🚀 feat: launch v1.0 — next-generation frontend built from the ground up (#4265)

* feat: add parameter coverage for the operations: copy, trim_prefix, trim_suffix, ensure_prefix, ensure_suffix, trim_space, to_lower, to_upper, replace, and regex_replace

* fix: CrossGroupRetry default false

移除gorm:"default:false"，避免每次 AutoMigrate时都执行ALTER TABLE `tokens` MODIFY COLUMN `cross_group_retry` boolean DEFAULT false
且bool默认false不影响原有功能

* feat: check-in feature integrates Turnstile security check

* feat: add support for Doubao /v1/responses (#2567)

* feat: add support for Doubao /v1/responses

* fix: fix model deployment style issues, lint problems, and i18n gaps. (#2556)

* fix: fix model deployment style issues, lint problems, and i18n gaps.

* fix: adjust the key not to be displayed on the frontend, tested via the backend.

* fix: adjust the sidebar configuration logic to use the default configuration items if they are not defined.

* feat: add plans directory to .gitignore

* fix: 修复 gemini 文件类型不支持 image/jpg

* fix: fix the proxyURL is empty, not using the default HTTP client configuration && the AWS calling side did not apply the relay timeout.

* fix: batch add key backend deduplication

* Merge pull request #2582 from seefs001/fix/tips

fix: add tips for model management and channel testing

* fix(gin): update request body size check to allow zero limit

* feat: add regex pattern to mask API keys in sensitive information

* fix(task): 修复使用 auto 分组时 Task Relay 不记录日志和不扣费的问题

问题描述：
- 使用 auto 分组的令牌调用 /v1/videos 等 Task 接口时，虽然任务能成功创建，
  但使用日志不显示记录，且不会扣费

根本原因：
- Distribute 中间件在选择渠道后，会将实际选中的分组存储在 ContextKeyAutoGroup 中
- 但 RelayTaskSubmit 函数没有从 context 中读取这个值来更新 info.UsingGroup
- 导致 info.UsingGroup 始终是 "auto" 而不是实际选中的分组（如 "sora2逆"）
- 当 auto 分组的倍率配置为 0 时，quota 计算结果为 0
- 日志记录条件 "if quota != 0" 不满足，导致日志不记录、不扣费

修复方案：
- 在 RelayTaskSubmit 函数中计算分组倍率之前，添加从 ContextKeyAutoGroup
  获取实际分组的逻辑
- 使用安全的类型断言，避免潜在的 panic 风险

影响范围：
- 仅影响 Task Relay 流程（/v1/videos, /suno, /kling 等接口）
- 不影响使用具体分组令牌的调用
- 不影响其他 Relay 类型（chat/completions 等已有类似处理逻辑）

* 🚀 feat(web): port legacy v2 frontend changes into new UI (deployments, check-in, ollama) + align APIs

Bring over the key frontend functionality introduced in merge `efa3301` and integrate it cleanly into the new `web/src` architecture and design system.

- **Model deployments (io.net)**
  - Align frontend endpoints and payloads with backend deployment routes (`/api/deployments/*`)
  - Add missing deployment operations: details, logs (container-aware), update config, rename, extend duration
  - Improve create-deployment flow (proper request shape, name availability check, price estimation parity)

- **System settings**
  - Enhance io.net deployment settings: allow testing connection with an unsaved API key and add “how to get API key” guidance

- **Channels / Ollama**
  - Improve Ollama model management: live fetch via base_url with fallback to channel fetch, selection + apply flows, delete confirmation
  - Refactor for feature-layer consistency: extract Ollama parsing/normalization utilities into `features/channels/lib`

- **Quality**
  - Ensure TypeScript typecheck passes after refactor and new dialogs/components integration

* Merge pull request #2590 from xyfacai/fix/max-body-limit

fix: 设置默认max req body 为128MB

* docs: update readme

* i18n: add missing translations

* fix(gemini): fetch model list via native v1beta/models endpoint

Use the native Gemini Models API (/v1beta/models) instead of the OpenAI-compatible
path when listing models for Gemini channels, improving compatibility with
third-party Gemini-format providers that don't implement OpenAI routes.

- Add paginated model listing with timeout and optional proxy support
- Select an enabled key for multi-key Gemini channels

* refactor(gemini): 更新 GeminiModelsResponse 以使用 dto.GeminiModel 类型

* fix: remove Minimax from FETCHABLE channels

* fix(minimax): 添加 MiniMax-M2 系列模型到 ModelList

* feat: add doubao video 1.5

* 🤢 chore: remove useless file

* feat: /v1/chat/completion -> /v1/response (#2629)

* feat: /v1/chat/completion -> /v1/response

* fix: clean propertyNames for gemini function

* fix: support snake_case fields in GeminiChatGenerationConfig

* chore: update dependencies and lockfile for improved compatibility

- Updated @clerk/clerk-react to version 5.59.3
- Updated @hookform/resolvers to version 5.2.2
- Updated @lobehub/icons to version 2.48.0
- Updated various Radix UI components to their latest versions
- Updated @tanstack/react-query and related packages for better performance
- Updated axios, i18next, and other libraries for security and feature enhancements
- Updated lockfile to include configVersion and ensure consistency across environments

* Merge pull request #2647 from seefs001/feature/status-code-auto-disable

feat: status code auto-disable configuration

* fix: chat2response setting ui (#2643)

* fix: setting ui

* fix: rm global.chat_completions_to_responses_policy

* fix: rm global.chat_completions_to_responses_policy

* Merge pull request #2627 from seefs001/feature/channel-test-param-override

feat: channel testing supports parameter overriding

* chore: update dependencies and lockfile for improved compatibility

- Updated @lobehub/icons to version 4.0.3
- Updated ai to version 6.0.27
- Updated various libraries including axios, react-day-picker, and streamdown for security and feature enhancements
- Updated devDependencies for eslint, prettier, and typescript for better performance and compatibility
- Updated lockfile to ensure consistency across environments

* chore: update lockfile and Vite configuration for improved build process

- Updated lockfile to version 1 for better compatibility and consistency
- Enhanced Vite configuration to support production optimizations, including code minification and chunking for dependencies
- Added environment-specific console and debugger removal for production builds

* chore: migrate from Vite to Rsbuild for build process

- Added Rsbuild configuration for development and production builds
- Updated package.json scripts to use Rsbuild instead of Vite
- Replaced @tailwindcss/vite with @tailwindcss/postcss in dependencies
- Introduced postcss.config.mjs for Tailwind CSS integration
- Updated TypeScript configuration to include Rsbuild config
- Removed Vite configuration file to streamline the build process

* refactor: optimize user data handling and API calls

- Replaced direct API calls to get user data with cached user information from auth-store in ModelsFilter and SummaryCards components.
- Improved session management in RootComponent and Authenticated route to utilize localStorage for user authentication status, reducing unnecessary API requests.
- Added caching for setup status checks to enhance performance during navigation.

* feat: enhance session validation in authenticated route

- Implemented session verification to check user authentication status via API call only once per session.
- Updated beforeLoad logic to redirect users to the login page if session validation fails or if no user information is available in localStorage.
- Improved user data handling by updating the auth store with fresh user information upon successful session verification.

* refactor: improve useMediaQuery hook for better SSR handling

- Enhanced the useMediaQuery hook to check for window availability before accessing matchMedia, preventing errors during server-side rendering.
- Simplified state initialization and change handling by using a dedicated function to determine initial matches.
- Updated event listener management for improved performance and clarity.

* feat(hooks): export useMediaQuery from hooks index

* refactor: update useMediaQuery imports to use unified hooks index

* fix(rsbuild): fix loadEnv API usage and removeConsole type

* feat: customizable automatic retry status codes

* refactor(hooks): use useSyncExternalStore for better SSR handling in useMediaQuery

* refactor: simplify embedded file structure in main.go

- Updated the embedded file directive to include the entire web/dist directory instead of individual assets, streamlining the build process.

* refactor: replace DropdownMenu with Sheet component in ProfileDropdown

- Updated the ProfileDropdown component to use a Sheet for user interactions instead of a DropdownMenu.
- Enhanced user info display with improved layout and styling.
- Added navigation links and sign-out functionality within the Sheet.

* refactor: streamline ProfileDropdown layout and improve user info display

- Removed unused Badge component and secondary text from user display.
- Enhanced styling for user info section and navigation links.
- Updated sign-out functionality to use a button for better accessibility.

* feat: add System Settings link for super admin in ProfileDropdown

- Introduced a new link to System Settings in the ProfileDropdown, visible only to users with the SUPER_ADMIN role.
- Updated imports to include the Settings icon and adjusted the component logic accordingly.
- Removed the Settings entry from the sidebar data to streamline navigation.

* feat: codex channel (#2652)

* feat: codex channel

* feat: codex channel

* feat: codex oauth flow

* feat: codex refresh cred

* feat: codex usage

* fix: codex err message detail

* fix: codex setting ui

* feat: codex refresh cred task

* fix: import err

* fix: codex store must be false

* fix: chat -> responses tool call

* fix: chat -> responses tool call

* feat(i18n): add missing translations

* fix(i18n): restore missing translations for "360" and add "User Menu" in multiple locales

- Reintroduced the translation for "360" in English, French, Japanese, Russian, Vietnamese, and Chinese locales.
- Added the "User Menu" translation in the same languages to enhance user interface consistency.

* fix: openAI function to gemini function field adjusted to whitelist mode

* feat: TLS_INSECURE_SKIP_VERIFY env

* fix: for chat-based calls to the Claude model, tagging is required. Using Claude's rendering logs, the two approaches handle input rendering differently.

* refactor(system-settings): restructure settings sections and navigation

- Replaced SettingsAccordion with a unified SettingsSection component across various settings sections for consistency.
- Introduced a section registry to manage general settings sections dynamically.
- Updated navigation items in the system settings sidebar to utilize the new section registry.
- Enhanced the GeneralSettings component to support section-based content rendering based on user selection.

* fix(system-settings): remove type assertion for quotaDisplayType in GeneralSettings

- Eliminated the type assertion for quotaDisplayType in the GeneralSettings component to improve type inference and maintain cleaner code.

* refactor(system-settings): update zod import syntax in general settings

- Changed the import statement for zod from a default import to a namespace import for better clarity and consistency in the codebase.

* fix: the login method cannot be displayed under the aff link.

* feat(system-settings): implement generic settings page and enhance navigation

- Added a new generic SettingsPage component to handle loading states, data fetching, and section rendering.
- Integrated section registry for general and authentication settings to streamline navigation and content management.
- Updated URL utility functions to improve query parameter handling for active navigation states.
- Enhanced the system settings sidebar to include authentication section items dynamically.

* refactor(system-settings): replace SettingsAccordion with SettingsSection across authentication settings

- Updated BasicAuthSection, BotProtectionSection, OAuthSection, and PasskeySection to use the new SettingsSection component for consistency.
- Introduced a section registry to manage authentication settings dynamically, enhancing navigation and content rendering.

* feat(system-settings): enhance request limits settings with new section and unified component

- Added a new Request Limits section to the system settings sidebar, integrating it with the section registry for improved navigation.
- Replaced SettingsAccordion with SettingsSection in RateLimitSection, SensitiveWordsSection, and SSRFSection for consistency.
- Updated RequestLimitsSettings to utilize the new SettingsPage component for better data handling and rendering.
- Implemented a search schema for request limits to streamline navigation and section management.

* feat(system-settings): integrate content settings sections with unified component and registry

- Added a new Content section to the system settings sidebar, incorporating it into the section registry for improved navigation.
- Replaced SettingsAccordion with SettingsSection in multiple content-related components for consistency.
- Created a section registry to manage content settings dynamically, enhancing the rendering and navigation experience.
- Updated the ContentSettings component to utilize the new section registry and streamline content display.

* feat(system-settings): enhance integrations settings with unified section registry and components

- Introduced a new section registry for integrations settings, consolidating various settings components for better organization and navigation.
- Replaced SettingsAccordion with SettingsSection in multiple integration-related components for consistency.
- Updated IntegrationSettings to utilize the new SettingsPage component, improving data handling and rendering.
- Added a new integrations section to the system settings sidebar, enhancing user experience and accessibility.

* feat(system-settings): unify model settings with new section registry and components

- Introduced a section registry for model settings, consolidating various model-related components for improved organization and navigation.
- Replaced SettingsAccordion with SettingsSection in multiple model settings components for consistency.
- Updated ModelSettings to utilize the new SettingsPage component, enhancing data handling and rendering.
- Added a new Models section to the system settings sidebar, improving user experience and accessibility.

* feat(system-settings): enhance maintenance settings with unified section registry and components

- Introduced a new section registry for maintenance settings, consolidating various maintenance-related components for improved organization and navigation.
- Replaced SettingsAccordion with SettingsSection in multiple maintenance components for consistency.
- Updated MaintenanceSettings to utilize the new section registry, enhancing data handling and rendering.
- Added a new Maintenance section to the system settings sidebar, improving user experience and accessibility.

* feat(system-settings): update section titles for improved clarity and consistency

- Renamed various section titles across content, integrations, maintenance, models, and request limits to enhance clarity and better reflect their functionalities.
- Adjusted titles such as 'Dashboard' to 'Data Dashboard', 'API Info' to 'API Addresses', and 'Update Checker' to 'System maintenance' for improved user understanding.
- Ensured consistency in naming conventions across all settings sections to streamline user experience and navigation.

* feat(nav-group): enhance collapsible menu behavior and URL matching logic

- Added controlled state management for collapsible menu items to automatically expand based on active sub-item paths.
- Updated the URL matching logic in checkIsActive to improve handling of query parameters and ensure accurate navigation state detection.
- Refactored the collapsible component to utilize the new state management, enhancing user experience in the sidebar navigation.

* feat(system-settings): update system settings navigation and redirect logic

- Changed the link in the profile dropdown to point directly to the general section of system settings with a search parameter for section identification.
- Implemented a redirect in the general settings route to ensure users are directed to the default section if no section parameter is provided, enhancing navigation consistency.

* feat(system-settings): unify route configuration for settings sections

- Refactored route configuration for various system settings sections (auth, content, general, integrations, maintenance, models, request limits) to utilize a new `createSettingsRouteConfig` function.
- This change consolidates the repetitive logic of creating search schemas and handling redirects, improving code maintainability and readability.
- Enhanced navigation by ensuring default sections are loaded when no section parameter is provided.

* feat(url-utils): enhance URL handling and matching logic

- Introduced a new utility function `urlToString` to convert various URL formats (string and object) into a standardized string format.
- Updated the `checkIsActive` function to utilize `urlToString`, improving the accuracy of URL matching and handling of query parameters.
- Refactored URL comparison logic to ensure consistent behavior across different URL types, enhancing navigation state detection.

* feat(system-settings): validate DataExportDefaultTime for improved data handling

- Introduced a new function `validateDataExportDefaultTime` to ensure the `DataExportDefaultTime` value is either 'week', 'hour', or 'day', defaulting to 'hour' for unexpected values.
- Updated the `DataExportDefaultTime` assignment in the settings section to utilize this validation function, enhancing data integrity and user experience.

* perf(system-settings): Improve the i18n of system settings content

- Changed button labels in various sections to use consistent capitalization and translation functions, enhancing user experience.
- Updated validation messages in schemas to utilize translation functions for improved internationalization support.
- Ensured all user-facing strings are properly translated, improving accessibility for non-English users.

* fix(system-settings): update ApiInfoFormValues type inference for improved schema validation

- Changed the type inference for ApiInfoFormValues to utilize ReturnType of createApiInfoSchema, ensuring accurate type representation and enhancing type safety in the API info section.

* fix(chat-settings): improve validation logic for chat settings schema

- Updated the validation logic to ensure that null values are correctly handled and that only objects are accepted as valid items in the chat settings schema.
- Simplified error handling by removing the error message from the catch block, providing a consistent user-facing message for invalid JSON strings.

* fix(system-settings): enhance validation error handling in uptime-kuma schema

- Updated the validation logic for category name, URL, and slug fields to use an object format for error messages, improving clarity and consistency in user feedback.
- Ensured that all validation messages are properly structured to enhance internationalization support.

* fix(i18n): add translations for Uptime Kuma group management

- Added English, French, Japanese, Russian, Vietnamese, and Chinese translations for "Add Uptime Kuma Group" and "Edit Uptime Kuma Group" to enhance internationalization support.
- Included validation messages for category name and slug fields across multiple languages to improve user feedback and accessibility.

* fix(system-settings): improve validation error message structure for SystemName

- Updated the validation logic for the SystemName field to use an object format for error messages, enhancing clarity and consistency in user feedback.
- This change aligns with recent improvements in internationalization support across the system settings schemas.

* perf(i18n): add new validation error message translations

- Added translations for the new validation error message "Invalid JSON format or values out of allowed range" in English, French, Japanese, Russian, Vietnamese, and Chinese.
- This update enhances internationalization support by ensuring users receive clear feedback across multiple languages.

* fix(i18n): update Japanese translation for payment method configuration message

- Corrected the Japanese translation for the message regarding payment methods configuration to use the term "メソッド" instead of "方法" for improved accuracy and consistency in user feedback.
- This change enhances the clarity of the message for Japanese-speaking users.

* fix(i18n): remove unnecessary loading messages from French translations

- Removed the French translations for "Loading settings...", "Loading maintenance settings...", and "Loading content settings..." to streamline the localization file.
- This change improves the clarity and relevance of the translations provided to users.

* fix(i18n): add translations for Uptime Kuma group management in multiple languages

- Added French, Japanese, Russian, Vietnamese, and Chinese translations for "Add Uptime Kuma Group" and "Edit Uptime Kuma Group" to enhance internationalization support.
- This update improves user experience by providing clear and consistent messaging across different languages.

* fix(validation): enhance pricing schema error messages and add translations

- Updated the pricing schema to include localized error messages for validation, ensuring users receive clear feedback when input values are invalid.
- Added new translations for "Exchange rate is required" and "Exchange rate must be greater than 0" in English, French, Japanese, and Chinese to improve internationalization support.
- This change enhances user experience by providing accurate and contextually relevant messages across multiple languages.

* fix: codex Unsupported parameter: max_output_tokens

* fix(model-mapping-editor): simplify JSON parsing logic in useEffect

* fix: jimeng i2v support multi image by metadata

* refactor(models): restructure models section handling and improve UI components

- Replaced tab-based navigation with section-based navigation for better clarity and organization.
- Introduced a new section registry to manage model sections, including 'metadata' and 'deployments'.
- Updated the ModelsContent component to reflect the new section structure and added a Create Deployment button.
- Removed the ModelsTabs component as it was no longer needed.
- Enhanced internationalization support by adding new translations for section descriptions and management tasks.
- Adjusted sidebar configuration to accommodate the new section structure.

* fix: update warning threshold label from '5$' to '2$'

* fix: video content api Priority use url field

* fix: update abortWithOpenAiMessage function to use types.ErrorCode

* feat(deployment): introduce CreateDeploymentDrawer component and update dialog references

- Replaced the CreateDeploymentDialog with a new CreateDeploymentDrawer component for improved user experience.
- Added comprehensive form handling for deployment creation, including validation and price estimation features.
- Updated internationalization files to include new translations for UI elements and descriptions related to deployment configuration.
- Enhanced the ModelsContent component to integrate the new drawer for creating deployments.

* perf(i18n): enhance internationalization for models table and columns

- Updated labels and titles in the ModelsTable and useModelsColumns components to utilize translation functions for improved localization.
- Changed static text for vendor and sync status to dynamic translations, enhancing user experience for non-English speakers.
- Updated empty state messages in the ModelsTable to support internationalization, ensuring clarity for all users.

* fix: fix email send

* fix: issue where consecutive calls to multiple tools in gemini all returned an index of 0

* fix: replace Alibaba's Claude-compatible interface with the new interface

* fix: Only models with the "qwen" designation can use the Claude-compatible interface; others require conversion.

* feat: log shows request conversion

* feat: optimized display

* feat: optimized display

* feat: optimized display

* fix: codex rm Temperature

* Revert "fix: video content api Priority use url field"

* feat: requestId time string use UTC

* feat(qwen): support qwen image sync image model config

* feat: sync old ui

* feat: more ui sync

* feat: replace theme

* fix build

* refactor(web): revert theme colors and variables in CSS

Updated color variables for light and dark themes to improve consistency and visual appeal.

* feat(deployment): enhance deployment access guard and model deployment settings

- Introduced loading phase management in the DeploymentAccessGuard component to provide better user feedback during connection checks.
- Updated the ModelsContent component to prefetch the deployments list while checking connection status, improving data readiness.
- Implemented a caching mechanism for connection status in useModelDeploymentSettings to optimize performance and reduce unnecessary API calls.
- Enhanced loading states and error handling for improved user experience during deployment settings retrieval and connection testing.

* feat(i18n): add new translations for connection and loading states across multiple languages

- Introduced translations for "Checking connection" and "Loading configuration" in English, French, Japanese, Russian, Vietnamese, and Chinese.
- This update enhances the internationalization support, providing clearer user feedback during connection checks and loading phases.

* refactor(pagination): adjust layout and styling for pagination component

- Updated the pagination component to improve layout by removing unnecessary width constraints and enhancing responsiveness.
- Increased minimum width for pagination text to ensure better visibility and alignment across different screen sizes.

* feat(i18n): implement translations for various UI elements across multiple components

- Updated several components to utilize the translation function for titles and placeholders, enhancing internationalization support.
- Added new translation entries for "Filter by name or key..." and "Log Type" in English, French, Japanese, Russian, Vietnamese, and Chinese.
- This update improves user experience by providing localized text in the ChannelsTable, SummaryCards, ApiKeysTable, RedemptionsTable, UsageLogsTable, and UsersTable components.

* feat(i18n): integrate translation support in SummaryCards component

- Added the useTranslation hook to the SummaryCards component to enhance internationalization.
- This update allows for localized text rendering, improving user experience for diverse language speakers.

* feat(dashboard): refactor dashboard structure and introduce section-based navigation

- Removed the tab navigation in favor of a section-based approach, enhancing user experience by providing clearer context for the dashboard content.
- Introduced a new section registry to manage dashboard sections, allowing for easier expansion and maintenance.
- Updated sidebar configuration to reflect the new section structure, ensuring proper navigation links are displayed.
- Added translations for new section titles and descriptions to support internationalization.

* feat(i18n): update time range labels and enhance translation support

- Changed time range labels from shorthand (e.g., '1D') to full text (e.g., '1 Day') for better clarity.
- Updated various components to utilize the translation function for time range labels, improving internationalization.
- Added new translation entries for time ranges in English, French, Japanese, Russian, Vietnamese, and Chinese, enhancing user experience across languages.

* feat(dashboard): enhance type safety and improve component structure

- Updated the Dashboard component to use specific types for model data and filters, enhancing type safety.
- Introduced new types for announcements and FAQs, improving clarity and maintainability.
- Refactored LogStatCards and UptimePanel components to utilize AbortController for better data fetching management.
- Optimized the rendering of announcements and FAQs by using unique keys based on item IDs.
- Improved theme management in ModelCharts by caching the ThemeManager import to reduce dynamic imports.

* feat(agents): add comprehensive guidelines for React and Next.js development

- Introduced a new set of best practices and optimization techniques for React and Next.js applications, aimed at enhancing performance and maintainability.
- Included detailed rules covering various aspects such as event handling, API routes, rendering strategies, and state management.
- Added extensive documentation in AGENTS.md and SKILL.md to support developers in adhering to these practices.
- This update serves as a foundational resource for improving code quality and efficiency in React-based projects.

* chore(web): update package.json dependencies

- Removed outdated dependencies including @base-ui/react, @clerk/clerk-react, and others to streamline the project.
- Updated remaining dependencies to their latest versions for improved performance and security.
- This cleanup enhances the overall maintainability of the project.

* feat(usage-logs): implement section-based navigation and enhance log management

- Introduced a section registry for usage logs, allowing for better organization and navigation between different log categories (common, drawing, task).
- Updated the UsageLogsContent component to dynamically render titles and descriptions based on the selected section.
- Refactored UsageLogsTable and UsageLogsPrimaryButtons components to accept the active log category as a prop, improving modularity.
- Enhanced sidebar configuration to support new section navigation, ensuring users can easily access different log types.
- Updated routing to redirect to the default section if none is specified, improving user experience.

* feat(i18n): enhance internationalization across usage logs components

- Integrated the useTranslation hook in various components related to usage logs, including CommonLogsStats, UsageLogsTable, and column helpers.
- Updated labels, titles, and messages to utilize translation functions, improving localization support.
- Added new translation entries for log-related terms in English, French, Japanese, Russian, Vietnamese, and Chinese, enhancing user experience for diverse language speakers.

* feat(datetime-picker): integrate dayjs for date formatting

- Added dayjs as a dependency to the project for improved date handling.
- Updated the DateTimePicker component to use dayjs for formatting dates, enhancing consistency and readability of date displays.

* feat(date-handling): replace date-fns with dayjs for improved date management

- Updated the project to use dayjs instead of date-fns for date formatting and manipulation, enhancing consistency across components.
- Refactored DatePicker, DateTimePicker, and other components to utilize dayjs for date-related functionalities.
- Added a new dayjs configuration file to extend its capabilities with relative time support.
- Updated AGENTS.md to reflect the new technology stack, emphasizing the use of dayjs for date handling.

* refactor(agents): streamline front-end development guidelines and update technology stack

- Revised AGENTS.md to condense front-end development standards and best practices, making it more accessible for developers and AI assistants.
- Updated the technology stack section to reflect current dependencies, emphasizing the use of Bun, React 19, TypeScript, and other key libraries.
- Enhanced the document structure with a new table format for better readability and navigation, including a comprehensive table of contents for quick access to sections.

* feat(i18n): enhance date picker and datetime picker localization support

- Integrated internationalization support in DatePicker and DateTimePicker components by adding locale handling for multiple languages (English, French, Japanese, Russian, Vietnamese, Chinese).
- Updated the calendar component to accept a locale prop, ensuring proper localization of month and weekday labels.
- Improved user experience by allowing date selection to adapt based on the user's language preference.

* feat(layout): add SectionPageLayout component for structured page layouts

- Introduced a new SectionPageLayout component to facilitate structured layouts for pages with sections, enhancing the organization of content.
- Added subcomponents for Title, Description, Actions, and Content to improve clarity and maintainability of page structures.
- Updated AGENTS.md to include guidelines on avoiding unnecessary destructuring of props for better code readability.

* feat(layout): refactor components to use SectionPageLayout for improved structure

- Replaced AppHeader and Main components with SectionPageLayout across multiple features including Channels, Dashboard, ApiKeys, Models, Redemption Codes, Usage Logs, Users, and Wallet.
- Enhanced page organization by utilizing SectionPageLayout's Title, Description, Actions, and Content subcomponents, improving clarity and maintainability.
- This update standardizes the layout structure across the application, facilitating a more cohesive user experience.

* feat(usage-logs): enhance URL state management and redirection logic

- Added useEffect to synchronize column filters with URL search changes, preventing infinite loops caused by inline references.
- Improved redirection logic in usage logs to clear 'type' from the URL when the section is not 'common', enhancing user experience and URL cleanliness.

* fix(usage-logs): disable global filter and update DataTableToolbar props

- Disabled the global filter in the UsageLogsTable component to streamline the user interface.
- Updated the DataTableToolbar component to accept a null customSearch prop, enhancing flexibility in toolbar configuration.

* feat(routes): implement section-based routing for system settings and dashboard

- Introduced section-based routing for system settings and dashboard features, enhancing navigation and organization.
- Updated route definitions to include dynamic sections, allowing for more granular access to settings and dashboard components.
- Refactored existing routes to redirect to default sections when no specific section is provided, improving user experience.
- Added new section routes for models, usage logs, and system settings, ensuring consistency across the application.
- Removed deprecated routes to streamline the routing structure and improve maintainability.

* refactor(usage-logs): update column helper functions to require config parameter

- Modified createFailReasonColumn and createProgressColumn functions to require a config parameter instead of allowing it to be optional.
- Simplified destructuring of config to enhance clarity and ensure necessary properties are always provided, improving code reliability.

* refactor(usage-logs): improve section ID validation and routing logic

- Introduced a type guard function, isUsageLogsSectionId, to validate section IDs, enhancing type safety and reducing the need for casting.
- Updated UsageLogsContent to utilize the new validation function for determining the active category, improving clarity and reliability.
- Refactored routing logic to use isUsageLogsSectionId for section validation, ensuring proper redirection to the default section when necessary.

* refactor(calendar): update locale documentation for i18n support

- Revised the locale prop documentation in the Calendar component to specify the use of react-day-picker for internationalization, clarifying the expected locale setup for users.

* chore(i18n): remove redundant user information description from locale files

- Removed the user information description from English, French, Japanese, Russian, Vietnamese, and Chinese locale files to streamline translations and improve clarity.

* chore(i18n): streamline locale files by removing redundant entries

- Removed unnecessary entries from English, French, Japanese, Russian, Vietnamese, and Chinese locale files to enhance clarity and reduce clutter.
- Adjusted translations for consistency and improved user experience across multiple languages.

* chore(sidebar): remove deprecated usage logs route from sidebar config

- Eliminated the '/usage-logs' entry from the sidebar configuration to streamline navigation and improve clarity in the sidebar structure.

* refactor(redemption-codes): enhance internationalization support and improve UI consistency

- Updated various components to utilize translation functions for user-facing strings, ensuring a consistent experience across different languages.
- Added meta labels for table columns to improve accessibility and clarity.
- Revised confirmation and action texts in dialogs and tooltips to leverage translation, enhancing user experience.
- Updated locale files to include new translations for improved clarity and consistency.

* feat(masked-value-display): add MaskedValueDisplay component for sensitive data handling

- Introduced a new MaskedValueDisplay component to display masked values with a popover for full value visibility and a copy button for easy access.
- Updated api-keys-columns and redemptions-columns to utilize the new component, enhancing code reusability and UI consistency.
- Revised translation keys in locale files to remove colons for improved clarity.

* refactor(url-utils): simplify query parameter matching logic in checkIsActive function

- Updated the checkIsActive function to streamline the logic for matching URLs with and without query parameters.
- Removed unnecessary checks for query parameters when matching base paths, improving clarity and maintainability of the code.

* fix(channels-table): update group filter label to use translation function

- Replaced hardcoded 'All Groups' label with a translation function call to enhance internationalization support in the ChannelsTable component.

* chore(api-keys): remove deprecated API key action messages and related exports

- Deleted the api-key-actions.ts file, which contained action messages for enabling, disabling, and deleting API keys.
- Updated index.ts to remove the export of getApiKeyActionMessage, streamlining the codebase by eliminating unused functionality.

* refactor(i18n): enhance internationalization support across various components

- Updated multiple components to utilize translation functions for user-facing strings, ensuring a consistent experience across different languages.
- Revised constants and labels in the channels and redemption codes features to use i18n keys, improving maintainability and clarity.
- Ensured that success and error messages leverage translation functions, enhancing user experience and accessibility.
- Streamlined the handling of i18n keys in the constants files for better organization and clarity.

* refactor(i18n): enhance translation support across various components

- Updated multiple components to utilize translation functions for user-facing strings, ensuring a consistent experience across different languages.
- Revised pagination and status labels to use i18n keys, improving maintainability and clarity.
- Enhanced response time formatting to support internationalization, allowing for localized display of time values.
- Updated locale files to include new translations for improved clarity and consistency.

* docs(AGENTS): add type checking requirement for TypeScript changes

- Included a new guideline stating that type checks must be executed after modifying TypeScript or TSX code, ensuring no type errors are left unresolved.
- Updated the document to reflect this addition in the relevant section for better clarity on coding standards.

* feat(combobox-input): add ComboboxInput component for enhanced token selection

- Introduced a new ComboboxInput component to facilitate token name selection with search and filtering capabilities.
- Integrated the ComboboxInput into the UsageLogsFilterDialog for improved user experience when filtering by token name.
- Updated locale files to include new translations for user-facing strings related to token filtering.

* feat(combobox): integrate translation support for custom value prompt

- Added translation functionality to the Combobox component, replacing hardcoded text with a translatable string for the custom value prompt.
- Utilized the useTranslation hook from react-i18next to enhance internationalization support, ensuring a consistent user experience across different languages.

* refactor(i18n): improve Chinese translations for consistency and clarity

- Adjusted spacing in various Chinese translations to enhance readability and maintain consistency across the locale file.
- Updated multiple user-facing strings to ensure proper formatting and alignment with localization standards.

* feat(calendar): add CalendarDropdown component for enhanced dropdown functionality

- Introduced a new CalendarDropdown component to improve user interaction with dropdown selections in the calendar.
- Implemented state management for dropdown visibility and selection handling, enhancing the overall user experience.
- Updated styling for dropdown elements to ensure consistency and better alignment with the UI design.

* fix(balance-query-dialog): handle null currentRow and improve usage query logic

- Updated the BalanceQueryDialog component to safely access currentRow properties using optional chaining.
- Added a check to ensure currentRow is not null before proceeding with usage queries, preventing potential runtime errors.
- Refactored the handleQueryCodexUsage function to use a local variable for currentRow, enhancing code clarity.

* feat(i18n): add new translations for batch creation and channel updates

- Added new translation strings for batch creation instructions across multiple languages, enhancing user guidance.
- Included translations for the "Update Channel" prompt to improve clarity in channel configuration settings.
- Ensured consistency in terminology across locale files for better user experience.

* feat(channel-mutate-drawer): improve API key input handling and update translations

- Refactored the API key input logic in the ChannelMutateDrawer component to enhance readability and maintainability.
- Added new placeholder translations for batch creation and existing key prompts in multiple languages, improving user guidance.
- Ensured consistency in translation strings across locale files for better user experience.

* feat(fetch-models-dialog): implement sorting for model categories

- Added a new function to sort model categories alphabetically, placing 'Other' at the end for easier navigation.
- Updated the rendering logic in the FetchModelsDialog component to utilize the new sorting function for both new and existing models, enhancing user experience.

* refactor(wallet-stats-card): standardize props usage and improve layout consistency

Standardizes props usage and improves layout consistency in wallet stats card

Refactors the wallet stats card component to:
- Use props directly instead of destructuring for consistency
- Add min-w-0 to prevent content overflow
- Adjust text sizing with break-all for proper wrapping
- Implement responsive font sizes (3xl on mobile, 4xl on larger screens)
- Improve leading and tracking for better readability

Refactor wallet stats card for consistency and layout

Standardizes props usage and improves layout consistency in wallet stats card

- Uses props directly instead of destructuring for consistency
- Adds min-w-0 to prevent content overflow
- Adjusts text sizing with break-all for proper wrapping
- Implements responsive font sizes (3xl on mobile, 4xl on larger screens)
- Improves leading and tracking for better readability

* feat(web): add subscription management and admin settings UI

* feat(web): add subscription management and admin settings UI

- Add subscription management module (plans, pricing, toggle status, and related dialogs/tables with Stripe/Creem integration notes)
- Add channel affinity (rules and cache stats), Waffo integration, performance, and Grok model sections to system settings, with extended types and section registry
- Add status code mapping validation/risk warnings, upstream update hooks, and utilities for channels; add available models and sidebar module cards to user profile
- Add chat2link route and useMinimumLoadingTime, useTableCompactMode shared hooks

Made-with: Cursor

* fix: remove duplicate GenerateOAuthCode and add missing TaskBulkUpdate

- remove duplicate GenerateOAuthCode from github.go since oauth.go already has the generic version.
- add model.TaskBulkUpdate for bulk update by upstream task_id strings, fixing task_video.go build failure.

* feat(router): add chat2link and subscriptions routes

- register /chat2link page route under authenticated layout.
- register /subscriptions/ page route under authenticated layout.
- update auto-generated routeTree type definitions and route mappings.

* feat(docker): add development environment setup with Docker Compose

- Introduced docker-compose.dev.yml for local development, including services for new-api, Redis, and PostgreSQL.
- Created Dockerfile.dev for backend-only builds, optimizing the development workflow.
- Updated makefile to include new commands for starting backend services and frontend development.

* feat(web): complete i18n coverage for setup wizard and add language switcher

- wrap all hardcoded English strings in setup-wizard, database-step, usage-mode-step, and complete-step with t() calls, covering step titles, descriptions, form validation messages, and fallback strings.
- add LanguageSwitcher component to the top-right corner of the setup page so users can switch language during initial setup.
- register 25 dynamic i18n keys in static-keys.ts and provide full translations for zh/en/ja/fr/ru/vi.

* feat(i18n): internationalize default version text in workspace-switcher

- remove hardcoded 'Unknown version' default, use t('Unknown version') for i18n fallback
- add "Unknown version" translation entries across all 6 locale files (zh/en/fr/ru/ja/vi)

* feat(i18n): add full i18n coverage for channel-affinity settings page

- replace Chinese t() keys with English keys across three channel-affinity components to align with new frontend i18n conventions.
- add 51 translation entries to all 6 locale files (en/zh/ja/fr/ru/vi) covering main page, rule editor, and cache stats dialog.
- register section-registry dynamic keys in static-keys.ts.

* feat(i18n): add full i18n coverage for Waffo payment settings page

- replace Chinese i18n keys with English keys in waffo-settings-section.tsx for consistency.
- wrap previously hardcoded labels (Pay Method Type / Pay Method Name) with t().
- add 26 Waffo-related translation entries across all 6 locale files (en/zh/fr/ru/ja/vi).

* feat(i18n): add missing translations for global model settings page

- add all 6 locale translations for 3 missing t() keys in global-settings-card.
- register dynamically used 'Grok' key in static-keys.ts for i18n scanner coverage.

* feat(i18n): add full i18n coverage for Grok model settings page

- add translations in all 6 locales (en/zh/fr/ja/ru/vi) for grok-settings-card t() calls.
- cover violation fee toggle, amount input, and official docs link labels.
- include section-registry descriptionKey translation entries.

* feat(i18n): add full i18n coverage for performance settings page

- migrate all t() keys from Chinese to English to align with project conventions.
- add translations for all 6 locales (en/zh/ja/fr/ru/vi) covering disk cache,
  system monitoring, log management, and stats dashboard sections.
- remove 71 obsolete Chinese-keyed entries from every locale file.

* fix(i18n): add 116 missing English translation keys across all locales

- scan all t() calls to identify English keys used in code but absent from locale files.
- add translations for zh/en/fr/ja/ru/vi, keeping key sets and sort order consistent.
- covers system-settings, channels, models, auth, wallet and other modules.

* fix(i18n): add missing translations for log cleanup quick-select and confirm dialog

- wrap quick-select button labels (24 hours ago / 7 days ago / 30 days ago) with t().
- replace hardcoded English strings in purge confirm dialog with t() calls and date interpolation.
- add 5 new translation keys across all 6 locale files (zh/en/fr/ja/ru/vi).

* refactor(web): unify all time display with dayjs formatting

- replace all toLocaleString/toLocaleDateString/toLocaleTimeString and manual padStart concatenation with dayjs.format().
- standardize output: datetime as YYYY-MM-DD HH:mm:ss, date as YYYY-MM-DD, time as HH:mm:ss.
- add formatDateTimeStr, formatDateStr, formatTimeStr dayjs-based helpers in lib/format.ts.
- update 12 files across core utils and feature components.

* refactor(web): replace native datetime-local input with DateTimePicker in announcements

- swap browser-native datetime-local for the project's DateTimePicker component to match the UI used in log cleanup and other pages.
- convert between Date objects and ISO strings to bridge the form's string-based schema.

* refactor(web): replace native HTML elements with design system components

- replace ~35 native <button> with <Button> across pricing, profile, channels modules
- replace native <input>/<textarea>/<label> with <Input>/<Textarea>/<Label> for consistent form styling
- replace native <table> with <Table> components, <details>/<summary> with <Collapsible>
- replace decorative <hr> with <Separator> to ensure global UI consistency

* refactor(web): enhance profile components with design system consistency

- update ProfileSecurityCard to use buttons for security actions, improving accessibility and styling.
- modify AccountBindingsTab layout to a grid for better responsiveness and visual alignment.
- refactor NotificationTab to utilize icons for notification methods, enhancing user experience and clarity.

* fix(i18n): complete i18n coverage for profile page components

- wrap passkey card status badges (enabled/disabled, backup state) and last-used text with t()
- fix hardcoded button labels in security dialogs (change password, access token, delete account)
- internationalize all 2FA dialog strings (setup, disable, backup codes)
- fix email bind dialog description and button state text missing i18n
- wrap remaining hardcoded strings in notification tab and checkin calendar
- add all missing translation entries to zh.json and en.json

* fix(i18n): enhance error messages with translations for deployment access and settings

- wrap connection error messages in DeploymentAccessGuard and IoNetDeploymentSettingsSection with t() for internationalization.
- add missing translation key for "io.net model deployment is not enabled or api key missing" in all locale files (en, fr, ja, ru, vi, zh).

* 🧹 chore(web): resolve all ESLint errors and warnings

Align the Vite/React frontend with the current ESLint flat config and
React Compiler–related rules by fixing violations instead of broad
suppression where practical.

- Replace `any` with concrete types (`unknown`, `Record<string, unknown>`,
  domain types) where upstream/API shapes allow
- Fix duplicate imports, unused bindings, `no-console`, and empty blocks
- Address react-hooks issues: reorder declarations, memoize unstable
  callbacks (`useCallback`), extend dependency arrays, and use targeted
  disables only where sync-from-props in `useEffect` is intentional
- Refactor `motion.create` usage in ai-elements shimmer to avoid creating
  components during render (static-components)
- Stabilize TanStack Query/Mutation hook usage (query keys, `mutate` in
  deps) and add narrowly scoped rule disables where the linter conflicts
  with library patterns
- Disable `react-hooks/incompatible-library` in ESLint config for
  TanStack Table / RHF false positives
- Add file-level `react-refresh/only-export-components` disables for
  registry/provider/column modules that intentionally mix exports

`bun lint` completes with 0 errors and 0 warnings.

* ✨ feat(web): add subscription management to sidebar and align drawer with project conventions

- Register "Subscription Management" nav item in the admin sidebar group
  with CreditCard icon pointing to /subscriptions
- Add subscription module to sidebar config defaults and URL mapping so it
  integrates with the admin sidebar modules toggle in system settings
- Add subscription entry to sidebar-modules-section moduleMeta for the
  maintenance settings UI
- Refactor SubscriptionsMutateDrawer to follow the same patterns used by
  users, redemption-codes, and other mutate drawers:
  - Use shadcn Form/FormField/FormItem/FormControl/FormLabel/FormMessage
    instead of raw register() + Label + manual error display
  - Move SheetFooter outside the form with form attribute association
  - Use SheetClose for the cancel button
  - Reset form state on drawer close
  - Align SheetContent width (sm:max-w-[600px]) and spacing conventions

* ✨ feat(web): overhaul UI/UX with Vercel Geist design alignment

Refactor the entire frontend UI/UX to align with Vercel/OpenAI design
principles, covering layout, animations, skeleton loading, and overall
visual polish.

Motion & Page Transitions:
- Add centralized motion system (lib/motion.ts) with Vercel-style
  transition presets, stagger variants for tables, cards, and sidebars
- Implement AnimatedOutlet for route-level page enter animations
  using TanStack Router pathname keying
- Add PageTransition, StaggerContainer, StaggerItem, CardStagger,
  and TableStagger wrapper components for progressive reveal effects

Skeleton Loading — Vercel Geist Style:
- Replace shadcn default `animate-pulse` with Geist-style shimmer
  sweep animation (linear-gradient + background-position keyframes)
- Add `--skeleton-base` / `--skeleton-highlight` CSS variables tuned
  for both light and dark themes with neutral oklch tones
- Override auto-skeleton-react inline styles via CSS to unify all
  skeleton elements under the same shimmer effect
- Update TableSkeleton with varied column widths for a natural feel
- Add ContentSkeleton and QuerySkeleton wrappers for auto-skeleton
  integration with React Query error/loading states
- Respect prefers-reduced-motion: disable shimmer for accessibility

Layout & Sidebar:
- Upgrade sidebar expand/collapse transitions to cubic-bezier easing
- Add hover micro-interactions (background-color, color, transform)
  to sidebar menu buttons with smooth 150ms transitions
- Fix oklch color compatibility in sidebar outline variant
- Integrate AnimatedOutlet into AuthenticatedLayout for unified
  route-level animations

Theme & CSS:
- Streamline theme.css with cleaner oklch color definitions
- Add CSS table row stagger-in animations with nth-child delays
- Fix hover-scrollbar color bug (hsl → color-mix for oklch compat)
- Add content-auto utility for long list rendering optimization

Cleanup:
- Remove deprecated skeleton-wrapper.tsx
- Remove unused imports and dead code across components
- Add empty-state, error-state, and loading-state utility components

* 🐛 fix(docker): track bun.lock to fix Docker build failure

Remove `web/bun.lock` from `.gitignore` so the lock file is committed
to version control. The Dockerfile `COPY web/bun.lock .` instruction
requires this file to be present in the build context, and ignoring it
caused the build to fail with a "not found" error.

* ⬆️ chore(web): upgrade dependencies and fix all type/lint errors

Upgrade all frontend dependencies to latest stable versions:
- lucide-react 0.562 → 1.7 (major: brand icons removed)
- shiki 3.x → 4.x, eslint 9.x → 10.x, knip 5.x → 6.x
- @rsbuild/core 1.3 → 1.7, @types/node 24 → 25
- tailwindcss/postcss 4.1 → 4.2, motion 12.25 → 12.38
- @tanstack/react-query 5.90 → 5.95, zod 4.3.5 → 4.3.6
- react 19.2.3 → 19.2.4, axios 1.13.2 → 1.13.6
- prettier 3.7 → 3.8, typescript-eslint 8.52 → 8.57
- Add missing optional deps: @xyflow/react, embla-carousel-react

Resolve all TypeScript compilation errors introduced by upgrades:
- Replace lucide-react brand icons (Github) with react-icons/si
- Fix react-hook-form Control/Resolver generics for zod v4
- Fix Record<string, unknown> type constraints across API utils
- Fix axios interceptor return types in lib/api.ts
- Add type assertions for useSettings/useStatus hook returns
- Resolve Badge variant, spread type, and route path mismatches

Resolve all ESLint 10 errors:
- preserve-caught-error: attach cause to re-thrown errors
- no-useless-assignment: refactor redundant variable assignments
- prefer-as-const: use `as const` over literal type assertions
- no-unused-vars: prefix type-only schemas with underscore

Update tsconfig lib from ES2020 to ES2022 for Error.cause support.

* 🐛 fix(web): stop pricing model row from centering its content

Wrapping the row in shadcn <Button variant='ghost'> inherits
`justify-center`, and the inner flex container had no width, so
`justify-between` collapsed and the row appeared centered.

* feat: add Waffo payment integration and related UI components

- Introduced Waffo payment method with support for custom icons and settings.
- Updated payment settings section to include Waffo settings.
- Added Waffo payment request handling in the wallet API.
- Enhanced wallet recharge form to support Waffo payment methods.
- Implemented hooks for Waffo payment processing.
- Updated localization files for new Waffo-related strings.
- Added new payment type and icon for Waffo in constants and UI components.
- Refactored topup info handling to include Waffo payment methods and configurations.

* feat(profile): add admin-only upstream model update notification setting

* fix(web): make sidebar module user settings actually take effect

Previously, saving sidebar module preferences in profile had no effect
because the client ignored user-level sidebar_modules entirely. This
fix wires user config into useSidebarConfig so the sidebar updates
immediately without a page refresh.

Changes:
- Add UserPermissions type with sidebar_settings/sidebar_modules fields
- Refactor useSidebarConfig to merge admin × user config with AND logic
- Sync sidebar_modules to auth store on save for immediate UI updates
- Conditionally render SidebarModulesCard based on user permissions
- Treat null/empty user config as "do not narrow" for legacy users

* feat(web): add custom OAuth provider CRUD and login button support

Migrate custom OAuth from v1 to v2:
- Admin CRUD UI with provider table, form dialog, preset templates, and OIDC discovery
- Login page renders dynamic buttons for custom OAuth providers
- Fix account bindings display showing "Not bound" text when already bound

* feat(web): add ServerAddress, SMTPForceAuthLogin, CreateCacheRatio and group special usable settings

Migrate missing v1 system settings to v2:
- ServerAddress input in General > System Information
- SMTPForceAuthLogin toggle in Integrations > Email
- CreateCacheRatio JSON editor in Models > Ratio
- Group special usable group rules editor in Models > Ratio

* feat(web): wire user subscriptions dialog to users table row actions

The UserSubscriptionsDialog component already existed but had no entry point
in the users table dropdown menu. Add "Manage Subscriptions" menu item.

* chore(web): update i18n translations for new settings and custom OAuth

* 💎 refactor(web): redesign pricing page with flat, typography-driven layout

* 🌐 chore(i18n): complete missing translations and normalize project config

- Add 425+ missing translations across fr, ja, ru, zh, vi locales
  for subscription management, sidebar navigation, Grok settings,
  upstream model updates, pricing page, and other UI components
- Add 37 missing i18n keys used in t() calls but absent from locale
  files (pricing filters, display options, audio/cache labels, etc.)
- Fix stale tech stack info in CLAUDE.md, AGENTS.md, and project.mdc:
  React 18 → 19, Vite → Rsbuild, Semi Design → Radix UI + Tailwind
- Fix i18n key format description: "Chinese source strings" → English
- Deduplicate .cursor/rules/project.mdc to avoid triple-loading the
  same rules already present in root CLAUDE.md and AGENTS.md
- Add i18n-translate Cursor skill for repeatable translation workflow

* 🎨 refactor(web): redesign dashboard with flat, typography-driven layout

Replace Card-based dashboard components with a flat, border-driven design
system consistent with the pricing page, following the ui-style.mdc conventions.

Overview section:
- StatCard: replace Card wrapper with flat flex layout, monospace tabular
  values, uppercase tracking-wider labels, layered opacity hierarchy
- PanelWrapper: replace Card/CardHeader/CardContent with rounded-lg border
  container and border-b header
- SummaryCards: merge three stat cards into a single bordered container
  with divide-x separators; decouple border from stagger animation to
  prevent border deformation during entrance transitions
- ApiInfoPanel/Item: full-width list rows with border-b separators,
  monospace route names, layered opacity for URLs and descriptions
- AnnouncementsPanel: native button rows with hover:bg-muted/40, i18n for
  "Click for details" hint
- FAQPanel: lighter border-border/60 accordion dividers, muted answer text
- UptimePanel: uppercase tracking-wider group headers with bg-muted/30
  background, monospace uptime percentages, fine-grained border opacity

Models section:
- LogStatCards: replace Card with rounded-lg border + divide-x grid,
  fix react-hooks/exhaustive-deps by destructuring props before useEffect
- ModelCharts: replace Card+Tabs with bordered container + custom
  segmented control matching ui-style spec
- Suspense fallbacks: match new flat skeleton layout with accurate
  column structure

Animation:
- Wrap models section in FadeIn with staggered delay
- Keep CardStagger for overview panel grid (each panel has own border)

Other:
- Add ui-style.mdc cursor rule documenting the design language
- Disable react-refresh/only-export-components for src/routes/** in
  eslint config (TanStack Router route files always export Route objects)
- Fix zh.json: "Token-based" translation "基于令牌的" → "按量计费"

* ✨ refactor(web): adopt flat dot-and-text design for all status badges

Replace the bordered/colored-background StatusBadge and Badge components
across the entire frontend with a minimal flat design: a small colored
dot followed by colored text, eliminating visual noise from heavy
borders, backgrounds, and rounded pill shapes.

Key changes:

- Redesign StatusBadge to use dot + text instead of bordered pill style,
  removing cva-based background/border variants in favor of exported
  dotColorMap and textColorMap lookup tables
- Add children prop support to StatusBadge for flexible content rendering
  alongside the existing label prop
- Migrate all Badge usages (except pricing page) to StatusBadge with
  appropriate variant mappings (default→info, secondary→neutral,
  outline→neutral, destructive→danger)
- Consolidate adjacent multi-badge groups into single-dot layouts with
  dot separators (·) to reduce visual clutter in:
  - Channel balance columns (used + remaining)
  - Channel type column (type + IO.NET indicator)
  - User invite info column (invited + revenue + inviter)
  - Usage log stats bar (usage + RPM + TPM)
  - Usage log time/FRT column (time + FRT + stream status)
  - Subscription plan counts (active + expired)
  - Channel affinity scope/regex/key-source columns
  - Prefill group card headers (type + ID)
- Export dotColorMap and textColorMap for direct use in custom inline
  layouts that need consistent status colors without the full component

* ✨ refactor(web): redesign public layout and landing page with modern UI

Overhaul the public-facing layout, header, and homepage to deliver a
polished, animation-rich landing experience inspired by contemporary
SaaS design patterns.

Header:
- Replace sticky header with fixed floating navbar that compacts into
  a pill-shaped glass-morphism bar on scroll (backdrop-blur + ring)
- Add smooth 700ms cubic-bezier transitions for scroll-based shrinking
- Build full-screen mobile menu overlay with staggered entry animations
- Remove background color from logo container, show logo image directly

Homepage sections:
- Hero: gradient text title, radial gradient + grid pattern background,
  interactive terminal demo showcasing API request/response
- Terminal demo: auto-cycles through gpt-4o, claude-sonnet-4-20250514,
  gemini-2.5-pro, deepseek-chat with smooth cross-fade transitions,
  clickable model badges, dual theme support (light/dark), fixed height
- Stats: animated counters driven by IntersectionObserver with
  cubic-bezier easing, supports integer and decimal modes
- Features: Bento grid layout with gap-px border technique, each card
  includes contextual visuals (model list, security badge, workflow)
- How It Works: new three-step process section (Configure → Connect →
  Monitor) with connecting gradient line and numbered badges
- CTA: gradient mesh background with scale-in scroll animation
- Footer: streamlined brand column + link columns layout

New components:
- AnimateInView: IntersectionObserver-based scroll animation component
  supporting fade-up, fade-in, scale-in, fade-left, fade-right
- HeroTerminalDemo: themed terminal with model carousel and live
  request/response preview

CSS:
- Add landing page scroll-triggered keyframe animations
- Add terminal demo animations (blink cursor, spinner, pulse indicator)
- Respect prefers-reduced-motion throughout

i18n:
- Add 17 new translation keys across all 6 locales (en/zh/fr/ja/ru/vi)

* ✨ feat(web): align usage logs and channels with legacy UI

Usage logs
- Show Refund (type 6) in detail dialog and hide conversion chain for refunds
- Sync filter dialog state from URL for model, token, group, username, and requestId

Channels
- Support optional stream flag in channel test API, actions, and test dialog
- Show upstream model update badges (+added / -removed) on fetchable channel types
- Add form fields and drawer toggles for upstream model update check and auto-sync
- Persist upstream model update flags in channel settings JSON for fetchable types

i18n
- Add locale strings for upstream model update UI (en, zh, fr, ja, ru, vi)

* 🐛 fix(web): prevent transient vertical scrollbar on tables during animations

Add overflow-y-clip to the shared Table container (data-slot=table-container)
alongside overflow-x-auto. Setting overflow-x to auto implicitly pairs with
overflow-y: auto in browsers, which made the table shell briefly show a
vertical scrollbar during route enter motion (y/blur) and table row stagger.

Remove the redundant descendant selector workaround from the model pricing
GroupPricingSection; behavior is now covered globally by the Table component.

* 🏗️ refactor(web): redesign console layout with fixed header, scrollable content, and pinned footer

Overhaul the authenticated console layout to match the OpenAI dashboard
pattern: header and page title bar stay fixed at the top, only the
content area scrolls, and table pagination is pinned to the bottom.

Layout architecture:
- Lock SidebarInset to full viewport height (h-svh) so all inner
  regions are controlled by flexbox instead of document scroll
- Convert Main from a generic div to a semantic <main> flex container
  with overflow-hidden, removing the legacy `fixed` prop and
  `data-layout` attribute
- Strip scroll-shadow logic and `fixed` prop from Header/AppHeader;
  the header is now naturally fixed as a shrink-0 flex child
- Restructure SectionPageLayout into three flex regions: a shrink-0
  title bar, a flex-1 overflow-auto content area, and a shrink-0
  footer portal target with empty:hidden
- Add min-h-0 to AnimatedOutlet wrappers to prevent flex overflow

Footer portal system:
- Introduce PageFooterProvider / PageFooterPortal (React Context +
  createPortal) so deeply nested table components can render their
  DataTablePagination into the fixed footer without prop drilling
- Migrate all 8 data tables (api-keys, channels, users, models,
  deployments, usage-logs, subscriptions, redemption-codes) to use
  PageFooterPortal for pagination

Page-level fixes:
- Profile: wrap content in a scrollable flex child with proper padding
- SystemSettings: remove overflow-auto from wrapper to avoid nested
  scrollbars (sub-pages manage their own scroll)
- Playground / Error pages: remove obsolete `fixed` props

API keys UX improvement:
- Replace inline key show/hide toggle with a Popover-based reveal,
  removing toggleKeyVisibility and keyVisibility state from the
  provider context

Cleanup:
- Remove dead CSS rule for body:has([data-layout='fixed'])
- Remove unused `fixed` prop from Header, AppHeader, and Main types
- Export PageFooterPortal from layout barrel file

* 💅 refactor(web): polish table UI consistency and add pagination transitions

- Standardize primary action buttons (Create, Add, Search) to size="sm"
  across all pages for visual consistency with channels and models
- Redesign NumericSpinnerInput with minimal inline style: plain text by
  default, hover-revealed +/- buttons, click-to-edit — replacing the
  clunky bordered input with stacked chevron arrows
- Fix vertical scrollbar in channels group column by replacing
  overflow-x-auto with overflow-hidden (redundant with +N collapse)
- Simplify API keys group column: replace colorful StatusBadge pairs
  with clean typography using opacity hierarchy and dot separators
- Move API key copy loading indicator from key text to the copy button
  itself, eliminating layout shift during key resolution
- Reduce page title from text-2xl to text-lg and subtitle to text-sm
  in SectionPageLayout for a more compact header
- Add smooth opacity transition (duration-150) on all 7 server-paginated
  tables during background data fetches (isFetching && !isLoading),
  with pointer-events-none to prevent interaction during loading
- Constrain usage logs Details column width (size: 200, maxSize: 220)

* 🐛 fix(web): restore missing padding on system settings content

The console layout refactor in d2150469 moved padding ownership from
Main onto each route, but SystemSettings was missed — its Outlet
wrapper had no padding, so the content area sat flush against the
sidebar and top nav. Add `px-4 pt-6 pb-4` to match the vertical
rhythm used by SectionPageLayout and the Profile page.

* 📱 refactor(web): standardize mobile responsive layout across all table pages

Unify mobile experience for all data table pages (channels, keys, models,
deployments, usage-logs, users, redemption-codes, subscriptions) with a
consistent layout pattern and cleaner header area.

DataTableToolbar:
- Redesign mobile layout: full-width search input + collapsible filter
  toggle button with active filter count badge
- Filters, additional search, and reset button collapse into an
  expandable section on mobile, keeping the default view compact
- Desktop layout remains unchanged

SectionPageLayout:
- Tighten mobile spacing (padding, gaps) for higher content density
- Scale down title (text-base) and description (text-xs) on mobile
- Shrink action button gaps on small screens

ChannelsPrimaryButtons:
- Move Tag Mode and Sort by ID toggles into the "More" dropdown on
  mobile (via DropdownMenuCheckboxItem), freeing header space
- Desktop toggle switches remain visible outside the dropdown

MobileCardList (shared component):
- Compact list-item layout with title + badge header row and
  side-by-side key fields, replacing individual card components
- Structured (CompactRow) and fallback (FallbackRow) rendering modes
  driven by column meta (mobileTitle, mobileBadge, mobileHidden)

New MobileCardList integration:
- Users table: username as title, status as badge; hide id,
  display_name, invite_info on mobile
- Redemptions table: name as title, status as badge; hide id,
  created_time, expired_time, used_user_id on mobile
- Subscriptions table: plan title as title, enabled as badge; hide id,
  sort_order, reset, payment, total_amount, upgrade_group on mobile

Column meta updates:
- Add mobileTitle/mobileBadge/mobileHidden meta across all 8 table
  column definitions for consistent mobile field prioritization

Minor fixes:
- Hide Subscriptions Stripe/Creem alert on mobile
- Disable card hover animations on mobile via CSS media query

* 🐛 fix(web): sync favicon with custom system logo

Favicon stayed at the hardcoded /logo.png while document.title already
followed system_name, leaving tab icon and site branding out of sync.
Apply the logo as favicon from localStorage cache on startup, refresh
from getStatus(), and re-apply when useSystemConfig finishes preloading.
Extract applyFaviconToDom helper into lib/dom-utils with idempotent guard
to avoid redundant DOM writes.

* ✨ feat(web): add channel affinity rule templates and CreateCacheRatio visual editing

Port missing features from legacy frontend (b8650b9 merge) to the new
React frontend:

- Add Codex CLI and Claude CLI channel affinity rule templates with
  header passthrough presets (pass_headers operations for Originator,
  Session_id, X-Codex-*, X-Stainless-*, Anthropic-*, etc.)
- Introduce "Add Rule" dropdown menu with blank, Codex CLI, and Claude
  CLI template options in the channel affinity settings page
- Add "Fill Templates" button to batch-append both CLI templates with
  duplicate name resolution and confirmation dialog
- Support templateKey prop in RuleEditorDialog to pre-fill form fields
  from selected template, auto-expanding advanced settings when a
  param_override_template is present
- Add CreateCacheRatio support to the model ratio visual editor, edit
  dialog, and form — previously only editable in JSON mode, now fully
  integrated into the visual table column, add/edit dialog fields, and
  save/delete handlers

* 🐛 fix(web): fix content-type detection bugs in About and Home pages

- Fix About page URL detection: replace naive `startsWith('https://')`
  with proper `new URL()` validation to support both http and https, and
  handle untrimmed input that previously caused silent misdetection
- Fix About page HTML detection: remove overly broad `startsWith('<')`
  and `endsWith('>')` checks that could misclassify Markdown or XML
  content; align with LegalDocument's regex-only `isLikelyHtml` approach
- Fix Home page URL detection: same `startsWith('https://')` bug,
  replaced with `new URL()` protocol validation
- Refactor About page to use early-return pattern instead of deeply
  nested ternary expressions for better readability
- Replace About loading spinner with Skeleton placeholder consistent
  with LegalDocument
- Add `prose prose-neutral dark:prose-invert` typography classes to
  About HTML/Markdown rendering for proper dark mode support
- Remove unused `Code` icon import from About page

* ✨ feat(web): port missing features from legacy frontend and complete i18n

Backport and enhance several features from the old frontend (web/old)
that were missing or incomplete in the new React frontend:

- Playground & channel test: parse structured JSON error responses from
  SSE streams and non-streaming API calls, extract error codes, and
  display actionable UI for `model_price_error` (admin settings link)
- User management: replace local quota manipulation with atomic
  server-side quota adjustments (add/subtract/override) via dedicated
  API endpoint, making the quota field read-only in the edit drawer
- Subscriptions: display next quota reset time for active subscriptions
- Dashboard: limit model ranking chart to top 20 models with an "Other"
  bucket, add dimension tooltips with sorted values and totals to model
  call trend and user consumption trend charts
- i18n: add 24 new translation keys across all 6 locales (en, zh, fr,
  ja, ru, vi) for the newly introduced UI elements and messages

* 🎨 feat: add backend-configurable frontend theme switching (default/classic)

Introduce runtime frontend theme switching so administrators can switch
between the new frontend (Radix UI + Tailwind) and the classic frontend
(Semi Design) from the settings page without restarting the server.

Directory restructuring:
- Move new frontend from web/ to web/default/
- Move classic frontend from web/old/ to web/classic/
- One-frontend-per-folder layout for extensibility

Backend (injection pattern):
- Add setting/system_setting/theme.go with GlobalConfig.Register("theme")
  so the DB key "theme.frontend" is handled automatically by
  handleConfigUpdate — no switch-case in updateOptionMap needed
- Use atomic.Value in common.GetTheme()/SetTheme() for lock-free
  concurrent reads on the hot path (static file middleware)
- Add themeAwareFileSystem that delegates to the correct embedded FS
  based on the current theme at request time
- Embed both frontends into the binary via go:embed
- Add controller validation for theme.frontend values
- Expose theme in GET /api/status response

Frontend settings UI:
- New frontend: add "Frontend Theme" select in System Information section
  using Radix UI Select + react-hook-form + Zod validation
- Classic frontend: add "前端主题" select in Personalization section
  using Semi Design Form.Select

Build system:
- Update Dockerfile with multi-stage builds for both frontends
- Update Makefile with separate build targets for each frontend
- Update GitHub Actions release workflow for dual frontend builds

i18n:
- New frontend: add translations for all 6 locales (en/zh/fr/ja/ru/vi)
- Classic frontend: add translations for all 7 locales (en/zh-TW/ja/fr/ru/vi)
- Fix zh "AI Proxy Library" → "AI 代理库"

Documentation:
- Update CLAUDE.md, AGENTS.md, .cursor/rules/project.mdc to reflect
  the new web/default/ and web/classic/ directory structure

* ✨ feat(web): add allow_speed passthrough for Claude channels, fix multi-key index and inference_geo scope

- Add `allow_speed` toggle for Anthropic (type 14) channels to control
  Claude inference speed mode passthrough, with full form schema,
  settings persistence, and UI switch
- Fix `allow_inference_geo` to also apply to Anthropic (type 14) channels,
  not just OpenAI (type 1), matching the backend behavior for Claude data
  residency region control
- Fix multi-key management dialog to display 1-based key indices instead
  of 0-based (#{key.index + 1})
- Fix TypeScript type error in section-registry by adding type assertion
  for theme.frontend enum
- Add i18n translations for all new keys across 6 locales (en, zh, fr,
  ja, ru, vi)

* 🧹 chore: clean up editor configs, consolidate agent skills, and set classic as default theme

- Add .cursor/ to .gitignore and remove tracked editor config files
  (.cursor/rules/, .cursor/skills/) from version control
- Consolidate .agents/skills/vercel-react-best-practices by keeping only
  the compiled AGENTS.md and removing redundant SKILL.md and 57 individual
  rule files under rules/
- Change default frontend theme from "default" to "classic" in both
  common/constants.go init and setting/system_setting/theme.go

* feat: Frontend Tiered Pricing, Waffo Payments, and Rsbuild 2 Upgrade (#24)

* feat(ui): add codex extra limits, key last used, and admin audit surfaces

- codex usage dialog: render `additional_rate_limits` with `RateLimitGroupSection` and typed base/secondary window data.
- api keys table: add "Last Used" column from `accessed_time`.
- usage log details: show top-up audit and manage operator for admins; extend `LogOtherData` audit fields; broaden IP display; warn when legacy records lack audit data.
- billing history: show user id badge for admins; add zh i18n for new strings.

* feat(web): add dynamic pricing breakdown and Waffo Pancake payments

- add billing-expr parsing and DynamicPricingBreakdown; surface tiered_expr in model list/details.
- extend PricingModel with billing_mode, billing_expr, and pricing_version for backend parity.
- add Waffo Pancake integration settings, amount/pay APIs, hook, and recharge flow wiring.
- update payment confirm/recharge UI and Chinese locale strings.

* feat(pricing): add tiered billing editor and tool price settings

- introduce tier-expr and extend billing-expr (time/param conditions, combine/split helpers, editor utilities) for visual tiers and request rules.
- support tiered_expr in model ratio dialog, form, and visual editor with billing_setting fields and default JSON placeholders.
- add TieredPricingEditor and tool price settings UI plus i18n updates.

* chore(web): bump rsbuild to v2 and align build config

- upgrade @rsbuild/core, @rsbuild/plugin-react, and Rspack 2 transitives; bump TanStack Router packages and refresh bun.lock.
- replace deprecated performance.chunkSplit with top-level splitChunks cache groups for react, radix, and tanstack vendors.
- factor dev server proxy into devProxy; set legalComments to none in prod; enable performance.buildCache keyed by VITE_REACT_APP_VERSION.
- TanStack Router plugin: enable autoCodeSplitting only in production for faster dev navigation and HMR.

* fix(i18n): update translations for API keys and Waffo Pancake settings

- Corrected translations for "API Private Key" and "Merchant ID is required" across multiple languages.
- Added new translation for "Configure Waffo Pancake hosted checkout integration for USD-priced top-ups."
- Updated various existing translations to ensure consistency and clarity in user interface text.

* refactor(code-block): simplify code highlighting and improve theme handling

- Updated the highlightCode function to support dual themes in a single call, reducing complexity.
- Removed unnecessary state management for dark theme HTML, streamlining the component.
- Enhanced CSS for Shiki themes to ensure proper token color application in dark mode.

* refactor(wallet): use isWaffoPancakePayment for pancake payment dispatch

- replace the waffo_pancake string literal with the shared helper for consistency with use-payment and PAYMENT_TYPES.
- centralize the value so a constant change does not require hunting for typos in multiple call sites.

* fix(wallet): validate waffo pancake checkout url and safe open

- allow only parseable http/https redirect targets from the backend, rejecting dangerous schemes.
- pass noopener and noreferrer in window.open to reduce reverse tabnabbing.
- show a toast and abort on invalid URLs; add i18n entries across locales.

* fix(wallet): harden payment icon image URLs

- add normalizeHttpIconUrl to allow only http(s) after resolution and reject userinfo in URLs.
- set referrerPolicy, lazy loading, and async decode on the icon <img> to cut referrer leakage.
- fall back to built-in icons on invalid URLs, same as when iconUrl is missing.

* fix(pricing): label param() conditions as body param in dynamic pricing

- non-header request rules map to `param()`, not query strings.
- align with tiered pricing editor by using the existing `Body param` string.

* fix(rsbuild): update legalComments handling in build config

- Rely on Rsbuild's default legalComments setting in all modes to ensure compliance with open-source licensing requirements.
- Clarified comments to explain the implications of omitting legalComments in production.

* fix(i18n): correct billing and codex UI strings in locale files

- restore ~83 en.json values to English (tool pricing, audit text, alipay label, etc.).
- add proper fr/ru/vi/ja strings so those locales no longer copy zh.
- change five locale files only; zh.json unchanged.

* fix(i18n): update locale files for improved translations and sync report

- Added missing translations and corrected existing strings in English, French, Japanese, Russian, Vietnamese, and Chinese locale files.
- Updated the sync report to reflect zero missing translations across multiple locales.
- Enhanced the untranslated count for Japanese locale to ensure completeness.
- Changed the base locale from zh.json to en.json for better alignment.

* chore(agents): add i18n-translate agent skill

- add `.agents/skills/i18n-translate/SKILL.md` documenting locale layout under `web/default` and
  `bun run i18n:sync` usage.
- capture a repeatable maintainer workflow with embedded script examples to find missing keys
  and untranslated values.
- give agents a clear path to complete and verify translations across en, zh, fr, ja, ru, and vi.

* feat(settings): hide frontend theme setting (#25)

* feat(settings): hide frontend theme setting

- add a local hidden feature flag with window.newapiUnlock support.
- hide the frontend theme option by default and reveal it immediately after unlock.

* feat(settings): support click unlock for frontend theme setting

- add a shared hidden click unlock hook for repeated-click gated UI.
- reveal the frontend theme option after triple-clicking the system information title.
- preserve the Doubao API address ten-click unlock behavior and remove global unlock functions.

* feat(sync 59337e9): Sync classic tiered billing, upstream price synchronization, and model management features to web/default (#26)

* feat(skill): add classic-to-default-sync skill for auditing and syncing web/classic changes to web/default

- Introduced a new skill to inspect a given commit's changes in web/classic and synchronize features and fixes to web/default.
- Documented workflow steps for extracting diffs, mapping changes, triaging, implementing, and reporting on the synchronization process.
- Emphasized quality standards and internationalization considerations for new user-visible strings.

* feat(web/default): sync billing and model management features from classic

- add `len` condition variable (total input context length); introduce
  BILLING_PRICING_VARS / BILLING_CONDITION_VARS to separate pricing vars
  from condition-only vars; fix tier condition regex to accept `len`.
- rewrite upstream ratio sync components to support per-model grouped
  rows and new ratio types (create_cache, image, audio, billing_expr).
- add LlmPromptHelper component; update tiered presets to use `len` for
  conditions; add GLM-4.5 Air, Doubao Seed 1.8, Qwen3 Omni Flash, and
  weekend-discount presets.
- add created_at / last_login_at columns to users table; add "Removed
  Models" tab to FetchModelsDialog for mapping source keys not in the
  models list.
- add extractMappingSourceModels helper; update dynamic-pricing-breakdown
  to use system currency settings; add 19 i18n keys across all locales.

* ✨ feat(default): surface tiered billing in usage logs and gate Passkey ops behind 2FA

Continues the classic-to-default sync (commit 1be6cdb) by porting the
remaining audit-log, pricing-hint, and Passkey lifecycle features from
web/classic to web/default using the default frontend's component
patterns (Radix UI, Tailwind, shadcn-style dialogs).

* feat(usage-logs): show tiered_expr breakdown and matched tier in details

  - Extend `LogOtherData` with `billing_mode`, `expr_b64`, and
    `matched_tier` fields populated by the backend for tiered logs.
  - Add `decodeBillingExprB64`, `resolveMatchedTier`, and
    `getTieredBillingSummary` helpers in `usage-logs/lib/format.ts` that
    centralise tiered-billing parsing on top of the canonical
    `parseTiersFromExpr` / `BILLING_PRICING_VARS` from the pricing
    feature, instead of duplicating the classic-frontend renderer.
  - Render `<DynamicPricingBreakdown>` inside the consume-log details
    dialog with the matched tier row highlighted in emerald and tagged
    "Matched"; suppress the legacy claude/audio/image cost rows when a
    tiered expression is in effect.
  - Surface per-tier prices and the matched tier label in log row
    segments and the billing breakdown table.

* feat(pricing): show tier-count, time-based, and request-based hints in model list

  - Add `summarizeTieredExpr` that derives compact dynamic-pricing
    metadata (tier count + presence of time/request conditions) from a
    `tiered_expr` model, computed once per render via `useMemo`, so
    users can tell *what kind* of dynamic pricing applies before
    drilling into the model details.
  - Render the hints alongside the existing "Dynamic Pricing" badge in
    `<ModelRow>`.
  - Extend `<DynamicPricingBreakdown>` with a `matchedTierLabel` prop so
    the same component can be reused from the usage-log details dialog
    to highlight the tier that actually fired.

* feat(profile): require Security Verification for Passkey register/remove

  - Wire `usePasskeyManagement` through `useSecureVerification` and
    `<SecureVerificationDialog>` in `<PasskeyCard>`.
  - Registration prompts for 2FA before issuing the Passkey credential
    (only when 2FA is already enabled — otherwise the browser-level
    Passkey prompt itself acts as proof of presence and we register
    directly).
  - Removal prompts for 2FA or Passkey, whichever the account has
    enabled, with informative toasts when neither method is available
    or the device lacks Passkey support.
  - Scope the dialog method set to the required factor so users cannot
    fall back to a weaker method, and propagate cancellation cleanly.

* refactor: tighten upstream-ratio-sync and fix tier editor narrowing

  - Drop the unused `hasSynced` state and dead `getOrderedRatioTypes` /
    `isSelectableUpstreamValue` imports from `upstream-ratio-sync.tsx`.
  - In the cost estimator, narrow `BILLING_EXTRA_VARS` entries with a
    null-`field` guard to silence the type checker and make the
    "pricing variables only" contract explicit.
  - Apply Prettier-consistent formatting to the upstream-ratio-sync
    table/columns, channel mutate drawer, system info section,
    tier-expr, and wallet helpers (no behaviour change).

* i18n: add 9 keys across en/zh/fr/ja/ru/vi

  - `{{count}} tiers`, `Billing Process`, `Matched`, `Matched Tier`,
    `Request-based`, `Security verification`, `Time-based`, plus the
    two new Passkey verification description strings.

* 🔧 refactor(default): align upstream price sync, tiered billing, and fetch-models with classic 59337e9

Port and optimize the remaining web/classic features from commit 59337e9 to web/default,
covering upstream price synchronization, tiered billing expressions, model fetching, and
channel preset detection. Improve component architecture, memoization, and i18n coverage.

Upstream Price Sync
- Extend sync to all ratio fields: CacheRatio, CreateCacheRatio, ImageRatio,
  AudioRatio, AudioCompletionRatio in addition to ModelRatio / CompletionRatio
  / ModelPrice
- Add tiered billing sync (billing_mode + billing_expr) with auto-pairing so
  selecting one upstream tier value populates the other from the same source
- Bulk select / unselect per upstream column with indeterminate checkbox state
  reflecting partial selection
- Confidence indicators warn when an upstream entry is heuristically derived
- Conflict confirm dialog gains loading state and disables actions during sync
- Default endpoint per channel: /api/pricing for official preset,
  /api/models.dev for the models.dev preset, /api/v1/models for OpenRouter,
  with the rest falling back to the global default
- Rename tab label from "Upstream sync" to "Upstream price sync" for clarity

Tiered Pricing Editor
- Add `len` (full input length, including cache hits) as a tier-condition
  variable to avoid mis-routing when cache hits reduce `p`
- When inserting a new tier, automatically convert the previous catch-all into
  a bounded tier with a `len <= X` upper bound
- Cap each tier at 0~2 conditions and disable the add-condition button at the
  limit, with an Alert explaining the recommended `len` usage
- Extend presets with Multimodal (img / img_o / ai / ao), Request rule
  (header/param matching), and Time-based (hour / weekday) entries
- Embed an LLM prompt helper that copies a model-aware template for designing
  expressions with ChatGPT / Claude

Fetch Models Dialog
- Add a "Removed Models" tab listing models still in the local selection but
  no longer returned by the upstream listing
- Exclude `model_mapping` source keys from the removed view so aliases never
  appear as missing entries
- Force-remount tab content on tab switch via `key` prop to clear stale state
- Switch count placeholders to `{{count}}` interpolation across "Existing
  Models", "New Models", and "Removed Models" labels

Channel Selector & Constants
- Recognize the models.dev preset (id, base_url, name) alongside the existing
  official-channel preset detection
- Add MODELS_DEV_PRESET_* and OPENROUTER_* constants and reorder
  ENDPOINT_OPTIONS so `pricing` is preferred over `ratio_config`
- Expose the new ratio types in RATIO_TYPE_OPTIONS for the sync filter

Types
- Add optional `type` field to UpstreamChannel for endpoint inference
- Extend RatioType union with create_cache_ratio, image_ratio, audio_ratio,
  audio_completion_ratio, billing_mode, and billing_expr

Code Quality & Performance
- Extract upstream-ratio-sync-helpers.ts to host shared types
  (RatioDifferenceEntry, ModelRow, ResolutionsMap), field ordering
  (RATIO_SYNC_FIELDS, SYNC_FIELD_ORDER, NUMERIC_SYNC_FIELDS), and selection
  logic (getPreferredSyncField, isSelectableUpstreamValue, getSyncFieldLabel)
- Memoize the column definitions in useUpstreamRatioSyncColumns and pull the
  per-cell rendering into a renderUpstreamValue helper to remove inline IIFEs
- Wrap handleBulkSelect / handleBulkUnselect in useCallback for stable refs;
  rename the misleading `_upstream` parameter to `upstream`
- Convert parsedRatios from useCallback (returning a function) to useMemo
  (returning the value) and update all call sites to read it as a value
- Memoize the channels list with useMemo so the endpoint-init effect no
  longer fires on every render due to a fresh `?? []` reference

i18n
- Add and translate new keys ("Upstream price sync", "Audio Ratio", "Audio
  Completion Ratio", "Cache Create Ratio", "Image Ratio", "Expression
  Billing", "Fixed Price", "{{n}} model(s) selected", tier guidance, etc.)
  across en, zh, fr, ja, ru, vi
- Fix truncated keys ("Existing Models (", "New Models (", "Removed Models (")
  to proper {{count}} interpolated forms in every locale
- bun run i18n:sync reports 0 missing and 0 extra keys for every locale

Verification
- bun run typecheck: pass
- bun run lint: pass
- bun run i18n:sync: pass (0 missing / 0 extras across all locales)

* 🐛 fix(default): port classic 73e5557 tiered-billing fixes and dedupe Title-Case ratio i18n keys

Sync the web/classic frontend fixes from upstream merge 73e5557 to
web/default, and clean up duplicated Title-Case ratio labels in the
upstream sync UI that were shadowing the canonical sentence-case i18n
keys.

Cache-token filter for tiered model price (port of 9f8a4ec05)
- The matched-tier breakdown shown in the usage-log details dialog
  and in the log table previously listed every cache-related price
  (Cache Read, Cache Write, Cache Write 1h) regardless of whether
  the request actually consumed cache tokens.
- `getTieredBillingSummary` in `usage-logs/lib/format.ts` now skips
  `cache`-group vars when none of `cache_tokens`,
  `cache_creation_tokens`, `cache_creation_tokens_5m`, or
  `cache_creation_tokens_1h` are positive, mirroring the classic
  `renderTieredModelPrice` / `renderTieredModelPriceSimple` logic.
- Extract `hasAnyCacheTokens(other)` as an exported helper so the
  predicate is defined once.
- Add a `hideCacheColumns?: boolean` prop to
  `DynamicPricingBreakdown` and wire it up from the log details
  dialog so the full tier table hides cache columns under the same
  condition. `model-details.tsx` keeps the default (show all
  configured prices), since that view represents the model's
  pricing structure rather than a specific call.

`tiered_expr` ratio/price fallback during sync delays (port of bee339d27)
- When saving a model in tiered-expression mode, the visual editor
  used to delete every ratio/price map entry for the model and only
  write `billing_setting.billing_mode` /
  `billing_setting.billing_expr`. In multi-instance deployments,
  instances that had not yet observed the billing_setting update
  fell back to ratios that no longer existed, breaking pricing.
- `model-ratio-dialog.tsx`: `handleSubmit` always passes every form
  field (`price`, `ratio`, `cacheRatio`, `createCacheRatio`,
  `completionRatio`, `imageRatio`, `audioRatio`,
  `audioCompletionRatio`) into the data object regardless of
  `pricingMode`, so a switch from per-token to tiered_expr no
  longer drops the previously entered ratios.
- `model-ratio-visual-editor.tsx`:
  - The row builder now also surfaces ratio/price values for
    `tiered_expr` rows, so they survive the edit-and-save round
    trip and the next save.
  - `handleSave` factors out a `setIfPresent` helper and persists
    ratio/price entries for `tiered_expr` models alongside
    billing_mode / billing_expr. These act purely as fallback
    because the backend's `ModelPriceHelper` checks `billing_mode`
    first.
  - Cell rendering mutes ratio/price values whenever the row is
    `tiered_expr` (in addition to the existing per-request
    muting), making it visually clear the values are fallback,
    not the active pricing source.

i18n: dedupe Title-Case ratio labels in upstream sync
- `upstream-ratio-sync` `RATIO_TYPE_OPTIONS` previously used
  Title-Case labels (`Model Ratio`, `Cache Ratio`, `Audio
  Completion Ratio`, …) that were rendered through `t()` but never
  existed as canonical keys in the catalogue. The form-field side
  has used sentence-case (`Model ratio`, `Cache ratio`, …) for
  some time, leaving two parallel translation entries per ratio
  type and causing the upstream sync UI to fall back to the
  English source string in zh/ja/ru/fr/vi.
- Rewrite `RATIO_TYPE_OPTIONS` in
  `system-settings/models/constants.ts` and the conflict-detection
  labels in `upstream-ratio-sync.tsx` to reuse the sentence-case
  keys.
- Drop the duplicate Title-Case entries from every locale and
  promote the better translations onto the surviving sentence-case
  keys (e.g. zh `Image ratio` keeps "图片倍率", `Audio completion
  ratio` keeps "音频补全倍率").
- Add a comment to `RATIO_TYPE_OPTIONS` warning future
  contributors not to switch back to Title Case without updating
  the catalogue.

Note on backend fix 4e93148d9
- The backend portion of the merge (allocating a fresh map in
  `updateConfigFromMap` so removed keys are properly cleared) is
  already on HEAD; no additional change is needed.

Verification
- `bun run typecheck`: pass
- `bun run lint`: pass
- `bun run i18n:sync`: 0 missing / 0 extras across
  en / zh / fr / ja / ru / vi

---------

Co-authored-by: Seefs <40468931+seefs001@users.noreply.github.com>
Co-authored-by: Seefs <i@seefs.me>
Co-authored-by: feitianbubu <feitianbubu@qq.com>
Co-authored-by: Calcium-Ion <i@caion.me>
Co-authored-by: Xyfacai <xyfacai@gmail.com>
Co-authored-by: xiangsx <1984871009@qq.com>
Co-authored-by: 郑伯涛 <351175318@qq.com>
Co-authored-by: RedwindA <austinaosid@gmail.com>
Co-authored-by: dean <1006393151@qq.com>
Co-authored-by: QuentinHsu <xuquentinyang@gmail.com>
Co-authored-by: Bliod <bliod@bliod.lan>
Co-authored-by: Apple\Apple <zeraturing@foxmail.com>

web/default/src/features/system-settings/auth/basic-auth-section.tsx

@@ -0,0 +1,259 @@
+import { useMemo } from 'react'
+import * as z from 'zod'
+import { useForm } from 'react-hook-form'
+import { zodResolver } from '@hookform/resolvers/zod'
+import { useTranslation } from 'react-i18next'
+import { Button } from '@/components/ui/button'
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '@/components/ui/form'
+import { Switch } from '@/components/ui/switch'
+import { Textarea } from '@/components/ui/textarea'
+import { SettingsSection } from '../components/settings-section'
+import { useResetForm } from '../hooks/use-reset-form'
+import { useUpdateOption } from '../hooks/use-update-option'
+
+const basicAuthSchema = z.object({
+  PasswordLoginEnabled: z.boolean(),
+  PasswordRegisterEnabled: z.boolean(),
+  EmailVerificationEnabled: z.boolean(),
+  RegisterEnabled: z.boolean(),
+  EmailDomainRestrictionEnabled: z.boolean(),
+  EmailAliasRestrictionEnabled: z.boolean(),
+  EmailDomainWhitelist: z.string(),
+})
+
+type BasicAuthFormValues = z.infer<typeof basicAuthSchema>
+
+type BasicAuthSectionProps = {
+  defaultValues: BasicAuthFormValues
+}
+
+export function BasicAuthSection({ defaultValues }: BasicAuthSectionProps) {
+  const { t } = useTranslation()
+  const updateOption = useUpdateOption()
+
+  const formDefaults = useMemo<BasicAuthFormValues>(
+    () => ({
+      ...defaultValues,
+      EmailDomainWhitelist: defaultValues.EmailDomainWhitelist.split(',')
+        .map((domain) => domain.trim())
+        .filter(Boolean)
+        .join('\n'),
+    }),
+    [defaultValues]
+  )
+
+  const form = useForm<BasicAuthFormValues>({
+    resolver: zodResolver(basicAuthSchema),
+    defaultValues: formDefaults,
+  })
+
+  useResetForm(form, formDefaults)
+
+  const onSubmit = async (data: BasicAuthFormValues) => {
+    const updates: Array<{ key: string; value: string | boolean }> = []
+
+    Object.entries(data).forEach(([key, value]) => {
+      if (key === 'EmailDomainWhitelist') {
+        if (typeof value !== 'string') return
+        const domains = value
+          .split('\n')
+          .map((domain) => domain.trim())
+          .filter(Boolean)
+          .join(',')
+        if (domains !== defaultValues.EmailDomainWhitelist) {
+          updates.push({ key, value: domains })
+        }
+      } else if (value !== defaultValues[key as keyof typeof defaultValues]) {
+        updates.push({ key, value })
+      }
+    })
+
+    for (const update of updates) {
+      await updateOption.mutateAsync(update)
+    }
+  }
+
+  return (
+    <SettingsSection
+      title={t('Basic Authentication')}
+      description={t('Configure password-based login and registration')}
+    >
+      <Form {...form}>
+        <form onSubmit={form.handleSubmit(onSubmit)} className='space-y-6'>
+          <FormField
+            control={form.control}
+            name='PasswordLoginEnabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Password Login')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t('Allow users to log in with password')}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='RegisterEnabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Registration Enabled')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t('Allow new users to register')}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='PasswordRegisterEnabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Password Registration')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t('Allow registration with password')}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='EmailVerificationEnabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Email Verification')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t('Require email verification for new accounts')}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='EmailDomainRestrictionEnabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Email Domain Restriction')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t('Only allow specific email domains')}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='EmailAliasRestrictionEnabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Email Alias Restriction')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t('Block email aliases (e.g., user+alias@domain.com)')}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='EmailDomainWhitelist'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('Email Domain Whitelist')}</FormLabel>
+                <FormControl>
+                  <Textarea
+                    placeholder={t('example.com&#10;company.com')}
+                    rows={4}
+                    {...field}
+                  />
+                </FormControl>
+                <FormDescription>
+                  {t(
+                    'One domain per line (only used when domain restriction is enabled)'
+                  )}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <Button type='submit' disabled={updateOption.isPending}>
+            {updateOption.isPending ? t('Saving...') : t('Save Changes')}
+          </Button>
+        </form>
+      </Form>
+    </SettingsSection>
+  )
+}

web/default/src/features/system-settings/auth/bot-protection-section.tsx

@@ -0,0 +1,141 @@
+import { useEffect } from 'react'
+import * as z from 'zod'
+import { useForm } from 'react-hook-form'
+import { zodResolver } from '@hookform/resolvers/zod'
+import { useTranslation } from 'react-i18next'
+import { Button } from '@/components/ui/button'
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '@/components/ui/form'
+import { Input } from '@/components/ui/input'
+import { Switch } from '@/components/ui/switch'
+import { SettingsSection } from '../components/settings-section'
+import { useUpdateOption } from '../hooks/use-update-option'
+
+const botProtectionSchema = z.object({
+  TurnstileCheckEnabled: z.boolean(),
+  TurnstileSiteKey: z.string().optional(),
+  TurnstileSecretKey: z.string().optional(),
+})
+
+type BotProtectionFormValues = z.infer<typeof botProtectionSchema>
+
+type BotProtectionSectionProps = {
+  defaultValues: BotProtectionFormValues
+}
+
+export function BotProtectionSection({
+  defaultValues,
+}: BotProtectionSectionProps) {
+  const { t } = useTranslation()
+  const updateOption = useUpdateOption()
+
+  const form = useForm<BotProtectionFormValues>({
+    resolver: zodResolver(botProtectionSchema),
+    defaultValues,
+  })
+
+  useEffect(() => {
+    form.reset(defaultValues)
+  }, [defaultValues, form])
+
+  const onSubmit = async (data: BotProtectionFormValues) => {
+    const updates = Object.entries(data).filter(
+      ([key, value]) =>
+        value !== defaultValues[key as keyof BotProtectionFormValues]
+    )
+
+    for (const [key, value] of updates) {
+      await updateOption.mutateAsync({ key, value: value ?? '' })
+    }
+  }
+
+  return (
+    <SettingsSection
+      title={t('Bot Protection')}
+      description={t(
+        'Protect login and registration with Cloudflare Turnstile'
+      )}
+    >
+      <Form {...form}>
+        <form
+          onSubmit={form.handleSubmit(onSubmit)}
+          className='space-y-6'
+          autoComplete='off'
+        >
+          <FormField
+            control={form.control}
+            name='TurnstileCheckEnabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Enable Turnstile')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t(
+                      'Protect login and registration with Cloudflare Turnstile'
+                    )}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='TurnstileSiteKey'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('Site Key')}</FormLabel>
+                <FormControl>
+                  <Input
+                    placeholder={t('Your Turnstile site key')}
+                    autoComplete='off'
+                    {...field}
+                  />
+                </FormControl>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='TurnstileSecretKey'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('Secret Key')}</FormLabel>
+                <FormControl>
+                  <Input
+                    type='password'
+                    placeholder={t('Your Turnstile secret key')}
+                    autoComplete='new-password'
+                    {...field}
+                  />
+                </FormControl>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <Button type='submit' disabled={updateOption.isPending}>
+            {updateOption.isPending ? t('Saving...') : t('Save Changes')}
+          </Button>
+        </form>
+      </Form>
+    </SettingsSection>
+  )
+}

web/default/src/features/system-settings/auth/custom-oauth/api.ts

@@ -0,0 +1,61 @@
+import { api } from '@/lib/api'
+import type { CustomOAuthProvider, DiscoveryResponse } from './types'
+
+// ============================================================================
+// Response Types
+// ============================================================================
+
+interface ApiResponse<T = unknown> {
+  success: boolean
+  message?: string
+  data?: T
+}
+
+// ============================================================================
+// Custom OAuth Provider APIs
+// ============================================================================
+
+export async function getCustomOAuthProviders(): Promise<
+  ApiResponse<CustomOAuthProvider[]>
+> {
+  const res = await api.get('/api/custom-oauth-provider/')
+  return res.data
+}
+
+export async function getCustomOAuthProvider(
+  id: number
+): Promise<ApiResponse<CustomOAuthProvider>> {
+  const res = await api.get(`/api/custom-oauth-provider/${id}`)
+  return res.data
+}
+
+export async function createCustomOAuthProvider(
+  data: Omit<CustomOAuthProvider, 'id'>
+): Promise<ApiResponse<CustomOAuthProvider>> {
+  const res = await api.post('/api/custom-oauth-provider/', data)
+  return res.data
+}
+
+export async function updateCustomOAuthProvider(
+  id: number,
+  data: Partial<CustomOAuthProvider>
+): Promise<ApiResponse<CustomOAuthProvider>> {
+  const res = await api.put(`/api/custom-oauth-provider/${id}`, data)
+  return res.data
+}
+
+export async function deleteCustomOAuthProvider(
+  id: number
+): Promise<ApiResponse> {
+  const res = await api.delete(`/api/custom-oauth-provider/${id}`)
+  return res.data
+}
+
+export async function discoverOIDCEndpoints(
+  wellKnownUrl: string
+): Promise<DiscoveryResponse> {
+  const res = await api.post('/api/custom-oauth-provider/discovery', {
+    well_known_url: wellKnownUrl,
+  })
+  return res.data
+}

web/default/src/features/system-settings/auth/custom-oauth/components/discovery-button.tsx

@@ -0,0 +1,77 @@
+import type { UseFormReturn } from 'react-hook-form'
+import { Search } from 'lucide-react'
+import { useTranslation } from 'react-i18next'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/button'
+import { useDiscoverEndpoints } from '../hooks/use-custom-oauth-mutations'
+import type { CustomOAuthFormValues } from '../types'
+
+type DiscoveryButtonProps = {
+  form: UseFormReturn<CustomOAuthFormValues>
+}
+
+export function DiscoveryButton(props: DiscoveryButtonProps) {
+  const { t } = useTranslation()
+  const discover = useDiscoverEndpoints()
+
+  const handleDiscover = async () => {
+    const wellKnown = props.form.getValues('well_known')
+    if (!wellKnown) {
+      toast.error(t('Please enter a Well-Known URL first'))
+      return
+    }
+
+    if (!wellKnown.startsWith('http://') && !wellKnown.startsWith('https://')) {
+      toast.error(t('Well-Known URL must start with http:// or https://'))
+      return
+    }
+
+    const res = await discover.mutateAsync(wellKnown)
+    if (res.success && res.data?.discovery) {
+      const disc = res.data.discovery
+      if (disc.authorization_endpoint) {
+        props.form.setValue(
+          'authorization_endpoint',
+          disc.authorization_endpoint,
+          { shouldDirty: true }
+        )
+      }
+      if (disc.token_endpoint) {
+        props.form.setValue('token_endpoint', disc.token_endpoint, {
+          shouldDirty: true,
+        })
+      }
+      if (disc.userinfo_endpoint) {
+        props.form.setValue('user_info_endpoint', disc.userinfo_endpoint, {
+          shouldDirty: true,
+        })
+      }
+      if (disc.scopes_supported && disc.scopes_supported.length > 0) {
+        const currentScopes = props.form.getValues('scopes')
+        if (!currentScopes) {
+          const defaultScopes = disc.scopes_supported
+            .filter((s) => ['openid', 'profile', 'email'].includes(s))
+            .join(' ')
+          if (defaultScopes) {
+            props.form.setValue('scopes', defaultScopes, {
+              shouldDirty: true,
+            })
+          }
+        }
+      }
+    }
+  }
+
+  return (
+    <Button
+      type='button'
+      variant='outline'
+      size='sm'
+      onClick={handleDiscover}
+      disabled={discover.isPending}
+    >
+      <Search className='mr-1.5 h-3.5 w-3.5' />
+      {discover.isPending ? t('Discovering...') : t('Auto-discover')}
+    </Button>
+  )
+}

web/default/src/features/system-settings/auth/custom-oauth/components/preset-selector.tsx

@@ -0,0 +1,115 @@
+import { useState } from 'react'
+import type { UseFormReturn } from 'react-hook-form'
+import { useTranslation } from 'react-i18next'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { OAUTH_PRESETS, type CustomOAuthFormValues } from '../types'
+
+type PresetSelectorProps = {
+  form: UseFormReturn<CustomOAuthFormValues>
+}
+
+export function PresetSelector(props: PresetSelectorProps) {
+  const { t } = useTranslation()
+  const [selectedPreset, setSelectedPreset] = useState<string>('')
+  const [baseUrl, setBaseUrl] = useState<string>('')
+
+  const handlePresetChange = (presetKey: string) => {
+    setSelectedPreset(presetKey)
+    const preset = OAUTH_PRESETS.find((p) => p.key === presetKey)
+    if (!preset) return
+
+    // Auto-fill name, slug, icon, and field mappings immediately
+    props.form.setValue('name', preset.name, { shouldDirty: true })
+    props.form.setValue('slug', presetKey.toLowerCase().replace(/\s+/g, '-'), {
+      shouldDirty: true,
+    })
+    props.form.setValue('icon', preset.icon, { shouldDirty: true })
+    props.form.setValue('scopes', preset.scopes, { shouldDirty: true })
+    props.form.setValue('user_id_field', preset.user_id_field, {
+      shouldDirty: true,
+    })
+    props.form.setValue('username_field', preset.username_field, {
+      shouldDirty: true,
+    })
+    props.form.setValue('display_name_field', preset.display_name_field, {
+      shouldDirty: true,
+    })
+    props.form.setValue('email_field', preset.email_field, {
+      shouldDirty: true,
+    })
+
+    // Apply base URL if already entered
+    if (baseUrl) {
+      applyEndpoints(preset, baseUrl)
+    }
+  }
+
+  const handleBaseUrlChange = (url: string) => {
+    setBaseUrl(url)
+    if (!selectedPreset) return
+
+    const preset = OAUTH_PRESETS.find((p) => p.key === selectedPreset)
+    if (!preset) return
+
+    applyEndpoints(preset, url)
+  }
+
+  const applyEndpoints = (
+    preset: (typeof OAUTH_PRESETS)[number],
+    url: string
+  ) => {
+    const cleanUrl = url.replace(/\/+$/, '')
+    props.form.setValue(
+      'authorization_endpoint',
+      cleanUrl + preset.authorization_endpoint,
+      { shouldDirty: true }
+    )
+    props.form.setValue('token_endpoint', cleanUrl + preset.token_endpoint, {
+      shouldDirty: true,
+    })
+    props.form.setValue(
+      'user_info_endpoint',
+      cleanUrl + preset.user_info_endpoint,
+      { shouldDirty: true }
+    )
+  }
+
+  return (
+    <div className='space-y-3 rounded-lg border border-dashed p-4'>
+      <p className='text-sm font-medium'>{t('Quick Setup from Preset')}</p>
+      <div className='grid grid-cols-1 gap-3 sm:grid-cols-2'>
+        <div className='space-y-1.5'>
+          <Label>{t('Preset Template')}</Label>
+          <Select value={selectedPreset} onValueChange={handlePresetChange}>
+            <SelectTrigger className='w-full'>
+              <SelectValue placeholder={t('Select a preset...')} />
+            </SelectTrigger>
+            <SelectContent>
+              {OAUTH_PRESETS.map((preset) => (
+                <SelectItem key={preset.key} value={preset.key}>
+                  {preset.name}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </div>
+        <div className='space-y-1.5'>
+          <Label>{t('Base URL')}</Label>
+          <Input
+            placeholder={t('https://your-server.example.com')}
+            value={baseUrl}
+            onChange={(e) => handleBaseUrlChange(e.target.value)}
+          />
+        </div>
+      </div>
+    </div>
+  )
+}

web/default/src/features/system-settings/auth/custom-oauth/components/provider-form-dialog.tsx

@@ -0,0 +1,583 @@
+import { useEffect } from 'react'
+import { type Resolver, useForm } from 'react-hook-form'
+import { zodResolver } from '@hookform/resolvers/zod'
+import { useTranslation } from 'react-i18next'
+import { Button } from '@/components/ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+} from '@/components/ui/dialog'
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '@/components/ui/form'
+import { Input } from '@/components/ui/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { Separator } from '@/components/ui/separator'
+import { Switch } from '@/components/ui/switch'
+import { Textarea } from '@/components/ui/textarea'
+import {
+  useCreateProvider,
+  useUpdateProvider,
+} from '../hooks/use-custom-oauth-mutations'
+import {
+  customOAuthFormSchema,
+  AUTH_STYLE_OPTIONS,
+  type CustomOAuthProvider,
+  type CustomOAuthFormValues,
+} from '../types'
+import { DiscoveryButton } from './discovery-button'
+import { PresetSelector } from './preset-selector'
+
+type ProviderFormDialogProps = {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  provider?: CustomOAuthProvider | null
+}
+
+export function ProviderFormDialog(props: ProviderFormDialogProps) {
+  const { t } = useTranslation()
+  const isEditing = !!props.provider
+  const createProvider = useCreateProvider()
+  const updateProvider = useUpdateProvider()
+
+  const form = useForm<CustomOAuthFormValues>({
+    resolver: zodResolver(
+      customOAuthFormSchema
+    ) as unknown as Resolver<CustomOAuthFormValues>,
+    defaultValues: {
+      name: '',
+      slug: '',
+      icon: '',
+      enabled: true,
+      client_id: '',
+      client_secret: '',
+      authorization_endpoint: '',
+      token_endpoint: '',
+      user_info_endpoint: '',
+      scopes: '',
+      user_id_field: '',
+      username_field: '',
+      display_name_field: '',
+      email_field: '',
+      well_known: '',
+      auth_style: 0,
+      access_policy: '',
+      access_denied_message: '',
+    },
+  })
+
+  useEffect(() => {
+    if (props.open && props.provider) {
+      form.reset({
+        name: props.provider.name,
+        slug: props.provider.slug,
+        icon: props.provider.icon || '',
+        enabled: props.provider.enabled,
+        client_id: props.provider.client_id,
+        client_secret: props.provider.client_secret || '',
+        authorization_endpoint: props.provider.authorization_endpoint,
+        token_endpoint: props.provider.token_endpoint,
+        user_info_endpoint: props.provider.user_info_endpoint,
+        scopes: props.provider.scopes || '',
+        user_id_field: props.provider.user_id_field,
+        username_field: props.provider.username_field || '',
+        display_name_field: props.provider.display_name_field || '',
+        email_field: props.provider.email_field || '',
+        well_known: props.provider.well_known || '',
+        auth_style: props.provider.auth_style ?? 0,
+        access_policy: props.provider.access_policy || '',
+        access_denied_message: props.provider.access_denied_message || '',
+      })
+    } else if (props.open && !props.provider) {
+      form.reset({
+        name: '',
+        slug: '',
+        icon: '',
+        enabled: true,
+        client_id: '',
+        client_secret: '',
+        authorization_endpoint: '',
+        token_endpoint: '',
+        user_info_endpoint: '',
+        scopes: '',
+        user_id_field: '',
+        username_field: '',
+        display_name_field: '',
+        email_field: '',
+        well_known: '',
+        auth_style: 0,
+        access_policy: '',
+        access_denied_message: '',
+      })
+    }
+  }, [props.open, props.provider, form])
+
+  const onSubmit = async (values: CustomOAuthFormValues) => {
+    if (isEditing && props.provider) {
+      const res = await updateProvider.mutateAsync({
+        id: props.provider.id,
+        data: values,
+      })
+      if (res.success) {
+        props.onOpenChange(false)
+      }
+    } else {
+      const res = await createProvider.mutateAsync(
+        values as Omit<CustomOAuthProvider, 'id'>
+      )
+      if (res.success) {
+        props.onOpenChange(false)
+      }
+    }
+  }
+
+  const isPending = createProvider.isPending || updateProvider.isPending
+
+  return (
+    <Dialog open={props.open} onOpenChange={props.onOpenChange}>
+      <DialogContent className='max-h-[85vh] overflow-y-auto sm:max-w-2xl'>
+        <DialogHeader>
+          <DialogTitle>
+            {isEditing ? t('Edit OAuth Provider') : t('Add OAuth Provider')}
+          </DialogTitle>
+          <DialogDescription>
+            {isEditing
+              ? t('Update the configuration for this custom OAuth provider.')
+              : t(
+                  'Configure a new custom OAuth provider for user authentication.'
+                )}
+          </DialogDescription>
+        </DialogHeader>
+
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className='space-y-6'>
+            {/* Preset Selector (only for creating) */}
+            {!isEditing && <PresetSelector form={form} />}
+
+            {/* Basic Info */}
+            <div className='space-y-4'>
+              <h4 className='text-sm font-medium'>{t('Basic Info')}</h4>
+
+              <FormField
+                control={form.control}
+                name='enabled'
+                render={({ field }) => (
+                  <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                    <div className='space-y-0.5'>
+                      <FormLabel className='text-base'>
+                        {t('Enabled')}
+                      </FormLabel>
+                      <FormDescription>
+                        {t('Allow users to sign in with this provider')}
+                      </FormDescription>
+                    </div>
+                    <FormControl>
+                      <Switch
+                        checked={field.value}
+                        onCheckedChange={field.onChange}
+                      />
+                    </FormControl>
+                  </FormItem>
+                )}
+              />
+
+              <div className='grid grid-cols-1 gap-4 sm:grid-cols-2'>
+                <FormField
+                  control={form.control}
+                  name='name'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Provider Name')}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t('e.g. My GitLab')} {...field} />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='slug'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Slug')}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t('e.g. my-gitlab')} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t('Used in URLs and API routes')}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </div>
+
+              <FormField
+                control={form.control}
+                name='icon'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Icon')}</FormLabel>
+                    <FormControl>
+                      <Input
+                        placeholder={t('Icon identifier (e.g. github, gitlab)')}
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormDescription>
+                      {t('Optional icon identifier for the login button')}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <Separator />
+
+            {/* Credentials */}
+            <div className='space-y-4'>
+              <h4 className='text-sm font-medium'>{t('Credentials')}</h4>
+              <div className='grid grid-cols-1 gap-4 sm:grid-cols-2'>
+                <FormField
+                  control={form.control}
+                  name='client_id'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client ID')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('OAuth Client ID')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='client_secret'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client Secret')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          type='password'
+                          placeholder={t('OAuth Client Secret')}
+                          autoComplete='new-password'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </div>
+
+              <FormField
+                control={form.control}
+                name='auth_style'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Auth Style')}</FormLabel>
+                    <Select
+                      value={String(field.value)}
+                      onValueChange={(val) => field.onChange(Number(val))}
+                    >
+                      <FormControl>
+                        <SelectTrigger className='w-full'>
+                          <SelectValue />
+                        </SelectTrigger>
+                      </FormControl>
+                      <SelectContent>
+                        {AUTH_STYLE_OPTIONS.map((option) => (
+                          <SelectItem
+                            key={option.value}
+                            value={String(option.value)}
+                          >
+                            {t(option.labelKey)}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                    <FormDescription>
+                      {t(
+                        'How client credentials are sent to the token endpoint'
+                      )}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <Separator />
+
+            {/* Endpoints */}
+            <div className='space-y-4'>
+              <div className='flex items-center justify-between'>
+                <h4 className='text-sm font-medium'>{t('Endpoints')}</h4>
+                <DiscoveryButton form={form} />
+              </div>
+
+              <FormField
+                control={form.control}
+                name='well_known'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Well-Known URL')}</FormLabel>
+                    <FormControl>
+                      <Input
+                        placeholder={t(
+                          'https://provider.com/.well-known/openid-configuration'
+                        )}
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormDescription>
+                      {t(
+                        'OIDC discovery URL. Click "Auto-discover" to fetch endpoints automatically.'
+                      )}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name='authorization_endpoint'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Authorization Endpoint')}</FormLabel>
+                    <FormControl>
+                      <Input
+                        placeholder='https://provider.com/oauth/authorize'
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name='token_endpoint'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Token Endpoint')}</FormLabel>
+                    <FormControl>
+                      <Input
+                        placeholder='https://provider.com/oauth/token'
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name='user_info_endpoint'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('User Info Endpoint')}</FormLabel>
+                    <FormControl>
+                      <Input
+                        placeholder='https://provider.com/api/user'
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name='scopes'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Scopes')}</FormLabel>
+                    <FormControl>
+                      <Input
+                        placeholder={t('e.g. openid profile email')}
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormDescription>
+                      {t('Space-separated OAuth scopes')}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <Separator />
+
+            {/* Field Mapping */}
+            <div className='space-y-4'>
+              <h4 className='text-sm font-medium'>{t('Field Mapping')}</h4>
+              <FormDescription>
+                {t(
+                  'Map fields from the user info response to local user attributes. Supports nested paths (e.g. ocs.data.id).'
+                )}
+              </FormDescription>
+
+              <div className='grid grid-cols-1 gap-4 sm:grid-cols-2'>
+                <FormField
+                  control={form.control}
+                  name='user_id_field'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('User ID Field')}</FormLabel>
+                      <FormControl>
+                        <Input placeholder='id' {...field} />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='username_field'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Username Field')}</FormLabel>
+                      <FormControl>
+                        <Input placeholder='login' {...field} />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='display_name_field'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Display Name Field')}</FormLabel>
+                      <FormControl>
+                        <Input placeholder='name' {...field} />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='email_field'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Email Field')}</FormLabel>
+                      <FormControl>
+                        <Input placeholder='email' {...field} />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </div>
+            </div>
+
+            <Separator />
+
+            {/* Advanced */}
+            <div className='space-y-4'>
+              <h4 className='text-sm font-medium'>{t('Advanced')}</h4>
+
+              <FormField
+                control={form.control}
+                name='access_policy'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Access Policy (JSON)')}</FormLabel>
+                    <FormControl>
+                      <Textarea
+                        placeholder={t(
+                          'Optional JSON policy to restrict access based on user info fields'
+                        )}
+                        className='min-h-[80px] font-mono text-xs'
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormDescription>
+                      {t(
+                        'JSON-based access control rules. Leave empty to allow all users.'
+                      )}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name='access_denied_message'
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('Access Denied Message')}</FormLabel>
+                    <FormControl>
+                      <Input
+                        placeholder={t(
+                          'Custom message shown when access is denied'
+                        )}
+                        {...field}
+                      />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <DialogFooter>
+              <Button
+                type='button'
+                variant='outline'
+                onClick={() => props.onOpenChange(false)}
+                disabled={isPending}
+              >
+                {t('Cancel')}
+              </Button>
+              <Button type='submit' disabled={isPending}>
+                {isPending
+                  ? t('Saving...')
+                  : isEditing
+                    ? t('Update Provider')
+                    : t('Create Provider')}
+              </Button>
+            </DialogFooter>
+          </form>
+        </Form>
+      </DialogContent>
+    </Dialog>
+  )
+}

web/default/src/features/system-settings/auth/custom-oauth/components/provider-table.tsx

@@ -0,0 +1,132 @@
+import { useState } from 'react'
+import { Pencil, Trash2, Plus } from 'lucide-react'
+import { useTranslation } from 'react-i18next'
+import { Button } from '@/components/ui/button'
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { StatusBadge } from '@/components/status-badge'
+import { useDeleteProvider } from '../hooks/use-custom-oauth-mutations'
+import type { CustomOAuthProvider } from '../types'
+
+type ProviderTableProps = {
+  providers: CustomOAuthProvider[]
+  onEdit: (provider: CustomOAuthProvider) => void
+  onCreate: () => void
+}
+
+export function ProviderTable(props: ProviderTableProps) {
+  const { t } = useTranslation()
+  const deleteProvider = useDeleteProvider()
+  const [deleteTarget, setDeleteTarget] = useState<CustomOAuthProvider | null>(
+    null
+  )
+
+  const handleDelete = async () => {
+    if (!deleteTarget) return
+    await deleteProvider.mutateAsync(deleteTarget.id)
+    setDeleteTarget(null)
+  }
+
+  return (
+    <>
+      <div className='flex items-center justify-between'>
+        <p className='text-muted-foreground text-sm'>
+          {t('Manage custom OAuth providers for user authentication')}
+        </p>
+        <Button size='sm' onClick={props.onCreate}>
+          <Plus className='mr-1.5 h-4 w-4' />
+          {t('Add Provider')}
+        </Button>
+      </div>
+
+      {props.providers.length === 0 ? (
+        <div className='text-muted-foreground rounded-lg border border-dashed p-8 text-center text-sm'>
+          {t('No custom OAuth providers configured yet.')}
+        </div>
+      ) : (
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>{t('Icon')}</TableHead>
+              <TableHead>{t('Name')}</TableHead>
+              <TableHead>{t('Slug')}</TableHead>
+              <TableHead>{t('Status')}</TableHead>
+              <TableHead>{t('Client ID')}</TableHead>
+              <TableHead className='text-right'>{t('Actions')}</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {props.providers.map((provider) => (
+              <TableRow key={provider.id}>
+                <TableCell>
+                  {provider.icon ? (
+                    <span className='text-lg'>{provider.icon}</span>
+                  ) : (
+                    <span className='text-muted-foreground text-xs'>--</span>
+                  )}
+                </TableCell>
+                <TableCell className='font-medium'>{provider.name}</TableCell>
+                <TableCell>
+                  <StatusBadge
+                    label={provider.slug}
+                    variant='neutral'
+                    copyable={false}
+                  />
+                </TableCell>
+                <TableCell>
+                  <StatusBadge
+                    label={provider.enabled ? t('Enabled') : t('Disabled')}
+                    variant={provider.enabled ? 'success' : 'neutral'}
+                    copyable={false}
+                  />
+                </TableCell>
+                <TableCell className='text-muted-foreground max-w-[120px] truncate font-mono text-xs'>
+                  {provider.client_id}
+                </TableCell>
+                <TableCell className='text-right'>
+                  <div className='flex justify-end gap-1'>
+                    <Button
+                      variant='ghost'
+                      size='sm'
+                      onClick={() => props.onEdit(provider)}
+                    >
+                      <Pencil className='h-4 w-4' />
+                    </Button>
+                    <Button
+                      variant='ghost'
+                      size='sm'
+                      onClick={() => setDeleteTarget(provider)}
+                    >
+                      <Trash2 className='text-destructive h-4 w-4' />
+                    </Button>
+                  </div>
+                </TableCell>
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
+      )}
+
+      <ConfirmDialog
+        open={!!deleteTarget}
+        onOpenChange={(open) => !open && setDeleteTarget(null)}
+        title={t('Delete Provider')}
+        desc={t(
+          'Are you sure you want to delete "{{name}}"? Users who authenticated with this provider will no longer be able to log in.',
+          { name: deleteTarget?.name || '' }
+        )}
+        confirmText={t('Delete')}
+        destructive
+        handleConfirm={handleDelete}
+        isLoading={deleteProvider.isPending}
+      />
+    </>
+  )
+}

web/default/src/features/system-settings/auth/custom-oauth/custom-oauth-section.tsx

@@ -0,0 +1,68 @@
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { SettingsSection } from '../../components/settings-section'
+import { ProviderFormDialog } from './components/provider-form-dialog'
+import { ProviderTable } from './components/provider-table'
+import { useCustomOAuthProviders } from './hooks/use-custom-oauth-providers'
+import type { CustomOAuthProvider } from './types'
+
+export function CustomOAuthSection() {
+  const { t } = useTranslation()
+  const { data: providers = [], isLoading } = useCustomOAuthProviders()
+  const [dialogOpen, setDialogOpen] = useState(false)
+  const [editingProvider, setEditingProvider] =
+    useState<CustomOAuthProvider | null>(null)
+
+  const handleCreate = () => {
+    setEditingProvider(null)
+    setDialogOpen(true)
+  }
+
+  const handleEdit = (provider: CustomOAuthProvider) => {
+    setEditingProvider(provider)
+    setDialogOpen(true)
+  }
+
+  const handleDialogChange = (open: boolean) => {
+    setDialogOpen(open)
+    if (!open) {
+      setEditingProvider(null)
+    }
+  }
+
+  if (isLoading) {
+    return (
+      <SettingsSection
+        title={t('Custom OAuth Providers')}
+        description={t(
+          'Configure custom OAuth providers for user authentication'
+        )}
+      >
+        <div className='text-muted-foreground py-8 text-center text-sm'>
+          {t('Loading...')}
+        </div>
+      </SettingsSection>
+    )
+  }
+
+  return (
+    <SettingsSection
+      title={t('Custom OAuth Providers')}
+      description={t(
+        'Configure custom OAuth providers for user authentication'
+      )}
+    >
+      <ProviderTable
+        providers={providers}
+        onEdit={handleEdit}
+        onCreate={handleCreate}
+      />
+
+      <ProviderFormDialog
+        open={dialogOpen}
+        onOpenChange={handleDialogChange}
+        provider={editingProvider}
+      />
+    </SettingsSection>
+  )
+}

web/default/src/features/system-settings/auth/custom-oauth/hooks/use-custom-oauth-mutations.ts

@@ -0,0 +1,94 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import i18next from 'i18next'
+import { toast } from 'sonner'
+import {
+  createCustomOAuthProvider,
+  updateCustomOAuthProvider,
+  deleteCustomOAuthProvider,
+  discoverOIDCEndpoints,
+} from '../api'
+import type { CustomOAuthProvider, DiscoveryResponse } from '../types'
+
+function useInvalidateOnSuccess() {
+  const queryClient = useQueryClient()
+  return {
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['custom-oauth-providers'] })
+      queryClient.invalidateQueries({ queryKey: ['status'] })
+    },
+  }
+}
+
+export function useCreateProvider() {
+  const invalidate = useInvalidateOnSuccess()
+
+  return useMutation({
+    mutationFn: (data: Omit<CustomOAuthProvider, 'id'>) =>
+      createCustomOAuthProvider(data),
+    onSuccess: (res) => {
+      if (res.success) {
+        toast.success(i18next.t('Provider created successfully'))
+        invalidate.onSuccess()
+      }
+    },
+    onError: (error: Error) => {
+      toast.error(error.message || i18next.t('Failed to create provider'))
+    },
+  })
+}
+
+export function useUpdateProvider() {
+  const invalidate = useInvalidateOnSuccess()
+
+  return useMutation({
+    mutationFn: ({
+      id,
+      data,
+    }: {
+      id: number
+      data: Partial<CustomOAuthProvider>
+    }) => updateCustomOAuthProvider(id, data),
+    onSuccess: (res) => {
+      if (res.success) {
+        toast.success(i18next.t('Provider updated successfully'))
+        invalidate.onSuccess()
+      }
+    },
+    onError: (error: Error) => {
+      toast.error(error.message || i18next.t('Failed to update provider'))
+    },
+  })
+}
+
+export function useDeleteProvider() {
+  const invalidate = useInvalidateOnSuccess()
+
+  return useMutation({
+    mutationFn: (id: number) => deleteCustomOAuthProvider(id),
+    onSuccess: (res) => {
+      if (res.success) {
+        toast.success(i18next.t('Provider deleted successfully'))
+        invalidate.onSuccess()
+      }
+    },
+    onError: (error: Error) => {
+      toast.error(error.message || i18next.t('Failed to delete provider'))
+    },
+  })
+}
+
+export function useDiscoverEndpoints() {
+  return useMutation({
+    mutationFn: (wellKnownUrl: string) => discoverOIDCEndpoints(wellKnownUrl),
+    onSuccess: (res: DiscoveryResponse) => {
+      if (res.success) {
+        toast.success(i18next.t('OIDC endpoints discovered successfully'))
+      }
+    },
+    onError: (error: Error) => {
+      toast.error(
+        error.message || i18next.t('Failed to discover OIDC endpoints')
+      )
+    },
+  })
+}

web/default/src/features/system-settings/auth/custom-oauth/hooks/use-custom-oauth-providers.ts

@@ -0,0 +1,12 @@
+import { useQuery } from '@tanstack/react-query'
+import { getCustomOAuthProviders } from '../api'
+
+export function useCustomOAuthProviders() {
+  return useQuery({
+    queryKey: ['custom-oauth-providers'],
+    queryFn: async () => {
+      const res = await getCustomOAuthProviders()
+      return res.data ?? []
+    },
+  })
+}

web/default/src/features/system-settings/auth/custom-oauth/types.ts

@@ -0,0 +1,206 @@
+import * as z from 'zod'
+
+// ============================================================================
+// Custom OAuth Provider Types
+// ============================================================================
+
+export interface CustomOAuthProvider {
+  id: number
+  name: string
+  slug: string
+  icon: string
+  enabled: boolean
+  client_id: string
+  client_secret: string
+  authorization_endpoint: string
+  token_endpoint: string
+  user_info_endpoint: string
+  scopes: string
+  user_id_field: string
+  username_field: string
+  display_name_field: string
+  email_field: string
+  well_known: string
+  auth_style: number // 0=auto, 1=params, 2=header
+  access_policy: string
+  access_denied_message: string
+}
+
+// ============================================================================
+// Form Schema
+// ============================================================================
+
+export const customOAuthFormSchema = z.object({
+  name: z.string().min(1, 'Name is required'),
+  slug: z
+    .string()
+    .min(1, 'Slug is required')
+    .regex(
+      /^[a-z0-9-]+$/,
+      'Slug must only contain lowercase letters, numbers, and hyphens'
+    ),
+  icon: z.string().optional().default(''),
+  enabled: z.boolean().default(true),
+  client_id: z.string().min(1, 'Client ID is required'),
+  client_secret: z.string().optional().default(''),
+  authorization_endpoint: z
+    .string()
+    .min(1, 'Authorization endpoint is required'),
+  token_endpoint: z.string().min(1, 'Token endpoint is required'),
+  user_info_endpoint: z.string().min(1, 'User info endpoint is required'),
+  scopes: z.string().optional().default(''),
+  user_id_field: z.string().min(1, 'User ID field is required'),
+  username_field: z.string().optional().default(''),
+  display_name_field: z.string().optional().default(''),
+  email_field: z.string().optional().default(''),
+  well_known: z.string().optional().default(''),
+  auth_style: z.number().int().min(0).max(2).default(0),
+  access_policy: z.string().optional().default(''),
+  access_denied_message: z.string().optional().default(''),
+})
+
+export type CustomOAuthFormValues = z.infer<typeof customOAuthFormSchema>
+
+// ============================================================================
+// OIDC Discovery
+// ============================================================================
+
+export interface DiscoveryResponse {
+  success: boolean
+  message?: string
+  data?: {
+    well_known_url?: string
+    discovery?: {
+      authorization_endpoint?: string
+      token_endpoint?: string
+      userinfo_endpoint?: string
+      scopes_supported?: string[]
+    }
+  }
+}
+
+// ============================================================================
+// Preset Templates
+// ============================================================================
+
+export interface OAuthPreset {
+  key: string
+  name: string
+  icon: string
+  authorization_endpoint: string
+  token_endpoint: string
+  user_info_endpoint: string
+  scopes: string
+  user_id_field: string
+  username_field: string
+  display_name_field: string
+  email_field: string
+  needsBaseUrl: boolean
+}
+
+export const OAUTH_PRESETS: OAuthPreset[] = [
+  {
+    key: 'github-enterprise',
+    name: 'GitHub Enterprise',
+    icon: 'github',
+    authorization_endpoint: '/login/oauth/authorize',
+    token_endpoint: '/login/oauth/access_token',
+    user_info_endpoint: '/api/v3/user',
+    scopes: 'user:email',
+    user_id_field: 'id',
+    username_field: 'login',
+    display_name_field: 'name',
+    email_field: 'email',
+    needsBaseUrl: true,
+  },
+  {
+    key: 'gitlab',
+    name: 'GitLab',
+    icon: 'gitlab',
+    authorization_endpoint: '/oauth/authorize',
+    token_endpoint: '/oauth/token',
+    user_info_endpoint: '/api/v4/user',
+    scopes: 'openid profile email',
+    user_id_field: 'id',
+    username_field: 'username',
+    display_name_field: 'name',
+    email_field: 'email',
+    needsBaseUrl: true,
+  },
+  {
+    key: 'gitea',
+    name: 'Gitea',
+    icon: 'gitea',
+    authorization_endpoint: '/login/oauth/authorize',
+    token_endpoint: '/login/oauth/access_token',
+    user_info_endpoint: '/api/v1/user',
+    scopes: 'openid profile email',
+    user_id_field: 'id',
+    username_field: 'login',
+    display_name_field: 'full_name',
+    email_field: 'email',
+    needsBaseUrl: true,
+  },
+  {
+    key: 'nextcloud',
+    name: 'Nextcloud',
+    icon: 'nextcloud',
+    authorization_endpoint: '/apps/oauth2/authorize',
+    token_endpoint: '/apps/oauth2/api/v1/token',
+    user_info_endpoint: '/ocs/v2.php/cloud/user?format=json',
+    scopes: 'openid profile email',
+    user_id_field: 'ocs.data.id',
+    username_field: 'ocs.data.id',
+    display_name_field: 'ocs.data.displayname',
+    email_field: 'ocs.data.email',
+    needsBaseUrl: true,
+  },
+  {
+    key: 'keycloak',
+    name: 'Keycloak',
+    icon: 'keycloak',
+    authorization_endpoint: '/realms/{realm}/protocol/openid-connect/auth',
+    token_endpoint: '/realms/{realm}/protocol/openid-connect/token',
+    user_info_endpoint: '/realms/{realm}/protocol/openid-connect/userinfo',
+    scopes: 'openid profile email',
+    user_id_field: 'sub',
+    username_field: 'preferred_username',
+    display_name_field: 'name',
+    email_field: 'email',
+    needsBaseUrl: true,
+  },
+  {
+    key: 'authentik',
+    name: 'Authentik',
+    icon: 'authentik',
+    authorization_endpoint: '/application/o/authorize/',
+    token_endpoint: '/application/o/token/',
+    user_info_endpoint: '/application/o/userinfo/',
+    scopes: 'openid profile email',
+    user_id_field: 'sub',
+    username_field: 'preferred_username',
+    display_name_field: 'name',
+    email_field: 'email',
+    needsBaseUrl: true,
+  },
+  {
+    key: 'ory',
+    name: 'ORY Hydra',
+    icon: 'openid',
+    authorization_endpoint: '/oauth2/auth',
+    token_endpoint: '/oauth2/token',
+    user_info_endpoint: '/userinfo',
+    scopes: 'openid profile email',
+    user_id_field: 'sub',
+    username_field: 'preferred_username',
+    display_name_field: 'name',
+    email_field: 'email',
+    needsBaseUrl: true,
+  },
+]
+
+export const AUTH_STYLE_OPTIONS = [
+  { value: 0, labelKey: 'Auto Detect' },
+  { value: 1, labelKey: 'Params (in body)' },
+  { value: 2, labelKey: 'Header (Basic Auth)' },
+] as const

web/default/src/features/system-settings/auth/index.tsx

@@ -0,0 +1,61 @@
+import { SettingsPage } from '../components/settings-page'
+import type { AuthSettings } from '../types'
+import {
+  AUTH_DEFAULT_SECTION,
+  getAuthSectionContent,
+} from './section-registry.tsx'
+
+const defaultAuthSettings: AuthSettings = {
+  PasswordLoginEnabled: true,
+  PasswordRegisterEnabled: true,
+  EmailVerificationEnabled: false,
+  RegisterEnabled: true,
+  EmailDomainRestrictionEnabled: false,
+  EmailAliasRestrictionEnabled: false,
+  EmailDomainWhitelist: '',
+  GitHubOAuthEnabled: false,
+  GitHubClientId: '',
+  GitHubClientSecret: '',
+  'discord.enabled': false,
+  'discord.client_id': '',
+  'discord.client_secret': '',
+  'oidc.enabled': false,
+  'oidc.client_id': '',
+  'oidc.client_secret': '',
+  'oidc.well_known': '',
+  'oidc.authorization_endpoint': '',
+  'oidc.token_endpoint': '',
+  'oidc.user_info_endpoint': '',
+  TelegramOAuthEnabled: false,
+  TelegramBotToken: '',
+  TelegramBotName: '',
+  LinuxDOOAuthEnabled: false,
+  LinuxDOClientId: '',
+  LinuxDOClientSecret: '',
+  LinuxDOMinimumTrustLevel: '0',
+  WeChatAuthEnabled: false,
+  WeChatServerAddress: '',
+  WeChatServerToken: '',
+  WeChatAccountQRCodeImageURL: '',
+  TurnstileCheckEnabled: false,
+  TurnstileSiteKey: '',
+  TurnstileSecretKey: '',
+  'passkey.enabled': false,
+  'passkey.rp_display_name': '',
+  'passkey.rp_id': '',
+  'passkey.origins': '',
+  'passkey.allow_insecure_origin': false,
+  'passkey.user_verification': 'preferred',
+  'passkey.attachment_preference': '',
+}
+
+export function AuthSettings() {
+  return (
+    <SettingsPage
+      routePath='/_authenticated/system-settings/auth/$section'
+      defaultSettings={defaultAuthSettings}
+      defaultSection={AUTH_DEFAULT_SECTION}
+      getSectionContent={getAuthSectionContent}
+    />
+  )
+}

web/default/src/features/system-settings/auth/oauth-section.tsx

@@ -0,0 +1,763 @@
+import { useState } from 'react'
+import * as z from 'zod'
+import axios from 'axios'
+import { useForm } from 'react-hook-form'
+import { zodResolver } from '@hookform/resolvers/zod'
+import { RotateCcw } from 'lucide-react'
+import { useTranslation } from 'react-i18next'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/button'
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '@/components/ui/form'
+import { Input } from '@/components/ui/input'
+import { Switch } from '@/components/ui/switch'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import { FormDirtyIndicator } from '../components/form-dirty-indicator'
+import { FormNavigationGuard } from '../components/form-navigation-guard'
+import { SettingsSection } from '../components/settings-section'
+import { useUpdateOption } from '../hooks/use-update-option'
+
+const oauthSchema = z.object({
+  GitHubOAuthEnabled: z.boolean(),
+  GitHubClientId: z.string().optional(),
+  GitHubClientSecret: z.string().optional(),
+  'discord.enabled': z.boolean(),
+  'discord.client_id': z.string().optional(),
+  'discord.client_secret': z.string().optional(),
+  'oidc.enabled': z.boolean(),
+  'oidc.client_id': z.string().optional(),
+  'oidc.client_secret': z.string().optional(),
+  'oidc.well_known': z.string().optional(),
+  'oidc.authorization_endpoint': z.string().optional(),
+  'oidc.token_endpoint': z.string().optional(),
+  'oidc.user_info_endpoint': z.string().optional(),
+  TelegramOAuthEnabled: z.boolean(),
+  TelegramBotToken: z.string().optional(),
+  TelegramBotName: z.string().optional(),
+  LinuxDOOAuthEnabled: z.boolean(),
+  LinuxDOClientId: z.string().optional(),
+  LinuxDOClientSecret: z.string().optional(),
+  LinuxDOMinimumTrustLevel: z.string().optional(),
+  WeChatAuthEnabled: z.boolean(),
+  WeChatServerAddress: z.string().optional(),
+  WeChatServerToken: z.string().optional(),
+  WeChatAccountQRCodeImageURL: z.string().optional(),
+})
+
+type OAuthFormValues = z.infer<typeof oauthSchema>
+
+type OAuthSectionProps = {
+  defaultValues: OAuthFormValues
+}
+
+export function OAuthSection({ defaultValues }: OAuthSectionProps) {
+  const { t } = useTranslation()
+  const updateOption = useUpdateOption()
+  const [activeTab, setActiveTab] = useState('github')
+
+  // Normalize empty strings for optional fields (only at mount)
+  const normalizedDefaults: OAuthFormValues = {
+    ...defaultValues,
+    GitHubClientId: defaultValues.GitHubClientId ?? '',
+    GitHubClientSecret: defaultValues.GitHubClientSecret ?? '',
+    'discord.client_id': defaultValues['discord.client_id'] ?? '',
+    'discord.client_secret': defaultValues['discord.client_secret'] ?? '',
+    'oidc.client_id': defaultValues['oidc.client_id'] ?? '',
+    'oidc.client_secret': defaultValues['oidc.client_secret'] ?? '',
+    'oidc.well_known': defaultValues['oidc.well_known'] ?? '',
+    'oidc.authorization_endpoint':
+      defaultValues['oidc.authorization_endpoint'] ?? '',
+    'oidc.token_endpoint': defaultValues['oidc.token_endpoint'] ?? '',
+    'oidc.user_info_endpoint': defaultValues['oidc.user_info_endpoint'] ?? '',
+    TelegramBotToken: defaultValues.TelegramBotToken ?? '',
+    TelegramBotName: defaultValues.TelegramBotName ?? '',
+    LinuxDOClientId: defaultValues.LinuxDOClientId ?? '',
+    LinuxDOClientSecret: defaultValues.LinuxDOClientSecret ?? '',
+    LinuxDOMinimumTrustLevel: defaultValues.LinuxDOMinimumTrustLevel ?? '',
+    WeChatServerAddress: defaultValues.WeChatServerAddress ?? '',
+    WeChatServerToken: defaultValues.WeChatServerToken ?? '',
+    WeChatAccountQRCodeImageURL:
+      defaultValues.WeChatAccountQRCodeImageURL ?? '',
+  }
+
+  const form = useForm<OAuthFormValues>({
+    resolver: zodResolver(oauthSchema),
+    defaultValues: normalizedDefaults,
+  })
+
+  const onSubmit = async () => {
+    // Get raw form values directly
+    // React Hook Form treats "oidc.xxx" as nested paths, so we need to flatten
+    const rawData = form.getValues() as Record<string, unknown>
+
+    // Flatten nested oidc object back to dot notation keys
+    const flattenedData: Record<string, unknown> = {}
+
+    Object.entries(rawData).forEach(([key, value]) => {
+      if (
+        (key === 'oidc' || key === 'discord') &&
+        typeof value === 'object' &&
+        value !== null
+      ) {
+        // React Hook Form auto-nested these fields, flatten them back
+        Object.entries(value as Record<string, unknown>).forEach(
+          ([nestedKey, nestedValue]) => {
+            flattenedData[`${key}.${nestedKey}`] = nestedValue
+          }
+        )
+      } else {
+        flattenedData[key] = value
+      }
+    })
+
+    const finalData = flattenedData as OAuthFormValues
+
+    if (finalData['oidc.well_known'] && finalData['oidc.well_known'] !== '') {
+      if (
+        !finalData['oidc.well_known'].startsWith('http://') &&
+        !finalData['oidc.well_known'].startsWith('https://')
+      ) {
+        toast.error(t('Well-Known URL must start with http:// or https://'))
+        return
+      }
+
+      try {
+        const res = await axios.create().get(finalData['oidc.well_known'])
+        const authEndpoint = res.data['authorization_endpoint'] || ''
+        const tokenEndpoint = res.data['token_endpoint'] || ''
+        const userInfoEndpoint = res.data['userinfo_endpoint'] || ''
+
+        finalData['oidc.authorization_endpoint'] = authEndpoint
+        finalData['oidc.token_endpoint'] = tokenEndpoint
+        finalData['oidc.user_info_endpoint'] = userInfoEndpoint
+
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        form.setValue('oidc.authorization_endpoint' as any, authEndpoint)
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        form.setValue('oidc.token_endpoint' as any, tokenEndpoint)
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        form.setValue('oidc.user_info_endpoint' as any, userInfoEndpoint)
+
+        toast.success(t('OIDC configuration fetched successfully'))
+      } catch (err) {
+        // eslint-disable-next-line no-console
+        console.error(err)
+        toast.error(
+          t(
+            'Failed to fetch OIDC configuration. Please check the URL and network status'
+          )
+        )
+        return
+      }
+    }
+
+    // Find changed fields by comparing to initial values
+    const updates = Object.entries(finalData).filter(
+      ([key, value]) =>
+        value !== normalizedDefaults[key as keyof OAuthFormValues]
+    )
+
+    if (updates.length === 0) {
+      toast.info(t('No changes to save'))
+      return
+    }
+
+    // Save all changed fields
+    for (const [key, value] of updates) {
+      await updateOption.mutateAsync({ key, value: value ?? '' })
+    }
+
+    // Reset form dirty state after successful save
+    form.reset(finalData)
+  }
+
+  const handleReset = () => {
+    // React Hook Form auto-nests 'oidc.xxx' fields into { oidc: { xxx: value } }
+    // So we need to pass the same structure when resetting
+    const currentValues = form.getValues() as Record<string, unknown>
+
+    // Create reset values matching RHF's internal structure
+    const resetValues = { ...currentValues }
+
+    // Update nested oidc fields
+    if (resetValues.oidc && typeof resetValues.oidc === 'object') {
+      Object.keys(resetValues.oidc as Record<string, unknown>).forEach(
+        (key) => {
+          const flatKey = `oidc.${key}` as keyof typeof normalizedDefaults
+          if (flatKey in normalizedDefaults) {
+            ;(resetValues.oidc as Record<string, unknown>)[key] =
+              normalizedDefaults[flatKey]
+          }
+        }
+      )
+    }
+
+    // Update nested discord fields
+    if (resetValues.discord && typeof resetValues.discord === 'object') {
+      Object.keys(resetValues.discord as Record<string, unknown>).forEach(
+        (key) => {
+          const flatKey = `discord.${key}` as keyof typeof normalizedDefaults
+          if (flatKey in normalizedDefaults) {
+            ;(resetValues.discord as Record<string, unknown>)[key] =
+              normalizedDefaults[flatKey]
+          }
+        }
+      )
+    }
+
+    // Update top-level fields
+    Object.keys(resetValues).forEach((key) => {
+      if (key !== 'oidc' && key in normalizedDefaults) {
+        resetValues[key] =
+          normalizedDefaults[key as keyof typeof normalizedDefaults]
+      }
+    })
+
+    form.reset(resetValues, {
+      keepDirty: false,
+      keepDirtyValues: false,
+      keepErrors: false,
+    })
+    toast.success(t('Form reset to saved values'))
+  }
+
+  return (
+    <>
+      <FormNavigationGuard when={form.formState.isDirty} />
+
+      <SettingsSection
+        title={t('OAuth Integrations')}
+        description={t('Configure third-party authentication providers')}
+      >
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className='space-y-6'>
+            <FormDirtyIndicator isDirty={form.formState.isDirty} />
+
+            <Tabs value={activeTab} onValueChange={setActiveTab}>
+              <TabsList className='grid w-full grid-cols-6'>
+                <TabsTrigger value='github'>{t('GitHub')}</TabsTrigger>
+                <TabsTrigger value='discord'>{t('Discord')}</TabsTrigger>
+                <TabsTrigger value='oidc'>{t('OIDC')}</TabsTrigger>
+                <TabsTrigger value='telegram'>{t('Telegram')}</TabsTrigger>
+                <TabsTrigger value='linuxdo'>{t('LinuxDO')}</TabsTrigger>
+                <TabsTrigger value='wechat'>{t('WeChat')}</TabsTrigger>
+              </TabsList>
+
+              <TabsContent value='github' className='space-y-4'>
+                <FormField
+                  control={form.control}
+                  name='GitHubOAuthEnabled'
+                  render={({ field }) => (
+                    <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                      <div className='space-y-0.5'>
+                        <FormLabel className='text-base'>
+                          {t('Enable GitHub OAuth')}
+                        </FormLabel>
+                        <FormDescription>
+                          {t('Allow users to sign in with GitHub')}
+                        </FormDescription>
+                      </div>
+                      <FormControl>
+                        <Switch
+                          checked={field.value}
+                          onCheckedChange={field.onChange}
+                        />
+                      </FormControl>
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='GitHubClientId'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client ID')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('Your GitHub OAuth Client ID')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='GitHubClientSecret'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client Secret')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          type='password'
+                          placeholder={t('Your GitHub OAuth Client Secret')}
+                          autoComplete='new-password'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </TabsContent>
+
+              <TabsContent value='discord' className='space-y-4'>
+                <FormField
+                  control={form.control}
+                  name='discord.enabled'
+                  render={({ field }) => (
+                    <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                      <div className='space-y-0.5'>
+                        <FormLabel className='text-base'>
+                          {t('Enable Discord OAuth')}
+                        </FormLabel>
+                        <FormDescription>
+                          {t('Allow users to sign in with Discord')}
+                        </FormDescription>
+                      </div>
+                      <FormControl>
+                        <Switch
+                          checked={field.value}
+                          onCheckedChange={field.onChange}
+                        />
+                      </FormControl>
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                  name={'discord.client_id' as any}
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client ID')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('Your Discord OAuth Client ID')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='discord.client_secret'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client Secret')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          type='password'
+                          placeholder={t('Your Discord OAuth Client Secret')}
+                          autoComplete='new-password'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </TabsContent>
+
+              <TabsContent value='oidc' className='space-y-4'>
+                <FormField
+                  control={form.control}
+                  name='oidc.enabled'
+                  render={({ field }) => (
+                    <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                      <div className='space-y-0.5'>
+                        <FormLabel className='text-base'>
+                          {t('Enable OIDC')}
+                        </FormLabel>
+                        <FormDescription>
+                          {t('Allow users to sign in with OpenID Connect')}
+                        </FormDescription>
+                      </div>
+                      <FormControl>
+                        <Switch
+                          checked={field.value}
+                          onCheckedChange={field.onChange}
+                        />
+                      </FormControl>
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                  name={'oidc.client_id' as any}
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client ID')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('OIDC Client ID')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='oidc.client_secret'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client Secret')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          type='password'
+                          placeholder={t('OIDC Client Secret')}
+                          autoComplete='new-password'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='oidc.well_known'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Well-Known URL')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t(
+                            'https://provider.com/.well-known/openid-configuration'
+                          )}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormDescription>
+                        {t('Auto-discovers endpoints from the provider')}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='oidc.authorization_endpoint'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>
+                        {t('Authorization Endpoint (Optional)')}
+                      </FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('Override auto-discovered endpoint')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='oidc.token_endpoint'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Token Endpoint (Optional)')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('Override auto-discovered endpoint')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='oidc.user_info_endpoint'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>
+                        {t('User Info Endpoint (Optional)')}
+                      </FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('Override auto-discovered endpoint')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </TabsContent>
+
+              <TabsContent value='telegram' className='space-y-4'>
+                <FormField
+                  control={form.control}
+                  name='TelegramOAuthEnabled'
+                  render={({ field }) => (
+                    <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                      <div className='space-y-0.5'>
+                        <FormLabel className='text-base'>
+                          {t('Enable Telegram OAuth')}
+                        </FormLabel>
+                        <FormDescription>
+                          {t('Allow users to sign in with Telegram')}
+                        </FormDescription>
+                      </div>
+                      <FormControl>
+                        <Switch
+                          checked={field.value}
+                          onCheckedChange={field.onChange}
+                        />
+                      </FormControl>
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='TelegramBotToken'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Bot Token')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          type='password'
+                          placeholder={t('Your Telegram Bot Token')}
+                          autoComplete='new-password'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='TelegramBotName'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Bot Name')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('Your Bot Name')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </TabsContent>
+
+              <TabsContent value='linuxdo' className='space-y-4'>
+                <FormField
+                  control={form.control}
+                  name='LinuxDOOAuthEnabled'
+                  render={({ field }) => (
+                    <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                      <div className='space-y-0.5'>
+                        <FormLabel className='text-base'>
+                          {t('Enable LinuxDO OAuth')}
+                        </FormLabel>
+                        <FormDescription>
+                          {t('Allow users to sign in with LinuxDO')}
+                        </FormDescription>
+                      </div>
+                      <FormControl>
+                        <Switch
+                          checked={field.value}
+                          onCheckedChange={field.onChange}
+                        />
+                      </FormControl>
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='LinuxDOClientId'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client ID')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('LinuxDO Client ID')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='LinuxDOClientSecret'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Client Secret')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          type='password'
+                          placeholder={t('LinuxDO Client Secret')}
+                          autoComplete='new-password'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='LinuxDOMinimumTrustLevel'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Minimum Trust Level')}</FormLabel>
+                      <FormControl>
+                        <Input placeholder='0' autoComplete='off' {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t('Minimum LinuxDO trust level required')}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </TabsContent>
+
+              <TabsContent value='wechat' className='space-y-4'>
+                <FormField
+                  control={form.control}
+                  name='WeChatAuthEnabled'
+                  render={({ field }) => (
+                    <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                      <div className='space-y-0.5'>
+                        <FormLabel className='text-base'>
+                          {t('Enable WeChat Auth')}
+                        </FormLabel>
+                        <FormDescription>
+                          {t('Allow users to sign in with WeChat')}
+                        </FormDescription>
+                      </div>
+                      <FormControl>
+                        <Switch
+                          checked={field.value}
+                          onCheckedChange={field.onChange}
+                        />
+                      </FormControl>
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='WeChatServerAddress'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Server Address')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('https://wechat-server.example.com')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='WeChatServerToken'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('Server Token')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          type='password'
+                          placeholder={t('Server Token')}
+                          autoComplete='new-password'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <FormField
+                  control={form.control}
+                  name='WeChatAccountQRCodeImageURL'
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t('QR Code Image URL')}</FormLabel>
+                      <FormControl>
+                        <Input
+                          placeholder={t('https://example.com/qr-code.png')}
+                          autoComplete='off'
+                          {...field}
+                        />
+                      </FormControl>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </TabsContent>
+            </Tabs>
+
+            <div className='flex gap-2'>
+              <Button type='submit' disabled={updateOption.isPending}>
+                {updateOption.isPending ? t('Saving...') : t('Save Changes')}
+              </Button>
+              <Button
+                type='button'
+                variant='outline'
+                onClick={handleReset}
+                disabled={!form.formState.isDirty || updateOption.isPending}
+              >
+                <RotateCcw className='mr-2 h-4 w-4' />
+                {t('Reset')}
+              </Button>
+            </div>
+          </form>
+        </Form>
+      </SettingsSection>
+    </>
+  )
+}

web/default/src/features/system-settings/auth/passkey-section.tsx

@@ -0,0 +1,335 @@
+import { useMemo } from 'react'
+import * as z from 'zod'
+import { useForm } from 'react-hook-form'
+import { zodResolver } from '@hookform/resolvers/zod'
+import { useTranslation } from 'react-i18next'
+import { Button } from '@/components/ui/button'
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '@/components/ui/form'
+import { Input } from '@/components/ui/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import { Switch } from '@/components/ui/switch'
+import { Textarea } from '@/components/ui/textarea'
+import { SettingsSection } from '../components/settings-section'
+import { useResetForm } from '../hooks/use-reset-form'
+import { useUpdateOption } from '../hooks/use-update-option'
+
+const passkeySchema = z.object({
+  'passkey.enabled': z.boolean(),
+  'passkey.rp_display_name': z.string(),
+  'passkey.rp_id': z.string(),
+  'passkey.origins': z.string(),
+  'passkey.allow_insecure_origin': z.boolean(),
+  'passkey.user_verification': z.enum(['required', 'preferred', 'discouraged']),
+  'passkey.attachment_preference': z.enum([
+    'none',
+    'platform',
+    'cross-platform',
+  ]),
+})
+
+type PasskeyFormValues = z.infer<typeof passkeySchema>
+
+interface PasskeySectionProps {
+  defaultValues: PasskeyFormValues
+}
+
+export function PasskeySection({ defaultValues }: PasskeySectionProps) {
+  const { t } = useTranslation()
+  const updateOption = useUpdateOption()
+
+  const formDefaults = useMemo<PasskeyFormValues>(
+    () => ({
+      ...defaultValues,
+      'passkey.origins': (defaultValues['passkey.origins'] as string)
+        .split(',')
+        .map((origin: string) => origin.trim())
+        .filter(Boolean)
+        .join('\n'),
+      'passkey.attachment_preference':
+        (defaultValues['passkey.attachment_preference'] as string) === ''
+          ? 'none'
+          : (defaultValues['passkey.attachment_preference'] as
+              | 'platform'
+              | 'cross-platform'),
+    }),
+    [defaultValues]
+  )
+
+  const form = useForm<PasskeyFormValues>({
+    resolver: zodResolver(passkeySchema),
+    defaultValues: formDefaults,
+  })
+
+  useResetForm(form, formDefaults)
+
+  const onSubmit = async () => {
+    const rawData = form.getValues() as Record<string, unknown>
+    const flattenedEntries: Array<
+      [keyof PasskeyFormValues, PasskeyFormValues[keyof PasskeyFormValues]]
+    > = []
+
+    Object.entries(rawData).forEach(([key, value]) => {
+      if (key === 'passkey' && value && typeof value === 'object') {
+        Object.entries(value as Record<string, unknown>).forEach(
+          ([nestedKey, nestedValue]) => {
+            flattenedEntries.push([
+              `passkey.${nestedKey}` as keyof PasskeyFormValues,
+              nestedValue as PasskeyFormValues[keyof PasskeyFormValues],
+            ])
+          }
+        )
+      } else {
+        flattenedEntries.push([
+          key as keyof PasskeyFormValues,
+          value as PasskeyFormValues[keyof PasskeyFormValues],
+        ])
+      }
+    })
+
+    const data = Object.fromEntries(flattenedEntries) as PasskeyFormValues
+    const updates: Array<{ key: string; value: string | boolean }> = []
+
+    Object.entries(data).forEach(([key, value]) => {
+      if (key === 'passkey.origins') {
+        const processed = (value as string)
+          .split('\n')
+          .map((origin: string) => origin.trim())
+          .filter(Boolean)
+          .join(',')
+        const currentDefault = defaultValues['passkey.origins'] as string
+        if (processed !== currentDefault) {
+          updates.push({ key, value: processed })
+        }
+      } else if (key === 'passkey.attachment_preference') {
+        const attachmentPreference =
+          value as PasskeyFormValues['passkey.attachment_preference']
+        const incoming =
+          attachmentPreference === 'none' ? '' : attachmentPreference
+        const currentDefault =
+          defaultValues['passkey.attachment_preference'] === 'none'
+            ? ''
+            : defaultValues['passkey.attachment_preference']
+        if (incoming !== currentDefault) {
+          updates.push({ key, value: incoming })
+        }
+      } else if (value !== defaultValues[key as keyof PasskeyFormValues]) {
+        updates.push({ key, value })
+      }
+    })
+
+    for (const update of updates) {
+      await updateOption.mutateAsync(update)
+    }
+  }
+
+  return (
+    <SettingsSection
+      title={t('Passkey Authentication')}
+      description={t('Configure Passkey (WebAuthn) login settings')}
+    >
+      <Form {...form}>
+        <form onSubmit={form.handleSubmit(onSubmit)} className='space-y-6'>
+          <FormField
+            control={form.control}
+            name='passkey.enabled'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Enable Passkey')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t(
+                      'Allow users to register and sign in with Passkey (WebAuthn)'
+                    )}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='passkey.rp_display_name'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('Relying Party Display Name')}</FormLabel>
+                <FormControl>
+                  <Input
+                    placeholder={t('e.g. New API Console')}
+                    {...field}
+                    value={field.value ?? ''}
+                  />
+                </FormControl>
+                <FormDescription>
+                  {t(
+                    'Human-readable name shown to users during Passkey prompts.'
+                  )}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='passkey.rp_id'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('Relying Party ID')}</FormLabel>
+                <FormControl>
+                  <Input
+                    placeholder={t('e.g. example.com')}
+                    {...field}
+                    value={field.value ?? ''}
+                  />
+                </FormControl>
+                <FormDescription>
+                  {t(
+                    'The effective domain for Passkey registration. Must match the current domain or be its parent domain.'
+                  )}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='passkey.user_verification'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('User Verification')}</FormLabel>
+                <FormControl>
+                  <Select value={field.value} onValueChange={field.onChange}>
+                    <SelectTrigger>
+                      <SelectValue placeholder={t('Select requirement')} />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value='required'>{t('Required')}</SelectItem>
+                      <SelectItem value='preferred'>
+                        {t('Recommended')}
+                      </SelectItem>
+                      <SelectItem value='discouraged'>
+                        {t('Discouraged')}
+                      </SelectItem>
+                    </SelectContent>
+                  </Select>
+                </FormControl>
+                <FormDescription>
+                  {t(
+                    'Controls whether user verification (biometrics/PIN) is required during Passkey flows.'
+                  )}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='passkey.attachment_preference'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('Device Type Preference')}</FormLabel>
+                <FormControl>
+                  <Select value={field.value} onValueChange={field.onChange}>
+                    <SelectTrigger>
+                      <SelectValue placeholder={t('No preference')} />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value='none'>{t('Unlimited')}</SelectItem>
+                      <SelectItem value='platform'>
+                        {t('Built-in Device')}
+                      </SelectItem>
+                      <SelectItem value='cross-platform'>
+                        {t('External Device')}
+                      </SelectItem>
+                    </SelectContent>
+                  </Select>
+                </FormControl>
+                <FormDescription>
+                  {t(
+                    'Built-in: phone fingerprint/face, or Windows Hello; External: USB security key'
+                  )}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='passkey.allow_insecure_origin'
+            render={({ field }) => (
+              <FormItem className='flex flex-row items-center justify-between rounded-lg border p-4'>
+                <div className='space-y-0.5'>
+                  <FormLabel className='text-base'>
+                    {t('Allow Insecure Origins')}
+                  </FormLabel>
+                  <FormDescription>
+                    {t(
+                      'Permit Passkey registration on non-HTTPS origins (only recommended for development)'
+                    )}
+                  </FormDescription>
+                </div>
+                <FormControl>
+                  <Switch
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name='passkey.origins'
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('Allowed Origins')}</FormLabel>
+                <FormControl>
+                  <Textarea
+                    rows={4}
+                    placeholder={t('https://example.com')}
+                    {...field}
+                    value={field.value ?? ''}
+                  />
+                </FormControl>
+                <FormDescription>
+                  {t(
+                    'List of origins (one per line) allowed for Passkey registration and authentication.'
+                  )}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <Button type='submit'>{t('Save Changes')}</Button>
+        </form>
+      </Form>
+    </SettingsSection>
+  )
+}

web/default/src/features/system-settings/auth/section-registry.tsx

@@ -0,0 +1,127 @@
+import type { AuthSettings } from '../types'
+import { createSectionRegistry } from '../utils/section-registry'
+import { BasicAuthSection } from './basic-auth-section'
+import { BotProtectionSection } from './bot-protection-section'
+import { CustomOAuthSection } from './custom-oauth/custom-oauth-section'
+import { OAuthSection } from './oauth-section'
+import { PasskeySection } from './passkey-section'
+
+const AUTH_SECTIONS = [
+  {
+    id: 'basic-auth',
+    titleKey: 'Basic Authentication',
+    descriptionKey: 'Configure password-based login and registration',
+    build: (settings: AuthSettings) => (
+      <BasicAuthSection
+        defaultValues={{
+          PasswordLoginEnabled: settings.PasswordLoginEnabled,
+          PasswordRegisterEnabled: settings.PasswordRegisterEnabled,
+          EmailVerificationEnabled: settings.EmailVerificationEnabled,
+          RegisterEnabled: settings.RegisterEnabled,
+          EmailDomainRestrictionEnabled: settings.EmailDomainRestrictionEnabled,
+          EmailAliasRestrictionEnabled: settings.EmailAliasRestrictionEnabled,
+          EmailDomainWhitelist: settings.EmailDomainWhitelist,
+        }}
+      />
+    ),
+  },
+  {
+    id: 'oauth',
+    titleKey: 'OAuth Integrations',
+    descriptionKey: 'Configure third-party authentication providers',
+    build: (settings: AuthSettings) => (
+      <OAuthSection
+        defaultValues={{
+          GitHubOAuthEnabled: settings.GitHubOAuthEnabled,
+          GitHubClientId: settings.GitHubClientId,
+          GitHubClientSecret: settings.GitHubClientSecret,
+          'discord.enabled': settings['discord.enabled'],
+          'discord.client_id': settings['discord.client_id'],
+          'discord.client_secret': settings['discord.client_secret'],
+          'oidc.enabled': settings['oidc.enabled'],
+          'oidc.client_id': settings['oidc.client_id'],
+          'oidc.client_secret': settings['oidc.client_secret'],
+          'oidc.well_known': settings['oidc.well_known'],
+          'oidc.authorization_endpoint':
+            settings['oidc.authorization_endpoint'],
+          'oidc.token_endpoint': settings['oidc.token_endpoint'],
+          'oidc.user_info_endpoint': settings['oidc.user_info_endpoint'],
+          TelegramOAuthEnabled: settings.TelegramOAuthEnabled,
+          TelegramBotToken: settings.TelegramBotToken,
+          TelegramBotName: settings.TelegramBotName,
+          LinuxDOOAuthEnabled: settings.LinuxDOOAuthEnabled,
+          LinuxDOClientId: settings.LinuxDOClientId,
+          LinuxDOClientSecret: settings.LinuxDOClientSecret,
+          LinuxDOMinimumTrustLevel: settings.LinuxDOMinimumTrustLevel,
+          WeChatAuthEnabled: settings.WeChatAuthEnabled,
+          WeChatServerAddress: settings.WeChatServerAddress,
+          WeChatServerToken: settings.WeChatServerToken,
+          WeChatAccountQRCodeImageURL: settings.WeChatAccountQRCodeImageURL,
+        }}
+      />
+    ),
+  },
+  {
+    id: 'passkey',
+    titleKey: 'Passkey Authentication',
+    descriptionKey: 'Configure Passkey (WebAuthn) login settings',
+    build: (settings: AuthSettings) => (
+      <PasskeySection
+        defaultValues={{
+          'passkey.enabled': settings['passkey.enabled'],
+          'passkey.rp_display_name': settings['passkey.rp_display_name'],
+          'passkey.rp_id': settings['passkey.rp_id'],
+          'passkey.origins': settings['passkey.origins'],
+          'passkey.allow_insecure_origin':
+            settings['passkey.allow_insecure_origin'],
+          'passkey.user_verification': settings['passkey.user_verification'] as
+            | 'required'
+            | 'preferred'
+            | 'discouraged',
+          'passkey.attachment_preference': (settings[
+            'passkey.attachment_preference'
+          ] === ''
+            ? 'none'
+            : settings['passkey.attachment_preference']) as
+            | 'none'
+            | 'platform'
+            | 'cross-platform',
+        }}
+      />
+    ),
+  },
+  {
+    id: 'bot-protection',
+    titleKey: 'Bot Protection',
+    descriptionKey: 'Protect login and registration with Cloudflare Turnstile',
+    build: (settings: AuthSettings) => (
+      <BotProtectionSection
+        defaultValues={{
+          TurnstileCheckEnabled: settings.TurnstileCheckEnabled,
+          TurnstileSiteKey: settings.TurnstileSiteKey,
+          TurnstileSecretKey: settings.TurnstileSecretKey,
+        }}
+      />
+    ),
+  },
+  {
+    id: 'custom-oauth',
+    titleKey: 'Custom OAuth',
+    descriptionKey: 'Configure custom OAuth providers for user authentication',
+    build: () => <CustomOAuthSection />,
+  },
+] as const
+
+export type AuthSectionId = (typeof AUTH_SECTIONS)[number]['id']
+
+const authRegistry = createSectionRegistry<AuthSectionId, AuthSettings>({
+  sections: AUTH_SECTIONS,
+  defaultSection: 'basic-auth',
+  basePath: '/system-settings/auth',
+  urlStyle: 'path',
+})
+
+export const AUTH_SECTION_IDS = authRegistry.sectionIds
+export const AUTH_DEFAULT_SECTION = authRegistry.defaultSection
+export const getAuthSectionNavItems = authRegistry.getSectionNavItems
+export const getAuthSectionContent = authRegistry.getSectionContent