diff --git a/src/dotnet/Modgud.Api.Tests/Authorization/ApplicationSettingsAdminTests.cs b/src/dotnet/Modgud.Api.Tests/Authorization/ApplicationSettingsAdminTests.cs
index 2f6849f5..6f39c624 100644
--- a/src/dotnet/Modgud.Api.Tests/Authorization/ApplicationSettingsAdminTests.cs
+++ b/src/dotnet/Modgud.Api.Tests/Authorization/ApplicationSettingsAdminTests.cs
@@ -3,6 +3,7 @@
 using BuildingBlocks.Helper;
 using Marten;
 using Microsoft.Extensions.DependencyInjection;
+using Modgud.Api.Features.Admin.Apps;
 using Modgud.Api.Tests.Infrastructure;
 using Modgud.Application.DTOs.Applications;
 using Modgud.Authorization.Apps;
@@ -13,25 +14,68 @@
 namespace Modgud.Api.Tests.Authorization;
 
 /// <summary>
-/// ADR-0011 — admin API for per-Application settings overrides
-/// (<c>GET</c>/<c>PATCH /api/app/{id}/settings</c>): patch→get roundtrip across
-/// sections, the Origin write also populating the global host→App routing map,
-/// validation, and cross-app subdomain uniqueness.
+/// ADR-0011 — an App is ONE resource: the per-App settings override is carried on the
+/// unified App endpoint (<c>POST</c>/<c>PUT</c>/<c>GET /api/app</c>), there is no separate
+/// <c>/settings</c> endpoint. Covers the atomic create (App + settings in one transaction,
+/// and an invalid settings section rejecting the whole create), the update roundtrip across
+/// sections, the Origin write also populating the global host→App routing map, validation,
+/// and cross-app subdomain uniqueness.
 /// </summary>
 [Collection(IntegrationTestCollection.Name)]
 public class ApplicationSettingsAdminTests : IntegrationTestBase
 {
     public ApplicationSettingsAdminTests(SharedPostgresFixture fixture) : base(fixture) { }
 
+    private sealed record AppRead(string Id, string Slug, ApplicationSettingsDto? Settings);
+
+    [Fact]
+    public async Task Create_With_Settings_PersistsBoth_Atomically()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var settings = new ApplicationSettingsDto
+        {
+            NativeGrants = new ApplicationNativeGrantsDto { Enabled = true, AccessTokenLifetimeMinutes = 10 },
+            Branding = new ApplicationBrandingDto { ProductName = "Created Together" },
+        };
+
+        var resp = await Client.PostAsJsonAsync("/api/app",
+            new CreateAppDto("as-create-app", "As Create App", null, [], settings), JsonOptions, ct);
+        Assert.True(resp.IsSuccessStatusCode, $"POST failed ({(int)resp.StatusCode}): {await resp.Content.ReadAsStringAsync(ct)}");
+
+        var created = await resp.Content.ReadFromJsonAsync<AppRead>(JsonOptions, ct);
+        Assert.True(created!.Settings!.NativeGrants!.Enabled);
+        Assert.Equal("Created Together", created.Settings.Branding!.ProductName);
+
+        // Re-read confirms the override was committed alongside the App.
+        var got = await GetAppAsync(created.Id, ct);
+        Assert.Equal(10, got.Settings!.NativeGrants!.AccessTokenLifetimeMinutes);
+    }
+
+    [Fact]
+    public async Task Create_With_Invalid_Settings_RejectsWholeCreate()
+    {
+        var ct = TestContext.Current.CancellationToken;
+
+        // The App itself is valid, but the settings section is not → the whole create is
+        // rejected and NO App is left behind (one atomic transaction).
+        var resp = await Client.PostAsJsonAsync("/api/app",
+            new CreateAppDto("as-atomic-app", "As Atomic App", null, [],
+                new ApplicationSettingsDto { SelfRegistration = new ApplicationSelfRegistrationDto { Posture = "Nope" } }),
+            JsonOptions, ct);
+
+        Assert.Equal(HttpStatusCode.BadRequest, resp.StatusCode);
+        Assert.False(await AppExistsAsync("as-atomic-app"), "the App must not be persisted when its settings are invalid");
+    }
+
     [Fact]
-    public async Task Patch_Then_Get_Roundtrips_And_Writes_The_Routing_Map()
+    public async Task Update_Settings_Roundtrips_And_Writes_The_Routing_Map()
     {
         var ct = TestContext.Current.CancellationToken;
-        var app = await CreateAppAsync("as-admin-app");
+        var app = await SeedAppAsync("as-admin-app");
         var appShort = new ShortGuid(app.Id).ToString();
         var host = $"as-admin.{await SystemPrimaryDomainAsync()}";
 
-        var patch = new ApplicationSettingsDto
+        var settings = new ApplicationSettingsDto
         {
             SelfRegistration = new ApplicationSelfRegistrationDto { Posture = "Off", Enabled = true },
             NativeGrants = new ApplicationNativeGrantsDto { Enabled = true, AccessTokenLifetimeMinutes = 10 },
@@ -41,12 +85,12 @@ public async Task Patch_Then_Get_Roundtrips_And_Writes_The_Routing_Map()
             RegistrationFields = new ApplicationRegistrationFieldsDto { Firstname = "Required", Lastname = "Off" },
             Origin = new ApplicationOriginDto { Subdomain = host },
         };
-        var patchResp = await Client.PatchAsJsonAsync($"/api/app/{appShort}/settings", patch, JsonOptions, ct);
-        Assert.True(patchResp.IsSuccessStatusCode,
-            $"PATCH failed ({(int)patchResp.StatusCode}): {await patchResp.Content.ReadAsStringAsync(ct)}");
+        var putResp = await Client.PutAsJsonAsync($"/api/app/{appShort}",
+            new UpdateAppDto("As Admin App", null, [], settings), JsonOptions, ct);
+        Assert.True(putResp.IsSuccessStatusCode,
+            $"PUT failed ({(int)putResp.StatusCode}): {await putResp.Content.ReadAsStringAsync(ct)}");
 
-        var got = await (await Client.GetAsync($"/api/app/{appShort}/settings", ct))
-            .Content.ReadFromJsonAsync<ApplicationSettingsDto>(JsonOptions, ct);
+        var got = (await GetAppAsync(appShort, ct)).Settings;
         Assert.Equal("Off", got!.SelfRegistration!.Posture);
         Assert.True(got.SelfRegistration.Enabled);
         Assert.True(got.NativeGrants!.Enabled);
@@ -69,48 +113,51 @@ public async Task Patch_Then_Get_Roundtrips_And_Writes_The_Routing_Map()
     }
 
     [Fact]
-    public async Task Patch_Rejects_Invalid_Values()
+    public async Task Update_Rejects_Invalid_Values()
     {
         var ct = TestContext.Current.CancellationToken;
-        var app = await CreateAppAsync("as-invalid-app");
+        var app = await SeedAppAsync("as-invalid-app");
         var appShort = new ShortGuid(app.Id).ToString();
 
         // Bad posture.
-        Assert.Equal(HttpStatusCode.BadRequest, (await Client.PatchAsJsonAsync($"/api/app/{appShort}/settings",
-            new ApplicationSettingsDto { SelfRegistration = new ApplicationSelfRegistrationDto { Posture = "Nope" } },
-            JsonOptions, ct)).StatusCode);
+        Assert.Equal(HttpStatusCode.BadRequest, (await PutSettingsAsync(appShort,
+            new ApplicationSettingsDto { SelfRegistration = new ApplicationSelfRegistrationDto { Posture = "Nope" } }, ct)).StatusCode);
 
         // Subdomain not under the realm's primary domain.
-        Assert.Equal(HttpStatusCode.BadRequest, (await Client.PatchAsJsonAsync($"/api/app/{appShort}/settings",
-            new ApplicationSettingsDto { Origin = new ApplicationOriginDto { Subdomain = "evil.example.com" } },
-            JsonOptions, ct)).StatusCode);
+        Assert.Equal(HttpStatusCode.BadRequest, (await PutSettingsAsync(appShort,
+            new ApplicationSettingsDto { Origin = new ApplicationOriginDto { Subdomain = "evil.example.com" } }, ct)).StatusCode);
 
         // Out-of-bounds token lifetime.
-        Assert.Equal(HttpStatusCode.BadRequest, (await Client.PatchAsJsonAsync($"/api/app/{appShort}/settings",
-            new ApplicationSettingsDto { NativeGrants = new ApplicationNativeGrantsDto { AccessTokenLifetimeMinutes = 9999 } },
-            JsonOptions, ct)).StatusCode);
+        Assert.Equal(HttpStatusCode.BadRequest, (await PutSettingsAsync(appShort,
+            new ApplicationSettingsDto { NativeGrants = new ApplicationNativeGrantsDto { AccessTokenLifetimeMinutes = 9999 } }, ct)).StatusCode);
     }
 
     [Fact]
     public async Task Subdomain_Is_Unique_Across_Apps()
     {
         var ct = TestContext.Current.CancellationToken;
-        var app1 = await CreateAppAsync("as-uniq-1");
-        var app2 = await CreateAppAsync("as-uniq-2");
+        var app1 = await SeedAppAsync("as-uniq-1");
+        var app2 = await SeedAppAsync("as-uniq-2");
         var host = $"as-uniq.{await SystemPrimaryDomainAsync()}";
 
-        var first = await Client.PatchAsJsonAsync($"/api/app/{new ShortGuid(app1.Id)}/settings",
-            new ApplicationSettingsDto { Origin = new ApplicationOriginDto { Subdomain = host } }, JsonOptions, ct);
+        var first = await PutSettingsAsync(new ShortGuid(app1.Id).ToString(),
+            new ApplicationSettingsDto { Origin = new ApplicationOriginDto { Subdomain = host } }, ct);
         Assert.True(first.IsSuccessStatusCode);
 
-        var second = await Client.PatchAsJsonAsync($"/api/app/{new ShortGuid(app2.Id)}/settings",
-            new ApplicationSettingsDto { Origin = new ApplicationOriginDto { Subdomain = host } }, JsonOptions, ct);
+        var second = await PutSettingsAsync(new ShortGuid(app2.Id).ToString(),
+            new ApplicationSettingsDto { Origin = new ApplicationOriginDto { Subdomain = host } }, ct);
         Assert.Equal(HttpStatusCode.Conflict, second.StatusCode);
     }
 
     // ── Helpers ──────────────────────────────────────────────────────────────
 
-    private async Task<App> CreateAppAsync(string slug)
+    private Task<HttpResponseMessage> PutSettingsAsync(string appShort, ApplicationSettingsDto settings, CancellationToken ct) =>
+        Client.PutAsJsonAsync($"/api/app/{appShort}", new UpdateAppDto(appShort, null, [], settings), JsonOptions, ct);
+
+    private async Task<AppRead> GetAppAsync(string appShort, CancellationToken ct) =>
+        (await (await Client.GetAsync($"/api/app/{appShort}", ct)).Content.ReadFromJsonAsync<AppRead>(JsonOptions, ct))!;
+
+    private async Task<App> SeedAppAsync(string slug)
     {
         using var scope = Factory.Services.CreateScope();
         var session = scope.ServiceProvider.GetRequiredService<IDocumentSession>();
@@ -121,6 +168,14 @@ private async Task<App> CreateAppAsync(string slug)
         return (await session.LoadAsync<App>(id, TestContext.Current.CancellationToken))!;
     }
 
+    private async Task<bool> AppExistsAsync(string slug)
+    {
+        using var scope = Factory.Services.CreateScope();
+        var session = scope.ServiceProvider.GetRequiredService<IDocumentSession>();
+        return await session.Query<App>().Where(a => a.Slug == slug && !a.IsDeleted)
+            .AnyAsync(TestContext.Current.CancellationToken);
+    }
+
     private async Task<string> SystemPrimaryDomainAsync()
     {
         var globalStore = Factory.Services.GetRequiredService<IGlobalStore>();
diff --git a/src/dotnet/Modgud.Api.Tests/Authorization/InviteCodeRegistrationFlowTests.cs b/src/dotnet/Modgud.Api.Tests/Authorization/InviteCodeRegistrationFlowTests.cs
index 83a350ba..e1155079 100644
--- a/src/dotnet/Modgud.Api.Tests/Authorization/InviteCodeRegistrationFlowTests.cs
+++ b/src/dotnet/Modgud.Api.Tests/Authorization/InviteCodeRegistrationFlowTests.cs
@@ -166,21 +166,28 @@ public async Task InviteCode_ConfirmedUser_With_Code_Is_Plain_Login_Code_Untouch
     }
 
     [Fact]
-    public async Task InviteCode_Posture_RoundTrips_Through_Settings_Endpoint()
+    public async Task InviteCode_Posture_RoundTrips_Through_App_Resource()
     {
-        // Gate 1 — the new posture value survives PATCH → GET on the per-App
-        // settings surface (sparse, zero-migration).
+        // Gate 1 — the new posture value survives a unified App update → GET on the
+        // single App resource (settings carried inline; sparse, zero-migration).
         var ct = TestContext.Current.CancellationToken;
         var app = await CreateAppAsync("adr12-posture");
         var appShort = new ShortGuid(app.Id).ToString();
 
-        var patch = await Client.PatchAsJsonAsync(
-            $"/api/app/{appShort}/settings",
-            new { SelfRegistration = new { Posture = "InviteCode" } }, ct);
-        Assert.Equal(HttpStatusCode.OK, patch.StatusCode);
-
-        var got = await Client.GetFromJsonAsync<JsonElement>($"/api/app/{appShort}/settings", JsonOptions, ct);
-        Assert.Equal("InviteCode", got.GetProperty("SelfRegistration").GetProperty("Posture").GetString());
+        var put = await Client.PutAsJsonAsync(
+            $"/api/app/{appShort}",
+            new
+            {
+                DisplayName = "adr12-posture",
+                Description = (string?)null,
+                Permissions = Array.Empty<object>(),
+                Settings = new { SelfRegistration = new { Posture = "InviteCode" } },
+            }, ct);
+        Assert.Equal(HttpStatusCode.OK, put.StatusCode);
+
+        var got = await Client.GetFromJsonAsync<JsonElement>($"/api/app/{appShort}", JsonOptions, ct);
+        Assert.Equal("InviteCode",
+            got.GetProperty("Settings").GetProperty("SelfRegistration").GetProperty("Posture").GetString());
     }
 
     [Fact]
diff --git a/src/dotnet/Modgud.Api/Features/Admin/Apps/AppAdminService.cs b/src/dotnet/Modgud.Api/Features/Admin/Apps/AppAdminService.cs
index 9885df16..1353c089 100644
--- a/src/dotnet/Modgud.Api/Features/Admin/Apps/AppAdminService.cs
+++ b/src/dotnet/Modgud.Api/Features/Admin/Apps/AppAdminService.cs
@@ -1,5 +1,7 @@
 using ErrorOr;
 using Marten;
+using Modgud.Application.DTOs.Applications;
+using Modgud.Authentication.Applications;
 using Modgud.Authorization.Apps;
 using Modgud.Authorization.Events;
 using Modgud.Domain.OAuth.Apis;
@@ -14,8 +16,16 @@ namespace Modgud.Api.Features.Admin.Apps;
 /// endpoint maps it to HTTP while the applier consumes it directly. The injected
 /// <see cref="IDocumentSession"/> is tenant-scoped, so a call lands in whatever realm
 /// the ambient <c>TenantContext</c> selects.
+///
+/// <para>An App is ONE resource: when <see cref="CreateAppDto.Settings"/> /
+/// <see cref="UpdateAppDto.Settings"/> is supplied, the per-App ADR-0011 settings override
+/// is written in the SAME tenant transaction as the App aggregate (atomic). The only piece
+/// that cannot be — the <c>Origin</c> subdomain, which drives the GLOBAL host→App routing
+/// map in a different database — is validated up-front (so an invalid subdomain rejects the
+/// whole call before any commit) and its routing applied right after the atomic commit. The
+/// applier passes no settings, so its behaviour is unchanged.</para>
 /// </summary>
-public sealed class AppAdminService(IDocumentSession session)
+public sealed class AppAdminService(IDocumentSession session, IApplicationSettingsService settingsSvc)
 {
     public async Task<ErrorOr<App>> CreateAppAsync(CreateAppDto dto, CancellationToken ct = default)
     {
@@ -46,8 +56,19 @@ public async Task<ErrorOr<App>> CreateAppAsync(CreateAppDto dto, CancellationTok
             Description: dto.Description,
             Permissions: permissions.Value,
             IsSystem: false));
+
+        // App + its settings override commit together (atomic) — see class summary.
+        if (dto.Settings is not null)
+        {
+            var staged = await StageSettingsAsync(id, dto.Settings, ct);
+            if (staged.IsError) return staged.Errors;
+        }
+
         await session.SaveChangesAsync(ct);
 
+        var originApplied = await ApplyOriginIfAnyAsync(id, dto.Settings, ct);
+        if (originApplied.IsError) return originApplied.Errors;
+
         return (await session.LoadAsync<App>(id, ct))!;
     }
 
@@ -97,11 +118,52 @@ public async Task<ErrorOr<App>> UpdateAppAsync(Guid id, UpdateAppDto dto, Cancel
 
         session.Events.Append(id, new AppUpdatedEvent(
             id, dto.DisplayName, dto.Description, permissions.Value));
+
+        // App + its settings override commit together (atomic) — see class summary.
+        if (dto.Settings is not null)
+        {
+            var staged = await StageSettingsAsync(id, dto.Settings, ct);
+            if (staged.IsError) return staged.Errors;
+        }
+
         await session.SaveChangesAsync(ct);
 
+        var originApplied = await ApplyOriginIfAnyAsync(id, dto.Settings, ct);
+        if (originApplied.IsError) return originApplied.Errors;
+
         return (await session.LoadAsync<App>(id, ct))!;
     }
 
+    /// <summary>
+    /// Validates the Origin subdomain up-front (so an invalid one rejects the whole
+    /// create/update before any commit) and stages every other settings section onto the
+    /// shared session — committed atomically with the App by the caller's SaveChangesAsync.
+    /// </summary>
+    private async Task<ErrorOr<Success>> StageSettingsAsync(Guid appId, ApplicationSettingsDto settings, CancellationToken ct)
+    {
+        if (settings.Origin is not null)
+        {
+            var validOrigin = await settingsSvc.ValidateOriginAsync(appId, settings.Origin.Subdomain, ct);
+            if (validOrigin.IsError) return validOrigin.Errors;
+        }
+        var staged = await settingsSvc.StageNonOriginAsync(appId, settings, ct);
+        return staged.IsError ? staged.Errors : Result.Success;
+    }
+
+    /// <summary>
+    /// Applies the Origin subdomain → GLOBAL host routing AFTER the atomic tenant commit
+    /// (the routing map lives in a different database, so it can't be in the tenant
+    /// transaction). Already validated in <see cref="StageSettingsAsync"/>, so this only
+    /// fails on a race or infrastructure error — and then the App + its other settings are
+    /// already persisted (a valid state; only the subdomain route is missing).
+    /// </summary>
+    private async Task<ErrorOr<Success>> ApplyOriginIfAnyAsync(Guid appId, ApplicationSettingsDto? settings, CancellationToken ct)
+    {
+        if (settings?.Origin is null) return Result.Success;
+        var r = await settingsSvc.PatchAsync(appId, new ApplicationSettingsDto { Origin = settings.Origin }, ct);
+        return r.IsError ? r.Errors : Result.Success;
+    }
+
     /// <summary>
     /// The single canonical delete path for an <see cref="App"/>, shared by
     /// <see cref="AppsEndpoints"/> and the realm-provisioning applier's prune. Refuses the
diff --git a/src/dotnet/Modgud.Api/Features/Admin/Apps/ApplicationSettingsEndpoints.cs b/src/dotnet/Modgud.Api/Features/Admin/Apps/ApplicationSettingsEndpoints.cs
deleted file mode 100644
index 71821d06..00000000
--- a/src/dotnet/Modgud.Api/Features/Admin/Apps/ApplicationSettingsEndpoints.cs
+++ /dev/null
@@ -1,62 +0,0 @@
-using BuildingBlocks.Helper;
-using Modgud.Application.DTOs.Applications;
-using Modgud.Authentication.Applications;
-using Modgud.Authorization.AspNetCore;
-
-namespace Modgud.Api.Features.Admin.Apps;
-
-/// <summary>
-/// ADR-0011 — admin surface for a per-Application settings override (the
-/// tenant-scoped <c>ApplicationSettings</c> doc keyed by <c>App.Id</c>). Sparse:
-/// GET returns only what the App overrides (null section = inherits the realm);
-/// PATCH replaces provided sections (a null section = no change). Setting
-/// <c>Origin.Subdomain</c> also writes the global host→App routing map. Gated by
-/// the same <c>app:read</c>/<c>app:write</c> permissions as the rest of App admin.
-/// </summary>
-public static class ApplicationSettingsEndpoints
-{
-    public static WebApplication MapApplicationSettingsEndpoints(this WebApplication application, string path)
-    {
-        var group = application.MapGroup($"{path}/app")
-            .WithTags("Application Settings")
-            .RequireAuthorization();
-
-        group.MapGet("{id}/settings", async (
-                ShortGuid id,
-                IApplicationSettingsService svc,
-                CancellationToken ct) =>
-            {
-                var result = await svc.GetAsync(id.Guid, ct);
-                return result.Match(Results.Ok, Problem);
-            })
-            .WithName("V2_App_Settings_Get")
-            .RequiresPermission("app:read");
-
-        group.MapPatch("{id}/settings", async (
-                ShortGuid id,
-                ApplicationSettingsDto dto,
-                IApplicationSettingsService svc,
-                CancellationToken ct) =>
-            {
-                var result = await svc.PatchAsync(id.Guid, dto, ct);
-                return result.Match(Results.Ok, Problem);
-            })
-            .WithName("V2_App_Settings_Patch")
-            .RequiresPermission("app:write");
-
-        return application;
-    }
-
-    private static IResult Problem(List<ErrorOr.Error> errors)
-    {
-        var first = errors[0];
-        var status = first.Type switch
-        {
-            ErrorOr.ErrorType.NotFound => StatusCodes.Status404NotFound,
-            ErrorOr.ErrorType.Validation => StatusCodes.Status400BadRequest,
-            ErrorOr.ErrorType.Conflict => StatusCodes.Status409Conflict,
-            _ => StatusCodes.Status500InternalServerError,
-        };
-        return Results.Problem(statusCode: status, title: first.Code, detail: first.Description);
-    }
-}
diff --git a/src/dotnet/Modgud.Api/Features/Admin/Apps/AppsEndpoints.cs b/src/dotnet/Modgud.Api/Features/Admin/Apps/AppsEndpoints.cs
index c6fb6c63..d04d4a6f 100644
--- a/src/dotnet/Modgud.Api/Features/Admin/Apps/AppsEndpoints.cs
+++ b/src/dotnet/Modgud.Api/Features/Admin/Apps/AppsEndpoints.cs
@@ -1,7 +1,9 @@
 using BuildingBlocks.Helper;
 using ErrorOr;
+using Modgud.Application.DTOs.Applications;
 using Modgud.Application.DTOs.OAuth;
 using Modgud.Application.Services;
+using Modgud.Authentication.Applications;
 using Modgud.Authorization.Apps;
 using Modgud.Authorization.AspNetCore;
 using Marten;
@@ -25,12 +27,17 @@ public record CreateAppDto(
     string Slug,
     string DisplayName,
     string? Description,
-    List<AppPermissionDto> Permissions);
+    List<AppPermissionDto> Permissions,
+    // ADR-0011 — an App is ONE resource: the optional per-App settings override is created
+    // in the SAME tenant transaction as the App (see AppAdminService). Null = inherit the
+    // realm everywhere (the zero-config default). The applier never sends it.
+    ApplicationSettingsDto? Settings = null);
 
 public record UpdateAppDto(
     string DisplayName,
     string? Description,
-    List<AppPermissionDto> Permissions);
+    List<AppPermissionDto> Permissions,
+    ApplicationSettingsDto? Settings = null);
 
 /// <summary>
 /// Admin surface for managing <see cref="App"/> records — the per-realm list
@@ -74,34 +81,41 @@ public static WebApplication MapAppsEndpoints(this WebApplication application, s
                     .OrderBy(a => a.Slug)
                     .ToListAsync();
 
-                return Results.Ok(apps.Select(MapToResponse));
+                return Results.Ok(apps.Select(a => MapToResponse(a)));
             })
             .WithName("V2_App_GetAll")
             .RequiresPermission("app:read");
 
-        appGroup.MapGet("{id}", async (ShortGuid id, IDocumentSession session) =>
+        appGroup.MapGet("{id}", async (ShortGuid id, IDocumentSession session, IApplicationSettingsService settingsSvc, CancellationToken ct) =>
             {
-                var app = await session.LoadAsync<App>(id.Guid);
+                var app = await session.LoadAsync<App>(id.Guid, ct);
                 if (app is null || app.IsDeleted) return Results.NotFound();
-                return Results.Ok(MapToResponse(app));
+                var settings = await settingsSvc.GetAsync(id.Guid, ct);
+                return Results.Ok(MapToResponse(app, settings.IsError ? null : settings.Value));
             })
             .WithName("V2_App_GetById")
             .RequiresPermission("app:read");
 
         // Create / Update both delegate to the shared AppAdminService — the single
         // canonical write path the realm-provisioning applier also calls (no divergence).
-        appGroup.MapPost("", async (CreateAppDto dto, AppAdminService appAdmin, CancellationToken ct) =>
+        appGroup.MapPost("", async (CreateAppDto dto, AppAdminService appAdmin, IApplicationSettingsService settingsSvc, CancellationToken ct) =>
             {
                 var result = await appAdmin.CreateAppAsync(dto, ct);
-                return result.IsError ? ToErrorResult(result.FirstError) : Results.Ok(MapToResponse(result.Value));
+                if (result.IsError) return ToErrorResult(result.FirstError);
+                var settings = await settingsSvc.GetAsync(result.Value.Id, ct);
+                return Results.Ok(MapToResponse(result.Value, settings.IsError ? null : settings.Value));
             })
             .WithName("V2_App_Create")
             .RequiresPermission("app:write");
 
-        appGroup.MapPut("{id}", async (ShortGuid id, UpdateAppDto dto, AppAdminService appAdmin, CancellationToken ct) =>
+        appGroup.MapPut("{id}", async (ShortGuid id, UpdateAppDto dto, AppAdminService appAdmin, IApplicationSettingsService settingsSvc, CancellationToken ct) =>
             {
                 var result = await appAdmin.UpdateAppAsync(id.Guid, dto, ct);
-                if (!result.IsError) return Results.Ok(MapToResponse(result.Value));
+                if (!result.IsError)
+                {
+                    var settings = await settingsSvc.GetAsync(id.Guid, ct);
+                    return Results.Ok(MapToResponse(result.Value, settings.IsError ? null : settings.Value));
+                }
 
                 var error = result.FirstError;
                 // The catalog-delete block carries its rich blocker list through the error
@@ -155,7 +169,9 @@ public static WebApplication MapAppsEndpoints(this WebApplication application, s
         return application;
     }
 
-    private static object MapToResponse(App a) => new
+    // The list endpoint passes no settings (the grid doesn't show them); the detail / create /
+    // update responses pass the per-App settings override so the single App modal can render it.
+    private static object MapToResponse(App a, ApplicationSettingsDto? settings = null) => new
     {
         Id = new ShortGuid(a.Id).ToString(),
         a.Slug,
@@ -171,6 +187,7 @@ public static WebApplication MapAppsEndpoints(this WebApplication application, s
             })
             .ToList(),
         a.IsSystem,
+        Settings = settings,
     };
 
     // Renders an AppAdminService ErrorOr error with the error code in the body. The shared
diff --git a/src/dotnet/Modgud.Api/Program.cs b/src/dotnet/Modgud.Api/Program.cs
index c7d04bc8..1e7936c2 100644
--- a/src/dotnet/Modgud.Api/Program.cs
+++ b/src/dotnet/Modgud.Api/Program.cs
@@ -1268,8 +1268,9 @@
     app.MapPrincipalEndpoints("api");
     app.MapRolesEndpoints("api");
     app.MapGroupEndpoints("api");
+    // An App is one resource: AppsEndpoints carries the per-App ADR-0011 settings override
+    // inline (POST/PUT/GET /api/app), so there is no separate /settings endpoint.
     Modgud.Api.Features.Admin.Apps.AppsEndpoints.MapAppsEndpoints(app, "api");
-    Modgud.Api.Features.Admin.Apps.ApplicationSettingsEndpoints.MapApplicationSettingsEndpoints(app, "api");
     // ADR-0012 — app-scoped invite codes (dual-auth: invite:write scope or invite-code:write permission).
     Modgud.Api.Features.InviteCodes.InviteCodeEndpoints.MapInviteCodeEndpoints(app, "api");
 
diff --git a/src/dotnet/Modgud.Authentication/Applications/ApplicationSettingsService.cs b/src/dotnet/Modgud.Authentication/Applications/ApplicationSettingsService.cs
index 7498edde..040f8ba5 100644
--- a/src/dotnet/Modgud.Authentication/Applications/ApplicationSettingsService.cs
+++ b/src/dotnet/Modgud.Authentication/Applications/ApplicationSettingsService.cs
@@ -23,6 +23,24 @@ public interface IApplicationSettingsService
 {
     Task<ErrorOr<ApplicationSettingsDto>> GetAsync(Guid applicationId, CancellationToken ct = default);
     Task<ErrorOr<ApplicationSettingsDto>> PatchAsync(Guid applicationId, ApplicationSettingsDto dto, CancellationToken ct = default);
+
+    /// <summary>
+    /// Stages the per-App settings override (every section EXCEPT <c>Origin</c>) onto the
+    /// caller's shared <see cref="IDocumentSession"/> WITHOUT committing, so it lands in the
+    /// same tenant transaction as the App aggregate — the unified, atomic App create/update.
+    /// <c>Origin</c> is excluded because it also drives the GLOBAL host→App routing map (a
+    /// different database, so inherently a separate write): validate it up-front via
+    /// <see cref="ValidateOriginAsync"/> and apply it via <see cref="PatchAsync"/> AFTER the
+    /// atomic commit. No app-existence check — the caller (<c>AppAdminService</c>) guarantees it.
+    /// </summary>
+    Task<ErrorOr<Success>> StageNonOriginAsync(Guid applicationId, ApplicationSettingsDto dto, CancellationToken ct = default);
+
+    /// <summary>
+    /// Read-only validation of an Origin subdomain (format, child-of-the-realm-primary,
+    /// cross-realm uniqueness) so a unified create/update can reject an invalid subdomain
+    /// up-front — before committing anything. An empty/null subdomain (a clear) is always valid.
+    /// </summary>
+    Task<ErrorOr<Success>> ValidateOriginAsync(Guid applicationId, string? subdomain, CancellationToken ct = default);
 }
 
 public sealed class ApplicationSettingsService(
@@ -135,14 +153,98 @@ public async Task<ErrorOr<ApplicationSettingsDto>> PatchAsync(
         return app is { IsDeleted: false } ? app : null;
     }
 
+    // ── Atomic-create staging (every section except Origin, no commit) ────────
+    // REPLACE semantics: the DTO is the COMPLETE desired override state (the unified App
+    // create/update is a replace, not a sparse patch). A provided section sets the override;
+    // a NULL section CLEARS it (→ inherit the realm). This is what keeps the modal honest —
+    // an unchecked section round-trips back unchecked instead of as an empty-but-present
+    // override. (PatchAsync stays sparse for the Origin-only follow-on.)
+
+    public async Task<ErrorOr<Success>> StageNonOriginAsync(
+        Guid applicationId, ApplicationSettingsDto dto, CancellationToken ct = default)
+    {
+        var doc = await session.LoadAsync<ApplicationSettings>(applicationId, ct)
+                  ?? new ApplicationSettings { Id = applicationId, CreatedAt = DateTimeOffset.UtcNow };
+        if (doc.CreatedAt == default) doc.CreatedAt = DateTimeOffset.UtcNow;
+
+        if (dto.SelfRegistration is null) doc.SelfRegistration = null;
+        else { var r = MapSelfRegistration(dto.SelfRegistration); if (r.IsError) return r.FirstError; doc.SelfRegistration = r.Value; }
+
+        if (dto.NativeGrants is null) doc.NativeGrants = null;
+        else { var r = MapNativeGrants(dto.NativeGrants); if (r.IsError) return r.FirstError; doc.NativeGrants = r.Value; }
+
+        if (dto.Dcr is null) doc.Dcr = null;
+        else { var r = MapDcr(dto.Dcr); if (r.IsError) return r.FirstError; doc.Dcr = r.Value; }
+
+        if (dto.Cimd is null) doc.Cimd = null;
+        else { var r = MapCimd(dto.Cimd); if (r.IsError) return r.FirstError; doc.Cimd = r.Value; }
+
+        if (dto.Branding is null) doc.Branding = null;
+        else { var r = MapBranding(dto.Branding); if (r.IsError) return r.FirstError; doc.Branding = r.Value; }
+
+        doc.EmailBranding = string.IsNullOrWhiteSpace(dto.EmailBranding?.ProductName)
+            ? null
+            : new ApplicationEmailBranding { ProductName = dto.EmailBranding.ProductName!.Trim() };
+
+        if (dto.RegistrationFields is null) doc.RegistrationFields = null;
+        else { var r = MapRegistrationFields(dto.RegistrationFields); if (r.IsError) return r.FirstError; doc.RegistrationFields = r.Value; }
+
+        doc.UpdatedAt = DateTimeOffset.UtcNow;
+        session.Store(doc);   // enrolled on the shared session; the caller commits.
+        return ErrorOr.Result.Success;
+    }
+
     // ── Origin / global routing map ──────────────────────────────────────────
 
+    public async Task<ErrorOr<Success>> ValidateOriginAsync(
+        Guid applicationId, string? subdomainRaw, CancellationToken ct = default)
+    {
+        var subdomain = subdomainRaw?.Trim().ToLowerInvariant();
+        if (string.IsNullOrEmpty(subdomain)) return ErrorOr.Result.Success;   // clearing is always valid
+
+        var slug = TenantContext.Current;
+        await using var gsession = globalStore.LightweightSession();
+        var realm = await gsession.Query<Realm>().FirstOrDefaultAsync(r => r.Slug == slug, ct);
+        if (realm is null)
+            return Error.Failure("Application.RealmNotFound", "The current realm could not be resolved.");
+
+        if (!HostRegex.IsMatch(subdomain))
+            return Error.Validation("Application.InvalidSubdomain", "Subdomain must be a valid hostname.");
+
+        // Must be a child of the realm's primary domain (the cookie + routing
+        // model: apps live under the tenant's primary domain).
+        var primary = realm.PrimaryDomain.Trim().ToLowerInvariant();
+        if (string.IsNullOrEmpty(primary) || !subdomain.EndsWith("." + primary, StringComparison.Ordinal))
+            return Error.Validation("Application.SubdomainNotUnderPrimary",
+                $"Subdomain must be a child of the realm's primary domain ('{realm.PrimaryDomain}').");
+
+        // Cross-realm uniqueness: the host must not be claimed by any realm's
+        // plain domains or another App's route.
+        var allRealms = await gsession.Query<Realm>().ToListAsync(ct);
+        foreach (var r in allRealms)
+        {
+            if (r.Domains.Any(d => string.Equals(d, subdomain, StringComparison.OrdinalIgnoreCase)))
+                return Error.Conflict("Application.SubdomainTaken", "That host is already a realm domain.");
+            foreach (var kv in r.ApplicationDomains)
+            {
+                if (string.Equals(kv.Key, subdomain, StringComparison.OrdinalIgnoreCase)
+                    && !(r.Id == realm.Id && kv.Value == applicationId))
+                    return Error.Conflict("Application.SubdomainTaken", "That host is already mapped to an application.");
+            }
+        }
+
+        return ErrorOr.Result.Success;
+    }
+
     private async Task<ErrorOr<ApplicationOrigin?>> ApplyOriginAsync(
         Guid applicationId, string? subdomainRaw, CancellationToken ct)
     {
-        var slug = TenantContext.Current;
         var subdomain = subdomainRaw?.Trim().ToLowerInvariant();
 
+        var valid = await ValidateOriginAsync(applicationId, subdomain, ct);
+        if (valid.IsError) return valid.FirstError;
+
+        var slug = TenantContext.Current;
         await using var gsession = globalStore.LightweightSession();
         var realm = await gsession.Query<Realm>().FirstOrDefaultAsync(r => r.Slug == slug, ct);
         if (realm is null)
@@ -159,31 +261,6 @@ public async Task<ErrorOr<ApplicationSettingsDto>> PatchAsync(
         ApplicationOrigin? origin = null;
         if (!string.IsNullOrEmpty(subdomain))
         {
-            if (!HostRegex.IsMatch(subdomain))
-                return Error.Validation("Application.InvalidSubdomain", "Subdomain must be a valid hostname.");
-
-            // Must be a child of the realm's primary domain (the cookie + routing
-            // model: apps live under the tenant's primary domain).
-            var primary = realm.PrimaryDomain.Trim().ToLowerInvariant();
-            if (string.IsNullOrEmpty(primary) || !subdomain.EndsWith("." + primary, StringComparison.Ordinal))
-                return Error.Validation("Application.SubdomainNotUnderPrimary",
-                    $"Subdomain must be a child of the realm's primary domain ('{realm.PrimaryDomain}').");
-
-            // Cross-realm uniqueness: the host must not be claimed by any realm's
-            // plain domains or another App's route.
-            var allRealms = await gsession.Query<Realm>().ToListAsync(ct);
-            foreach (var r in allRealms)
-            {
-                if (r.Domains.Any(d => string.Equals(d, subdomain, StringComparison.OrdinalIgnoreCase)))
-                    return Error.Conflict("Application.SubdomainTaken", "That host is already a realm domain.");
-                foreach (var kv in r.ApplicationDomains)
-                {
-                    if (string.Equals(kv.Key, subdomain, StringComparison.OrdinalIgnoreCase)
-                        && !(r.Id == realm.Id && kv.Value == applicationId))
-                        return Error.Conflict("Application.SubdomainTaken", "That host is already mapped to an application.");
-                }
-            }
-
             realm.ApplicationDomains[subdomain] = applicationId;
             origin = new ApplicationOrigin { Subdomain = subdomain };
         }
diff --git a/src/frontend-vue/public/i18n/de.json b/src/frontend-vue/public/i18n/de.json
index dae9d141..217336f6 100644
--- a/src/frontend-vue/public/i18n/de.json
+++ b/src/frontend-vue/public/i18n/de.json
@@ -1296,7 +1296,8 @@
       "systemHint": "Dies ist eine System-App des IdP. Slug, Display Name und Permission-Catalog sind im Backend fest hinterlegt — der Catalog hier ist schreibgeschützt und dient nur zur Einsicht. Änderungen an den Strings würden die RequiresPermission-Aufrufe im Backend brechen.",
       "tabs": {
         "catalog": "Permission-Catalog",
-        "general": "Allgemein"
+        "general": "Allgemein",
+        "settings": "Einstellungen"
       }
     },
     "realms": {
diff --git a/src/frontend-vue/src/models/application.ts b/src/frontend-vue/src/models/application.ts
index 95e58e42..5fee18b9 100644
--- a/src/frontend-vue/src/models/application.ts
+++ b/src/frontend-vue/src/models/application.ts
@@ -20,6 +20,9 @@ export interface ApplicationDto {
   Description?: string | null
   Permissions: ApplicationPermissionDto[]
   IsSystem: boolean
+  // An App is one resource: the per-App ADR-0011 settings override is carried inline on
+  // GET {id} / create / update (null on the list endpoint, which doesn't render it).
+  Settings?: ApplicationSettingsDto | null
 }
 
 export interface ApplicationLookupDto {
@@ -45,12 +48,15 @@ export interface CreateApplicationDto {
   DisplayName: string
   Description?: string | null
   Permissions: ApplicationPermissionInputDto[]
+  // Optional per-App settings override, written atomically with the App.
+  Settings?: ApplicationSettingsDto | null
 }
 
 export interface UpdateApplicationDto {
   DisplayName: string
   Description?: string | null
   Permissions: ApplicationPermissionInputDto[]
+  Settings?: ApplicationSettingsDto | null
 }
 
 // ── ADR-0011: per-Application settings overrides ────────────────────────────
diff --git a/src/frontend-vue/src/router/index.ts b/src/frontend-vue/src/router/index.ts
index b340054b..fb18b084 100644
--- a/src/frontend-vue/src/router/index.ts
+++ b/src/frontend-vue/src/router/index.ts
@@ -133,7 +133,6 @@ const GROUP_MODAL_SIZE = {
 
 // Heaviest builders (wide AG-Grid catalog / 6-tab client builder) → full.
 const APP_MODAL_SIZE = MODAL_FULL
-const APP_SETTINGS_MODAL_SIZE = MODAL_MD
 const CLIENT_MODAL_SIZE = MODAL_FULL
 
 const routes = [
@@ -406,21 +405,13 @@ const routes = [
               meta: {
                 routedFragments: [
                   {
-                    // The :id slot is the App's Id (or "create"). Slug is
-                    // immutable post-creation but stored on the dto.
+                    // The :id slot is the App's Id (or "create"). One modal for the
+                    // whole App: identity + permission catalog + ADR-0011 settings.
                     type: 'modal',
                     path: ':id',
                     component: () => import('@/views/admin/apps/AppDetails.vue'),
                     overlayOptions: { size: APP_MODAL_SIZE },
                   },
-                  {
-                    // ADR-0011 — per-App settings overrides. Two-segment path so
-                    // it never collides with the single-segment `:id` App modal.
-                    type: 'modal',
-                    path: 'settings/:id',
-                    component: () => import('@/views/admin/apps/ApplicationSettingsModal.vue'),
-                    overlayOptions: { size: APP_SETTINGS_MODAL_SIZE },
-                  },
                 ],
               },
             },
diff --git a/src/frontend-vue/src/stores/applications.store.ts b/src/frontend-vue/src/stores/applications.store.ts
index 2c8463d3..b558e72b 100644
--- a/src/frontend-vue/src/stores/applications.store.ts
+++ b/src/frontend-vue/src/stores/applications.store.ts
@@ -3,7 +3,6 @@ import { ref } from 'vue'
 import { useHttpClient } from '@/composables/useHttpClient'
 import type {
   ApplicationDto,
-  ApplicationSettingsDto,
   CreateApplicationDto,
   UpdateApplicationDto,
 } from '@/models/application'
@@ -60,15 +59,8 @@ export const useApplicationsStore = defineStore('applications', () => {
     apps.value = apps.value.filter((a) => a.Id !== id)
   }
 
-  // ADR-0011 — per-Application settings overrides (separate from the App CRUD
-  // above; tenant ApplicationSettings doc + global subdomain routing map).
-  async function loadSettings(id: string): Promise<ApplicationSettingsDto> {
-    return await http.addPath(id, 'settings').get<ApplicationSettingsDto>()
-  }
-
-  async function saveSettings(id: string, dto: ApplicationSettingsDto): Promise<ApplicationSettingsDto> {
-    return await http.addPath(id, 'settings').patch<ApplicationSettingsDto>(dto)
-  }
+  // The per-App ADR-0011 settings override rides inline on loadOne/create/update
+  // (an App is one resource) — there is no separate settings endpoint.
 
   return {
     apps,
@@ -79,8 +71,6 @@ export const useApplicationsStore = defineStore('applications', () => {
     create,
     update,
     remove,
-    loadSettings,
-    saveSettings,
   }
 })
 
diff --git a/src/frontend-vue/src/views/admin/apps/AppDetails.vue b/src/frontend-vue/src/views/admin/apps/AppDetails.vue
index 6b77c44c..e4c1bfad 100644
--- a/src/frontend-vue/src/views/admin/apps/AppDetails.vue
+++ b/src/frontend-vue/src/views/admin/apps/AppDetails.vue
@@ -4,6 +4,7 @@ import { CoarTextInput, CoarFormField, CoarNote, CoarButton, CoarTabGroup, CoarT
 import { CoarDataGrid, CoarGridBuilder } from '@cocoar/vue-data-grid'
 import { useI18n } from '@cocoar/vue-localization'
 import ModalLayout from '@/components/ModalLayout.vue'
+import AppSettingsSections from './AppSettingsSections.vue'
 import { useApplicationsStore } from '@/stores/applications.store'
 import type {
   ApplicationDto,
@@ -153,7 +154,8 @@ const hasIncompleteRows = computed(() => catalog.value.some((r) =>
 ))
 
 const isSystem = computed(() => dto.value?.IsSystem === true)
-const activeTab = ref<'general' | 'catalog'>('general')
+const activeTab = ref<'general' | 'catalog' | 'settings'>('general')
+const settingsRef = ref<InstanceType<typeof AppSettingsSections> | null>(null)
 
 /**
  * Per-cell visual cue for the resource/action validation surface. The
@@ -279,18 +281,24 @@ async function save() {
   error.value = null
   catalogBlockers.value = []
   try {
+    // An App is one resource: its ADR-0011 settings override is part of the same
+    // create/update payload (the backend writes it in one tenant transaction). System
+    // apps carry no per-App settings, so omit it for them.
+    const settings = isSystem.value ? undefined : settingsRef.value?.build()
     if (isCreate.value) {
       await store.create({
         Slug: form.value.Slug.trim(),
         DisplayName: form.value.DisplayName.trim(),
         Description: form.value.Description.trim() || null,
         Permissions: buildPermissionsPayload(),
+        Settings: settings,
       })
     } else {
       await store.update(id.value, {
         DisplayName: form.value.DisplayName.trim(),
         Description: form.value.Description.trim() || null,
         Permissions: buildPermissionsPayload(),
+        Settings: settings,
       })
     }
     props.close()
@@ -318,9 +326,10 @@ async function save() {
       <span class="text-gray-400">{{ t('common.loading', {}, 'Laden...') }}</span>
     </div>
     <div v-else class="flex flex-col min-w-0 min-h-0 flex-1 gap-3">
-      <CoarTabGroup v-if="!isCreate" v-model="activeTab" class="tab-bar">
+      <CoarTabGroup v-model="activeTab" class="tab-bar">
         <CoarTab id="general">{{ t('admin.apps.tabs.general', {}, 'Allgemein') }}</CoarTab>
         <CoarTab id="catalog">{{ t('admin.apps.tabs.catalog', {}, 'Permission-Catalog') }}</CoarTab>
+        <CoarTab v-if="!isSystem" id="settings">{{ t('admin.apps.tabs.settings', {}, 'Einstellungen') }}</CoarTab>
       </CoarTabGroup>
 
       <CoarNote v-if="isCreate" variant="info">
@@ -331,7 +340,7 @@ async function save() {
       </CoarNote>
 
       <!-- Tab: General -->
-      <div v-show="isCreate || activeTab === 'general'" class="tab-content">
+      <div v-show="activeTab === 'general'" class="tab-content">
         <div class="grid grid-cols-2 gap-3">
           <CoarFormField :label="t('admin.apps.slug', {}, 'Slug (immutable)')">
             <CoarTextInput v-model="form.Slug" :disabled="!isCreate || isSystem" clearable
@@ -348,7 +357,7 @@ async function save() {
       </div>
 
       <!-- Tab: Permission Catalog -->
-      <div v-show="isCreate || activeTab === 'catalog'" class="tab-content">
+      <div v-show="activeTab === 'catalog'" class="tab-content">
         <p class="catalog-subtitle">
           {{ isSystem
             ? t('admin.apps.permissionsHintSystem', {}, 'Permission-Catalog der System-App — read-only. Diese Einträge entsprechen 1:1 den RequiresPermission-Aufrufen im Backend-Code.')
@@ -404,6 +413,11 @@ async function save() {
         </CoarNote>
       </div>
 
+      <!-- Tab: Settings (ADR-0011 per-App override) — one App, one modal -->
+      <div v-if="!isSystem" v-show="activeTab === 'settings'" class="tab-content">
+        <AppSettingsSections ref="settingsRef" :model-value="dto?.Settings" />
+      </div>
+
       <p v-if="error" class="text-sm text-red-600">{{ error }}</p>
     </div>
   </ModalLayout>
diff --git a/src/frontend-vue/src/views/admin/apps/AppList.vue b/src/frontend-vue/src/views/admin/apps/AppList.vue
index f16565f1..7148a778 100644
--- a/src/frontend-vue/src/views/admin/apps/AppList.vue
+++ b/src/frontend-vue/src/views/admin/apps/AppList.vue
@@ -120,9 +120,6 @@ onMounted(() => store.initialize())
     <CoarContextMenu :menu="cellMenu">
       <CoarMenuItem :label="t('common.open', {}, 'Öffnen')" icon="pencil"
         @clicked="selectedIds[0] && navigateToModal(selectedIds[0])" />
-      <CoarMenuItem :label="t('admin.appSettings.open', {}, 'Einstellungen')" icon="sliders-horizontal"
-        :disabled="selectedIsSystem"
-        @clicked="selectedIds[0] && navigateToModal(`settings/${selectedIds[0]}`)" />
       <CoarMenuItem :label="t('common.create', {}, 'Erstellen')" icon="plus"
         @clicked="navigateToModal('create')" />
       <CoarMenuDivider />
diff --git a/src/frontend-vue/src/views/admin/apps/AppSettingsSections.vue b/src/frontend-vue/src/views/admin/apps/AppSettingsSections.vue
new file mode 100644
index 00000000..a054a285
--- /dev/null
+++ b/src/frontend-vue/src/views/admin/apps/AppSettingsSections.vue
@@ -0,0 +1,364 @@
+<script setup lang="ts">
+import { onMounted, reactive, watch } from 'vue'
+import {
+  CoarTextInput, CoarFormField, CoarCheckbox, CoarSelect, CoarNote,
+  CoarTabGroup, CoarTab, CoarMultiSelect,
+} from '@cocoar/vue-ui'
+import { useI18n } from '@cocoar/vue-localization'
+import { ref } from 'vue'
+import EditableStringList from '@/components/EditableStringList.vue'
+import { useGroupStore } from '@/stores/group.store'
+import type { ApplicationSettingsDto } from '@/models/application'
+
+// ADR-0011 per-App settings override sections, extracted from the old standalone
+// ApplicationSettingsModal so the single App modal (AppDetails) can carry them as a
+// tab. The parent owns load + save; this component owns the form. Populate it via the
+// `modelValue` prop (the App's current Settings) and read it back via the exposed
+// `build()` — the exact same override/inherit shape the per-App settings doc uses.
+const { t } = useI18n()
+const props = defineProps<{ modelValue?: ApplicationSettingsDto | null }>()
+
+const groupStore = useGroupStore()
+const activeTab = ref<'origin' | 'registration' | 'grants' | 'oauth'>('origin')
+
+const groupOptions = ref<{ value: string; label: string }[]>([])
+
+// Per-section "override" toggle (on → this App overrides the realm; off → inherit).
+// Numbers are kept as strings (empty = inherit that field).
+const f = reactive({
+  origin: { override: false, subdomain: '' },
+  branding: { override: false, productName: '', primaryColor: '' },
+  emailBranding: { override: false, productName: '' },
+  selfReg: {
+    override: false,
+    posture: '' as '' | 'Off' | 'JitOnOtp' | 'ExplicitEndpoint' | 'InviteCode',
+    enabled: false,
+    requireEmailVerification: true,
+    requireAdminApproval: false,
+    allowedEmailDomains: [] as string[],
+    defaultGroupIds: [] as string[],
+    termsOfServiceUrl: '',
+    privacyPolicyUrl: '',
+  },
+  registrationFields: {
+    override: false,
+    username: '' as '' | 'Off' | 'Optional' | 'Required',
+    firstname: '' as '' | 'Off' | 'Optional' | 'Required',
+    lastname: '' as '' | 'Off' | 'Optional' | 'Required',
+  },
+  nativeGrants: { override: false, enabled: false, access: '', refresh: '' },
+  dcr: {
+    override: false, enabled: false, access: '', refresh: '',
+    reservedNames: [] as string[], perIp: '', perRealm: '',
+  },
+  cimd: { override: false, enabled: false, access: '', refresh: '' },
+})
+
+const postureOptions = [
+  { value: '', label: t('admin.appSettings.inherit', {}, '(vom Realm erben)') },
+  { value: 'Off', label: t('admin.appSettings.posture.off', {}, 'Off — keine Selbstregistrierung') },
+  { value: 'JitOnOtp', label: t('admin.appSettings.posture.jit', {}, 'JIT-on-OTP (passwortlos)') },
+  { value: 'ExplicitEndpoint', label: t('admin.appSettings.posture.explicit', {}, 'Expliziter Endpoint') },
+  { value: 'InviteCode', label: t('admin.appSettings.posture.inviteCode', {}, 'Invite code (invite-only)') },
+]
+
+const requirementOptions = [
+  { value: '', label: t('admin.appSettings.inherit', {}, '(vom Realm erben)') },
+  { value: 'Off', label: t('admin.regFields.off', {}, 'Aus') },
+  { value: 'Optional', label: t('admin.regFields.optional', {}, 'Optional') },
+  { value: 'Required', label: t('admin.regFields.required', {}, 'Pflicht') },
+]
+
+function numStr(n?: number | null): string {
+  return n === null || n === undefined ? '' : String(n)
+}
+function parseNum(s: string): number | null {
+  const v = s.trim()
+  if (v === '') return null
+  const n = Number(v)
+  return Number.isFinite(n) ? n : null
+}
+
+function resetForm() {
+  f.origin.override = false; f.origin.subdomain = ''
+  f.branding.override = false; f.branding.productName = ''; f.branding.primaryColor = ''
+  f.emailBranding.override = false; f.emailBranding.productName = ''
+  f.selfReg.override = false; f.selfReg.posture = ''; f.selfReg.enabled = false
+  f.selfReg.requireEmailVerification = true; f.selfReg.requireAdminApproval = false
+  f.selfReg.allowedEmailDomains = []; f.selfReg.defaultGroupIds = []
+  f.selfReg.termsOfServiceUrl = ''; f.selfReg.privacyPolicyUrl = ''
+  f.registrationFields.override = false; f.registrationFields.username = ''
+  f.registrationFields.firstname = ''; f.registrationFields.lastname = ''
+  f.nativeGrants.override = false; f.nativeGrants.enabled = false; f.nativeGrants.access = ''; f.nativeGrants.refresh = ''
+  f.dcr.override = false; f.dcr.enabled = false; f.dcr.access = ''; f.dcr.refresh = ''
+  f.dcr.reservedNames = []; f.dcr.perIp = ''; f.dcr.perRealm = ''
+  f.cimd.override = false; f.cimd.enabled = false; f.cimd.access = ''; f.cimd.refresh = ''
+}
+
+function populate(s?: ApplicationSettingsDto | null) {
+  resetForm()
+  if (!s) return
+  if (s.Origin) { f.origin.override = true; f.origin.subdomain = s.Origin.Subdomain ?? '' }
+  if (s.Branding) {
+    f.branding.override = true
+    f.branding.productName = s.Branding.ProductName ?? ''
+    f.branding.primaryColor = s.Branding.PrimaryColor ?? ''
+  }
+  if (s.EmailBranding) {
+    f.emailBranding.override = true
+    f.emailBranding.productName = s.EmailBranding.ProductName ?? ''
+  }
+  if (s.SelfRegistration) {
+    const sr = s.SelfRegistration
+    f.selfReg.override = true
+    f.selfReg.posture = (sr.Posture as typeof f.selfReg.posture) ?? ''
+    f.selfReg.enabled = sr.Enabled ?? false
+    f.selfReg.requireEmailVerification = sr.RequireEmailVerification ?? true
+    f.selfReg.requireAdminApproval = sr.RequireAdminApproval ?? false
+    f.selfReg.allowedEmailDomains = sr.AllowedEmailDomains ?? []
+    f.selfReg.defaultGroupIds = sr.DefaultGroupIds ?? []
+    f.selfReg.termsOfServiceUrl = sr.TermsOfServiceUrl ?? ''
+    f.selfReg.privacyPolicyUrl = sr.PrivacyPolicyUrl ?? ''
+  }
+  if (s.RegistrationFields) {
+    const rf = s.RegistrationFields
+    f.registrationFields.override = true
+    f.registrationFields.username = (rf.Username as typeof f.registrationFields.username) ?? ''
+    f.registrationFields.firstname = (rf.Firstname as typeof f.registrationFields.firstname) ?? ''
+    f.registrationFields.lastname = (rf.Lastname as typeof f.registrationFields.lastname) ?? ''
+  }
+  if (s.NativeGrants) {
+    f.nativeGrants.override = true
+    f.nativeGrants.enabled = s.NativeGrants.Enabled ?? false
+    f.nativeGrants.access = numStr(s.NativeGrants.AccessTokenLifetimeMinutes)
+    f.nativeGrants.refresh = numStr(s.NativeGrants.RefreshTokenLifetimeDays)
+  }
+  if (s.Dcr) {
+    f.dcr.override = true
+    f.dcr.enabled = s.Dcr.Enabled ?? false
+    f.dcr.access = numStr(s.Dcr.AccessTokenLifetimeMinutes)
+    f.dcr.refresh = numStr(s.Dcr.RefreshTokenLifetimeDays)
+    f.dcr.reservedNames = s.Dcr.ReservedNames ?? []
+    f.dcr.perIp = numStr(s.Dcr.PerIpRateLimitPerHour)
+    f.dcr.perRealm = numStr(s.Dcr.PerRealmRateLimitPerDay)
+  }
+  if (s.Cimd) {
+    f.cimd.override = true
+    f.cimd.enabled = s.Cimd.Enabled ?? false
+    f.cimd.access = numStr(s.Cimd.AccessTokenLifetimeMinutes)
+    f.cimd.refresh = numStr(s.Cimd.RefreshTokenLifetimeDays)
+  }
+}
+
+/** Build the override DTO as the COMPLETE desired state (the App PUT is a replace):
+ * an overridden section sends its values, a non-overridden section sends `null` so the
+ * backend clears that override (→ inherit the realm). Origin sends null when off
+ * (sparse — toggling a subdomain off doesn't clear an existing route in this view). */
+function build(): ApplicationSettingsDto {
+  return {
+    Origin: f.origin.override ? { Subdomain: f.origin.subdomain.trim() || null } : null,
+    Branding: f.branding.override
+      ? { ProductName: f.branding.productName.trim() || null, PrimaryColor: f.branding.primaryColor.trim() || null }
+      : null,
+    EmailBranding: f.emailBranding.override
+      ? { ProductName: f.emailBranding.productName.trim() || null }
+      : null,
+    SelfRegistration: f.selfReg.override
+      ? {
+          Posture: f.selfReg.posture || null,
+          Enabled: f.selfReg.enabled,
+          RequireEmailVerification: f.selfReg.requireEmailVerification,
+          RequireAdminApproval: f.selfReg.requireAdminApproval,
+          AllowedEmailDomains: f.selfReg.allowedEmailDomains.length ? f.selfReg.allowedEmailDomains : null,
+          DefaultGroupIds: f.selfReg.defaultGroupIds.length ? f.selfReg.defaultGroupIds : null,
+          TermsOfServiceUrl: f.selfReg.termsOfServiceUrl.trim() || null,
+          PrivacyPolicyUrl: f.selfReg.privacyPolicyUrl.trim() || null,
+        }
+      : null,
+    RegistrationFields: f.registrationFields.override
+      ? {
+          Username: f.registrationFields.username || null,
+          Firstname: f.registrationFields.firstname || null,
+          Lastname: f.registrationFields.lastname || null,
+        }
+      : null,
+    NativeGrants: f.nativeGrants.override
+      ? { Enabled: f.nativeGrants.enabled, AccessTokenLifetimeMinutes: parseNum(f.nativeGrants.access), RefreshTokenLifetimeDays: parseNum(f.nativeGrants.refresh) }
+      : null,
+    Dcr: f.dcr.override
+      ? {
+          Enabled: f.dcr.enabled,
+          AccessTokenLifetimeMinutes: parseNum(f.dcr.access),
+          RefreshTokenLifetimeDays: parseNum(f.dcr.refresh),
+          ReservedNames: f.dcr.reservedNames.length ? f.dcr.reservedNames : null,
+          PerIpRateLimitPerHour: parseNum(f.dcr.perIp),
+          PerRealmRateLimitPerDay: parseNum(f.dcr.perRealm),
+        }
+      : null,
+    Cimd: f.cimd.override
+      ? { Enabled: f.cimd.enabled, AccessTokenLifetimeMinutes: parseNum(f.cimd.access), RefreshTokenLifetimeDays: parseNum(f.cimd.refresh) }
+      : null,
+  }
+}
+
+watch(() => props.modelValue, (s) => populate(s), { immediate: true })
+onMounted(async () => {
+  await groupStore.initialize()
+  groupOptions.value = groupStore.groups.map((g) => ({ value: g.Id, label: g.Name }))
+})
+
+defineExpose({ build })
+</script>
+
+<template>
+  <div class="flex flex-col min-w-0 min-h-0 flex-1 gap-3">
+    <CoarNote variant="info">
+      {{ t('admin.appSettings.hint', {}, 'Diese Einstellungen überschreiben die Realm-Defaults nur für diese App. Ein deaktivierter Abschnitt erbt vom Realm.') }}
+    </CoarNote>
+
+    <CoarTabGroup v-model="activeTab" class="tab-bar">
+      <CoarTab id="origin">{{ t('admin.appSettings.tabs.origin', {}, 'Origin & Branding') }}</CoarTab>
+      <CoarTab id="registration">{{ t('admin.appSettings.tabs.registration', {}, 'Registrierung') }}</CoarTab>
+      <CoarTab id="grants">{{ t('admin.appSettings.tabs.grants', {}, 'Native Grants') }}</CoarTab>
+      <CoarTab id="oauth">{{ t('admin.appSettings.tabs.oauth', {}, 'OAuth (DCR/CIMD)') }}</CoarTab>
+    </CoarTabGroup>
+
+    <!-- Origin & Branding -->
+    <div v-show="activeTab === 'origin'" class="tab-content">
+      <CoarCheckbox v-model="f.origin.override" :label="t('admin.appSettings.origin.override', {}, 'Eigene Subdomain für diese App')" />
+      <CoarFormField v-if="f.origin.override" :label="t('admin.appSettings.origin.subdomain', {}, 'Subdomain (Child der Realm-Primary-Domain)')">
+        <CoarTextInput v-model="f.origin.subdomain" clearable placeholder="amzettel.cocoar.app" />
+      </CoarFormField>
+
+      <CoarCheckbox v-model="f.branding.override" :label="t('admin.appSettings.branding.override', {}, 'Eigenes Branding (Login/SPA)')" />
+      <template v-if="f.branding.override">
+        <CoarFormField :label="t('admin.appSettings.branding.productName', {}, 'Produktname')">
+          <CoarTextInput v-model="f.branding.productName" clearable />
+        </CoarFormField>
+        <CoarFormField :label="t('admin.appSettings.branding.primaryColor', {}, 'Primärfarbe (CSS)')">
+          <CoarTextInput v-model="f.branding.primaryColor" clearable placeholder="#1077be" />
+        </CoarFormField>
+      </template>
+
+      <CoarCheckbox v-model="f.emailBranding.override" :label="t('admin.appSettings.email.override', {}, 'Eigenes E-Mail-Branding')" />
+      <CoarFormField v-if="f.emailBranding.override" :label="t('admin.appSettings.email.productName', {}, 'Produktname in E-Mails')">
+        <CoarTextInput v-model="f.emailBranding.productName" clearable />
+      </CoarFormField>
+    </div>
+
+    <!-- Registration -->
+    <div v-show="activeTab === 'registration'" class="tab-content">
+      <CoarCheckbox v-model="f.selfReg.override" :label="t('admin.appSettings.selfReg.override', {}, 'Eigene Registrierungs-Policy')" />
+      <template v-if="f.selfReg.override">
+        <CoarFormField :label="t('admin.appSettings.selfReg.posture', {}, 'Posture (passwortlose Registrierung)')">
+          <CoarSelect v-model="f.selfReg.posture" :options="postureOptions" />
+        </CoarFormField>
+
+        <div v-if="f.selfReg.posture === 'InviteCode'"
+          class="rounded border border-amber-300 bg-amber-50 dark:border-amber-700/50 dark:bg-amber-900/20 p-3 text-sm space-y-1">
+          <p class="font-medium">{{ t('admin.appSettings.posture.inviteCode.title', {}, 'Invite-code posture: how to hand out codes') }}</p>
+          <p>{{ t('admin.appSettings.posture.inviteCode.ui', {}, 'Works immediately: mint codes in the admin under “Invite Codes” (sidebar, OAuth & Federation) for this app — no further setup required.') }}</p>
+          <p>{{ t('admin.appSettings.posture.inviteCode.m2m', {}, 'For automatic minting by the backend app (M2M): create an OAuth scope “invite:write” bound to this app (App-ID set), and give a ServiceAccount a credential carrying that scope. The app then calls POST /api/app/{appId}/invite-codes with its client_credentials token.') }}</p>
+          <p class="text-gray-500">{{ t('admin.appSettings.posture.inviteCode.redeem', {}, 'Redemption: the code travels on the native sign-up request (InviteCode field); unknown emails become users only with a valid, unused code. Existing confirmed users sign in normally (the code is ignored).') }}</p>
+        </div>
+        <CoarCheckbox v-model="f.selfReg.enabled" :label="t('admin.appSettings.selfReg.enabled', {}, 'Self-Registration aktiv')" />
+        <CoarCheckbox v-model="f.selfReg.requireEmailVerification" :label="t('admin.appSettings.selfReg.verify', {}, 'E-Mail-Verifizierung erforderlich')" />
+        <CoarCheckbox v-model="f.selfReg.requireAdminApproval" :label="t('admin.appSettings.selfReg.approval', {}, 'Admin-Freigabe erforderlich')" />
+        <CoarFormField :label="t('admin.appSettings.selfReg.domains', {}, 'Erlaubte E-Mail-Domains (leer = alle)')">
+          <EditableStringList v-model="f.selfReg.allowedEmailDomains" />
+        </CoarFormField>
+        <CoarFormField :label="t('admin.appSettings.selfReg.defaultGroups', {}, 'Standard-Gruppen (Auto-Mitgliedschaft nach Verifizierung)')">
+          <CoarMultiSelect
+            v-model="f.selfReg.defaultGroupIds"
+            :options="groupOptions"
+            searchable
+            clearable
+            :placeholder="t('admin.appSettings.selfReg.defaultGroups.placeholder', {}, 'Gruppen wählen…')" />
+        </CoarFormField>
+        <CoarFormField :label="t('admin.appSettings.selfReg.tos', {}, 'AGB-URL')">
+          <CoarTextInput v-model="f.selfReg.termsOfServiceUrl" clearable />
+        </CoarFormField>
+        <CoarFormField :label="t('admin.appSettings.selfReg.privacy', {}, 'Datenschutz-URL')">
+          <CoarTextInput v-model="f.selfReg.privacyPolicyUrl" clearable />
+        </CoarFormField>
+      </template>
+
+      <CoarCheckbox v-model="f.registrationFields.override" :label="t('admin.appSettings.regFields.override', {}, 'Eigene Pflichtfelder bei Registrierung')" />
+      <template v-if="f.registrationFields.override">
+        <CoarNote variant="info">
+          {{ t('admin.appSettings.regFields.hint', {}, 'Welche Identitätsfelder bei der Kontoerstellung gefordert sind. E-Mail ist immer Pflicht. Native Clients müssen geforderte Felder erfassen.') }}
+        </CoarNote>
+        <CoarFormField :label="t('admin.regFields.username', {}, 'Benutzername')">
+          <CoarSelect v-model="f.registrationFields.username" :options="requirementOptions" />
+        </CoarFormField>
+        <CoarFormField :label="t('admin.regFields.firstname', {}, 'Vorname')">
+          <CoarSelect v-model="f.registrationFields.firstname" :options="requirementOptions" />
+        </CoarFormField>
+        <CoarFormField :label="t('admin.regFields.lastname', {}, 'Nachname')">
+          <CoarSelect v-model="f.registrationFields.lastname" :options="requirementOptions" />
+        </CoarFormField>
+      </template>
+    </div>
+
+    <!-- Native Grants -->
+    <div v-show="activeTab === 'grants'" class="tab-content">
+      <CoarCheckbox v-model="f.nativeGrants.override" :label="t('admin.appSettings.grants.override', {}, 'Eigene Native-Grant-Settings')" />
+      <template v-if="f.nativeGrants.override">
+        <CoarCheckbox v-model="f.nativeGrants.enabled" :label="t('admin.appSettings.grants.enabled', {}, 'Native Grants aktiv')" />
+        <div class="grid grid-cols-2 gap-3">
+          <CoarFormField :label="t('admin.appSettings.access', {}, 'Access-Token (Min, 1–60)')">
+            <CoarTextInput v-model="f.nativeGrants.access" clearable placeholder="15" />
+          </CoarFormField>
+          <CoarFormField :label="t('admin.appSettings.refresh', {}, 'Refresh-Token (Tage, 1–30)')">
+            <CoarTextInput v-model="f.nativeGrants.refresh" clearable placeholder="14" />
+          </CoarFormField>
+        </div>
+      </template>
+    </div>
+
+    <!-- OAuth (DCR / CIMD) -->
+    <div v-show="activeTab === 'oauth'" class="tab-content">
+      <CoarCheckbox v-model="f.dcr.override" :label="t('admin.appSettings.dcr.override', {}, 'Eigene DCR-Settings')" />
+      <template v-if="f.dcr.override">
+        <CoarCheckbox v-model="f.dcr.enabled" :label="t('admin.appSettings.dcr.enabled', {}, 'Dynamic Client Registration aktiv')" />
+        <div class="grid grid-cols-2 gap-3">
+          <CoarFormField :label="t('admin.appSettings.access', {}, 'Access-Token (Min, 1–60)')">
+            <CoarTextInput v-model="f.dcr.access" clearable placeholder="15" />
+          </CoarFormField>
+          <CoarFormField :label="t('admin.appSettings.refresh', {}, 'Refresh-Token (Tage, 1–30)')">
+            <CoarTextInput v-model="f.dcr.refresh" clearable placeholder="7" />
+          </CoarFormField>
+        </div>
+        <div class="grid grid-cols-2 gap-3">
+          <CoarFormField :label="t('admin.appSettings.dcr.perIp', {}, 'Rate-Limit pro IP / Stunde')">
+            <CoarTextInput v-model="f.dcr.perIp" clearable placeholder="5" />
+          </CoarFormField>
+          <CoarFormField :label="t('admin.appSettings.dcr.perRealm', {}, 'Rate-Limit pro Realm / Tag')">
+            <CoarTextInput v-model="f.dcr.perRealm" clearable placeholder="100" />
+          </CoarFormField>
+        </div>
+        <CoarFormField :label="t('admin.appSettings.dcr.reservedNames', {}, 'Reservierte Client-Namen (Blockliste)')">
+          <EditableStringList v-model="f.dcr.reservedNames" />
+        </CoarFormField>
+      </template>
+
+      <CoarCheckbox v-model="f.cimd.override" :label="t('admin.appSettings.cimd.override', {}, 'Eigene CIMD-Settings')" />
+      <template v-if="f.cimd.override">
+        <CoarCheckbox v-model="f.cimd.enabled" :label="t('admin.appSettings.cimd.enabled', {}, 'CIMD aktiv')" />
+        <div class="grid grid-cols-2 gap-3">
+          <CoarFormField :label="t('admin.appSettings.access', {}, 'Access-Token (Min, 1–60)')">
+            <CoarTextInput v-model="f.cimd.access" clearable placeholder="15" />
+          </CoarFormField>
+          <CoarFormField :label="t('admin.appSettings.refresh', {}, 'Refresh-Token (Tage, 1–30)')">
+            <CoarTextInput v-model="f.cimd.refresh" clearable placeholder="7" />
+          </CoarFormField>
+        </div>
+      </template>
+    </div>
+  </div>
+</template>
+
+<style scoped>
+.tab-bar { margin-bottom: 8px; }
+.tab-content { display: flex; flex-direction: column; gap: 12px; min-height: 0; }
+</style>
diff --git a/src/frontend-vue/src/views/admin/apps/ApplicationSettingsModal.vue b/src/frontend-vue/src/views/admin/apps/ApplicationSettingsModal.vue
deleted file mode 100644
index 4321bcf8..00000000
--- a/src/frontend-vue/src/views/admin/apps/ApplicationSettingsModal.vue
+++ /dev/null
@@ -1,379 +0,0 @@
-<script setup lang="ts">
-import { computed, onMounted, reactive, ref } from 'vue'
-import {
-  CoarTextInput, CoarFormField, CoarCheckbox, CoarSelect, CoarNote,
-  CoarTabGroup, CoarTab, CoarMultiSelect,
-} from '@cocoar/vue-ui'
-import { useI18n } from '@cocoar/vue-localization'
-import ModalLayout from '@/components/ModalLayout.vue'
-import EditableStringList from '@/components/EditableStringList.vue'
-import { useApplicationsStore } from '@/stores/applications.store'
-import { useGroupStore } from '@/stores/group.store'
-import type { ApplicationSettingsDto } from '@/models/application'
-
-const { t } = useI18n()
-
-const props = defineProps<{
-  id: string
-  close: (result?: unknown) => void
-}>()
-
-const store = useApplicationsStore()
-const groupStore = useGroupStore()
-const loading = ref(false)
-const error = ref<string | null>(null)
-const activeTab = ref<'origin' | 'registration' | 'grants' | 'oauth'>('origin')
-
-const groupOptions = computed(() =>
-  groupStore.groups.map((g) => ({ value: g.Id, label: g.Name })))
-
-// Per-section "override" toggle (on → this App overrides the realm; off → inherit).
-// Numbers are kept as strings (empty = inherit that field). Booleans inside an
-// overridden section are concrete; the section toggle is the inherit control.
-const f = reactive({
-  origin: { override: false, subdomain: '' },
-  branding: { override: false, productName: '', primaryColor: '' },
-  emailBranding: { override: false, productName: '' },
-  selfReg: {
-    override: false,
-    posture: '' as '' | 'Off' | 'JitOnOtp' | 'ExplicitEndpoint' | 'InviteCode',
-    enabled: false,
-    requireEmailVerification: true,
-    requireAdminApproval: false,
-    allowedEmailDomains: [] as string[],
-    defaultGroupIds: [] as string[],
-    termsOfServiceUrl: '',
-    privacyPolicyUrl: '',
-  },
-  registrationFields: {
-    override: false,
-    username: '' as '' | 'Off' | 'Optional' | 'Required',
-    firstname: '' as '' | 'Off' | 'Optional' | 'Required',
-    lastname: '' as '' | 'Off' | 'Optional' | 'Required',
-  },
-  nativeGrants: { override: false, enabled: false, access: '', refresh: '' },
-  dcr: {
-    override: false, enabled: false, access: '', refresh: '',
-    reservedNames: [] as string[], perIp: '', perRealm: '',
-  },
-  cimd: { override: false, enabled: false, access: '', refresh: '' },
-})
-
-const postureOptions = [
-  { value: '', label: t('admin.appSettings.inherit', {}, '(vom Realm erben)') },
-  { value: 'Off', label: t('admin.appSettings.posture.off', {}, 'Off — keine Selbstregistrierung') },
-  { value: 'JitOnOtp', label: t('admin.appSettings.posture.jit', {}, 'JIT-on-OTP (passwortlos)') },
-  { value: 'ExplicitEndpoint', label: t('admin.appSettings.posture.explicit', {}, 'Expliziter Endpoint') },
-  { value: 'InviteCode', label: t('admin.appSettings.posture.inviteCode', {}, 'Invite code (invite-only)') },
-]
-
-// Tri-state per identity field; '' = inherit the realm requirement for that field.
-const requirementOptions = [
-  { value: '', label: t('admin.appSettings.inherit', {}, '(vom Realm erben)') },
-  { value: 'Off', label: t('admin.regFields.off', {}, 'Aus') },
-  { value: 'Optional', label: t('admin.regFields.optional', {}, 'Optional') },
-  { value: 'Required', label: t('admin.regFields.required', {}, 'Pflicht') },
-]
-
-function numStr(n?: number | null): string {
-  return n === null || n === undefined ? '' : String(n)
-}
-function parseNum(s: string): number | null {
-  const v = s.trim()
-  if (v === '') return null
-  const n = Number(v)
-  return Number.isFinite(n) ? n : null
-}
-
-onMounted(async () => {
-  loading.value = true
-  try {
-    // Load groups too so the DefaultGroups picker can label by name.
-    const [s] = await Promise.all([store.loadSettings(props.id), groupStore.initialize()])
-    if (s.Origin) { f.origin.override = true; f.origin.subdomain = s.Origin.Subdomain ?? '' }
-    if (s.Branding) {
-      f.branding.override = true
-      f.branding.productName = s.Branding.ProductName ?? ''
-      f.branding.primaryColor = s.Branding.PrimaryColor ?? ''
-    }
-    if (s.EmailBranding) {
-      f.emailBranding.override = true
-      f.emailBranding.productName = s.EmailBranding.ProductName ?? ''
-    }
-    if (s.SelfRegistration) {
-      const sr = s.SelfRegistration
-      f.selfReg.override = true
-      f.selfReg.posture = (sr.Posture as any) ?? ''
-      f.selfReg.enabled = sr.Enabled ?? false
-      f.selfReg.requireEmailVerification = sr.RequireEmailVerification ?? true
-      f.selfReg.requireAdminApproval = sr.RequireAdminApproval ?? false
-      f.selfReg.allowedEmailDomains = sr.AllowedEmailDomains ?? []
-      f.selfReg.defaultGroupIds = sr.DefaultGroupIds ?? []
-      f.selfReg.termsOfServiceUrl = sr.TermsOfServiceUrl ?? ''
-      f.selfReg.privacyPolicyUrl = sr.PrivacyPolicyUrl ?? ''
-    }
-    if (s.RegistrationFields) {
-      const rf = s.RegistrationFields
-      f.registrationFields.override = true
-      f.registrationFields.username = (rf.Username as any) ?? ''
-      f.registrationFields.firstname = (rf.Firstname as any) ?? ''
-      f.registrationFields.lastname = (rf.Lastname as any) ?? ''
-    }
-    if (s.NativeGrants) {
-      f.nativeGrants.override = true
-      f.nativeGrants.enabled = s.NativeGrants.Enabled ?? false
-      f.nativeGrants.access = numStr(s.NativeGrants.AccessTokenLifetimeMinutes)
-      f.nativeGrants.refresh = numStr(s.NativeGrants.RefreshTokenLifetimeDays)
-    }
-    if (s.Dcr) {
-      f.dcr.override = true
-      f.dcr.enabled = s.Dcr.Enabled ?? false
-      f.dcr.access = numStr(s.Dcr.AccessTokenLifetimeMinutes)
-      f.dcr.refresh = numStr(s.Dcr.RefreshTokenLifetimeDays)
-      f.dcr.reservedNames = s.Dcr.ReservedNames ?? []
-      f.dcr.perIp = numStr(s.Dcr.PerIpRateLimitPerHour)
-      f.dcr.perRealm = numStr(s.Dcr.PerRealmRateLimitPerDay)
-    }
-    if (s.Cimd) {
-      f.cimd.override = true
-      f.cimd.enabled = s.Cimd.Enabled ?? false
-      f.cimd.access = numStr(s.Cimd.AccessTokenLifetimeMinutes)
-      f.cimd.refresh = numStr(s.Cimd.RefreshTokenLifetimeDays)
-    }
-  } catch (e: any) {
-    error.value = e?.body?.detail ?? e?.message ?? String(e)
-  } finally {
-    loading.value = false
-  }
-})
-
-function buildDto(): ApplicationSettingsDto {
-  // An overridden section sends its values; a non-overridden section sends {}
-  // (empty = clear → inherit the realm), so the saved doc matches the toggles.
-  return {
-    Origin: f.origin.override ? { Subdomain: f.origin.subdomain.trim() || null } : {},
-    Branding: f.branding.override
-      ? { ProductName: f.branding.productName.trim() || null, PrimaryColor: f.branding.primaryColor.trim() || null }
-      : {},
-    EmailBranding: f.emailBranding.override
-      ? { ProductName: f.emailBranding.productName.trim() || null }
-      : {},
-    SelfRegistration: f.selfReg.override
-      ? {
-          Posture: f.selfReg.posture || null,
-          Enabled: f.selfReg.enabled,
-          RequireEmailVerification: f.selfReg.requireEmailVerification,
-          RequireAdminApproval: f.selfReg.requireAdminApproval,
-          AllowedEmailDomains: f.selfReg.allowedEmailDomains.length ? f.selfReg.allowedEmailDomains : null,
-          DefaultGroupIds: f.selfReg.defaultGroupIds.length ? f.selfReg.defaultGroupIds : null,
-          TermsOfServiceUrl: f.selfReg.termsOfServiceUrl.trim() || null,
-          PrivacyPolicyUrl: f.selfReg.privacyPolicyUrl.trim() || null,
-        }
-      : {},
-    RegistrationFields: f.registrationFields.override
-      ? {
-          Username: f.registrationFields.username || null,
-          Firstname: f.registrationFields.firstname || null,
-          Lastname: f.registrationFields.lastname || null,
-        }
-      : {},
-    NativeGrants: f.nativeGrants.override
-      ? { Enabled: f.nativeGrants.enabled, AccessTokenLifetimeMinutes: parseNum(f.nativeGrants.access), RefreshTokenLifetimeDays: parseNum(f.nativeGrants.refresh) }
-      : {},
-    Dcr: f.dcr.override
-      ? {
-          Enabled: f.dcr.enabled,
-          AccessTokenLifetimeMinutes: parseNum(f.dcr.access),
-          RefreshTokenLifetimeDays: parseNum(f.dcr.refresh),
-          ReservedNames: f.dcr.reservedNames.length ? f.dcr.reservedNames : null,
-          PerIpRateLimitPerHour: parseNum(f.dcr.perIp),
-          PerRealmRateLimitPerDay: parseNum(f.dcr.perRealm),
-        }
-      : {},
-    Cimd: f.cimd.override
-      ? { Enabled: f.cimd.enabled, AccessTokenLifetimeMinutes: parseNum(f.cimd.access), RefreshTokenLifetimeDays: parseNum(f.cimd.refresh) }
-      : {},
-  }
-}
-
-async function save() {
-  loading.value = true
-  error.value = null
-  try {
-    await store.saveSettings(props.id, buildDto())
-    props.close(true)
-  } catch (e: any) {
-    error.value = e?.body?.detail ?? e?.body?.Message ?? e?.message ?? String(e)
-  } finally {
-    loading.value = false
-  }
-}
-
-const footerButton = computed(() => ({
-  visible: true,
-  text: t('common.save', {}, 'Speichern'),
-  disabled: loading.value,
-  loading: loading.value,
-  onClick: save,
-}))
-</script>
-
-<template>
-  <ModalLayout :close="close" :title="t('admin.appSettings.title', {}, 'Application-Einstellungen')"
-    icon="sliders-horizontal" :footer-button="footerButton" width="46rem">
-    <div class="flex flex-col min-w-0 min-h-0 flex-1 gap-3">
-      <CoarNote variant="info">
-        {{ t('admin.appSettings.hint', {}, 'Diese Einstellungen überschreiben die Realm-Defaults nur für diese App. Ein deaktivierter Abschnitt erbt vom Realm.') }}
-      </CoarNote>
-
-      <CoarTabGroup v-model="activeTab" class="tab-bar">
-        <CoarTab id="origin">{{ t('admin.appSettings.tabs.origin', {}, 'Origin & Branding') }}</CoarTab>
-        <CoarTab id="registration">{{ t('admin.appSettings.tabs.registration', {}, 'Registrierung') }}</CoarTab>
-        <CoarTab id="grants">{{ t('admin.appSettings.tabs.grants', {}, 'Native Grants') }}</CoarTab>
-        <CoarTab id="oauth">{{ t('admin.appSettings.tabs.oauth', {}, 'OAuth (DCR/CIMD)') }}</CoarTab>
-      </CoarTabGroup>
-
-      <!-- Origin & Branding -->
-      <div v-show="activeTab === 'origin'" class="tab-content">
-        <CoarCheckbox v-model="f.origin.override" :label="t('admin.appSettings.origin.override', {}, 'Eigene Subdomain für diese App')" />
-        <CoarFormField v-if="f.origin.override" :label="t('admin.appSettings.origin.subdomain', {}, 'Subdomain (Child der Realm-Primary-Domain)')">
-          <CoarTextInput v-model="f.origin.subdomain" clearable placeholder="amzettel.cocoar.app" />
-        </CoarFormField>
-
-        <CoarCheckbox v-model="f.branding.override" :label="t('admin.appSettings.branding.override', {}, 'Eigenes Branding (Login/SPA)')" />
-        <template v-if="f.branding.override">
-          <CoarFormField :label="t('admin.appSettings.branding.productName', {}, 'Produktname')">
-            <CoarTextInput v-model="f.branding.productName" clearable />
-          </CoarFormField>
-          <CoarFormField :label="t('admin.appSettings.branding.primaryColor', {}, 'Primärfarbe (CSS)')">
-            <CoarTextInput v-model="f.branding.primaryColor" clearable placeholder="#1077be" />
-          </CoarFormField>
-        </template>
-
-        <CoarCheckbox v-model="f.emailBranding.override" :label="t('admin.appSettings.email.override', {}, 'Eigenes E-Mail-Branding')" />
-        <CoarFormField v-if="f.emailBranding.override" :label="t('admin.appSettings.email.productName', {}, 'Produktname in E-Mails')">
-          <CoarTextInput v-model="f.emailBranding.productName" clearable />
-        </CoarFormField>
-      </div>
-
-      <!-- Registration -->
-      <div v-show="activeTab === 'registration'" class="tab-content">
-        <CoarCheckbox v-model="f.selfReg.override" :label="t('admin.appSettings.selfReg.override', {}, 'Eigene Registrierungs-Policy')" />
-        <template v-if="f.selfReg.override">
-          <CoarFormField :label="t('admin.appSettings.selfReg.posture', {}, 'Posture (passwortlose Registrierung)')">
-            <CoarSelect v-model="f.selfReg.posture" :options="postureOptions" />
-          </CoarFormField>
-
-          <!-- ADR-0012 — how to actually use the InviteCode posture. The admin-UI
-               path works immediately; M2M minting needs a one-time scope + SA setup. -->
-          <div v-if="f.selfReg.posture === 'InviteCode'"
-            class="rounded border border-amber-300 bg-amber-50 dark:border-amber-700/50 dark:bg-amber-900/20 p-3 text-sm space-y-1">
-            <p class="font-medium">{{ t('admin.appSettings.posture.inviteCode.title', {}, 'Invite-code posture: how to hand out codes') }}</p>
-            <p>{{ t('admin.appSettings.posture.inviteCode.ui', {}, 'Works immediately: mint codes in the admin under “Invite Codes” (sidebar, OAuth & Federation) for this app — no further setup required.') }}</p>
-            <p>{{ t('admin.appSettings.posture.inviteCode.m2m', {}, 'For automatic minting by the backend app (M2M): create an OAuth scope “invite:write” bound to this app (App-ID set), and give a ServiceAccount a credential carrying that scope. The app then calls POST /api/app/{appId}/invite-codes with its client_credentials token.') }}</p>
-            <p class="text-gray-500">{{ t('admin.appSettings.posture.inviteCode.redeem', {}, 'Redemption: the code travels on the native sign-up request (InviteCode field); unknown emails become users only with a valid, unused code. Existing confirmed users sign in normally (the code is ignored).') }}</p>
-          </div>
-          <CoarCheckbox v-model="f.selfReg.enabled" :label="t('admin.appSettings.selfReg.enabled', {}, 'Self-Registration aktiv')" />
-          <CoarCheckbox v-model="f.selfReg.requireEmailVerification" :label="t('admin.appSettings.selfReg.verify', {}, 'E-Mail-Verifizierung erforderlich')" />
-          <CoarCheckbox v-model="f.selfReg.requireAdminApproval" :label="t('admin.appSettings.selfReg.approval', {}, 'Admin-Freigabe erforderlich')" />
-          <CoarFormField :label="t('admin.appSettings.selfReg.domains', {}, 'Erlaubte E-Mail-Domains (leer = alle)')">
-            <EditableStringList v-model="f.selfReg.allowedEmailDomains" />
-          </CoarFormField>
-          <CoarFormField :label="t('admin.appSettings.selfReg.defaultGroups', {}, 'Standard-Gruppen (Auto-Mitgliedschaft nach Verifizierung)')">
-            <CoarMultiSelect
-              v-model="f.selfReg.defaultGroupIds"
-              :options="groupOptions"
-              searchable
-              clearable
-              :placeholder="t('admin.appSettings.selfReg.defaultGroups.placeholder', {}, 'Gruppen wählen…')" />
-          </CoarFormField>
-          <CoarFormField :label="t('admin.appSettings.selfReg.tos', {}, 'AGB-URL')">
-            <CoarTextInput v-model="f.selfReg.termsOfServiceUrl" clearable />
-          </CoarFormField>
-          <CoarFormField :label="t('admin.appSettings.selfReg.privacy', {}, 'Datenschutz-URL')">
-            <CoarTextInput v-model="f.selfReg.privacyPolicyUrl" clearable />
-          </CoarFormField>
-        </template>
-
-        <CoarCheckbox v-model="f.registrationFields.override" :label="t('admin.appSettings.regFields.override', {}, 'Eigene Pflichtfelder bei Registrierung')" />
-        <template v-if="f.registrationFields.override">
-          <CoarNote variant="info">
-            {{ t('admin.appSettings.regFields.hint', {}, 'Welche Identitätsfelder bei der Kontoerstellung gefordert sind. E-Mail ist immer Pflicht. Native Clients müssen geforderte Felder erfassen.') }}
-          </CoarNote>
-          <CoarFormField :label="t('admin.regFields.username', {}, 'Benutzername')">
-            <CoarSelect v-model="f.registrationFields.username" :options="requirementOptions" />
-          </CoarFormField>
-          <CoarFormField :label="t('admin.regFields.firstname', {}, 'Vorname')">
-            <CoarSelect v-model="f.registrationFields.firstname" :options="requirementOptions" />
-          </CoarFormField>
-          <CoarFormField :label="t('admin.regFields.lastname', {}, 'Nachname')">
-            <CoarSelect v-model="f.registrationFields.lastname" :options="requirementOptions" />
-          </CoarFormField>
-        </template>
-      </div>
-
-      <!-- Native Grants -->
-      <div v-show="activeTab === 'grants'" class="tab-content">
-        <CoarCheckbox v-model="f.nativeGrants.override" :label="t('admin.appSettings.grants.override', {}, 'Eigene Native-Grant-Settings')" />
-        <template v-if="f.nativeGrants.override">
-          <CoarCheckbox v-model="f.nativeGrants.enabled" :label="t('admin.appSettings.grants.enabled', {}, 'Native Grants aktiv')" />
-          <div class="grid grid-cols-2 gap-3">
-            <CoarFormField :label="t('admin.appSettings.access', {}, 'Access-Token (Min, 1–60)')">
-              <CoarTextInput v-model="f.nativeGrants.access" clearable placeholder="15" />
-            </CoarFormField>
-            <CoarFormField :label="t('admin.appSettings.refresh', {}, 'Refresh-Token (Tage, 1–30)')">
-              <CoarTextInput v-model="f.nativeGrants.refresh" clearable placeholder="14" />
-            </CoarFormField>
-          </div>
-        </template>
-      </div>
-
-      <!-- OAuth (DCR / CIMD) -->
-      <div v-show="activeTab === 'oauth'" class="tab-content">
-        <CoarCheckbox v-model="f.dcr.override" :label="t('admin.appSettings.dcr.override', {}, 'Eigene DCR-Settings')" />
-        <template v-if="f.dcr.override">
-          <CoarCheckbox v-model="f.dcr.enabled" :label="t('admin.appSettings.dcr.enabled', {}, 'Dynamic Client Registration aktiv')" />
-          <div class="grid grid-cols-2 gap-3">
-            <CoarFormField :label="t('admin.appSettings.access', {}, 'Access-Token (Min, 1–60)')">
-              <CoarTextInput v-model="f.dcr.access" clearable placeholder="15" />
-            </CoarFormField>
-            <CoarFormField :label="t('admin.appSettings.refresh', {}, 'Refresh-Token (Tage, 1–30)')">
-              <CoarTextInput v-model="f.dcr.refresh" clearable placeholder="7" />
-            </CoarFormField>
-          </div>
-          <div class="grid grid-cols-2 gap-3">
-            <CoarFormField :label="t('admin.appSettings.dcr.perIp', {}, 'Rate-Limit pro IP / Stunde')">
-              <CoarTextInput v-model="f.dcr.perIp" clearable placeholder="5" />
-            </CoarFormField>
-            <CoarFormField :label="t('admin.appSettings.dcr.perRealm', {}, 'Rate-Limit pro Realm / Tag')">
-              <CoarTextInput v-model="f.dcr.perRealm" clearable placeholder="100" />
-            </CoarFormField>
-          </div>
-          <CoarFormField :label="t('admin.appSettings.dcr.reservedNames', {}, 'Reservierte Client-Namen (Blockliste)')">
-            <EditableStringList v-model="f.dcr.reservedNames" />
-          </CoarFormField>
-        </template>
-
-        <CoarCheckbox v-model="f.cimd.override" :label="t('admin.appSettings.cimd.override', {}, 'Eigene CIMD-Settings')" />
-        <template v-if="f.cimd.override">
-          <CoarCheckbox v-model="f.cimd.enabled" :label="t('admin.appSettings.cimd.enabled', {}, 'CIMD aktiv')" />
-          <div class="grid grid-cols-2 gap-3">
-            <CoarFormField :label="t('admin.appSettings.access', {}, 'Access-Token (Min, 1–60)')">
-              <CoarTextInput v-model="f.cimd.access" clearable placeholder="15" />
-            </CoarFormField>
-            <CoarFormField :label="t('admin.appSettings.refresh', {}, 'Refresh-Token (Tage, 1–30)')">
-              <CoarTextInput v-model="f.cimd.refresh" clearable placeholder="7" />
-            </CoarFormField>
-          </div>
-        </template>
-      </div>
-
-      <p v-if="error" class="text-sm text-red-600">{{ error }}</p>
-    </div>
-  </ModalLayout>
-</template>
-
-<style scoped>
-.tab-bar { margin-bottom: 8px; }
-.tab-content { display: flex; flex-direction: column; gap: 12px; min-height: 0; }
-</style>