chore: sync package-lock.json after npm install

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat: improve accessibility across the app
2026-07-17 22:32:07 +02:00 · 2026-07-17 22:31:43 +02:00 · 2026-07-17 09:47:30 +02:00 · 2026-07-17 09:40:53 +02:00 · 2026-07-17 09:33:21 +02:00 · 2026-07-17 09:32:05 +02:00
52 changed files with 2113 additions and 1714 deletions
@@ -9,3 +9,4 @@ uploads/
 .gitignore
 .vscode/
 *.md
+screenshots/
@@ -37,6 +37,13 @@ SMTP_FROM=noreply@example.com
 # App URL (used for verification links, auto-detected if not set)
 # APP_URL=https://your-domain.com

+# Recording Transcription / AI Summarization
+# When the per-room "AI summary / transcript" setting is enabled, Redlight will POST to
+# ${TRANSCRIPTION_API_URL}/prompt with header `X-Api-Key: ${TRANSCRIPTION_API_KEY}` as soon as
+# the "video" format of the recording is available. Leave empty to disable the integration entirely.
+# TRANSCRIPTION_API_URL=
+# TRANSCRIPTION_API_KEY=
+
 # Reverse Proxy trust depth (express 'trust proxy' setting)
 # loopback = trust only 127.0.0.1 / ::1 (default)
 # Use a number for proxy hops (e.g. 1), or a specific IP/CIDR.
@@ -1,6 +1,8 @@
 node_modules/
 dist/
 redlight.db
+redlight.db-wal
+redlight.db-shm
 uploads/
 .env
 .claude/
@@ -9,6 +9,17 @@ A modern, self-hosted BigBlueButton frontend with 25+ themes, federation, calend
 ![License](https://img.shields.io/badge/License-GPL-pink)
 ![BigBlueButton](https://img.shields.io/badge/BigBlueButton-Compatible-red)

+## 🖼️ Pictures
+
+<details>
+<summary>Click to expand screenshots</summary>
+
+![Home](screenshots/home.png)
+![Dashboard](screenshots/dashboard.png)
+![Rooms](screenshots/rooms.png)
+
+</details>
+
 ## ✨ Features

 ### Core Features
@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
  <head>
    <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <link rel="icon" type="image/svg+xml" href="/logo.svg" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <link rel="preconnect" href="https://fonts.googleapis.com" />
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
@@ -1,7 +1,7 @@
 {
  "name": "redlight",
  "private": true,
-  "version": "2.2.0",
+  "version": "2.5.0",
  "license": "GPL-3.0-or-later",
  "type": "module",
  "scripts": {
@@ -19,7 +19,6 @@
    "concurrently": "^9.0.0",
    "cors": "^2.8.5",
    "dotenv": "^17.3.1",
-    "exceljs": "^4.4.0",
    "express": "^5.2.1",
    "express-rate-limit": "^8.5.2",
    "flatpickr": "^4.6.13",
@@ -27,7 +26,7 @@
    "jsonwebtoken": "^9.0.0",
    "lucide-react": "^1.16.0",
    "multer": "^2.1.0",
-    "nodemailer": "^8.0.1",
+    "nodemailer": "^9.0.3",
    "otpauth": "^9.5.0",
    "pdfkit": "^0.18.0",
    "pg": "^8.18.0",
@@ -38,6 +37,7 @@
    "react-hot-toast": "^2.4.0",
    "react-router-dom": "^7.15.1",
    "uuid": "^14.0.0",
+    "write-excel-file": "^4.1.1",
    "xml2js": "^0.6.0"
  },
  "devDependencies": {
@@ -48,5 +48,8 @@
    "postcss": "^8.4.0",
    "tailwindcss": "^4.3.0",
    "vite": "^8.0.0"
+  },
+  "allowScripts": {
+    "better-sqlite3@12.11.1": true
  }
 }
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <!-- Speech bubble tail -->
+  <path d="M 185 325 L 148 425 L 248 360 Z" fill="#2B3140" stroke="#2B3140" stroke-width="14" stroke-linejoin="round"/>
+  <!-- Speech bubble outline -->
+  <circle cx="256" cy="240" r="120" fill="none" stroke="#2B3140" stroke-width="34"/>
+  <!-- Red dot -->
+  <circle cx="262" cy="234" r="76" fill="#ED2224"/>
+  <!-- Sound waves right -->
+  <path d="M 423 100 A 218 218 0 0 1 423 380" fill="none" stroke="#ED2224" stroke-width="32" stroke-linecap="round"/>
+  <path d="M 413 160 A 176 176 0 0 1 413 320" fill="none" stroke="#ED2224" stroke-width="30" stroke-linecap="round"/>
+  <!-- Sound waves left -->
+  <path d="M 89 100 A 218 218 0 0 0 89 380" fill="none" stroke="#ED2224" stroke-width="32" stroke-linecap="round"/>
+  <path d="M 99 160 A 176 176 0 0 0 99 320" fill="none" stroke="#ED2224" stroke-width="30" stroke-linecap="round"/>
+</svg>
@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32" fill="none">
-  <rect width="32" height="32" rx="8" fill="#ef4444"/>
-  <circle cx="16" cy="16" r="8" fill="white" opacity="0.9"/>
-  <circle cx="16" cy="16" r="4" fill="#ef4444"/>
-</svg>
@@ -2,6 +2,7 @@
 import xml2js from 'xml2js';
 import { log, fmtDuration, fmtStatus, fmtMethod, fmtReturncode, sanitizeBBBParams } from './logger.js';
 import { t } from './emaili18n.js';
+import { isTranscriptionEnabled } from './transcription.js';

 const BBB_URL = process.env.BBB_URL || 'https://your-bbb-server.com/bigbluebutton/api/';
 const BBB_SECRET = process.env.BBB_SECRET || '';
@@ -115,6 +116,17 @@ export async function createMeeting(room, logoutURL, loginURL = null, presentati
  if (analyticsCallbackURL) {
    params['meta_analytics-callback-url'] = analyticsCallbackURL;
  }
+  if (room.recording_transcript && isTranscriptionEnabled()) {
+    // BBB posts a signed recording-ready callback there once recording formats
+    // are processed; used to trigger the AI summary/transcript integration.
+    if (logoutURL) {
+      params['meta_bbb-recording-ready-url'] = `${logoutURL}/api/recordings/recording-ready`;
+    }
+  } else {
+    // Transcription/summary is off for this room — tell BBB to skip processing
+    // and publishing those recording formats entirely (BBB PR #25277).
+    params['meta_bbb-disable-recording-formats'] = 'transcript,summary';
+  }

  // Build optional presentation XML body - escape URL to prevent XML injection
  let xmlBody = null;
@@ -130,7 +142,7 @@ export async function createMeeting(room, logoutURL, loginURL = null, presentati
  return apiCall('create', params, xmlBody);
 }

-export async function joinMeeting(uid, name, isModerator = false, avatarURL = null) {
+export async function joinMeeting(uid, name, isModerator = false, avatarURL = null, darkMode = false) {
  const { moderatorPW, attendeePW } = getRoomPasswords(uid);
  const params = {
    meetingID: uid,
@@ -141,6 +153,11 @@ export async function joinMeeting(uid, name, isModerator = false, avatarURL = nu
  if (avatarURL) {
    params.avatarURL = avatarURL;
  }
+  if (darkMode) {
+    // Per-user userdata override: start the client in dark theme for users who
+    // have a dark theme active in Redlight. Read by BBB as bbb_prefer_dark_theme.
+    params['userdata-bbb_prefer_dark_theme'] = 'true';
+  }
  return buildUrl('join', params);
 }

@@ -384,6 +384,25 @@ export async function initDatabase() {
    }
  }

+  // Password reset: store a SHA-256 hash of the reset token (never the raw token)
+  if (!(await db.columnExists('users', 'reset_token_hash'))) {
+    await db.exec('ALTER TABLE users ADD COLUMN reset_token_hash TEXT DEFAULT NULL');
+  }
+  if (!(await db.columnExists('users', 'reset_token_expires'))) {
+    if (isPostgres) {
+      await db.exec('ALTER TABLE users ADD COLUMN reset_token_expires TIMESTAMP DEFAULT NULL');
+    } else {
+      await db.exec('ALTER TABLE users ADD COLUMN reset_token_expires DATETIME DEFAULT NULL');
+    }
+  }
+  if (!(await db.columnExists('users', 'reset_requested_at'))) {
+    if (isPostgres) {
+      await db.exec('ALTER TABLE users ADD COLUMN reset_requested_at TIMESTAMP DEFAULT NULL');
+    } else {
+      await db.exec('ALTER TABLE users ADD COLUMN reset_requested_at DATETIME DEFAULT NULL');
+    }
+  }
+
  // Federation sync: add deleted + updated_at to federated_rooms
  if (!(await db.columnExists('federated_rooms', 'deleted'))) {
    await db.exec('ALTER TABLE federated_rooms ADD COLUMN deleted INTEGER DEFAULT 0');
@@ -860,6 +879,18 @@ export async function initDatabase() {
    `);
  }

+  // ── Recording transcription / AI summary ────────────────────────────────
+  if (!(await db.columnExists('rooms', 'recording_transcript'))) {
+    await db.exec('ALTER TABLE rooms ADD COLUMN recording_transcript INTEGER DEFAULT 0');
+  }
+  if (!(await db.columnExists('recordings', 'transcript_requested_at'))) {
+    if (isPostgres) {
+      await db.exec('ALTER TABLE recordings ADD COLUMN transcript_requested_at TIMESTAMP DEFAULT NULL');
+    } else {
+      await db.exec('ALTER TABLE recordings ADD COLUMN transcript_requested_at DATETIME DEFAULT NULL');
+    }
+  }
+
  // ── Default admin (only on very first start) ────────────────────────────
  const adminAlreadySeeded = await db.get("SELECT value FROM settings WHERE key = 'admin_seeded'");
  if (!adminAlreadySeeded) {
@@ -92,6 +92,50 @@ export async function sendVerificationEmail(to, name, verifyUrl, appName = 'Redl
  });
 }

+/**
+ * Send a password reset email with a clickable link.
+ * @param {string} to        - recipient email
+ * @param {string} name      - user's display name
+ * @param {string} resetUrl  - full password reset URL
+ * @param {string} appName   - branding app name (default "Redlight")
+ * @param {string} lang      - language code
+ */
+export async function sendPasswordResetEmail(to, name, resetUrl, appName = 'Redlight', lang = 'en') {
+  if (!transporter) {
+    throw new Error('SMTP not configured');
+  }
+
+  const from = process.env.SMTP_FROM || process.env.SMTP_USER;
+  const headerAppName = sanitizeHeaderValue(appName);
+  const safeName = escapeHtml(name);
+
+  await transporter.sendMail({
+    from: `"${headerAppName}" <${from}>`,
+    to,
+    subject: t(lang, 'email.resetPassword.subject', { appName: headerAppName }),
+    html: `
+      <div style="font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:32px;background:#1e1e2e;color:#cdd6f4;border-radius:12px;">
+        <h2 style="color:#cba6f7;margin-top:0;">${t(lang, 'email.greeting', { name: safeName })}</h2>
+        <p>${t(lang, 'email.resetPassword.intro')}</p>
+        <p style="text-align:center;margin:28px 0;">
+          <a href="${resetUrl}"
+             style="display:inline-block;background:#cba6f7;color:#1e1e2e;padding:12px 32px;border-radius:8px;text-decoration:none;font-weight:bold;">
+            ${t(lang, 'email.resetPassword.button')}
+          </a>
+        </p>
+        <p style="font-size:13px;color:#7f849c;">
+          ${t(lang, 'email.linkHint')}<br/>
+          <a href="${resetUrl}" style="color:#89b4fa;word-break:break-all;">${escapeHtml(resetUrl)}</a>
+        </p>
+        <p style="font-size:13px;color:#7f849c;">${t(lang, 'email.resetPassword.validity')}</p>
+        <hr style="border:none;border-top:1px solid #313244;margin:24px 0;"/>
+        <p style="font-size:12px;color:#585b70;">${t(lang, 'email.resetPassword.footer')}</p>
+      </div>
+    `,
+    text: `${t(lang, 'email.greeting', { name })}\n\n${t(lang, 'email.resetPassword.intro')}\n${resetUrl}\n\n${t(lang, 'email.resetPassword.validity')}\n\n- ${appName}`,
+  });
+}
+
 /**
 * Send a federation meeting invitation email.
 * @param {string} to          - recipient email
@@ -228,7 +272,7 @@ export async function sendCalendarInviteEmail(to, name, fromUser, title, startTi
        <p>${introHtml}</p>
        <div style="background:#313244;border-radius:8px;padding:16px;margin:20px 0;">
          <p style="margin:0 0 4px 0;font-size:15px;font-weight:bold;color:#cdd6f4;">${safeTitle}</p>
-          <p style="margin:6px 0 0 0;font-size:13px;color:#a6adc8;">🕐 ${escapeHtml(formatDate(startTime))} - ${escapeHtml(formatDate(endTime))}</p>
+          <p style="margin:6px 0 0 0;font-size:13px;color:#a6adc8;">${escapeHtml(formatDate(startTime))} - ${escapeHtml(formatDate(endTime))}</p>
          ${safeDesc ? `<p style="margin:10px 0 0 0;font-size:13px;color:#a6adc8;font-style:italic;">&quot;${safeDesc}&quot;</p>` : ''}
        </div>
        <p style="text-align:center;margin:28px 0;">
@@ -245,6 +289,78 @@ export async function sendCalendarInviteEmail(to, name, fromUser, title, startTi
  });
 }

+/**
+ * Send a calendar event invitation to an external email address (with ICS attachment).
+ * @param {string} to          - recipient email
+ * @param {string} fromUser    - sender display name
+ * @param {string} title       - event title
+ * @param {string} startTime   - ISO start time
+ * @param {string} endTime     - ISO end time
+ * @param {string|null} description - optional event description
+ * @param {string|null} joinUrl - direct meeting join URL if a room is linked
+ * @param {string} ics         - ICS file content to attach
+ * @param {string} appName     - branding app name
+ * @param {string} lang        - language code
+ */
+export async function sendCalendarEventEmail(to, fromUser, title, startTime, endTime, description, joinUrl, ics, appName = 'Redlight', lang = 'en') {
+  if (!transporter) {
+    throw new Error('SMTP not configured');
+  }
+
+  const from = process.env.SMTP_FROM || process.env.SMTP_USER;
+  const headerAppName = sanitizeHeaderValue(appName);
+  const safeFromUser = escapeHtml(fromUser);
+  const safeTitle = escapeHtml(title);
+  const safeDesc = description ? escapeHtml(description) : null;
+
+  const formatDate = (iso) => {
+    try { return new Date(iso).toLocaleString(lang === 'de' ? 'de-DE' : 'en-GB', { dateStyle: 'full', timeStyle: 'short' }); }
+    catch { return iso; }
+  };
+
+  const introHtml = t(lang, 'email.calendarEventInvite.intro')
+    .replace('{fromUser}', `<strong style="color:#cdd6f4;">${safeFromUser}</strong>`);
+
+  await transporter.sendMail({
+    from: `"${headerAppName}" <${from}>`,
+    to,
+    subject: t(lang, 'email.calendarEventInvite.subject', { appName: headerAppName, title: sanitizeHeaderValue(title) }),
+    html: `
+      <div style="font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:32px;background:#1e1e2e;color:#cdd6f4;border-radius:12px;">
+        <h2 style="color:#cba6f7;margin-top:0;">${t(lang, 'email.calendarEventInvite.title')}</h2>
+        <p>${introHtml}</p>
+        <div style="background:#313244;border-radius:8px;padding:16px;margin:20px 0;">
+          <p style="margin:0 0 4px 0;font-size:15px;font-weight:bold;color:#cdd6f4;">${safeTitle}</p>
+          <p style="margin:6px 0 0 0;font-size:13px;color:#a6adc8;">${escapeHtml(formatDate(startTime))} - ${escapeHtml(formatDate(endTime))}</p>
+          ${safeDesc ? `<p style="margin:10px 0 0 0;font-size:13px;color:#a6adc8;font-style:italic;">&quot;${safeDesc}&quot;</p>` : ''}
+        </div>
+        ${joinUrl ? `
+        <p style="text-align:center;margin:28px 0;">
+          <a href="${joinUrl}"
+             style="display:inline-block;background:#cba6f7;color:#1e1e2e;padding:12px 32px;border-radius:8px;text-decoration:none;font-weight:bold;">
+            ${t(lang, 'email.calendarEventInvite.joinButton')}
+          </a>
+        </p>
+        <p style="font-size:13px;color:#7f849c;">
+          ${t(lang, 'email.linkHint')}<br/>
+          <a href="${joinUrl}" style="color:#89b4fa;word-break:break-all;">${escapeHtml(joinUrl)}</a>
+        </p>` : ''}
+        <p style="font-size:13px;color:#7f849c;">${t(lang, 'email.calendarEventInvite.icsHint')}</p>
+        <hr style="border:none;border-top:1px solid #313244;margin:24px 0;"/>
+        <p style="font-size:12px;color:#585b70;">${t(lang, 'email.calendarEventInvite.footer', { appName: escapeHtml(appName) })}</p>
+      </div>
+    `,
+    text: `${t(lang, 'email.calendarEventInvite.intro', { fromUser })}\n${title}\n${formatDate(startTime)} – ${formatDate(endTime)}${description ? `\n\n"${description}"` : ''}${joinUrl ? `\n\n${t(lang, 'email.calendarEventInvite.joinButton')}: ${joinUrl}` : ''}\n\n${t(lang, 'email.calendarEventInvite.icsHint')}\n\n– ${appName}`,
+    attachments: [
+      {
+        filename: 'event.ics',
+        content: ics,
+        contentType: 'text/calendar; charset=utf-8; method=PUBLISH',
+      },
+    ],
+  });
+}
+
 /**
 * Notify a user that a federated calendar event they received was deleted by the organiser.
 */
@@ -0,0 +1,71 @@
+import { log } from './logger.js';
+
+/**
+ * Recording transcription / AI summarization integration.
+ *
+ * When the per-room "recording transcript" setting is enabled, Redlight POSTs
+ * to ${TRANSCRIPTION_API_URL}/prompt with header `X-Api-Key: ${TRANSCRIPTION_API_KEY}`
+ * as soon as the "video" format of a recording becomes available (delivered via
+ * BBB's recording-ready callback). Leave both env vars empty to disable the
+ * integration entirely.
+ */
+
+const TRANSCRIPTION_API_URL = process.env.TRANSCRIPTION_API_URL || '';
+const TRANSCRIPTION_API_KEY = process.env.TRANSCRIPTION_API_KEY || '';
+
+const DEFAULT_PROMPT = 'Summarise the key decisions made in this meeting.';
+
+export function isTranscriptionEnabled() {
+  return !!(TRANSCRIPTION_API_URL && TRANSCRIPTION_API_KEY);
+}
+
+/**
+ * Request a summary/transcript for a recording. Never throws — failures are
+ * logged and reported via the boolean return value.
+ *
+ * @param {object} opts
+ * @param {string} opts.meetingId   Room UID / BBB meeting ID
+ * @param {string} opts.recordingId BBB record ID
+ * @param {string} [opts.prompt]    Optional custom prompt
+ * @returns {Promise<boolean>} true if the request was accepted
+ */
+export async function requestTranscription({ meetingId, recordingId, prompt }) {
+  if (!isTranscriptionEnabled()) {
+    log.server.warn('Transcription request skipped: TRANSCRIPTION_API_URL or TRANSCRIPTION_API_KEY is not configured');
+    return false;
+  }
+
+  const base = TRANSCRIPTION_API_URL.endsWith('/') ? TRANSCRIPTION_API_URL : `${TRANSCRIPTION_API_URL}/`;
+  const url = new URL('prompt', base).toString();
+
+  try {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Api-Key': TRANSCRIPTION_API_KEY,
+      },
+      body: JSON.stringify({
+        prompt: prompt || DEFAULT_PROMPT,
+        meeting_id: meetingId,
+        recording_id: recordingId,
+      }),
+      signal: AbortSignal.timeout(15_000),
+    });
+
+    if (!response.ok) {
+      const body = await response.text().catch(() => '');
+      log.server.error(`Transcription request failed: status=${response.status} body=${body.slice(0, 200)}`);
+      return false;
+    }
+
+    log.server.info(`Transcription requested for recording ${recordingId} (meeting: ${meetingId})`);
+    return true;
+  } catch (err) {
+    // undici wraps the real network error (ECONNREFUSED, ENOTFOUND, timeout, …)
+    // in err.cause — surface it, "fetch failed" alone is undiagnosable.
+    const cause = err.cause ? ` (${err.cause.code || ''} ${err.cause.message || ''})`.trimEnd() : '';
+    log.server.error(`Transcription request to ${url} failed: ${err.message}${cause}`);
+    return false;
+  }
+}
@@ -1,6 +1,6 @@
 {
  "email": {
-    "greeting": "Hey {name} 👋",
+    "greeting": "Hallo {name},",
    "viewInvitation": "Einladung anzeigen",
    "invitationFooter": "Öffne den Link oben, um die Einladung anzunehmen oder abzulehnen.",
    "linkHint": "Oder kopiere diesen Link in deinen Browser:",
@@ -11,9 +11,16 @@
      "validity": "Dieser Link ist 24 Stunden gültig.",
      "footer": "Falls du dich nicht registriert hast, kannst du diese E-Mail ignorieren."
    },
+    "resetPassword": {
+      "subject": "{appName} - Passwort zurücksetzen",
+      "intro": "Du hast angefordert, dein Passwort zurückzusetzen. Klicke auf den Button, um ein neues Passwort festzulegen:",
+      "button": "Passwort zurücksetzen",
+      "validity": "Dieser Link ist 1 Stunde gültig.",
+      "footer": "Falls du das nicht angefordert hast, kannst du diese E-Mail ignorieren – dein Passwort bleibt unverändert."
+    },
    "invite": {
      "subject": "{appName} - Du wurdest eingeladen",
-      "title": "Du wurdest eingeladen! 🎉",
+      "title": "Du wurdest eingeladen",
      "intro": "Du wurdest eingeladen, ein Konto auf {appName} zu erstellen.",
      "prompt": "Klicke auf den Button, um dich zu registrieren:",
      "button": "Konto erstellen",
@@ -36,6 +43,14 @@
      "subject": "{appName} - Kalendereinladung von {fromUser}",
      "intro": "Du hast eine Kalendereinladung von {fromUser} erhalten."
    },
+    "calendarEventInvite": {
+      "subject": "{appName} - Kalendereinladung: {title}",
+      "title": "Kalendereinladung",
+      "intro": "{fromUser} hat dich zu folgendem Termin eingeladen:",
+      "joinButton": "Meeting beitreten",
+      "icsHint": "Mit der angehängten .ics-Datei kannst du den Termin zu deinem Kalender hinzufügen.",
+      "footer": "Diese Einladung wurde über {appName} versendet."
+    },
    "calendarDeleted": {
      "subject": "{appName} - Kalendereintrag abgesagt: {title}",
      "intro": "Der folgende Kalendereintrag wurde vom Organisator ({fromUser}) gelöscht und ist nicht mehr verfügbar:",
@@ -1,6 +1,6 @@
 {
  "email": {
-    "greeting": "Hey {name} 👋",
+    "greeting": "Hello {name},",
    "viewInvitation": "View Invitation",
    "invitationFooter": "Open the link above to accept or decline the invitation.",
    "linkHint": "Or copy this link in your browser:",
@@ -11,9 +11,16 @@
      "validity": "This link is valid for 24 hours.",
      "footer": "If you didn't register, please ignore this email."
    },
+    "resetPassword": {
+      "subject": "{appName} - Reset your password",
+      "intro": "You requested to reset your password. Click the button below to set a new one:",
+      "button": "Reset Password",
+      "validity": "This link is valid for 1 hour.",
+      "footer": "If you didn't request this, you can safely ignore this email — your password will remain unchanged."
+    },
    "invite": {
      "subject": "{appName} - You've been invited",
-      "title": "You've been invited! 🎉",
+      "title": "You have been invited",
      "intro": "You have been invited to create an account on {appName}.",
      "prompt": "Click the button below to register:",
      "button": "Create Account",
@@ -36,6 +43,14 @@
      "subject": "{appName} - Calendar invitation from {fromUser}",
      "intro": "You have received a calendar invitation from {fromUser}."
    },
+    "calendarEventInvite": {
+      "subject": "{appName} - Calendar invitation: {title}",
+      "title": "Calendar Invitation",
+      "intro": "{fromUser} has invited you to the following event:",
+      "joinButton": "Join Meeting",
+      "icsHint": "You can add this event to your calendar using the attached .ics file.",
+      "footer": "This invitation was sent via {appName}."
+    },
    "calendarDeleted": {
      "subject": "{appName} - Calendar event cancelled: {title}",
      "intro": "The following calendar event was deleted by the organiser ({fromUser}) and is no longer available:",
@@ -1,6 +1,6 @@
 import { Router, json } from 'express';
 import crypto from 'crypto';
-import ExcelJS from 'exceljs';
+import writeXlsxFile from 'write-excel-file/node';
 import PDFDocument from 'pdfkit';
 import { getDb } from '../config/database.js';
 import { authenticateToken } from '../middleware/auth.js';
@@ -9,22 +9,25 @@ import { getAnalyticsToken } from '../config/bbb.js';

 const router = Router();

-// POST /api/analytics/callback/:uid?token=... - BBB Learning Analytics callback (token-secured)
-// Excluded from the global 100kb body limit (see index.js): learning analytics
-// payloads for large meetings can be several MB.
-router.post('/callback/:uid', json({ limit: '5mb' }), async (req, res) => {
-  try {
+// Token check runs BEFORE the 5mb body parser so unauthenticated callers
+// cannot make the server buffer large payloads.
+// Constant-time comparison to prevent timing attacks. Reject non-string tokens
+// (e.g. ?token=a&token=b would yield an array and crash Buffer.from).
+function verifyCallbackToken(req, res, next) {
  const { token } = req.query;
  const expectedToken = getAnalyticsToken(req.params.uid);
-
-    // Constant-time comparison to prevent timing attacks.
-    // Reject non-string tokens (e.g. ?token=a&token=b would yield an array and
-    // crash Buffer.from).
  if (typeof token !== 'string' || token.length !== expectedToken.length ||
      !crypto.timingSafeEqual(Buffer.from(token), Buffer.from(expectedToken))) {
    return res.status(403).json({ error: 'Invalid token' });
  }
+  next();
+}

+// POST /api/analytics/callback/:uid?token=... - BBB Learning Analytics callback (token-secured)
+// Excluded from the global 100kb body limit (see index.js): learning analytics
+// payloads for large meetings can be several MB.
+router.post('/callback/:uid', verifyCallbackToken, json({ limit: '5mb' }), async (req, res) => {
+  try {
    const db = getDb();
    const room = await db.get('SELECT id, uid, learning_analytics FROM rooms WHERE uid = ?', [req.params.uid]);

@@ -243,26 +246,24 @@ router.get('/:id/export/:format', authenticateToken, async (req, res) => {

    if (format === 'xlsx') {
      // Prefix-escape strings that would otherwise be evaluated as formulas.
-      const sanitizeXlsx = (r) => {
-        const out = {};
-        for (const k of Object.keys(r)) {
-          const v = r[k];
-          out[k] = (typeof v === 'string' && /^[=+\-@\t\r]/.test(v)) ? "'" + v : v;
-        }
-        return out;
-      };
-      const workbook = new ExcelJS.Workbook();
-      const sheet = workbook.addWorksheet('Analytics');
-      sheet.columns = COLUMNS;
-      rows.forEach(r => sheet.addRow(sanitizeXlsx(r)));
-      // Style header row
-      sheet.getRow(1).font = { bold: true };
-      sheet.getRow(1).fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FFE0E0E0' } };
+      const sanitizeXlsx = (v) =>
+        (typeof v === 'string' && /^[=+\-@\t\r]/.test(v)) ? "'" + v : v;
+
+      const headerRow = COLUMNS.map(c => ({
+        value: c.header,
+        fontWeight: 'bold',
+        backgroundColor: '#e0e0e0',
+      }));
+      const dataRows = rows.map(r => COLUMNS.map(c => ({ value: sanitizeXlsx(r[c.key]) })));
+
+      const buffer = await writeXlsxFile([headerRow, ...dataRows], {
+        columns: COLUMNS.map(c => ({ width: c.width })),
+        sheet: 'Analytics',
+      }).toBuffer();

      res.setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
      res.setHeader('Content-Disposition', `attachment; filename="${safeName}.xlsx"`);
-      await workbook.xlsx.write(res);
-      return res.end();
+      return res.send(buffer);
    }

    if (format === 'pdf') {
@@ -2,16 +2,17 @@ import { Router } from 'express';
 import bcrypt from 'bcryptjs';
 import jwt from 'jsonwebtoken';
 import { v4 as uuidv4 } from 'uuid';
+import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { rateLimit } from 'express-rate-limit';
+import { rateLimit, MemoryStore } from 'express-rate-limit';
 import { RedisStore } from 'rate-limit-redis';
 import * as OTPAuth from 'otpauth';
 import { getDb } from '../config/database.js';
 import redis from '../config/redis.js';
 import { authenticateToken, generateToken, getBaseUrl } from '../middleware/auth.js';
-import { isMailerConfigured, sendVerificationEmail } from '../config/mailer.js';
+import { isMailerConfigured, sendVerificationEmail, sendPasswordResetEmail } from '../config/mailer.js';
 import { getOAuthConfig, discoverOIDC } from '../config/oauth.js';
 import { getAppName } from '../config/appName.js';
 import { log } from '../config/logger.js';
@@ -23,15 +24,65 @@ if (!process.env.JWT_SECRET) {
 const JWT_SECRET = process.env.JWT_SECRET;

 // ── Rate Limiting ────────────────────────────────────────────────────────────
-function makeRedisStore(prefix) {
+// Shared Redis store with in-memory fallback. Without the fallback, a dead
+// Redis connection makes every rate-limited endpoint (incl. login) return 500 —
+// rate limiting must degrade, not take auth down with it.
+class ResilientStore {
+  constructor(prefix) {
    try {
-    return new RedisStore({
+      this.redisStore = new RedisStore({
        sendCommand: (...args) => redis.call(...args),
        prefix,
      });
    } catch {
-    return undefined; // falls back to in-memory if Redis unavailable
+      this.redisStore = null;
    }
+    this.memoryStore = new MemoryStore();
+  }
+  init(options) {
+    try {
+      // RedisStore.init returns the SCRIPT LOAD promise; catch it so a dead
+      // Redis connection surfaces as a warning instead of an unhandled
+      // rejection that kills the process.
+      const initResult = this.redisStore?.init?.(options);
+      if (typeof initResult?.catch === 'function') {
+        initResult.catch(err => log.auth.warn(`Rate-limit Redis init failed: ${err.message}`));
+      }
+    } catch (err) {
+      log.auth.warn(`Rate-limit Redis init failed: ${err.message}`);
+    }
+    this.memoryStore.init(options);
+  }
+  async increment(key) {
+    if (this.redisStore && redis.status === 'ready') {
+      try {
+        return await this.redisStore.increment(key);
+      } catch (err) {
+        log.auth.warn(`Rate-limit Redis store failed, using in-memory fallback: ${err.message}`);
+      }
+    }
+    return this.memoryStore.increment(key);
+  }
+  async decrement(key) {
+    if (this.redisStore && redis.status === 'ready') {
+      try {
+        return await this.redisStore.decrement(key);
+      } catch { /* fall through to memory */ }
+    }
+    return this.memoryStore.decrement(key);
+  }
+  async resetKey(key) {
+    if (this.redisStore && redis.status === 'ready') {
+      try {
+        return await this.redisStore.resetKey(key);
+      } catch { /* fall through to memory */ }
+    }
+    return this.memoryStore.resetKey(key);
+  }
+}
+
+function makeRedisStore(prefix) {
+  return new ResilientStore(prefix);
 }

 // ── Validation helpers ─────────────────────────────────────────────────────
@@ -117,6 +168,26 @@ const twoFaLimiter = rateLimit({
  store: makeRedisStore('rl:2fa:'),
 });

+// Rate limit forgot-password to prevent SMTP abuse / email enumeration spam
+const forgotPasswordLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 5,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many requests. Please try again later.' },
+  store: makeRedisStore('rl:forgot:'),
+});
+
+// Rate limit reset-password submissions to slow token brute-forcing
+const resetPasswordLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many attempts. Please try again later.' },
+  store: makeRedisStore('rl:reset:'),
+});
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const uploadsDir = path.join(__dirname, '..', '..', 'uploads', 'avatars');
@@ -341,6 +412,115 @@ router.post('/resend-verification', resendVerificationLimiter, async (req, res)
  }
 });

+// Hash a reset token for storage/lookup (never store the raw token)
+function hashResetToken(token) {
+  return crypto.createHash('sha256').update(token).digest('hex');
+}
+
+// POST /api/auth/forgot-password
+router.post('/forgot-password', forgotPasswordLimiter, async (req, res) => {
+  try {
+    const { email } = req.body;
+    if (!email || typeof email !== 'string' || !EMAIL_RE.test(email)) {
+      return res.status(400).json({ error: 'A valid email address is required' });
+    }
+
+    // Generic response used in every branch so we never reveal whether an
+    // account exists, whether it uses SSO, or whether SMTP is configured.
+    const genericResponse = { message: 'If an account exists for that address, a password reset email has been sent.' };
+
+    if (!isMailerConfigured()) {
+      return res.json(genericResponse);
+    }
+
+    const db = getDb();
+    const user = await db.get('SELECT id, name, display_name, email, language, oauth_provider, reset_requested_at FROM users WHERE email = ?', [email.toLowerCase()]);
+
+    // No account, or an SSO-only account that has no local password to reset
+    if (!user || user.oauth_provider) {
+      return res.json(genericResponse);
+    }
+
+    // Server-side 60s throttle per account to limit repeated emails
+    if (user.reset_requested_at) {
+      const secondsAgo = (Date.now() - new Date(user.reset_requested_at).getTime()) / 1000;
+      if (secondsAgo < 60) {
+        return res.json(genericResponse);
+      }
+    }
+
+    const resetToken = uuidv4();
+    const tokenHash = hashResetToken(resetToken);
+    const expires = new Date(Date.now() + 60 * 60 * 1000).toISOString(); // 1 hour
+    const now = new Date().toISOString();
+
+    await db.run(
+      'UPDATE users SET reset_token_hash = ?, reset_token_expires = ?, reset_requested_at = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?',
+      [tokenHash, expires, now, user.id]
+    );
+
+    const baseUrl = getBaseUrl(req);
+    const resetUrl = `${baseUrl}/reset-password?token=${resetToken}`;
+    const appName = await getAppName();
+
+    try {
+      await sendPasswordResetEmail(email.toLowerCase(), user.display_name || user.name, resetUrl, appName, user.language || 'en');
+    } catch (mailErr) {
+      log.auth.error(`Password reset mail failed: ${mailErr.message}`);
+      // Still return generic success — don't leak SMTP state to the client
+    }
+
+    res.json(genericResponse);
+  } catch (err) {
+    log.auth.error(`Forgot password error: ${err.message}`);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// POST /api/auth/reset-password
+router.post('/reset-password', resetPasswordLimiter, async (req, res) => {
+  try {
+    const { token, password } = req.body;
+    if (!token || typeof token !== 'string') {
+      return res.status(400).json({ error: 'Invalid or expired reset link.' });
+    }
+    if (!password || typeof password !== 'string') {
+      return res.status(400).json({ error: 'A new password is required' });
+    }
+    if (password.length < MIN_PASSWORD_LENGTH) {
+      return res.status(400).json({ error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long` });
+    }
+    if (password.length > MAX_PASSWORD_LENGTH) {
+      return res.status(400).json({ error: `Password must not exceed ${MAX_PASSWORD_LENGTH} characters` });
+    }
+
+    const db = getDb();
+    const tokenHash = hashResetToken(token);
+    const user = await db.get('SELECT id, reset_token_expires FROM users WHERE reset_token_hash = ?', [tokenHash]);
+
+    if (!user) {
+      return res.status(400).json({ error: 'Invalid or expired reset link.' });
+    }
+    if (!user.reset_token_expires || new Date(user.reset_token_expires) < new Date()) {
+      return res.status(400).json({ error: 'Invalid or expired reset link.' });
+    }
+
+    const hash = await bcrypt.hash(password, 12);
+
+    // Set the new password, verify the email (proves mailbox ownership), and
+    // clear the reset token so it can't be reused.
+    await db.run(
+      'UPDATE users SET password_hash = ?, email_verified = 1, reset_token_hash = NULL, reset_token_expires = NULL, reset_requested_at = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?',
+      [hash, user.id]
+    );
+
+    res.json({ message: 'Password has been reset successfully. You can now sign in.' });
+  } catch (err) {
+    log.auth.error(`Reset password error: ${err.message}`);
+    res.status(500).json({ error: 'Password could not be reset' });
+  }
+});
+
 // POST /api/auth/login
 router.post('/login', loginLimiter, async (req, res) => {
  try {
@@ -7,6 +7,7 @@ import { getDb } from '../config/database.js';
 import { authenticateToken, requireAdmin } from '../middleware/auth.js';
 import { log } from '../config/logger.js';
 import { getOAuthConfig } from '../config/oauth.js';
+import { isTranscriptionEnabled } from '../config/transcription.js';

 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -121,6 +122,7 @@ router.get('/', async (req, res) => {
      oauthEnabled,
      oauthDisplayName,
      hideAppName: hideAppName === 'true',
+      transcriptionEnabled: isTranscriptionEnabled(),
    });
  } catch (err) {
    log.branding.error('Get branding error:', err);
@@ -12,12 +12,25 @@

 import { Router, text } from 'express';
 import crypto from 'crypto';
+import { rateLimit } from 'express-rate-limit';
 import { getDb } from '../config/database.js';
 import { log } from '../config/logger.js';
 import { getBaseUrl } from '../middleware/auth.js';

 const router = Router();

+// Brute-force protection for the Basic-Auth tokens: only failed requests count
+// (skipSuccessfulRequests), so legitimate sync clients polling frequently are
+// not throttled.
+router.use(rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 30,
+  skipSuccessfulRequests: true,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: 'Too many failed CalDAV requests. Please try again later.',
+}));
+
 // ── Body parsing for XML and iCalendar payloads ────────────────────────────
 router.use(text({ type: ['application/xml', 'text/xml', 'text/calendar', 'application/octet-stream'] }));

@@ -194,9 +207,10 @@ async function caldavAuth(req, res, next) {
    const token = decoded.slice(colonIdx + 1);

    const db = getDb();
+    // Emails are stored lowercased
    const user = await db.get(
      'SELECT id, name, display_name, email FROM users WHERE email = ?',
-      [email],
+      [email.toLowerCase()],
    );
    if (!user) {
      res.set('WWW-Authenticate', 'Basic realm="Redlight CalDAV"');
@@ -243,7 +257,7 @@ function setDAVHeaders(res) {
 // ── CalDAV username authorization ──────────────────────────────────────────
 // Ensures the :username param matches the authenticated user's email
 function validateCalDAVUser(req, res, next) {
-  if (req.params.username && decodeURIComponent(req.params.username) !== req.caldavUser.email) {
+  if (req.params.username && decodeURIComponent(req.params.username).toLowerCase() !== req.caldavUser.email) {
    return res.status(403).end();
  }
  next();
@@ -3,7 +3,7 @@ import crypto from 'crypto';
 import { getDb } from '../config/database.js';
 import { authenticateToken, getBaseUrl } from '../middleware/auth.js';
 import { log } from '../config/logger.js';
-import { sendCalendarInviteEmail } from '../config/mailer.js';
+import { sendCalendarInviteEmail, sendCalendarEventEmail } from '../config/mailer.js';
 import { getAppName } from '../config/appName.js';
 import {
  isFederationEnabled,
@@ -23,6 +23,16 @@ const SAFE_COLOR_RE = /^(?:#[0-9a-fA-F]{3,8}|hsl\(\d{1,3},\s*\d{1,3}%,\s*\d{1,3}
 // Allowed reminder intervals in minutes
 const VALID_REMINDERS = new Set([5, 15, 30, 60, 120, 1440]);

+// Rate limit email invitations: each request may carry up to 50 addresses, so
+// without a cap any registered account could be abused as an SMTP spam relay.
+const calendarEmailInviteLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000, // 1 hour
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many email invitations. Please try again later.' },
+});
+
 // Rate limit for federation calendar receive
 const calendarFederationLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
@@ -581,6 +591,69 @@ router.post('/events/:id/federation', authenticateToken, async (req, res) => {
  }
 });

+// ── POST /api/calendar/events/:id/email — Send event invitation by email ────
+router.post('/events/:id/email', authenticateToken, calendarEmailInviteLimiter, async (req, res) => {
+  try {
+    const { emails } = req.body;
+    if (!emails || !Array.isArray(emails) || !emails.length) {
+      return res.status(400).json({ error: 'At least one email address is required' });
+    }
+    if (emails.length > 50) {
+      return res.status(400).json({ error: 'Maximum 50 email addresses allowed' });
+    }
+
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    for (const email of emails) {
+      if (typeof email !== 'string' || !emailRegex.test(email) || email.length > 254) {
+        return res.status(400).json({ error: `Invalid email address: ${email}` });
+      }
+    }
+
+    const db = getDb();
+    const event = await db.get(`
+      SELECT ce.*, COALESCE(NULLIF(u.display_name,''), u.name) as organizer_name, u.email as organizer_email
+      FROM calendar_events ce
+      JOIN users u ON ce.user_id = u.id
+      WHERE ce.id = ? AND ce.user_id = ?
+    `, [req.params.id, req.user.id]);
+    if (!event) return res.status(404).json({ error: 'Event not found or no permission' });
+
+    const baseUrl = getBaseUrl(req);
+    let joinUrl = null;
+    if (event.room_uid) {
+      joinUrl = `${baseUrl}/join/${event.room_uid}`;
+    }
+
+    const ics = generateICS(event, joinUrl || '', baseUrl);
+    const appName = await getAppName();
+    const fromUser = req.user.display_name || req.user.name;
+    const lang = req.user.language || 'en';
+
+    // Send emails (in parallel but collect errors)
+    const results = await Promise.allSettled(
+      emails.map(email =>
+        sendCalendarEventEmail(
+          email, fromUser, event.title, event.start_time, event.end_time,
+          event.description, joinUrl, ics, appName, lang
+        )
+      )
+    );
+
+    const failed = results.filter(r => r.status === 'rejected');
+    if (failed.length === emails.length) {
+      return res.status(500).json({ error: 'Failed to send all email invitations' });
+    }
+    if (failed.length > 0) {
+      log.server.warn(`${failed.length}/${emails.length} calendar email invitations failed`);
+    }
+
+    res.json({ success: true, sent: emails.length - failed.length, failed: failed.length });
+  } catch (err) {
+    log.server.error(`Calendar email invite error: ${err.message}`);
+    res.status(500).json({ error: err.message || 'Failed to send email invitations' });
+  }
+});
+
 // ── POST /receive-event or /calendar-event — Receive calendar event from remote ──
 // '/receive-event' when mounted at /api/calendar
 // '/calendar-event' when mounted at /api/federation (for remote instance discovery)
@@ -41,7 +41,7 @@ export function wellKnownHandler(req, res) {
        federation_api: '/api/federation',
        public_key: getPublicKey(),
        software: 'Redlight',
-        version: '2.2.0',
+        version: '2.5.0',
    });
 }

@@ -1,7 +1,9 @@
-import { Router } from 'express';
+import { Router, urlencoded } from 'express';
+import jwt from 'jsonwebtoken';
 import { authenticateToken } from '../middleware/auth.js';
 import { getDb } from '../config/database.js';
 import { log } from '../config/logger.js';
+import { isTranscriptionEnabled, requestTranscription } from '../config/transcription.js';
 import {
  getRecordings,
  getRecordingByRecordId,
@@ -9,6 +11,8 @@ import {
  publishRecording,
 } from '../config/bbb.js';

+const BBB_SECRET = process.env.BBB_SECRET || '';
+
 const router = Router();

 /**
@@ -176,6 +180,65 @@ async function fetchAndSyncRecordings(meetingID, fallbackName) {
  }
 }

+// POST /api/recordings/recording-ready - BBB recording-ready callback (unauthenticated)
+// BBB posts `signed_parameters`, a JWT signed with the shared BBB secret.
+// Fires once per playback format; the transcription request is only sent when
+// the "video" format first becomes available and the room has the setting on.
+router.post('/recording-ready', urlencoded({ extended: false }), async (req, res) => {
+  try {
+    const signed = req.body?.signed_parameters;
+    if (!signed || typeof signed !== 'string') {
+      return res.status(400).json({ error: 'signed_parameters is required' });
+    }
+
+    let payload;
+    try {
+      payload = jwt.verify(signed, BBB_SECRET, { algorithms: ['HS256'] });
+    } catch {
+      return res.status(403).json({ error: 'Invalid signature' });
+    }
+
+    const recordId = payload.record_id;
+    const meetingId = payload.meeting_id;
+    if (!recordId || !meetingId) {
+      return res.status(400).json({ error: 'record_id and meeting_id are required' });
+    }
+
+    // Always answer 200 from here on so BBB does not keep retrying —
+    // "nothing to do" is a valid outcome for this callback.
+    const db = getDb();
+    const room = await db.get('SELECT id, uid, name, recording_transcript FROM rooms WHERE uid = ?', [meetingId]);
+    if (!room || !room.recording_transcript || !isTranscriptionEnabled()) {
+      return res.json({});
+    }
+
+    const rec = await getRecordingByRecordId(recordId).catch(() => null);
+    if (!rec) return res.json({});
+
+    const formatted = formatBbbRecording(rec, room.name);
+    const hasVideo = formatted.formats.some(f => f.type === 'video');
+
+    // Cache the recording so the dedupe marker below has a row to live on
+    await upsertRecording(db, formatted);
+
+    if (!hasVideo) return res.json({});
+
+    // Dedupe: BBB fires the callback once per format
+    const cached = await db.get('SELECT transcript_requested_at FROM recordings WHERE record_id = ?', [recordId]);
+    if (cached?.transcript_requested_at) return res.json({});
+
+    const ok = await requestTranscription({ meetingId, recordingId: recordId });
+    if (ok) {
+      await db.run('UPDATE recordings SET transcript_requested_at = CURRENT_TIMESTAMP WHERE record_id = ?', [recordId]);
+    }
+
+    res.json({});
+  } catch (err) {
+    log.recordings.error(`Recording-ready callback error: ${err.message}`);
+    res.status(500).json({ error: 'Error processing recording-ready callback' });
+  }
+});
+
 // GET /api/recordings - Get recordings for a room (by meetingID/uid)
 router.get('/', authenticateToken, async (req, res) => {
  try {
@@ -67,6 +67,16 @@ const guestJoinLimiter = rateLimit({
  message: { error: 'Too many join attempts. Please try again later.' },
 });

+// Rate limit email invitations: each request may carry up to 50 addresses, so
+// without a cap any registered account could be abused as an SMTP spam relay.
+const inviteEmailLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000, // 1 hour
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many email invitations. Please try again later.' },
+});
+
 const router = Router();

 // Build avatar URL for a user (uploaded image or generated initials)
@@ -183,6 +193,7 @@ router.post('/', authenticateToken, async (req, res) => {
      record_meeting,
      guest_access,
      moderator_code,
+      recording_transcript,
    } = req.body;

    if (!name || name.trim().length === 0) {
@@ -217,8 +228,8 @@ router.post('/', authenticateToken, async (req, res) => {
    const db = getDb();

    const result = await db.run(`
-      INSERT INTO rooms (uid, name, user_id, welcome_message, max_participants, access_code, mute_on_join, require_approval, anyone_can_start, all_join_moderator, record_meeting, guest_access, moderator_code)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      INSERT INTO rooms (uid, name, user_id, welcome_message, max_participants, access_code, mute_on_join, require_approval, anyone_can_start, all_join_moderator, record_meeting, guest_access, moderator_code, recording_transcript)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
    `, [
      uid,
      name.trim(),
@@ -233,6 +244,8 @@ router.post('/', authenticateToken, async (req, res) => {
      record_meeting !== false ? 1 : 0,
      guest_access ? 1 : 0,
      moderator_code || null,
+      // Transcription/AI summary requires recording to be enabled
+      (record_meeting !== false && recording_transcript) ? 1 : 0,
    ]);

    const room = await db.get('SELECT * FROM rooms WHERE id = ?', [result.lastInsertRowid]);
@@ -267,6 +280,7 @@ router.put('/:uid', authenticateToken, async (req, res) => {
      moderator_code,
      learning_analytics,
      analytics_visibility,
+      recording_transcript,
    } = req.body;

    // M12: field length limits (same as create)
@@ -293,6 +307,9 @@ router.put('/:uid', authenticateToken, async (req, res) => {
      }
    }

+    // Transcription/AI summary requires recording — force it off when recording ends up disabled
+    const effectiveRecordMeeting = record_meeting !== undefined ? !!record_meeting : !!room.record_meeting;
+
    await db.run(`
      UPDATE rooms SET
        name = COALESCE(?, name),
@@ -308,6 +325,7 @@ router.put('/:uid', authenticateToken, async (req, res) => {
        moderator_code = ?,
        learning_analytics = COALESCE(?, learning_analytics),
        analytics_visibility = COALESCE(?, analytics_visibility),
+        recording_transcript = COALESCE(?, recording_transcript),
        updated_at = CURRENT_TIMESTAMP
      WHERE uid = ?
    `, [
@@ -324,6 +342,7 @@ router.put('/:uid', authenticateToken, async (req, res) => {
      moderator_code !== undefined ? (moderator_code || null) : room.moderator_code,
      learning_analytics !== undefined ? (learning_analytics ? 1 : 0) : null,
      analytics_visibility && ['owner', 'shared'].includes(analytics_visibility) ? analytics_visibility : null,
+      !effectiveRecordMeeting ? 0 : (recording_transcript !== undefined ? (recording_transcript ? 1 : 0) : null),
      req.params.uid,
    ]);

@@ -425,6 +444,10 @@ router.post('/:uid/shares', authenticateToken, async (req, res) => {
    if (user_id === req.user.id) {
      return res.status(400).json({ error: 'You cannot share the room with yourself' });
    }
+    const targetUser = await db.get('SELECT id FROM users WHERE id = ?', [user_id]);
+    if (!targetUser) {
+      return res.status(404).json({ error: 'User not found' });
+    }
    // Check if already shared
    const existing = await db.get('SELECT id FROM room_shares WHERE room_id = ? AND user_id = ?', [room.id, user_id]);
    if (existing) {
@@ -519,7 +542,7 @@ router.post('/:uid/start', authenticateToken, async (req, res) => {
    await createMeeting(room, baseUrl, loginURL, presentationUrl, analyticsCallbackURL, owner?.language || 'en');
    const avatarURL = getUserAvatarURL(req, req.user);
    const displayName = req.user.display_name || req.user.name;
-    const joinUrl = await joinMeeting(room.uid, displayName, true, avatarURL);
+    const joinUrl = await joinMeeting(room.uid, displayName, true, avatarURL, !!req.body.dark_mode);
    res.json({ joinUrl });
  } catch (err) {
    log.rooms.error(`Start meeting error: ${err.message}`);
@@ -553,7 +576,7 @@ router.post('/:uid/join', authenticateToken, async (req, res) => {
    const isShared = !isOwner && await db.get('SELECT id FROM room_shares WHERE room_id = ? AND user_id = ?', [room.id, req.user.id]);
    const isModerator = isOwner || !!isShared || room.all_join_moderator;
    const avatarURL = getUserAvatarURL(req, req.user);
-    const joinUrl = await joinMeeting(room.uid, req.user.display_name || req.user.name, isModerator, avatarURL);
+    const joinUrl = await joinMeeting(room.uid, req.user.display_name || req.user.name, isModerator, avatarURL, !!req.body.dark_mode);
    res.json({ joinUrl });
  } catch (err) {
    log.rooms.error(`Join meeting error: ${err.message}`);
@@ -629,7 +652,7 @@ router.get('/:uid/public', async (req, res) => {
 // POST /api/rooms/:uid/guest-join - Join meeting as guest (no auth needed)
 router.post('/:uid/guest-join', guestJoinLimiter, async (req, res) => {
  try {
-    const { name, access_code, moderator_code, avatar_image, avatar_color } = req.body;
+    const { name, access_code, moderator_code, avatar_image, avatar_color, dark_mode } = req.body;

    if (!name || name.trim().length === 0) {
      return res.status(400).json({ error: 'Name is required' });
@@ -691,7 +714,7 @@ router.post('/:uid/guest-join', guestJoinLimiter, async (req, res) => {
    } else {
      guestAvatarURL = `${baseUrl}/api/auth/avatar/initials/${encodeURIComponent(name.trim())}`;
    }
-    const joinUrl = await joinMeeting(room.uid, name.trim(), isModerator, guestAvatarURL);
+    const joinUrl = await joinMeeting(room.uid, name.trim(), isModerator, guestAvatarURL, !!dark_mode);
    res.json({ joinUrl });
  } catch (err) {
    log.rooms.error(`Guest join error: ${err.message}`);
@@ -740,7 +763,10 @@ router.get('/presentations/:token/:expires/:roomUid/:filename', (req, res) => {
    .update(`${roomUid}/${filename}:${expires}`)
    .digest('hex');

-  if (!crypto.timingSafeEqual(Buffer.from(token), Buffer.from(expected))) {
+  // timingSafeEqual throws on length mismatch, so compare lengths first
+  const tokenBuf = Buffer.from(token);
+  const expectedBuf = Buffer.from(expected);
+  if (tokenBuf.length !== expectedBuf.length || !crypto.timingSafeEqual(tokenBuf, expectedBuf)) {
    return res.status(403).json({ error: 'Invalid token' });
  }

@@ -868,7 +894,7 @@ router.delete('/:uid/presentation', authenticateToken, async (req, res) => {
 });

 // ── POST /api/rooms/invite-email — Send email invitation to guest(s) ────────
-router.post('/invite-email', authenticateToken, async (req, res) => {
+router.post('/invite-email', authenticateToken, inviteEmailLimiter, async (req, res) => {
  try {
    const { room_uid, emails, message } = req.body;
    if (!room_uid || !emails || !emails.length) {
@@ -1,5 +1,5 @@
 import { useEffect } from 'react';
-import { Routes, Route, Navigate } from 'react-router-dom';
+import { Routes, Route, Navigate, useLocation } from 'react-router-dom';
 import { useAuth } from './contexts/AuthContext';
 import { useLanguage } from './contexts/LanguageContext';
 import { useBranding } from './contexts/BrandingContext';
@@ -9,6 +9,8 @@ import Home from './pages/Home';
 import Login from './pages/Login';
 import Register from './pages/Register';
 import VerifyEmail from './pages/VerifyEmail';
+import ForgotPassword from './pages/ForgotPassword';
+import ResetPassword from './pages/ResetPassword';
 import Dashboard from './pages/Dashboard';
 import RoomDetail from './pages/RoomDetail';
 import Settings from './pages/Settings';
@@ -22,8 +24,9 @@ import NotFound from './pages/NotFound';

 export default function App() {
  const { user, loading } = useAuth();
-  const { setLanguage } = useLanguage();
+  const { t, setLanguage } = useLanguage();
  const { appName } = useBranding();
+  const location = useLocation();

  // Sync language from server when user loads
  useEffect(() => {
@@ -32,14 +35,28 @@ export default function App() {
    }
  }, [user?.language, setLanguage]);

-  // Update document title with branding
+  // Unique, context-forward document title per page (SPA route changes
+  // don't reload the document, so we update the title ourselves)
  useEffect(() => {
-    document.title = `${appName} - BigBlueButton Frontend`;
-  }, [appName]);
+    const pageTitles = {
+      '/dashboard': t('nav.dashboard'),
+      '/calendar': t('nav.calendar'),
+      '/settings': t('nav.settings'),
+      '/admin': t('nav.admin'),
+      '/federation': t('nav.federation'),
+      '/login': t('auth.login'),
+      '/register': t('auth.register'),
+      '/forgot-password': t('auth.forgotPassword'),
+    };
+    const match = Object.entries(pageTitles).find(([path]) =>
+      location.pathname === path || location.pathname.startsWith(`${path}/`)
+    );
+    document.title = match ? `${match[1]} | ${appName}` : `${appName} - BigBlueButton Frontend`;
+  }, [location.pathname, appName, t]);

  if (loading) {
    return (
-      <div className="min-h-screen bg-th-bg flex items-center justify-center">
+      <div className="min-h-screen bg-th-bg flex items-center justify-center" role="status" aria-label={t('common.loading')}>
        <div className="animate-spin rounded-full h-12 w-12 border-4 border-th-accent border-t-transparent" />
      </div>
    );
@@ -52,6 +69,8 @@ export default function App() {
      <Route path="/login" element={user ? <Navigate to="/dashboard" /> : <Login />} />
      <Route path="/register" element={user ? <Navigate to="/dashboard" /> : <Register />} />
      <Route path="/verify-email" element={<VerifyEmail />} />
+      <Route path="/forgot-password" element={user ? <Navigate to="/dashboard" /> : <ForgotPassword />} />
+      <Route path="/reset-password" element={<ResetPassword />} />
      <Route path="/oauth/callback" element={<OAuthCallback />} />
      <Route path="/join/:uid" element={<GuestJoin />} />

@@ -211,21 +211,21 @@ export default function AnalyticsList({ analytics, onRefresh, isOwner = true })
                  <table className="w-full text-sm">
                    <thead>
                      <tr className="text-left text-xs text-th-text-s border-b border-th-border">
-                        <th className="pb-2 pr-4 font-medium">{t('analytics.userName')}</th>
-                        <th className="pb-2 pr-4 font-medium">{t('analytics.role')}</th>
-                        <th className="pb-2 pr-4 font-medium">
+                        <th scope="col" className="pb-2 pr-4 font-medium">{t('analytics.userName')}</th>
+                        <th scope="col" className="pb-2 pr-4 font-medium">{t('analytics.role')}</th>
+                        <th scope="col" className="pb-2 pr-4 font-medium">
                          <span className="flex items-center gap-1"><Clock size={11} />{t('analytics.duration')}</span>
                        </th>
-                        <th className="pb-2 pr-4 font-medium">
+                        <th scope="col" className="pb-2 pr-4 font-medium">
                          <span className="flex items-center gap-1"><Mic size={11} />{t('analytics.talkTime')}</span>
                        </th>
-                        <th className="pb-2 pr-4 font-medium">
+                        <th scope="col" className="pb-2 pr-4 font-medium">
                          <span className="flex items-center gap-1"><MessageSquare size={11} />{t('analytics.messages')}</span>
                        </th>
-                        <th className="pb-2 pr-4 font-medium">
+                        <th scope="col" className="pb-2 pr-4 font-medium">
                          <span className="flex items-center gap-1"><Hand size={11} />{t('analytics.raiseHand')}</span>
                        </th>
-                        <th className="pb-2 font-medium">{t('analytics.reactions')}</th>
+                        <th scope="col" className="pb-2 font-medium">{t('analytics.reactions')}</th>
                      </tr>
                    </thead>
                    <tbody>
@@ -1,4 +1,4 @@
-import { useEffect, useRef } from 'react';
+import { useEffect, useId, useRef } from 'react';
 import flatpickr from 'flatpickr';
 import 'flatpickr/dist/flatpickr.min.css';
 import { German } from 'flatpickr/dist/l10n/de.js';
@@ -30,6 +30,7 @@ export default function DateTimePicker({
 }) {
  const inputRef = useRef(null);
  const fpRef = useRef(null);
+  const inputId = useId();
  // Always keep a current ref to onChange so flatpickr's closure never goes stale
  const onChangeRef = useRef(onChange);
  useEffect(() => { onChangeRef.current = onChange; });
@@ -85,13 +86,14 @@ export default function DateTimePicker({
  return (
    <div>
      {label && (
-        <label className="block text-sm font-medium text-th-text mb-1.5">
+        <label htmlFor={inputId} className="block text-sm font-medium text-th-text mb-1.5">
          {label}{required && ' *'}
        </label>
      )}
      <div className="relative">
-        <Icon size={15} className="absolute left-3 top-1/2 -translate-y-1/2 text-th-text-s pointer-events-none z-1" />
+        <Icon size={15} className="absolute left-3 top-1/2 -translate-y-1/2 text-th-text-s pointer-events-none z-1" aria-hidden="true" />
        <input
+          id={inputId}
          ref={inputRef}
          type="text"
          required={required}
@@ -1,5 +1,5 @@
-import { Outlet } from 'react-router-dom';
-import { useState, useEffect } from 'react';
+import { Outlet, useLocation } from 'react-router-dom';
+import { useState, useEffect, useRef } from 'react';
 import Navbar from './Navbar';
 import Sidebar from './Sidebar';
 import { useAuth } from '../contexts/AuthContext';
@@ -14,6 +14,19 @@ export default function Layout() {
  const { t } = useLanguage();
  const [resendCooldown, setResendCooldown] = useState(0);
  const [resending, setResending] = useState(false);
+  const location = useLocation();
+  const isFirstRoute = useRef(true);
+
+  // On SPA route changes, move focus to the main region so keyboard and
+  // screen-reader users land on the new page content instead of staying
+  // on the link they clicked in the sidebar.
+  useEffect(() => {
+    if (isFirstRoute.current) {
+      isFirstRoute.current = false;
+      return;
+    }
+    document.getElementById('main-content')?.focus();
+  }, [location.pathname]);

  // Countdown timer for resend cooldown
  useEffect(() => {
@@ -22,6 +35,16 @@ export default function Layout() {
    return () => clearTimeout(timer);
  }, [resendCooldown]);

+  // Close the mobile sidebar drawer with Escape
+  useEffect(() => {
+    if (!sidebarOpen) return;
+    const handleKey = (e) => {
+      if (e.key === 'Escape') setSidebarOpen(false);
+    };
+    document.addEventListener('keydown', handleKey);
+    return () => document.removeEventListener('keydown', handleKey);
+  }, [sidebarOpen]);
+
  const handleResendVerification = async () => {
    if (resendCooldown > 0 || resending) return;
    setResending(true);
@@ -42,12 +65,20 @@ export default function Layout() {

  return (
    <div className="min-h-screen bg-th-bg flex">
+      {/* Skip link — first tab stop, jumps past sidebar and navbar */}
+      <a
+        href="#main-content"
+        className="sr-only focus:not-sr-only focus:fixed focus:top-2 focus:left-2 focus:z-50 focus:px-4 focus:py-2 focus:rounded-lg focus:bg-th-accent focus:text-th-accent-t focus:shadow-lg"
+      >
+        {t('common.skipToContent')}
+      </a>
+
      {/* Sidebar */}
      <Sidebar open={sidebarOpen} onClose={() => setSidebarOpen(false)} />

      {/* Main content */}
      <div className="flex-1 flex flex-col min-h-screen lg:ml-64">
-        <Navbar onMenuClick={() => setSidebarOpen(true)} />
+        <Navbar onMenuClick={() => setSidebarOpen(true)} sidebarOpen={sidebarOpen} />

        {/* Email verification banner */}
        {user && user.email_verified === 0 && (
@@ -67,7 +98,7 @@ export default function Layout() {
          </div>
        )}

-        <main className="flex-1 p-4 md:p-6 lg:p-8 max-w-7xl w-full mx-auto">
+        <main id="main-content" tabIndex={-1} className="flex-1 p-4 md:p-6 lg:p-8 max-w-7xl w-full mx-auto focus:outline-hidden">
          <Outlet />
        </main>
      </div>
@@ -77,6 +108,7 @@ export default function Layout() {
        <div
          className="fixed inset-0 bg-black/50 z-30 lg:hidden"
          onClick={() => setSidebarOpen(false)}
+          aria-hidden="true"
        />
      )}
    </div>
@@ -1,33 +1,12 @@
-import { useEffect, useId, useRef } from 'react';
+import { useId } from 'react';
 import { X } from 'lucide-react';
 import { useLanguage } from '../contexts/LanguageContext';
+import useDialogA11y from '../hooks/useDialogA11y';

 export default function Modal({ title, children, onClose, maxWidth = 'max-w-lg' }) {
  const { t } = useLanguage();
  const titleId = useId();
-  const dialogRef = useRef(null);
-  const previouslyFocused = useRef(null);
-
-  // Keep the latest onClose in a ref so the mount-only effect below can call it
-  // without listing onClose as a dependency. Callers pass a fresh inline arrow
-  // each render; depending on it would re-run the effect on every keystroke and
-  // steal focus back to the dialog (kicking the user out of input fields).
-  const onCloseRef = useRef(onClose);
-  onCloseRef.current = onClose;
-
-  useEffect(() => {
-    previouslyFocused.current = document.activeElement;
-    const handleKey = (e) => {
-      if (e.key === 'Escape') onCloseRef.current?.();
-    };
-    document.addEventListener('keydown', handleKey);
-    // Focus the dialog so screen readers announce it and keyboard focus lands inside
-    dialogRef.current?.focus();
-    return () => {
-      document.removeEventListener('keydown', handleKey);
-      previouslyFocused.current?.focus?.();
-    };
-  }, []);
+  const dialogRef = useDialogA11y(true, onClose);

  return (
    <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
@@ -42,10 +21,10 @@ export default function Modal({ title, children, onClose, maxWidth = 'max-w-lg'
        aria-modal="true"
        aria-labelledby={titleId}
        tabIndex={-1}
-        className={`relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full ${maxWidth} focus:outline-hidden`}
+        className={`relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full ${maxWidth} max-h-[calc(100vh-2rem)] flex flex-col focus:outline-hidden`}
      >
        {/* Header */}
-        <div className="flex items-center justify-between px-6 py-4 border-b border-th-border rounded-t-2xl">
+        <div className="flex items-center justify-between px-6 py-4 border-b border-th-border rounded-t-2xl shrink-0">
          <h2 id={titleId} className="text-lg font-semibold text-th-text">{title}</h2>
          <button
            type="button"
@@ -56,8 +35,8 @@ export default function Modal({ title, children, onClose, maxWidth = 'max-w-lg'
            <X size={20} />
          </button>
        </div>
-        {/* Body */}
-        <div className="p-6">
+        {/* Body — scrolls inside the card instead of overflowing the viewport */}
+        <div className="p-6 overflow-y-auto min-h-0">
          {children}
        </div>
      </div>
@@ -6,12 +6,13 @@ import { useState, useRef, useEffect } from 'react';
 import api from '../services/api';
 import NotificationBell from './NotificationBell';

-export default function Navbar({ onMenuClick }) {
+export default function Navbar({ onMenuClick, sidebarOpen }) {
  const { user, logout } = useAuth();
  const { t } = useLanguage();
  const navigate = useNavigate();
  const [dropdownOpen, setDropdownOpen] = useState(false);
  const dropdownRef = useRef(null);
+  const dropdownButtonRef = useRef(null);

  useEffect(() => {
    function handleClick(e) {
@@ -23,6 +24,19 @@ export default function Navbar({ onMenuClick }) {
    return () => document.removeEventListener('mousedown', handleClick);
  }, []);

+  // Close the dropdown with Escape and return focus to its trigger
+  useEffect(() => {
+    if (!dropdownOpen) return;
+    function handleKey(e) {
+      if (e.key === 'Escape') {
+        setDropdownOpen(false);
+        dropdownButtonRef.current?.focus();
+      }
+    }
+    document.addEventListener('keydown', handleKey);
+    return () => document.removeEventListener('keydown', handleKey);
+  }, [dropdownOpen]);
+
  const handleLogout = () => {
    logout();
    navigate('/');
@@ -45,6 +59,8 @@ export default function Navbar({ onMenuClick }) {
          <button
            onClick={onMenuClick}
            aria-label={t('nav.navigation')}
+            aria-controls="app-sidebar"
+            aria-expanded={sidebarOpen}
            className="lg:hidden p-2 rounded-lg hover:bg-th-hover text-th-text-s transition-colors"
          >
            <Menu size={20} />
@@ -59,9 +75,9 @@ export default function Navbar({ onMenuClick }) {
          {/* User dropdown */}
          <div className="relative" ref={dropdownRef}>
            <button
+              ref={dropdownButtonRef}
              onClick={() => setDropdownOpen(!dropdownOpen)}
              aria-label={user?.display_name || user?.name}
-              aria-haspopup="menu"
              aria-expanded={dropdownOpen}
              className="flex items-center gap-2 p-1.5 rounded-lg hover:bg-th-hover transition-colors"
            >
@@ -53,6 +53,7 @@ export default function NotificationBell() {
  const navigate = useNavigate();
  const [open, setOpen] = useState(false);
  const containerRef = useRef(null);
+  const bellButtonRef = useRef(null);

  useEffect(() => {
    function handleOutsideClick(e) {
@@ -64,6 +65,19 @@ export default function NotificationBell() {
    return () => document.removeEventListener('mousedown', handleOutsideClick);
  }, []);

+  // Close the dropdown with Escape and return focus to the bell button
+  useEffect(() => {
+    if (!open) return;
+    function handleKey(e) {
+      if (e.key === 'Escape') {
+        setOpen(false);
+        bellButtonRef.current?.focus();
+      }
+    }
+    document.addEventListener('keydown', handleKey);
+    return () => document.removeEventListener('keydown', handleKey);
+  }, [open]);
+
  const handleNotificationClick = async (n) => {
    if (!n.read) await markRead(n.id);
    if (n.link) navigate(n.link);
@@ -81,12 +95,12 @@ export default function NotificationBell() {
    <div className="relative" ref={containerRef}>
      {/* Bell button */}
      <button
+        ref={bellButtonRef}
        onClick={() => setOpen(prev => !prev)}
        className="relative p-2 rounded-lg hover:bg-th-hover text-th-text-s transition-colors"
        aria-label={unreadCount > 0
          ? `${t('notifications.bell')} (${unreadCount})`
          : t('notifications.bell')}
-        aria-haspopup="true"
        aria-expanded={open}
        title={t('notifications.bell')}
      >
@@ -148,37 +162,42 @@ export default function NotificationBell() {
                {recent.map(n => (
                  <li
                    key={n.id}
-                    onClick={() => handleNotificationClick(n)}
-                    className={`group flex items-start gap-3 px-4 py-3 cursor-pointer transition-colors border-b border-th-border/50 last:border-0
+                    className={`group relative flex items-start gap-3 px-4 py-3 transition-colors border-b border-th-border/50 last:border-0
                      ${n.read ? 'hover:bg-th-hover' : 'bg-th-accent/5 hover:bg-th-accent/10'}`}
+                  >
+                    {/* Main click target — a real button so it is keyboard operable */}
+                    <button
+                      onClick={() => handleNotificationClick(n)}
+                      className="flex items-start gap-3 flex-1 min-w-0 text-left focus:outline-hidden focus-visible:ring-2 focus-visible:ring-th-ring rounded-sm"
                    >
                      {/* Icon */}
-                    <span className="text-lg shrink-0 mt-0.5">{notificationIcon(n.type)}</span>
+                      <span className="text-lg shrink-0 mt-0.5" aria-hidden="true">{notificationIcon(n.type)}</span>

                      {/* Content */}
-                    <div className="flex-1 min-w-0">
-                      <p className={`text-sm truncate ${n.read ? 'text-th-text-s' : 'text-th-text font-medium'}`}>
+                      <span className="flex-1 min-w-0 block">
+                        <span className={`text-sm truncate block ${n.read ? 'text-th-text-s' : 'text-th-text font-medium'}`}>
                          {n.title}
-                      </p>
-                      <p className="text-xs text-th-text-s truncate">
+                        </span>
+                        <span className="text-xs text-th-text-s truncate block">
                          {notificationSubtitle(n, t, language)}
-                      </p>
-                      <p className="text-xs text-th-text-s/70 mt-0.5">
+                        </span>
+                        <span className="text-xs text-th-text-s/70 mt-0.5 block">
                          {timeAgo(n.created_at, language)}
-                      </p>
-                    </div>
+                        </span>
+                      </span>
+                    </button>

                    {/* Right side: unread dot, link icon, delete button */}
                    <div className="flex flex-col items-end gap-1 shrink-0">
                      {!n.read && (
-                        <span className="w-2 h-2 rounded-full bg-th-accent mt-1" />
+                        <span className="w-2 h-2 rounded-full bg-th-accent mt-1" aria-hidden="true" />
                      )}
                      {n.link && (
-                        <ExternalLink size={12} className="text-th-text-s/50" />
+                        <ExternalLink size={12} className="text-th-text-s/50" aria-hidden="true" />
                      )}
                      <button
                        onClick={(e) => handleDelete(e, n.id)}
-                        className="opacity-0 group-hover:opacity-100 p-0.5 rounded-sm hover:text-th-error transition-all text-th-text-s/50"
+                        className="opacity-0 group-hover:opacity-100 focus-visible:opacity-100 p-0.5 rounded-sm hover:text-th-error transition-all text-th-text-s/50"
                        aria-label={t('notifications.delete')}
                        title={t('notifications.delete')}
                      >
@@ -2,6 +2,7 @@ import { Users, Play, Trash2, Radio, Loader2, Share2, Copy, Link } from 'lucide-
 import { useNavigate } from 'react-router-dom';
 import { useState, useEffect, useRef } from 'react';
 import api from '../services/api';
+import { isCurrentThemeDark } from '../themes';
 import { useLanguage } from '../contexts/LanguageContext';
 import toast from 'react-hot-toast';

@@ -23,6 +24,20 @@ export default function RoomCard({ room, onDelete }) {
    return () => document.removeEventListener('mousedown', handleClickOutside);
  }, []);

+  // Close the copy menu with Escape
+  useEffect(() => {
+    if (!showCopyMenu) return;
+    const handleKey = (e) => {
+      if (e.key === 'Escape') {
+        e.stopPropagation();
+        setShowCopyMenu(false);
+        copyMenuRef.current?.querySelector('button')?.focus();
+      }
+    };
+    document.addEventListener('keydown', handleKey);
+    return () => document.removeEventListener('keydown', handleKey);
+  }, [showCopyMenu]);
+
  const copyToClipboard = (url) => {
    navigator.clipboard.writeText(url);
    toast.success(t('room.linkCopied'));
@@ -107,11 +122,12 @@ export default function RoomCard({ room, onDelete }) {
            setStarting(true);
            try {
              if (status.running) {
-                const data = room.access_code ? { access_code: prompt(t('room.enterAccessCode')) } : {};
+                const data = { dark_mode: isCurrentThemeDark() };
+                if (room.access_code) data.access_code = prompt(t('room.enterAccessCode'));
                const res = await api.post(`/rooms/${room.uid}/join`, data);
                if (res.data.joinUrl) window.open(res.data.joinUrl, '_blank');
              } else {
-                const res = await api.post(`/rooms/${room.uid}/start`);
+                const res = await api.post(`/rooms/${room.uid}/start`, { dark_mode: isCurrentThemeDark() });
                if (res.data.joinUrl) window.open(res.data.joinUrl, '_blank');
                toast.success(t('room.meetingStarted'));
                setTimeout(() => {
@@ -135,7 +151,6 @@ export default function RoomCard({ room, onDelete }) {
            onClick={(e) => { e.stopPropagation(); setShowCopyMenu(v => !v); }}
            className="btn-ghost text-xs py-1.5 px-2"
            aria-label={t('room.copyLink')}
-            aria-haspopup="menu"
            aria-expanded={showCopyMenu}
            title={t('room.copyLink')}
          >
@@ -14,6 +14,19 @@ export default function Sidebar({ open, onClose }) {
  const { imprintUrl, privacyUrl } = useBranding();
  const [themeOpen, setThemeOpen] = useState(false);
  const [federationCount, setFederationCount] = useState(0);
+  // On mobile the sidebar is an off-canvas drawer: while closed it must be
+  // inert so its links aren't reachable via Tab or screen readers. On
+  // desktop (lg+) it is always visible and never inert.
+  const [isDesktop, setIsDesktop] = useState(
+    () => window.matchMedia('(min-width: 1024px)').matches
+  );
+
+  useEffect(() => {
+    const mq = window.matchMedia('(min-width: 1024px)');
+    const handleChange = (e) => setIsDesktop(e.matches);
+    mq.addEventListener('change', handleChange);
+    return () => mq.removeEventListener('change', handleChange);
+  }, []);

  // Fetch pending federation invitation count
  useEffect(() => {
@@ -50,6 +63,8 @@ export default function Sidebar({ open, onClose }) {
  return (
    <>
      <aside
+        id="app-sidebar"
+        inert={!open && !isDesktop}
        className={`fixed top-0 left-0 z-40 h-full w-64 bg-th-side border-r border-th-border
        transition-transform duration-300 ease-in-out
        ${open ? 'translate-x-0' : '-translate-x-full'} lg:translate-x-0`}
@@ -68,7 +83,7 @@ export default function Sidebar({ open, onClose }) {
          </div>

          {/* Navigation */}
-          <nav className="flex-1 px-3 py-4 space-y-1 overflow-y-auto">
+          <nav aria-label={t('nav.navigation')} className="flex-1 px-3 py-4 space-y-1 overflow-y-auto">
            <p className="px-3 mb-2 text-xs font-semibold text-th-text-s uppercase tracking-wider">
              {t('nav.navigation')}
            </p>
@@ -95,6 +110,7 @@ export default function Sidebar({ open, onClose }) {
              </p>
              <button
                onClick={() => setThemeOpen(!themeOpen)}
+                aria-haspopup="dialog"
                className="w-full flex items-center gap-3 px-3 py-2.5 rounded-lg text-sm font-medium text-th-text-s hover:text-th-text hover:bg-th-hover transition-all duration-200"
              >
                <Palette size={18} />
@@ -2,21 +2,25 @@ import { X, Check, Sun, Moon } from 'lucide-react';
 import { useTheme } from '../contexts/ThemeContext';
 import { useLanguage } from '../contexts/LanguageContext';
 import { getThemeGroups } from '../themes';
+import useDialogA11y from '../hooks/useDialogA11y';

 export default function ThemeSelector({ onClose }) {
  const { theme, setTheme } = useTheme();
  const { t } = useLanguage();
  const groups = getThemeGroups();
+  const dialogRef = useDialogA11y(true, onClose);

  return (
    <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
      <div className="fixed inset-0 bg-black/60 backdrop-blur-xs" onClick={onClose} aria-hidden="true" />

      <div
+        ref={dialogRef}
        role="dialog"
        aria-modal="true"
        aria-labelledby="theme-selector-title"
-        className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-2xl max-h-[80vh] overflow-hidden"
+        tabIndex={-1}
+        className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-2xl max-h-[80vh] overflow-hidden focus:outline-hidden"
      >
        {/* Header */}
        <div className="flex items-center justify-between px-6 py-4 border-b border-th-border">
@@ -45,6 +49,7 @@ export default function ThemeSelector({ onClose }) {
                  <button
                    key={t.id}
                    onClick={() => setTheme(t.id)}
+                    aria-pressed={theme === t.id}
                    className={`relative group rounded-xl p-3 border-2 transition-all duration-200 text-left ${
                      theme === t.id
                        ? 'border-th-accent shadow-lg scale-[1.02]'
@@ -0,0 +1,77 @@
+import { useEffect, useRef } from 'react';
+
+const FOCUSABLE_SELECTOR = [
+  'a[href]',
+  'button:not([disabled])',
+  'input:not([disabled]):not([type="hidden"])',
+  'select:not([disabled])',
+  'textarea:not([disabled])',
+  '[tabindex]:not([tabindex="-1"])',
+].join(', ');
+
+/**
+ * Accessibility behavior for custom modal dialogs (we don't use the native
+ * <dialog> element, so the browser gives us none of this for free):
+ *  - moves focus into the dialog when it opens (unless something inside,
+ *    e.g. an autoFocus input, already holds focus)
+ *  - restores focus to the previously focused element when it closes
+ *  - closes on Escape
+ *  - keeps Tab / Shift+Tab cycling inside the dialog
+ *
+ * Attach the returned ref to the dialog element; it needs tabIndex={-1}.
+ * `active` allows conditionally rendered dialogs while keeping the hook
+ * call unconditional.
+ */
+export default function useDialogA11y(active, onClose) {
+  const dialogRef = useRef(null);
+  // Keep the latest onClose in a ref so the effect below doesn't re-run (and
+  // steal focus) when callers pass a fresh inline arrow on every render.
+  const onCloseRef = useRef(onClose);
+  onCloseRef.current = onClose;
+
+  useEffect(() => {
+    if (!active) return;
+    const previouslyFocused = document.activeElement;
+    const dialog = dialogRef.current;
+    if (dialog && !dialog.contains(document.activeElement)) {
+      dialog.focus();
+    }
+
+    const handleKey = (e) => {
+      if (e.key === 'Escape') {
+        onCloseRef.current?.();
+        return;
+      }
+      if (e.key !== 'Tab' || !dialogRef.current) return;
+      const el = dialogRef.current;
+      // Only visible elements — offsetParent is null for display:none subtrees
+      const focusable = Array.from(el.querySelectorAll(FOCUSABLE_SELECTOR))
+        .filter(node => node.offsetParent !== null);
+      if (focusable.length === 0) {
+        e.preventDefault();
+        el.focus();
+        return;
+      }
+      const first = focusable[0];
+      const last = focusable[focusable.length - 1];
+      const current = document.activeElement;
+      if (!el.contains(current)) {
+        e.preventDefault();
+        (e.shiftKey ? last : first).focus();
+      } else if (e.shiftKey && (current === first || current === el)) {
+        e.preventDefault();
+        last.focus();
+      } else if (!e.shiftKey && current === last) {
+        e.preventDefault();
+        first.focus();
+      }
+    };
+    document.addEventListener('keydown', handleKey);
+    return () => {
+      document.removeEventListener('keydown', handleKey);
+      previouslyFocused?.focus?.();
+    };
+  }, [active]);
+
+  return dialogRef;
+}
@@ -25,7 +25,10 @@
    "error": "Fehler",
    "success": "Erfolg",
    "gridView": "Rasteransicht",
-    "listView": "Listenansicht"
+    "listView": "Listenansicht",
+    "skipToContent": "Zum Hauptinhalt springen",
+    "previous": "Zurück",
+    "next": "Weiter"
  },
  "nav": {
    "dashboard": "Dashboard",
@@ -64,16 +67,16 @@
    "passwordMismatch": "Passwörter stimmen nicht überein",
    "passwordTooShort": "Passwort muss mindestens 6 Zeichen lang sein",
    "loginSuccess": "Willkommen zurück!",
-    "registerSuccess": "Registrierung erfolgreich!",
+    "registerSuccess": "Registrierung erfolgreich",
    "loginFailed": "Anmeldung fehlgeschlagen",
    "registerFailed": "Registrierung fehlgeschlagen",
    "allFieldsRequired": "Alle Felder sind erforderlich",
-    "verificationSent": "Verifizierungs-E-Mail wurde gesendet!",
+    "verificationSent": "Verifizierungs-E-Mail wurde gesendet",
    "verificationSentDesc": "Wir haben dir eine E-Mail mit einem Bestätigungslink geschickt. Bitte klicke auf den Link, um dein Konto zu aktivieren.",
    "checkYourEmail": "Prüfe dein Postfach",
    "verifying": "E-Mail wird verifiziert...",
    "verifySuccess": "Deine E-Mail-Adresse wurde erfolgreich bestätigt. Du kannst dich jetzt anmelden.",
-    "verifySuccessTitle": "E-Mail bestätigt!",
+    "verifySuccessTitle": "E-Mail bestätigt",
    "verifyFailed": "Verifizierung fehlgeschlagen",
    "verifyFailedTitle": "Verifizierung fehlgeschlagen",
    "verifyTokenMissing": "Kein Verifizierungstoken vorhanden.",
@@ -90,7 +93,7 @@
    "emailVerificationBanner": "Deine E-Mail-Adresse wurde noch nicht verifiziert.",
    "emailVerificationResend": "Hier klicken um eine neue Verifizierungsmail zu erhalten",
    "emailVerificationResendCooldown": "Erneut senden in {seconds}s",
-    "emailVerificationResendSuccess": "Verifizierungsmail wurde gesendet!",
+    "emailVerificationResendSuccess": "Verifizierungsmail wurde gesendet",
    "emailVerificationResendFailed": "Verifizierungsmail konnte nicht gesendet werden",
    "inviteOnly": "Nur mit Einladung",
    "inviteOnlyDesc": "Die Registrierung ist derzeit eingeschränkt. Sie benötigen einen Einladungslink von einem Administrator, um ein Konto zu erstellen.",
@@ -102,6 +105,22 @@
    "oauthNoToken": "Kein Authentifizierungstoken erhalten.",
    "oauthLoginFailed": "Anmeldung konnte nicht abgeschlossen werden. Bitte versuche es erneut.",
    "oauthRedirecting": "Du wirst angemeldet...",
+    "forgotPassword": "Passwort vergessen?",
+    "forgotPasswordTitle": "Passwort zurücksetzen",
+    "forgotPasswordSubtitle": "Gib deine E-Mail-Adresse ein. Wir senden dir einen Link zum Zurücksetzen deines Passworts.",
+    "forgotPasswordSubmit": "Link senden",
+    "forgotPasswordSent": "Wenn ein Konto für diese Adresse existiert, haben wir dir eine E-Mail zum Zurücksetzen des Passworts gesendet.",
+    "forgotPasswordSentTitle": "Prüfe dein Postfach",
+    "forgotPasswordFailed": "Anfrage konnte nicht gesendet werden. Bitte versuche es erneut.",
+    "resetPasswordTitle": "Neues Passwort festlegen",
+    "resetPasswordSubtitle": "Wähle ein neues Passwort für dein Konto.",
+    "newPassword": "Neues Passwort",
+    "resetPasswordSubmit": "Passwort zurücksetzen",
+    "resetPasswordSuccess": "Dein Passwort wurde zurückgesetzt. Du kannst dich jetzt anmelden.",
+    "resetPasswordSuccessTitle": "Passwort zurückgesetzt",
+    "resetPasswordFailed": "Passwort konnte nicht zurückgesetzt werden.",
+    "resetTokenMissing": "Kein Token zum Zurücksetzen vorhanden.",
+    "passwordMinLength": "Passwort muss mindestens 8 Zeichen lang sein",
    "2fa": {
      "title": "Zwei-Faktor-Authentifizierung",
      "prompt": "Gib den 6-stelligen Code aus deiner Authenticator-App ein.",
@@ -112,38 +131,22 @@
    }
  },
  "home": {
-    "madeFor": "Made for BigBlueButton",
-    "heroTitle": "Meetings neu ",
-    "heroTitleHighlight": "definiert",
-    "heroSubtitle": "Das moderne, selbst gehostete BigBlueButton-Frontend. Erstellen Sie Räume, verwalten Sie Aufnahmen, verbinden Sie sich mit anderen Instanzen und genießen Sie ein wunderschönes Interface mit über 15 Themes.",
-    "getStarted": "Jetzt starten",
-    "features": "Alles was Sie brauchen",
-    "featuresSubtitle": "Redlight bietet alle Funktionen, die Sie für professionelle Videokonferenzen benötigen.",
-    "featureVideoTitle": "Videokonferenzen",
-    "featureVideoDesc": "Erstellen und verwalten Sie Meetings direkt über BigBlueButton.",
+    "heroTitle": "Selbst gehostetes Frontend für BigBlueButton",
+    "heroSubtitle": "Redlight verwaltet Räume, Aufnahmen und Termine für deinen BigBlueButton-Server – mit Federation zwischen Instanzen, CalDAV-Sync und SSO-Anbindung.",
+    "getStarted": "Konto erstellen",
+    "features": "Funktionen",
    "featureRoomsTitle": "Raumverwaltung",
-    "featureRoomsDesc": "Unbegrenzte Räume mit individuellen Einstellungen und Zugangscodes.",
+    "featureRoomsDesc": "Räume mit eigenen Einstellungen, Zugangscodes und geteiltem Zugriff für Kolleginnen und Kollegen.",
    "featureRecordingsTitle": "Aufnahmen",
-    "featureRecordingsDesc": "Alle Aufnahmen pro Raum einsehen, veröffentlichen oder löschen.",
+    "featureRecordingsDesc": "Aufnahmen pro Raum einsehen, veröffentlichen oder löschen.",
    "featureFederationTitle": "Federation",
-    "featureFederationDesc": "Laden Sie Nutzer anderer Redlight-Instanzen in Ihre Räume ein und nehmen Sie instanzübergreifende Einladungen an.",
-    "featureCalendarTitle": "Kalender & Erinnerungen",
-    "featureCalendarDesc": "Meetings planen, per CalDAV synchronisieren und E-Mail-Erinnerungen vor dem Start erhalten.",
-    "featureNotificationsTitle": "Benachrichtigungen",
-    "featureNotificationsDesc": "Echtzeit-Benachrichtigungen in der App und per E-Mail für Einladungen und bevorstehende Meetings.",
-    "featureOAuthTitle": "OAuth / SSO",
-    "featureOAuthDesc": "Melden Sie sich über OAuth 2.0 mit Ihrem bestehenden Identity Provider an – kein separates Konto nötig.",
-    "featureAnalyticsTitle": "Analytics",
-    "featureAnalyticsDesc": "Meeting-Statistiken einsehen und die Nutzung über alle Räume hinweg verfolgen.",
-    "featureThemesTitle": "15+ Themes",
-    "featureThemesDesc": "Dracula, Nord, Catppuccin, Rosé Pine, Gruvbox und viele mehr – plus eigenes Branding.",
-    "featureUsersTitle": "Benutzerverwaltung",
-    "featureUsersDesc": "Registrierung, Login und Rollenverwaltung für Ihre Organisation.",
-    "featureOpenSourceTitle": "Open Source",
-    "featureOpenSourceDesc": "Vollständig quelloffen und selbst gehostet. Ihre Daten bleiben bei Ihnen.",
-    "statThemes": "Themes",
-    "statRooms": "Räume",
-    "statOpenSource": "Open Source",
+    "featureFederationDesc": "Nutzer anderer Redlight-Instanzen einladen und instanzübergreifende Einladungen annehmen.",
+    "featureCalendarTitle": "Kalender",
+    "featureCalendarDesc": "Meetings planen, per CalDAV mit Thunderbird, Apple Calendar oder DAVx⁵ synchronisieren, Erinnerungen erhalten.",
+    "featureVideoTitle": "Videokonferenzen",
+    "featureVideoDesc": "Meetings direkt über BigBlueButton erstellen, starten und verwalten.",
+    "featureAnalyticsTitle": "Learning Analytics",
+    "featureAnalyticsDesc": "Teilnahme- und Aktivitätsdaten aus Meetings einsehen und als CSV, Excel oder PDF exportieren.",
    "footer": "© {year} Redlight. Ein Open-Source BigBlueButton Frontend."
  },
  "dashboard": {
@@ -164,7 +167,7 @@
    "accessCode": "Zugangscode",
    "muteOnJoin": "Teilnehmer beim Beitritt stummschalten",
    "allowRecording": "Aufnahme erlauben",
-    "roomCreated": "Raum erstellt!",
+    "roomCreated": "Raum erstellt",
    "roomCreateFailed": "Raum konnte nicht erstellt werden",
    "roomDeleted": "Raum gelöscht",
    "roomDeleteFailed": "Raum konnte nicht gelöscht werden",
@@ -188,7 +191,7 @@
    "copyLink": "Link kopieren",
    "copyRoomLink": "Raum-Link",
    "copyGuestLink": "Gast-Link",
-    "linkCopied": "Link kopiert!",
+    "linkCopied": "Link kopiert",
    "meetingDetails": "Meeting-Details",
    "meetingId": "Meeting ID",
    "status": "Status",
@@ -209,11 +212,12 @@
    "anyoneCanStart": "Jeder kann das Meeting starten",
    "allJoinModerator": "Alle Teilnehmer als Moderator",
    "allowRecording": "Aufnahme erlauben",
+    "enableTranscript": "KI-Zusammenfassung / Transkript für Aufnahmen",
    "noAccessCode": "Kein Zugangscode",
    "emptyNoCode": "Leer = kein Code",
    "settingsSaved": "Einstellungen gespeichert",
    "settingsSaveFailed": "Einstellungen konnten nicht gespeichert werden",
-    "meetingStarted": "Meeting gestartet!",
+    "meetingStarted": "Meeting gestartet",
    "meetingStartFailed": "Meeting konnte nicht gestartet werden",
    "meetingEnded": "Meeting beendet",
    "meetingEndFailed": "Meeting konnte nicht beendet werden",
@@ -228,7 +232,7 @@
    "moderatorCodeHint": "Optionaler Code für Moderator-Rechte",
    "moderatorCodeDesc": "Gäste, die diesen Code eingeben, erhalten Moderator-Rechte.",
    "guestLink": "Gast-Einladungslink",
-    "guestLinkCopied": "Gast-Link kopiert!",
+    "guestLinkCopied": "Gast-Link kopiert",
    "guestJoinTitle": "Meeting beitreten",
    "guestCreatedBy": "Erstellt von",
    "guestMeetingRunning": "Meeting läuft",
@@ -363,7 +367,7 @@
      "statusDisabledDesc": "Aktiviere die Zwei-Faktor-Authentifizierung für zusätzliche Sicherheit.",
      "enable": "2FA aktivieren",
      "disable": "2FA deaktivieren",
-      "enabled": "Zwei-Faktor-Authentifizierung aktiviert!",
+      "enabled": "Zwei-Faktor-Authentifizierung aktiviert",
      "disabled": "Zwei-Faktor-Authentifizierung deaktiviert.",
      "enableFailed": "2FA konnte nicht aktiviert werden",
      "disableFailed": "2FA konnte nicht deaktiviert werden",
@@ -392,7 +396,7 @@
      "revoked": "Token widerrufen",
      "revokeFailed": "Token konnte nicht widerrufen werden",
      "createFailed": "Token konnte nicht erstellt werden",
-      "newTokenCreated": "Token erstellt — jetzt kopieren!",
+      "newTokenCreated": "Token erstellt — jetzt kopieren",
      "newTokenHint": "Dieses Token wird nur einmal angezeigt. Kopiere es und trage es als Passwort in deiner Kalender-App ein.",
      "dismiss": "Ich habe das Token kopiert"
    }
@@ -417,6 +421,7 @@
    "makeUser": "Zum Benutzer machen",
    "resetPassword": "Passwort zurücksetzen",
    "deleteUser": "Löschen",
+    "userActions": "Benutzeraktionen",
    "createUser": "Benutzer erstellen",
    "createUserTitle": "Neuen Benutzer erstellen",
    "userCreated": "Benutzer erstellt",
@@ -460,11 +465,11 @@
    "inviteTitle": "Benutzer-Einladungen",
    "inviteDescription": "Laden Sie neue Benutzer per E-Mail ein. Sie erhalten einen Registrierungslink, der 7 Tage gültig ist.",
    "sendInvite": "Einladung senden",
-    "inviteSent": "Einladung gesendet!",
+    "inviteSent": "Einladung gesendet",
    "inviteFailed": "Einladung konnte nicht gesendet werden",
    "inviteDeleted": "Einladung gelöscht",
    "inviteDeleteFailed": "Einladung konnte nicht gelöscht werden",
-    "inviteLinkCopied": "Einladungslink kopiert!",
+    "inviteLinkCopied": "Einladungslink kopiert",
    "copyInviteLink": "Einladungslink kopieren",
    "inviteExpired": "Abgelaufen",
    "inviteUsedBy": "Verwendet von",
@@ -536,8 +541,8 @@
    "messageLabel": "Nachricht (optional)",
    "messagePlaceholder": "Hallo, ich lade dich zu unserem Meeting ein!",
    "send": "Einladung senden",
-    "sent": "Einladung gesendet!",
-    "emailSent": "E-Mail-Einladung(en) gesendet!",
+    "sent": "Einladung gesendet",
+    "emailSent": "E-Mail-Einladung(en) gesendet",
    "emailSendFailed": "E-Mail-Einladung konnte nicht gesendet werden",
    "sendFailed": "Einladung konnte nicht gesendet werden",
    "from": "Von",
@@ -563,7 +568,7 @@
    "removeRoomConfirm": "Raum wirklich entfernen?",
    "roomRemoved": "Raum entfernt",
    "roomRemoveFailed": "Raum konnte nicht entfernt werden",
-    "acceptedSaved": "Einladung angenommen - Raum wurde in deinem Dashboard gespeichert!",
+    "acceptedSaved": "Einladung angenommen - Raum wurde in deinem Dashboard gespeichert",
    "meetingId": "Meeting ID",
    "maxParticipants": "Max. Teilnehmer",
    "recordingOn": "Aufnahme aktiviert",
@@ -579,9 +584,9 @@
    "roomDeleted": "Gelöscht",
    "roomDeletedNotice": "Dieser Raum wurde vom Besitzer auf der Ursprungsinstanz gelöscht und ist nicht mehr verfügbar.",
    "calendarEvent": "Kalendereinladung",
-    "calendarAccepted": "Kalender-Event angenommen und in deinen Kalender eingetragen!",
+    "calendarAccepted": "Kalender-Event angenommen und in deinen Kalender eingetragen",
    "localCalendarEvent": "Lokale Kalendereinladung",
-    "calendarLocalAccepted": "Einladung angenommen - Event wurde in deinen Kalender eingetragen!",
+    "calendarLocalAccepted": "Einladung angenommen - Event wurde in deinen Kalender eingetragen",
    "invitationRemoved": "Einladung entfernt",
    "removeInvitation": "Einladung entfernen"
  },
@@ -610,8 +615,8 @@
    "reminder1440": "1 Tag vorher",
    "timezone": "Zeitzone",
    "color": "Farbe",
-    "eventCreated": "Event erstellt!",
-    "eventUpdated": "Event aktualisiert!",
+    "eventCreated": "Event erstellt",
+    "eventUpdated": "Event aktualisiert",
    "eventDeleted": "Event gelöscht",
    "saveFailed": "Event konnte nicht gespeichert werden",
    "deleteFailed": "Event konnte nicht gelöscht werden",
@@ -638,14 +643,16 @@
    "shareAdded": "Benutzer zum Event hinzugefügt",
    "shareRemoved": "Freigabe entfernt",
    "shareFailed": "Event konnte nicht geteilt werden",
-    "invitationSent": "Einladung gesendet!",
+    "invitationSent": "Einladung gesendet",
    "invitationCancelled": "Einladung widerrufen",
    "invitationPending": "Einladung ausstehend",
    "pendingInvitations": "Ausstehende Einladungen",
    "accepted": "Angenommen",
-    "sendFederated": "An Remote senden",
-    "sendFederatedTitle": "Event an Remote-Instanz senden",
-    "sendFederatedDesc": "Sende dieses Kalender-Event an einen Benutzer auf einer anderen Redlight-Instanz. Der Empfänger muss die Einladung zuerst annehmen, bevor das Event in seinem Kalender erscheint.",
+    "sendFederated": "Remote einladen",
+    "sendFederatedTitle": "Termin-Einladung senden",
+    "sendFederatedDesc": "Sende dieses Kalender-Event an einen Benutzer auf einer anderen Redlight-Instanz oder an eine beliebige E-Mail-Adresse. Remote-Empfänger müssen die Einladung zuerst annehmen, bevor das Event in ihrem Kalender erscheint; E-Mail-Empfänger erhalten die Termindetails mit einer .ics-Datei im Anhang.",
+    "inviteSection": "Einladungen versenden (optional)",
+    "inviteSectionHint": "Lade Personen per E-Mail ein oder sende das Event an einen Benutzer auf einer anderen Redlight-Instanz.",
    "send": "Senden",
    "fedSent": "Kalendereinladung gesendet! Der Empfänger muss diese zuerst annehmen.",
    "fedFailed": "Event konnte nicht an Remote-Instanz gesendet werden",
@@ -25,7 +25,10 @@
    "error": "Error",
    "success": "Success",
    "gridView": "Grid view",
-    "listView": "List view"
+    "listView": "List view",
+    "skipToContent": "Skip to main content",
+    "previous": "Previous",
+    "next": "Next"
  },
  "nav": {
    "dashboard": "Dashboard",
@@ -64,16 +67,16 @@
    "passwordMismatch": "Passwords do not match",
    "passwordTooShort": "Password must be at least 6 characters",
    "loginSuccess": "Welcome back!",
-    "registerSuccess": "Registration successful!",
+    "registerSuccess": "Registration successful",
    "loginFailed": "Login failed",
    "registerFailed": "Registration failed",
    "allFieldsRequired": "All fields are required",
-    "verificationSent": "Verification email sent!",
+    "verificationSent": "Verification email sent",
    "verificationSentDesc": "We've sent you an email with a verification link. Please click the link to activate your account.",
    "checkYourEmail": "Check your inbox",
    "verifying": "Verifying your email...",
    "verifySuccess": "Your email has been verified successfully. You can now sign in.",
-    "verifySuccessTitle": "Email verified!",
+    "verifySuccessTitle": "Email verified",
    "verifyFailed": "Verification failed",
    "verifyFailedTitle": "Verification failed",
    "verifyTokenMissing": "No verification token provided.",
@@ -90,7 +93,7 @@
    "emailVerificationBanner": "Your email address has not been verified yet.",
    "emailVerificationResend": "Click here to receive a new verification email",
    "emailVerificationResendCooldown": "Resend in {seconds}s",
-    "emailVerificationResendSuccess": "Verification email sent!",
+    "emailVerificationResendSuccess": "Verification email sent",
    "emailVerificationResendFailed": "Could not send verification email",
    "inviteOnly": "Invite Only",
    "inviteOnlyDesc": "Registration is currently restricted. You need an invitation link from an administrator to create an account.",
@@ -102,6 +105,22 @@
    "oauthNoToken": "No authentication token received.",
    "oauthLoginFailed": "Could not complete sign in. Please try again.",
    "oauthRedirecting": "Signing you in...",
+    "forgotPassword": "Forgot password?",
+    "forgotPasswordTitle": "Reset your password",
+    "forgotPasswordSubtitle": "Enter your email address and we'll send you a link to reset your password.",
+    "forgotPasswordSubmit": "Send link",
+    "forgotPasswordSent": "If an account exists for that address, we've sent you a password reset email.",
+    "forgotPasswordSentTitle": "Check your inbox",
+    "forgotPasswordFailed": "Could not send the request. Please try again.",
+    "resetPasswordTitle": "Set a new password",
+    "resetPasswordSubtitle": "Choose a new password for your account.",
+    "newPassword": "New password",
+    "resetPasswordSubmit": "Reset password",
+    "resetPasswordSuccess": "Your password has been reset. You can now sign in.",
+    "resetPasswordSuccessTitle": "Password reset",
+    "resetPasswordFailed": "Could not reset password.",
+    "resetTokenMissing": "No reset token provided.",
+    "passwordMinLength": "Password must be at least 8 characters",
    "2fa": {
      "title": "Two-Factor Authentication",
      "prompt": "Enter the 6-digit code from your authenticator app.",
@@ -112,38 +131,22 @@
    }
  },
  "home": {
-    "madeFor": "Made for BigBlueButton",
-    "heroTitle": "Meetings re",
-    "heroTitleHighlight": "defined",
-    "heroSubtitle": "The modern, self-hosted BigBlueButton frontend. Create rooms, manage recordings, federate with other instances and enjoy a beautiful interface with over 15 themes.",
-    "getStarted": "Get started",
-    "features": "Everything you need",
-    "featuresSubtitle": "Redlight provides all the features you need for professional video conferencing.",
-    "featureVideoTitle": "Video Conferencing",
-    "featureVideoDesc": "Create and manage meetings directly via BigBlueButton.",
-    "featureRoomsTitle": "Room Management",
-    "featureRoomsDesc": "Unlimited rooms with individual settings and access codes.",
+    "heroTitle": "Self-hosted frontend for BigBlueButton",
+    "heroSubtitle": "Redlight manages rooms, recordings and scheduling for your BigBlueButton server – with federation between instances, CalDAV sync and SSO support.",
+    "getStarted": "Create account",
+    "features": "Features",
+    "featureRoomsTitle": "Room management",
+    "featureRoomsDesc": "Rooms with individual settings, access codes and shared access for colleagues.",
    "featureRecordingsTitle": "Recordings",
-    "featureRecordingsDesc": "View, publish or delete all recordings per room.",
+    "featureRecordingsDesc": "View, publish or delete recordings per room.",
    "featureFederationTitle": "Federation",
-    "featureFederationDesc": "Invite users from other Redlight instances into your rooms and accept cross-instance meeting invitations.",
-    "featureCalendarTitle": "Calendar & Reminders",
-    "featureCalendarDesc": "Schedule meetings with your rooms, sync via CalDAV and receive email reminders before they start.",
-    "featureNotificationsTitle": "Notifications",
-    "featureNotificationsDesc": "Real-time in-app and email notifications for room invitations and upcoming meetings.",
-    "featureOAuthTitle": "OAuth / SSO",
-    "featureOAuthDesc": "Sign in with your existing identity provider via OAuth 2.0 — no separate account needed.",
-    "featureAnalyticsTitle": "Analytics",
-    "featureAnalyticsDesc": "Track meeting statistics and monitor usage across all your rooms.",
-    "featureThemesTitle": "15+ Themes",
-    "featureThemesDesc": "Dracula, Nord, Catppuccin, Rosé Pine, Gruvbox and many more — plus custom branding.",
-    "featureUsersTitle": "User Management",
-    "featureUsersDesc": "Registration, login and role management for your organization.",
-    "featureOpenSourceTitle": "Open Source",
-    "featureOpenSourceDesc": "Fully open source and self-hosted. Your data stays with you.",
-    "statThemes": "Themes",
-    "statRooms": "Rooms",
-    "statOpenSource": "Open Source",
+    "featureFederationDesc": "Invite users from other Redlight instances and accept cross-instance invitations.",
+    "featureCalendarTitle": "Calendar",
+    "featureCalendarDesc": "Schedule meetings, sync via CalDAV with Thunderbird, Apple Calendar or DAVx⁵, get reminders.",
+    "featureVideoTitle": "Video conferencing",
+    "featureVideoDesc": "Create, start and manage meetings directly via BigBlueButton.",
+    "featureAnalyticsTitle": "Learning analytics",
+    "featureAnalyticsDesc": "Review attendance and activity data from meetings and export it as CSV, Excel or PDF.",
    "footer": "© {year} Redlight. An open source BigBlueButton frontend."
  },
  "dashboard": {
@@ -164,7 +167,7 @@
    "accessCode": "Access code",
    "muteOnJoin": "Mute participants on join",
    "allowRecording": "Allow recording",
-    "roomCreated": "Room created!",
+    "roomCreated": "Room created",
    "roomCreateFailed": "Room could not be created",
    "roomDeleted": "Room deleted",
    "roomDeleteFailed": "Room could not be deleted",
@@ -188,7 +191,7 @@
    "copyLink": "Copy link",
    "copyRoomLink": "Room Link",
    "copyGuestLink": "Guest Link",
-    "linkCopied": "Link copied!",
+    "linkCopied": "Link copied",
    "meetingDetails": "Meeting details",
    "meetingId": "Meeting ID",
    "status": "Status",
@@ -209,11 +212,12 @@
    "anyoneCanStart": "Anyone can start the meeting",
    "allJoinModerator": "All participants as moderator",
    "allowRecording": "Allow recording",
+    "enableTranscript": "AI summary / transcript for recordings",
    "noAccessCode": "No access code",
    "emptyNoCode": "Empty = no code",
    "settingsSaved": "Settings saved",
    "settingsSaveFailed": "Settings could not be saved",
-    "meetingStarted": "Meeting started!",
+    "meetingStarted": "Meeting started",
    "meetingStartFailed": "Meeting could not be started",
    "meetingEnded": "Meeting ended",
    "meetingEndFailed": "Meeting could not be ended",
@@ -228,7 +232,7 @@
    "moderatorCodeHint": "Optional code for moderator rights",
    "moderatorCodeDesc": "Guests who enter this code will receive moderator rights.",
    "guestLink": "Guest Invite Link",
-    "guestLinkCopied": "Guest link copied!",
+    "guestLinkCopied": "Guest link copied",
    "guestJoinTitle": "Join Meeting",
    "guestCreatedBy": "Created by",
    "guestMeetingRunning": "Meeting in progress",
@@ -363,7 +367,7 @@
      "statusDisabledDesc": "Enable two-factor authentication for an extra layer of security.",
      "enable": "Enable 2FA",
      "disable": "Disable 2FA",
-      "enabled": "Two-factor authentication enabled!",
+      "enabled": "Two-factor authentication enabled",
      "disabled": "Two-factor authentication disabled.",
      "enableFailed": "Could not enable 2FA",
      "disableFailed": "Could not disable 2FA",
@@ -392,7 +396,7 @@
      "revoked": "Token revoked",
      "revokeFailed": "Could not revoke token",
      "createFailed": "Could not create token",
-      "newTokenCreated": "Token created — copy it now!",
+      "newTokenCreated": "Token created — copy it now",
      "newTokenHint": "This token will only be shown once. Copy it and enter it as the password in your calendar app.",
      "dismiss": "I have copied the token"
    }
@@ -417,6 +421,7 @@
    "makeUser": "Make user",
    "resetPassword": "Reset password",
    "deleteUser": "Delete",
+    "userActions": "User actions",
    "createUser": "Create user",
    "createUserTitle": "Create new user",
    "userCreated": "User created",
@@ -460,11 +465,11 @@
    "inviteTitle": "User Invitations",
    "inviteDescription": "Invite new users by email. They will receive a registration link valid for 7 days.",
    "sendInvite": "Send invite",
-    "inviteSent": "Invitation sent!",
+    "inviteSent": "Invitation sent",
    "inviteFailed": "Could not send invitation",
    "inviteDeleted": "Invitation deleted",
    "inviteDeleteFailed": "Could not delete invitation",
-    "inviteLinkCopied": "Invite link copied!",
+    "inviteLinkCopied": "Invite link copied",
    "copyInviteLink": "Copy invite link",
    "inviteExpired": "Expired",
    "inviteUsedBy": "Used by",
@@ -536,8 +541,8 @@
    "messageLabel": "Message (optional)",
    "messagePlaceholder": "Hi, I'd like to invite you to our meeting!",
    "send": "Send invitation",
-    "sent": "Invitation sent!",
-    "emailSent": "Email invitation(s) sent!",
+    "sent": "Invitation sent",
+    "emailSent": "Email invitation(s) sent",
    "emailSendFailed": "Could not send email invitation",
    "sendFailed": "Could not send invitation",
    "from": "From",
@@ -563,7 +568,7 @@
    "removeRoomConfirm": "Really remove this room?",
    "roomRemoved": "Room removed",
    "roomRemoveFailed": "Could not remove room",
-    "acceptedSaved": "Invitation accepted - room saved to your dashboard!",
+    "acceptedSaved": "Invitation accepted - room saved to your dashboard",
    "meetingId": "Meeting ID",
    "maxParticipants": "Max. participants",
    "recordingOn": "Recording enabled",
@@ -579,9 +584,9 @@
    "roomDeleted": "Deleted",
    "roomDeletedNotice": "This room has been deleted by the owner on the origin instance and is no longer available.",
    "calendarEvent": "Calendar Invitation",
-    "calendarAccepted": "Calendar event accepted and added to your calendar!",
+    "calendarAccepted": "Calendar event accepted and added to your calendar",
    "localCalendarEvent": "Local Calendar Invitation",
-    "calendarLocalAccepted": "Invitation accepted - event added to your calendar!",
+    "calendarLocalAccepted": "Invitation accepted - event added to your calendar",
    "invitationRemoved": "Invitation removed",
    "removeInvitation": "Remove invitation"
  },
@@ -610,8 +615,8 @@
    "reminder1440": "1 day before",
    "timezone": "Timezone",
    "color": "Color",
-    "eventCreated": "Event created!",
-    "eventUpdated": "Event updated!",
+    "eventCreated": "Event created",
+    "eventUpdated": "Event updated",
    "eventDeleted": "Event deleted",
    "saveFailed": "Could not save event",
    "deleteFailed": "Could not delete event",
@@ -638,14 +643,16 @@
    "shareAdded": "User added to event",
    "shareRemoved": "Share removed",
    "shareFailed": "Could not share event",
-    "invitationSent": "Invitation sent!",
+    "invitationSent": "Invitation sent",
    "invitationCancelled": "Invitation cancelled",
    "invitationPending": "Invitation pending",
    "pendingInvitations": "Pending Invitations",
    "accepted": "Accepted",
-    "sendFederated": "Send to remote",
-    "sendFederatedTitle": "Send Event to Remote Instance",
-    "sendFederatedDesc": "Send this calendar event to a user on another Redlight instance. The recipient must accept the invitation before the event appears in their calendar.",
+    "sendFederated": "Invite remote",
+    "sendFederatedTitle": "Send Event Invitation",
+    "sendFederatedDesc": "Send this calendar event to a user on another Redlight instance or to any email address. Remote recipients must accept the invitation before the event appears in their calendar; email recipients receive the event details with an .ics attachment.",
+    "inviteSection": "Send invitations (optional)",
+    "inviteSectionHint": "Invite people by email or send the event to a user on another Redlight instance.",
    "send": "Send",
    "fedSent": "Calendar invitation sent! The recipient must accept it first.",
    "fedFailed": "Could not send event to remote instance",
@@ -51,6 +51,20 @@
  [role="button"]:not([aria-disabled="true"]) {
    cursor: pointer;
  }
+
+  /* Respect the user's OS-level reduced-motion preference: collapse
+     animations and transitions to near-instant instead of removing them,
+     so JS animation/transition event handlers still fire. */
+  @media (prefers-reduced-motion: reduce) {
+    *,
+    ::before,
+    ::after {
+      animation-duration: 0.01ms !important;
+      animation-iteration-count: 1 !important;
+      transition-duration: 0.01ms !important;
+      scroll-behavior: auto !important;
+    }
+  }
 }

@utility btn-primary {
@@ -12,6 +12,7 @@ import { useBranding } from '../contexts/BrandingContext';
 import { themes } from '../themes';
 import api from '../services/api';
 import toast from 'react-hot-toast';
+import useDialogA11y from '../hooks/useDialogA11y';

 export default function Admin() {
  const { user } = useAuth();
@@ -63,6 +64,25 @@ export default function Admin() {
  const [showAllRoomsModal, setShowAllRoomsModal] = useState(false);
  const [allRoomsSearch, setAllRoomsSearch] = useState('');

+  // Dialog accessibility (focus management, Escape, focus trap)
+  const resetPwDialogRef = useDialogA11y(!!resetPwModal, () => setResetPwModal(null));
+  const createUserDialogRef = useDialogA11y(showCreateUser, () => setShowCreateUser(false));
+  const allRoomsDialogRef = useDialogA11y(showAllRoomsModal, () => setShowAllRoomsModal(false));
+
+  // Close the user context menu with Escape and return focus to its trigger
+  useEffect(() => {
+    if (!openMenu) return;
+    const handleKey = (e) => {
+      if (e.key === 'Escape') {
+        menuBtnRefs.current[openMenu]?.focus();
+        setOpenMenu(null);
+        setMenuPos(null);
+      }
+    };
+    document.addEventListener('keydown', handleKey);
+    return () => document.removeEventListener('keydown', handleKey);
+  }, [openMenu]);
+
  useEffect(() => {
    if (user?.role !== 'admin') {
      navigate('/dashboard');
@@ -386,7 +406,7 @@ export default function Admin() {

  if (loading) {
    return (
-      <div className="flex items-center justify-center py-20">
+      <div className="flex items-center justify-center py-20" role="status" aria-label={t('common.loading')}>
        <Loader2 size={32} className="animate-spin text-th-accent" />
      </div>
    );
@@ -435,7 +455,7 @@ export default function Admin() {
                  <button
                    onClick={handleLogoRemove}
                    aria-label={t('common.delete')}
-                    className="absolute -top-2 -right-2 w-5 h-5 bg-th-error text-white rounded-full flex items-center justify-center opacity-0 group-hover:opacity-100 transition-opacity"
+                    className="absolute -top-2 -right-2 w-5 h-5 bg-th-error text-white rounded-full flex items-center justify-center opacity-0 group-hover:opacity-100 focus-visible:opacity-100 transition-opacity"
                  >
                    <XIcon size={12} />
                  </button>
@@ -509,6 +529,7 @@ export default function Admin() {
                  }`}
                  aria-checked={hideAppName}
                  role="switch"
+                  aria-label={t('admin.hideAppNameLabel')}
                >
                  <span className={`pointer-events-none inline-block h-4 w-4 transform rounded-full bg-white shadow ring-0 transition duration-200 ease-in-out ${
                    hideAppName ? 'translate-x-4' : 'translate-x-0'
@@ -863,19 +884,19 @@ export default function Admin() {
                    <table className="w-full">
                      <thead>
                        <tr className="border-b border-th-border">
-                          <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
+                          <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
                            {t('admin.roomName')}
                          </th>
-                          <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden sm:table-cell">
+                          <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden sm:table-cell">
                            {t('admin.roomOwner')}
                          </th>
-                          <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden md:table-cell">
+                          <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden md:table-cell">
                            {t('admin.roomShares')}
                          </th>
-                          <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden lg:table-cell">
+                          <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden lg:table-cell">
                            {t('admin.roomCreated')}
                          </th>
-                          <th className="text-right text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
+                          <th scope="col" className="text-right text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
                            {t('admin.actions')}
                          </th>
                        </tr>
@@ -970,19 +991,19 @@ export default function Admin() {
          <table className="w-full">
            <thead>
              <tr className="border-b border-th-border">
-                <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3">
+                <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3">
                  {t('admin.user')}
                </th>
-                <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3 hidden sm:table-cell">
+                <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3 hidden sm:table-cell">
                  {t('admin.role')}
                </th>
-                <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3 hidden md:table-cell">
+                <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3 hidden md:table-cell">
                  {t('admin.rooms')}
                </th>
-                <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3 hidden lg:table-cell">
+                <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3 hidden lg:table-cell">
                  {t('admin.registered')}
                </th>
-                <th className="text-right text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3">
+                <th scope="col" className="text-right text-xs font-semibold text-th-text-s uppercase tracking-wider px-5 py-3">
                  {t('admin.actions')}
                </th>
              </tr>
@@ -1052,6 +1073,8 @@ export default function Admin() {
                        }}
                        className="p-1.5 rounded-lg hover:bg-th-hover text-th-text-s transition-colors"
                        disabled={u.id === user.id}
+                        aria-label={`${t('admin.userActions')}: ${u.display_name || u.name}`}
+                        aria-expanded={openMenu === u.id}
                      >
                        <MoreVertical size={16} />
                      </button>
@@ -1112,7 +1135,7 @@ export default function Admin() {
      {resetPwModal && (
        <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
          <div className="fixed inset-0 bg-black/60 backdrop-blur-xs" onClick={() => setResetPwModal(null)} aria-hidden="true" />
-          <div role="dialog" aria-modal="true" aria-labelledby="reset-pw-title" className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-sm p-6">
+          <div ref={resetPwDialogRef} role="dialog" aria-modal="true" aria-labelledby="reset-pw-title" tabIndex={-1} className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-sm p-6 focus:outline-hidden">
            <h3 id="reset-pw-title" className="text-lg font-semibold text-th-text mb-4">{t('admin.resetPasswordTitle')}</h3>
            <form onSubmit={handleResetPassword}>
              <div className="mb-4">
@@ -1146,7 +1169,7 @@ export default function Admin() {
      {showCreateUser && (
        <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
          <div className="fixed inset-0 bg-black/60 backdrop-blur-xs" onClick={() => setShowCreateUser(false)} aria-hidden="true" />
-          <div role="dialog" aria-modal="true" aria-labelledby="create-user-title" className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-md p-6">
+          <div ref={createUserDialogRef} role="dialog" aria-modal="true" aria-labelledby="create-user-title" tabIndex={-1} className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-md p-6 focus:outline-hidden">
            <h3 id="create-user-title" className="text-lg font-semibold text-th-text mb-4">{t('admin.createUserTitle')}</h3>
            <form onSubmit={handleCreateUser} className="space-y-4">
              <div>
@@ -1242,12 +1265,12 @@ export default function Admin() {
      {/* All rooms modal */}
      {showAllRoomsModal && (
        <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
-          <div className="fixed inset-0 bg-black/60 backdrop-blur-xs" onClick={() => setShowAllRoomsModal(false)} />
-          <div className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-4xl max-h-[85vh] flex flex-col">
+          <div className="fixed inset-0 bg-black/60 backdrop-blur-xs" onClick={() => setShowAllRoomsModal(false)} aria-hidden="true" />
+          <div ref={allRoomsDialogRef} role="dialog" aria-modal="true" aria-labelledby="all-rooms-title" tabIndex={-1} className="relative bg-th-card rounded-2xl border border-th-border shadow-2xl w-full max-w-4xl max-h-[85vh] flex flex-col focus:outline-hidden">
            <div className="flex items-center justify-between p-6 border-b border-th-border">
              <div className="flex items-center gap-2">
-                <DoorOpen size={20} className="text-th-accent" />
-                <h3 className="text-lg font-semibold text-th-text">{t('admin.roomsTitle')}</h3>
+                <DoorOpen size={20} className="text-th-accent" aria-hidden="true" />
+                <h3 id="all-rooms-title" className="text-lg font-semibold text-th-text">{t('admin.roomsTitle')}</h3>
                <span className="text-sm text-th-text-s">({adminRooms.length})</span>
              </div>
              <button onClick={() => setShowAllRoomsModal(false)} aria-label={t('common.close')} className="p-1.5 rounded-lg hover:bg-th-hover text-th-text-s transition-colors">
@@ -1272,19 +1295,19 @@ export default function Admin() {
              <table className="w-full">
                <thead className="sticky top-0 bg-th-card z-10">
                  <tr className="border-b border-th-border">
-                    <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
+                    <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
                      {t('admin.roomName')}
                    </th>
-                    <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden sm:table-cell">
+                    <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden sm:table-cell">
                      {t('admin.roomOwner')}
                    </th>
-                    <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden md:table-cell">
+                    <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden md:table-cell">
                      {t('admin.roomShares')}
                    </th>
-                    <th className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden lg:table-cell">
+                    <th scope="col" className="text-left text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5 hidden lg:table-cell">
                      {t('admin.roomCreated')}
                    </th>
-                    <th className="text-right text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
+                    <th scope="col" className="text-right text-xs font-semibold text-th-text-s uppercase tracking-wider px-4 py-2.5">
                      {t('admin.actions')}
                    </th>
                  </tr>
@@ -1321,6 +1344,7 @@ export default function Admin() {
                            <button
                              onClick={() => { setShowAllRoomsModal(false); navigate(`/rooms/${r.uid}`); }}
                              className="p-1.5 rounded-lg hover:bg-th-hover text-th-text-s transition-colors"
+                              aria-label={t('admin.roomView')}
                              title={t('admin.roomView')}
                            >
                              <Eye size={15} />
@@ -1328,6 +1352,7 @@ export default function Admin() {
                            <button
                              onClick={() => handleAdminDeleteRoom(r.uid, r.name)}
                              className="p-1.5 rounded-lg hover:bg-th-hover text-th-error transition-colors"
+                              aria-label={t('admin.deleteRoom')}
                              title={t('admin.deleteRoom')}
                            >
                              <Trash2 size={15} />
@@ -42,8 +42,13 @@ export default function Calendar() {
  const [sharedUsers, setSharedUsers] = useState([]);
  const [pendingInvitations, setPendingInvitations] = useState([]);
  const [fedAddress, setFedAddress] = useState('');
+  const [fedEmails, setFedEmails] = useState('');
  const [fedSending, setFedSending] = useState(false);

+  // Invitations sent right after creating an event
+  const [inviteFedAddress, setInviteFedAddress] = useState('');
+  const [inviteEmails, setInviteEmails] = useState('');
+
  // Load events on month change
  useEffect(() => {
    fetchEvents();
@@ -159,6 +164,8 @@ export default function Calendar() {
      end_time: toLocalDateTimeStr(end),
      room_uid: '', color: '#6366f1', reminder_minutes: null,
    });
+    setInviteFedAddress('');
+    setInviteEmails('');
    setEditingEvent(null);
    setShowCreate(true);
  };
@@ -178,8 +185,41 @@ export default function Calendar() {
    setShowCreate(true);
  };

+  const isValidFedAddress = (address) => {
+    const normalized = address.startsWith('@') ? address.slice(1) : address;
+    return normalized.includes('@') && !normalized.endsWith('@');
+  };
+
+  // Send invitations for an event; shows a toast per outcome (non-fatal on failure)
+  const sendEventInvites = async (eventId, address, emailsStr) => {
+    const addr = address.trim();
+    if (addr) {
+      try {
+        await api.post(`/calendar/events/${eventId}/federation`, { to: addr });
+        toast.success(t('calendar.fedSent'));
+      } catch (err) {
+        toast.error(err.response?.data?.error || t('calendar.fedFailed'));
+      }
+    }
+    const emailList = emailsStr.split(',').map(s => s.trim()).filter(Boolean);
+    if (emailList.length > 0) {
+      try {
+        await api.post(`/calendar/events/${eventId}/email`, { emails: emailList });
+        toast.success(t('federation.emailSent'));
+      } catch (err) {
+        toast.error(err.response?.data?.error || t('federation.emailSendFailed'));
+      }
+    }
+  };
+
  const handleSave = async (e) => {
    e.preventDefault();
+
+    if (!editingEvent && inviteFedAddress.trim() && !isValidFedAddress(inviteFedAddress.trim())) {
+      toast.error(t('federation.addressHint'));
+      return;
+    }
+
    setSaving(true);
    try {
      const data = {
@@ -192,11 +232,17 @@ export default function Calendar() {
        await api.put(`/calendar/events/${editingEvent.id}`, data);
        toast.success(t('calendar.eventUpdated'));
      } else {
-        await api.post('/calendar/events', data);
+        const res = await api.post('/calendar/events', data);
        toast.success(t('calendar.eventCreated'));
+        const created = res.data.event;
+        if (created && (inviteFedAddress.trim() || inviteEmails.trim())) {
+          await sendEventInvites(created.id, inviteFedAddress, inviteEmails);
+        }
      }
      setShowCreate(false);
      setEditingEvent(null);
+      setInviteFedAddress('');
+      setInviteEmails('');
      fetchEvents();
    } catch (err) {
      toast.error(err.response?.data?.error || t('calendar.saveFailed'));
@@ -328,19 +374,41 @@ export default function Calendar() {
  const handleFedSend = async (e) => {
    e.preventDefault();
    if (!showFedShare) return;
-    const normalized = fedAddress.startsWith('@') ? fedAddress.slice(1) : fedAddress;
-    if (!normalized.includes('@') || normalized.endsWith('@')) {
+    const hasAddress = fedAddress.trim().length > 0;
+    const hasEmails = fedEmails.trim().length > 0;
+
+    if (!hasAddress && !hasEmails) {
      toast.error(t('federation.addressHint'));
      return;
    }
+
    setFedSending(true);
    try {
+      if (hasAddress) {
+        // Federation address mode
+        if (!isValidFedAddress(fedAddress.trim())) {
+          toast.error(t('federation.addressHint'));
+          setFedSending(false);
+          return;
+        }
        await api.post(`/calendar/events/${showFedShare.id}/federation`, { to: fedAddress });
        toast.success(t('calendar.fedSent'));
+      } else {
+        // Email mode
+        const emailList = fedEmails.split(',').map(s => s.trim()).filter(Boolean);
+        if (emailList.length === 0) {
+          toast.error(t('federation.emailHint'));
+          setFedSending(false);
+          return;
+        }
+        await api.post(`/calendar/events/${showFedShare.id}/email`, { emails: emailList });
+        toast.success(t('federation.emailSent'));
+      }
      setShowFedShare(null);
      setFedAddress('');
+      setFedEmails('');
    } catch (err) {
-      toast.error(err.response?.data?.error || t('calendar.fedFailed'));
+      toast.error(err.response?.data?.error || t(hasAddress ? 'calendar.fedFailed' : 'federation.emailSendFailed'));
    } finally {
      setFedSending(false);
    }
@@ -353,7 +421,7 @@ export default function Calendar() {

  if (loading) {
    return (
-      <div className="flex items-center justify-center py-20">
+      <div className="flex items-center justify-center py-20" role="status" aria-label={t('common.loading')}>
        <Loader2 size={32} className="animate-spin text-th-accent" />
      </div>
    );
@@ -378,6 +446,8 @@ export default function Calendar() {
            end_time: toLocalDateTimeStr(end),
            room_uid: '', color: '#6366f1',
          });
+          setInviteFedAddress('');
+          setInviteEmails('');
          setEditingEvent(null);
          setShowCreate(true);
        }} className="btn-primary">
@@ -389,13 +459,13 @@ export default function Calendar() {
      {/* Toolbar */}
      <div className="card p-3 mb-4 flex items-center justify-between flex-wrap gap-2">
        <div className="flex items-center gap-2">
-          <button onClick={navigatePrev} className="btn-ghost p-2">
+          <button onClick={navigatePrev} aria-label={t('common.previous')} className="btn-ghost p-2">
            <ChevronLeft size={18} />
          </button>
          <button onClick={goToToday} className="btn-ghost text-sm px-3 py-1.5">
            {t('calendar.today')}
          </button>
-          <button onClick={navigateNext} className="btn-ghost p-2">
+          <button onClick={navigateNext} aria-label={t('common.next')} className="btn-ghost p-2">
            <ChevronRight size={18} />
          </button>
          <h2 className="text-lg font-semibold text-th-text ml-2">{monthLabel}</h2>
@@ -616,6 +686,41 @@ export default function Calendar() {
              </div>
            </div>

+            {!editingEvent && (
+              <div className="pt-4 border-t border-th-border space-y-4">
+                <div>
+                  <p className="text-sm font-medium text-th-text">{t('calendar.inviteSection')}</p>
+                  <p className="text-xs text-th-text-s mt-0.5">{t('calendar.inviteSectionHint')}</p>
+                </div>
+
+                <div>
+                  <label htmlFor="calendar-invite-emails" className="block text-sm font-medium text-th-text mb-1.5">{t('federation.emailLabel')}</label>
+                  <input
+                    id="calendar-invite-emails"
+                    type="text"
+                    value={inviteEmails}
+                    onChange={e => setInviteEmails(e.target.value)}
+                    className="input-field"
+                    placeholder={t('federation.emailPlaceholder')}
+                  />
+                  <p className="text-xs text-th-text-s mt-1">{t('federation.emailHint')}</p>
+                </div>
+
+                <div>
+                  <label htmlFor="calendar-invite-fed-address" className="block text-sm font-medium text-th-text mb-1.5">{t('federation.addressLabel')}</label>
+                  <input
+                    id="calendar-invite-fed-address"
+                    type="text"
+                    value={inviteFedAddress}
+                    onChange={e => setInviteFedAddress(e.target.value)}
+                    className="input-field"
+                    placeholder={t('federation.addressPlaceholder')}
+                  />
+                  <p className="text-xs text-th-text-s mt-1">{t('federation.addressHint')}</p>
+                </div>
+              </div>
+            )}
+
            <div className="flex items-center gap-3 pt-4 border-t border-th-border">
              <button type="button" onClick={() => { setShowCreate(false); setEditingEvent(null); }} className="btn-secondary flex-1">
                {t('common.cancel')}
@@ -827,9 +932,9 @@ export default function Calendar() {
        </Modal>
      )}

-      {/* Federation Share Modal */}
+      {/* Federation/Email Share Modal */}
      {showFedShare && (
-        <Modal title={t('calendar.sendFederatedTitle')} onClose={() => setShowFedShare(null)}>
+        <Modal title={t('calendar.sendFederatedTitle')} onClose={() => { setShowFedShare(null); setFedAddress(''); setFedEmails(''); }}>
          <p className="text-sm text-th-text-s mb-4">{t('calendar.sendFederatedDesc')}</p>
          <form onSubmit={handleFedSend} className="space-y-4">
            <div>
@@ -838,18 +943,39 @@ export default function Calendar() {
                id="calendar-fed-share-address"
                type="text"
                value={fedAddress}
-                onChange={e => setFedAddress(e.target.value)}
+                onChange={e => { setFedAddress(e.target.value); if (e.target.value) setFedEmails(''); }}
                className="input-field"
                placeholder={t('federation.addressPlaceholder')}
-                required
+                disabled={fedEmails.trim().length > 0}
              />
              <p className="text-xs text-th-text-s mt-1">{t('federation.addressHint')}</p>
            </div>
+
+            <div className="flex items-center gap-3 my-2">
+              <div className="flex-1 border-t border-th-border" />
+              <span className="text-xs text-th-text-s uppercase">{t('common.or')}</span>
+              <div className="flex-1 border-t border-th-border" />
+            </div>
+
+            <div>
+              <label htmlFor="calendar-fed-share-emails" className="block text-sm font-medium text-th-text mb-1.5">{t('federation.emailLabel')}</label>
+              <input
+                id="calendar-fed-share-emails"
+                type="text"
+                value={fedEmails}
+                onChange={e => { setFedEmails(e.target.value); if (e.target.value) setFedAddress(''); }}
+                className="input-field"
+                placeholder={t('federation.emailPlaceholder')}
+                disabled={fedAddress.trim().length > 0}
+              />
+              <p className="text-xs text-th-text-s mt-1">{t('federation.emailHint')}</p>
+            </div>
+
            <div className="flex items-center gap-3 pt-2 border-t border-th-border">
-              <button type="button" onClick={() => setShowFedShare(null)} className="btn-secondary flex-1">
+              <button type="button" onClick={() => { setShowFedShare(null); setFedAddress(''); setFedEmails(''); }} className="btn-secondary flex-1">
                {t('common.cancel')}
              </button>
-              <button type="submit" disabled={fedSending} className="btn-primary flex-1">
+              <button type="submit" disabled={fedSending || (!fedAddress.trim() && !fedEmails.trim())} className="btn-primary flex-1">
                {fedSending ? <Loader2 size={16} className="animate-spin" /> : <Send size={16} />}
                {t('calendar.send')}
              </button>
@@ -85,7 +85,7 @@ export default function Dashboard() {

  if (loading) {
    return (
-      <div className="flex items-center justify-center py-20">
+      <div className="flex items-center justify-center py-20" role="status" aria-label={t('common.loading')}>
        <Loader2 size={32} className="animate-spin text-th-accent" />
      </div>
    );
@@ -67,7 +67,7 @@ export default function FederatedRoomDetail() {

  if (loading) {
    return (
-      <div className="flex items-center justify-center py-20">
+      <div className="flex items-center justify-center py-20" role="status" aria-label={t('common.loading')}>
        <Loader2 size={32} className="animate-spin text-th-accent" />
      </div>
    );
@@ -127,7 +127,7 @@ export default function FederationInbox() {

    if (loading) {
        return (
-            <div className="flex items-center justify-center py-20">
+            <div className="flex items-center justify-center py-20" role="status" aria-label={t('common.loading')}>
                <Loader2 size={32} className="animate-spin text-th-accent" />
            </div>
        );
@@ -0,0 +1,104 @@
+import { useState } from 'react';
+import { Link } from 'react-router-dom';
+import { useLanguage } from '../contexts/LanguageContext';
+import { Mail, ArrowRight, Loader2, CheckCircle } from 'lucide-react';
+import BrandLogo from '../components/BrandLogo';
+import api from '../services/api';
+import toast from 'react-hot-toast';
+
+export default function ForgotPassword() {
+  const [email, setEmail] = useState('');
+  const [loading, setLoading] = useState(false);
+  const [sent, setSent] = useState(false);
+  const { t } = useLanguage();
+
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setLoading(true);
+    try {
+      await api.post('/auth/forgot-password', { email });
+      setSent(true);
+    } catch (err) {
+      toast.error(err.response?.data?.error || t('auth.forgotPasswordFailed'));
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <div className="min-h-screen flex items-center justify-center p-6 relative overflow-hidden">
+      {/* Animated background */}
+      <div className="absolute inset-0 bg-th-bg">
+        <div className="absolute inset-0 opacity-30">
+          <div className="absolute top-1/4 left-1/4 w-96 h-96 bg-th-accent rounded-full blur-[128px] animate-pulse" />
+          <div className="absolute bottom-1/4 right-1/4 w-80 h-80 bg-purple-500 rounded-full blur-[128px] animate-pulse" style={{ animationDelay: '2s' }} />
+          <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-64 h-64 bg-pink-500 rounded-full blur-[128px] animate-pulse" style={{ animationDelay: '4s' }} />
+        </div>
+      </div>
+
+      <div className="relative w-full max-w-md">
+        <div className="card p-8 backdrop-blur-xl bg-th-card/80 border border-th-border shadow-2xl rounded-2xl">
+          <div className="flex justify-center mb-8">
+            <BrandLogo size="lg" />
+          </div>
+
+          {sent ? (
+            <div className="text-center space-y-4">
+              <CheckCircle size={48} className="mx-auto text-green-400" />
+              <h2 className="text-2xl font-bold text-th-text">{t('auth.forgotPasswordSentTitle')}</h2>
+              <p className="text-th-text-s">{t('auth.forgotPasswordSent')}</p>
+              <Link to="/login" className="btn-primary inline-flex items-center gap-2 mt-4">
+                {t('auth.login')}
+              </Link>
+            </div>
+          ) : (
+            <>
+              <div className="mb-8">
+                <h2 className="text-2xl font-bold text-th-text mb-2">{t('auth.forgotPasswordTitle')}</h2>
+                <p className="text-th-text-s">{t('auth.forgotPasswordSubtitle')}</p>
+              </div>
+
+              <form onSubmit={handleSubmit} className="space-y-5">
+                <div>
+                  <label htmlFor="forgot-email" className="block text-sm font-medium text-th-text mb-1.5">{t('auth.email')}</label>
+                  <div className="relative">
+                    <Mail size={18} className="absolute left-3.5 top-1/2 -translate-y-1/2 text-th-text-s" aria-hidden="true" />
+                    <input
+                      id="forgot-email"
+                      type="email"
+                      autoComplete="email"
+                      value={email}
+                      onChange={e => setEmail(e.target.value)}
+                      className="input-field pl-11"
+                      placeholder={t('auth.emailPlaceholder')}
+                      required
+                    />
+                  </div>
+                </div>
+
+                <button
+                  type="submit"
+                  disabled={loading}
+                  className="btn-primary w-full py-3"
+                >
+                  {loading ? (
+                    <Loader2 size={18} className="animate-spin" />
+                  ) : (
+                    <>
+                      {t('auth.forgotPasswordSubmit')}
+                      <ArrowRight size={18} />
+                    </>
+                  )}
+                </button>
+              </form>
+            </>
+          )}
+
+          <Link to="/login" className="block mt-6 text-center text-sm text-th-text-s hover:text-th-text transition-colors">
+            {t('auth.backToLogin')}
+          </Link>
+        </div>
+      </div>
+    </div>
+  );
+}
@@ -3,6 +3,7 @@ import { useParams, Link, useSearchParams, useNavigate } from 'react-router-dom'
 import { Video, User, Lock, Shield, ArrowRight, Loader2, Users, Radio, AlertCircle, FileText, Clock, X } from 'lucide-react';
 import BrandLogo from '../components/BrandLogo';
 import api from '../services/api';
+import { isCurrentThemeDark } from '../themes';
 import toast from 'react-hot-toast';
 import { useLanguage } from '../contexts/LanguageContext';
 import { useAuth } from '../contexts/AuthContext';
@@ -35,6 +36,7 @@ export default function GuestJoin() {
        name: name.trim(),
        access_code: accessCode || undefined,
        moderator_code: moderatorCode || undefined,
+        dark_mode: isCurrentThemeDark(),
      };
      // If logged in, send avatar data
      if (isLoggedIn && user) {
@@ -1,5 +1,5 @@
 import { Link } from 'react-router-dom';
-import { Video, Shield, Users, Palette, ArrowRight, Zap, Globe, FileText, Lock, Network, CalendarDays, Bell, KeyRound, BarChart2, Settings2 } from 'lucide-react';
+import { Video, Users, FileVideo, Network, CalendarDays, BarChart2, ArrowRight, FileText, Lock } from 'lucide-react';
 import BrandLogo from '../components/BrandLogo';
 import { useLanguage } from '../contexts/LanguageContext';
 import { useBranding } from '../contexts/BrandingContext';
@@ -21,7 +21,7 @@ export default function Home() {
      desc: t('home.featureRoomsDesc'),
    },
    {
-      icon: Zap,
+      icon: FileVideo,
      title: t('home.featureRecordingsTitle'),
      desc: t('home.featureRecordingsDesc'),
    },
@@ -35,38 +35,21 @@ export default function Home() {
      title: t('home.featureCalendarTitle'),
      desc: t('home.featureCalendarDesc'),
    },
-    {
-      icon: Bell,
-      title: t('home.featureNotificationsTitle'),
-      desc: t('home.featureNotificationsDesc'),
-    },
-    {
-      icon: KeyRound,
-      title: t('home.featureOAuthTitle'),
-      desc: t('home.featureOAuthDesc'),
-    },
    {
      icon: BarChart2,
      title: t('home.featureAnalyticsTitle'),
      desc: t('home.featureAnalyticsDesc'),
    },
-    {
-      icon: Palette,
-      title: t('home.featureThemesTitle'),
-      desc: t('home.featureThemesDesc'),
-    },
  ];

  return (
    <div className="min-h-screen bg-th-bg">
-      {/* Hero Section */}
      <div className="relative overflow-hidden">
        {/* Background gradient */}
        <div className="absolute inset-0 gradient-bg opacity-5" />
        <div className="absolute top-0 left-1/2 -translate-x-1/2 w-[800px] h-[600px] gradient-bg opacity-10 blur-3xl rounded-full" />

-        {/* Navbar */}
-        <nav className="relative z-10 flex items-center justify-between px-6 md:px-12 py-4">
+        <nav className="relative z-10 flex items-center justify-between px-6 md:px-12 py-4 border-b border-th-border">
          <BrandLogo size="md" />
          <div className="flex items-center gap-3">
            <Link to="/login" className="btn-ghost text-sm">
@@ -75,75 +58,43 @@ export default function Home() {
            {!isInviteOnly && (
              <Link to="/register" className="btn-primary text-sm">
                {t('auth.register')}
-                <ArrowRight size={16} />
              </Link>
            )}
          </div>
        </nav>

-        {/* Hero content */}
-        <div className="relative z-10 max-w-4xl mx-auto text-center px-6 pt-20 pb-32">
-          <div className="inline-flex items-center gap-2 px-3 py-1 rounded-full bg-th-accent/10 text-th-accent text-sm font-medium mb-6">
-            <Zap size={14} />
-            {t('home.madeFor')}
-          </div>
-
-          <h1 className="text-4xl md:text-6xl lg:text-7xl font-extrabold text-th-text mb-6 leading-tight tracking-tight">
-            {t('home.heroTitle')}{' '}
-            <span className="gradient-text">{t('home.heroTitleHighlight')}</span>
+        {/* Hero */}
+        <div className="relative z-10 max-w-3xl mx-auto px-6 pt-24 pb-20">
+          <h1 className="text-3xl md:text-4xl font-bold text-th-text mb-4">
+            {t('home.heroTitle')}
          </h1>
-
-          <p className="text-lg md:text-xl text-th-text-s max-w-2xl mx-auto mb-10 leading-relaxed">
+          <p className="text-lg text-th-text-s mb-8 leading-relaxed">
            {t('home.heroSubtitle')}
          </p>
-
-          <div className="flex items-center gap-4 justify-center">
+          <div className="flex items-center gap-3">
            {!isInviteOnly && (
-              <Link to="/register" className="btn-primary text-base px-8 py-3">
+              <Link to="/register" className="btn-primary px-6 py-2.5">
                {t('home.getStarted')}
-                <ArrowRight size={18} />
+                <ArrowRight size={16} />
              </Link>
            )}
-            <Link to="/login" className={`${isInviteOnly ? 'btn-primary' : 'btn-secondary'} text-base px-8 py-3`}>
+            <Link to="/login" className={`${isInviteOnly ? 'btn-primary' : 'btn-secondary'} px-6 py-2.5`}>
              {t('auth.login')}
            </Link>
          </div>
-
-          {/* Stats */}
-          <div className="flex items-center justify-center gap-8 md:gap-16 mt-16">
-            {[
-              { value: '15+', label: t('home.statThemes') },
-              { value: '∞', label: t('home.statRooms') },
-              { value: '100%', label: t('home.statOpenSource') },
-            ].map(stat => (
-              <div key={stat.label} className="text-center">
-                <div className="text-2xl md:text-3xl font-bold gradient-text">{stat.value}</div>
-                <div className="text-sm text-th-text-s mt-1">{stat.label}</div>
-              </div>
-            ))}
-          </div>
        </div>
      </div>

-      {/* Features Section */}
-      <div className="max-w-6xl mx-auto px-6 py-20">
-        <div className="text-center mb-16">
-          <h2 className="text-3xl md:text-4xl font-bold text-th-text mb-4">
+      {/* Features */}
+      <div className="border-t border-th-border">
+        <div className="max-w-5xl mx-auto px-6 py-16">
+          <h2 className="text-xl font-semibold text-th-text mb-10">
            {t('home.features')}
          </h2>
-          <p className="text-lg text-th-text-s max-w-2xl mx-auto">
-            {t('home.featuresSubtitle')}
-          </p>
-        </div>
-
          <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
-          {features.map((feature, idx) => (
-            <div key={idx} className="card p-6 hover:shadow-th-lg transition-all duration-300 group">
-              <div className="w-12 h-12 rounded-xl gradient-bg/10 flex items-center justify-center mb-4 group-hover:scale-110 transition-transform"
-                   style={{ background: `linear-gradient(135deg, var(--gradient-start), var(--gradient-end))`, opacity: 0.15 }}>
-                <feature.icon size={24} className="text-th-accent" style={{ opacity: 1 }} />
-              </div>
-              <div className="w-12 h-12 rounded-xl flex items-center justify-center mb-4 -mt-16 relative">
+            {features.map(feature => (
+              <div key={feature.title} className="card p-6 hover:shadow-th-lg transition-shadow">
+                <div className="w-12 h-12 rounded-xl bg-th-accent/10 flex items-center justify-center mb-4">
                  <feature.icon size={24} className="text-th-accent" />
                </div>
                <h3 className="text-base font-semibold text-th-text mb-2">{feature.title}</h3>
@@ -152,6 +103,7 @@ export default function Home() {
            ))}
          </div>
        </div>
+      </div>

      {/* Footer */}
      <footer className="border-t border-th-border py-8 text-center">
@@ -106,7 +106,7 @@ export default function Login() {
  return (
    <div className="min-h-screen flex items-center justify-center p-6 relative overflow-hidden">
      {/* Animated background */}
-      <div className="absolute inset-0 bg-th-bg">
+      <div className="absolute inset-0 bg-th-bg" aria-hidden="true">
        <div className="absolute inset-0 opacity-30">
          <div className="absolute top-1/4 left-1/4 w-96 h-96 bg-th-accent rounded-full blur-[128px] animate-pulse" />
          <div className="absolute bottom-1/4 right-1/4 w-80 h-80 bg-purple-500 rounded-full blur-[128px] animate-pulse" style={{ animationDelay: '2s' }} />
@@ -137,10 +137,11 @@ export default function Login() {

              <form onSubmit={handle2FASubmit} className="space-y-5">
                <div>
-                  <label className="block text-sm font-medium text-th-text mb-1.5">{t('auth.2fa.codeLabel')}</label>
+                  <label htmlFor="login-totp-code" className="block text-sm font-medium text-th-text mb-1.5">{t('auth.2fa.codeLabel')}</label>
                  <div className="relative">
-                    <ShieldCheck size={18} className="absolute left-3.5 top-1/2 -translate-y-1/2 text-th-text-s" />
+                    <ShieldCheck size={18} className="absolute left-3.5 top-1/2 -translate-y-1/2 text-th-text-s" aria-hidden="true" />
                    <input
+                      id="login-totp-code"
                      ref={totpInputRef}
                      type="text"
                      inputMode="numeric"
@@ -220,6 +221,11 @@ export default function Login() {
                      required
                    />
                  </div>
+                  <div className="mt-1.5 text-right">
+                    <Link to="/forgot-password" className="text-sm text-th-accent hover:underline">
+                      {t('auth.forgotPassword')}
+                    </Link>
+                  </div>
                </div>

                <button
@@ -0,0 +1,147 @@
+import { useState } from 'react';
+import { Link, useSearchParams, useNavigate } from 'react-router-dom';
+import { useLanguage } from '../contexts/LanguageContext';
+import { Lock, ArrowRight, Loader2, CheckCircle, XCircle } from 'lucide-react';
+import BrandLogo from '../components/BrandLogo';
+import api from '../services/api';
+import toast from 'react-hot-toast';
+
+const MIN_PASSWORD_LENGTH = 8;
+
+export default function ResetPassword() {
+  const [searchParams] = useSearchParams();
+  const token = searchParams.get('token');
+  const { t } = useLanguage();
+  const navigate = useNavigate();
+
+  const [password, setPassword] = useState('');
+  const [confirm, setConfirm] = useState('');
+  const [loading, setLoading] = useState(false);
+  const [done, setDone] = useState(false);
+
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    if (password.length < MIN_PASSWORD_LENGTH) {
+      toast.error(t('auth.passwordMinLength'));
+      return;
+    }
+    if (password !== confirm) {
+      toast.error(t('auth.passwordMismatch'));
+      return;
+    }
+    setLoading(true);
+    try {
+      await api.post('/auth/reset-password', { token, password });
+      setDone(true);
+      toast.success(t('auth.resetPasswordSuccess'));
+      setTimeout(() => navigate('/login'), 2500);
+    } catch (err) {
+      toast.error(err.response?.data?.error || t('auth.resetPasswordFailed'));
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <div className="min-h-screen flex items-center justify-center p-6 relative overflow-hidden">
+      {/* Animated background */}
+      <div className="absolute inset-0 bg-th-bg">
+        <div className="absolute inset-0 opacity-30">
+          <div className="absolute top-1/4 left-1/4 w-96 h-96 bg-th-accent rounded-full blur-[128px] animate-pulse" />
+          <div className="absolute bottom-1/4 right-1/4 w-80 h-80 bg-purple-500 rounded-full blur-[128px] animate-pulse" style={{ animationDelay: '2s' }} />
+          <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-64 h-64 bg-pink-500 rounded-full blur-[128px] animate-pulse" style={{ animationDelay: '4s' }} />
+        </div>
+      </div>
+
+      <div className="relative w-full max-w-md">
+        <div className="card p-8 backdrop-blur-xl bg-th-card/80 border border-th-border shadow-2xl rounded-2xl">
+          <div className="flex justify-center mb-8">
+            <BrandLogo size="lg" />
+          </div>
+
+          {!token ? (
+            <div className="text-center space-y-4">
+              <XCircle size={48} className="mx-auto text-red-400" />
+              <h2 className="text-2xl font-bold text-th-text">{t('auth.resetPasswordFailed')}</h2>
+              <p className="text-th-text-s">{t('auth.resetTokenMissing')}</p>
+              <Link to="/forgot-password" className="btn-primary inline-flex items-center gap-2 mt-4">
+                {t('auth.forgotPasswordTitle')}
+              </Link>
+            </div>
+          ) : done ? (
+            <div className="text-center space-y-4">
+              <CheckCircle size={48} className="mx-auto text-green-400" />
+              <h2 className="text-2xl font-bold text-th-text">{t('auth.resetPasswordSuccessTitle')}</h2>
+              <p className="text-th-text-s">{t('auth.resetPasswordSuccess')}</p>
+              <Link to="/login" className="btn-primary inline-flex items-center gap-2 mt-4">
+                {t('auth.login')}
+              </Link>
+            </div>
+          ) : (
+            <>
+              <div className="mb-8">
+                <h2 className="text-2xl font-bold text-th-text mb-2">{t('auth.resetPasswordTitle')}</h2>
+                <p className="text-th-text-s">{t('auth.resetPasswordSubtitle')}</p>
+              </div>
+
+              <form onSubmit={handleSubmit} className="space-y-5">
+                <div>
+                  <label htmlFor="reset-password" className="block text-sm font-medium text-th-text mb-1.5">{t('auth.newPassword')}</label>
+                  <div className="relative">
+                    <Lock size={18} className="absolute left-3.5 top-1/2 -translate-y-1/2 text-th-text-s" aria-hidden="true" />
+                    <input
+                      id="reset-password"
+                      type="password"
+                      autoComplete="new-password"
+                      value={password}
+                      onChange={e => setPassword(e.target.value)}
+                      className="input-field pl-11"
+                      placeholder={t('auth.passwordPlaceholder')}
+                      required
+                    />
+                  </div>
+                </div>
+
+                <div>
+                  <label htmlFor="reset-confirm" className="block text-sm font-medium text-th-text mb-1.5">{t('auth.confirmPassword')}</label>
+                  <div className="relative">
+                    <Lock size={18} className="absolute left-3.5 top-1/2 -translate-y-1/2 text-th-text-s" aria-hidden="true" />
+                    <input
+                      id="reset-confirm"
+                      type="password"
+                      autoComplete="new-password"
+                      value={confirm}
+                      onChange={e => setConfirm(e.target.value)}
+                      className="input-field pl-11"
+                      placeholder={t('auth.passwordPlaceholder')}
+                      required
+                    />
+                  </div>
+                </div>
+
+                <button
+                  type="submit"
+                  disabled={loading}
+                  className="btn-primary w-full py-3"
+                >
+                  {loading ? (
+                    <Loader2 size={18} className="animate-spin" />
+                  ) : (
+                    <>
+                      {t('auth.resetPasswordSubmit')}
+                      <ArrowRight size={18} />
+                    </>
+                  )}
+                </button>
+              </form>
+            </>
+          )}
+
+          <Link to="/login" className="block mt-6 text-center text-sm text-th-text-s hover:text-th-text transition-colors">
+            {t('auth.backToLogin')}
+          </Link>
+        </div>
+      </div>
+    </div>
+  );
+}
@@ -8,7 +8,9 @@ import {
 } from 'lucide-react';
 import Modal from '../components/Modal';
 import api from '../services/api';
+import { isCurrentThemeDark } from '../themes';
 import { useAuth } from '../contexts/AuthContext';
+import { useBranding } from '../contexts/BrandingContext';
 import { useLanguage } from '../contexts/LanguageContext';
 import RecordingList from '../components/RecordingList';
 import AnalyticsList from '../components/AnalyticsList';
@@ -18,6 +20,7 @@ export default function RoomDetail() {
  const { uid } = useParams();
  const navigate = useNavigate();
  const { user } = useAuth();
+  const { transcriptionEnabled } = useBranding();
  const { t } = useLanguage();

  const [room, setRoom] = useState(null);
@@ -124,7 +127,7 @@ export default function RoomDetail() {
      toast.success(t('room.meetingStarted'));
      setWaitingToJoin(false);
      setActionLoading('join');
-      api.post(`/rooms/${uid}/join`, {})
+      api.post(`/rooms/${uid}/join`, { dark_mode: isCurrentThemeDark() })
        .then(res => { if (res.data.joinUrl) window.open(res.data.joinUrl, '_blank'); })
        .catch(err => toast.error(err.response?.data?.error || t('room.joinFailed')))
        .finally(() => setActionLoading(null));
@@ -135,7 +138,7 @@ export default function RoomDetail() {
  const handleStart = async () => {
    setActionLoading('start');
    try {
-      const res = await api.post(`/rooms/${uid}/start`);
+      const res = await api.post(`/rooms/${uid}/start`, { dark_mode: isCurrentThemeDark() });
      if (res.data.joinUrl) {
        window.open(res.data.joinUrl, '_blank');
      }
@@ -157,7 +160,8 @@ export default function RoomDetail() {
    setWaitingToJoin(false);
    setActionLoading('join');
    try {
-      const data = room.access_code ? { access_code: prompt(t('room.enterAccessCode')) } : {};
+      const data = { dark_mode: isCurrentThemeDark() };
+      if (room.access_code) data.access_code = prompt(t('room.enterAccessCode'));
      const res = await api.post(`/rooms/${uid}/join`, data);
      if (res.data.joinUrl) {
        window.open(res.data.joinUrl, '_blank');
@@ -201,6 +205,7 @@ export default function RoomDetail() {
        moderator_code: editRoom.moderator_code,
        learning_analytics: !!editRoom.learning_analytics,
        analytics_visibility: editRoom.analytics_visibility || 'owner',
+        recording_transcript: !!editRoom.record_meeting && !!editRoom.recording_transcript,
      });
      setRoom(res.data.room);
      setEditRoom(res.data.room);
@@ -364,7 +369,7 @@ export default function RoomDetail() {

  if (loading) {
    return (
-      <div className="flex items-center justify-center py-20">
+      <div className="flex items-center justify-center py-20" role="status" aria-label={t('common.loading')}>
        <Loader2 size={32} className="animate-spin text-th-accent" />
      </div>
    );
@@ -669,11 +674,28 @@ export default function RoomDetail() {
              <input
                type="checkbox"
                checked={!!editRoom.record_meeting}
-                onChange={e => setEditRoom({ ...editRoom, record_meeting: e.target.checked })}
+                onChange={e => setEditRoom({
+                  ...editRoom,
+                  record_meeting: e.target.checked,
+                  // Transcription/AI summary requires recording — clear it when recording is turned off
+                  recording_transcript: e.target.checked ? editRoom.recording_transcript : false,
+                })}
                className="w-4 h-4 rounded-sm border-th-border text-th-accent focus:ring-th-ring"
              />
              <span className="text-sm text-th-text">{t('room.allowRecording')}</span>
            </label>
+            {transcriptionEnabled && (
+              <label className={`flex items-center gap-3 ${editRoom.record_meeting ? 'cursor-pointer' : 'opacity-50 cursor-not-allowed'}`}>
+                <input
+                  type="checkbox"
+                  checked={!!editRoom.recording_transcript}
+                  disabled={!editRoom.record_meeting}
+                  onChange={e => setEditRoom({ ...editRoom, recording_transcript: e.target.checked })}
+                  className="w-4 h-4 rounded-sm border-th-border text-th-accent focus:ring-th-ring"
+                />
+                <span className="text-sm text-th-text">{t('room.enableTranscript')}</span>
+              </label>
+            )}
            <label className="flex items-center gap-3 cursor-pointer">
              <input
                type="checkbox"
@@ -717,7 +739,7 @@ export default function RoomDetail() {
              <p className="text-xs text-th-text-s mt-1">{t('room.moderatorCodeDesc')}</p>
            </div>
            <div>
-              <label className="block text-sm font-medium text-th-text mb-1.5">{t('room.guestLink')}</label>
+              <span className="block text-sm font-medium text-th-text mb-1.5">{t('room.guestLink')}</span>
              <div className="flex items-center gap-2">
                <code className="flex-1 bg-th-bg-s px-3 py-2 rounded-lg text-xs text-th-text font-mono truncate border border-th-border">
                  {window.location.origin}/join/{room.uid}
@@ -728,6 +750,7 @@ export default function RoomDetail() {
                    navigator.clipboard.writeText(`${window.location.origin}/join/${room.uid}`);
                    toast.success(t('room.linkCopied'));
                  }}
+                  aria-label={t('room.copyLink')}
                  className="btn-ghost text-xs py-2 px-3"
                >
                  <Copy size={14} />
@@ -173,6 +173,18 @@ export function getThemeById(id) {
  return themes.find(t => t.id === id) || themes[1]; // default to dark
 }

+// Whether the currently applied theme is a dark one. Reads the resolved theme
+// from the <html data-theme> attribute (set by ThemeContext) with a localStorage
+// fallback, so it works without React context — handy for one-off API payloads
+// such as the BBB join call that forwards dark mode to the meeting.
+export function isCurrentThemeDark() {
+  const id = (typeof document !== 'undefined'
+    && document.documentElement.getAttribute('data-theme'))
+    || (typeof localStorage !== 'undefined' && localStorage.getItem('theme'))
+    || 'dark';
+  return getThemeById(id).type === 'dark';
+}
+
 export function getThemeGroups() {
  const groups = {};
  themes.forEach(theme => {
Author	SHA1	Message	Date
MichelleandClaude Fable 5	231959a508	chore: sync package-lock.json after npm install Build & Push Docker Image / build (push) Successful in 3m38s Details Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 22:32:07 +02:00
MichelleandClaude Fable 5	762d6c54c8	feat: improve accessibility across the app - add useDialogA11y hook: focus trap, Escape handling, and focus restore for all custom modal dialogs (Modal, ThemeSelector, Admin modals) - add skip link, per-route document titles, and focus shift to main on SPA route changes - make notification list items real buttons (keyboard operable) and show hover-only controls on keyboard focus - close sidebar, dropdowns, and context menus with Escape, returning focus to their triggers; mark closed mobile sidebar inert - associate missing form labels (2FA code, DateTimePicker), add missing aria-labels on icon-only buttons, aria-expanded/controls on toggles, aria-pressed on theme tiles, scope=col on table headers - announce loading states via role=status - respect prefers-reduced-motion - new i18n keys: common.skipToContent/previous/next, admin.userActions Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 22:31:43 +02:00
MichelleandClaude Fable 5	6a312ba055	chore: update version to 2.5.0 Build & Push Docker Image / build (release) Successful in 3m56s Details Build & Push Docker Image / build (push) Successful in 3m57s Details Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 09:47:30 +02:00
MichelleandClaude Fable 5	8c65e4acd2	refactor: replace exceljs with write-excel-file for analytics export Build & Push Docker Image / build (push) Successful in 3m57s Details exceljs (latest 4.4.0) ships years-old transitive dependencies that npm flags as deprecated on every install (rimraf 2, glob 7, inflight, fstream, lodash.isequal) and needed a uuid override for a security advisory. It was only used for the single-sheet analytics XLSX export, which write-excel-file covers with the same output (column widths, bold/grey header, formula-injection escaping). Removes the now-unneeded exceljs uuid override. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 09:40:53 +02:00
MichelleandClaude Fable 5	fcd73d0667	fix: constrain modals to viewport height with internal scrolling Build & Push Docker Image / build (push) Successful in 4m2s Details Modal dialogs (e.g. the create-event form) grew beyond the screen and scrolled the page behind them. Cap the card at the viewport height and scroll the body inside it, keeping the header pinned. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 09:33:21 +02:00
MichelleandClaude Fable 5	8830f42ac5	feat: disable AI summary/transcription when room recording is off - Unchecking "allow recording" in room settings now also clears the transcript/AI summary checkbox (it was only greyed out before, so a previously enabled value stayed checked and got saved) - Server enforces the coupling on room create and update: with recording disabled, recording_transcript is always stored as 0 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 09:32:05 +02:00
MichelleandClaude Fable 5	e7c7dd28d3	chore: update dependencies and fix security vulnerabilities Build & Push Docker Image / build (push) Successful in 4m1s Details - npm update for all semver-compatible packages (vite 8.1.5, concurrently 9.2.4, axios 1.18.1, better-sqlite3 12.11.1, ...) - nodemailer 8 -> 9 (fixes GHSA-p6gq-j5cr-w38f and three further advisories: CRLF header injection, jsonTransport/raw file-access bypasses, OAuth2 TLS validation) - override exceljs' nested uuid to ^11.1.1 (GHSA-w5hq-g745-h8pq) instead of the breaking exceljs downgrade npm audit suggests - allow better-sqlite3 install script (npm allowScripts policy) npm audit: 0 vulnerabilities Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 09:15:28 +02:00
MichelleandClaude Fable 5	69e901f145	feat: send calendar event invitations by email or federation Build & Push Docker Image / build (push) Successful in 4m18s Details - New endpoint POST /api/calendar/events/:id/email sends event invitations with an .ics attachment to external email addresses (rate-limited like room email invites) - Create-event dialog gets an optional invitations section to invite people by email or federation address right away - The "Invite remote" dialog on existing events now accepts email addresses in addition to federation IDs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 08:58:28 +02:00
MichelleandClaude Opus 4.8	849f54db7d	chore: update version to 2.4.1 Build & Push Docker Image / build (push) Canceled after 0s Details Build & Push Docker Image / build (release) Successful in 4m16s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-16 09:03:40 +02:00
MichelleandClaude Opus 4.8	4e89d9d0fe	feat: disable transcript/summary recording formats when transcription is off Build & Push Docker Image / build (push) Successful in 4m16s Details When the per-room AI summary/transcript setting is disabled (or the integration is not configured), pass meta_bbb-disable-recording-formats=transcript,summary on meeting create so BBB skips processing and publishing those formats entirely (bigbluebutton/bigbluebutton#25277). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-16 09:01:18 +02:00
MichelleandClaude Opus 4.8	4aeca36a9c	fix: log underlying network error cause for failed transcription requests Build & Push Docker Image / build (push) Successful in 4m5s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-14 12:30:17 +02:00
MichelleandClaude Opus 4.8	51b42cfee5	feat: add AI summary / transcript integration for recordings Build & Push Docker Image / build (push) Successful in 4m17s Details Build & Push Docker Image / build (release) Successful in 3m57s Details Ported from greenlight-tm: when TRANSCRIPTION_API_URL and TRANSCRIPTION_API_KEY are set in the .env and the per-room "AI summary / transcript" setting is enabled, Redlight POSTs to ${TRANSCRIPTION_API_URL}/prompt (header X-Api-Key) as soon as the "video" format of a recording becomes available. - transcription.js: service with env gating, timeout and logging - bbb.js: pass meta_bbb-recording-ready-url on meeting create when the room has the setting enabled - recordings.js: unauthenticated /recording-ready callback that verifies BBB's signed_parameters JWT (HS256, shared secret), caches the recording and requests the transcription once per recording (deduped via transcript_requested_at) - rooms: new recording_transcript column, accepted on create/update - branding endpoint exposes transcriptionEnabled so the UI only shows the toggle when the server is configured - RoomDetail: toggle under "Allow recording" (disabled when recording is off), de/en i18n - chore: bump version to 2.4.0 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-14 11:56:45 +02:00
MichelleandClaude Opus 4.8	dffb68efe5	fix: move resetPassword email locales to server i18n Build & Push Docker Image / build (push) Successful in 4m9s Details The password reset email is rendered server-side via emaili18n.js, which loads translations from server/i18n. The email.resetPassword keys only existed in the frontend src/i18n locales, so t() returned the raw key paths in the sent email. Move the EN/DE block to the server locales and drop the unused copy from the frontend. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-28 22:28:37 +02:00
MichelleandClaude Opus 4.8	db82cd944f	feat: add password reset ("forgot password") flow Build & Push Docker Image / build (push) Successful in 4m12s Details Add a self-service password reset to the login flow: - Login page now shows a "Passwort vergessen?" link under the password field - New /forgot-password page requests a reset email by address - New /reset-password page sets a new password from an emailed token - Backend: POST /auth/forgot-password and /auth/reset-password with dedicated rate limiters; tokens stored as SHA-256 hashes with a 1h expiry - Generic responses avoid leaking account existence or SMTP/SSO state; SSO-only accounts are skipped - New sendPasswordResetEmail mailer + email/auth i18n keys (de + en) - DB migration: reset_token_hash, reset_token_expires, reset_requested_at Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 23:40:11 +02:00
Michelle	2f65e53a24	fix: wrap screenshots in collapsible details section in README Build & Push Docker Image / build (push) Successful in 4m6s Details	2026-06-21 22:17:58 +02:00
Michelle	1518645145	Merge branch 'main' of https://git.scrunkly.cat/Michelle/redlight Build & Push Docker Image / build (push) Successful in 4m13s Details	2026-06-21 22:16:43 +02:00
Michelle	64a1ba2548	Add screenshots to README	2026-06-21 22:16:42 +02:00
MichelleandClaude Opus 4.8	03098eaf2b	chore: update version to 2.3.0 Build & Push Docker Image / build (push) Successful in 4m5s Details Build & Push Docker Image / build (release) Successful in 4m13s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-11 10:18:48 +02:00
MichelleandClaude Opus 4.8	7dd834cd35	Harden server security, rework landing page and refresh branding Build & Push Docker Image / build (push) Successful in 4m3s Details Security: - rooms: rate-limit /invite-email (SMTP spam relay), validate share target user exists, guard timingSafeEqual against length mismatch in the presentation route (500 -> 403) - analytics: verify callback token before parsing the 5mb body so unauthenticated callers cannot buffer large payloads - caldav: rate-limit failed Basic-Auth attempts (token brute force), lowercase email lookup, case-insensitive principal check - auth: fall back to the in-memory rate-limit store when Redis is unavailable; previously every rate-limited endpoint (incl. login) returned 500 when the Redis connection was down UI/copy: - Home: factual hero copy and feature cards (6 instead of 9), fix double-rendered feature icon, remove fake stats row and pill badge; keep the background gradient and card layout - i18n: consistent informal tone, drop trailing exclamation marks from status toasts, remove emoji from transactional emails - new favicon (logo.svg), restore theme-based default brand logo Chore: - gitignore SQLite WAL/SHM files Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-11 10:14:36 +02:00
Michelle	4621010bd7	feat: add dark mode support for meeting join and start processes Build & Push Docker Image / build (push) Successful in 4m14s Details	2026-06-11 09:27:34 +02:00