/lib/types";
 import { Card } from "@/components/ui/card";
+import { Textarea } from "@/components/ui/textarea";
 import { Button } from "@/components/ui/button";
 import { toast } from "@/components/providers";
 import { cn } from "@/lib/utils";
@@ -89,8 +90,7 @@ export default function LockoutPage() {
       <p className="text-xs font-bold tracking-wider text-destructive">حساب قفل شد</p>
       <h1 className="mt-2 text-3xl font-bold tracking-tight">جان‌هایتان تمام شد</h1>
       <p className="mt-3 text-sm leading-relaxed text-muted-foreground">
-        هر پاسخ اشتباه در آزمون یک جان کم می‌کند. با تمام شدن سه جان، یادگیری و آزمون قفل می‌شود تا
-        تیم مسیر را بررسی کند — خودتان نمی‌توانید قفل را باز کنید.
+        جان‌ها معمولاً خودشان برمی‌گردند. این صفحه وقتی دیده می‌شود که مدیریت حساب را قفل کرده باشد.
       </p>
 
       <div className="mt-6 flex items-center gap-2">
@@ -117,14 +117,14 @@ export default function LockoutPage() {
       </Card>
 
       <div className="mt-5 w-full space-y-2">
-        <textarea
+        <Textarea
           value={note}
           onChange={(e) => setNote(e.target.value)}
           maxLength={500}
           rows={3}
           dir="rtl"
           placeholder="اختیاری: چه آزمونی گیر کردید؟ چه کمکی لازم دارید؟"
-          className="w-full rounded-xl border-2 border-border bg-background px-3 py-2 text-sm outline-none focus-visible:border-primary/50"
+          className="min-h-0"
         />
         <div className="flex flex-col gap-2 sm:flex-row">
           <Button className="flex-1" disabled={busy || requested} onClick={() => void requestUnlock()}>
@@ -144,7 +144,7 @@ export default function LockoutPage() {
           className={cn("w-full text-muted-foreground")}
           onClick={() => router.push("/unwrap?tab=community")}
         >
-          جامعه و حمایت
+          شبکه‌های پرگار
         </Button>
       </div>
     </div>

frontend/src/app/login/page.tsx

@@ -7,7 +7,7 @@ import { useQuery } from "@tanstack/react-query";
 import { CheckCircle2, Loader2, ShieldCheck, Timer, Zap } from "lucide-react";
 import { BrandMark } from "@/components/brand-mark";
 import { useAuth } from "@/lib/auth-store";
-import { http, toUserError } from "@/lib/api";
+import { ApiError, http, toUserError } from "@/lib/api";
 import type { User } from "@/lib/types";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -34,6 +34,7 @@ export default function LoginPage() {
   const [rememberMe, setRememberMe] = useState(false);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  const [captchaError, setCaptchaError] = useState<string | null>(null);
 
   const { data: registerStatus } = useQuery({
     queryKey: ["auth", "register-status"],
@@ -43,7 +44,7 @@ export default function LoginPage() {
   const submit = async (e: React.FormEvent) => {
     e.preventDefault();
     if (!challenge) {
-      setError("ابتدا کد امنیتی را بارگذاری کنید");
+      setCaptchaError("ابتدا کد امنیتی را بارگذاری کنید");
       setCaptchaKey((k) => k + 1);
       return;
     }
@@ -61,7 +62,10 @@ export default function LoginPage() {
       router.push("/cap");
     } catch (err) {
       setError(toUserError(err, "ورود ناموفق بود"));
-      setCaptchaKey((k) => k + 1);
+      // 429 is returned before the captcha is consumed, so keep this challenge.
+      if (!(err instanceof ApiError) || err.status !== 429) {
+        setCaptchaKey((k) => k + 1);
+      }
     } finally {
       setLoading(false);
     }
@@ -137,7 +141,7 @@ export default function LoginPage() {
                 value={captchaAnswer}
                 onChange={setCaptchaAnswer}
                 onChallenge={setChallenge}
-                onError={setError}
+                onError={setCaptchaError}
               />
               <label className="flex items-center justify-between gap-3 text-sm">
                 <span>مرا به یاد داشته باش</span>
@@ -147,7 +151,11 @@ export default function LoginPage() {
                   aria-label="مرا به یاد داشته باش"
                 />
               </label>
-              {error && <p className="text-sm text-destructive">{error}</p>}
+              {(error || captchaError) && (
+                <p className="text-sm text-destructive" role="alert">
+                  {error || captchaError}
+                </p>
+              )}
               <Button
                 type="submit"
                 variant="gradient"

frontend/src/app/not-found.tsx

@@ -1,58 +1,12 @@
-"use client";
-
-import Link from "next/link";
-import { BrandMark } from "@/components/brand-mark";
-import { Button } from "@/components/ui/button";
-import { useAuth, useAuthHydrated } from "@/lib/auth-store";
-import { Home, LogIn, Trees } from "lucide-react";
+import { NotFoundState } from "@/components/not-found-state";
 
 export default function NotFound() {
-  const hydrated = useAuthHydrated();
-  const user = useAuth((s) => s.user);
-  const loggedIn = hydrated && !!user;
-
   return (
-    <div className="mx-auto flex max-w-lg flex-col items-center px-4 py-16 text-center">
-      <div className="relative w-full overflow-hidden rounded-2xl border-2 border-border bg-card px-8 py-14 shadow-offset">
-        <div className="dot-grid dot-grid-primary pointer-events-none absolute -end-10 -top-10 h-40 w-40 opacity-60" aria-hidden />
-        <p className="text-7xl font-black tabular-nums text-primary/25">۴۰۴</p>
-        <div className="mt-4 flex justify-center">
-          <BrandMark locale="fa" size="lg" />
-        </div>
-        <h1 className="mt-6 text-2xl font-black tracking-tight">این مسیر پیدا نشد</h1>
-        <p className="mt-3 text-sm leading-relaxed text-muted-foreground">
-          {loggedIn
-            ? "این آدرس در سامانه نیست. از درخت مهارت یا مرکز ادامه دهید."
-            : "صفحه‌ای که دنبالش بودید پیدا نشد. می‌توانید به خانه برگردید یا وارد حساب شوید."}
-        </p>
-        <div className="mt-8 flex flex-wrap items-center justify-center gap-3">
-          {loggedIn ? (
-            <>
-              <Button asChild className="gap-2">
-                <Link href="/cap">
-                  <Trees className="h-4 w-4" /> درخت مهارت
-                </Link>
-              </Button>
-              <Button asChild variant="outline" className="gap-2">
-                <Link href="/unwrap?tab=community">مرکز · حمایت</Link>
-              </Button>
-            </>
-          ) : (
-            <>
-              <Button asChild className="gap-2">
-                <Link href="/">
-                  <Home className="h-4 w-4" /> خانه
-                </Link>
-              </Button>
-              <Button asChild variant="outline" className="gap-2">
-                <Link href="/login">
-                  <LogIn className="h-4 w-4" /> ورود
-                </Link>
-              </Button>
-            </>
-          )}
-        </div>
-      </div>
-    </div>
+    <NotFoundState
+      title="صفحه پیدا نشد"
+      description="این آدرس در سامانه نیست. از خانه می‌توانید دوباره شروع کنید."
+      href="/"
+      actionLabel="بازگشت به خانه"
+    />
   );
 }

frontend/src/app/notifications/page.tsx

@@ -48,7 +48,7 @@ export default function NotificationsPage() {
           <Skeleton className="h-8 w-44" />
           <Skeleton className="h-4 w-72" />
         </div>
-        <div className="rounded-2xl border border-border/70 bg-card p-6 shadow-soft">
+        <div className="rounded-2xl border-2 border-border/70 bg-card p-6 shadow-soft">
           <div className="flex items-center gap-3">
             <Skeleton className="h-10 w-10 rounded-xl" />
             <div className="flex-1 space-y-1.5">

frontend/src/app/page.tsx

@@ -93,6 +93,7 @@ export default function Home() {
 
   const goCap = () => router.push("/cap");
   const goLogin = () => router.push("/login");
+  const goRegister = () => router.push("/register");
 
   return (
     <div className="mx-auto flex max-w-5xl flex-col items-center">
@@ -134,7 +135,7 @@ export default function Home() {
                 <Button size="lg" onClick={goLogin} className="gap-2 px-8">
                   ورود
                 </Button>
-                <Button size="lg" variant="outline" onClick={goLogin} className="gap-2 px-8">
+                <Button size="lg" variant="outline" onClick={goRegister} className="gap-2 px-8">
                   <Zap className="h-5 w-5" /> شروع مسیر
                 </Button>
               </>
@@ -288,7 +289,7 @@ export default function Home() {
                   <Link href="/login">ورود</Link>
                 </Button>
                 <Button size="lg" variant="outline" asChild className="gap-2 px-8">
-                  <Link href="/login">
+                  <Link href="/register">
                     <PlayCircle className="h-5 w-5" /> شروع مسیر
                   </Link>
                 </Button>

frontend/src/app/player/[lessonId]/page.tsx

@@ -6,6 +6,7 @@ import { useEffect } from "react";
 import { useQuery } from "@tanstack/react-query";
 import { ArrowRight, Lock, TreePine } from "lucide-react";
 import { VideoPlayer } from "@/components/video-player";
+import { NotFoundState, notFoundSentence } from "@/components/not-found-state";
 import { ApiError, http, toUserError } from "@/lib/api";
 import type { Lesson, LessonProgress } from "@/lib/types";
 import { Button } from "@/components/ui/button";
@@ -24,6 +25,7 @@ function isLessonLockedError(error: unknown): boolean {
 export default function PlayerPage() {
   const { lessonId } = useParams<{ lessonId: string }>();
   const id = Number(lessonId);
+  const idOk = Number.isFinite(id) && id > 0;
   const router = useRouter();
   const user = useAuth((s) => s.user);
 
@@ -37,7 +39,7 @@ export default function PlayerPage() {
         progress: LessonProgress | null;
         quizStatus: string;
       }>(`/api/lessons/${id}`),
-    enabled: !!user && (!user.isLocked || hasInfiniteHearts(user.role)),
+    enabled: idOk && !!user && (!user.isLocked || hasInfiniteHearts(user.role)),
     staleTime: 5 * 60_000,
     retry: (count, err) => {
       if (isLessonLockedError(err)) return false;
@@ -53,6 +55,17 @@ export default function PlayerPage() {
     return null;
   }
 
+  if (!idOk) {
+    return (
+      <NotFoundState
+        title="درس پیدا نشد"
+        description="این درس در درخت مهارت نیست."
+        href="/cap"
+        actionLabel="بازگشت به درخت مهارت"
+      />
+    );
+  }
+
   if (isLoading) {
     return (
       <div className="mx-auto max-w-4xl space-y-6">
@@ -79,6 +92,16 @@ export default function PlayerPage() {
     if (isLessonLockedError(error)) {
       return <LockedLessonState onBack={() => router.push("/cap")} />;
     }
+    if (error instanceof ApiError && error.status === 404) {
+      return (
+        <NotFoundState
+          title="درس پیدا نشد"
+          description={notFoundSentence(toUserError(error, ""), "این درس در درخت مهارت نیست.", "درس پیدا نشد")}
+          href="/cap"
+          actionLabel="بازگشت به درخت مهارت"
+        />
+      );
+    }
     return (
       <div className="mx-auto max-w-lg space-y-4 py-16 text-center">
         <p className="font-medium text-destructive">{toUserError(error, "بارگذاری درس ممکن نشد")}</p>

frontend/src/app/profile/[id]/page.tsx

@@ -2,17 +2,15 @@
 
 import type { ReactNode } from "react";
 import dynamic from "next/dynamic";
-import Link from "next/link";
 import { useParams } from "next/navigation";
 import { useQuery } from "@tanstack/react-query";
-import { Flame, Heart, Sparkles, User as UserIcon } from "lucide-react";
+import { Flame, Heart, Sparkles } from "lucide-react";
+import { ProfileHeader } from "@/components/profile-header";
+import { NotFoundState, notFoundSentence } from "@/components/not-found-state";
 import { http, toUserError } from "@/lib/api";
 import { useAuth } from "@/lib/auth-store";
 import type { PublicProfile } from "@/lib/types";
-import { Panel } from "@/components/panel";
-import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
-import { UserAvatar, avatarPropsOf } from "@/components/ui/user-avatar";
 import { formatFaNumber, formatStreakLabel } from "@/lib/utils";
 
 const AdminProfileManage = dynamic(
@@ -20,12 +18,6 @@ const AdminProfileManage = dynamic(
   { ssr: false },
 );
 
-function roleLabel(role: string) {
-  if (role === "mentor") return "منتور";
-  if (role === "admin") return "ادمین";
-  return "هنرجو";
-}
-
 export default function PublicProfilePage() {
   const params = useParams<{ id: string }>();
   const id = Number(params.id);
@@ -41,9 +33,12 @@ export default function PublicProfilePage() {
 
   if (!enabled) {
     return (
-      <div className="mx-auto max-w-2xl py-16 text-center text-sm text-muted-foreground">
-        کاربر پیدا نشد.
-      </div>
+      <NotFoundState
+        title="کاربر پیدا نشد"
+        description="این شناسه در سامانه نیست."
+        href="/unwrap"
+        actionLabel="بازگشت به مرکز"
+      />
     );
   }
 
@@ -62,14 +57,16 @@ export default function PublicProfilePage() {
 
   if (profileQ.isError || !profileQ.data?.user) {
     return (
-      <div className="mx-auto max-w-2xl space-y-4 py-16 text-center">
-        <p className="text-sm font-bold text-destructive">
-          {toUserError(profileQ.error, "کاربر پیدا نشد")}
-        </p>
-        <Button asChild variant="outline">
-          <Link href="/unwrap">بازگشت</Link>
-        </Button>
-      </div>
+      <NotFoundState
+        title="کاربر پیدا نشد"
+        description={notFoundSentence(
+          toUserError(profileQ.error, ""),
+          "این شناسه در سامانه نیست.",
+          "کاربر پیدا نشد",
+        )}
+        href="/unwrap"
+        actionLabel="بازگشت به مرکز"
+      />
     );
   }
 
@@ -77,40 +74,55 @@ export default function PublicProfilePage() {
 
   return (
     <div className="mx-auto max-w-2xl space-y-6">
-      <Panel
-        title={person.name}
-        description={roleLabel(person.role)}
-        icon={<UserIcon className="h-5 w-5" />}
-        tint="bg-primary/10 text-primary"
-      >
-        <div className="flex flex-col items-center gap-4 sm:flex-row sm:items-start">
-          <UserAvatar name={person.name} className="h-20 w-20" {...avatarPropsOf(person)} />
-          <div className="min-w-0 flex-1 space-y-2 text-center sm:text-start">
-            <h1 className="text-2xl font-black tracking-tight">{person.name}</h1>
-            <p className="font-latin text-sm font-bold" dir="ltr">
-              @{person.username}
-            </p>
-            {person.isLocked && (
-              <p className="text-xs font-bold text-destructive">حساب قفل است</p>
-            )}
-          </div>
-        </div>
-      </Panel>
+      <ProfileHeader
+        person={{
+          name: person.name,
+          role: person.role,
+          banner: person.banner,
+          createdAt: person.private ? undefined : person.createdAt,
+          avatarVariant: person.avatarVariant,
+          avatarPalette: person.avatarPalette,
+          avatarPhoto: person.avatarPhoto,
+          isFrozen: person.isFrozen,
+          isClosed: person.isClosed,
+        }}
+        secondary={person.private ? "این پروفایل خصوصی است" : undefined}
+      />
+      {person.isLocked && <p className="text-xs font-bold text-destructive">حساب قفل است</p>}
 
+      {person.private ? (
+        <p className="text-sm text-muted-foreground">جز نام و آواتار چیزی نمایش داده نمی‌شود.</p>
+      ) : (
       <div className="grid gap-3 sm:grid-cols-2">
-        <Stat icon={<Sparkles className="h-4 w-4 text-gold" />} label="امتیاز" value={formatFaNumber(person.xp)} />
-        <Stat icon={<Heart className="h-4 w-4 text-destructive" />} label="قلب‌ها" value={formatFaNumber(person.hearts)} />
+        {person.xp != null && <Stat icon={<Sparkles className="h-4 w-4 text-gold" />} label="امتیاز" value={formatFaNumber(person.xp)} />}
+        {person.hearts != null && <Stat icon={<Heart className="h-4 w-4 text-destructive" />} label="قلب‌ها" value={formatFaNumber(person.hearts)} />}
+        {person.streakCurrent != null && (
         <Stat
           icon={<Flame className="h-4 w-4 text-accent" />}
           label="زنجیرهٔ فعلی"
           value={formatStreakLabel(person.streakCurrent)}
         />
+        )}
+        {person.streakLongest != null && (
         <Stat
           icon={<Flame className="h-4 w-4 text-muted-foreground" />}
           label="بلندترین زنجیره"
           value={formatStreakLabel(person.streakLongest)}
         />
+        )}
       </div>
+      )}
+      {(person.socialLinks ?? []).length > 0 && (
+        <ul className="space-y-1 text-sm">
+          {person.socialLinks!.map((l) => (
+            <li key={l.url}>
+              <a href={l.url} className="text-primary underline" target="_blank" rel="noreferrer">
+                {l.name}
+              </a>
+            </li>
+          ))}
+        </ul>
+      )}
 
       {isAdmin && <AdminProfileManage userId={person.id} />}
     </div>

frontend/src/app/profile/page.tsx

@@ -2,16 +2,16 @@
 
 import Link from "next/link";
 import { useQuery } from "@tanstack/react-query";
-import { Flame, Heart, Sparkles, Trophy, User as UserIcon } from "lucide-react";
+import { Flame, Heart, Sparkles, Trophy } from "lucide-react";
+import { useState } from "react";
 import { useAuth } from "@/lib/auth-store";
 import { http, toUserError } from "@/lib/api";
-import type { LeaderboardData } from "@/lib/types";
-import { Panel } from "@/components/panel";
+import type { LeaderboardData, MeetingEvent } from "@/lib/types";
 import { Card, CardContent } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
-import { UserAvatar, avatarPropsOf } from "@/components/ui/user-avatar";
 import { ProfileCertificateSlot } from "@/components/profile-certificate-slot";
+import { OwnerProfileHeader } from "@/components/profile-header";
 import { ChallengeCards } from "@/components/challenge-cards";
 import { AvatarStudio } from "@/components/avatar-studio";
 import {
@@ -20,8 +20,7 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog";
-import { formatFaNumber, formatStreakLabel } from "@/lib/utils";
-import { useState } from "react";
+import { formatFaNumber, formatJalaliStamp, formatStreakLabel } from "@/lib/utils";
 
 export default function ProfilePage() {
   const user = useAuth((s) => s.user);
@@ -45,56 +44,7 @@ export default function ProfilePage() {
 
   return (
     <div className="mx-auto max-w-2xl space-y-6">
-      <Panel
-        title="پروفایل من"
-        description="هویت، آمار یادگیری، چالش‌ها و گواهینامه در یک نگاه."
-        icon={<UserIcon className="h-5 w-5" />}
-        tint="bg-primary/10 text-primary"
-        actions={
-          <Button variant="outline" size="sm" onClick={() => setStudioOpen(true)}>
-            ویرایش آواتار
-          </Button>
-        }
-      >
-        <div className="flex flex-col items-center gap-4 sm:flex-row sm:items-start">
-          <UserAvatar name={user.name} className="h-20 w-20" {...avatarPropsOf(user)} />
-          <div className="min-w-0 flex-1 space-y-2 text-center sm:text-start">
-            <h1 className="text-2xl font-black tracking-tight">{user.name}</h1>
-            <dl className="mt-1 space-y-2 text-sm">
-              <div className="flex items-baseline justify-between gap-3">
-                <dt className="shrink-0 text-xs text-muted-foreground">نام کاربری</dt>
-                <dd className="min-w-0 font-latin font-bold tracking-tight" dir="ltr">
-                  @{user.username}
-                </dd>
-              </div>
-              <div className="flex items-baseline justify-between gap-3">
-                <dt className="shrink-0 text-xs text-muted-foreground">ایمیل</dt>
-                <dd className="min-w-0 break-all font-latin font-medium" dir="ltr">
-                  {user.email}
-                </dd>
-              </div>
-              {user.phone && (
-                <div className="flex items-baseline justify-between gap-3">
-                  <dt className="shrink-0 text-xs text-muted-foreground">تلفن</dt>
-                  <dd className="min-w-0 font-latin font-medium" dir="ltr">
-                    {user.phone}
-                  </dd>
-                </div>
-              )}
-              <div className="flex items-baseline justify-between gap-3">
-                <dt className="shrink-0 text-xs text-muted-foreground">عضویت از</dt>
-                <dd className="min-w-0 font-medium">
-                  {new Date(user.createdAt).toLocaleDateString("fa-IR", {
-                    year: "numeric",
-                    month: "long",
-                    day: "numeric",
-                  })}
-                </dd>
-              </div>
-            </dl>
-          </div>
-        </div>
-      </Panel>
+      <OwnerProfileHeader user={user} onEditAvatar={() => setStudioOpen(true)} />
 
       <div className="grid gap-3 sm:grid-cols-2">
         <StatCard icon={<Sparkles className="h-4 w-4 text-gold" />} label="امتیاز کل" value={formatFaNumber(user.xp)} />
@@ -139,14 +89,16 @@ export default function ProfilePage() {
         <ChallengeCards />
       </div>
 
+      <ProfileActivity />
+
       <div>
         <h2 className="mb-2 text-sm font-black text-muted-foreground">گواهینامه</h2>
         <ProfileCertificateSlot />
       </div>
 
       <Dialog open={studioOpen} onOpenChange={setStudioOpen}>
-        <DialogContent className="max-w-lg">
-          <DialogHeader>
+        <DialogContent className="flex max-h-[min(85vh,40rem)] max-w-lg flex-col gap-3 overflow-hidden">
+          <DialogHeader className="shrink-0">
             <DialogTitle className="text-center">ویرایش آواتار</DialogTitle>
           </DialogHeader>
           <AvatarStudio user={user} onClose={() => setStudioOpen(false)} />
@@ -156,6 +108,172 @@ export default function ProfilePage() {
   );
 }
 
+function ProfileActivity() {
+  const activityQ = useQuery({
+    queryKey: ["me-activity"],
+    queryFn: () => http.get<{ days: { day: string; count: number }[] }>("/api/me/activity"),
+  });
+  const eventsQ = useQuery({
+    queryKey: ["events", "profile"],
+    queryFn: () => http.get<{ events: MeetingEvent[] }>("/api/events"),
+  });
+
+  return (
+    <div>
+      <h2 className="mb-2 text-sm font-black text-muted-foreground">فعالیت</h2>
+      <Card>
+        <CardContent className="space-y-6 p-4">
+          <div>
+            <h3 className="text-sm font-black">تاریخچهٔ ماهانه</h3>
+            <p className="mt-1 text-xs text-muted-foreground">هر بار یک ماه. پررنگ‌تر یعنی فعالیت بیشتر.</p>
+            {activityQ.isPending ? (
+              <Skeleton className="mt-3 h-24 rounded-xl" aria-busy="true" aria-label="در حال بارگذاری نمودار فعالیت" />
+            ) : activityQ.isError ? (
+              <p className="mt-3 text-sm font-bold text-destructive">{toUserError(activityQ.error, "بارگذاری فعالیت ممکن نشد")}</p>
+            ) : (
+              <ActivityGrid days={activityQ.data?.days ?? []} />
+            )}
+          </div>
+          <div>
+            <h3 className="text-sm font-black">رویدادها</h3>
+            {eventsQ.isPending ? (
+              <p className="mt-2 text-sm text-muted-foreground" aria-busy="true">
+                در حال بارگذاری…
+              </p>
+            ) : eventsQ.isError ? (
+              <p className="mt-2 text-sm font-bold text-destructive">{toUserError(eventsQ.error, "بارگذاری رویدادها ممکن نشد")}</p>
+            ) : (eventsQ.data?.events ?? []).length === 0 ? (
+              <p className="mt-2 text-sm text-muted-foreground">رویدادی نیست.</p>
+            ) : (
+              <ul className="mt-3 divide-y divide-border rounded-xl border border-border">
+                {(eventsQ.data?.events ?? []).map((ev) => (
+                  <li key={ev.id} className="flex items-baseline justify-between gap-3 px-3 py-2.5 text-sm">
+                    <span className="font-bold">{ev.title}</span>
+                    <time className="shrink-0 text-xs text-muted-foreground" dateTime={ev.startsAt}>
+                      {formatJalaliStamp(ev.startsAt)}
+                    </time>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
+
+function activityCountLabel(count: number) {
+  if (count <= 0) return "بدون فعالیت";
+  return `${formatFaNumber(count)} فعالیت`;
+}
+
+const WEEKDAYS = ["ش", "ی", "د", "س", "چ", "پ", "ج"];
+
+function ActivityGrid({ days }: { days: { day: string; count: number }[] }) {
+  const [index, setIndex] = useState(0);
+  const map = new Map(days.map((d) => [d.day.slice(0, 10), d.count]));
+  const order: string[] = [];
+  const months = new Map<string, { label: string; cells: { day: string; count: number }[] }>();
+  const today = new Date();
+  today.setHours(12, 0, 0, 0);
+  for (let i = 119; i >= 0; i--) {
+    const d = new Date(today);
+    d.setDate(today.getDate() - i);
+    const key = d.toISOString().slice(0, 10);
+    const id = jalaliMonthId(d);
+    if (!months.has(id)) {
+      order.push(id);
+      months.set(id, { label: jalaliMonth(d), cells: [] });
+    }
+    months.get(id)!.cells.push({ day: key, count: map.get(key) ?? 0 });
+  }
+  const newestFirst = [...order].reverse();
+  const safeIndex = Math.min(index, Math.max(newestFirst.length - 1, 0));
+  const id = newestFirst[safeIndex];
+  const month = id ? months.get(id) : undefined;
+  if (!month || !id) return null;
+  const pad = weekdayOffset(month.cells[0]?.day ?? "");
+
+  return (
+    <div className="mt-3" role="group" aria-label="تاریخچهٔ ماهانهٔ فعالیت، به تاریخ جلالی">
+      <div className="mb-3 flex items-center justify-between gap-3">
+        <Button type="button" variant="outline" size="sm" disabled={safeIndex <= 0} onClick={() => setIndex(safeIndex - 1)}>
+          ماه جدیدتر
+        </Button>
+        <h4 className="text-sm font-black">{month.label}</h4>
+        <Button
+          type="button"
+          variant="outline"
+          size="sm"
+          disabled={safeIndex >= newestFirst.length - 1}
+          onClick={() => setIndex(safeIndex + 1)}
+        >
+          ماه قدیمی‌تر
+        </Button>
+      </div>
+      <div className="grid grid-cols-7 gap-1" dir="ltr">
+        {WEEKDAYS.map((name) => (
+          <span key={name} className="text-center text-[10px] font-bold text-muted-foreground" dir="rtl">
+            {name}
+          </span>
+        ))}
+        {Array.from({ length: pad }, (_, i) => (
+          <span key={`${id}-pad-${i}`} />
+        ))}
+        {month.cells.map((c) => {
+          const date = jalaliDay(c.day);
+          const countLabel = activityCountLabel(c.count);
+          return (
+            <button
+              key={c.day}
+              type="button"
+              aria-label={`${date}، ${countLabel}`}
+              className="group relative z-0 aspect-square min-h-0 w-full min-w-0 cursor-default appearance-none rounded-sm border-0 p-0 outline-none hover:z-30 focus-visible:z-30 focus-visible:ring-2 focus-visible:ring-ring"
+              style={{ background: c.count === 0 ? "var(--muted)" : `color-mix(in srgb, var(--primary) ${30 + Math.min(c.count, 6) * 12}%, white)` }}
+            >
+              <span
+                role="tooltip"
+                dir="rtl"
+                className="pointer-events-none absolute bottom-[calc(100%+0.35rem)] left-1/2 z-30 hidden w-max -translate-x-1/2 rounded-lg border border-border bg-card px-2.5 py-1.5 text-start text-sm leading-snug text-card-foreground shadow-soft group-hover:block group-focus-visible:block"
+              >
+                <span className="block font-bold whitespace-nowrap">{date}</span>
+                <span className="block whitespace-nowrap text-muted-foreground">{countLabel}</span>
+              </span>
+            </button>
+          );
+        })}
+      </div>
+    </div>
+  );
+}
+
+function weekdayOffset(day: string) {
+  if (!day) return 0;
+  const d = new Date(day + "T12:00:00");
+  return (d.getDay() + 1) % 7;
+}
+
+function jalaliMonthId(d: Date) {
+  const parts = new Intl.DateTimeFormat("en-u-ca-persian", { year: "numeric", month: "2-digit" }).formatToParts(d);
+  const year = parts.find((p) => p.type === "year")?.value ?? "";
+  const month = parts.find((p) => p.type === "month")?.value ?? "";
+  return `${year}-${month}`;
+}
+
+function jalaliMonth(d: Date) {
+  const parts = new Intl.DateTimeFormat("fa-IR-u-ca-persian", { month: "long", year: "numeric" }).formatToParts(d);
+  const month = parts.find((p) => p.type === "month")?.value ?? "";
+  const year = parts.find((p) => p.type === "year")?.value ?? "";
+  return `${month} ${year}`;
+}
+
+function jalaliDay(day: string) {
+  return new Intl.DateTimeFormat("fa-IR-u-ca-persian", { year: "numeric", month: "short", day: "numeric" }).format(
+    new Date(day + "T12:00:00"),
+  );
+}
+
 function StatCard({ icon, label, value }: { icon: React.ReactNode; label: string; value: string }) {
   return (
     <Card>

frontend/src/app/settings/page.tsx

@@ -0,0 +1,874 @@
+"use client";
+
+import { useEffect, useState, type ReactNode } from "react";
+import { useQueries, useQuery, useQueryClient } from "@tanstack/react-query";
+import { CalendarDays, Flame, Sparkles } from "lucide-react";
+import { AccountIdentityFields, AccountUsernameSection } from "@/components/account-identity-fields";
+import { SectionColumns, SectionNav, SectionPanel } from "@/components/section-nav";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { PasswordInput } from "@/components/ui/password-input";
+import { Switch } from "@/components/ui/switch";
+import { Badge } from "@/components/ui/badge";
+import { Label } from "@/components/ui/label";
+import { Skeleton } from "@/components/ui/skeleton";
+import { ApiError, http, toUserError } from "@/lib/api";
+import { validateEmail, validateName, validatePassword, validatePhone, validateUsername } from "@/lib/validation";
+import { useAuth } from "@/lib/auth-store";
+import { clearMediaCache } from "@/lib/transfer";
+import { toast } from "@/components/providers";
+import type { Conversation } from "@/lib/types";
+import { formatFaNumber, formatJalaliStamp, formatStreakLabel } from "@/lib/utils";
+
+type SocialLink = { name: string; url: string };
+
+type Extras = {
+  banner: string;
+  public: boolean;
+  showActivity: boolean;
+  showStats: boolean;
+  showPath: boolean;
+  showBadges: boolean;
+  socialLinks: SocialLink[];
+  theme: string;
+};
+
+type Activity = { days: { day: string; count: number }[]; weekDays: number; monthDays: number };
+type BadgeItem = { id: string; title: string; unlocked: boolean };
+
+const SECTIONS = [
+  { id: "account", label: "حساب", title: "حساب", description: "نام، ایمیل و تلفن را اینجا ذخیره می‌کنید. نام کاربری جدا عوض می‌شود. برای گذرواژه، گذرواژهٔ فعلی لازم است." },
+  { id: "privacy", label: "حریم", title: "حریم", description: "مشخص کنید دیگران در پروفایل شما چه چیزی ببینند." },
+  { id: "stats", label: "آمار", title: "آمار", description: "امتیاز، زنجیره و نشان‌های همین حساب." },
+  { id: "export", label: "خروجی", title: "خروجی", description: "گفتگوها را دانلود کنید یا حافظه موقت را از همین دستگاه حذف کنید." },
+] as const;
+
+const EXPORT_PAGE_SIZE = 8;
+
+type SectionId = (typeof SECTIONS)[number]["id"];
+
+export default function SettingsPage() {
+  const user = useAuth((s) => s.user);
+  const setUser = useAuth((s) => s.setUser);
+  const profileQ = useQuery({
+    queryKey: ["me-profile"],
+    queryFn: () => http.get<{ profile: Extras }>("/api/me/profile"),
+    enabled: !!user,
+  });
+  const activityQ = useQuery({
+    queryKey: ["me-activity"],
+    queryFn: () => http.get<Activity>("/api/me/activity"),
+    enabled: !!user && (profileQ.data?.profile.showActivity ?? true),
+  });
+  const badgesQ = useQuery({
+    queryKey: ["me-achievements"],
+    queryFn: () => http.get<{ achievements: BadgeItem[] }>("/api/me/achievements"),
+    enabled: !!user && (profileQ.data?.profile.showBadges ?? true),
+  });
+  const [section, setSection] = useState<SectionId>("account");
+  const [exportingId, setExportingId] = useState<number | null>(null);
+  const [exportPage, setExportPage] = useState(1);
+  const exportChatsQ = useQuery({
+    queryKey: ["settings-export-chats", user?.id],
+    queryFn: () => http.get<{ conversations: Conversation[] }>("/api/chats/conversations"),
+    enabled: !!user && section === "export",
+  });
+  const exportChats = exportChatsQ.data?.conversations ?? [];
+  const exportPageCount = Math.max(1, Math.ceil(exportChats.length / EXPORT_PAGE_SIZE));
+  const exportPageSafe = Math.min(Math.max(exportPage, 1), exportPageCount);
+  const exportPageStart = (exportPageSafe - 1) * EXPORT_PAGE_SIZE;
+  const exportPageChats = exportChats.slice(exportPageStart, exportPageStart + EXPORT_PAGE_SIZE);
+  const exportSizes = useQueries({
+    queries: exportChats.map((chat) => ({
+      queryKey: ["me-export-meta", user?.id, chat.partner.id],
+      queryFn: () => http.get<{ bytes: number; chat: number; lastAt?: string }>(`/api/me/export?meta=1&chat=${chat.partner.id}`),
+      enabled: !!user && section === "export",
+    })),
+  });
+  const [form, setForm] = useState<Extras | null>(null);
+  const [displayName, setDisplayName] = useState(user?.name ?? "");
+  const [email, setEmail] = useState(user?.email ?? "");
+  const [phone, setPhone] = useState(user?.phone ?? "");
+  const [nextUsername, setNextUsername] = useState("");
+  const [password, setPassword] = useState("");
+  const [currentPassword, setCurrentPassword] = useState("");
+  const [identityDirty, setIdentityDirty] = useState(false);
+  const [savingIdentity, setSavingIdentity] = useState(false);
+  const [savingUsername, setSavingUsername] = useState(false);
+  const [savingPassword, setSavingPassword] = useState(false);
+  const [freezeConfirm, setFreezeConfirm] = useState(false);
+  const [freezePassword, setFreezePassword] = useState("");
+  const [freezeBusy, setFreezeBusy] = useState(false);
+  const qc = useQueryClient();
+
+  useEffect(() => {
+    const profile = profileQ.data?.profile;
+    if (!profile) return;
+    setForm({
+      ...profile,
+      socialLinks: normalizeLinks(profile.socialLinks),
+    });
+  }, [profileQ.data]);
+
+  useEffect(() => {
+    if (!user || identityDirty) return;
+    setDisplayName(user.name ?? "");
+    setEmail(user.email ?? "");
+    setPhone(user.phone ?? "");
+  }, [user, identityDirty]);
+
+  if (!user) return null;
+
+  const usernameCooling = Boolean(
+    user.usernameCooldownUntil && new Date(user.usernameCooldownUntil).getTime() > Date.now(),
+  );
+  const usernameRemaining = user.usernameChangesRemaining ?? 3;
+  const active = SECTIONS.find((item) => item.id === section) ?? SECTIONS[0];
+  const activityOn = profileQ.data?.profile.showActivity ?? true;
+  const badgesOn = profileQ.data?.profile.showBadges ?? true;
+
+  const patch = (partial: Partial<Extras>) => {
+    setForm((prev) => (prev ? { ...prev, ...partial } : prev));
+  };
+
+  const saveProfile = async () => {
+    if (!form) return;
+    try {
+      await http.put("/api/me/profile", {
+        public: form.public,
+        showActivity: form.showActivity,
+        showStats: form.showStats,
+        showPath: form.showPath,
+        showBadges: form.showBadges,
+        socialLinks: form.socialLinks.slice(0, 5),
+        banner: form.banner,
+      });
+      toast.success("تنظیمات ذخیره شد");
+    } catch (e) {
+      toast.error(toUserError(e, "ذخیره ممکن نشد"));
+    }
+  };
+
+  const saveIdentity = async () => {
+    const nameErr = validateName(displayName);
+    if (nameErr) {
+      toast.error(nameErr);
+      return;
+    }
+    const emailErr = validateEmail(email);
+    if (emailErr) {
+      toast.error(emailErr);
+      return;
+    }
+    const phoneErr = validatePhone(phone, false);
+    if (phoneErr) {
+      toast.error(phoneErr);
+      return;
+    }
+    setSavingIdentity(true);
+    try {
+      const res = await http.put<{ user: typeof user }>("/api/me/account", {
+        name: displayName.trim(),
+        email: email.trim().toLowerCase(),
+        phone: phone.trim(),
+      });
+      setUser(res.user);
+      setDisplayName(res.user.name ?? "");
+      setEmail(res.user.email ?? "");
+      setPhone(res.user.phone ?? "");
+      setIdentityDirty(false);
+      toast.success("مشخصات ذخیره شد");
+    } catch (e) {
+      toast.error(toUserError(e, "ذخیره مشخصات ممکن نشد"));
+    } finally {
+      setSavingIdentity(false);
+    }
+  };
+
+  const changeUsername = async () => {
+    const err = validateUsername(nextUsername);
+    if (err) {
+      toast.error(err);
+      return;
+    }
+    const next = nextUsername.trim().toLowerCase();
+    if (next === user.username) {
+      toast.success("نام کاربری همان است");
+      return;
+    }
+    setSavingUsername(true);
+    try {
+      const res = await http.put<{ user: typeof user }>("/api/me/username", { username: next });
+      setUser(res.user);
+      setNextUsername("");
+      toast.success("نام کاربری تغییر کرد");
+    } catch (e) {
+      if (!(e instanceof ApiError && e.status === 429)) {
+        toast.error(toUserError(e, "تغییر نام کاربری ممکن نشد"));
+      }
+    } finally {
+      setSavingUsername(false);
+    }
+  };
+
+  const savePassword = async () => {
+    const err = validatePassword(password);
+    if (err) {
+      toast.error(err);
+      return;
+    }
+    setSavingPassword(true);
+    try {
+      const res = await http.put<{ user: typeof user }>("/api/me/account", {
+        currentPassword,
+        password,
+      });
+      setUser(res.user);
+      setPassword("");
+      setCurrentPassword("");
+      toast.success("گذرواژه ذخیره شد");
+    } catch (e) {
+      toast.error(toUserError(e, "تغییر گذرواژه ممکن نشد"));
+    } finally {
+      setSavingPassword(false);
+    }
+  };
+
+  const freezeAccount = async () => {
+    if (!freezeConfirm) {
+      setFreezeConfirm(true);
+      return;
+    }
+    if (!freezePassword.trim()) {
+      toast.error("گذرواژهٔ فعلی را بنویسید");
+      return;
+    }
+    setFreezeBusy(true);
+    try {
+      const res = await http.post<{ user: typeof user }>("/api/me/freeze", { currentPassword: freezePassword });
+      setUser(res.user);
+      setFreezeConfirm(false);
+      setFreezePassword("");
+      await qc.invalidateQueries({ queryKey: ["me"] });
+      toast.success("حساب فریز شد");
+    } catch (e) {
+      toast.error(toUserError(e, "فریز حساب ممکن نشد"));
+    } finally {
+      setFreezeBusy(false);
+    }
+  };
+
+  const unfreezeAccount = async () => {
+    setFreezeBusy(true);
+    try {
+      const res = await http.post<{ user: typeof user }>("/api/me/unfreeze");
+      setUser(res.user);
+      await qc.invalidateQueries({ queryKey: ["me"] });
+      toast.success("فریز لغو شد");
+    } catch (e) {
+      toast.error(toUserError(e, "لغو فریز ممکن نشد"));
+    } finally {
+      setFreezeBusy(false);
+    }
+  };
+
+  const closeDate = formatFreezeCloseDate(user.closesAt || freezeCloseIso(user.frozenAt));
+
+  return (
+    <div className="mx-auto max-w-4xl">
+      <header className="mb-6 space-y-1">
+        <h1 className="text-2xl font-black tracking-tight">تنظیمات</h1>
+        <p className="text-sm text-muted-foreground">حساب، حریم و داده‌های همین حساب.</p>
+      </header>
+
+      <SectionColumns>
+        <SectionNav
+          label="بخش‌های تنظیمات"
+          groups={[{ items: SECTIONS.map((item) => ({ id: item.id, label: item.label })) }]}
+          activeId={section}
+          onSelect={setSection}
+        />
+
+        <SectionPanel
+          id="settings-section"
+          titleId="settings-section-title"
+          title={active.title}
+          description={active.description}
+        >
+            {section === "account" && (
+              <div className="space-y-8">
+                <AccountIdentityFields
+                  idPrefix="settings"
+                  name={displayName}
+                  email={email}
+                  phone={phone}
+                  onName={(value) => {
+                    setIdentityDirty(true);
+                    setDisplayName(value);
+                  }}
+                  onEmail={(value) => {
+                    setIdentityDirty(true);
+                    setEmail(value);
+                  }}
+                  onPhone={(value) => {
+                    setIdentityDirty(true);
+                    setPhone(value);
+                  }}
+                  action={
+                    <Button type="button" disabled={savingIdentity} onClick={() => void saveIdentity()}>
+                      ذخیره مشخصات
+                    </Button>
+                  }
+                />
+
+                <AccountUsernameSection
+                  mode="self"
+                  idPrefix="settings"
+                  current={user.username}
+                  next={nextUsername}
+                  onNext={setNextUsername}
+                  disabled={usernameCooling}
+                  hint={
+                    usernameCooling && user.usernameCooldownUntil ? (
+                      <p className="text-sm text-muted-foreground">
+                        سه بار نام کاربری را عوض کرده‌اید. تغییر بعدی از {formatJalaliStamp(user.usernameCooldownUntil)} ممکن است.
+                      </p>
+                    ) : usernameAllowanceLabel(usernameRemaining) ? (
+                      <p className="text-xs font-bold text-muted-foreground">{usernameAllowanceLabel(usernameRemaining)}</p>
+                    ) : null
+                  }
+                  action={
+                    <Button
+                      type="button"
+                      disabled={usernameCooling || savingUsername || usernameRemaining <= 0}
+                      onClick={() => void changeUsername()}
+                    >
+                      تغییر نام کاربری
+                    </Button>
+                  }
+                />
+
+                <section className="space-y-4 border-t border-border pt-6" aria-labelledby="settings-password-heading">
+                  <div className="space-y-1">
+                    <h3 id="settings-password-heading" className="text-sm font-black">گذرواژه</h3>
+                    <p className="text-xs text-muted-foreground">برای ذخیره، گذرواژهٔ فعلی لازم است.</p>
+                  </div>
+                  <div className="grid gap-4 sm:grid-cols-2">
+                    <Field id="settings-new-password" label="گذرواژهٔ جدید">
+                      <PasswordInput
+                        id="settings-new-password"
+                        value={password}
+                        onChange={(e) => setPassword(e.target.value)}
+                        dir="ltr"
+                        autoComplete="new-password"
+                      />
+                    </Field>
+                    <Field id="settings-current-password" label="گذرواژهٔ فعلی">
+                      <PasswordInput
+                        id="settings-current-password"
+                        value={currentPassword}
+                        onChange={(e) => setCurrentPassword(e.target.value)}
+                        dir="ltr"
+                        autoComplete="current-password"
+                      />
+                    </Field>
+                  </div>
+                  <Button type="button" disabled={savingPassword} onClick={() => void savePassword()}>
+                    ذخیره
+                  </Button>
+                </section>
+
+                <section className="space-y-3 border-t border-border pt-6" aria-labelledby="settings-freeze-heading">
+                  <h3 id="settings-freeze-heading" className="text-sm font-black">فریز حساب</h3>
+                  <p className="text-sm text-muted-foreground">
+                    فریز تا ۳۰ روز قابل بازگشت است، بعد از آن حساب بسته می‌شود و حذف دائمی فقط با مجوز ادمین است.
+                  </p>
+                  {user.isClosed ? (
+                    <p className="text-sm font-bold">حساب بسته شده است. لغو فریز ممکن نیست.</p>
+                  ) : user.isFrozen ? (
+                    <div className="space-y-3">
+                      <p className="text-sm">
+                        {closeDate ? `این حساب در ${closeDate} بسته می‌شود.` : "این حساب تا ۳۰ روز دیگر بسته می‌شود."}
+                      </p>
+                      <Button type="button" variant="outline" disabled={freezeBusy} onClick={() => void unfreezeAccount()}>
+                        لغو فریز
+                      </Button>
+                    </div>
+                  ) : (
+                    <div className="space-y-3">
+                      {freezeConfirm && (
+                        <>
+                          <p className="text-sm font-bold">برای فریز، گذرواژهٔ فعلی را بنویسید.</p>
+                          <Field id="settings-freeze-password" label="گذرواژهٔ فعلی">
+                            <PasswordInput
+                              id="settings-freeze-password"
+                              value={freezePassword}
+                              onChange={(e) => setFreezePassword(e.target.value)}
+                              dir="ltr"
+                              autoComplete="current-password"
+                            />
+                          </Field>
+                        </>
+                      )}
+                      <div className="flex flex-wrap gap-2">
+                        <Button type="button" variant={freezeConfirm ? "destructive" : "outline"} disabled={freezeBusy} onClick={() => void freezeAccount()}>
+                          فریز حساب
+                        </Button>
+                        {freezeConfirm && (
+                          <Button
+                            type="button"
+                            variant="ghost"
+                            disabled={freezeBusy}
+                            onClick={() => {
+                              setFreezeConfirm(false);
+                              setFreezePassword("");
+                            }}
+                          >
+                            انصراف
+                          </Button>
+                        )}
+                      </div>
+                    </div>
+                  )}
+                </section>
+              </div>
+            )}
+
+            {section === "privacy" && (
+              <PrivacyFields
+                form={form}
+                loading={profileQ.isPending}
+                error={profileQ.isError ? toUserError(profileQ.error, "بارگذاری حریم ممکن نشد") : null}
+                onPatch={patch}
+                onSave={() => void saveProfile()}
+              />
+            )}
+
+            {section === "stats" && (
+              <div className="space-y-6">
+                <div className="grid grid-cols-2 gap-3 sm:grid-cols-3">
+                  <StatTile
+                    icon={<Sparkles className="h-4 w-4 text-gold" />}
+                    label="امتیاز"
+                    value={formatFaNumber(user.xp)}
+                  />
+                  <StatTile
+                    icon={<Flame className="h-4 w-4 text-accent" />}
+                    label="زنجیرهٔ فعلی"
+                    value={formatStreakLabel(user.streakCurrent)}
+                  />
+                  <StatTile
+                    icon={<Flame className="h-4 w-4 text-muted-foreground" />}
+                    label="بلندترین زنجیره"
+                    value={formatStreakLabel(user.streakLongest)}
+                  />
+                  <StatTile
+                    icon={<CalendarDays className="h-4 w-4 text-primary" />}
+                    label="روزهای این هفته"
+                    value={countLabel(activityOn, activityQ.isPending, activityQ.data?.weekDays)}
+                  />
+                  <StatTile
+                    icon={<CalendarDays className="h-4 w-4 text-secondary" />}
+                    label="روزهای این ماه"
+                    value={countLabel(activityOn, activityQ.isPending, activityQ.data?.monthDays)}
+                  />
+                </div>
+                <div>
+                  <h3 className="text-sm font-black">نشان‌ها</h3>
+                  {badgesOn ? (
+                    <div className="mt-3">
+                      <p className="mb-3 text-xs text-muted-foreground">رنگ‌دارها باز شده‌اند و کمرنگ‌ها هنوز قفل‌اند.</p>
+                      {badgesQ.isPending ? (
+                        <div className="flex flex-wrap gap-2" aria-busy="true" aria-label="در حال بارگذاری نشان‌ها">
+                          <Skeleton className="h-6 w-24 rounded-full" />
+                          <Skeleton className="h-6 w-20 rounded-full" />
+                          <Skeleton className="h-6 w-28 rounded-full" />
+                        </div>
+                      ) : badgesQ.isError ? (
+                        <p className="text-sm font-bold text-destructive">{toUserError(badgesQ.error, "بارگذاری نشان‌ها ممکن نشد")}</p>
+                      ) : (badgesQ.data?.achievements ?? []).length === 0 ? (
+                        <p className="text-sm text-muted-foreground">نشانی ثبت نشده.</p>
+                      ) : (
+                        <ul className="flex flex-wrap gap-2">
+                          {(badgesQ.data?.achievements ?? []).map((b) => (
+                            <li key={b.id}>
+                              <Badge variant={b.unlocked ? "success" : "secondary"} className="rounded-full px-2.5 py-1">
+                                {b.title}
+                              </Badge>
+                            </li>
+                          ))}
+                        </ul>
+                      )}
+                    </div>
+                  ) : (
+                    <p className="mt-2 text-sm text-muted-foreground">نمایش نشان‌ها در بخش حریم خاموش است.</p>
+                  )}
+                </div>
+              </div>
+            )}
+
+            {section === "export" && (
+              <div className="space-y-6">
+                {exportChatsQ.isPending ? (
+                  <div className="space-y-3" aria-busy="true" aria-label="در حال بارگذاری گفتگوها">
+                    <Skeleton className="h-16 rounded-xl" />
+                    <Skeleton className="h-16 rounded-xl" />
+                  </div>
+                ) : exportChatsQ.isError ? (
+                  <p className="text-sm font-bold text-destructive">{toUserError(exportChatsQ.error, "بارگذاری گفتگوها ممکن نشد")}</p>
+                ) : exportChats.length === 0 ? (
+                  <p className="text-sm text-muted-foreground">گفتگویی نیست.</p>
+                ) : (
+                  <div className="space-y-4">
+                    <ul className="divide-y divide-border">
+                      {exportPageChats.map((chat, offset) => {
+                        const saved = chat.partner.saved || chat.partner.id === user.id;
+                        const label = saved ? "پیام‌های ذخیره‌شده" : chat.partner.name;
+                        const size = exportSizes[exportPageStart + offset];
+                        const last = chat.lastMessage?.createdAt || size?.data?.lastAt;
+                        return (
+                          <li key={chat.partner.id} className="flex flex-col gap-3 py-4 first:pt-0 sm:flex-row sm:items-center sm:justify-between">
+                            <div className="min-w-0 space-y-1">
+                              <p className="truncate text-sm font-bold">{label}</p>
+                              <p className="text-xs text-muted-foreground">
+                                {last ? `آخرین فعالیت: ${formatJalaliStamp(last)}` : "هنوز پیامی نیست"}
+                              </p>
+                              <p className="text-xs font-bold text-foreground">
+                                {size?.isPending
+                                  ? "در حال برآورد حجم…"
+                                  : size?.isError
+                                    ? "برآورد حجم ممکن نشد"
+                                    : `حجم تقریبی: ${formatApproxSize(size?.data?.bytes ?? 0)}`}
+                              </p>
+                            </div>
+                            <Button
+                              type="button"
+                              variant="outline"
+                              className="shrink-0"
+                              disabled={exportingId === chat.partner.id}
+                              onClick={() => {
+                                setExportingId(chat.partner.id);
+                                void downloadChatExport(chat.partner.id, exportFileName(label, chat.partner.id)).finally(() => {
+                                  setExportingId((cur) => (cur === chat.partner.id ? null : cur));
+                                });
+                              }}
+                            >
+                              دانلود
+                            </Button>
+                          </li>
+                        );
+                      })}
+                    </ul>
+                    {exportChats.length > EXPORT_PAGE_SIZE && (
+                      <div className="flex items-center justify-between gap-3">
+                        <Button
+                          type="button"
+                          variant="outline"
+                          size="sm"
+                          disabled={exportPageSafe <= 1}
+                          onClick={() => setExportPage(exportPageSafe - 1)}
+                        >
+                          قبلی
+                        </Button>
+                        <p className="text-sm font-bold tabular-nums text-muted-foreground">
+                          {formatFaNumber(exportPageSafe)} از {formatFaNumber(exportPageCount)}
+                        </p>
+                        <Button
+                          type="button"
+                          variant="outline"
+                          size="sm"
+                          disabled={exportPageSafe >= exportPageCount}
+                          onClick={() => setExportPage(exportPageSafe + 1)}
+                        >
+                          بعدی
+                        </Button>
+                      </div>
+                    )}
+                  </div>
+                )}
+              <ul className="divide-y divide-border border-t border-border pt-4">
+                <li className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                  <div className="min-w-0 space-y-1">
+                    <p className="text-sm font-bold">حذف حافظه موقت</p>
+                    <p className="text-xs leading-relaxed text-muted-foreground">عکس و صدای ذخیره‌شده روی همین دستگاه حذف می‌شود.</p>
+                  </div>
+                  <Button
+                    type="button"
+                    variant="outline"
+                    className="shrink-0"
+                    onClick={() => {
+                      void clearMediaCache().then(() => toast.success("حافظه موقت حذف شد"));
+                    }}
+                  >
+                    حذف
+                  </Button>
+                </li>
+              </ul>
+              </div>
+            )}
+        </SectionPanel>
+      </SectionColumns>
+    </div>
+  );
+}
+
+function PrivacyFields({
+  form,
+  loading,
+  error,
+  onPatch,
+  onSave,
+}: {
+  form: Extras | null;
+  loading: boolean;
+  error: string | null;
+  onPatch: (partial: Partial<Extras>) => void;
+  onSave: () => void;
+}) {
+  if (loading || !form) {
+    if (error) return <p className="text-sm font-bold text-destructive">{error}</p>;
+    return (
+      <div className="space-y-3" aria-busy="true" aria-label="در حال بارگذاری حریم">
+        <Skeleton className="h-14 rounded-xl" />
+        <Skeleton className="h-14 rounded-xl" />
+        <Skeleton className="h-14 rounded-xl" />
+      </div>
+    );
+  }
+
+  const links = form.socialLinks;
+
+  return (
+    <div className="space-y-6">
+      <div className="divide-y divide-border">
+        <PrivacyRow
+          id="privacy-public"
+          label="پروفایل عمومی"
+          hint="تا وقتی خاموش باشد، دیگران فقط نام و آواتار را می‌بینند."
+          checked={form.public}
+          onCheckedChange={(v) => onPatch({ public: v })}
+        />
+        <PrivacyRow
+          id="privacy-activity"
+          label="نمایش فعالیت"
+          hint="روزهای فعال در پروفایل عمومی دیده می‌شود."
+          checked={form.showActivity}
+          onCheckedChange={(v) => onPatch({ showActivity: v })}
+        />
+        <PrivacyRow
+          id="privacy-stats"
+          label="نمایش آمار"
+          hint="امتیاز و زنجیره در پروفایل عمومی دیده می‌شود."
+          checked={form.showStats}
+          onCheckedChange={(v) => onPatch({ showStats: v })}
+        />
+        <PrivacyRow
+          id="privacy-path"
+          label="نمایش مسیر"
+          hint="مسیر یادگیری در پروفایل عمومی دیده می‌شود."
+          checked={form.showPath}
+          onCheckedChange={(v) => onPatch({ showPath: v })}
+        />
+        <PrivacyRow
+          id="privacy-badges"
+          label="نمایش نشان‌ها"
+          hint="نشان‌ها در پروفایل عمومی دیده می‌شوند."
+          checked={form.showBadges}
+          onCheckedChange={(v) => onPatch({ showBadges: v })}
+        />
+      </div>
+
+      <div className="space-y-3 border-t border-border pt-5">
+        <div>
+          <h3 className="text-sm font-black">لینک‌های شخصی</h3>
+          <p className="mt-1 text-xs text-muted-foreground">حداکثر پنج لینک. نام و نشانی را وارد کنید.</p>
+        </div>
+        {links.length === 0 ? (
+          <p className="text-sm text-muted-foreground">هنوز لینکی اضافه نشده.</p>
+        ) : (
+          <ul className="space-y-3">
+            {links.map((link, i) => (
+              <li key={i} className="flex items-end gap-2">
+                <div className="w-28 shrink-0 space-y-1.5 sm:w-36">
+                  <Label htmlFor={`settings-link-name-${i}`} className="text-xs font-bold text-muted-foreground">
+                    نام
+                  </Label>
+                  <Input
+                    id={`settings-link-name-${i}`}
+                    value={link.name}
+                    placeholder="تلگرام"
+                    onChange={(e) => {
+                      const socialLinks = links.map((row, idx) => (idx === i ? { ...row, name: e.target.value } : row));
+                      onPatch({ socialLinks });
+                    }}
+                  />
+                </div>
+                <div className="min-w-0 flex-1 space-y-1.5">
+                  <Label htmlFor={`settings-link-url-${i}`} className="text-xs font-bold text-muted-foreground">
+                    نشانی
+                  </Label>
+                  <Input
+                    id={`settings-link-url-${i}`}
+                    dir="ltr"
+                    value={link.url}
+                    placeholder="https://"
+                    onChange={(e) => {
+                      const socialLinks = links.map((row, idx) => (idx === i ? { ...row, url: e.target.value } : row));
+                      onPatch({ socialLinks });
+                    }}
+                  />
+                </div>
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="sm"
+                  className="h-11 shrink-0"
+                  aria-label={`حذف لینک ${link.name || i + 1}`}
+                  onClick={() => onPatch({ socialLinks: links.filter((_, idx) => idx !== i) })}
+                >
+                  حذف
+                </Button>
+              </li>
+            ))}
+          </ul>
+        )}
+        {links.length < 5 && (
+          <Button
+            type="button"
+            variant="outline"
+            size="sm"
+            onClick={() => onPatch({ socialLinks: [...links, { name: "", url: "" }] })}
+          >
+            افزودن لینک
+          </Button>
+        )}
+      </div>
+
+      <Button type="button" onClick={onSave}>
+        ذخیره حریم
+      </Button>
+    </div>
+  );
+}
+
+function PrivacyRow({
+  id,
+  label,
+  hint,
+  checked,
+  onCheckedChange,
+}: {
+  id: string;
+  label: string;
+  hint: string;
+  checked: boolean;
+  onCheckedChange: (v: boolean) => void;
+}) {
+  const hintId = `${id}-hint`;
+  return (
+    <div className="flex items-center justify-between gap-4 py-4 first:pt-0 last:pb-0">
+      <div className="min-w-0 space-y-1">
+        <Label htmlFor={id} className="text-sm font-bold text-foreground">
+          {label}
+        </Label>
+        <p id={hintId} className="text-xs leading-relaxed text-muted-foreground">
+          {hint}
+        </p>
+      </div>
+      <Switch id={id} checked={checked} onCheckedChange={onCheckedChange} aria-describedby={hintId} />
+    </div>
+  );
+}
+
+function formatFreezeCloseDate(iso?: string) {
+  if (!iso) return "";
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return "";
+  return d.toLocaleDateString("fa-IR", { year: "numeric", month: "long", day: "numeric" });
+}
+
+function freezeCloseIso(frozenAt?: string) {
+  if (!frozenAt) return "";
+  const start = new Date(frozenAt);
+  if (Number.isNaN(start.getTime())) return "";
+  const close = new Date(start);
+  close.setDate(close.getDate() + 30);
+  return close.toISOString();
+}
+
+function usernameAllowanceLabel(remaining: number): string {
+  if (remaining >= 3) return "۳ بار دیگر";
+  if (remaining === 2) return "۲ بار دیگر";
+  if (remaining === 1) return "۱ بار دیگر";
+  return "";
+}
+
+function Field({ id, label, children }: { id: string; label: string; children: ReactNode }) {
+  return (
+    <div className="space-y-1.5">
+      <Label htmlFor={id} className="text-xs font-bold text-muted-foreground">
+        {label}
+      </Label>
+      {children}
+    </div>
+  );
+}
+
+function StatTile({ icon, label, value }: { icon: ReactNode; label: string; value: string }) {
+  return (
+    <div className="flex items-center gap-3 rounded-2xl border border-border bg-muted/30 px-3 py-3 sm:px-4">
+      <span className="grid h-9 w-9 shrink-0 place-items-center rounded-xl bg-card">{icon}</span>
+      <div className="min-w-0">
+        <p className="text-[11px] font-bold text-muted-foreground">{label}</p>
+        <p className="text-lg font-black tabular-nums">{value}</p>
+      </div>
+    </div>
+  );
+}
+
+function countLabel(enabled: boolean, pending: boolean, value: number | undefined) {
+  if (!enabled) return "خاموش";
+  if (pending) return "…";
+  return formatFaNumber(value ?? 0);
+}
+
+function normalizeLinks(links: SocialLink[] | null | undefined): SocialLink[] {
+  if (!Array.isArray(links)) return [];
+  return links.slice(0, 5).map((row) => ({ name: row?.name ?? "", url: row?.url ?? "" }));
+}
+
+function formatApproxSize(bytes: number) {
+  if (!Number.isFinite(bytes) || bytes < 1024) return `حدود ${formatFaNumber(1)} کیلوبایت`;
+  if (bytes < 1024 * 1024) return `حدود ${formatFaNumber(Math.round(bytes / 1024))} کیلوبایت`;
+  const mb = bytes / (1024 * 1024);
+  return `حدود ${formatFaNumber(mb, mb < 10 ? 1 : 0)} مگابایت`;
+}
+
+function exportFileName(label: string, id: number) {
+  const clean = label.replace(/[\\/:*?"<>|]/g, " ").replace(/\s+/g, " ").trim();
+  return `${clean || `chat-${id}`}.zip`;
+}
+
+async function downloadChatExport(chatId: number, filename: string) {
+  const token = useAuth.getState().accessToken;
+  const base = (process.env.NEXT_PUBLIC_API_URL ?? "").replace(/\/$/, "");
+  try {
+    const res = await fetch(`${base}/api/me/export?chat=${chatId}`, {
+      headers: token ? { Authorization: `Bearer ${token}` } : {},
+      credentials: "include",
+    });
+    if (!res.ok) {
+      toast.error("دانلود خروجی گفتگو ممکن نشد");
+      return;
+    }
+    const blob = await res.blob();
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = filename;
+    a.click();
+    URL.revokeObjectURL(url);
+  } catch {
+    toast.error("دانلود خروجی گفتگو ممکن نشد");
+  }
+}