diff --git a/.agents/agent_assets_metadata.toml b/.agents/agent_assets_metadata.toml
new file mode 100644
index 00000000..29a20467
--- /dev/null
+++ b/.agents/agent_assets_metadata.toml
@@ -0,0 +1,14 @@
+uploads = []
+generated = []
+
+[[outputs]]
+id = "OQ6_BDrejb-HuZQVwzvnR"
+uri = "file://.local/stack-analyse-polly.md"
+type = "text"
+title = "Stack-Analyse & Migrationsbericht: Polly → Canonical Stack"
+
+[[outputs]]
+id = "32j2umQnmIB66UTjwerbv"
+uri = "file://.local/polly-canonical-stack-abgleich.md"
+type = "text"
+title = "Polly vs. Canonical Stack — Release-Risikobewertung"
diff --git a/.canvas/assets/asset_-595277047.png b/.canvas/assets/asset_-595277047.png
new file mode 100644
index 00000000..0c44680e
Binary files /dev/null and b/.canvas/assets/asset_-595277047.png differ
diff --git a/.canvas/assets/asset_559079389.png b/.canvas/assets/asset_559079389.png
new file mode 100644
index 00000000..6211cc32
Binary files /dev/null and b/.canvas/assets/asset_559079389.png differ
diff --git a/.env.example b/.env.example
index 3a430325..89331698 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,8 @@
 # Polly - Environment Variables Template
 # Copy this file to .env and fill in your values
+#
+# Variables prefixed with # are optional/commented out.
+# Remove the # to activate them.
 
 # ============================================
 # REQUIRED
@@ -8,71 +11,128 @@
 # PostgreSQL Database URL
 DATABASE_URL=postgresql://polly:your_password@localhost:5432/polly
 
-# Session secret (minimum 32 characters, use a random string)
+# Session secret (minimum 32 characters, use: openssl rand -base64 32)
 SESSION_SECRET=change-this-to-a-secure-random-string-at-least-32-chars
 
 # ============================================
-# APPLICATION URLs
+# APPLICATION URL
 # ============================================
 
-# Public URL of your application
+# Public URL of your application (used for OIDC redirects, email links, sharing)
 APP_URL=http://localhost:5000
-VITE_APP_URL=http://localhost:5000
+
+# Legacy aliases (supported for backward compatibility, use APP_URL instead):
+#   BASE_URL, VITE_APP_URL
 
 # ============================================
 # EMAIL (SMTP) - Optional
 # ============================================
 
 # SMTP Server Configuration
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=your-email@example.com
-SMTP_PASSWORD=your-email-password
+# SMTP_HOST=smtp.example.com
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=your-email@example.com
+# SMTP_PASSWORD=your-email-password
+
+# Sender address and name for outgoing emails
+# FROM_EMAIL=noreply@yourdomain.com
+# FROM_NAME=Polly
 
-# From address for outgoing emails
-EMAIL_FROM=noreply@yourdomain.com
+# Legacy alias: EMAIL_FROM (same as FROM_EMAIL)
+# Legacy alias: SMTP_PASS (same as SMTP_PASSWORD)
 
 # ============================================
 # KEYCLOAK OIDC - Optional
 # ============================================
 
 # Enable enterprise SSO with Keycloak
-KEYCLOAK_REALM=your-realm
-KEYCLOAK_CLIENT_ID=polly
-KEYCLOAK_CLIENT_SECRET=your-client-secret
-KEYCLOAK_AUTH_SERVER_URL=https://keycloak.example.com
+# KEYCLOAK_REALM=your-realm
+# KEYCLOAK_CLIENT_ID=polly
+# KEYCLOAK_CLIENT_SECRET=your-client-secret
+# KEYCLOAK_AUTH_SERVER_URL=https://keycloak.example.com
+
+# Full OIDC issuer URL (auto-derived from REALM + AUTH_SERVER_URL if not set)
+# KEYCLOAK_ISSUER_URL=https://keycloak.example.com/realms/your-realm
+
+# Custom SSO button label (shown on login page instead of "Login with Keycloak")
+# SSO_BUTTON_LABEL=Kita Hub Login
+
+# Hide the local username+password login form (default: false = form visible)
+# Set to "true" to hide the local form when SSO is the primary login method
+# HIDE_LOGIN_FORM=true
+
+# Legacy alias: KEYCLOAK_URL (same as KEYCLOAK_AUTH_SERVER_URL)
+
+# ============================================
+# AI ASSISTANT - Optional (GWDG SAIA / OpenAI-compatible)
+# ============================================
+
+# AI API endpoint (OpenAI-compatible, e.g., GWDG SAIA)
+# AI_API_URL=https://saia.2.rahtiapp.fi/v1
+
+# AI API key — when set via ENV, AI chat is auto-enabled (no admin toggle needed)
+# AI_API_KEY=your-ai-api-key
+
+# Fallback AI API key (used when primary key hits rate limit HTTP 429)
+# AI_API_KEY_FALLBACK=your-fallback-ai-api-key
+
+# AI model name (default: llama-3.3-70b-instruct)
+# AI_MODEL=llama-3.3-70b-instruct
 
 # ============================================
 # SECURITY SCANNING - Optional
 # ============================================
 
 # ClamAV Antivirus (for file upload scanning)
-CLAMAV_ENABLED=false
-CLAMAV_HOST=localhost
-CLAMAV_PORT=3310
+# CLAMAV_ENABLED=false
+# CLAMAV_HOST=localhost
+# CLAMAV_PORT=3310
 
-# Pentest-Tools.com API (for vulnerability scanning)
-PENTEST_TOOLS_API_KEY=your-api-key-here
+# Pentest-Tools.com Pro API (for vulnerability scanning)
+# PENTEST_TOOLS_API_TOKEN=your-api-token-here
 
 # ============================================
-# DOCKER COMPOSE ONLY
+# DOCKER / INITIAL ADMIN - Optional
 # ============================================
 
-# PostgreSQL credentials (only used by docker-compose)
+# PostgreSQL credentials (only used by docker-compose bundled PostgreSQL)
 POSTGRES_USER=polly
 POSTGRES_PASSWORD=polly_secret
 POSTGRES_DB=polly
 
+# Initial admin account (created/updated on Docker start)
+# ADMIN_USERNAME=admin
+# ADMIN_EMAIL=admin@polly.local
+# ADMIN_PASSWORD=Admin123!
+
 # Seed demo data on first start (true/false)
-SEED_DEMO_DATA=false
+# SEED_DEMO_DATA=false
 
 # ============================================
 # ADVANCED
 # ============================================
 
 # Node environment (development, production)
-NODE_ENV=production
+# NODE_ENV=production
+
+# Server port (default: 5000)
+# PORT=5000
+
+# Enable SSL for database connections (e.g., managed PostgreSQL with TLS)
+# DATABASE_SSL=true
+
+# Force secure cookies even without HTTPS APP_URL (e.g., behind TLS-terminating proxy)
+# FORCE_HTTPS=true
+
+# Logging level: debug, info, warn, error (default: info in production, debug in development)
+# LOG_LEVEL=info
+
+# Chromium path for PDF export (auto-detected in Docker)
+# PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
+
+# Disable WCAG default theme enforcement without branding.local.json
+# POLLY_WCAG_OVERRIDE=true
 
-# Port (default: 5000)
-PORT=5000
+# Custom header value for E2E test mode (default: polly-e2e-test-mode)
+# TEST_MODE_SECRET=polly-e2e-test-mode
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 76bdc406..4e162223 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -53,22 +53,51 @@ variables:
   GITHUB_REPO_URL: "https://github.com/manfredsteger/polly.git"
 
 # Reusable script for cloning from GitHub (avoids git init issues)
-# Note: Clears working directory first to avoid conflicts with downloaded artifacts
+# Preserves node_modules from build artifact if present, clears everything else
 # Uses GITHUB_REPO_URL variable - override in GitLab CI/CD settings for your fork
 .github_clone: &github_clone
+  - '[ -d node_modules ] && mv node_modules /tmp/_nm_preserve || true'
   - rm -rf /tmp/polly-src 2>/dev/null || true
   - find . -mindepth 1 -delete 2>/dev/null || rm -rf ./* ./.[!.]* 2>/dev/null || true
   - git clone --depth=1 "${GITHUB_REPO_URL}" /tmp/polly-src
+  - rm -rf /tmp/polly-src/.git
   - cp -r /tmp/polly-src/. .
   - rm -rf /tmp/polly-src
+  - '[ -d /tmp/_nm_preserve ] && mv /tmp/_nm_preserve node_modules || true'
 
-# Reusable script for npm install with cleanup (fixes error -116 and TAR_ENTRY_ERROR)
+# Reusable script for npm install with retry logic
+# Skips if node_modules already exists (from build artifact)
+# Retries up to 3 times with 10s pause to handle NFS/ESTALE errors on Kubernetes runners
 .npm_install: &npm_install
-  - rm -rf node_modules 2>/dev/null || true
-  - npm cache clean --force 2>/dev/null || true
-  - rm -rf /tmp/.npm 2>/dev/null || true
-  - mkdir -p /tmp/.npm
-  - npm ci --no-audit --no-fund
+  - |
+    if [ -d node_modules ] && [ "$(ls -A node_modules 2>/dev/null)" ]; then
+      echo "=== Using existing node_modules (from build artifact) ==="
+    else
+      echo "=== No node_modules found, running npm ci with retry ==="
+      npm_install_attempt=1
+      npm_install_max=3
+      while [ $npm_install_attempt -le $npm_install_max ]; do
+        echo "--- npm ci attempt $npm_install_attempt/$npm_install_max ---"
+        rm -rf node_modules 2>/dev/null || true
+        npm cache clean --force 2>/dev/null || true
+        rm -rf /tmp/.npm 2>/dev/null || true
+        mkdir -p /tmp/.npm
+        if npm ci --no-audit --no-fund; then
+          echo "--- npm ci succeeded on attempt $npm_install_attempt ---"
+          break
+        fi
+        echo "--- npm ci failed on attempt $npm_install_attempt ---"
+        if [ $npm_install_attempt -lt $npm_install_max ]; then
+          echo "Waiting 10s before retry..."
+          sleep 10
+        fi
+        npm_install_attempt=$((npm_install_attempt + 1))
+      done
+      if [ $npm_install_attempt -gt $npm_install_max ]; then
+        echo "=== npm ci failed after $npm_install_max attempts ==="
+        exit 1
+      fi
+    fi
 
 # Reusable script for waiting until PostgreSQL is ready (fixes flaky tests)
 .wait_for_postgres: &wait_for_postgres
@@ -109,7 +138,10 @@ build:
   image: node:${NODE_VERSION}
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git
     - *github_clone
@@ -119,15 +151,20 @@ build:
   artifacts:
     paths:
       - dist/
+      - node_modules/
     expire_in: 1 hour
 
 typescript-check:
   stage: test
   image: node:${NODE_VERSION}
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git
     - *github_clone
@@ -142,7 +179,9 @@ validate-translations:
   dependencies: []
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git
     - *github_clone
@@ -153,10 +192,14 @@ validate-translations:
 unit-tests:
   stage: test
   image: node:${NODE_VERSION}
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git postgresql-client
     - *github_clone
@@ -183,10 +226,14 @@ unit-tests:
 integration-tests:
   stage: test
   image: node:${NODE_VERSION}
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git postgresql-client
     - *github_clone
@@ -209,10 +256,14 @@ integration-tests:
 api-tests:
   stage: test
   image: node:${NODE_VERSION}
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git postgresql-client
     - *github_clone
@@ -235,10 +286,14 @@ api-tests:
 auth-tests:
   stage: test
   image: node:${NODE_VERSION}
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git postgresql-client
     - *github_clone
@@ -261,10 +316,14 @@ auth-tests:
 poll-tests:
   stage: test
   image: node:${NODE_VERSION}
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git postgresql-client
     - *github_clone
@@ -287,17 +346,18 @@ poll-tests:
 e2e-tests:
   stage: test
   image: mcr.microsoft.com/playwright:v1.52.0-noble
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
-    - rm -rf /tmp/polly-src 2>/dev/null || true
-    - git clone --depth=1 "${GITHUB_REPO_URL}" /tmp/polly-src
-    - cp -r /tmp/polly-src/. .
-    - rm -rf /tmp/polly-src
+    - apt-get update && apt-get install -y git postgresql-client curl
+    - *github_clone
     - mkdir -p playwright-report test-results
-    - apt-get update && apt-get install -y postgresql-client curl
   services:
     - postgres:15
   variables:
@@ -311,16 +371,10 @@ e2e-tests:
     NODE_ENV: "test"
     npm_config_cache: "/tmp/.npm"
   script:
-    - rm -rf node_modules 2>/dev/null || true
-    - npm cache clean --force 2>/dev/null || true
-    - rm -rf /tmp/.npm 2>/dev/null || true
-    - mkdir -p /tmp/.npm
-    - npm ci --no-audit --no-fund
-    # Wait for PostgreSQL to be ready before db:push
+    - *npm_install
     - *wait_for_postgres
     - npm run db:push
     - npm run dev &
-    # Wait for dev server to be ready (replaces unreliable sleep 15)
     - *wait_for_server
     - npx playwright test --reporter=list --timeout=60000 || true
   artifacts:
@@ -334,10 +388,14 @@ e2e-tests:
 security-audit:
   stage: security
   image: node:${NODE_VERSION}
-  dependencies: []
+  dependencies:
+    - build
   retry:
     max: 2
-    when: unknown_failure
+    when:
+      - unknown_failure
+      - script_failure
+      - runner_system_failure
   before_script:
     - apt-get update && apt-get install -y git
     - *github_clone
diff --git a/.replit b/.replit
index 9c11fba7..39be4485 100644
--- a/.replit
+++ b/.replit
@@ -39,6 +39,10 @@ waitForPort = 5000
 localPort = 5000
 externalPort = 80
 
+[[ports]]
+localPort = 5904
+externalPort = 3000
+
 [agent]
 integrations = ["javascript_sendgrid:1.0.0"]
 
@@ -47,3 +51,9 @@ integrations = ["javascript_sendgrid:1.0.0"]
 [userenv.shared]
 ADMIN_USERNAME = "manfredsteger"
 ADMIN_EMAIL = "manfred.steger@ifp.bayern.de"
+AI_API_URL = "https://saia.gwdg.de/v1"
+AI_MODEL = "llama-3.3-70b-instruct"
+
+[postMerge]
+path = "scripts/post-merge.sh"
+timeoutMs = 20000
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 623f742e..bd86db13 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,18 +7,83 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+*(no pending changes)*
+
+---
+
+## [0.1.0-beta.2] - 2026-04-10
+
 ### Added
+
+#### AI-Powered Poll Creation (GWDG KISSKI Integration)
+- AI assistant for poll creation via natural language input (German & English)
+- **Free tier included** for all Polly installations (GWDG SAIA / KISSKI)
+- Voice input (speech-to-text) via GWDG Whisper API with real-time waveform visualization
+- Audio transcription endpoint (`POST /api/v1/ai/transcribe`) with ffmpeg WebM→MP3 conversion
+- Whisper hallucination filter (removes artifacts like "Vielen Dank fürs Zuschauen")
+- Large audio file chunking (>20 MB split into 150 s segments for transcription)
+- Microphone permission handling with user-friendly error messages
+- Drag-and-drop reordering for organization poll slots and AI suggestions
+- AI suggestion preview with inline editing, follow-up refinement, and one-click apply
+- AI rate limiting with configurable guest/user limits via admin panel
+
+#### Schedule Poll Improvements
+- **Video conference URL**: Optional Videokonferenz-Link for schedule polls (shown in confirmation email and ICS)
+- Chronological sorting of date options in finalization view
+- Finalize button visible directly on the best-voted option
+- Labeled voting links in calendar event descriptions (direct Yes/Maybe/No links)
+
+#### Notifications & Email
+- **End Poll notifications for all poll types** (was Schedule-only before):
+  - Survey: winning option text shown in email ("Festgelegtes Ergebnis: …")
+  - Organization: compact slot summary in email (up to 5 slots with filled/capacity)
+  - Schedule: sends full date + time + ICS if a date was previously confirmed; generic notification otherwise
+- Frontend "End Poll" notify-participants toggle is now wired to the backend (was disconnected in beta.1)
+- Creator email always included in all finalization notification recipient lists
+- Email deliverability improvements: correct bulk headers, List-Unsubscribe, precedence settings
+
+#### Administration & Configuration
+- System-wide default language setting in admin panel
+- Matrix Chat Integration admin panel — "Coming Soon" placeholder (planned for v1.0)
+- Poll owner now gets admin/finalize features directly on the public poll URL (no separate admin link required)
+- Finalize button visibility fixed for all poll types and for poll owners
+
+#### Export & Calendar
+- CSV export now includes participant summary and total rows at the bottom
+- ICS calendar: CANCELLED events removed from exports and email attachments
+- ICS email status corrected (METHOD:REQUEST with TENTATIVE/CONFIRMED prefixes)
+- Calendar events automatically cleaned up (old options marked CANCELLED, removed on re-export)
+
+#### Developer Experience
+- OpenAPI 3.0 API documentation (`docs/openapi.yaml`) — full endpoint reference
+- Architecture documentation (`docs/ARCHITECTURE.md`) updated with current structure
 - Accessibility (a11y) testing with axe-core and Playwright (WCAG 2.1 AA compliance)
-- README badges for Build Status, License, TypeScript version, and Docker
+- README badges: Build Status, License, TypeScript version, Docker
+- Flutter integration guide (`docs/FLUTTER_INTEGRATION.md`)
 
 ### Fixed
+- Multi-day organization poll time slots from AI suggestions now correctly preserve start/end times
+- Date regex for AI-generated slots now accepts single-digit day/month formats (e.g., `5.9.2026`)
+- Permissions-Policy header updated to allow microphone access (`microphone=(self)`)
 - Pentest-Tools scan ID extraction (now correctly reads `created_id` from API response)
-- Missing admin warning translations (defaultAdminAccount, defaultAdminWarning, createNewAdminWarning)
-- Docker schema migration for `language_preference` column in ensureSchema.ts
+- Missing admin warning translations (`defaultAdminAccount`, `defaultAdminWarning`, `createNewAdminWarning`)
+- Docker schema migration for `language_preference` column in `ensureSchema.ts`
+- Duplicate date/time display removed from finalized poll confirmation view
+- Vote deselection: re-submitting a vote form no longer clears already-selected options
+- Missing translations added for vote editing and multiple UI strings (de + en)
+- Test suite race conditions in auth tests resolved — all 55 tests pass reliably
+
+### Security
+- File content validation: actual byte-level content type verified, not just MIME header
+- Strengthened password hashing (increased bcrypt rounds)
+- Inline scripts removed from HTML pages (CSP hardening)
+- Stricter cookie settings (HttpOnly, Secure, SameSite enforcement)
+- AI API keys proxied server-side — never exposed to the frontend
+- `microphone` Permissions-Policy restricted to same-origin only
 
 ---
 
-## [0.1.0-beta.1] - 2025-02-XX
+## [0.1.0-beta.1] - 2025-02-24
 
 ### Added
 
@@ -73,7 +138,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Demo data seeding**: `SEED_DEMO_DATA=true` for instant testing
 - **Comprehensive test suite**: 200+ unit/integration tests with Vitest
 - **E2E testing**: Playwright-based end-to-end tests
-- **API documentation**: OpenAPI 3.0 specification in `docs/openapi.yaml`
 - **CI/CD pipelines**: GitHub Actions and GitLab CI workflows
 
 ### Security
@@ -101,9 +165,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 | Version | Date | Description |
 |---------|------|-------------|
-| 0.1.0-beta.1 | 2025-02-XX | Initial beta release |
+| 0.1.0-beta.2 | 2026-04-10 | AI integration, schedule improvements, notification fixes |
+| 0.1.0-beta.1 | 2025-02-24 | Initial beta release |
 
 ---
 
-[Unreleased]: https://github.com/manfredsteger/polly/compare/v0.1.0-beta.1...HEAD
+[Unreleased]: https://github.com/manfredsteger/polly/compare/v0.1.0-beta.2...HEAD
+[0.1.0-beta.2]: https://github.com/manfredsteger/polly/compare/v0.1.0-beta.1...v0.1.0-beta.2
 [0.1.0-beta.1]: https://github.com/manfredsteger/polly/releases/tag/v0.1.0-beta.1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f2fab947..f6deb6ac 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -15,7 +15,7 @@ Vielen Dank für Ihr Interesse, zu Polly beizutragen! Diese Anleitung erklärt,
 
 ### Voraussetzungen
 
-- Node.js 20+
+- Node.js 22+
 - PostgreSQL 15+
 - npm oder yarn
 
@@ -47,22 +47,31 @@ polly/
 ├── client/                 # React Frontend
 │   └── src/
 │       ├── components/     # UI-Komponenten
+│       │   └── ai/         # AI Chat Widget & Voice Input
 │       ├── pages/          # Seitenkomponenten
 │       ├── lib/            # Utilities
-│       └── hooks/          # React Hooks
+│       ├── hooks/          # React Hooks
+│       └── locales/        # i18n Übersetzungen (de.json, en.json)
 ├── server/                 # Express Backend
-│   ├── routes.ts           # API-Routen
-│   ├── storage.ts          # Datenbank-Interface
+│   ├── routes/             # API-Routen (modular)
+│   │   ├── admin.ts        # Admin-Endpunkte
+│   │   ├── auth.ts         # Authentifizierung
+│   │   ├── polls.ts        # Umfragen-CRUD
+│   │   ├── votes.ts        # Abstimmungen
+│   │   ├── ai.ts           # AI-Assistent & Transkription
+│   │   └── ...             # Weitere Route-Module
 │   ├── services/           # Business-Logik
+│   │   ├── aiService.ts    # AI Poll-Erstellung (GWDG SAIA)
+│   │   └── whisperService.ts # Spracheingabe (Whisper API)
+│   ├── storage.ts          # Datenbank-Interface
 │   └── tests/              # Backend-Tests
-│       ├── auth/           # Authentifizierungstests
-│       ├── api/            # API-Sicherheitstests
-│       ├── polls/          # Umfragen-Tests
-│       ├── security/       # Sicherheitstests
-│       └── fixtures/       # Test-Daten & Helpers
 ├── shared/                 # Geteilte TypeScript-Typen
 │   └── schema.ts           # Drizzle-Schema & Zod-Validierung
-└── e2e/                    # Playwright E2E-Tests
+├── docs/                   # Dokumentation
+│   ├── openapi.yaml        # API-Spezifikation
+│   └── SELF-HOSTING.md     # Deployment-Anleitung
+├── Dockerfile              # Production Container
+└── docker-compose.yml      # Docker Setup
 ```
 
 ## Tests schreiben
diff --git a/DOCKERHUB.md b/DOCKERHUB.md
index fc372ee7..8953a57b 100644
--- a/DOCKERHUB.md
+++ b/DOCKERHUB.md
@@ -41,6 +41,8 @@ docker run -d \
 - **Admin Dashboard**: User management, branding, security scanning, email templates
 - **WCAG 2.1 AA**: Automatic color contrast auditing and correction
 - **ClamAV Integration**: Optional virus scanning for file uploads
+- **AI Poll Assistant**: Create polls via natural language with GWDG SAIA (OpenAI-compatible API)
+- **Voice Input**: Speech-to-text for AI chat using Whisper
 - **GDPR Compliant**: All data stays on your server, no external tracking
 
 ## Available Tags
@@ -50,7 +52,7 @@ docker run -d \
 | `manfredsteger/polly:latest` | Latest stable release |
 | `manfredsteger/polly:beta` | Latest beta release |
 | `manfredsteger/polly:rc` | Latest release candidate |
-| `manfredsteger/polly:<version>` | Specific version (e.g., `0.1.0-beta.1`) |
+| `manfredsteger/polly:<version>` | Specific version (e.g., `0.1.0-beta.2`) |
 
 ## Environment Variables
 
@@ -61,6 +63,9 @@ docker run -d \
 | `DATABASE_URL` | PostgreSQL connection string | Auto-configured in Docker Compose |
 | `SESSION_SECRET` | Session encryption key (min 32 chars) | Change in production! |
 
+> **External / Managed PostgreSQL:** Set `DATABASE_URL` directly (e.g. `postgresql://user:pass@your-db-host:5432/polly`) — the entrypoint automatically parses host and port from it. Special characters in passwords are supported (URL-encoded).
+> The `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_DB`, and `POSTGRES_HOST` variables are only used by the integrated Docker Compose setup and are ignored when `DATABASE_URL` is set.
+
 ### Application
 
 | Variable | Description | Default |
@@ -105,6 +110,15 @@ Start with ClamAV:
 docker compose --profile clamav up -d
 ```
 
+### AI Assistant (Optional)
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `AI_API_URL` | OpenAI-compatible API endpoint | — |
+| `AI_API_KEY` | API key for AI services | — |
+| `AI_API_KEY_FALLBACK` | Fallback key (on HTTP 429) | — |
+| `AI_MODEL` | AI model name | `llama-3.3-70b-instruct` |
+
 ## Docker Compose
 
 The included `docker-compose.yml` provides a zero-config setup with PostgreSQL:
diff --git a/Dockerfile b/Dockerfile
index a3db414a..c9145950 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -70,6 +70,7 @@ FROM node:22-slim AS production
 # Install minimal runtime dependencies
 # - canvas/pdfkit: libcairo2 libpango-1.0-0 libjpeg62-turbo libgif7 libpixman-1-0
 # - Puppeteer: chromium (system installation, not bundled)
+# - ffmpeg: audio conversion for AI voice transcription (WebM → MP3)
 # - Database: postgresql-client (for pg_isready)
 # - Utilities: wget for health checks
 # Note: Full apt reset to guarantee fresh package lists (no stale GPG signatures)
@@ -84,6 +85,7 @@ RUN rm -rf /var/lib/apt/lists/* /var/cache/apt/* /etc/apt/apt.conf.d/docker-clea
     libgif7 \
     libpixman-1-0 \
     chromium \
+    ffmpeg \
     fonts-liberation \
     postgresql-client \
     wget \
@@ -116,10 +118,8 @@ COPY --from=builder /app/drizzle.config.ts ./
 COPY --from=builder /app/vite.config.ts ./
 COPY vitest.config.ts ./
 
-# Copy client source files needed by UI consistency tests (alertConsistency.test.ts)
-COPY --from=builder /app/client/src/components ./client/src/components
-COPY --from=builder /app/client/src/pages ./client/src/pages
-COPY --from=builder /app/client/src/index.css ./client/src/index.css
+# Copy client source files needed by UI tests (alertConsistency, i18n-hardcoded-strings)
+COPY --from=builder /app/client/src ./client/src
 
 # Copy migrations for schema setup
 COPY migrations ./migrations
diff --git a/README.md b/README.md
index 333fd712..52bc657a 100644
--- a/README.md
+++ b/README.md
@@ -154,6 +154,8 @@ make complete
 - **QR Code Sharing**: Easy poll distribution via QR codes
 - **Full Customization**: Theme colors, logo, site name via admin panel
 - **Dark Mode**: System-wide dark mode with admin defaults
+- **AI Poll Assistant**: Create polls via natural language with AI-powered suggestions (GWDG SAIA integration)
+- **Voice Input**: Speech-to-text for AI chat with real-time waveform visualization
 - **Transactional Slot Booking**: PostgreSQL row-level locking prevents overbooking in organization polls
 
 ### Authentication Options
@@ -206,39 +208,94 @@ npm run dev
 
 ## ⚙️ Configuration
 
-### Required Environment Variables
-
-```env
-DATABASE_URL=postgresql://user:password@localhost:5432/polly
-SESSION_SECRET=your-secure-random-string-min-32-chars
-```
-
-### Optional: Email (SMTP)
-
-```env
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=your-email@example.com
-SMTP_PASSWORD=your-email-password
-EMAIL_FROM=noreply@yourdomain.com
-```
-
-### Optional: Keycloak OIDC
-
-```env
-KEYCLOAK_REALM=your-realm
-KEYCLOAK_CLIENT_ID=polly
-KEYCLOAK_CLIENT_SECRET=your-client-secret
-KEYCLOAK_AUTH_SERVER_URL=https://keycloak.example.com
-```
-
-### Application URLs
-
-```env
-APP_URL=https://your-app-url.com
-VITE_APP_URL=https://your-app-url.com
-```
+> **Full reference**: See [`.env.example`](.env.example) for a ready-to-use template with all variables.
+> **Production guide**: See [`docs/SELF-HOSTING.md`](docs/SELF-HOSTING.md) for deployment-specific configuration.
+
+### Required
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `DATABASE_URL` | PostgreSQL connection URL | `postgresql://user:pass@host:5432/polly` |
+| `SESSION_SECRET` | Session encryption key (min 32 chars). Generate with `openssl rand -base64 32` | `a1b2c3d4...` |
+
+### Application URL
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `APP_URL` | Public URL of your application (used for OIDC redirects, email links, QR codes, sharing) | `https://poll.example.com` |
+
+> **Note:** `BASE_URL` and `VITE_APP_URL` are supported as legacy aliases. Use `APP_URL` for new deployments.
+
+### Email (SMTP) — Optional
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `SMTP_HOST` | SMTP server hostname | — |
+| `SMTP_PORT` | SMTP port | `587` |
+| `SMTP_SECURE` | Use TLS (`true`/`false`) | `false` |
+| `SMTP_USER` | SMTP username | — |
+| `SMTP_PASSWORD` | SMTP password | — |
+| `FROM_EMAIL` | Sender address for outgoing emails | `noreply@polly.example.com` |
+| `FROM_NAME` | Sender display name | `Polly` |
+
+> **Legacy aliases:** `EMAIL_FROM` (same as `FROM_EMAIL`), `SMTP_PASS` (same as `SMTP_PASSWORD`)
+
+### Keycloak OIDC — Optional
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `KEYCLOAK_REALM` | Keycloak realm name | `university` |
+| `KEYCLOAK_CLIENT_ID` | Client ID | `polly` |
+| `KEYCLOAK_CLIENT_SECRET` | Client secret | `secret-uuid` |
+| `KEYCLOAK_AUTH_SERVER_URL` | Keycloak base URL | `https://keycloak.example.com` |
+| `KEYCLOAK_ISSUER_URL` | Full OIDC issuer URL (auto-derived if not set) | `https://keycloak.example.com/realms/myrealm` |
+| `SSO_BUTTON_LABEL` | Custom login button text (e.g. "Kita Hub Login"). Also configurable in Admin panel | — |
+| `HIDE_LOGIN_FORM` | Hide local username+password login form when SSO is primary | `false` |
+
+> **Legacy alias:** `KEYCLOAK_URL` (same as `KEYCLOAK_AUTH_SERVER_URL`)
+
+### AI Assistant — Optional
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `AI_API_URL` | OpenAI-compatible API endpoint | — |
+| `AI_API_KEY` | API key. When set via ENV, AI chat is **auto-enabled** without admin toggle | — |
+| `AI_API_KEY_FALLBACK` | Fallback key (used on HTTP 429 rate limit) | — |
+| `AI_MODEL` | AI model name | `llama-3.3-70b-instruct` |
+
+### Security Scanning — Optional
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `CLAMAV_ENABLED` | Enable ClamAV virus scanning for uploads | `false` |
+| `CLAMAV_HOST` | ClamAV daemon hostname | `clamav` |
+| `CLAMAV_PORT` | ClamAV daemon port | `3310` |
+| `PENTEST_TOOLS_API_TOKEN` | Pentest-Tools.com Pro API token | — |
+
+### Docker / Initial Admin — Optional
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `ADMIN_USERNAME` | Initial admin username | `admin` |
+| `ADMIN_EMAIL` | Initial admin email | `admin@polly.local` |
+| `ADMIN_PASSWORD` | Initial admin password | `Admin123!` |
+| `SEED_DEMO_DATA` | Seed demo polls on first start | `false` |
+| `POSTGRES_USER` | Bundled PostgreSQL user (docker-compose only) | `polly` |
+| `POSTGRES_PASSWORD` | Bundled PostgreSQL password (docker-compose only) | `polly_secret` |
+| `POSTGRES_DB` | Bundled PostgreSQL database (docker-compose only) | `polly` |
+
+### Advanced
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `PORT` | Server port | `5000` |
+| `NODE_ENV` | Node environment | `production` |
+| `DATABASE_SSL` | Enable SSL for database connections | `false` |
+| `FORCE_HTTPS` | Force secure cookies (behind TLS-terminating proxy) | auto-detect from `APP_URL` |
+| `LOG_LEVEL` | Logging level: `debug`, `info`, `warn`, `error` | `info` (prod) / `debug` (dev) |
+| `PUPPETEER_EXECUTABLE_PATH` | Chromium path for PDF export | auto-detected |
+| `POLLY_WCAG_OVERRIDE` | Disable WCAG default theme enforcement | `false` |
+| `TEST_MODE_SECRET` | Custom header value for E2E test mode | `polly-e2e-test-mode` |
 
 ## 🏗️ Tech Stack
 
@@ -250,6 +307,7 @@ VITE_APP_URL=https://your-app-url.com
 | **Backend** | Express.js, TypeScript |
 | **Database** | PostgreSQL, Drizzle ORM |
 | **Auth** | Passport.js, express-session |
+| **AI** | GWDG SAIA (OpenAI-compatible), Whisper |
 
 ## 📁 Project Structure
 
@@ -306,6 +364,7 @@ Access the admin panel at `/admin` to customize:
 - Role-based access control
 - CSRF protection
 - Secure password hashing with bcrypt
+- AI API key proxying (server-side only)
 
 ## 🐳 Docker Deployment
 
@@ -409,7 +468,7 @@ Polly is currently in **Beta Phase** (Q1-Q2 2025). Our focus areas:
 | Priority | Feature | Status |
 |----------|---------|--------|
 | 🔐 | **Keycloak SSO (OIDC)** - Enterprise single sign-on integration | In Progress |
-| 🤖 | **AI Voice Control** - Create polls via speech with GWDG KISSKI Free Tier | Planned |
+| 🤖 | **AI Voice Control** - Create polls via speech with GWDG KISSKI Free Tier | ✅ Done |
 | 🔌 | **OpenAI-Compatible API** - Support for custom AI providers | Planned |
 | 💬 | **Matrix / Element Chatbot** - Create and manage polls directly from Matrix chat | Version 1.0 |
 | 🇪🇺 | **European DC Focus** - Simplified deployment for EU data centers | Version 1.0 |
diff --git a/ROADMAP.md b/ROADMAP.md
index 6d15fb04..747716d5 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -25,42 +25,57 @@ The initial development phase focused on building a solid foundation for a self-
 
 ---
 
-## 🧪 Beta Phase (Q1-Q2 2025)
+## 🧪 Beta Phase (Q1 2025 – Q2 2026)
 
 The beta phase focuses on enterprise readiness, AI integration, and community feedback.
 
 ### Core Goals
 
 #### 1. Single Sign-On (SSO) with Keycloak OIDC
-- [ ] Full Keycloak OIDC integration testing
-- [ ] Automatic role mapping (User, Admin, Manager)
+- [x] Keycloak OIDC integration (basic)
+- [x] Automatic role mapping (User, Admin, Manager)
+- [ ] Full Keycloak end-to-end integration testing
 - [ ] Session synchronization with identity provider
 - [ ] Documentation for enterprise SSO setup
 
-#### 2. AI-Powered Voice Control (GWDG KISSKI Integration)
-- [ ] Integration with [GWDG KISSKI](https://kisski.gwdg.de) AI services
-- [ ] **Free Tier included** for all Polly installations
-- [ ] Voice-controlled poll creation with speech-to-text
-- [ ] AI agent-guided form completion (no manual input required)
-- [ ] Natural language commands: "Erstelle eine Terminumfrage für nächste Woche"
-- [ ] OpenAI-compatible provider support for custom deployments
-
-> **Partner:** GWDG (Gesellschaft für wissenschaftliche Datenverarbeitung mbH Göttingen) is the primary AI integration partner, providing free AI capabilities to all Polly users.
-
-#### 3. Community & Stability
+#### 2. AI-Powered Poll Creation & Voice Control (GWDG KISSKI Integration) ✅ *Released in beta.2*
+- [x] Integration with [GWDG KISSKI](https://kisski.gwdg.de) AI services
+- [x] **Free Tier included** for all Polly installations
+- [x] Voice-controlled poll creation with speech-to-text (GWDG Whisper API)
+- [x] AI agent-guided form completion (no manual input required)
+- [x] Natural language commands: "Erstelle eine Terminumfrage für nächste Woche"
+- [x] Drag-and-drop reordering of AI-suggested slots
+- [x] Follow-up refinement via chat ("Füge noch Montag Abend hinzu")
+- [x] AI rate limiting (configurable guest/user limits via admin panel)
+- [x] OpenAI-compatible provider support for custom deployments
+
+#### 3. Schedule Poll Enhancements ✅ *Released in beta.2*
+- [x] Video conference URL field (optional, shown in emails and ICS)
+- [x] Chronological date sorting in finalization view
+- [x] Finalize button visible on best-voted option
+- [x] Labeled voting links in calendar event descriptions
+- [x] CANCELLED events removed from ICS exports
+
+#### 4. Notification Improvements ✅ *Released in beta.2*
+- [x] End Poll notifications for all poll types (not just Schedule)
+- [x] Survey finalization email shows winning option text
+- [x] Organization poll "End Poll" email shows slot summary
+- [x] Creator always included in finalization email recipients
+- [x] Frontend "End Poll" notify toggle wired to backend
+
+#### 5. Community & Stability
 - [ ] Community feedback collection and issue tracking
-- [ ] Bug fixes and stability improvements
 - [ ] Performance optimization for large-scale deployments
 - [ ] Extended documentation for self-hosting
 
-#### 4. Additional Integrations
+#### 6. Additional Integrations
 - [ ] Additional language packs (community contributions welcome)
 - [ ] Webhook support for external automation
 - [ ] Enhanced calendar integrations
 
 ---
 
-## 🎯 Version 1.0 (Target: H2 2025)
+## 🎯 Version 1.0 (Target: H2 2026)
 
 The 1.0 release will focus on meeting the needs of European data centers and simplifying enterprise deployment.
 
@@ -75,13 +90,12 @@ The 1.0 release will focus on meeting the needs of European data centers and sim
 
 #### Enterprise Features
 - [ ] Advanced analytics dashboard
-- [ ] API rate limiting (admin-configurable)
 - [ ] Audit logging for compliance
 - [ ] Backup and restore utilities
 
 #### Mobile & Integrations
-- [ ] Mobile app (React Native or Flutter)
-- [ ] **Matrix / Element Chatbot** - Create and manage polls via Matrix messenger
+- [ ] Mobile app (React Native or Flutter) — see `docs/FLUTTER_INTEGRATION.md`
+- [ ] 🚧 **Matrix / Element Chatbot** *(Coming Soon)* - Create and manage polls via Matrix messenger
   - [ ] Bot account for self-hosted Matrix/Synapse servers
   - [ ] Poll creation via chat commands (e.g. `!poll create Terminumfrage ...`)
   - [ ] Vote notifications and reminders in Matrix rooms
@@ -117,12 +131,13 @@ We welcome community input! If you have feature requests or suggestions:
 
 ## 📅 Release Timeline
 
-| Phase | Target | Focus |
-|-------|--------|-------|
-| **Alpha** | 2024 - Q1 2025 | Core functionality, foundation |
-| **Beta 0.1.0** | Q1-Q2 2025 | SSO, AI integration, stability |
-| **Version 1.0** | H2 2025 | European DC support, enterprise features |
+| Phase | Released | Focus |
+|-------|----------|-------|
+| **Alpha** | 2024 – Q1 2025 | Core functionality, foundation |
+| **Beta 0.1.0-beta.1** | 2025-02-24 | Initial public beta — all poll types, auth, Docker |
+| **Beta 0.1.0-beta.2** | 2026-04-10 | AI integration, schedule improvements, notification fixes |
+| **Version 1.0** | Target: H2 2026 | European DC support, enterprise features |
 
 ---
 
-*Last updated: February 2025*
+*Last updated: April 2026*
diff --git a/SECURITY.md b/SECURITY.md
index d8c46f86..8fff98b4 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -40,6 +40,9 @@ Polly implements the following security measures:
 - **Server-side validation** with Zod schemas
 - **HTTP-only secure session cookies**
 - **Role-based access control** (User, Admin, Manager)
+- **AI API key proxying** — Keys stored server-side only, never exposed to frontend
+- **Permissions-Policy headers** — Microphone restricted to same-origin, camera/geolocation/payment disabled
+- **Audio upload validation** — File type and size checks before AI transcription
 
 ## Security Best Practices for Self-Hosting
 
@@ -49,6 +52,8 @@ Polly implements the following security measures:
 4. **Restrict database access** to application server only
 5. **Configure firewall rules** appropriately
 6. **Enable audit logging** for compliance requirements
+7. **Protect AI API keys** — Use environment variables, never commit keys to source control
+8. **Monitor AI usage** — Check admin panel for unusual AI request patterns
 
 ## Acknowledgments
 
diff --git a/client/index.html b/client/index.html
index 14a8341c..1fb897b3 100644
--- a/client/index.html
+++ b/client/index.html
@@ -5,36 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Polly - Open Source Polling System</title>
     <meta name="description" content="Polly is an open-source polling and scheduling platform for teams. Create schedule polls, surveys, and organization lists." />
-    <script>
-      (function() {
-        try {
-          var cached = localStorage.getItem('polly-branding-colors');
-          if (cached) {
-            var colors = JSON.parse(cached);
-            var style = document.documentElement.style;
-            if (colors.primary) {
-              style.setProperty('--polly-orange', colors.primary);
-              style.setProperty('--primary', colors.primaryHSL);
-            }
-            if (colors.secondary) {
-              style.setProperty('--polly-blue', colors.secondary);
-            }
-            if (colors.schedule) {
-              style.setProperty('--color-schedule', colors.schedule);
-              style.setProperty('--color-schedule-light', colors.scheduleLight);
-            }
-            if (colors.survey) {
-              style.setProperty('--color-survey', colors.survey);
-              style.setProperty('--color-survey-light', colors.surveyLight);
-            }
-            if (colors.organization) {
-              style.setProperty('--color-organization', colors.organization);
-              style.setProperty('--color-organization-light', colors.organizationLight);
-            }
-          }
-        } catch (e) {}
-      })();
-    </script>
+    <script src="/branding-preload.js"></script>
   </head>
   <body>
     <div id="root"></div>
diff --git a/client/public/branding-preload.js b/client/public/branding-preload.js
new file mode 100644
index 00000000..df7a9530
--- /dev/null
+++ b/client/public/branding-preload.js
@@ -0,0 +1,28 @@
+(function() {
+  try {
+    var cached = localStorage.getItem('polly-branding-colors');
+    if (cached) {
+      var colors = JSON.parse(cached);
+      var style = document.documentElement.style;
+      if (colors.primary) {
+        style.setProperty('--polly-orange', colors.primary);
+        style.setProperty('--primary', colors.primaryHSL);
+      }
+      if (colors.secondary) {
+        style.setProperty('--polly-blue', colors.secondary);
+      }
+      if (colors.schedule) {
+        style.setProperty('--color-schedule', colors.schedule);
+        style.setProperty('--color-schedule-light', colors.scheduleLight);
+      }
+      if (colors.survey) {
+        style.setProperty('--color-survey', colors.survey);
+        style.setProperty('--color-survey-light', colors.surveyLight);
+      }
+      if (colors.organization) {
+        style.setProperty('--color-organization', colors.organization);
+        style.setProperty('--color-organization-light', colors.organizationLight);
+      }
+    }
+  } catch (e) {}
+})();
diff --git a/client/src/App.tsx b/client/src/App.tsx
index 3ccaa6f8..fa64e20c 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -1,14 +1,22 @@
-import { lazy, Suspense } from "react";
+import { lazy, Suspense, useState } from "react";
 import { Switch, Route } from "wouter";
 import { queryClient } from "./lib/queryClient";
-import { QueryClientProvider } from "@tanstack/react-query";
+import { QueryClientProvider, useQueryClient } from "@tanstack/react-query";
 import { Toaster } from "@/components/ui/toaster";
 import { TooltipProvider } from "@/components/ui/tooltip";
-import { AuthProvider } from "@/contexts/AuthContext";
+import { AuthProvider, useAuth } from "@/contexts/AuthContext";
 import { CustomizationProvider } from "@/contexts/CustomizationContext";
 import { ThemeProvider } from "@/contexts/ThemeContext";
 import Layout from "@/components/Layout";
 import { Skeleton } from "@/components/ui/skeleton";
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { ShieldAlert } from "lucide-react";
+import { apiRequest } from "@/lib/queryClient";
+import { useTranslation } from "react-i18next";
 import Home from "@/pages/home";
 import NotFound from "@/pages/not-found";
 
@@ -19,7 +27,6 @@ const Poll = lazy(() => import("@/pages/poll"));
 const PollSuccess = lazy(() => import("@/pages/poll-success"));
 const VoteSuccess = lazy(() => import("@/pages/vote-success"));
 const VoteEdit = lazy(() => import("@/pages/vote-edit"));
-const Dashboard = lazy(() => import("@/pages/dashboard"));
 const Admin = lazy(() => import("@/pages/admin"));
 const Login = lazy(() => import("@/pages/login"));
 const MyPolls = lazy(() => import("@/pages/my-polls"));
@@ -52,7 +59,6 @@ function Router() {
         <Route path="/success" component={PollSuccess} />
         <Route path="/vote-success" component={VoteSuccess} />
         <Route path="/edit/:editToken" component={VoteEdit} />
-        <Route path="/dashboard" component={Dashboard} />
         <Route path="/admin" component={Admin} />
         <Route path="/anmelden" component={Login} />
         <Route path="/meine-umfragen" component={MyPolls} />
@@ -66,6 +72,88 @@ function Router() {
   );
 }
 
+function ForcePasswordChangeGuard({ children }: { children: React.ReactNode }) {
+  const { user, logout } = useAuth();
+  const { t } = useTranslation();
+  const qc = useQueryClient();
+  const [currentPassword, setCurrentPassword] = useState('');
+  const [newPassword, setNewPassword] = useState('');
+  const [confirmPassword, setConfirmPassword] = useState('');
+  const [error, setError] = useState('');
+  const [loading, setLoading] = useState(false);
+
+  if (!user?.isInitialAdmin) return <>{children}</>;
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setError('');
+    if (newPassword !== confirmPassword) {
+      setError(t('forcePassword.passwordsMismatch'));
+      return;
+    }
+    if (newPassword.length < 8) {
+      setError(t('forcePassword.passwordTooShort'));
+      return;
+    }
+    setLoading(true);
+    try {
+      const res = await apiRequest('POST', '/api/v1/auth/change-password', { currentPassword, newPassword });
+      if (!res.ok) {
+        const data = await res.json();
+        setError(data.error || t('forcePassword.error'));
+        return;
+      }
+      qc.invalidateQueries({ queryKey: ['/api/v1/auth/me'] });
+    } catch {
+      setError(t('forcePassword.error'));
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <>
+      {children}
+      <Dialog open={true} onOpenChange={() => {}}>
+        <DialogContent className="sm:max-w-md [&>button:last-child]:hidden" onInteractOutside={(e) => e.preventDefault()} onEscapeKeyDown={(e) => e.preventDefault()}>
+          <DialogHeader>
+            <div className="flex items-center gap-2 text-destructive">
+              <ShieldAlert className="h-5 w-5" />
+              <DialogTitle>{t('forcePassword.title')}</DialogTitle>
+            </div>
+            <DialogDescription>
+              {t('forcePassword.description')}
+            </DialogDescription>
+          </DialogHeader>
+          <form onSubmit={handleSubmit} className="space-y-4">
+            {error && (
+              <Alert variant="destructive">
+                <AlertDescription>{error}</AlertDescription>
+              </Alert>
+            )}
+            <div className="space-y-2">
+              <Label htmlFor="force-current">{t('forcePassword.currentPassword')}</Label>
+              <Input id="force-current" type="password" autoComplete="off" value={currentPassword} onChange={(e) => setCurrentPassword(e.target.value)} required />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="force-new">{t('forcePassword.newPassword')}</Label>
+              <Input id="force-new" type="password" autoComplete="off" value={newPassword} onChange={(e) => setNewPassword(e.target.value)} required />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="force-confirm">{t('forcePassword.confirmPassword')}</Label>
+              <Input id="force-confirm" type="password" autoComplete="off" value={confirmPassword} onChange={(e) => setConfirmPassword(e.target.value)} required />
+            </div>
+            <div className="flex gap-2 justify-end">
+              <Button type="button" variant="outline" onClick={() => logout()}>{t('forcePassword.logout')}</Button>
+              <Button type="submit" disabled={loading}>{loading ? t('forcePassword.changing') : t('forcePassword.submit')}</Button>
+            </div>
+          </form>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
 function App() {
   return (
     <QueryClientProvider client={queryClient}>
@@ -73,10 +161,12 @@ function App() {
         <AuthProvider>
           <ThemeProvider>
             <TooltipProvider>
-              <Layout>
-                <Toaster />
-                <Router />
-              </Layout>
+              <ForcePasswordChangeGuard>
+                <Layout>
+                  <Toaster />
+                  <Router />
+                </Layout>
+              </ForcePasswordChangeGuard>
             </TooltipProvider>
           </ThemeProvider>
         </AuthProvider>
diff --git a/client/src/components/Layout.tsx b/client/src/components/Layout.tsx
index cbd59538..6d717ca4 100644
--- a/client/src/components/Layout.tsx
+++ b/client/src/components/Layout.tsx
@@ -62,10 +62,9 @@ export default function Layout({ children }: LayoutProps) {
     return <Moon className="w-4 h-4" />;
   };
 
-  const rawSiteName = settings?.branding?.siteName ?? '';
-  const rawSiteNameAccent = settings?.branding?.siteNameAccent ?? '';
-  const siteName = (rawSiteName || rawSiteNameAccent) ? rawSiteName : 'Poll';
-  const siteNameAccent = (rawSiteName || rawSiteNameAccent) ? rawSiteNameAccent : 'y';
+  const siteName = settings?.branding?.siteName ?? '';
+  const siteNameAccent = settings?.branding?.siteNameAccent ?? '';
+  const hasSiteTitle = !!(siteName || siteNameAccent);
   const logoUrl = settings?.branding?.logoUrl;
   const footerDescription = settings?.footer?.description || t('footer.defaultDescription');
   const footerCopyright = settings?.footer?.copyrightText || t('footer.defaultCopyright');
@@ -75,7 +74,7 @@ export default function Layout({ children }: LayoutProps) {
   ];
 
   return (
-    <div className="min-h-screen bg-background transition-colors duration-200">
+    <div className="min-h-screen flex flex-col bg-background transition-colors duration-200">
       <nav className="bg-white dark:bg-gray-900 border-b border-border sticky top-0 z-50 transition-colors duration-200">
         <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
           <div className="flex justify-between items-center h-16">
@@ -83,11 +82,13 @@ export default function Layout({ children }: LayoutProps) {
               <Link href="/" aria-label={t('nav.home')}>
                 <div className="flex items-center cursor-pointer" data-testid="logo">
                   {logoUrl ? (
-                    <img src={logoUrl} alt={siteName} className="h-10 mr-2" />
+                    <img src={logoUrl} alt={siteName || 'Logo'} className="h-10 mr-2" />
                   ) : null}
-                  <h1 className="text-2xl font-bold text-foreground">
-                    {siteName}<span className="text-polly-orange">{siteNameAccent}</span>
-                  </h1>
+                  {hasSiteTitle && (
+                    <h1 className="text-2xl font-bold text-foreground">
+                      {siteName}<span className="text-polly-orange">{siteNameAccent}</span>
+                    </h1>
+                  )}
                 </div>
               </Link>
             </div>
@@ -164,7 +165,7 @@ export default function Layout({ children }: LayoutProps) {
         </div>
       </nav>
 
-      {isAuthenticated && user && !user.emailVerified && (
+      {isAuthenticated && user && !user.emailVerified && user.provider === 'local' && (
         <div className="bg-amber-50 dark:bg-amber-950 border-b border-amber-200 dark:border-amber-800">
           <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-3">
             <div className="flex flex-col sm:flex-row items-start sm:items-center justify-between gap-2">
@@ -203,11 +204,13 @@ export default function Layout({ children }: LayoutProps) {
             <div className="md:col-span-2">
               <div className="flex items-center mb-4">
                 {logoUrl ? (
-                  <img src={logoUrl} alt={siteName} className="h-10 mr-2" />
+                  <img src={logoUrl} alt={siteName || 'Logo'} className="h-10 mr-2" />
                 ) : null}
-                <h3 className="text-2xl font-bold">
-                  {siteName}<span className="text-polly-orange">{siteNameAccent}</span>
-                </h3>
+                {hasSiteTitle && (
+                  <h3 className="text-2xl font-bold">
+                    {siteName}<span className="text-polly-orange">{siteNameAccent}</span>
+                  </h3>
+                )}
               </div>
               <p className="text-gray-300 mb-6 max-w-md">
                 {footerDescription}
diff --git a/client/src/components/LiveResultsView.tsx b/client/src/components/LiveResultsView.tsx
index 0b501795..e932fa85 100644
--- a/client/src/components/LiveResultsView.tsx
+++ b/client/src/components/LiveResultsView.tsx
@@ -18,7 +18,8 @@ import {
   Eye,
   Clock,
   User,
-  Trophy
+  Trophy,
+  Lock
 } from 'lucide-react';
 import { useLiveVoting } from '@/hooks/useLiveVoting';
 import type { PollWithOptions, PollResults } from '@shared/schema';
@@ -79,6 +80,7 @@ export function LiveResultsView({ poll, publicToken, isAdminAccess = false }: Li
   } = useLiveVoting({
     pollToken: publicToken,
     isPresenter: true,
+    adminToken: poll.adminToken,
     onResultsRefresh: handleResultsRefresh,
     onVoteFinalized: handleVoteFinalized,
   });
@@ -305,19 +307,24 @@ export function LiveResultsView({ poll, publicToken, isAdminAccess = false }: Li
                   </th>
                   {poll.options.map(option => {
                     const isWinner = winningOptionIds.has(option.id);
+                    const isFinalOption = poll.finalOptionId != null && poll.finalOptionId > 0 && poll.finalOptionId === option.id;
                     return (
                       <th 
                         key={option.id} 
                         className={cn(
                           'text-center font-medium p-3 min-w-[120px] transition-all duration-500',
                           isFullscreen && 'p-4 min-w-[180px]',
-                          isWinner && 'bg-green-500/20 border-x-2 border-t-2 border-green-500/50'
+                          isFinalOption 
+                            ? 'bg-green-500/30 border-x-2 border-t-2 border-green-500/70'
+                            : isWinner && 'bg-green-500/20 border-x-2 border-t-2 border-green-500/50'
                         )}
                       >
                         <div className="flex flex-col items-center gap-1">
-                          {isWinner && (
+                          {isFinalOption ? (
+                            <Lock className={cn('text-green-600', isFullscreen ? 'w-5 h-5' : 'w-4 h-4')} />
+                          ) : isWinner ? (
                             <Trophy className={cn('text-green-600 animate-pulse', isFullscreen ? 'w-5 h-5' : 'w-4 h-4')} />
-                          )}
+                          ) : null}
                           <div 
                             className={cn(
                               isFullscreen ? 'text-sm whitespace-normal leading-tight' : 'truncate max-w-[150px] text-xs'
@@ -326,6 +333,11 @@ export function LiveResultsView({ poll, publicToken, isAdminAccess = false }: Li
                           >
                             <FormattedOptionText text={option.text} startTime={option.startTime} locale={i18n.language} />
                           </div>
+                          {isFinalOption && (
+                            <Badge className="text-xs bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200">
+                              {t('resultsChart.confirmed')}
+                            </Badge>
+                          )}
                         </div>
                       </th>
                     );
diff --git a/client/src/components/ResultsChart.tsx b/client/src/components/ResultsChart.tsx
index 39730d45..e24c91a2 100644
--- a/client/src/components/ResultsChart.tsx
+++ b/client/src/components/ResultsChart.tsx
@@ -1,6 +1,17 @@
+import { MessageSquare } from "lucide-react";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
 import { PollTypeBadge } from "@/components/ui/PollTypeBadge";
 import { Progress } from "@/components/ui/progress";
 import { Input } from "@/components/ui/input";
@@ -18,7 +29,13 @@ import {
   Mail,
   Pencil,
   Save,
-  ClipboardList
+  ClipboardList,
+  Lock,
+  Unlock,
+  CalendarCheck,
+  Loader2,
+  Video,
+  ExternalLink
 } from "lucide-react";
 import Lightbox from "yet-another-react-lightbox";
 import "yet-another-react-lightbox/styles.css";
@@ -27,6 +44,7 @@ import { useTranslation } from 'react-i18next';
 import { Table } from "lucide-react";
 import type { PollResults } from "@shared/schema";
 import { useToast } from "@/hooks/use-toast";
+import { apiRequest } from "@/lib/queryClient";
 import { formatScheduleOptionWithWeekday } from "@/lib/utils";
 
 function FormattedOptionText({ text, startTime, locale = 'en' }: { text: string; startTime?: Date | string | null; locale?: string }) {
@@ -41,11 +59,14 @@ function FormattedOptionText({ text, startTime, locale = 'en' }: { text: string;
 interface ResultsChartProps {
   results: PollResults;
   publicToken?: string;
+  adminToken?: string;
   isAdminAccess?: boolean;
+  isOwner?: boolean;
   onCapacityUpdate?: (optionId: number, newCapacity: number | null) => Promise<void>;
+  onFinalize?: () => void;
 }
 
-export function ResultsChart({ results, publicToken, isAdminAccess = false, onCapacityUpdate }: ResultsChartProps) {
+export function ResultsChart({ results, publicToken, adminToken, isAdminAccess = false, isOwner = false, onCapacityUpdate, onFinalize }: ResultsChartProps) {
   const { poll, options, stats, participantCount } = results;
   const { toast } = useToast();
   const { t, i18n } = useTranslation();
@@ -57,6 +78,81 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
   const [capacityError, setCapacityError] = useState<string>("");
 
   const isOrganization = poll.type === 'organization';
+  const isSchedule = poll.type === 'schedule';
+  const isFinalized = poll.finalOptionId != null && poll.finalOptionId > 0;
+  const [isFinalizingOption, setIsFinalizingOption] = useState<number | null>(null);
+  const [confirmDialogOptionId, setConfirmDialogOptionId] = useState<number | null>(null);
+  const [finalizeClosePoll, setFinalizeClosePoll] = useState(true);
+  const [finalizeNotify, setFinalizeNotify] = useState(true);
+
+  const handleFinalize = async (optionId: number) => {
+    if (!adminToken) return;
+    setIsFinalizingOption(optionId);
+    try {
+      await apiRequest('POST', `/api/v1/polls/admin/${adminToken}/finalize`, {
+        optionId,
+        closePoll: finalizeClosePoll,
+        notifyParticipants: finalizeNotify,
+      });
+      const parts: string[] = [isSchedule ? t('resultsChart.dateConfirmed') : t('resultsChart.resultConfirmed')];
+      if (finalizeClosePoll) parts.push(t('resultsChart.pollClosed'));
+      if (finalizeNotify) parts.push(t('resultsChart.participantsNotified'));
+      toast({ title: t('common.success'), description: parts.join(' ') });
+      onFinalize?.();
+    } catch (error) {
+      toast({ title: t('common.error'), description: t('resultsChart.finalizeFailed'), variant: "destructive" });
+    } finally {
+      setIsFinalizingOption(null);
+      setConfirmDialogOptionId(null);
+    }
+  };
+
+  const handleUnfinalize = async () => {
+    if (!adminToken) return;
+    setIsFinalizingOption(0);
+    try {
+      await apiRequest('POST', `/api/v1/polls/admin/${adminToken}/finalize`, { optionId: 0 });
+      toast({ title: t('common.success'), description: isSchedule ? t('resultsChart.dateUnconfirmed') : t('resultsChart.resultUnconfirmed') });
+      onFinalize?.();
+    } catch (error) {
+      toast({ title: t('common.error'), description: t('resultsChart.finalizeFailed'), variant: "destructive" });
+    } finally {
+      setIsFinalizingOption(null);
+    }
+  };
+
+  const handleExportICS = async () => {
+    if (!publicToken) return;
+    try {
+      const response = await fetch(`/api/v1/polls/${publicToken}/export/ics?lang=${i18n.language}`);
+      if (!response.ok) {
+        const data = await response.json().catch(() => null);
+        toast({
+          title: t('common.error'),
+          description: data?.error || t('results.icsExportError'),
+          variant: "destructive",
+        });
+        return;
+      }
+      const blob = await response.blob();
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement('a');
+      a.href = url;
+      const disposition = response.headers.get('Content-Disposition');
+      const filenameMatch = disposition?.match(/filename="?([^"]+)"?/);
+      a.download = filenameMatch?.[1] || 'poll.ics';
+      document.body.appendChild(a);
+      a.click();
+      document.body.removeChild(a);
+      URL.revokeObjectURL(url);
+    } catch {
+      toast({
+        title: t('common.error'),
+        description: t('results.icsExportError'),
+        variant: "destructive",
+      });
+    }
+  };
 
   const handleEditCapacity = (optionId: number, currentCapacity: number | null | undefined) => {
     setEditingCapacity(optionId);
@@ -177,24 +273,30 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
       <div className="flex items-center justify-between">
         <div>
           <h2 className="text-2xl font-semibold text-foreground">
-            {isOrganization ? 'Eintragungen' : 'Ergebnisse'}
+            {isOrganization ? t('results.entries') : t('results.resultsTitle')}
           </h2>
           <p className="text-muted-foreground">
             {isOrganization 
-              ? `${participantCount} ${participantCount === 1 ? 'Person hat' : 'Personen haben'} sich eingetragen`
-              : `${participantCount} ${participantCount === 1 ? 'Person hat' : 'Personen haben'} abgestimmt`
+              ? (participantCount === 1 ? t('results.personSignedUpSingular', { count: participantCount }) : t('results.personSignedUpPlural', { count: participantCount }))
+              : (participantCount === 1 ? t('results.personVotedSingular', { count: participantCount }) : t('results.personVotedPlural', { count: participantCount }))
             }
           </p>
         </div>
         <div className="flex space-x-3">
           <Button variant="outline" onClick={handleExportCSV}>
             <FileText className="w-4 h-4 mr-2" />
-            CSV Export
+            {t('results.csvExport')}
           </Button>
           <Button variant="outline" onClick={handleExportPDF}>
             <Download className="w-4 h-4 mr-2" />
-            PDF Export
+            {t('results.pdfExport')}
           </Button>
+          {isSchedule && isFinalized && (
+            <Button variant="outline" onClick={handleExportICS}>
+              <CalendarCheck className="w-4 h-4 mr-2" />
+              {t('results.icsExport')}
+            </Button>
+          )}
         </div>
       </div>
 
@@ -203,26 +305,26 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
         <CardContent className="p-6">
           <div className="flex items-center justify-between mb-2">
             <span className="text-sm font-medium text-foreground">
-              {isOrganization ? 'Gesamte Eintragungen' : 'Gesamte Abstimmungen'}
+              {isOrganization ? t('results.totalEntries') : t('results.totalVotes')}
             </span>
             <span className="text-sm font-medium text-foreground">
               {isOrganization 
-                ? `${results.votes.length} ${results.votes.length === 1 ? 'Eintragung' : 'Eintragungen'}`
-                : `${participantCount} ${participantCount === 1 ? 'Stimme' : 'Stimmen'}`
+                ? `${results.votes.length} ${results.votes.length === 1 ? t('results.entrySingular') : t('results.entriesPlural')}`
+                : `${participantCount} ${participantCount === 1 ? t('results.voteSingular') : t('results.votesPlural')}`
               }
             </span>
           </div>
           <div className="flex items-center space-x-4 mt-4">
             <div className="flex items-center space-x-2">
               <Users className="w-4 h-4 text-polly-blue" />
-              <span className="text-sm text-muted-foreground">Teilnehmer: {participantCount}</span>
+              <span className="text-sm text-muted-foreground">{t('results.participantsLabel', { count: participantCount })}</span>
             </div>
             <div className="flex items-center space-x-2">
               <Check className="w-4 h-4 text-green-600" />
               <span className="text-sm text-muted-foreground">
                 {isOrganization 
-                  ? `Gesamte Eintragungen: ${results.votes.length}`
-                  : `Gesamte Stimmen: ${results.votes.length}`
+                  ? t('results.totalEntriesCount', { count: results.votes.length })
+                  : t('results.totalVotesCount', { count: results.votes.length })
                 }
               </span>
             </div>
@@ -230,6 +332,60 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
         </CardContent>
       </Card>
 
+      {/* Finalized Option Banner */}
+      {isFinalized && (() => {
+        const finalOption = options.find(opt => opt.id === poll.finalOptionId);
+        if (!finalOption) return null;
+        return (
+          <Card className="border-2 border-green-500 bg-green-50 dark:bg-green-950/30 dark:border-green-600">
+            <CardContent className="p-6">
+              <div className="flex items-center justify-between">
+                <div className="flex items-center space-x-3">
+                  <Lock className="w-5 h-5 text-green-600 dark:text-green-400" />
+                  <div>
+                    <h3 className="font-semibold text-green-900 dark:text-green-100">
+                      {isSchedule ? t('resultsChart.confirmedDate') : t('resultsChart.confirmedResult')}
+                    </h3>
+                    <p className="text-sm text-green-700 dark:text-green-300 mt-1">
+                      <FormattedOptionText text={finalOption.text} startTime={finalOption.startTime} locale={i18n.language} />
+                    </p>
+                    {poll.videoConferenceUrl && (
+                      <p className="text-sm text-green-600 dark:text-green-400 mt-1">
+                        <Video className="w-3 h-3 inline mr-1" />
+                        <a href={poll.videoConferenceUrl} target="_blank" rel="noopener noreferrer" className="underline hover:text-green-800 dark:hover:text-green-200">
+                          {t('resultsChart.videoConferenceLink')}
+                          <ExternalLink className="w-3 h-3 inline ml-1" />
+                        </a>
+                      </p>
+                    )}
+                  </div>
+                </div>
+                <div className="flex items-center space-x-2">
+                  {isSchedule && (
+                    <Button variant="outline" size="sm" onClick={handleExportICS} className="border-green-500 text-green-700 hover:bg-green-100 dark:text-green-300 dark:hover:bg-green-900">
+                      <CalendarCheck className="w-4 h-4 mr-1" />
+                      {t('results.icsExport')}
+                    </Button>
+                  )}
+                  {(isAdminAccess || isOwner) && adminToken && (
+                    <Button 
+                      variant="outline" 
+                      size="sm" 
+                      onClick={handleUnfinalize}
+                      disabled={isFinalizingOption !== null}
+                      className="border-orange-400 text-orange-700 hover:bg-orange-50 dark:text-orange-300 dark:hover:bg-orange-900"
+                    >
+                      {isFinalizingOption === 0 ? <Loader2 className="w-4 h-4 mr-1 animate-spin" /> : <Unlock className="w-4 h-4 mr-1" />}
+                      {t('resultsChart.undoConfirmation')}
+                    </Button>
+                  )}
+                </div>
+              </div>
+            </CardContent>
+          </Card>
+        );
+      })()}
+
       {/* Best Option Highlight */}
       {bestOptionData && (
         <Card className={`${
@@ -240,17 +396,17 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
           <CardContent className="p-6">
             <div className="flex items-center space-x-3 mb-2">
               <Crown className={poll.type === 'schedule' ? 'w-5 h-5 text-orange-600 dark:text-orange-400' : 'w-5 h-5 text-teal-600 dark:text-teal-400'} />
-              <h3 className="font-semibold text-gray-900 dark:text-gray-100">Beliebteste Option</h3>
+              <h3 className="font-semibold text-gray-900 dark:text-gray-100">{t('results.bestOption')}</h3>
               <Badge className={
                 poll.type === 'schedule' ? 'polly-badge-schedule-solid' : 
                 poll.type === 'organization' ? 'polly-badge-organization-solid' :
                 'polly-badge-survey-solid'
               }>
-                {bestOption.score} Punkte
+                {t('results.points', { count: bestOption.score })}
               </Badge>
             </div>
             <p className="text-sm text-gray-600 dark:text-gray-300 mb-3">
-              Bewertung: Ja = 2 Punkte, Vielleicht = 1 Punkt, Nein = 0 Punkte
+              {t('results.scoringDescription')}
             </p>
             <div className="flex items-center space-x-3 mb-2">
               {bestOptionData.imageUrl && (
@@ -274,23 +430,59 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
             {bestOptionData.startTime && bestOptionData.endTime && (
               <div className="flex items-center text-sm text-gray-700 dark:text-gray-300">
                 <Calendar className="w-4 h-4 mr-1" />
-                {new Date(bestOptionData.startTime).toLocaleDateString('de-DE')}
+                {new Date(bestOptionData.startTime).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')}
                 <Clock className="w-4 h-4 ml-3 mr-1" />
-                {new Date(bestOptionData.startTime).toLocaleTimeString('de-DE', { 
+                {new Date(bestOptionData.startTime).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                   hour: '2-digit', 
                   minute: '2-digit' 
-                })} - {new Date(bestOptionData.endTime).toLocaleTimeString('de-DE', { 
+                })} - {new Date(bestOptionData.endTime).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                   hour: '2-digit', 
                   minute: '2-digit' 
                 })}
               </div>
             )}
+            {poll.videoConferenceUrl && (
+              <div className="flex items-center text-sm text-gray-700 dark:text-gray-300 mt-1">
+                <Video className="w-4 h-4 mr-1" />
+                <a href={poll.videoConferenceUrl} target="_blank" rel="noopener noreferrer" className="underline hover:text-gray-900 dark:hover:text-gray-100">
+                  {t('resultsChart.videoConferenceLink')}
+                  <ExternalLink className="w-3 h-3 inline ml-1" />
+                </a>
+              </div>
+            )}
+            {(isAdminAccess || isOwner) && adminToken && (
+              <div className="mt-3 pt-3 border-t border-orange-200 dark:border-orange-800">
+                {isFinalized && poll.finalOptionId === bestOptionData.id ? (
+                  <Badge className="bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200">
+                    <Lock className="w-3 h-3 mr-1" />
+                    {t('resultsChart.confirmed')}
+                  </Badge>
+                ) : !isFinalized ? (
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    onClick={() => setConfirmDialogOptionId(bestOptionData.id)}
+                    disabled={isFinalizingOption !== null}
+                    className={poll.type === 'schedule' 
+                      ? 'border-orange-500 text-orange-700 hover:bg-orange-100 dark:border-orange-600 dark:text-orange-400 dark:hover:bg-orange-950' 
+                      : 'border-teal-500 text-teal-700 hover:bg-teal-100 dark:border-teal-600 dark:text-teal-400 dark:hover:bg-teal-950'}
+                  >
+                    {isFinalizingOption === bestOptionData.id ? (
+                      <Loader2 className="w-4 h-4 mr-1 animate-spin" />
+                    ) : (
+                      <CalendarCheck className="w-4 h-4 mr-1" />
+                    )}
+                    {isSchedule ? t('resultsChart.confirmDate') : t('resultsChart.setResult')}
+                  </Button>
+                ) : null}
+              </div>
+            )}
           </CardContent>
         </Card>
       )}
 
-      {/* Matrix View - Participants as rows, Options as columns */}
-      {!isOrganization && participants.length > 0 && (
+      {/* Matrix View - Participants as rows, Options as columns (only non-freetext options) */}
+      {!isOrganization && participants.length > 0 && options.filter((o: any) => !o.isFreeText).length > 0 && (
         <Card className="polly-card">
           <CardHeader>
             <CardTitle className="flex items-center">
@@ -306,7 +498,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                     <th className="text-right py-2 px-3 font-medium text-foreground border-b border-border min-w-[150px]">
                       {t('voting.participant')}
                     </th>
-                    {options.map((option) => {
+                    {options.filter((o: any) => !o.isFreeText).map((option) => {
                       const isSchedule = poll.type === 'schedule' && option.startTime && option.endTime;
                       return (
                         <th 
@@ -316,17 +508,17 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                           {isSchedule ? (
                             <div className="flex flex-col items-center text-xs">
                               <span className="font-semibold">
-                                {new Date(option.startTime!).toLocaleDateString('de-DE', { 
+                                {new Date(option.startTime!).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                   weekday: 'short',
                                   day: '2-digit',
                                   month: '2-digit'
                                 })}
                               </span>
                               <span className="text-muted-foreground">
-                                {new Date(option.startTime!).toLocaleTimeString('de-DE', { 
+                                {new Date(option.startTime!).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                   hour: '2-digit', 
                                   minute: '2-digit' 
-                                })} - {new Date(option.endTime!).toLocaleTimeString('de-DE', { 
+                                })} - {new Date(option.endTime!).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                   hour: '2-digit', 
                                   minute: '2-digit' 
                                 })}
@@ -350,7 +542,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                       <td className="text-right py-2 px-3 font-medium text-foreground border-r border-border">
                         {participant.name}
                       </td>
-                      {options.map((option) => {
+                      {options.filter((o: any) => !o.isFreeText).map((option) => {
                         const vote = participant.votes.find((v: any) => v.optionId === option.id);
                         const response = vote?.response;
                         
@@ -387,7 +579,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                     <td className="text-right py-2 px-3 text-sm text-muted-foreground">
                       {t('results.total')}
                     </td>
-                    {options.map((option) => {
+                    {options.filter((o: any) => !o.isFreeText).map((option) => {
                       const stat = stats.find(s => s.optionId === option.id);
                       const yesCount = stat?.yesCount || 0;
                       return (
@@ -407,6 +599,45 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
         </Card>
       )}
 
+      {/* Free-text answers section for survey polls */}
+      {poll.type === 'survey' && options.some((o: any) => o.isFreeText) && (
+        <div className="space-y-4">
+          {options.filter((o: any) => o.isFreeText).map((option: any) => {
+            const answers = results.votes
+              .filter((v: any) => v.optionId === option.id && v.response === 'freetext' && v.freeTextAnswer)
+              .map((v: any) => ({ name: v.voterName, text: v.freeTextAnswer as string }));
+            return (
+              <Card key={option.id} className="polly-card border-l-4 border-l-primary/40">
+                <CardHeader className="pb-2">
+                  <CardTitle className="flex items-center text-base">
+                    <MessageSquare className="w-4 h-4 mr-2 text-primary/70" />
+                    {option.text}
+                  </CardTitle>
+                  <p className="text-xs text-muted-foreground">{t('results.openAnswers')} · {answers.length} {answers.length === 1 ? t('voting.participant') : t('polls.participants')}</p>
+                </CardHeader>
+                <CardContent>
+                  {answers.length === 0 ? (
+                    <p className="text-sm text-muted-foreground italic">{t('results.noAnswersYet')}</p>
+                  ) : (
+                    <ol className="space-y-2">
+                      {answers.map((a, i) => (
+                        <li key={i} className="text-sm bg-muted/30 rounded-lg px-4 py-2">
+                          <span className="font-medium text-foreground/70 text-xs mr-2">{i + 1}.</span>
+                          {poll.resultsPublic && (
+                            <span className="text-xs text-muted-foreground mr-2">[{a.name}]</span>
+                          )}
+                          {a.text}
+                        </li>
+                      ))}
+                    </ol>
+                  )}
+                </CardContent>
+              </Card>
+            );
+          })}
+        </div>
+      )}
+
       {/* Matrix View for Organization Polls - Participants as rows, Slots as columns */}
       {isOrganization && options.length > 0 && (
         <Card className="polly-card">
@@ -439,16 +670,16 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                             <span className="font-semibold"><FormattedOptionText text={option.text} startTime={option.startTime} locale={i18n.language} /></span>
                             {option.startTime && option.endTime && (
                               <span className="text-muted-foreground">
-                                {new Date(option.startTime).toLocaleDateString('de-DE', { 
+                                {new Date(option.startTime).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                   weekday: 'short',
                                   day: '2-digit',
                                   month: '2-digit'
                                 })}
                                 <br />
-                                {new Date(option.startTime).toLocaleTimeString('de-DE', { 
+                                {new Date(option.startTime).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                   hour: '2-digit', 
                                   minute: '2-digit' 
-                                })} - {new Date(option.endTime).toLocaleTimeString('de-DE', { 
+                                })} - {new Date(option.endTime).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                   hour: '2-digit', 
                                   minute: '2-digit' 
                                 })}
@@ -508,7 +739,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                   ) : (
                     <tr>
                       <td colSpan={options.length + 1} className="py-4 text-center text-muted-foreground text-sm italic">
-                        Noch keine Eintragungen vorhanden
+                        {t('results.noEntriesYet')}
                       </td>
                     </tr>
                   )}
@@ -516,7 +747,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                 <tfoot>
                   <tr className="border-t-2 border-border font-medium">
                     <td className="text-left py-2 px-3 text-sm text-muted-foreground">
-                      Gesamt
+                      {t('results.total')}
                     </td>
                     {options.map((option) => {
                       const slotVotes = results.votes.filter(v => v.optionId === option.id && v.response === 'yes');
@@ -541,7 +772,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
       {isOrganization ? (
         <Card className="polly-card">
           <CardHeader>
-            <CardTitle>Slots und Eintragungen</CardTitle>
+            <CardTitle>{t('results.slotsAndEntries')}</CardTitle>
           </CardHeader>
           <CardContent>
             <div className="space-y-4">
@@ -646,7 +877,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                           <>
                             <Badge className={isFull ? "bg-red-100 text-red-900" : "bg-green-100 text-green-900"}>
                               {signupCount} / {capacity || '∞'}
-                              {isFull && <span className="ml-1">voll</span>}
+                              {isFull && <span className="ml-1">{t('results.full')}</span>}
                             </Badge>
                             {isAdminAccess && onCapacityUpdate && (
                               <Button
@@ -688,7 +919,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                         ))}
                       </div>
                     ) : (
-                      <p className="text-sm text-muted-foreground italic">{t('organizationSlot.noEntries', 'Noch keine Eintragungen')}</p>
+                      <p className="text-sm text-muted-foreground italic">{t('results.noEntriesYet')}</p>
                     )}
                   </div>
                 );
@@ -699,7 +930,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
       ) : (
         <Card className="polly-card">
           <CardHeader>
-            <CardTitle>Detaillierte Ergebnisse</CardTitle>
+            <CardTitle>{t('results.detailedResults')}</CardTitle>
           </CardHeader>
           <CardContent>
             <div className="overflow-x-auto">
@@ -707,34 +938,39 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                 <thead>
                   <tr className="border-b border-border">
                     <th className="text-left py-3 px-4 font-medium text-foreground">
-                      Option
+                      {t('results.option')}
                     </th>
                     <th className="text-center py-3 px-4 font-medium text-foreground w-24">
                       <div className="flex items-center justify-center space-x-1">
                         <Check className="w-4 h-4 text-green-600" />
-                        <span>Ja</span>
+                        <span>{t('voting.yes')}</span>
                       </div>
                     </th>
                     <th className="text-center py-3 px-4 font-medium text-foreground w-24">
                       <div className="flex items-center justify-center space-x-1">
                         <HelpCircle className="w-4 h-4 text-yellow-600" />
-                        <span>Vielleicht</span>
+                        <span>{t('voting.maybe')}</span>
                       </div>
                     </th>
                     <th className="text-center py-3 px-4 font-medium text-foreground w-24">
                       <div className="flex items-center justify-center space-x-1">
                         <X className="w-4 h-4 text-red-600" />
-                        <span>Nein</span>
+                        <span>{t('voting.no')}</span>
                       </div>
                     </th>
                     <th className="text-center py-3 px-4 font-medium text-foreground w-32">
                       <div className="flex flex-col items-center">
-                        <span>Punkte</span>
+                        <span>{t('results.pointsHeader')}</span>
                         <span className="text-xs text-muted-foreground font-normal">
-                          (Ja=2, Vielleicht=1, Nein=0)
+                          ({t('voting.yes')}=2, {t('voting.maybe')}=1, {t('voting.no')}=0)
                         </span>
                       </div>
                     </th>
+                    {(isAdminAccess || isOwner) && adminToken && (
+                      <th className="text-center py-3 px-4 font-medium text-foreground w-36">
+                        {isSchedule ? t('resultsChart.confirmColumn') : t('resultsChart.setResultColumn')}
+                      </th>
+                    )}
                   </tr>
                 </thead>
                 <tbody className="divide-y divide-border">
@@ -746,9 +982,10 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                     const yesPercent = total > 0 ? (stat.yesCount / total) * 100 : 0;
                     const maybePercent = total > 0 ? (stat.maybeCount / total) * 100 : 0;
                     const noPercent = total > 0 ? (stat.noCount / total) * 100 : 0;
+                    const isFinalOption = isFinalized && poll.finalOptionId === stat.optionId;
 
                     return (
-                      <tr key={stat.optionId} className="hover:bg-muted/50">
+                      <tr key={stat.optionId} className={isFinalOption ? "bg-green-50 dark:bg-green-950/20 border-l-4 border-l-green-500" : "hover:bg-muted/50"}>
                         <td className="py-4 px-4">
                           <div className="flex items-center space-x-3">
                             {/* Show image if available */}
@@ -772,11 +1009,11 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                               </div>
                               {option.startTime && option.endTime && (
                                 <div className="text-sm text-muted-foreground mt-1">
-                                  {new Date(option.startTime).toLocaleDateString('de-DE')} • {' '}
-                                  {new Date(option.startTime).toLocaleTimeString('de-DE', { 
+                                  {new Date(option.startTime).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')} • {' '}
+                                  {new Date(option.startTime).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                     hour: '2-digit', 
                                     minute: '2-digit' 
-                                  })} - {new Date(option.endTime).toLocaleTimeString('de-DE', { 
+                                  })} - {new Date(option.endTime).toLocaleTimeString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                                     hour: '2-digit', 
                                     minute: '2-digit' 
                                   })}
@@ -842,6 +1079,31 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                             )}
                           </div>
                         </td>
+                        {(isAdminAccess || isOwner) && adminToken && (
+                          <td className="py-4 px-4 text-center">
+                            {isFinalOption ? (
+                              <Badge className="bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200">
+                                <Lock className="w-3 h-3 mr-1" />
+                                {t('resultsChart.confirmed')}
+                              </Badge>
+                            ) : (
+                              <Button
+                                variant="outline"
+                                size="sm"
+                                onClick={() => setConfirmDialogOptionId(stat.optionId)}
+                                disabled={isFinalizingOption !== null}
+                                className="text-xs"
+                              >
+                                {isFinalizingOption === stat.optionId ? (
+                                  <Loader2 className="w-3 h-3 mr-1 animate-spin" />
+                                ) : (
+                                  <CalendarCheck className="w-3 h-3 mr-1" />
+                                )}
+                                {isSchedule ? t('resultsChart.confirmDate') : t('resultsChart.setResult')}
+                              </Button>
+                            )}
+                          </td>
+                        )}
                       </tr>
                     );
                   })}
@@ -970,7 +1232,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                     }}>
                       <span style={{ fontSize: '24px', color: '#10b981' }}>✓</span>
                       <span style={{ fontSize: '18px', fontWeight: '700', color: 'white' }}>{currentStat.yesCount}</span>
-                      <span style={{ fontSize: '14px', fontWeight: '500', color: '#10b981' }}>Ja</span>
+                      <span style={{ fontSize: '14px', fontWeight: '500', color: '#10b981' }}>{t('voting.yes')}</span>
                     </div>
                     
                     {/* Vielleicht Button Style */}
@@ -987,7 +1249,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                     }}>
                       <span style={{ fontSize: '24px', color: '#f59e0b' }}>~</span>
                       <span style={{ fontSize: '18px', fontWeight: '700', color: 'white' }}>{currentStat.maybeCount}</span>
-                      <span style={{ fontSize: '14px', fontWeight: '500', color: '#f59e0b' }}>Vielleicht</span>
+                      <span style={{ fontSize: '14px', fontWeight: '500', color: '#f59e0b' }}>{t('voting.maybe')}</span>
                     </div>
                     
                     {/* Nein Button Style */}
@@ -1004,7 +1266,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                     }}>
                       <span style={{ fontSize: '24px', color: '#ef4444' }}>✗</span>
                       <span style={{ fontSize: '18px', fontWeight: '700', color: 'white' }}>{currentStat.noCount}</span>
-                      <span style={{ fontSize: '14px', fontWeight: '500', color: '#ef4444' }}>Nein</span>
+                      <span style={{ fontSize: '14px', fontWeight: '500', color: '#ef4444' }}>{t('voting.no')}</span>
                     </div>
                   </div>
                   
@@ -1018,7 +1280,7 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
                     borderRadius: '8px'
                   }}>
                     <span style={{ fontSize: '16px', fontWeight: '600', color: '#fbbf24' }}>
-                      Punkte: {currentStat.score}
+                      {t('results.pointsLabel', { count: currentStat.score })}
                     </span>
                   </div>
                 </div>
@@ -1032,6 +1294,65 @@ export function ResultsChart({ results, publicToken, isAdminAccess = false, onCa
           },
         }}
       />
+
+      <AlertDialog open={confirmDialogOptionId !== null} onOpenChange={(open) => { if (!open) setConfirmDialogOptionId(null); }}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>{isSchedule ? t('resultsChart.confirmDialogTitle') : t('resultsChart.confirmResultDialogTitle')}</AlertDialogTitle>
+            <AlertDialogDescription asChild>
+              <div className="space-y-3">
+                <p>
+                  {(() => {
+                    if (confirmDialogOptionId === null) return '';
+                    const opt = options.find(o => o.id === confirmDialogOptionId);
+                    if (!opt) return '';
+                    const localeCode = i18n.language === 'de' ? 'de-DE' : 'en-US';
+                    const dateStr = opt.startTime ? new Date(opt.startTime).toLocaleDateString(localeCode, { weekday: 'long', day: '2-digit', month: 'long', year: 'numeric' }) : opt.text;
+                    const timeStr = opt.startTime && opt.endTime 
+                      ? `${new Date(opt.startTime).toLocaleTimeString(localeCode, { hour: '2-digit', minute: '2-digit' })} – ${new Date(opt.endTime).toLocaleTimeString(localeCode, { hour: '2-digit', minute: '2-digit' })}`
+                      : '';
+                    return isSchedule 
+                      ? t('resultsChart.confirmDialogDescription', { date: dateStr, time: timeStr })
+                      : t('resultsChart.confirmResultDialogDescription', { option: opt.text });
+                  })()}
+                </p>
+                <div className="space-y-2 pt-2 border-t">
+                  <label className="flex items-center gap-2 cursor-pointer text-sm">
+                    <input
+                      type="checkbox"
+                      checked={finalizeClosePoll}
+                      onChange={(e) => setFinalizeClosePoll(e.target.checked)}
+                      className="rounded border-gray-300 w-4 h-4 accent-primary"
+                    />
+                    <Lock className="w-3.5 h-3.5 text-muted-foreground" />
+                    <span>{t('resultsChart.closePollOption')}</span>
+                  </label>
+                  <label className="flex items-center gap-2 cursor-pointer text-sm">
+                    <input
+                      type="checkbox"
+                      checked={finalizeNotify}
+                      onChange={(e) => setFinalizeNotify(e.target.checked)}
+                      className="rounded border-gray-300 w-4 h-4 accent-primary"
+                    />
+                    <Mail className="w-3.5 h-3.5 text-muted-foreground" />
+                    <span>{t('resultsChart.notifyParticipantsOption')}</span>
+                  </label>
+                </div>
+              </div>
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>{t('common.cancel')}</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={() => { if (confirmDialogOptionId !== null) handleFinalize(confirmDialogOptionId); }}
+              disabled={isFinalizingOption !== null}
+            >
+              {isFinalizingOption !== null ? <Loader2 className="w-4 h-4 mr-1 animate-spin" /> : <CalendarCheck className="w-4 h-4 mr-1" />}
+              {isSchedule ? t('resultsChart.confirmDate') : t('resultsChart.setResult')}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
     </div>
   );
 }
diff --git a/client/src/components/SimpleImageVoting.tsx b/client/src/components/SimpleImageVoting.tsx
index 63acb6fa..369503d0 100644
--- a/client/src/components/SimpleImageVoting.tsx
+++ b/client/src/components/SimpleImageVoting.tsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import Lightbox from "yet-another-react-lightbox";
 import "yet-another-react-lightbox/styles.css";
@@ -16,6 +16,15 @@ function FormattedOptionText({ text, startTime, locale = 'en' }: { text: string;
   return <>{text}</>;
 }
 
+function TimeOnlyText({ text, startTime, locale = 'en' }: { text: string; startTime?: Date | string | null; locale?: string }) {
+  const startTimeStr = startTime instanceof Date ? startTime.toISOString() : startTime;
+  const formatted = formatScheduleOptionWithWeekday(text, startTimeStr, locale);
+  if (formatted.isSchedule && formatted.time) {
+    return <>{formatted.time}</>;
+  }
+  return <>{text}</>;
+}
+
 interface SimpleImageVotingProps {
   options: PollOption[];
   onVote: (optionId: string, response: 'yes' | 'no' | 'maybe') => void;
@@ -25,6 +34,141 @@ interface SimpleImageVotingProps {
   allowMaybe?: boolean;
 }
 
+interface DayGroup {
+  dateKey: string;
+  dateLabel: string;
+  options: PollOption[];
+}
+
+function getDateSortKey(option: PollOption): string {
+  if (option.startTime) {
+    const d = new Date(option.startTime);
+    if (!isNaN(d.getTime())) {
+      return d.toISOString();
+    }
+  }
+  const match = option.text.match(/^(\d{1,2})\.(\d{1,2})\.?(\d{2,4})?\s*/);
+  if (match) {
+    const day = match[1].padStart(2, '0');
+    const month = match[2].padStart(2, '0');
+    const year = match[3] || new Date().getFullYear().toString();
+    const fullYear = year.length === 2 ? `20${year}` : year;
+    const timePart = option.text.replace(match[0], '').trim();
+    const timeMatch = timePart.match(/^(\d{1,2}):(\d{2})/);
+    const time = timeMatch ? `${timeMatch[1].padStart(2, '0')}:${timeMatch[2]}` : '00:00';
+    return `${fullYear}-${month}-${day}T${time}`;
+  }
+  return '9999-99-99';
+}
+
+function getDateKey(option: PollOption): string {
+  if (option.startTime) {
+    const d = new Date(option.startTime);
+    if (!isNaN(d.getTime())) {
+      return `${d.getFullYear()}-${(d.getMonth() + 1).toString().padStart(2, '0')}-${d.getDate().toString().padStart(2, '0')}`;
+    }
+  }
+  const match = option.text.match(/^(\d{1,2})\.(\d{1,2})\.?(\d{2,4})?\s*/);
+  if (match) {
+    const day = match[1].padStart(2, '0');
+    const month = match[2].padStart(2, '0');
+    const year = match[3] || new Date().getFullYear().toString();
+    const fullYear = year.length === 2 ? `20${year}` : year;
+    return `${fullYear}-${month}-${day}`;
+  }
+  return '';
+}
+
+function getDateLabel(option: PollOption, locale: string): string {
+  const startTimeStr = option.startTime instanceof Date ? option.startTime.toISOString() : option.startTime;
+  const formatted = formatScheduleOptionWithWeekday(option.text, startTimeStr, locale);
+  if (formatted.isSchedule) {
+    return formatted.dateWithWeekday;
+  }
+  return option.text;
+}
+
+function groupByDay(options: PollOption[], locale: string): DayGroup[] {
+  const sorted = [...options].sort((a, b) => getDateSortKey(a).localeCompare(getDateSortKey(b)));
+
+  const groups: DayGroup[] = [];
+  let currentKey = '';
+  let currentGroup: DayGroup | null = null;
+
+  for (const opt of sorted) {
+    const key = getDateKey(opt);
+    if (key && key !== currentKey) {
+      currentKey = key;
+      currentGroup = { dateKey: key, dateLabel: getDateLabel(opt, locale), options: [] };
+      groups.push(currentGroup);
+    }
+    if (currentGroup && key) {
+      currentGroup.options.push(opt);
+    } else {
+      const noDateGroup = groups.find(g => g.dateKey === '');
+      if (noDateGroup) {
+        noDateGroup.options.push(opt);
+      } else {
+        groups.push({ dateKey: '', dateLabel: '', options: [opt] });
+      }
+    }
+  }
+
+  return groups;
+}
+
+function VoteButtons({ 
+  optionId, currentVote, allowMaybe, disabled, onVote, t, testIdSuffix 
+}: { 
+  optionId: string | number; 
+  currentVote?: 'yes' | 'no' | 'maybe'; 
+  allowMaybe: boolean; 
+  disabled: boolean; 
+  onVote: (id: string | number, response: 'yes' | 'no' | 'maybe') => void; 
+  t: (key: string) => string;
+  testIdSuffix: string;
+}) {
+  return (
+    <div className="flex gap-1.5">
+      <Button
+        className={`px-3 py-1.5 text-xs ${currentVote === 'yes' ? 'bg-green-600 hover:bg-green-700 text-white' : 'border-green-600 text-green-600 hover:bg-green-50 dark:hover:bg-green-950'}`}
+        variant={currentVote === 'yes' ? 'default' : 'outline'}
+        size="sm"
+        onClick={() => onVote(optionId, 'yes')}
+        disabled={disabled}
+        data-testid={`vote-yes-${testIdSuffix}`}
+      >
+        <Check className="w-3.5 h-3.5 mr-0.5" />
+        {t('voting.yes')}
+      </Button>
+      {allowMaybe && (
+        <Button
+          className={`px-3 py-1.5 text-xs ${currentVote === 'maybe' ? 'bg-yellow-500 hover:bg-yellow-600 text-black' : 'border-yellow-500 text-yellow-600 hover:bg-yellow-50 dark:hover:bg-yellow-950'}`}
+          variant={currentVote === 'maybe' ? 'default' : 'outline'}
+          size="sm"
+          onClick={() => onVote(optionId, 'maybe')}
+          disabled={disabled}
+          data-testid={`vote-maybe-${testIdSuffix}`}
+        >
+          <Minus className="w-3.5 h-3.5 mr-0.5" />
+          {t('voting.maybe')}
+        </Button>
+      )}
+      <Button
+        className={`px-3 py-1.5 text-xs ${currentVote === 'no' ? 'bg-red-600 hover:bg-red-700 text-white' : 'border-red-600 text-red-600 hover:bg-red-50 dark:hover:bg-red-950'}`}
+        variant={currentVote === 'no' ? 'default' : 'outline'}
+        size="sm"
+        onClick={() => onVote(optionId, 'no')}
+        disabled={disabled}
+        data-testid={`vote-no-${testIdSuffix}`}
+      >
+        <X className="w-3.5 h-3.5 mr-0.5" />
+        {t('voting.no')}
+      </Button>
+    </div>
+  );
+}
+
 export function SimpleImageVoting({ 
   options, 
   onVote, 
@@ -33,17 +177,24 @@ export function SimpleImageVoting({
   adminPreview = false,
   allowMaybe = true
 }: SimpleImageVotingProps) {
-  const { i18n } = useTranslation();
+  const { t, i18n } = useTranslation();
   const [votes, setVotes] = useState<Record<string, 'yes' | 'no' | 'maybe'>>(existingVotes);
   const [lightboxOpen, setLightboxOpen] = useState(false);
   const [lightboxIndex, setLightboxIndex] = useState(0);
 
-  // Filter options that have images
   const imageOptions = options.filter(option => option.imageUrl && option.imageUrl.trim());
   const textOptions = options.filter(option => !option.imageUrl || !option.imageUrl.trim());
   const hasImages = imageOptions.length > 0;
 
-  // Create slides for lightbox
+  const isSchedulePoll = useMemo(() => {
+    return textOptions.some(opt => opt.startTime || /^\d{1,2}\.\d{1,2}\./.test(opt.text));
+  }, [textOptions]);
+
+  const dayGroups = useMemo(() => {
+    if (!isSchedulePoll) return null;
+    return groupByDay(textOptions, i18n.language);
+  }, [textOptions, isSchedulePoll, i18n.language]);
+
   const slides = imageOptions.map(option => ({
     src: option.imageUrl || '',
     alt: option.altText || option.text,
@@ -51,7 +202,6 @@ export function SimpleImageVoting({
     height: 900
   }));
 
-  // Update votes when external votes change
   useEffect(() => {
     setVotes(existingVotes);
   }, [existingVotes]);
@@ -67,21 +217,17 @@ export function SimpleImageVoting({
     setLightboxOpen(true);
   };
 
-  // Update lightbox when votes change
   useEffect(() => {
-    // Force re-render of lightbox when votes change
     if (lightboxOpen) {
-      // The lightbox will automatically re-render due to state change
     }
   }, [votes, lightboxOpen]);
 
   if (!hasImages && textOptions.length === 0) {
-    return <div>No options available</div>;
+    return <div>{t('voting.noOptionsAvailable')}</div>;
   }
 
   return (
     <div className="space-y-6">
-      {/* Image grid with voting buttons */}
       {hasImages && (
         <div className="grid grid-cols-1 md:grid-cols-2 gap-6">
           {imageOptions.map((option, index) => {
@@ -99,10 +245,9 @@ export function SimpleImageVoting({
                   />
                   <div className="absolute inset-0 bg-black bg-opacity-0 hover:bg-opacity-10 transition-all duration-200 flex items-center justify-center">
                     <div className="text-white font-medium text-sm bg-black bg-opacity-50 px-3 py-1 rounded opacity-0 hover:opacity-100 transition-opacity">
-                      Click to enlarge
+                      {t('voting.clickToEnlarge')}
                     </div>
                   </div>
-                  {/* Vote indicator */}
                   {currentVote && (
                     <div className="absolute top-2 right-2">
                       <div className={`px-2 py-1 rounded text-xs font-medium ${
@@ -110,20 +255,19 @@ export function SimpleImageVoting({
                         currentVote === 'maybe' ? 'bg-yellow-500 text-black' :
                         'bg-red-600 text-white'
                       }`}>
-                        {currentVote === 'yes' ? 'Ja' :
-                         currentVote === 'maybe' ? 'Vielleicht' : 'Nein'}
+                        {currentVote === 'yes' ? t('voting.yes') :
+                         currentVote === 'maybe' ? t('voting.maybe') : t('voting.no')}
                       </div>
                     </div>
                   )}
                 </div>
                 
-                {/* Title and voting buttons below each image */}
                 <div className="text-center">
                   <h4 className="font-medium text-lg mb-3"><FormattedOptionText text={option.text} startTime={option.startTime} locale={i18n.language} /></h4>
                   {!adminPreview && (
                     <div className="flex gap-2">
                       <Button
-                        className={`flex-1 py-2 ${currentVote === 'yes' ? 'bg-green-600 hover:bg-green-700 text-white' : 'border-green-600 text-green-600 hover:bg-green-50'}`}
+                        className={`flex-1 py-2 ${currentVote === 'yes' ? 'bg-green-600 hover:bg-green-700 text-white' : 'border-green-600 text-green-600 hover:bg-green-50 dark:hover:bg-green-950'}`}
                         variant={currentVote === 'yes' ? 'default' : 'outline'}
                         size="sm"
                         onClick={() => handleVoteClick(option.id, 'yes')}
@@ -131,11 +275,11 @@ export function SimpleImageVoting({
                         data-testid={`vote-yes-${index}`}
                       >
                         <Check className="w-4 h-4 mr-1" />
-                        Ja
+                        {t('voting.yes')}
                       </Button>
                       {allowMaybe && (
                         <Button
-                          className={`flex-1 py-2 ${currentVote === 'maybe' ? 'bg-yellow-500 hover:bg-yellow-600 text-black' : 'border-yellow-500 text-yellow-600 hover:bg-yellow-50'}`}
+                          className={`flex-1 py-2 ${currentVote === 'maybe' ? 'bg-yellow-500 hover:bg-yellow-600 text-black' : 'border-yellow-500 text-yellow-600 hover:bg-yellow-50 dark:hover:bg-yellow-950'}`}
                           variant={currentVote === 'maybe' ? 'default' : 'outline'}
                           size="sm"
                           onClick={() => handleVoteClick(option.id, 'maybe')}
@@ -143,11 +287,11 @@ export function SimpleImageVoting({
                           data-testid={`vote-maybe-${index}`}
                         >
                           <Minus className="w-4 h-4 mr-1" />
-                          Vielleicht
+                          {t('voting.maybe')}
                         </Button>
                       )}
                       <Button
-                        className={`flex-1 py-2 ${currentVote === 'no' ? 'bg-red-600 hover:bg-red-700 text-white' : 'border-red-600 text-red-600 hover:bg-red-50'}`}
+                        className={`flex-1 py-2 ${currentVote === 'no' ? 'bg-red-600 hover:bg-red-700 text-white' : 'border-red-600 text-red-600 hover:bg-red-50 dark:hover:bg-red-950'}`}
                         variant={currentVote === 'no' ? 'default' : 'outline'}
                         size="sm"
                         onClick={() => handleVoteClick(option.id, 'no')}
@@ -155,7 +299,7 @@ export function SimpleImageVoting({
                         data-testid={`vote-no-${index}`}
                       >
                         <X className="w-4 h-4 mr-1" />
-                        Nein
+                        {t('voting.no')}
                       </Button>
                     </div>
                   )}
@@ -166,62 +310,111 @@ export function SimpleImageVoting({
         </div>
       )}
 
-      {/* Text-only options */}
       {textOptions.length > 0 && (
-        <div className="space-y-4">
-          <h3 className="text-lg font-semibold mb-4">Text Optionen</h3>
-          {textOptions.map((option, textIndex) => {
-            const currentVote = votes[String(option.id)];
-            const globalIndex = imageOptions.length + textIndex;
-            return (
-              <div key={option.id} className="p-4 border rounded-lg" data-testid={`option-${globalIndex}`}>
-                <h4 className="font-medium text-lg mb-3"><FormattedOptionText text={option.text} startTime={option.startTime} locale={i18n.language} /></h4>
-                {!adminPreview && (
-                  <div className="flex gap-2">
-                    <Button
-                      className={`flex-1 py-2 ${currentVote === 'yes' ? 'bg-green-600 hover:bg-green-700 text-white' : 'border-green-600 text-green-600 hover:bg-green-50'}`}
-                      variant={currentVote === 'yes' ? 'default' : 'outline'}
-                      size="sm"
-                      onClick={() => handleVoteClick(option.id, 'yes')}
-                      disabled={disabled}
-                      data-testid={`vote-yes-${globalIndex}`}
-                    >
-                      <Check className="w-4 h-4 mr-1" />
-                      Ja
-                    </Button>
-                    {allowMaybe && (
-                      <Button
-                        className={`flex-1 py-2 ${currentVote === 'maybe' ? 'bg-yellow-500 hover:bg-yellow-600 text-black' : 'border-yellow-500 text-yellow-600 hover:bg-yellow-50'}`}
-                        variant={currentVote === 'maybe' ? 'default' : 'outline'}
-                        size="sm"
-                        onClick={() => handleVoteClick(option.id, 'maybe')}
-                        disabled={disabled}
-                        data-testid={`vote-maybe-${globalIndex}`}
-                      >
-                        <Minus className="w-4 h-4 mr-1" />
-                        Vielleicht
-                      </Button>
+        <div>
+          <h3 className="text-lg font-semibold mb-4">{t('voting.textOptions')}</h3>
+          
+          {isSchedulePoll && dayGroups ? (
+            <div className="space-y-5">
+              {dayGroups.map((group) => (
+                <div key={group.dateKey || 'no-date'}>
+                  {group.dateLabel && (
+                    <div className="flex items-center gap-2 mb-2">
+                      <h4 className="text-sm font-bold text-primary">{group.dateLabel}</h4>
+                      <div className="flex-1 h-px bg-border" />
+                    </div>
+                  )}
+                  <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-2">
+                    {group.options.map((option) => {
+                      const currentVote = votes[String(option.id)];
+                      const globalIndex = options.findIndex(o => o.id === option.id);
+                      return (
+                        <div 
+                          key={option.id} 
+                          className={`p-3 border rounded-lg transition-colors ${
+                            currentVote === 'yes' ? 'border-green-500/50 bg-green-50/50 dark:bg-green-950/20' :
+                            currentVote === 'maybe' ? 'border-yellow-500/50 bg-yellow-50/50 dark:bg-yellow-950/20' :
+                            currentVote === 'no' ? 'border-red-500/50 bg-red-50/50 dark:bg-red-950/20' :
+                            'border-border'
+                          }`}
+                          data-testid={`option-${globalIndex}`}
+                        >
+                          <div className="text-sm font-medium mb-2">
+                            <TimeOnlyText text={option.text} startTime={option.startTime} locale={i18n.language} />
+                          </div>
+                          {!adminPreview && (
+                            <VoteButtons 
+                              optionId={option.id} 
+                              currentVote={currentVote} 
+                              allowMaybe={allowMaybe} 
+                              disabled={disabled} 
+                              onVote={handleVoteClick} 
+                              t={t}
+                              testIdSuffix={String(globalIndex)}
+                            />
+                          )}
+                        </div>
+                      );
+                    })}
+                  </div>
+                </div>
+              ))}
+            </div>
+          ) : (
+            <div className="space-y-4">
+              {textOptions.map((option, textIndex) => {
+                const currentVote = votes[String(option.id)];
+                const globalIndex = imageOptions.length + textIndex;
+                return (
+                  <div key={option.id} className="p-4 border rounded-lg" data-testid={`option-${globalIndex}`}>
+                    <h4 className="font-medium text-lg mb-3"><FormattedOptionText text={option.text} startTime={option.startTime} locale={i18n.language} /></h4>
+                    {!adminPreview && (
+                      <div className="flex gap-2">
+                        <Button
+                          className={`flex-1 py-2 ${currentVote === 'yes' ? 'bg-green-600 hover:bg-green-700 text-white' : 'border-green-600 text-green-600 hover:bg-green-50 dark:hover:bg-green-950'}`}
+                          variant={currentVote === 'yes' ? 'default' : 'outline'}
+                          size="sm"
+                          onClick={() => handleVoteClick(option.id, 'yes')}
+                          disabled={disabled}
+                          data-testid={`vote-yes-${globalIndex}`}
+                        >
+                          <Check className="w-4 h-4 mr-1" />
+                          {t('voting.yes')}
+                        </Button>
+                        {allowMaybe && (
+                          <Button
+                            className={`flex-1 py-2 ${currentVote === 'maybe' ? 'bg-yellow-500 hover:bg-yellow-600 text-black' : 'border-yellow-500 text-yellow-600 hover:bg-yellow-50 dark:hover:bg-yellow-950'}`}
+                            variant={currentVote === 'maybe' ? 'default' : 'outline'}
+                            size="sm"
+                            onClick={() => handleVoteClick(option.id, 'maybe')}
+                            disabled={disabled}
+                            data-testid={`vote-maybe-${globalIndex}`}
+                          >
+                            <Minus className="w-4 h-4 mr-1" />
+                            {t('voting.maybe')}
+                          </Button>
+                        )}
+                        <Button
+                          className={`flex-1 py-2 ${currentVote === 'no' ? 'bg-red-600 hover:bg-red-700 text-white' : 'border-red-600 text-red-600 hover:bg-red-50 dark:hover:bg-red-950'}`}
+                          variant={currentVote === 'no' ? 'default' : 'outline'}
+                          size="sm"
+                          onClick={() => handleVoteClick(option.id, 'no')}
+                          disabled={disabled}
+                          data-testid={`vote-no-${globalIndex}`}
+                        >
+                          <X className="w-4 h-4 mr-1" />
+                          {t('voting.no')}
+                        </Button>
+                      </div>
                     )}
-                    <Button
-                      className={`flex-1 py-2 ${currentVote === 'no' ? 'bg-red-600 hover:bg-red-700 text-white' : 'border-red-600 text-red-600 hover:bg-red-50'}`}
-                      variant={currentVote === 'no' ? 'default' : 'outline'}
-                      size="sm"
-                      onClick={() => handleVoteClick(option.id, 'no')}
-                      disabled={disabled}
-                      data-testid={`vote-no-${globalIndex}`}
-                    >
-                      <X className="w-4 h-4 mr-1" />
-                      Nein
-                    </Button>
                   </div>
-                )}
-              </div>
-            );
-          })}
+                );
+              })}
+            </div>
+          )}
         </div>
       )}
 
-      {/* Yet Another React Lightbox */}
       <Lightbox
         open={lightboxOpen}
         close={() => setLightboxOpen(false)}
@@ -233,8 +426,7 @@ export function SimpleImageVoting({
         render={{
           buttonPrev: slides.length <= 1 ? () => null : undefined,
           buttonNext: slides.length <= 1 ? () => null : undefined,
-          slide: ({ slide, offset, rect }) => {
-            // Get the current slide index from the slide itself
+          slide: ({ slide }) => {
             const currentSlideIndex = slides.findIndex(s => s.src === slide.src);
             const currentOption = imageOptions[currentSlideIndex >= 0 ? currentSlideIndex : lightboxIndex];
             const currentVote = votes[String(currentOption?.id)];
@@ -251,7 +443,6 @@ export function SimpleImageVoting({
                   }}
                 />
                 
-                {/* Title overlay at top */}
                 {currentOption && (
                   <div style={{
                     position: 'absolute',
@@ -272,7 +463,6 @@ export function SimpleImageVoting({
                   </div>
                 )}
                 
-                {/* Voting buttons at bottom */}
                 {currentOption && !adminPreview && (
                   <div style={{
                     position: 'absolute',
@@ -308,7 +498,7 @@ export function SimpleImageVoting({
                       }}
                     >
                       <span style={{ fontSize: '20px' }}>✓</span>
-                      <span>Ja</span>
+                      <span>{t('voting.yes')}</span>
                     </button>
                     
                     {allowMaybe && (
@@ -334,7 +524,7 @@ export function SimpleImageVoting({
                         }}
                       >
                         <span style={{ fontSize: '20px' }}>−</span>
-                        <span>Vielleicht</span>
+                        <span>{t('voting.maybe')}</span>
                       </button>
                     )}
                     
@@ -360,7 +550,7 @@ export function SimpleImageVoting({
                       }}
                     >
                       <span style={{ fontSize: '20px' }}>✗</span>
-                      <span>Nein</span>
+                      <span>{t('voting.no')}</span>
                     </button>
                   </div>
                 )}
@@ -376,4 +566,4 @@ export function SimpleImageVoting({
       />
     </div>
   );
-}
\ No newline at end of file
+}
diff --git a/client/src/components/VotingInterface.tsx b/client/src/components/VotingInterface.tsx
index 1f77340a..6ac3028b 100644
--- a/client/src/components/VotingInterface.tsx
+++ b/client/src/components/VotingInterface.tsx
@@ -72,6 +72,7 @@ export function VotingInterface({ poll, isAdminAccess = false }: VotingInterface
   const [voterName, setVoterName] = useState("");
   const [voterEmail, setVoterEmail] = useState("");
   const [votes, setVotes] = useState<Record<number, VoteResponse>>({});
+  const [freeTextAnswers, setFreeTextAnswers] = useState<Record<number, string>>({});
   const [orgaBookings, setOrgaBookings] = useState<SlotBookingInfo[]>([]);
   const [hasOrgaChanges, setHasOrgaChanges] = useState(false);
   const [showSelfVote, setShowSelfVote] = useState(false);
@@ -497,8 +498,10 @@ export function VotingInterface({ poll, isAdminAccess = false }: VotingInterface
         return;
       }
     } else {
+      const hasFreeTextOptions = poll.options.some((o: any) => o.isFreeText);
       const votesToSubmit = Object.entries(votes);
-      if (votesToSubmit.length === 0) {
+      const hasFreeTextAnswers = hasFreeTextOptions && Object.values(freeTextAnswers).some(v => v?.trim());
+      if (votesToSubmit.length === 0 && !hasFreeTextAnswers) {
         toast({
           title: t('common.error'),
           description: t('votingInterface.pleaseSelectOption'),
@@ -542,14 +545,32 @@ export function VotingInterface({ poll, isAdminAccess = false }: VotingInterface
         sessionStorage.setItem('vote-success-data', JSON.stringify(successData));
       } else if (poll.type === 'survey') {
         // For surveys: Use bulk vote endpoint to ensure atomicity
-        const votesToSubmit = Object.entries(votes);
+        // Include free-text answers for isFreeText options
+        const freeTextOptions = poll.options.filter((o: any) => o.isFreeText);
+        const freeTextVotes = freeTextOptions
+          .filter((o: any) => freeTextAnswers[o.id]?.trim())
+          .map((o: any) => ({
+            optionId: o.id,
+            response: 'freetext' as const,
+            freeTextAnswer: freeTextAnswers[o.id].trim(),
+          }));
+        const regularVotes = Object.entries(votes).map(([optionId, response]) => ({
+          optionId: parseInt(optionId),
+          response,
+        }));
+        const allVotes = [...regularVotes, ...freeTextVotes];
+        if (allVotes.length === 0) {
+          toast({
+            title: t('common.error'),
+            description: t('votingInterface.pleaseSelectOption'),
+            variant: "destructive",
+          });
+          return;
+        }
         const bulkVoteData = {
           voterName: voterName.trim(),
           voterEmail: voterEmail.trim(),
-          votes: votesToSubmit.map(([optionId, response]) => ({
-            optionId: parseInt(optionId),
-            response
-          }))
+          votes: allVotes,
         };
         
         const response = await apiRequest("POST", `/api/v1/polls/${poll.publicToken}/vote-bulk`, bulkVoteData);
@@ -952,18 +973,42 @@ export function VotingInterface({ poll, isAdminAccess = false }: VotingInterface
             )
           ) : (
             canVote && (showSelfVote || !isAdminAccess) ? (
-              <SimpleImageVoting
-                options={poll.options}
-                onVote={(optionId, response) => handleVote(parseInt(optionId), response)}
-                existingVotes={Object.fromEntries(
-                  Object.entries(votes).map(([id, response]) => [id, response])
+              <>
+                {poll.options.filter((o: any) => o.isFreeText).length > 0 && (
+                  <div className="space-y-4 mb-4">
+                    {poll.options.filter((o: any) => o.isFreeText).map((option: any) => (
+                      <div key={option.id} className="space-y-1">
+                        <label className="block text-sm font-medium text-foreground">
+                          {option.text}
+                          <span className="ml-1 text-xs text-muted-foreground">({t('survey.freeTextAnswerOptional')})</span>
+                        </label>
+                        <textarea
+                          className="w-full rounded-lg border border-border bg-background px-3 py-2 text-sm placeholder:text-muted-foreground/50 focus:outline-none focus:ring-1 focus:ring-primary/50 focus:border-primary/50 transition-colors resize-none"
+                          rows={3}
+                          placeholder={t('survey.freeTextAnswerPlaceholder')}
+                          value={freeTextAnswers[option.id] || ""}
+                          onChange={(e) => setFreeTextAnswers(prev => ({ ...prev, [option.id]: e.target.value }))}
+                          maxLength={2000}
+                        />
+                      </div>
+                    ))}
+                  </div>
                 )}
-                disabled={!canVote}
-                allowMaybe={poll.allowMaybe ?? true}
-              />
+                {poll.options.filter((o: any) => !o.isFreeText).length > 0 && (
+                  <SimpleImageVoting
+                    options={poll.options.filter((o: any) => !o.isFreeText)}
+                    onVote={(optionId, response) => handleVote(parseInt(optionId), response)}
+                    existingVotes={Object.fromEntries(
+                      Object.entries(votes).map(([id, response]) => [id, response])
+                    )}
+                    disabled={!canVote}
+                    allowMaybe={poll.allowMaybe ?? true}
+                  />
+                )}
+              </>
             ) : (
               <SimpleImageVoting
-                options={poll.options}
+                options={poll.options.filter((o: any) => !o.isFreeText)}
                 onVote={() => {}}
                 existingVotes={{}}
                 disabled={true}
@@ -1022,7 +1067,7 @@ export function VotingInterface({ poll, isAdminAccess = false }: VotingInterface
                       className={`px-8 ${
                         poll.type === 'survey' ? 'polly-button-survey' : 'polly-button-schedule'
                       }`}
-                      disabled={voteMutation.isPending || !voterName.trim() || emailRequiresLogin || isCheckingEmail || Object.keys(votes).length === 0}
+                      disabled={voteMutation.isPending || !voterName.trim() || emailRequiresLogin || isCheckingEmail || (Object.keys(votes).length === 0 && !poll.options.some((o: any) => o.isFreeText))}
                       data-testid="button-submit-vote"
                     >
                       {voteMutation.isPending ? t('votingInterface.saving') : t('votingInterface.submitVote')}
diff --git a/client/src/components/admin/AdminDashboard.tsx b/client/src/components/admin/AdminDashboard.tsx
index b456ad2b..457c7174 100644
--- a/client/src/components/admin/AdminDashboard.tsx
+++ b/client/src/components/admin/AdminDashboard.tsx
@@ -28,6 +28,7 @@ import {
   CalendarSettingsPanel,
   PentestToolsPanel,
   WCAGAccessibilityPanel,
+  AiSettingsPanel,
 } from "./settings";
 
 interface AdminDashboardProps {
@@ -68,7 +69,17 @@ export function AdminDashboard({ stats, users, polls, settings, userRole }: Admi
   const { t } = useTranslation();
   const { toast } = useToast();
   
-  const [activeTab, setActiveTab] = useState<AdminTab>("overview");
+  const [activeTab, setActiveTab] = useState<AdminTab>(() => {
+    if (typeof window !== 'undefined') {
+      const params = new URLSearchParams(window.location.search);
+      const tab = params.get('tab');
+      const validTabs: AdminTab[] = ['overview', 'monitoring', 'polls', 'users', 'customize', 'settings', 'tests', 'deletion-requests'];
+      if (tab && validTabs.includes(tab as AdminTab)) {
+        return tab as AdminTab;
+      }
+    }
+    return "overview";
+  });
   const [selectedUser, setSelectedUser] = useState<User | null>(null);
   const [selectedPoll, setSelectedPoll] = useState<PollWithOptions | null>(null);
   const [selectedSettingsPanel, setSelectedSettingsPanel] = useState<SettingsPanelType>(null);
@@ -325,6 +336,9 @@ export function AdminDashboard({ stats, users, polls, settings, userRole }: Admi
           {activeTab === "settings" && selectedSettingsPanel === 'wcag' && (
             <WCAGAccessibilityPanel onBack={() => setSelectedSettingsPanel(null)} />
           )}
+          {activeTab === "settings" && selectedSettingsPanel === 'ai' && (
+            <AiSettingsPanel onBack={() => setSelectedSettingsPanel(null)} />
+          )}
 
           {activeTab === "tests" && (
             <TestsPanel onBack={() => setActiveTab("overview")} />
diff --git a/client/src/components/admin/AdminSidebar.tsx b/client/src/components/admin/AdminSidebar.tsx
index 7b5bb6af..49bc8b50 100644
--- a/client/src/components/admin/AdminSidebar.tsx
+++ b/client/src/components/admin/AdminSidebar.tsx
@@ -1,4 +1,5 @@
 import { useTranslation } from 'react-i18next';
+import { useQuery } from '@tanstack/react-query';
 import { Card, CardContent } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import {
@@ -38,6 +39,12 @@ export function AdminSidebar({
 }: AdminSidebarProps) {
   const { t } = useTranslation();
 
+  const { data: deletionRequests } = useQuery<any[]>({
+    queryKey: ['/api/v1/admin/deletion-requests'],
+    refetchInterval: 60000,
+  });
+  const pendingDeletionCount = deletionRequests?.length ?? 0;
+
   const handleNavClick = (tab: AdminTab) => {
     setActiveTab(tab);
     clearSelections();
@@ -126,7 +133,8 @@ export function AdminSidebar({
               onClick={() => handleNavClick("deletion-requests")} 
               icon={<UserX className="w-4 h-4" />} 
               label={t('admin.nav.deletionRequests')} 
-              testId="nav-deletion-requests" 
+              testId="nav-deletion-requests"
+              badge={pendingDeletionCount}
             />
           </nav>
         </CardContent>
diff --git a/client/src/components/admin/common/components.tsx b/client/src/components/admin/common/components.tsx
index 7f44e6ac..bbc5b68f 100644
--- a/client/src/components/admin/common/components.tsx
+++ b/client/src/components/admin/common/components.tsx
@@ -23,7 +23,8 @@ export function NavButton({
   icon, 
   label, 
   testId, 
-  collapsed 
+  collapsed,
+  badge,
 }: { 
   active: boolean; 
   onClick: () => void; 
@@ -31,17 +32,30 @@ export function NavButton({
   label: string; 
   testId: string; 
   collapsed: boolean;
+  badge?: number;
 }) {
   const button = (
     <Button
       variant={active ? "default" : "ghost"}
-      className={`w-full ${collapsed ? 'justify-center px-2' : 'justify-start px-3'}`}
+      className={`w-full ${collapsed ? 'justify-center px-2' : 'justify-start px-3'} relative`}
       size={collapsed ? "icon" : "default"}
       onClick={onClick}
       data-testid={testId}
     >
-      {icon}
+      <span className="relative">
+        {icon}
+        {badge != null && badge > 0 && collapsed && (
+          <span className="absolute -top-2 -right-2 bg-red-500 text-white text-[10px] font-bold rounded-full min-w-[16px] h-4 flex items-center justify-center px-1">
+            {badge}
+          </span>
+        )}
+      </span>
       {!collapsed && <span className="ml-2 truncate">{label}</span>}
+      {!collapsed && badge != null && badge > 0 && (
+        <span className="ml-auto bg-red-500 text-white text-xs font-bold rounded-full min-w-[20px] h-5 flex items-center justify-center px-1.5">
+          {badge}
+        </span>
+      )}
     </Button>
   );
 
diff --git a/client/src/components/admin/common/types.ts b/client/src/components/admin/common/types.ts
index 775f1b62..708ac6fd 100644
--- a/client/src/components/admin/common/types.ts
+++ b/client/src/components/admin/common/types.ts
@@ -101,7 +101,7 @@ export interface AdminDashboardProps {
   userRole: 'admin' | 'manager';
 }
 
-export type SettingsPanelId = 'oidc' | 'database' | 'email' | 'email-templates' | 'security' | 'matrix' | 'roles' | 'notifications' | 'session-timeout' | 'calendar' | 'pentest' | 'tests' | 'wcag' | null;
+export type SettingsPanelId = 'oidc' | 'database' | 'email' | 'email-templates' | 'security' | 'matrix' | 'roles' | 'notifications' | 'session-timeout' | 'calendar' | 'pentest' | 'tests' | 'wcag' | 'ai' | null;
 
 export type AdminTab = 'overview' | 'monitoring' | 'polls' | 'users' | 'customize' | 'settings' | 'tests' | 'deletion-requests';
 
diff --git a/client/src/components/admin/panels/CustomizePanel.tsx b/client/src/components/admin/panels/CustomizePanel.tsx
index 878982df..d7c4ed74 100644
--- a/client/src/components/admin/panels/CustomizePanel.tsx
+++ b/client/src/components/admin/panels/CustomizePanel.tsx
@@ -19,7 +19,8 @@ import {
   Sun,
   Monitor,
   RotateCcw,
-  Loader2
+  Loader2,
+  Globe
 } from "lucide-react";
 import { useToast } from "@/hooks/use-toast";
 import { apiRequest } from "@/lib/queryClient";
@@ -70,6 +71,10 @@ export function CustomizePanel() {
     supportLinks: [] as FooterLink[],
   });
 
+  const [languageSettings, setLanguageSettings] = useState({
+    defaultLanguage: 'en' as 'de' | 'en',
+  });
+
   const [isUploading, setIsUploading] = useState(false);
 
   useEffect(() => {
@@ -101,6 +106,9 @@ export function CustomizePanel() {
         copyrightText: customization.footer?.copyrightText || '',
         supportLinks: customization.footer?.supportLinks || [],
       });
+      setLanguageSettings({
+        defaultLanguage: customization.language?.defaultLanguage || 'en',
+      });
       setInitialDataLoaded(true);
     }
   }, [customization, initialDataLoaded]);
@@ -113,6 +121,7 @@ export function CustomizePanel() {
     onSuccess: () => {
       toast({ title: t('admin.toasts.saved'), description: t('admin.toasts.customizationSaved') });
       queryClient.invalidateQueries({ queryKey: ['/api/v1/admin/customization'] });
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/customization'] });
     },
     onError: () => {
       toast({ title: t('errors.generic'), description: t('admin.toasts.customizationSaveError'), variant: "destructive" });
@@ -142,6 +151,7 @@ export function CustomizePanel() {
   const handleLogoUpload = async (event: React.ChangeEvent<HTMLInputElement>) => {
     const file = event.target.files?.[0];
     if (!file) return;
+    event.target.value = '';
 
     setIsUploading(true);
     const formData = new FormData();
@@ -173,14 +183,16 @@ export function CustomizePanel() {
           });
           return;
         }
-        throw new Error('Upload failed');
+        throw new Error(errorData.error || 'Upload failed');
       }
       
       const data = await response.json();
       setBrandingSettings({ ...brandingSettings, logoUrl: data.logoUrl });
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/admin/customization'] });
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/customization'] });
       toast({ title: t('admin.toasts.logoUploaded'), description: t('admin.toasts.logoUploadedDescription') });
-    } catch (error) {
-      toast({ title: t('errors.generic'), description: t('admin.toasts.logoUploadError'), variant: "destructive" });
+    } catch (error: any) {
+      toast({ title: t('errors.generic'), description: error?.message || t('admin.toasts.logoUploadError'), variant: "destructive" });
     } finally {
       setIsUploading(false);
     }
@@ -194,6 +206,8 @@ export function CustomizePanel() {
       });
       if (!response.ok) throw new Error('Delete failed');
       setBrandingSettings({ ...brandingSettings, logoUrl: null });
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/admin/customization'] });
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/customization'] });
       toast({ title: t('admin.toasts.logoDeleted'), description: t('admin.toasts.logoDeletedDescription') });
     } catch (error) {
       toast({ title: t('errors.generic'), description: t('admin.toasts.logoDeleteError'), variant: "destructive" });
@@ -271,15 +285,27 @@ export function CustomizePanel() {
                 </div>
               )}
               <div>
-                <Input
+                <input
+                  id="logo-upload-input"
                   type="file"
                   accept="image/*"
                   onChange={handleLogoUpload}
                   disabled={isUploading}
-                  className="max-w-xs"
+                  className="sr-only"
                   data-testid="input-logo-upload"
                 />
-                {isUploading && <p className="text-xs text-muted-foreground mt-1">{t('common.uploading')}</p>}
+                <label
+                  htmlFor="logo-upload-input"
+                  className={`inline-flex items-center justify-center gap-2 rounded-md border border-input bg-background px-3 py-2 text-sm font-medium ring-offset-background hover:bg-accent hover:text-accent-foreground cursor-pointer ${isUploading ? 'pointer-events-none opacity-50' : ''}`}
+                  data-testid="button-logo-upload"
+                >
+                  {isUploading ? (
+                    <Loader2 className="h-4 w-4 animate-spin" />
+                  ) : (
+                    <Upload className="h-4 w-4" />
+                  )}
+                  {isUploading ? t('admin.customization.uploading') : t('admin.customize.uploadLogo')}
+                </label>
               </div>
             </div>
           </div>
@@ -291,7 +317,7 @@ export function CustomizePanel() {
                 id="siteName"
                 value={brandingSettings.siteName}
                 onChange={(e) => setBrandingSettings({ ...brandingSettings, siteName: e.target.value })}
-                placeholder="Polly"
+                placeholder="Poll"
                 data-testid="input-site-name"
               />
             </div>
@@ -301,7 +327,7 @@ export function CustomizePanel() {
                 id="siteNameAccent"
                 value={brandingSettings.siteNameAccent}
                 onChange={(e) => setBrandingSettings({ ...brandingSettings, siteNameAccent: e.target.value })}
-                placeholder="Poll"
+                placeholder="y"
                 data-testid="input-site-name-accent"
               />
             </div>
@@ -319,6 +345,47 @@ export function CustomizePanel() {
         </CardContent>
       </Card>
 
+      {/* Language Settings */}
+      <Card className="polly-card">
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Globe className="w-5 h-5" />
+            {t('admin.customize.languageSection')}
+          </CardTitle>
+          <CardDescription>{t('admin.customize.languageDescription')}</CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div>
+            <Label className="mb-2 block">{t('admin.customize.defaultLanguage')}</Label>
+            <p className="text-sm text-muted-foreground mb-3">{t('admin.customize.defaultLanguageHint')}</p>
+            <RadioGroup
+              value={languageSettings.defaultLanguage}
+              onValueChange={(value) => setLanguageSettings({ defaultLanguage: value as 'de' | 'en' })}
+              className="flex gap-4"
+            >
+              <div className="flex items-center space-x-2">
+                <RadioGroupItem value="de" id="lang-de" />
+                <Label htmlFor="lang-de">Deutsch</Label>
+              </div>
+              <div className="flex items-center space-x-2">
+                <RadioGroupItem value="en" id="lang-en" />
+                <Label htmlFor="lang-en">English</Label>
+              </div>
+            </RadioGroup>
+          </div>
+
+          <Button 
+            onClick={() => saveMutation.mutate({ language: languageSettings })}
+            disabled={saveMutation.isPending}
+            data-testid="button-save-language"
+            className="bg-polly-orange hover:bg-polly-orange/90 text-white font-medium"
+          >
+            {saveMutation.isPending && <Loader2 className="w-4 h-4 mr-2 animate-spin" />}
+            {t('admin.customize.saveLanguage')}
+          </Button>
+        </CardContent>
+      </Card>
+
       {/* Theme Colors */}
       <Card className="polly-card">
         <CardHeader>
diff --git a/client/src/components/admin/panels/SettingsPanel.tsx b/client/src/components/admin/panels/SettingsPanel.tsx
index fea05f96..10c6154a 100644
--- a/client/src/components/admin/panels/SettingsPanel.tsx
+++ b/client/src/components/admin/panels/SettingsPanel.tsx
@@ -14,7 +14,8 @@ import {
   Timer,
   Calendar,
   ShieldAlert,
-  Target
+  Target,
+  Bot
 } from "lucide-react";
 import { SettingCard } from "../common/components";
 import type { SettingsPanelId as SettingsPanelType } from "../common/types";
@@ -30,18 +31,37 @@ export function SettingsPanel({
 }: SettingsPanelProps) {
   const { t } = useTranslation();
 
-  const { data: oidcStatus } = useQuery<{ enabled: boolean }>({
-    queryKey: ['/api/v1/admin/oidc-status'],
+  const { data: oidcConfig } = useQuery<{ enabled: boolean; configured: boolean }>({
+    queryKey: ['/api/v1/oidc-config'],
   });
 
   const { data: matrixStatus } = useQuery<{ enabled: boolean }>({
-    queryKey: ['/api/v1/admin/matrix-status'],
+    queryKey: ['/api/v1/matrix/status'],
   });
 
-  const { data: emailStatus } = useQuery<{ configured: boolean }>({
-    queryKey: ['/api/v1/admin/email-status'],
+  const { data: emailStatus } = useQuery<{ smtpConfigured: boolean }>({
+    queryKey: ['/api/v1/email-status'],
   });
 
+  const { data: aiStatus } = useQuery<{ enabled: boolean; apiConfigured: boolean }>({
+    queryKey: ['/api/v1/ai/status'],
+  });
+
+  const getOidcStatus = () => {
+    if (!oidcConfig?.configured) return { label: t('admin.settings.status.notConfigured'), type: 'warning' as const };
+    if (oidcConfig.enabled) return { label: t('admin.settings.status.enabled'), type: 'success' as const };
+    return { label: t('admin.settings.status.disabled'), type: 'neutral' as const };
+  };
+
+  const getAiStatus = () => {
+    if (!aiStatus?.apiConfigured) return { label: t('admin.settings.status.notConfigured'), type: 'warning' as const };
+    if (aiStatus.enabled) return { label: t('admin.settings.status.enabled'), type: 'success' as const };
+    return { label: t('admin.settings.status.disabled'), type: 'neutral' as const };
+  };
+
+  const oidcSt = getOidcStatus();
+  const aiSt = getAiStatus();
+
   return (
     <div className="space-y-6">
       <div className="flex items-center justify-between">
@@ -57,8 +77,8 @@ export function SettingsPanel({
           title={t('admin.settings.oidc.title')}
           description={t('admin.settings.oidc.description')}
           icon={<Key className="w-5 h-5" />}
-          status={oidcStatus?.enabled ? t('admin.settings.status.enabled') : t('admin.settings.status.disabled')}
-          statusType={oidcStatus?.enabled ? 'success' : 'neutral'}
+          status={oidcSt.label}
+          statusType={oidcSt.type}
           onClick={() => onSelectPanel('oidc')}
           testId="setting-oidc"
         />
@@ -77,8 +97,8 @@ export function SettingsPanel({
           title={t('admin.settings.email.title')}
           description={t('admin.settings.email.description')}
           icon={<Mail className="w-5 h-5" />}
-          status={emailStatus?.configured ? t('admin.settings.status.configured') : t('admin.settings.status.notConfigured')}
-          statusType={emailStatus?.configured ? 'success' : 'warning'}
+          status={emailStatus?.smtpConfigured ? t('admin.settings.status.configured') : t('admin.settings.status.notConfigured')}
+          statusType={emailStatus?.smtpConfigured ? 'success' : 'warning'}
           onClick={() => onSelectPanel('email')}
           testId="setting-email"
         />
@@ -178,6 +198,26 @@ export function SettingsPanel({
           />
         </div>
       </div>
+
+      <div className="pt-6 border-t border-border">
+        <div className="flex items-center gap-2 mb-4">
+          <h3 className="text-lg font-semibold text-foreground">{t('admin.settings.ai.sectionTitle')}</h3>
+          <span className="text-[10px] px-1.5 py-0.5 rounded-full bg-amber-500/20 text-amber-600 dark:text-amber-400 border border-amber-500/30 font-medium">
+            Beta
+          </span>
+        </div>
+        <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+          <SettingCard
+            title={t('admin.settings.ai.title')}
+            description={t('admin.settings.ai.description')}
+            icon={<Bot className="w-5 h-5" />}
+            status={aiSt.label}
+            statusType={aiSt.type}
+            onClick={() => onSelectPanel('ai')}
+            testId="setting-ai"
+          />
+        </div>
+      </div>
     </div>
   );
 }
diff --git a/client/src/components/admin/panels/TestsPanel.tsx b/client/src/components/admin/panels/TestsPanel.tsx
index 262f5739..4199f517 100644
--- a/client/src/components/admin/panels/TestsPanel.tsx
+++ b/client/src/components/admin/panels/TestsPanel.tsx
@@ -11,6 +11,8 @@ import {
   AccordionItem,
   AccordionTrigger,
 } from "@/components/ui/accordion";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
 import { 
   FlaskConical, 
   Play, 
@@ -25,7 +27,11 @@ import {
   ShieldAlert,
   ExternalLink,
   Trash2,
-  Database
+  Database,
+  Mail,
+  Save,
+  X,
+  AlertTriangle,
 } from "lucide-react";
 import {
   AlertDialog,
@@ -74,6 +80,17 @@ interface TestRun {
   } | null;
 }
 
+interface ScheduleConfig {
+  enabled: boolean;
+  intervalDays: number;
+  runTime: string;
+  notifyEmail?: string;
+}
+
+interface SmtpStatus {
+  smtpConfigured: boolean;
+}
+
 interface TestsPanelProps {
   onBack: () => void;
 }
@@ -104,8 +121,8 @@ export function TestsPanel({ onBack }: TestsPanelProps) {
     if (currentRunError && isRunning) {
       setIsRunning(false);
       toast({
-        title: t('admin.tests.error', 'Verbindungsfehler'),
-        description: t('admin.tests.pollingStoppedError', 'Statusabfrage wurde gestoppt. Bitte Seite neu laden.'),
+        title: t('admin.tests.error'),
+        description: t('admin.tests.pollingStoppedError'),
         variant: 'destructive',
       });
     }
@@ -115,6 +132,44 @@ export function TestsPanel({ onBack }: TestsPanelProps) {
     queryKey: ['/api/v1/admin/pentest-tools/status'],
   });
 
+  const { data: scheduleConfig } = useQuery<ScheduleConfig>({
+    queryKey: ['/api/v1/admin/tests/schedule'],
+  });
+
+  const { data: smtpStatus } = useQuery<SmtpStatus>({
+    queryKey: ['/api/v1/email-status'],
+  });
+
+  const [notifyEmail, setNotifyEmail] = useState('');
+  const [emailDirty, setEmailDirty] = useState(false);
+
+  useEffect(() => {
+    if (scheduleConfig && !emailDirty) {
+      setNotifyEmail(scheduleConfig.notifyEmail || '');
+    }
+  }, [scheduleConfig, emailDirty]);
+
+  const saveEmailMutation = useMutation({
+    mutationFn: async (email: string) => {
+      await apiRequest('PUT', '/api/v1/admin/tests/schedule', { notifyEmail: email || '' });
+    },
+    onSuccess: (_data, email) => {
+      setEmailDirty(false);
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/admin/tests/schedule'] });
+      toast({
+        title: email
+          ? t('admin.tests.notificationEmailSaved')
+          : t('admin.tests.notificationEmailCleared'),
+      });
+    },
+    onError: () => {
+      toast({
+        title: t('admin.tests.error'),
+        variant: 'destructive',
+      });
+    },
+  });
+
   const { data: testDataStats, refetch: refetchTestDataStats } = useQuery<{
     polls: number;
     users: number;
@@ -218,8 +273,10 @@ export function TestsPanel({ onBack }: TestsPanelProps) {
   };
 
   const calculateProgress = (run: TestRun) => {
-    if (run.summary.total === 0) return 0;
-    return ((run.summary.passed + run.summary.failed + run.summary.skipped) / run.summary.total) * 100;
+    const processed = run.summary.passed + run.summary.failed + run.summary.skipped;
+    const total = run.summary.total;
+    if (total === 0) return processed > 0 ? 99 : 0;
+    return Math.min((processed / total) * 100, 100);
   };
 
   return (
@@ -298,7 +355,7 @@ export function TestsPanel({ onBack }: TestsPanelProps) {
                 <span className="text-green-500">✓ {currentRun.summary.passed}</span>
                 <span className="text-red-500">✗ {currentRun.summary.failed}</span>
                 <span className="text-amber-500">○ {currentRun.summary.skipped}</span>
-                <span>/ {currentRun.summary.total}</span>
+                <span>/ {currentRun.summary.total > 0 ? currentRun.summary.total : t('common.loading')}</span>
               </div>
               {currentRun.liveProgress?.currentTest && (
                 <div className="flex items-center gap-2 text-xs text-muted-foreground mt-2">
@@ -458,6 +515,72 @@ export function TestsPanel({ onBack }: TestsPanelProps) {
         </CardContent>
       </Card>
 
+      {/* Email Notification */}
+      <Card className="polly-card">
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Mail className="w-5 h-5" />
+            {t('admin.tests.notificationEmail')}
+          </CardTitle>
+          <CardDescription>{t('admin.tests.notificationEmailHint')}</CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          {smtpStatus && !smtpStatus.smtpConfigured && (
+            <div className="flex items-center gap-2 text-sm text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-950/30 p-3 rounded-md">
+              <AlertTriangle className="w-4 h-4 shrink-0" />
+              <span>{t('admin.tests.smtpNotConfigured')}</span>
+            </div>
+          )}
+          <div className="flex items-center gap-2">
+            <div className="flex-1">
+              <Label htmlFor="notify-email" className="sr-only">{t('admin.tests.notificationEmail')}</Label>
+              <Input
+                id="notify-email"
+                type="email"
+                placeholder={t('admin.tests.notificationEmailPlaceholder')}
+                value={notifyEmail}
+                onChange={(e) => { setNotifyEmail(e.target.value); setEmailDirty(true); }}
+                data-testid="input-notify-email"
+              />
+            </div>
+            <Button
+              size="sm"
+              onClick={() => saveEmailMutation.mutate(notifyEmail)}
+              disabled={saveEmailMutation.isPending || notifyEmail === (scheduleConfig?.notifyEmail || '')}
+              data-testid="button-save-notify-email"
+            >
+              {saveEmailMutation.isPending ? (
+                <Loader2 className="w-4 h-4 mr-1 animate-spin" />
+              ) : (
+                <Save className="w-4 h-4 mr-1" />
+              )}
+              {t('admin.tests.saveEmail')}
+            </Button>
+            {scheduleConfig?.notifyEmail && (
+              <Button
+                size="sm"
+                variant="outline"
+                onClick={() => {
+                  setNotifyEmail('');
+                  setEmailDirty(false);
+                  saveEmailMutation.mutate('');
+                }}
+                disabled={saveEmailMutation.isPending}
+                data-testid="button-clear-notify-email"
+              >
+                <X className="w-4 h-4 mr-1" />
+                {t('admin.tests.clearEmail')}
+              </Button>
+            )}
+          </div>
+          {!scheduleConfig?.notifyEmail && (
+            <p className="text-xs text-muted-foreground">
+              {t('admin.tests.noEmailConfigured')}
+            </p>
+          )}
+        </CardContent>
+      </Card>
+
       {/* Pentest-Tools Integration */}
       {pentestStatus?.configured && (
         <Card className="polly-card">
diff --git a/client/src/components/admin/panels/UsersPanel.tsx b/client/src/components/admin/panels/UsersPanel.tsx
index 00cae428..a73f8d91 100644
--- a/client/src/components/admin/panels/UsersPanel.tsx
+++ b/client/src/components/admin/panels/UsersPanel.tsx
@@ -58,7 +58,10 @@ import {
   ArrowLeft,
   Loader2,
   Eye,
-  Vote
+  Vote,
+  CheckCircle,
+  XCircle,
+  ShieldCheck
 } from "lucide-react";
 import { formatDistanceToNow, format } from "date-fns";
 import { getDateLocale } from "@/lib/i18n";
@@ -442,6 +445,7 @@ function UserDetailView({
   isDeprovisionEnabled: boolean;
 }) {
   const { t } = useTranslation();
+  const { toast } = useToast();
 
   return (
     <div className="space-y-6">
@@ -483,6 +487,20 @@ function UserDetailView({
               <Label>{t('admin.users.provider')}</Label>
               <Badge variant="outline">{user.provider}</Badge>
             </div>
+            <div className="flex items-center justify-between">
+              <Label>{t('admin.users.emailStatus')}</Label>
+              {user.emailVerified ? (
+                <Badge variant="outline" className="text-green-600 border-green-600/30 bg-green-500/10">
+                  <CheckCircle className="w-3 h-3 mr-1" />
+                  {t('admin.users.emailVerified')}
+                </Badge>
+              ) : (
+                <Badge variant="outline" className="text-red-500 border-red-500/30 bg-red-500/10">
+                  <XCircle className="w-3 h-3 mr-1" />
+                  {t('admin.users.emailNotVerified')}
+                </Badge>
+              )}
+            </div>
           </CardContent>
         </Card>
 
@@ -491,6 +509,32 @@ function UserDetailView({
             <CardTitle>{t('admin.users.management')}</CardTitle>
           </CardHeader>
           <CardContent className="space-y-4">
+            {!user.emailVerified && user.provider === 'local' && (
+              <div>
+                <Button
+                  variant="outline"
+                  className="w-full"
+                  onClick={() => {
+                    apiRequest('PATCH', `/api/v1/admin/users/${user.id}`, { emailVerified: true })
+                      .then(() => {
+                        queryClient.invalidateQueries({ queryKey: ['/api/v1/admin/users'] });
+                        toast({
+                          title: t('admin.users.emailVerifiedSuccess'),
+                          description: t('admin.users.emailVerifiedDescription'),
+                        });
+                      })
+                      .catch(() => {
+                        toast({ title: t('admin.users.saveError'), variant: 'destructive' });
+                      });
+                  }}
+                  data-testid="button-verify-email"
+                >
+                  <ShieldCheck className="w-4 h-4 mr-2" />
+                  {t('admin.users.verifyEmail')}
+                </Button>
+              </div>
+            )}
+
             <div>
               <Label>{t('admin.users.changeRole')}</Label>
               <Select
diff --git a/client/src/components/admin/settings/AiSettingsPanel.tsx b/client/src/components/admin/settings/AiSettingsPanel.tsx
new file mode 100644
index 00000000..ed57ddd4
--- /dev/null
+++ b/client/src/components/admin/settings/AiSettingsPanel.tsx
@@ -0,0 +1,480 @@
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useQuery, useMutation } from "@tanstack/react-query";
+import { queryClient, apiRequest } from "@/lib/queryClient";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import { Switch } from "@/components/ui/switch";
+import { Label } from "@/components/ui/label";
+import { Input } from "@/components/ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { ArrowLeft, Bot, Zap, Info, CheckCircle, XCircle, Infinity, Key, Globe, Trash2 } from "lucide-react";
+import { useToast } from "@/hooks/use-toast";
+import type { AiSettings } from "@shared/schema";
+
+const GWDG_MODELS = [
+  { id: "llama-3.3-70b-instruct", name: "LLaMA 3.3 70B", noteKey: "modelRecommended" },
+  { id: "gemma-3-27b-it", name: "Gemma 3 27B", noteKey: "modelFast" },
+  { id: "deepseek-r1-distill-llama-70b", name: "DeepSeek R1 70B", noteKey: "modelReasoning" },
+  { id: "qwen3-235b-a22b", name: "Qwen3 235B", noteKey: "modelVeryStrong" },
+  { id: "mistral-large-3-675b-instruct-2512", name: "Mistral Large 675B", noteKey: "modelLargest" },
+  { id: "meta-llama-3.1-8b-instruct", name: "LLaMA 3.1 8B", noteKey: "modelVeryFast" },
+];
+
+interface Props {
+  onBack: () => void;
+}
+
+interface AdminAiData {
+  settings: AiSettings;
+  apiConfigured: boolean;
+  fallbackConfigured: boolean;
+  hasApiKey: boolean;
+  hasApiKeyFallback: boolean;
+  apiKeyViaEnv: boolean;
+  apiKeyFallbackViaEnv: boolean;
+  apiUrlViaEnv: boolean;
+  envModel: string | null;
+  envApiUrl: string | null;
+}
+
+function RoleLimitControl({
+  label,
+  enabled,
+  requestsPerHour,
+  onEnabledChange,
+  onLimitChange,
+  t,
+}: {
+  label: string;
+  enabled: boolean;
+  requestsPerHour: number | null;
+  onEnabledChange: (v: boolean) => void;
+  onLimitChange: (v: number | null) => void;
+  t: (key: string) => string;
+}) {
+  const [unlimited, setUnlimited] = useState(requestsPerHour === null);
+  const [localValue, setLocalValue] = useState(requestsPerHour ?? 5);
+
+  const handleUnlimitedToggle = (checked: boolean) => {
+    setUnlimited(checked);
+    onLimitChange(checked ? null : localValue);
+  };
+
+  const handleValueChange = (val: string) => {
+    const num = parseInt(val, 10);
+    if (!isNaN(num) && num >= 0) {
+      setLocalValue(num);
+      onLimitChange(num);
+    }
+  };
+
+  return (
+    <div className="p-3 rounded-lg border border-border bg-muted/20">
+      <div className="flex items-center justify-between mb-2">
+        <span className="text-sm font-medium">{label}</span>
+        <Switch checked={enabled} onCheckedChange={onEnabledChange} />
+      </div>
+      {enabled && (
+        <div className="flex items-center gap-3 mt-2">
+          <div className="flex items-center gap-2">
+            <Switch
+              checked={unlimited}
+              onCheckedChange={handleUnlimitedToggle}
+              id={`unlimited-${label}`}
+            />
+            <Label htmlFor={`unlimited-${label}`} className="text-xs text-muted-foreground flex items-center gap-1">
+              <Infinity className="w-3 h-3" /> {t('admin.aiSettings.unlimited')}
+            </Label>
+          </div>
+          {!unlimited && (
+            <div className="flex items-center gap-1">
+              <Input
+                type="number"
+                min={0}
+                max={1000}
+                value={localValue}
+                onChange={(e) => handleValueChange(e.target.value)}
+                className="w-20 h-7 text-xs"
+              />
+              <span className="text-xs text-muted-foreground">{t('admin.aiSettings.perHour')}</span>
+            </div>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
+
+function EnvBadge() {
+  return (
+    <Badge variant="outline" className="text-[10px] px-1.5 py-0 h-4 bg-blue-500/10 text-blue-600 dark:text-blue-400 border-blue-500/30">
+      ENV
+    </Badge>
+  );
+}
+
+export function AiSettingsPanel({ onBack }: Props) {
+  const { t } = useTranslation();
+  const { toast } = useToast();
+
+  const { data, isLoading } = useQuery<AdminAiData>({
+    queryKey: ["/api/v1/ai/admin/settings"],
+  });
+
+  const [localSettings, setLocalSettings] = useState<AiSettings | null>(null);
+  const [newApiKey, setNewApiKey] = useState("");
+  const [newApiKeyFallback, setNewApiKeyFallback] = useState("");
+  const [newApiUrl, setNewApiUrl] = useState("");
+  const settings: AiSettings | null = localSettings ?? data?.settings ?? null;
+
+  const saveMutation = useMutation({
+    mutationFn: (s: AiSettings) =>
+      apiRequest("PUT", "/api/v1/ai/admin/settings", s),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["/api/v1/ai/admin/settings"] });
+      queryClient.invalidateQueries({ queryKey: ["/api/v1/ai/status"] });
+      setNewApiKey("");
+      setNewApiKeyFallback("");
+      setNewApiUrl("");
+      toast({ title: t('admin.aiSettings.savedToast') });
+    },
+    onError: () => {
+      toast({ title: t('admin.aiSettings.saveError'), variant: "destructive" });
+    },
+  });
+
+  const update = (patch: Partial<AiSettings>) => {
+    if (!settings) return;
+    setLocalSettings({ ...settings, ...patch });
+  };
+
+  const handleSave = () => {
+    if (!settings) return;
+    const toSave = { ...settings };
+    if (newApiKey) toSave.apiKey = newApiKey;
+    if (newApiKeyFallback) toSave.apiKeyFallback = newApiKeyFallback;
+    if (newApiUrl) toSave.apiUrl = newApiUrl;
+    saveMutation.mutate(toSave);
+  };
+
+  const handleClearApiKey = () => {
+    if (!settings) return;
+    const toSave = { ...settings, apiKey: "__CLEAR__" };
+    saveMutation.mutate(toSave);
+  };
+
+  const handleClearApiKeyFallback = () => {
+    if (!settings) return;
+    const toSave = { ...settings, apiKeyFallback: "__CLEAR__" };
+    saveMutation.mutate(toSave);
+  };
+
+  if (isLoading || !settings) {
+    return <div className="p-8 text-center text-muted-foreground">{t('admin.aiSettings.loading')}</div>;
+  }
+
+  const apiOk = data?.apiConfigured;
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center gap-3">
+        <Button variant="ghost" size="sm" onClick={onBack}>
+          <ArrowLeft className="w-4 h-4 mr-1" /> {t('admin.aiSettings.back')}
+        </Button>
+        <div className="flex items-center gap-2">
+          <Bot className="w-5 h-5 text-primary" />
+          <h2 className="text-xl font-semibold">{t('admin.aiSettings.title')}</h2>
+          <Badge variant="secondary" className="bg-amber-500/20 text-amber-600 dark:text-amber-400 border-amber-500/30">
+            Beta
+          </Badge>
+        </div>
+      </div>
+
+      {!apiOk && (
+        <Alert className="border-amber-500/50 bg-amber-50 dark:bg-amber-950/20">
+          <Info className="w-4 h-4 text-amber-600" />
+          <AlertDescription className="text-amber-700 dark:text-amber-400">
+            {t('admin.aiSettings.noApiKeyWarning')}
+          </AlertDescription>
+        </Alert>
+      )}
+
+      <div className="grid gap-6">
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-base flex items-center gap-2">
+              <Key className="w-4 h-4" /> {t('admin.aiSettings.apiConfiguration')}
+            </CardTitle>
+            <CardDescription>
+              {t('admin.aiSettings.envPrecedence')}
+            </CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-4">
+            <div className="space-y-1.5">
+              <div className="flex items-center gap-2">
+                <Label>{t('admin.aiSettings.apiKey')}</Label>
+                {data?.apiKeyViaEnv && <EnvBadge />}
+              </div>
+              {data?.apiKeyViaEnv ? (
+                <div className="flex items-center gap-2">
+                  <Input
+                    value="••••••••••••••••"
+                    readOnly
+                    disabled
+                    className="bg-muted font-mono text-xs"
+                  />
+                  <CheckCircle className="w-4 h-4 text-green-500 flex-shrink-0" />
+                </div>
+              ) : (
+                <div className="space-y-1">
+                  <div className="flex items-center gap-2">
+                    <Input
+                      type="password"
+                      placeholder={data?.hasApiKey ? t('admin.aiSettings.apiKeyPlaceholderSaved') : t('admin.aiSettings.apiKeyPlaceholder')}
+                      value={newApiKey}
+                      onChange={(e) => setNewApiKey(e.target.value)}
+                      className="font-mono text-xs"
+                    />
+                    {data?.hasApiKey ? (
+                      <CheckCircle className="w-4 h-4 text-green-500 flex-shrink-0" />
+                    ) : (
+                      <XCircle className="w-4 h-4 text-red-500 flex-shrink-0" />
+                    )}
+                    {data?.hasApiKey && (
+                      <Button
+                        variant="ghost"
+                        size="icon"
+                        className="h-8 w-8 text-muted-foreground hover:text-destructive"
+                        onClick={handleClearApiKey}
+                        title={t('admin.aiSettings.deleteKeyTitle')}
+                      >
+                        <Trash2 className="w-3.5 h-3.5" />
+                      </Button>
+                    )}
+                  </div>
+                  {!data?.hasApiKey && (
+                    <p className="text-xs text-muted-foreground">
+                      {t('admin.aiSettings.envAlternative')}
+                    </p>
+                  )}
+                </div>
+              )}
+            </div>
+
+            <div className="space-y-1.5">
+              <div className="flex items-center gap-2">
+                <Label>{t('admin.aiSettings.fallbackKey')}</Label>
+                {data?.apiKeyFallbackViaEnv && <EnvBadge />}
+              </div>
+              {data?.apiKeyFallbackViaEnv ? (
+                <div className="flex items-center gap-2">
+                  <Input
+                    value="••••••••••••••••"
+                    readOnly
+                    disabled
+                    className="bg-muted font-mono text-xs"
+                  />
+                  <CheckCircle className="w-4 h-4 text-green-500 flex-shrink-0" />
+                </div>
+              ) : (
+                <div className="space-y-1">
+                  <div className="flex items-center gap-2">
+                    <Input
+                      type="password"
+                      placeholder={data?.hasApiKeyFallback ? t('admin.aiSettings.apiKeyPlaceholderSaved') : t('admin.aiSettings.fallbackPlaceholder')}
+                      value={newApiKeyFallback}
+                      onChange={(e) => setNewApiKeyFallback(e.target.value)}
+                      className="font-mono text-xs"
+                    />
+                    {data?.hasApiKeyFallback && (
+                      <>
+                        <CheckCircle className="w-4 h-4 text-green-500 flex-shrink-0" />
+                        <Button
+                          variant="ghost"
+                          size="icon"
+                          className="h-8 w-8 text-muted-foreground hover:text-destructive"
+                          onClick={handleClearApiKeyFallback}
+                          title={t('admin.aiSettings.deleteFallbackTitle')}
+                        >
+                          <Trash2 className="w-3.5 h-3.5" />
+                        </Button>
+                      </>
+                    )}
+                  </div>
+                  <p className="text-xs text-muted-foreground">
+                    {t('admin.aiSettings.fallbackUsageNote')}
+                  </p>
+                </div>
+              )}
+            </div>
+
+            <div className="space-y-1.5">
+              <div className="flex items-center gap-2">
+                <Label>{t('admin.aiSettings.apiUrl')}</Label>
+                {data?.apiUrlViaEnv && <EnvBadge />}
+              </div>
+              {data?.apiUrlViaEnv ? (
+                <div className="flex items-center gap-2">
+                  <Input
+                    value={data?.envApiUrl || ""}
+                    readOnly
+                    disabled
+                    className="bg-muted font-mono text-xs"
+                  />
+                  <CheckCircle className="w-4 h-4 text-green-500 flex-shrink-0" />
+                </div>
+              ) : (
+                <div className="space-y-1">
+                  <Input
+                    type="url"
+                    placeholder="https://saia.gwdg.de/v1"
+                    value={newApiUrl || settings.apiUrl || ""}
+                    onChange={(e) => {
+                      setNewApiUrl(e.target.value);
+                      update({ apiUrl: e.target.value });
+                    }}
+                    className="font-mono text-xs"
+                  />
+                  <p className="text-xs text-muted-foreground">
+                    {t('admin.aiSettings.defaultUrl')} <code className="font-mono">https://saia.gwdg.de/v1</code>
+                  </p>
+                </div>
+              )}
+            </div>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-base flex items-center gap-2">
+              <Zap className="w-4 h-4" /> {t('admin.aiSettings.general')}
+            </CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <Label>{t('admin.aiSettings.enableAi')}</Label>
+                <p className="text-xs text-muted-foreground mt-0.5">
+                  {t('admin.aiSettings.enableAiDescription')}
+                </p>
+              </div>
+              <Switch
+                checked={settings.enabled}
+                onCheckedChange={(v) => update({ enabled: v })}
+              />
+            </div>
+
+            <div className="space-y-1.5">
+              <Label>{t('admin.aiSettings.model')}</Label>
+              <Select
+                value={settings.model}
+                onValueChange={(v) => update({ model: v })}
+              >
+                <SelectTrigger>
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {GWDG_MODELS.map((m) => (
+                    <SelectItem key={m.id} value={m.id}>
+                      <span>{m.name}</span>
+                      <span className="ml-2 text-xs text-muted-foreground">({t(`admin.aiSettings.${m.noteKey}`)})</span>
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+              {data?.envModel && (
+                <p className="text-xs text-muted-foreground">
+                  {t('admin.aiSettings.envOverride')} <code className="font-mono">{data.envModel}</code>
+                </p>
+              )}
+            </div>
+
+            <div className="flex items-center gap-3 text-sm">
+              <div className="flex items-center gap-1.5">
+                {apiOk ? (
+                  <CheckCircle className="w-4 h-4 text-green-500" />
+                ) : (
+                  <XCircle className="w-4 h-4 text-red-500" />
+                )}
+                <span className="text-muted-foreground">
+                  {t('admin.aiSettings.apiKey')}: {apiOk ? t('admin.aiSettings.apiKeyConfigured') : t('admin.aiSettings.apiKeyNotSet')}
+                </span>
+                {apiOk && data?.apiKeyViaEnv && (
+                  <span className="text-xs text-muted-foreground">(ENV)</span>
+                )}
+                {apiOk && data?.hasApiKey && !data?.apiKeyViaEnv && (
+                  <span className="text-xs text-muted-foreground">(DB)</span>
+                )}
+              </div>
+              {data?.fallbackConfigured && (
+                <div className="flex items-center gap-1.5">
+                  <CheckCircle className="w-4 h-4 text-green-500" />
+                  <span className="text-muted-foreground">{t('admin.aiSettings.fallbackKeyConfigured')}</span>
+                </div>
+              )}
+            </div>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-base">{t('admin.aiSettings.rateLimiting')}</CardTitle>
+            <CardDescription>
+              {t('admin.aiSettings.rateLimitingDescription')}
+            </CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            <RoleLimitControl
+              label={t('admin.aiSettings.guests')}
+              enabled={settings.guestLimits.enabled}
+              requestsPerHour={settings.guestLimits.requestsPerHour}
+              onEnabledChange={(v) =>
+                update({ guestLimits: { ...settings.guestLimits, enabled: v } })
+              }
+              onLimitChange={(v) =>
+                update({ guestLimits: { ...settings.guestLimits, requestsPerHour: v } })
+              }
+              t={t}
+            />
+            <RoleLimitControl
+              label={t('admin.aiSettings.authenticatedUsers')}
+              enabled={settings.userLimits.enabled}
+              requestsPerHour={settings.userLimits.requestsPerHour}
+              onEnabledChange={(v) =>
+                update({ userLimits: { ...settings.userLimits, enabled: v } })
+              }
+              onLimitChange={(v) =>
+                update({ userLimits: { ...settings.userLimits, requestsPerHour: v } })
+              }
+              t={t}
+            />
+            <RoleLimitControl
+              label={t('admin.aiSettings.administrators')}
+              enabled={settings.adminLimits.enabled}
+              requestsPerHour={settings.adminLimits.requestsPerHour}
+              onEnabledChange={(v) =>
+                update({ adminLimits: { ...settings.adminLimits, enabled: v } })
+              }
+              onLimitChange={(v) =>
+                update({ adminLimits: { ...settings.adminLimits, requestsPerHour: v } })
+              }
+              t={t}
+            />
+          </CardContent>
+        </Card>
+      </div>
+
+      <div className="flex gap-2">
+        <Button onClick={handleSave} disabled={saveMutation.isPending}>
+          {saveMutation.isPending ? t('admin.aiSettings.saving') : t('admin.aiSettings.saveSettings')}
+        </Button>
+        <Button variant="outline" onClick={onBack}>
+          {t('admin.aiSettings.cancel')}
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/client/src/components/admin/settings/CalendarSettingsPanel.tsx b/client/src/components/admin/settings/CalendarSettingsPanel.tsx
index 1b4907f1..e11a9b55 100644
--- a/client/src/components/admin/settings/CalendarSettingsPanel.tsx
+++ b/client/src/components/admin/settings/CalendarSettingsPanel.tsx
@@ -37,15 +37,15 @@ export function CalendarSettingsPanel({ onBack }: { onBack: () => void }) {
   
   const [settings, setSettings] = useState<CalendarSettings>({
     prefixEnabled: true,
-    tentativePrefix: 'Vorläufig',
-    confirmedPrefix: 'Bestätigt',
-    myChoicePrefix: '[Meine Wahl]',
+    tentativePrefix: t('admin.calendar.defaults.tentativePrefix'),
+    confirmedPrefix: t('admin.calendar.defaults.confirmedPrefix'),
+    myChoicePrefix: t('admin.calendar.defaults.myChoicePrefix'),
     exportScope: 'all',
     markOwnChoices: false,
     highlightFinalDate: true,
     prefixesLocalized: {
-      de: { tentative: 'Vorläufig', confirmed: 'Bestätigt', myChoice: '[Meine Wahl]' },
-      en: { tentative: 'Tentative', confirmed: 'Confirmed', myChoice: '[My Choice]' },
+      de: { tentative: t('admin.calendar.defaults.deTentative'), confirmed: t('admin.calendar.defaults.deConfirmed'), myChoice: t('admin.calendar.defaults.deMyChoice') },
+      en: { tentative: t('admin.calendar.defaults.enTentative'), confirmed: t('admin.calendar.defaults.enConfirmed'), myChoice: t('admin.calendar.defaults.enMyChoice') },
     },
   });
 
@@ -145,7 +145,7 @@ export function CalendarSettingsPanel({ onBack }: { onBack: () => void }) {
                           id="de-tentative"
                           value={settings.prefixesLocalized.de?.tentative || ''}
                           onChange={(e) => updateLocalizedPrefix('de', 'tentative', e.target.value)}
-                          placeholder="Vorläufig"
+                          placeholder={t('admin.calendar.placeholders.deTentative')}
                         />
                       </div>
                       <div>
@@ -154,7 +154,7 @@ export function CalendarSettingsPanel({ onBack }: { onBack: () => void }) {
                           id="de-confirmed"
                           value={settings.prefixesLocalized.de?.confirmed || ''}
                           onChange={(e) => updateLocalizedPrefix('de', 'confirmed', e.target.value)}
-                          placeholder="Bestätigt"
+                          placeholder={t('admin.calendar.placeholders.deConfirmed')}
                         />
                       </div>
                       <div>
@@ -163,7 +163,7 @@ export function CalendarSettingsPanel({ onBack }: { onBack: () => void }) {
                           id="de-myChoice"
                           value={settings.prefixesLocalized.de?.myChoice || ''}
                           onChange={(e) => updateLocalizedPrefix('de', 'myChoice', e.target.value)}
-                          placeholder="[Meine Wahl]"
+                          placeholder={t('admin.calendar.placeholders.deMyChoice')}
                         />
                       </div>
                     </div>
@@ -177,7 +177,7 @@ export function CalendarSettingsPanel({ onBack }: { onBack: () => void }) {
                           id="en-tentative"
                           value={settings.prefixesLocalized.en?.tentative || ''}
                           onChange={(e) => updateLocalizedPrefix('en', 'tentative', e.target.value)}
-                          placeholder="Tentative"
+                          placeholder={t('admin.calendar.placeholders.enTentative')}
                         />
                       </div>
                       <div>
@@ -186,7 +186,7 @@ export function CalendarSettingsPanel({ onBack }: { onBack: () => void }) {
                           id="en-confirmed"
                           value={settings.prefixesLocalized.en?.confirmed || ''}
                           onChange={(e) => updateLocalizedPrefix('en', 'confirmed', e.target.value)}
-                          placeholder="Confirmed"
+                          placeholder={t('admin.calendar.placeholders.enConfirmed')}
                         />
                       </div>
                       <div>
@@ -195,7 +195,7 @@ export function CalendarSettingsPanel({ onBack }: { onBack: () => void }) {
                           id="en-myChoice"
                           value={settings.prefixesLocalized.en?.myChoice || ''}
                           onChange={(e) => updateLocalizedPrefix('en', 'myChoice', e.target.value)}
-                          placeholder="[My Choice]"
+                          placeholder={t('admin.calendar.placeholders.enMyChoice')}
                         />
                       </div>
                     </div>
diff --git a/client/src/components/admin/settings/EmailSettingsPanel.tsx b/client/src/components/admin/settings/EmailSettingsPanel.tsx
index dbded88a..bd324362 100644
--- a/client/src/components/admin/settings/EmailSettingsPanel.tsx
+++ b/client/src/components/admin/settings/EmailSettingsPanel.tsx
@@ -1,21 +1,63 @@
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
+import { useQuery } from '@tanstack/react-query';
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Badge } from "@/components/ui/badge";
 import { Label } from "@/components/ui/label";
 import { Switch } from "@/components/ui/switch";
+import { Alert, AlertDescription } from "@/components/ui/alert";
 import { useToast } from "@/hooks/use-toast";
+import { apiRequest } from "@/lib/queryClient";
+import { Skeleton } from "@/components/ui/skeleton";
 import { 
   Mail,
   ArrowLeft,
   ChevronRight,
-  CheckCircle
+  CheckCircle,
+  XCircle,
+  Info,
+  AlertTriangle,
+  Loader2
 } from "lucide-react";
 
+interface SmtpConfig {
+  configured: boolean;
+  host: string;
+  port: number;
+  user: string;
+  hasPassword: boolean;
+  secure: boolean;
+  fromEmail: string;
+  fromName: string;
+}
+
 export function EmailSettingsPanel({ onBack }: { onBack: () => void }) {
   const { t } = useTranslation();
   const { toast } = useToast();
+  const [isTesting, setIsTesting] = useState(false);
+
+  const { data: config, isLoading, isError } = useQuery<SmtpConfig>({
+    queryKey: ['/api/v1/smtp-config'],
+  });
+
+  const handleTestConnection = async () => {
+    setIsTesting(true);
+    try {
+      const res = await apiRequest('POST', '/api/v1/smtp-test');
+      const result = await res.json();
+      if (result.success) {
+        toast({ title: t('admin.emailSettings.testEmail'), description: t('admin.emailSettings.testSuccess') });
+      } else {
+        toast({ title: t('admin.emailSettings.testFailed'), description: result.error || t('admin.emailSettings.testError'), variant: 'destructive' });
+      }
+    } catch {
+      toast({ title: t('admin.emailSettings.testFailed'), description: t('admin.emailSettings.testError'), variant: 'destructive' });
+    } finally {
+      setIsTesting(false);
+    }
+  };
   
   return (
     <div className="space-y-6">
@@ -33,12 +75,40 @@ export function EmailSettingsPanel({ onBack }: { onBack: () => void }) {
           <h2 className="text-2xl font-semibold text-foreground">{t('admin.emailSettings.emailConfig')}</h2>
           <p className="text-muted-foreground">{t('admin.emailSettings.smtpDescription')}</p>
         </div>
-        <Badge variant="outline" className="text-green-600 border-green-600">
-          <CheckCircle className="w-3 h-3 mr-1" />
-          {t('admin.emailSettings.active')}
-        </Badge>
+        {isLoading ? (
+          <Skeleton className="h-6 w-16" />
+        ) : config?.configured ? (
+          <Badge variant="outline" className="text-green-600 border-green-600">
+            <CheckCircle className="w-3 h-3 mr-1" />
+            {t('admin.emailSettings.active')}
+          </Badge>
+        ) : (
+          <Badge variant="outline" className="text-yellow-600 border-yellow-600">
+            <XCircle className="w-3 h-3 mr-1" />
+            {t('admin.emailSettings.inactive')}
+          </Badge>
+        )}
       </div>
 
+      {!isLoading && isError && (
+        <Alert variant="destructive">
+          <AlertTriangle className="h-4 w-4" />
+          <AlertDescription>{t('admin.emailSettings.testError')}</AlertDescription>
+        </Alert>
+      )}
+
+      {!isLoading && !isError && !config?.configured && (
+        <Alert variant="destructive">
+          <AlertTriangle className="h-4 w-4" />
+          <AlertDescription>{t('admin.emailSettings.notConfigured')}</AlertDescription>
+        </Alert>
+      )}
+
+      <Alert>
+        <Info className="h-4 w-4" />
+        <AlertDescription>{t('admin.emailSettings.envHint')}</AlertDescription>
+      </Alert>
+
       <Card className="polly-card">
         <CardHeader>
           <CardTitle className="flex items-center">
@@ -48,55 +118,79 @@ export function EmailSettingsPanel({ onBack }: { onBack: () => void }) {
           <CardDescription>{t('admin.emailSettings.smtpSettingsDescription')}</CardDescription>
         </CardHeader>
         <CardContent className="space-y-4">
-          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-            <div>
-              <Label htmlFor="smtp-host">{t('admin.emailSettings.smtpHost')}</Label>
-              <Input id="smtp-host" placeholder="smtp.example.com" data-testid="input-smtp-host" />
-            </div>
-            <div>
-              <Label htmlFor="smtp-port">{t('admin.emailSettings.port')}</Label>
-              <Input id="smtp-port" placeholder="587" data-testid="input-smtp-port" />
-            </div>
-          </div>
-          
-          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-            <div>
-              <Label htmlFor="smtp-user">{t('admin.emailSettings.username')}</Label>
-              <Input id="smtp-user" placeholder="user@example.com" data-testid="input-smtp-user" />
-            </div>
-            <div>
-              <Label htmlFor="smtp-pass">{t('admin.emailSettings.password')}</Label>
-              <Input id="smtp-pass" type="password" placeholder="••••••••" data-testid="input-smtp-pass" />
+          {isLoading ? (
+            <div className="space-y-4">
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <Skeleton className="h-10" />
+                <Skeleton className="h-10" />
+              </div>
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <Skeleton className="h-10" />
+                <Skeleton className="h-10" />
+              </div>
+              <Skeleton className="h-10" />
+              <Skeleton className="h-10" />
             </div>
-          </div>
-          
-          <div>
-            <Label htmlFor="from-email">{t('admin.emailSettings.senderEmail')}</Label>
-            <Input id="from-email" placeholder="noreply@polly-poll.bayern.de" data-testid="input-from-email" />
-          </div>
+          ) : (
+            <>
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <div>
+                  <Label htmlFor="smtp-host">{t('admin.emailSettings.smtpHost')}</Label>
+                  <Input id="smtp-host" value={config?.host || ''} readOnly className="bg-muted" data-testid="input-smtp-host" />
+                </div>
+                <div>
+                  <Label htmlFor="smtp-port">{t('admin.emailSettings.port')}</Label>
+                  <Input id="smtp-port" value={config?.port || ''} readOnly className="bg-muted" data-testid="input-smtp-port" />
+                </div>
+              </div>
+              
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <div>
+                  <Label htmlFor="smtp-user">{t('admin.emailSettings.username')}</Label>
+                  <Input id="smtp-user" value={config?.user || ''} readOnly className="bg-muted" data-testid="input-smtp-user" />
+                </div>
+                <div>
+                  <Label htmlFor="smtp-pass">{t('admin.emailSettings.password')}</Label>
+                  <Input id="smtp-pass" type="password" value={config?.hasPassword ? '••••••••' : ''} readOnly className="bg-muted" data-testid="input-smtp-pass" />
+                </div>
+              </div>
+              
+              <div>
+                <Label htmlFor="from-email">{t('admin.emailSettings.senderEmail')}</Label>
+                <Input id="from-email" value={config?.fromEmail || ''} readOnly className="bg-muted" data-testid="input-from-email" />
+              </div>
 
-          <div>
-            <Label htmlFor="from-name">{t('admin.emailSettings.senderName')}</Label>
-            <Input id="from-name" placeholder="Polly System" data-testid="input-from-name" />
-          </div>
+              <div>
+                <Label htmlFor="from-name">{t('admin.emailSettings.senderName')}</Label>
+                <Input id="from-name" value={config?.fromName || ''} readOnly className="bg-muted" data-testid="input-from-name" />
+              </div>
 
-          <div className="flex items-center space-x-2 pt-2">
-            <Switch id="smtp-tls" defaultChecked data-testid="switch-smtp-tls" />
-            <Label htmlFor="smtp-tls">{t('admin.emailSettings.useTls')}</Label>
-          </div>
+              <div className="flex items-center space-x-2 pt-2">
+                <Switch id="smtp-tls" checked={config?.secure ?? false} disabled data-testid="switch-smtp-tls" />
+                <Label htmlFor="smtp-tls">{t('admin.emailSettings.useTls')}</Label>
+              </div>
 
-          <div className="flex justify-end space-x-2 pt-4">
-            <Button variant="outline" data-testid="button-test-email">
-              {t('admin.emailSettings.testEmail')}
-            </Button>
-            <Button 
-              className="polly-button-primary" 
-              data-testid="button-save-email"
-              onClick={() => toast({ title: t('admin.emailSettings.saved'), description: t('admin.emailSettings.emailSaved') })}
-            >
-              {t('admin.emailSettings.saveSettings')}
-            </Button>
-          </div>
+              {config?.configured && (
+                <div className="flex justify-end pt-4">
+                  <Button 
+                    variant="outline" 
+                    data-testid="button-test-email"
+                    onClick={handleTestConnection}
+                    disabled={isTesting}
+                  >
+                    {isTesting ? (
+                      <>
+                        <Loader2 className="w-4 h-4 mr-2 animate-spin" />
+                        {t('admin.emailSettings.testing')}
+                      </>
+                    ) : (
+                      t('admin.emailSettings.testEmail')
+                    )}
+                  </Button>
+                </div>
+              )}
+            </>
+          )}
         </CardContent>
       </Card>
     </div>
diff --git a/client/src/components/admin/settings/EmailTemplatesPanel.tsx b/client/src/components/admin/settings/EmailTemplatesPanel.tsx
index 18303aa8..4d890ce2 100644
--- a/client/src/components/admin/settings/EmailTemplatesPanel.tsx
+++ b/client/src/components/admin/settings/EmailTemplatesPanel.tsx
@@ -6,6 +6,7 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Textarea } from "@/components/ui/textarea";
 import { Badge } from "@/components/ui/badge";
+import { InDevelopmentBadge } from "@/components/ui/InDevelopmentBadge";
 import { Label } from "@/components/ui/label";
 import { useToast } from "@/hooks/use-toast";
 import { apiRequest } from "@/lib/queryClient";
@@ -268,10 +269,26 @@ export function EmailTemplatesPanel({ onBack }: { onBack: () => void }) {
     },
   });
 
+  const stripBase64Images = (obj: unknown): unknown => {
+    if (typeof obj === 'string' && obj.startsWith('data:image/')) {
+      return '[image-removed]';
+    }
+    if (Array.isArray(obj)) {
+      return obj.map(stripBase64Images);
+    }
+    if (obj && typeof obj === 'object') {
+      return Object.fromEntries(
+        Object.entries(obj as Record<string, unknown>).map(([k, v]) => [k, stripBase64Images(v)])
+      );
+    }
+    return obj;
+  };
+
   const handleThemeJsonPreview = () => {
     try {
       const parsed = JSON.parse(themeJsonInput);
-      previewThemeMutation.mutate(parsed);
+      const cleaned = stripBase64Images(parsed);
+      previewThemeMutation.mutate(cleaned);
     } catch {
       toast({ title: t('admin.emailTemplates.toasts.invalidJson'), description: t('admin.emailTemplates.toasts.invalidJsonDescription'), variant: 'destructive' });
     }
@@ -320,16 +337,20 @@ export function EmailTemplatesPanel({ onBack }: { onBack: () => void }) {
 
       {!selectedTemplate ? (
         <>
-          <Card className="polly-card">
+          <Card className="polly-card relative">
             <CardHeader className="pb-3">
               <div className="flex items-center justify-between">
-                <div className="flex items-center space-x-3">
+                <div className="flex items-center space-x-3 opacity-50">
                   <div className="p-2 bg-primary/10 rounded-lg text-primary">
                     <Palette className="w-5 h-5" />
                   </div>
                   <div>
                     <CardTitle className="text-lg">{t('admin.emailTemplates.emailTheme')}</CardTitle>
                     <CardDescription>{t('admin.emailTemplates.themeDescription')}</CardDescription>
+                    <p className="text-xs text-muted-foreground mt-1 flex items-center gap-1">
+                      <Info className="w-3 h-3 shrink-0" />
+                      {t('admin.emailTemplates.themeHint')}
+                    </p>
                   </div>
                 </div>
                 <div className="flex items-center space-x-2">
@@ -343,20 +364,32 @@ export function EmailTemplatesPanel({ onBack }: { onBack: () => void }) {
                     <RotateCcw className="w-4 h-4 mr-1" />
                     {t('admin.emailTemplates.resetTheme')}
                   </Button>
-                  <Button
-                    size="sm"
-                    onClick={() => setShowThemeImport(true)}
-                    data-testid="button-import-theme"
-                  >
-                    <Upload className="w-4 h-4 mr-1" />
-                    {t('admin.emailTemplates.importTheme')}
-                  </Button>
+                  <Tooltip>
+                    <TooltipTrigger asChild>
+                      <div className="inline-flex items-center gap-2 cursor-default" data-testid="button-import-theme">
+                        <Button
+                          size="sm"
+                          variant="ghost"
+                          disabled
+                          className="pointer-events-none opacity-50"
+                          tabIndex={-1}
+                        >
+                          <Upload className="w-4 h-4 mr-1" />
+                          {t('admin.emailTemplates.importTheme')}
+                        </Button>
+                        <InDevelopmentBadge />
+                      </div>
+                    </TooltipTrigger>
+                    <TooltipContent>
+                      <p>{t('admin.emailTemplates.importThemeDisabledHint')}</p>
+                    </TooltipContent>
+                  </Tooltip>
                 </div>
               </div>
             </CardHeader>
             <CardContent>
               {emailTheme && (
-                <div className="grid grid-cols-2 md:grid-cols-4 gap-4">
+                <div className="grid grid-cols-2 md:grid-cols-4 gap-4 opacity-50">
                   <div className="space-y-1">
                     <Label className="text-xs text-muted-foreground">{t('admin.emailTemplates.backdrop')}</Label>
                     <div className="flex items-center space-x-2">
@@ -453,7 +486,8 @@ export function EmailTemplatesPanel({ onBack }: { onBack: () => void }) {
                   onClick={() => {
                     try {
                       const parsed = JSON.parse(themeJsonInput);
-                      confirmThemeImportMutation.mutate(parsed);
+                      const cleaned = stripBase64Images(parsed);
+                      confirmThemeImportMutation.mutate(cleaned);
                     } catch {
                       toast({ title: t('admin.emailTemplates.toasts.invalidJson'), description: t('admin.emailTemplates.toasts.invalidJsonDescription'), variant: 'destructive' });
                     }
diff --git a/client/src/components/admin/settings/MatrixSettingsPanel.tsx b/client/src/components/admin/settings/MatrixSettingsPanel.tsx
index bb650f7a..936c4030 100644
--- a/client/src/components/admin/settings/MatrixSettingsPanel.tsx
+++ b/client/src/components/admin/settings/MatrixSettingsPanel.tsx
@@ -1,116 +1,26 @@
-import { useState, useEffect } from "react";
 import { useTranslation } from 'react-i18next';
-import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
+import { Card, CardContent } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
-import { Input } from "@/components/ui/input";
-import { Badge } from "@/components/ui/badge";
-import { Label } from "@/components/ui/label";
-import { Switch } from "@/components/ui/switch";
-import { useToast } from "@/hooks/use-toast";
-import { apiRequest } from "@/lib/queryClient";
+import { InDevelopmentBadge } from "@/components/ui/InDevelopmentBadge";
 import { 
   MessageSquare,
-  Building2,
-  Wifi,
-  AlertCircle,
   ArrowLeft,
   ChevronRight,
-  Loader2,
-  CheckCircle,
-  XCircle,
-  Eye,
-  EyeOff
+  Users,
+  Bell,
+  Bot,
+  BarChart3
 } from "lucide-react";
 
-interface MatrixSettings {
-  enabled: boolean;
-  homeserverUrl: string;
-  botUserId: string;
-  botAccessToken: string;
-  searchEnabled: boolean;
-}
-
 export function MatrixSettingsPanel({ onBack }: { onBack: () => void }) {
   const { t } = useTranslation();
-  const { toast } = useToast();
-  const queryClient = useQueryClient();
-  
-  const [matrixEnabled, setMatrixEnabled] = useState(false);
-  const [homeserverUrl, setHomeserverUrl] = useState('');
-  const [botUserId, setBotUserId] = useState('');
-  const [botAccessToken, setBotAccessToken] = useState('');
-  const [searchEnabled, setSearchEnabled] = useState(true);
-  const [showToken, setShowToken] = useState(false);
-  const [testStatus, setTestStatus] = useState<'idle' | 'testing' | 'success' | 'error'>('idle');
-  const [testMessage, setTestMessage] = useState('');
-
-  const { data: customization, isLoading } = useQuery<{ matrix?: MatrixSettings }>({
-    queryKey: ['/api/v1/admin/customization'],
-  });
-
-  useEffect(() => {
-    if (customization?.matrix) {
-      setMatrixEnabled(customization.matrix.enabled);
-      setHomeserverUrl(customization.matrix.homeserverUrl);
-      setBotUserId(customization.matrix.botUserId);
-      setSearchEnabled(customization.matrix.searchEnabled);
-    }
-  }, [customization]);
-
-  const saveMutation = useMutation({
-    mutationFn: async (settings: MatrixSettings) => {
-      const response = await apiRequest('PUT', '/api/v1/admin/customization', {
-        matrix: settings,
-      });
-      return response.json();
-    },
-    onSuccess: () => {
-      toast({ title: t('admin.toasts.saved'), description: t('admin.matrix.saved') });
-      queryClient.invalidateQueries({ queryKey: ['/api/v1/admin/customization'] });
-      setBotAccessToken('');
-    },
-    onError: () => {
-      toast({ title: t('errors.generic'), description: t('admin.toasts.settingsSaveError'), variant: "destructive" });
-    }
-  });
-
-  const handleSave = () => {
-    saveMutation.mutate({
-      enabled: matrixEnabled,
-      homeserverUrl,
-      botUserId,
-      botAccessToken: botAccessToken || '',
-      searchEnabled,
-    });
-  };
-
-  const handleTestConnection = async () => {
-    setTestStatus('testing');
-    setTestMessage('');
-    try {
-      const response = await apiRequest('POST', '/api/v1/matrix/test');
-      const result = await response.json();
-      if (result.success) {
-        setTestStatus('success');
-        setTestMessage(t('admin.matrix.connectedAs', { userId: result.userId }));
-      } else {
-        setTestStatus('error');
-        setTestMessage(result.error || t('admin.matrix.connectionFailed'));
-      }
-    } catch (error: any) {
-      setTestStatus('error');
-      setTestMessage(t('admin.matrix.connectionTestFailed'));
-    }
-  };
 
-  if (isLoading) {
-    return (
-      <div className="flex items-center justify-center h-64">
-        <Loader2 className="w-8 h-8 animate-spin text-muted-foreground" />
-      </div>
-    );
-  }
+  const features = [
+    { icon: Bot, labelKey: 'admin.matrix.comingSoon.feature1' },
+    { icon: Users, labelKey: 'admin.matrix.comingSoon.feature2' },
+    { icon: Bell, labelKey: 'admin.matrix.comingSoon.feature3' },
+    { icon: BarChart3, labelKey: 'admin.matrix.comingSoon.feature4' },
+  ];
 
   return (
     <div className="space-y-6">
@@ -120,7 +30,7 @@ export function MatrixSettingsPanel({ onBack }: { onBack: () => void }) {
           {t('admin.matrix.backToSettings')}
         </Button>
         <ChevronRight className="w-4 h-4" />
-        <span className="font-medium text-foreground">Matrix Chat</span>
+        <span className="font-medium text-foreground">{t('admin.matrix.title')}</span>
       </div>
 
       <div className="flex items-center justify-between">
@@ -128,229 +38,46 @@ export function MatrixSettingsPanel({ onBack }: { onBack: () => void }) {
           <h2 className="text-2xl font-semibold text-foreground">{t('admin.matrix.title')}</h2>
           <p className="text-muted-foreground">{t('admin.matrix.description')}</p>
         </div>
-        <Badge variant="outline" className={matrixEnabled ? "text-green-600 border-green-600" : "text-muted-foreground border-muted"}>
-          {matrixEnabled ? (
-            <>
-              <CheckCircle className="w-3 h-3 mr-1" />
-              {t('admin.matrix.enabled')}
-            </>
-          ) : (
-            <>
-              <XCircle className="w-3 h-3 mr-1" />
-              {t('admin.matrix.disabled')}
-            </>
-          )}
-        </Badge>
+        <InDevelopmentBadge size="md" />
       </div>
 
-      <Card className="polly-card">
-        <CardHeader>
-          <CardTitle className="flex items-center justify-between">
-            <div className="flex items-center">
-              <MessageSquare className="w-5 h-5 mr-2" />
-              {t('admin.matrix.connection')}
-            </div>
-            {saveMutation.isPending && (
-              <Loader2 className="w-4 h-4 animate-spin text-muted-foreground" />
-            )}
-          </CardTitle>
-          <CardDescription>{t('admin.matrix.connectionDescription')}</CardDescription>
-        </CardHeader>
-        <CardContent className="space-y-6">
-          <div className={`flex items-center justify-between p-4 border rounded-lg ${matrixEnabled ? 'bg-green-50 dark:bg-green-950/30 border-green-200 dark:border-green-800' : 'bg-muted/50 border-muted'}`}>
-            <div className="flex items-center space-x-4">
-              <div className={`p-3 rounded-lg ${matrixEnabled ? 'bg-green-100 dark:bg-green-900/50' : 'bg-muted'}`}>
-                <MessageSquare className={`w-6 h-6 ${matrixEnabled ? 'text-green-600 dark:text-green-400' : 'text-muted-foreground'}`} />
-              </div>
-              <div>
-                <p className="font-medium text-foreground">{t('admin.matrix.enableIntegration')}</p>
-                <p className="text-sm text-muted-foreground">
-                  {matrixEnabled 
-                    ? t('admin.matrix.ssoUsersCanReceive') 
-                    : t('admin.matrix.onlyEmailActive')}
-                </p>
-              </div>
-            </div>
-            <Switch 
-              id="matrix-enabled" 
-              checked={matrixEnabled}
-              onCheckedChange={setMatrixEnabled}
-              data-testid="switch-matrix-enabled" 
-            />
-          </div>
-
-          {matrixEnabled && (
-            <>
-              <div className="p-4 border rounded-lg bg-blue-50 dark:bg-blue-950/30 border-blue-200 dark:border-blue-800">
-                <div className="flex items-start space-x-3">
-                  <Building2 className="w-5 h-5 text-blue-600 dark:text-blue-400 mt-0.5" />
-                  <div>
-                    <p className="font-medium text-blue-800 dark:text-blue-200">{t('admin.matrix.homeserverUrl')}</p>
-                    <p className="text-sm text-blue-700 dark:text-blue-300">
-                      {t('admin.matrix.homeserverNote')}
-                    </p>
-                  </div>
-                </div>
-              </div>
+      <Card className="polly-card overflow-hidden">
+        <CardContent className="p-0">
+          <div className="relative">
+            <div className="absolute inset-0 bg-gradient-to-br from-purple-500/5 via-transparent to-blue-500/5 dark:from-purple-500/10 dark:to-blue-500/10" />
 
-              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-                <div>
-                  <Label htmlFor="matrix-homeserver">{t('admin.matrix.homeserverUrl')}</Label>
-                  <Input 
-                    id="matrix-homeserver" 
-                    placeholder="https://matrix.example.com"
-                    value={homeserverUrl}
-                    onChange={(e) => setHomeserverUrl(e.target.value)}
-                    data-testid="input-matrix-homeserver"
-                  />
-                  <p className="text-xs text-muted-foreground mt-1">{t('admin.matrix.homeserverUrlLabel')}</p>
-                </div>
-                <div>
-                  <Label htmlFor="matrix-bot-user">{t('admin.matrix.botUserId')}</Label>
-                  <Input 
-                    id="matrix-bot-user" 
-                    placeholder="@pollbot:matrix.example.com"
-                    value={botUserId}
-                    onChange={(e) => setBotUserId(e.target.value)}
-                    data-testid="input-matrix-bot-user"
-                  />
-                  <p className="text-xs text-muted-foreground mt-1">{t('admin.matrix.botUserIdLabel')}</p>
-                </div>
+            <div className="relative px-8 py-12 text-center">
+              <div className="inline-flex items-center justify-center w-16 h-16 rounded-2xl bg-gradient-to-br from-purple-100 to-blue-100 dark:from-purple-900/40 dark:to-blue-900/40 mb-6">
+                <MessageSquare className="w-8 h-8 text-purple-600 dark:text-purple-400" />
               </div>
 
-              <div>
-                <Label htmlFor="matrix-token">{t('admin.matrix.botAccessToken')}</Label>
-                <div className="relative">
-                  <Input 
-                    id="matrix-token" 
-                    type={showToken ? "text" : "password"}
-                    placeholder={customization?.matrix?.botAccessToken ? "••••••••••••••••" : "syt_xxx..."}
-                    value={botAccessToken}
-                    onChange={(e) => setBotAccessToken(e.target.value)}
-                    data-testid="input-matrix-token"
-                  />
-                  <Button
-                    type="button"
-                    variant="ghost"
-                    size="sm"
-                    className="absolute right-0 top-0 h-full px-3"
-                    onClick={() => setShowToken(!showToken)}
-                  >
-                    {showToken ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
-                  </Button>
-                </div>
-                <p className="text-xs text-muted-foreground mt-1">
-                  {t('admin.matrix.leaveEmptyToKeep')}
-                </p>
-              </div>
+              <h3 className="text-xl font-semibold text-foreground mb-3">
+                {t('admin.matrix.comingSoon.title')}
+              </h3>
 
-              <div className="flex items-center space-x-2 p-4 border rounded-lg">
-                <Switch 
-                  id="matrix-search" 
-                  checked={searchEnabled}
-                  onCheckedChange={setSearchEnabled}
-                  data-testid="switch-matrix-search"
-                />
-                <div className="flex-1">
-                  <Label htmlFor="matrix-search" className="font-medium">{t('admin.matrix.userDirectorySearch')}</Label>
-                  <p className="text-sm text-muted-foreground">
-                    {t('admin.matrix.searchDescription')}
-                  </p>
-                </div>
-              </div>
+              <p className="text-muted-foreground max-w-md mx-auto leading-relaxed mb-8">
+                {t('admin.matrix.comingSoon.description')}
+              </p>
 
-              <div className="flex items-center justify-between pt-2">
-                <div className="flex items-center space-x-2">
-                  <Button 
-                    variant="outline" 
-                    onClick={handleTestConnection}
-                    disabled={testStatus === 'testing' || !homeserverUrl || !botUserId}
-                    data-testid="button-test-matrix"
+              <div className="grid grid-cols-1 sm:grid-cols-2 gap-3 max-w-lg mx-auto mb-8">
+                {features.map((feature, index) => (
+                  <div
+                    key={index}
+                    className="flex items-center gap-3 p-3 rounded-lg bg-muted/50 dark:bg-muted/30 text-left"
                   >
-                    {testStatus === 'testing' ? (
-                      <>
-                        <Loader2 className="w-4 h-4 mr-2 animate-spin" />
-                        {t('admin.matrix.testing')}
-                      </>
-                    ) : (
-                      <>
-                        <Wifi className="w-4 h-4 mr-2" />
-                        {t('admin.matrix.testConnection')}
-                      </>
-                    )}
-                  </Button>
-                  {testStatus === 'success' && (
-                    <span className="text-sm text-green-600 dark:text-green-400 flex items-center">
-                      <CheckCircle className="w-4 h-4 mr-1" />
-                      {testMessage}
-                    </span>
-                  )}
-                  {testStatus === 'error' && (
-                    <span className="text-sm text-red-600 dark:text-red-400 flex items-center">
-                      <XCircle className="w-4 h-4 mr-1" />
-                      {testMessage}
-                    </span>
-                  )}
-                </div>
-                <Button 
-                  onClick={handleSave}
-                  disabled={saveMutation.isPending || !homeserverUrl || !botUserId}
-                  className="polly-button-primary"
-                  data-testid="button-save-matrix"
-                >
-                  {saveMutation.isPending ? (
-                    <>
-                      <Loader2 className="w-4 h-4 mr-2 animate-spin" />
-                      {t('admin.matrix.saving')}
-                    </>
-                  ) : (
-                    t('admin.matrix.saveSettings')
-                  )}
-                </Button>
+                    <feature.icon className="w-4 h-4 text-muted-foreground shrink-0" />
+                    <span className="text-sm text-foreground">{t(feature.labelKey)}</span>
+                  </div>
+                ))}
               </div>
-            </>
-          )}
-        </CardContent>
-      </Card>
 
-      {matrixEnabled && (
-        <Card className="polly-card">
-          <CardHeader>
-            <CardTitle className="flex items-center">
-              <AlertCircle className="w-5 h-5 mr-2" />
-              {t('admin.matrix.setupTitle')}
-            </CardTitle>
-          </CardHeader>
-          <CardContent className="space-y-4">
-            <div className="space-y-3 text-sm">
-              <div className="flex items-start space-x-3 p-3 bg-muted rounded-lg">
-                <span className="font-bold text-polly-orange">1.</span>
-                <div>
-                  <p className="font-medium">{t('admin.matrix.setupHints.createBotAccount')}</p>
-                  <p className="text-muted-foreground">{t('admin.matrix.setupHints.createBotAccountDescription')}</p>
-                </div>
-              </div>
-              <div className="flex items-start space-x-3 p-3 bg-muted rounded-lg">
-                <span className="font-bold text-polly-orange">2.</span>
-                <div>
-                  <p className="font-medium">{t('admin.matrix.setupHints.generateToken')}</p>
-                  <p className="text-muted-foreground">{t('admin.matrix.setupHints.generateTokenDescription')}</p>
-                </div>
-              </div>
-              <div className="flex items-start space-x-3 p-3 bg-muted rounded-lg">
-                <span className="font-bold text-polly-orange">3.</span>
-                <div>
-                  <p className="font-medium">{t('admin.matrix.setupHints.userDirectory')}</p>
-                  <p className="text-muted-foreground">
-                    {t('admin.matrix.setupHints.userDirectoryDescription')} 
-                    <code className="mx-1 px-1 bg-background rounded">user_directory.search_all_users: true</code>
-                  </p>
-                </div>
-              </div>
+              <p className="text-xs text-muted-foreground">
+                {t('admin.matrix.comingSoon.timeline')}
+              </p>
             </div>
-          </CardContent>
-        </Card>
-      )}
+          </div>
+        </CardContent>
+      </Card>
     </div>
   );
 }
diff --git a/client/src/components/admin/settings/OIDCSettingsPanel.tsx b/client/src/components/admin/settings/OIDCSettingsPanel.tsx
index 3cc682ad..c2476191 100644
--- a/client/src/components/admin/settings/OIDCSettingsPanel.tsx
+++ b/client/src/components/admin/settings/OIDCSettingsPanel.tsx
@@ -7,36 +7,74 @@ import { Input } from "@/components/ui/input";
 import { Badge } from "@/components/ui/badge";
 import { Label } from "@/components/ui/label";
 import { Switch } from "@/components/ui/switch";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Skeleton } from "@/components/ui/skeleton";
 import { useToast } from "@/hooks/use-toast";
 import { apiRequest } from "@/lib/queryClient";
 import { 
   Key,
+  KeyRound,
   ArrowLeft,
   ChevronRight,
   CheckCircle,
+  XCircle,
   AlertCircle,
   Building2,
   Loader2,
   UserPlus,
-  UserX
+  UserX,
+  Info,
+  AlertTriangle
 } from "lucide-react";
 
+interface OidcConfig {
+  configured: boolean;
+  enabled: boolean;
+  issuerUrl: string;
+  clientId: string;
+  hasClientSecret: boolean;
+  callbackUrl: string;
+}
+
 export function OIDCSettingsPanel({ onBack }: { onBack: () => void }) {
   const { t } = useTranslation();
   const { toast } = useToast();
   const queryClient = useQueryClient();
+  const [isTesting, setIsTesting] = useState(false);
   
-  const { data: authMethods } = useQuery<{ local: boolean; keycloak: boolean; registrationEnabled: boolean }>({
+  const { data: authMethods } = useQuery<{ local: boolean; keycloak: boolean; registrationEnabled: boolean; ssoButtonLabel?: string }>({
     queryKey: ['/api/v1/auth/methods'],
   });
+
+  const { data: oidcConfig, isLoading: configLoading, isError: configError } = useQuery<OidcConfig>({
+    queryKey: ['/api/v1/oidc-config'],
+  });
   
   const [registrationEnabled, setRegistrationEnabled] = useState<boolean>(true);
+  const [ssoButtonLabel, setSsoButtonLabel] = useState<string>('');
   
   useEffect(() => {
     if (authMethods) {
       setRegistrationEnabled(authMethods.registrationEnabled);
     }
   }, [authMethods]);
+
+  const { data: settings } = useQuery<any[]>({
+    queryKey: ['/api/v1/admin/settings'],
+  });
+
+  const ssoLabelFromDb = settings?.find((s: any) => s.key === 'oidc_button_label')?.value;
+  const ssoLabelIsFromEnv = !ssoLabelFromDb && !!authMethods?.ssoButtonLabel;
+
+  useEffect(() => {
+    if (settings) {
+      if (ssoLabelFromDb) {
+        setSsoButtonLabel(typeof ssoLabelFromDb === 'string' ? ssoLabelFromDb : '');
+      } else if (authMethods?.ssoButtonLabel) {
+        setSsoButtonLabel(authMethods.ssoButtonLabel);
+      }
+    }
+  }, [settings, authMethods, ssoLabelFromDb]);
   
   const saveRegistrationMutation = useMutation({
     mutationFn: async (enabled: boolean) => {
@@ -70,6 +108,53 @@ export function OIDCSettingsPanel({ onBack }: { onBack: () => void }) {
     setRegistrationEnabled(enabled);
     saveRegistrationMutation.mutate(enabled);
   };
+
+  const saveSsoLabelMutation = useMutation({
+    mutationFn: async (label: string) => {
+      const res = await apiRequest('POST', '/api/v1/admin/settings', {
+        key: 'oidc_button_label',
+        value: label,
+        description: t('admin.oidc.ssoButtonLabelSettingDescription')
+      });
+      return res.json();
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/auth/methods'] });
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/admin/settings'] });
+      toast({ 
+        title: t('admin.oidc.ssoLabelSaved'),
+        description: t('admin.oidc.ssoLabelSavedDescription')
+      });
+    },
+    onError: () => {
+      toast({ 
+        title: t('errors.generic'), 
+        description: t('admin.oidc.saveError'),
+        variant: "destructive"
+      });
+    }
+  });
+
+  const handleSaveSsoLabel = () => {
+    saveSsoLabelMutation.mutate(ssoButtonLabel.trim());
+  };
+
+  const handleTestConnection = async () => {
+    setIsTesting(true);
+    try {
+      const res = await apiRequest('POST', '/api/v1/oidc-test');
+      const result = await res.json();
+      if (result.success) {
+        toast({ title: t('admin.oidc.testConnection'), description: result.details || t('admin.oidc.testSuccess') });
+      } else {
+        toast({ title: t('admin.oidc.testFailed'), description: result.error || t('admin.oidc.testError'), variant: 'destructive' });
+      }
+    } catch {
+      toast({ title: t('admin.oidc.testFailed'), description: t('admin.oidc.testError'), variant: 'destructive' });
+    } finally {
+      setIsTesting(false);
+    }
+  };
   
   return (
     <div className="space-y-6">
@@ -164,73 +249,186 @@ export function OIDCSettingsPanel({ onBack }: { onBack: () => void }) {
 
       <Card className="polly-card">
         <CardHeader>
-          <CardTitle className="flex items-center">
-            <Key className="w-5 h-5 mr-2" />
-            {t('admin.oidc.keycloakSettings')}
+          <CardTitle className="flex items-center justify-between">
+            <div className="flex items-center">
+              <Key className="w-5 h-5 mr-2" />
+              {t('admin.oidc.keycloakSettings')}
+            </div>
+            {configLoading ? (
+              <Skeleton className="h-6 w-16" />
+            ) : oidcConfig?.enabled ? (
+              <Badge variant="outline" className="text-green-600 border-green-600">
+                <CheckCircle className="w-3 h-3 mr-1" />
+                {t('admin.oidc.active')}
+              </Badge>
+            ) : (
+              <Badge variant="outline" className="text-yellow-600 border-yellow-600">
+                <XCircle className="w-3 h-3 mr-1" />
+                {t('admin.oidc.inactive')}
+              </Badge>
+            )}
           </CardTitle>
           <CardDescription>{t('admin.oidc.keycloakDescription')}</CardDescription>
         </CardHeader>
         <CardContent className="space-y-4">
-          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-            <div>
-              <Label htmlFor="keycloak-issuer">{t('admin.oidc.issuerUrl')}</Label>
-              <Input 
-                id="keycloak-issuer" 
-                placeholder="https://keycloak.example.com/realms/kita" 
-                data-testid="input-keycloak-issuer"
-              />
-              <p className="text-xs text-muted-foreground mt-1">{t('admin.oidc.issuerUrlHint')}</p>
-            </div>
-            <div>
-              <Label htmlFor="keycloak-client">{t('admin.oidc.clientId')}</Label>
-              <Input 
-                id="keycloak-client" 
-                placeholder="polly-poll-client" 
-                data-testid="input-keycloak-client"
-              />
-            </div>
-          </div>
-          
-          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-            <div>
-              <Label htmlFor="keycloak-secret">{t('admin.oidc.clientSecret')}</Label>
-              <Input 
-                id="keycloak-secret" 
-                type="password" 
-                placeholder="••••••••••••••••" 
-                data-testid="input-keycloak-secret"
-              />
-            </div>
-            <div>
-              <Label htmlFor="keycloak-callback">{t('admin.oidc.callbackUrl')}</Label>
-              <Input 
-                id="keycloak-callback" 
-                value={typeof window !== 'undefined' ? `${window.location.origin}/auth/callback` : ''}
-                readOnly
-                className="bg-muted"
-                data-testid="input-keycloak-callback"
-              />
-              <p className="text-xs text-muted-foreground mt-1">{t('admin.oidc.callbackUrlHint')}</p>
+          {!configLoading && configError && (
+            <Alert variant="destructive">
+              <AlertTriangle className="h-4 w-4" />
+              <AlertDescription>{t('admin.oidc.testError')}</AlertDescription>
+            </Alert>
+          )}
+
+          {!configLoading && !configError && !oidcConfig?.configured && (
+            <Alert variant="destructive">
+              <AlertTriangle className="h-4 w-4" />
+              <AlertDescription>{t('admin.oidc.notConfigured')}</AlertDescription>
+            </Alert>
+          )}
+
+          <Alert>
+            <Info className="h-4 w-4" />
+            <AlertDescription>{t('admin.oidc.envHint')}</AlertDescription>
+          </Alert>
+
+          {configLoading ? (
+            <div className="space-y-4">
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <Skeleton className="h-10" />
+                <Skeleton className="h-10" />
+              </div>
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <Skeleton className="h-10" />
+                <Skeleton className="h-10" />
+              </div>
             </div>
-          </div>
+          ) : (
+            <>
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <div>
+                  <Label htmlFor="keycloak-issuer">{t('admin.oidc.issuerUrl')}</Label>
+                  <Input 
+                    id="keycloak-issuer" 
+                    value={oidcConfig?.issuerUrl || ''}
+                    readOnly
+                    className="bg-muted"
+                    data-testid="input-keycloak-issuer"
+                  />
+                  <p className="text-xs text-muted-foreground mt-1">{t('admin.oidc.issuerUrlHint')}</p>
+                </div>
+                <div>
+                  <Label htmlFor="keycloak-client">{t('admin.oidc.clientId')}</Label>
+                  <Input 
+                    id="keycloak-client" 
+                    value={oidcConfig?.clientId || ''}
+                    readOnly
+                    className="bg-muted"
+                    data-testid="input-keycloak-client"
+                  />
+                </div>
+              </div>
+              
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                <div>
+                  <Label htmlFor="keycloak-secret">{t('admin.oidc.clientSecret')}</Label>
+                  <Input 
+                    id="keycloak-secret" 
+                    type="password" 
+                    value={oidcConfig?.hasClientSecret ? '••••••••••••••••' : ''}
+                    readOnly
+                    className="bg-muted"
+                    data-testid="input-keycloak-secret"
+                  />
+                </div>
+                <div>
+                  <Label htmlFor="keycloak-callback">{t('admin.oidc.callbackUrl')}</Label>
+                  <Input 
+                    id="keycloak-callback" 
+                    value={oidcConfig?.callbackUrl || ''}
+                    readOnly
+                    className="bg-muted"
+                    data-testid="input-keycloak-callback"
+                  />
+                  <p className="text-xs text-muted-foreground mt-1">{t('admin.oidc.callbackUrlHint')}</p>
+                </div>
+              </div>
 
-          <div className="flex items-center space-x-2 pt-2">
-            <Switch id="keycloak-enabled" data-testid="switch-keycloak-enabled" />
-            <Label htmlFor="keycloak-enabled">{t('admin.oidc.enableOidc')}</Label>
-          </div>
+              <div className="flex items-center space-x-2 pt-2">
+                <Switch id="keycloak-enabled" checked={oidcConfig?.enabled ?? false} disabled data-testid="switch-keycloak-enabled" />
+                <Label htmlFor="keycloak-enabled">{t('admin.oidc.enableOidc')}</Label>
+              </div>
 
-          <div className="flex justify-end space-x-2 pt-4">
-            <Button variant="outline" data-testid="button-test-oidc">
-              {t('admin.oidc.testConnection')}
-            </Button>
-            <Button 
-              className="polly-button-primary" 
-              data-testid="button-save-oidc"
-              onClick={() => toast({ title: t('admin.oidc.saved'), description: t('admin.oidc.oidcSaved') })}
+              {oidcConfig?.configured && (
+                <div className="flex justify-end pt-4">
+                  <Button 
+                    variant="outline" 
+                    data-testid="button-test-oidc"
+                    onClick={handleTestConnection}
+                    disabled={isTesting}
+                  >
+                    {isTesting ? (
+                      <>
+                        <Loader2 className="w-4 h-4 mr-2 animate-spin" />
+                        {t('admin.oidc.testing')}
+                      </>
+                    ) : (
+                      t('admin.oidc.testConnection')
+                    )}
+                  </Button>
+                </div>
+              )}
+            </>
+          )}
+        </CardContent>
+      </Card>
+
+      <Card className="polly-card">
+        <CardHeader>
+          <CardTitle className="flex items-center">
+            <Key className="w-5 h-5 mr-2" />
+            {t('admin.oidc.ssoButtonLabel')}
+          </CardTitle>
+          <CardDescription>{t('admin.oidc.ssoButtonLabelDescription')}</CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="flex gap-3">
+            <div className="flex-1">
+              <Input
+                id="sso-button-label"
+                value={ssoButtonLabel}
+                onChange={(e) => setSsoButtonLabel(e.target.value)}
+                placeholder={t('admin.oidc.ssoButtonLabelPlaceholder')}
+                data-testid="input-sso-button-label"
+              />
+              <p className="text-xs text-muted-foreground mt-1">
+                {t('admin.oidc.ssoButtonLabelHint')}
+                {ssoLabelIsFromEnv && (
+                  <span className="ml-1 text-amber-600 dark:text-amber-400">
+                    ({t('admin.oidc.ssoLabelFromEnv')})
+                  </span>
+                )}
+              </p>
+            </div>
+            <Button
+              onClick={handleSaveSsoLabel}
+              disabled={saveSsoLabelMutation.isPending}
+              data-testid="button-save-sso-label"
             >
-              {t('admin.oidc.saveSettings')}
+              {saveSsoLabelMutation.isPending ? (
+                <Loader2 className="w-4 h-4 animate-spin" />
+              ) : (
+                t('admin.oidc.ssoLabelSave')
+              )}
             </Button>
           </div>
+          {ssoButtonLabel && (
+            <div className="p-3 border rounded-lg bg-muted/50">
+              <p className="text-xs text-muted-foreground mb-2">{t('admin.oidc.ssoLabelPreview')}</p>
+              <div className="inline-flex items-center gap-2 px-4 py-2 border rounded-md bg-background text-sm font-medium">
+                <KeyRound className="h-4 w-4" />
+                {ssoButtonLabel}
+              </div>
+            </div>
+          )}
         </CardContent>
       </Card>
 
diff --git a/client/src/components/admin/settings/SecuritySettingsPanel.tsx b/client/src/components/admin/settings/SecuritySettingsPanel.tsx
index 21bf1ba1..b8e2cd48 100644
--- a/client/src/components/admin/settings/SecuritySettingsPanel.tsx
+++ b/client/src/components/admin/settings/SecuritySettingsPanel.tsx
@@ -742,7 +742,7 @@ export function SecuritySettingsPanel({ onBack }: { onBack: () => void }) {
 
               <div className={`grid grid-cols-2 gap-4 ${!clamavEnabled ? 'opacity-50' : ''}`}>
                 <div className="space-y-2">
-                  <Label htmlFor="clamav-host">ClamAV Host</Label>
+                  <Label htmlFor="clamav-host">{t('admin.security.clamavHost')}</Label>
                   <Input id="clamav-host" value={clamavHost} onChange={(e) => setClamavHost(e.target.value)} disabled={!clamavEnabled} placeholder="localhost" data-testid="input-clamav-host" />
                   <p className="text-xs text-muted-foreground">{t('admin.security.clamdServerAddress')}</p>
                 </div>
diff --git a/client/src/components/admin/settings/SessionTimeoutPanel.tsx b/client/src/components/admin/settings/SessionTimeoutPanel.tsx
index b1828c18..7da66150 100644
--- a/client/src/components/admin/settings/SessionTimeoutPanel.tsx
+++ b/client/src/components/admin/settings/SessionTimeoutPanel.tsx
@@ -145,7 +145,7 @@ export function SessionTimeoutPanel({ onBack }: { onBack: () => void }) {
             <div className="space-y-2">
               <div className="flex items-center justify-between">
                 <div className="flex items-center gap-2">
-                  <Badge className="polly-badge-admin">Admin</Badge>
+                  <Badge className="polly-badge-admin">{t('admin.roles.admin')}</Badge>
                   <span className="text-sm text-muted-foreground">{t('admin.sessionTimeout.longestSessionForAdmins')}</span>
                 </div>
                 <span className="text-sm font-medium">{formatDuration(settings.adminTimeoutMinutes)}</span>
@@ -162,7 +162,7 @@ export function SessionTimeoutPanel({ onBack }: { onBack: () => void }) {
                 data-testid="slider-admin-timeout"
               />
               <div className="flex justify-between text-xs text-muted-foreground">
-                <span>30 Min</span>
+                <span>30 {t('common.minutesShort')}</span>
                 <span>12 {t('admin.sessionTimeout.hours')}</span>
               </div>
             </div>
@@ -170,7 +170,7 @@ export function SessionTimeoutPanel({ onBack }: { onBack: () => void }) {
             <div className="space-y-2">
               <div className="flex items-center justify-between">
                 <div className="flex items-center gap-2">
-                  <Badge className="polly-badge-manager">Manager</Badge>
+                  <Badge className="polly-badge-manager">{t('admin.roles.manager')}</Badge>
                   <span className="text-sm text-muted-foreground">{t('admin.sessionTimeout.mediumSessionForManagers')}</span>
                 </div>
                 <span className="text-sm font-medium">{formatDuration(settings.managerTimeoutMinutes)}</span>
@@ -187,7 +187,7 @@ export function SessionTimeoutPanel({ onBack }: { onBack: () => void }) {
                 data-testid="slider-manager-timeout"
               />
               <div className="flex justify-between text-xs text-muted-foreground">
-                <span>15 Min</span>
+                <span>15 {t('common.minutesShort')}</span>
                 <span>8 {t('admin.sessionTimeout.hours')}</span>
               </div>
             </div>
@@ -195,7 +195,7 @@ export function SessionTimeoutPanel({ onBack }: { onBack: () => void }) {
             <div className="space-y-2">
               <div className="flex items-center justify-between">
                 <div className="flex items-center gap-2">
-                  <Badge className="polly-badge-user">User</Badge>
+                  <Badge className="polly-badge-user">{t('admin.roles.user')}</Badge>
                   <span className="text-sm text-muted-foreground">{t('admin.sessionTimeout.shortestSessionForUsers')}</span>
                 </div>
                 <span className="text-sm font-medium">{formatDuration(settings.userTimeoutMinutes)}</span>
@@ -212,7 +212,7 @@ export function SessionTimeoutPanel({ onBack }: { onBack: () => void }) {
                 data-testid="slider-user-timeout"
               />
               <div className="flex justify-between text-xs text-muted-foreground">
-                <span>5 Min</span>
+                <span>5 {t('common.minutesShort')}</span>
                 <span>4 {t('admin.sessionTimeout.hours')}</span>
               </div>
             </div>
diff --git a/client/src/components/admin/settings/index.ts b/client/src/components/admin/settings/index.ts
index 27a7cb59..c12c61ea 100644
--- a/client/src/components/admin/settings/index.ts
+++ b/client/src/components/admin/settings/index.ts
@@ -10,3 +10,4 @@ export { CalendarSettingsPanel } from './CalendarSettingsPanel';
 export { MatrixSettingsPanel } from './MatrixSettingsPanel';
 export { PentestToolsPanel } from './PentestToolsPanel';
 export { WCAGAccessibilityPanel } from './WCAGAccessibilityPanel';
+export { AiSettingsPanel } from './AiSettingsPanel';
diff --git a/client/src/components/ai/AiChatWidget.tsx b/client/src/components/ai/AiChatWidget.tsx
new file mode 100644
index 00000000..851fa0ae
--- /dev/null
+++ b/client/src/components/ai/AiChatWidget.tsx
@@ -0,0 +1,955 @@
+import { useState, useRef, useCallback, useEffect } from "react";
+import { useLocation } from "wouter";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { apiRequest } from "@/lib/queryClient";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { Mic, ArrowRight, Sparkles, Loader2, CheckCircle, RefreshCw, AlertCircle, EyeOff, Eye, Minus, Send, X, Pencil, Lock, UserMinus, UserX, HelpCircle, ListChecks, Square, GripVertical } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { useToast } from "@/hooks/use-toast";
+import { VoiceRecordingOverlay } from "./VoiceRecordingOverlay";
+import {
+  DndContext,
+  closestCenter,
+  KeyboardSensor,
+  PointerSensor,
+  useSensor,
+  useSensors,
+  DragEndEvent,
+} from "@dnd-kit/core";
+import {
+  SortableContext,
+  sortableKeyboardCoordinates,
+  useSortable,
+  verticalListSortingStrategy,
+  arrayMove,
+} from "@dnd-kit/sortable";
+import { CSS } from "@dnd-kit/utilities";
+
+interface AiStatus {
+  enabled: boolean;
+  apiConfigured: boolean;
+  canUse: boolean;
+  remaining: number | null;
+  reason?: string;
+  resetAt?: string;
+}
+
+export interface AiSuggestionSettings {
+  resultsPublic?: boolean;
+  allowVoteEdit?: boolean;
+  allowVoteWithdrawal?: boolean;
+  allowMaybe?: boolean;
+  allowMultipleSlots?: boolean;
+}
+
+export type AiOptionItem = string | { text: string; isFreeText?: boolean };
+
+export interface AiSuggestion {
+  pollType: "schedule" | "survey" | "organization";
+  title: string;
+  description: string;
+  options: AiOptionItem[];
+  settings?: AiSuggestionSettings;
+}
+
+function getOptionText(opt: AiOptionItem): string {
+  return typeof opt === "string" ? opt : opt.text;
+}
+
+const POLL_TYPE_ROUTES: Record<AiSuggestion["pollType"], string> = {
+  schedule: "/create-poll",
+  survey: "/create-survey",
+  organization: "/create-organization",
+};
+
+const POLL_TYPE_LABEL_KEYS: Record<AiSuggestion["pollType"], string> = {
+  schedule: "aiWidget.pollTypeSchedule",
+  survey: "aiWidget.pollTypeSurvey",
+  organization: "aiWidget.pollTypeOrganization",
+};
+
+const SETTINGS_DEFAULTS: Record<AiSuggestion["pollType"], AiSuggestionSettings> = {
+  schedule:     { resultsPublic: true,  allowVoteEdit: true,  allowVoteWithdrawal: true },
+  survey:       { resultsPublic: true,  allowVoteEdit: false, allowVoteWithdrawal: false, allowMaybe: true },
+  organization: { resultsPublic: true,  allowVoteEdit: true,  allowVoteWithdrawal: true,  allowMultipleSlots: true },
+};
+
+function getPrompts(t: (key: string) => string): string[] {
+  return Array.from({ length: 12 }, (_, i) => t(`aiWidget.prompts.${i}`));
+}
+
+function getQuickSuggestions(
+  t: (key: string) => string,
+  pollType: AiSuggestion["pollType"],
+  settings: AiSuggestionSettings
+): string[] {
+  const chips: string[] = [];
+
+  if (settings.resultsPublic) {
+    chips.push(t("aiWidget.quickSuggestions.resultsOnlyCreator"));
+  } else {
+    chips.push(t("aiWidget.quickSuggestions.resultsPublicAll"));
+  }
+  if (settings.allowVoteEdit) {
+    chips.push(t("aiWidget.quickSuggestions.submissionsFinal"));
+  } else {
+    chips.push(t("aiWidget.quickSuggestions.allowEditSubmission"));
+  }
+  if (settings.allowVoteWithdrawal) {
+    chips.push(t("aiWidget.quickSuggestions.disableWithdrawals"));
+  } else {
+    chips.push(t("aiWidget.quickSuggestions.allowWithdrawal"));
+  }
+  if (pollType === "organization") {
+    if (settings.allowMultipleSlots) {
+      chips.push(t("aiWidget.quickSuggestions.singleSlotOnly"));
+    } else {
+      chips.push(t("aiWidget.quickSuggestions.allowMultipleSlots"));
+    }
+    chips.push(t("aiWidget.quickSuggestions.limitSpots"));
+    chips.push(t("aiWidget.quickSuggestions.addMoreStations"));
+  } else if (pollType === "schedule") {
+    if (settings.allowMaybe) {
+      chips.push(t("aiWidget.quickSuggestions.yesNoOnly"));
+    } else {
+      chips.push(t("aiWidget.quickSuggestions.addMaybe"));
+    }
+    chips.push(t("aiWidget.quickSuggestions.addMoreDates"));
+    chips.push(t("aiWidget.quickSuggestions.weekdaysOnly"));
+  } else if (pollType === "survey") {
+    if (settings.allowMaybe) {
+      chips.push(t("aiWidget.quickSuggestions.yesNoOnly"));
+    } else {
+      chips.push(t("aiWidget.quickSuggestions.addMaybeVoting"));
+    }
+    chips.push(t("aiWidget.quickSuggestions.addMoreOptions"));
+  }
+
+  return chips;
+}
+
+function SortableOptionItem({ id, index, option }: { id: string; index: number; option: AiOptionItem }) {
+  const { t } = useTranslation();
+  const { attributes, listeners, setNodeRef, transform, transition, isDragging } = useSortable({ id });
+  const displayText = getOptionText(option);
+  const isFreeText = typeof option === "object" && option.isFreeText;
+  return (
+    <li
+      ref={setNodeRef}
+      style={{
+        transform: CSS.Transform.toString(transform),
+        transition,
+        opacity: isDragging ? 0.4 : 1,
+      }}
+      className="flex items-center gap-2 bg-muted/30 rounded-lg px-3 py-1.5"
+    >
+      <span
+        {...attributes}
+        {...listeners}
+        className="cursor-grab active:cursor-grabbing text-muted-foreground/40 hover:text-muted-foreground/70 transition-colors shrink-0 touch-none"
+        aria-label={t("aiWidget.dragToSort")}
+      >
+        <GripVertical className="w-3.5 h-3.5" />
+      </span>
+      <span className="bg-primary/10 text-primary text-xs w-5 h-5 rounded-full flex items-center justify-center shrink-0 font-medium">
+        {index + 1}
+      </span>
+      <span className="text-sm">{displayText}</span>
+      {isFreeText && (
+        <span className="text-[10px] bg-blue-100 dark:bg-blue-900/30 text-blue-600 dark:text-blue-400 px-1.5 py-0.5 rounded-full shrink-0">
+          {t("aiWidget.freeText")}
+        </span>
+      )}
+    </li>
+  );
+}
+
+const TYPE_SPEED = 38;
+const ERASE_SPEED = 18;
+const PAUSE_AFTER_TYPE = 2400;
+const PAUSE_AFTER_ERASE = 350;
+
+function useTypewriter(lines: string[], paused: boolean) {
+  const [display, setDisplay] = useState("");
+  const [lineIdx, setLineIdx] = useState(0);
+  const [charIdx, setCharIdx] = useState(0);
+  const [erasing, setErasing] = useState(false);
+  const [pausePhase, setPausePhase] = useState<"none" | "after-type" | "after-erase">("none");
+
+  useEffect(() => {
+    if (paused || lines.length === 0) return;
+
+    if (pausePhase === "after-type") {
+      const t = setTimeout(() => { setErasing(true); setPausePhase("none"); }, PAUSE_AFTER_TYPE);
+      return () => clearTimeout(t);
+    }
+    if (pausePhase === "after-erase") {
+      const t = setTimeout(() => {
+        setLineIdx((i) => (i + 1) % lines.length);
+        setCharIdx(0);
+        setPausePhase("none");
+      }, PAUSE_AFTER_ERASE);
+      return () => clearTimeout(t);
+    }
+
+    if (!erasing) {
+      const target = lines[lineIdx];
+      if (charIdx < target.length) {
+        const t = setTimeout(() => {
+          setDisplay(target.slice(0, charIdx + 1));
+          setCharIdx((c) => c + 1);
+        }, TYPE_SPEED);
+        return () => clearTimeout(t);
+      } else {
+        setPausePhase("after-type");
+      }
+    } else {
+      if (display.length > 0) {
+        const t = setTimeout(() => setDisplay((d) => d.slice(0, -1)), ERASE_SPEED);
+        return () => clearTimeout(t);
+      } else {
+        setErasing(false);
+        setPausePhase("after-erase");
+      }
+    }
+  }, [paused, lines, lineIdx, charIdx, erasing, pausePhase, display]);
+
+  return { display, currentFull: lines[lineIdx] ?? "" };
+}
+
+function SettingsToggles({
+  settings,
+  pollType,
+  onToggle,
+  t,
+}: {
+  settings: AiSuggestionSettings;
+  pollType: AiSuggestion["pollType"];
+  onToggle: (key: keyof AiSuggestionSettings) => void;
+  t: (key: string) => string;
+}) {
+  type Toggle = {
+    key: keyof AiSuggestionSettings;
+    trueIcon: React.ReactNode;
+    falseIcon: React.ReactNode;
+    trueLabel: string;
+    falseLabel: string;
+    trueClass: string;
+    falseClass: string;
+  };
+
+  const green = "bg-green-500/15 border-green-500/30 text-green-600 dark:text-green-400";
+  const amber = "bg-amber-500/15 border-amber-500/30 text-amber-600 dark:text-amber-400";
+  const muted = "bg-muted/50 border-border text-muted-foreground";
+
+  const common: Toggle[] = [
+    {
+      key: "resultsPublic",
+      trueIcon: <Eye className="w-3 h-3" />,
+      falseIcon: <EyeOff className="w-3 h-3" />,
+      trueLabel: t("aiWidget.settingsResultsPublic"),
+      falseLabel: t("aiWidget.settingsResultsPrivate"),
+      trueClass: green,
+      falseClass: muted,
+    },
+    {
+      key: "allowVoteEdit",
+      trueIcon: <Pencil className="w-3 h-3" />,
+      falseIcon: <Lock className="w-3 h-3" />,
+      trueLabel: t("aiWidget.settingsAllowVoteEdit"),
+      falseLabel: t("aiWidget.settingsVoteEditLocked"),
+      trueClass: green,
+      falseClass: muted,
+    },
+    {
+      key: "allowVoteWithdrawal",
+      trueIcon: <UserMinus className="w-3 h-3" />,
+      falseIcon: <UserX className="w-3 h-3" />,
+      trueLabel: t("aiWidget.settingsAllowWithdrawal"),
+      falseLabel: t("aiWidget.settingsNoWithdrawal"),
+      trueClass: green,
+      falseClass: muted,
+    },
+  ];
+
+  const extra: Toggle[] = pollType === "survey"
+    ? [{
+        key: "allowMaybe",
+        trueIcon: <HelpCircle className="w-3 h-3" />,
+        falseIcon: <Minus className="w-3 h-3" />,
+        trueLabel: t("aiWidget.settingsMaybeAllowed"),
+        falseLabel: t("aiWidget.settingsNoMaybe"),
+        trueClass: amber,
+        falseClass: muted,
+      }]
+    : pollType === "organization"
+    ? [{
+        key: "allowMultipleSlots",
+        trueIcon: <ListChecks className="w-3 h-3" />,
+        falseIcon: <Square className="w-3 h-3" />,
+        trueLabel: t("aiWidget.settingsMultipleSlots"),
+        falseLabel: t("aiWidget.settingsSingleSlot"),
+        trueClass: green,
+        falseClass: muted,
+      }]
+    : [];
+
+  const toggles = [...common, ...extra];
+
+  return (
+    <div className="flex flex-wrap gap-1.5 pt-2">
+      {toggles.map((tog) => {
+        const val = settings[tog.key] ?? false;
+        const cls = val ? tog.trueClass : tog.falseClass;
+        const icon = val ? tog.trueIcon : tog.falseIcon;
+        const label = val ? tog.trueLabel : tog.falseLabel;
+        return (
+          <button
+            key={tog.key}
+            type="button"
+            onClick={() => onToggle(tog.key)}
+            className={`inline-flex items-center gap-1.5 text-[11px] px-2.5 py-1 rounded-full border font-medium cursor-pointer transition-all hover:opacity-75 select-none ${cls}`}
+          >
+            {icon}
+            {label}
+          </button>
+        );
+      })}
+    </div>
+  );
+}
+
+export function AiChatWidget() {
+  const { t, i18n } = useTranslation();
+  const lang = i18n.language?.startsWith("de") ? "de" : "en";
+  const { toast } = useToast();
+  const [, setLocation] = useLocation();
+  const [inputValue, setInputValue] = useState("");
+  const [suggestion, setSuggestion] = useState<AiSuggestion | null>(null);
+  const [localSettings, setLocalSettings] = useState<AiSuggestionSettings>({});
+  const [followUpValue, setFollowUpValue] = useState("");
+  const [selectedChips, setSelectedChips] = useState<string[]>([]);
+  const [orderedOptions, setOrderedOptions] = useState<AiOptionItem[]>([]);
+  const [refineError, setRefineError] = useState<string | null>(null);
+  const [isListening, setIsListening] = useState(false);
+  const [isTranscribing, setIsTranscribing] = useState(false);
+  const [audioStream, setAudioStream] = useState<MediaStream | null>(null);
+  const textareaRef = useRef<HTMLTextAreaElement>(null);
+  const followUpRef = useRef<HTMLInputElement>(null);
+  const suggestionRef = useRef<HTMLDivElement>(null);
+  const originalInputRef = useRef<string>("");
+  const mediaRecorderRef = useRef<MediaRecorder | null>(null);
+  const audioChunksRef = useRef<Blob[]>([]);
+  const mediaStreamRef = useRef<MediaStream | null>(null);
+  const isFilled = inputValue.trim().length > 0;
+
+  const sensors = useSensors(
+    useSensor(PointerSensor),
+    useSensor(KeyboardSensor, { coordinateGetter: sortableKeyboardCoordinates })
+  );
+
+  const prompts = getPrompts(t);
+
+  const { display: placeholderDisplay, currentFull } = useTypewriter(prompts, isFilled);
+
+  const { data: status, isLoading: statusLoading, isError: statusError } = useQuery<AiStatus>({
+    queryKey: ["/api/v1/ai/status"],
+    refetchInterval: false,
+    staleTime: 30_000,
+  });
+
+  useEffect(() => {
+    if (!suggestion) return;
+    const defaults = SETTINGS_DEFAULTS[suggestion.pollType];
+    setLocalSettings({ ...defaults, ...(suggestion.settings ?? {}) });
+    setOrderedOptions(suggestion.options ?? []);
+  }, [suggestion]);
+
+  useEffect(() => {
+    return () => {
+      if (mediaStreamRef.current) {
+        mediaStreamRef.current.getTracks().forEach((track) => track.stop());
+      }
+    };
+  }, []);
+
+  const voiceTargetRef = useRef<"main" | "followup">("main");
+  const activeRecordingTargetRef = useRef<"main" | "followup">("main");
+
+  const transcribeVoice = useCallback(async (audioBlob: Blob) => {
+    if (audioBlob.size < 1024) {
+      setIsTranscribing(false);
+      return;
+    }
+    const target = activeRecordingTargetRef.current;
+    try {
+      const formData = new FormData();
+      formData.append("audio", audioBlob, "recording.webm");
+      const response = await fetch("/api/v1/ai/transcribe", { method: "POST", body: formData });
+      const result = await response.json();
+      if (result.success && result.text) {
+        const setter = target === "followup" ? setFollowUpValue : setInputValue;
+        setter((prev) => {
+          const trimmed = prev.trim();
+          return trimmed ? `${trimmed} ${result.text.trim()}` : result.text.trim();
+        });
+      }
+    } catch (error) {
+      console.error("[Voice] Transcription failed:", error);
+    } finally {
+      setIsTranscribing(false);
+    }
+  }, []);
+
+  const startRecording = useCallback(async () => {
+    activeRecordingTargetRef.current = voiceTargetRef.current;
+    if (!navigator.mediaDevices || !navigator.mediaDevices.getUserMedia) {
+      toast({ title: t("home.aiMicError"), variant: "destructive" });
+      return;
+    }
+    try {
+      const stream = await navigator.mediaDevices.getUserMedia({ audio: true });
+      mediaStreamRef.current = stream;
+      setAudioStream(stream);
+      setIsListening(true);
+      audioChunksRef.current = [];
+
+      const mimeType = MediaRecorder.isTypeSupported("audio/webm;codecs=opus")
+        ? "audio/webm;codecs=opus"
+        : MediaRecorder.isTypeSupported("audio/webm")
+        ? "audio/webm"
+        : "audio/mp4";
+
+      const mediaRecorder = new MediaRecorder(stream, { mimeType });
+      mediaRecorderRef.current = mediaRecorder;
+
+      mediaRecorder.ondataavailable = (event) => {
+        if (event.data.size > 0) audioChunksRef.current.push(event.data);
+      };
+
+      mediaRecorder.onstop = async () => {
+        if (mediaStreamRef.current) {
+          mediaStreamRef.current.getTracks().forEach((track) => track.stop());
+          mediaStreamRef.current = null;
+          setAudioStream(null);
+        }
+        const audioBlob = new Blob(audioChunksRef.current, { type: mimeType });
+        audioChunksRef.current = [];
+        if (audioBlob.size > 0) {
+          setIsTranscribing(true);
+          setIsListening(false);
+          await transcribeVoice(audioBlob);
+        } else {
+          setIsListening(false);
+        }
+      };
+
+      mediaRecorder.start(100);
+    } catch (error: any) {
+      console.error("[Voice] Failed to start recording:", error);
+      const msg = error?.name === "NotAllowedError"
+        ? t("home.aiMicError")
+        : error?.name === "NotFoundError"
+        ? t("home.aiMicError")
+        : t("home.aiMicError");
+      toast({ title: msg, variant: "destructive" });
+      setIsListening(false);
+    }
+  }, [transcribeVoice, toast, t]);
+
+  const stopRecording = useCallback(() => {
+    if (mediaRecorderRef.current && mediaRecorderRef.current.state !== "inactive") {
+      mediaRecorderRef.current.stop();
+    } else {
+      setIsListening(false);
+    }
+  }, []);
+
+  const toggleListening = useCallback(() => {
+    if (isListening) stopRecording();
+    else startRecording();
+  }, [isListening, startRecording, stopRecording]);
+
+  const toggleSetting = (key: keyof AiSuggestionSettings) => {
+    setLocalSettings((prev) => ({ ...prev, [key]: !prev[key] }));
+  };
+
+  const handleKeyDown = useCallback(
+    (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
+      if (e.key === "Tab" && !isFilled && currentFull) {
+        e.preventDefault();
+        setInputValue(currentFull);
+      }
+    },
+    [isFilled, currentFull]
+  );
+
+  const mutation = useMutation({
+    mutationFn: () => {
+      originalInputRef.current = inputValue.trim();
+      return apiRequest("POST", "/api/v1/ai/create-poll", { description: inputValue, language: lang });
+    },
+    onSuccess: async (res) => {
+      const data = await res.json();
+      setSuggestion(data.suggestion as AiSuggestion);
+      setFollowUpValue("");
+      setRefineError(null);
+      setTimeout(() => textareaRef.current?.scrollIntoView({ behavior: "smooth", block: "start" }), 150);
+      setTimeout(() => followUpRef.current?.focus({ preventScroll: true }), 400);
+    },
+    onError: (err: any) => {
+      setSuggestion(null);
+      setRefineError(null);
+    },
+  });
+
+  const refineMutation = useMutation({
+    mutationFn: (refinement: string) => {
+      setRefineError(null);
+      return apiRequest("POST", "/api/v1/ai/create-poll", {
+        description: originalInputRef.current || inputValue.trim(),
+        language: lang,
+        refinement,
+        previousSuggestion: suggestion,
+      });
+    },
+    onSuccess: async (res) => {
+      const data = await res.json();
+      setSuggestion(data.suggestion as AiSuggestion);
+      setFollowUpValue("");
+      setSelectedChips([]);
+      setRefineError(null);
+      setTimeout(() => textareaRef.current?.scrollIntoView({ behavior: "smooth", block: "start" }), 150);
+      setTimeout(() => followUpRef.current?.focus({ preventScroll: true }), 400);
+    },
+    onError: (err: any) => {
+      let message = t("aiWidget.refineFailed");
+      try {
+        const errMsg = err?.message || "";
+        const jsonStart = errMsg.indexOf("{");
+        if (jsonStart !== -1) {
+          const body = JSON.parse(errMsg.slice(jsonStart));
+          if (body?.error) message = body.error;
+        }
+      } catch {}
+      setRefineError(message);
+    },
+  });
+
+  const handleSubmit = () => {
+    if (!inputValue.trim() || inputValue.trim().length < 5) return;
+    setSuggestion(null);
+    setFollowUpValue("");
+    setSelectedChips([]);
+    mutation.mutate();
+  };
+
+  const handleRefine = () => {
+    const parts = [...selectedChips, followUpValue.trim()].filter(Boolean);
+    if (parts.length === 0 || !suggestion) return;
+    refineMutation.mutate(parts.join(". "));
+  };
+
+  const handleApply = () => {
+    if (!suggestion) return;
+    sessionStorage.setItem("ai-suggestion", JSON.stringify({ ...suggestion, options: orderedOptions, settings: localSettings }));
+    setLocation(POLL_TYPE_ROUTES[suggestion.pollType]);
+  };
+
+  const handleDragEnd = (event: DragEndEvent) => {
+    const { active, over } = event;
+    if (over && active.id !== over.id) {
+      setOrderedOptions((items) => {
+        const from = items.findIndex((_, i) => `opt-${i}` === active.id);
+        const to = items.findIndex((_, i) => `opt-${i}` === over.id);
+        return arrayMove(items, from, to);
+      });
+    }
+  };
+
+  const handleKeySubmit = (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
+    if (e.key === "Enter" && (e.metaKey || e.ctrlKey)) {
+      e.preventDefault();
+      handleSubmit();
+    }
+  };
+
+  const handleFollowUpKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
+    if (e.key === "Enter" && !e.shiftKey) {
+      e.preventDefault();
+      handleRefine();
+    }
+  };
+
+  const toggleFollowUpListening = useCallback(() => {
+    voiceTargetRef.current = "followup";
+    if (isListening) stopRecording();
+    else startRecording();
+  }, [isListening, startRecording, stopRecording]);
+
+  if (statusLoading || statusError || (status && (!status.enabled || !status.apiConfigured))) return null;
+
+  const isRefining = refineMutation.isPending;
+  const pollTypeLabel = suggestion
+    ? t(POLL_TYPE_LABEL_KEYS[suggestion.pollType])
+    : "";
+
+  return (
+    <div className="w-full max-w-2xl mx-auto">
+      <div className="text-center mb-3">
+        <h2 className="text-xl font-semibold text-foreground inline-flex items-center gap-2 mb-1">
+          {t("home.aiChatTitle")}
+          <Badge
+            variant="secondary"
+            className="text-[10px] px-1.5 py-0 bg-amber-500/20 text-amber-600 dark:text-amber-400 border border-amber-500/30"
+          >
+            {t("home.betaBadge")}
+          </Badge>
+        </h2>
+        <p className="text-sm text-muted-foreground">{t("home.aiChatHint")}</p>
+      </div>
+
+      <div className="rounded-2xl border-2 border-primary/30 bg-card shadow-lg overflow-hidden focus-within:border-primary/60 transition-colors duration-200">
+        {/* Textarea */}
+        <div className="relative">
+          <textarea
+            ref={textareaRef}
+            value={inputValue}
+            onChange={(e) => { setInputValue(e.target.value); setSuggestion(null); setFollowUpValue(""); setSelectedChips([]); }}
+            onKeyDown={(e) => { handleKeyDown(e); handleKeySubmit(e); }}
+            rows={3}
+            className="w-full resize-none bg-transparent px-4 pt-4 pb-2 text-sm text-foreground placeholder-transparent focus:outline-none"
+            style={{ minHeight: "88px" }}
+            disabled={mutation.isPending}
+          />
+          {!isFilled && (
+            <div
+              className="pointer-events-none absolute top-4 left-4 right-4 text-sm text-muted-foreground/60 select-none"
+              aria-hidden="true"
+            >
+              {placeholderDisplay}
+              <span className="animate-pulse">|</span>
+              {currentFull && (
+                <span className="ml-2 text-xs text-primary/40 hidden sm:inline">
+                  Tab ↹
+                </span>
+              )}
+            </div>
+          )}
+        </div>
+
+        {/* Toolbar */}
+        <div className="flex items-center justify-between px-3 py-2 border-t border-border/40 bg-muted/20">
+          <div className="flex items-center gap-2">
+            <TooltipProvider>
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <button
+                    type="button"
+                    onClick={() => { voiceTargetRef.current = "main"; toggleListening(); }}
+                    disabled={isTranscribing || mutation.isPending}
+                    className={`flex items-center gap-1.5 px-2.5 py-1.5 rounded-lg text-xs transition-colors select-none disabled:opacity-40 disabled:cursor-not-allowed ${
+                      isListening
+                        ? "text-primary animate-pulse"
+                        : "text-muted-foreground hover:text-foreground"
+                    }`}
+                  >
+                    {isTranscribing ? (
+                      <Loader2 className="w-4 h-4 animate-spin" />
+                    ) : (
+                      <Mic className="w-4 h-4" />
+                    )}
+                    <span className="hidden sm:inline">{t("home.aiMicTooltip")}</span>
+                  </button>
+                </TooltipTrigger>
+                <TooltipContent side="top">
+                  <p>{t("home.aiMicTooltip")}</p>
+                </TooltipContent>
+              </Tooltip>
+            </TooltipProvider>
+            {inputValue.length > 0 && (
+              <span className={`text-xs tabular-nums transition-colors ${
+                inputValue.length > 9800 ? "text-red-500" :
+                inputValue.length > 9000 ? "text-amber-500" :
+                "text-muted-foreground/40"
+              }`}>
+                {inputValue.length.toLocaleString()} / 10 000
+              </span>
+            )}
+          </div>
+
+          <div className="flex items-center gap-2">
+            {!status?.canUse && status?.reason && (
+              <span className="text-xs text-muted-foreground hidden sm:flex items-center gap-1">
+                <AlertCircle className="w-3 h-3 text-amber-500" />
+                {status?.reason === "GUEST_NOT_ALLOWED"
+                  ? t("home.aiLoginRequired")
+                  : t("home.aiLimitReached")}
+              </span>
+            )}
+            {status?.canUse && status?.remaining != null && (
+              <span className="text-xs text-muted-foreground">
+                {status.remaining} {t("home.aiRemaining")}
+              </span>
+            )}
+            <Button
+              type="button"
+              size="sm"
+              onClick={handleSubmit}
+              disabled={statusLoading || !status?.canUse || !isFilled || inputValue.trim().length < 5 || mutation.isPending}
+              className="gap-1.5 h-8 px-3"
+            >
+              {mutation.isPending ? (
+                <Loader2 className="w-3.5 h-3.5 animate-spin" />
+              ) : (
+                <Sparkles className="w-3.5 h-3.5" />
+              )}
+              <span>{mutation.isPending ? t("home.aiGenerating") : t("home.aiStart")}</span>
+              {!mutation.isPending && <ArrowRight className="w-3 h-3" />}
+            </Button>
+          </div>
+        </div>
+      </div>
+
+      {/* Suggestion result */}
+      {suggestion && (
+        <div
+          ref={suggestionRef}
+          className="mt-3 rounded-xl border border-border bg-card/80 shadow-sm animate-in fade-in slide-in-from-top-2 duration-300 overflow-hidden"
+        >
+          {/* Suggestion content */}
+          <div className="p-4 space-y-3">
+            <div className="flex items-center justify-between mb-3">
+              <div className="flex items-center gap-2">
+                <div className="flex items-center gap-1.5 text-sm font-medium text-green-600 dark:text-green-400">
+                  <CheckCircle className="w-4 h-4" />
+                  {t("home.aiSuggestion")}
+                </div>
+                <span className="text-xs px-1.5 py-0.5 rounded-full bg-primary/10 text-primary border border-primary/20 font-medium">
+                  {pollTypeLabel}
+                </span>
+              </div>
+              <button
+                type="button"
+                onClick={() => { setSuggestion(null); setFollowUpValue(""); mutation.mutate(); }}
+                disabled={mutation.isPending}
+                className="flex items-center gap-1 text-xs text-muted-foreground hover:text-foreground transition-colors"
+              >
+                <RefreshCw className="w-3 h-3" />
+                {t("home.aiRegenerate")}
+              </button>
+            </div>
+
+            <div className="space-y-3">
+              <p className="text-lg font-bold text-foreground leading-tight">{suggestion.title}</p>
+              {suggestion.description && (
+                <p className="text-sm text-muted-foreground leading-relaxed">{suggestion.description}</p>
+              )}
+              <div>
+                <p className="text-xs text-muted-foreground mb-2">
+                  {t("home.aiOptions")} ({orderedOptions.length})
+                </p>
+                <DndContext sensors={sensors} collisionDetection={closestCenter} onDragEnd={handleDragEnd}>
+                  <SortableContext
+                    items={orderedOptions.map((_, i) => `opt-${i}`)}
+                    strategy={verticalListSortingStrategy}
+                  >
+                    <ul className="space-y-1.5">
+                      {orderedOptions.map((opt, i) => (
+                        <SortableOptionItem key={`opt-${i}`} id={`opt-${i}`} index={i} option={opt} />
+                      ))}
+                    </ul>
+                  </SortableContext>
+                </DndContext>
+              </div>
+
+              <SettingsToggles
+                settings={localSettings}
+                pollType={suggestion.pollType}
+                onToggle={toggleSetting}
+                t={t}
+              />
+            </div>
+          </div>
+
+          {/* Follow-up refinement box */}
+          <div className="border-t border-border/60">
+            <div className="px-4 pt-4 pb-3">
+              <p className="text-base font-semibold text-foreground">
+                {t("aiWidget.followUpTitle")}
+              </p>
+              <p className="text-sm text-muted-foreground mt-1">
+                {t("aiWidget.followUpHint")}
+              </p>
+            </div>
+
+            {/* Free-text input with voice + Anpassen */}
+            <div className="px-4 pb-4">
+              <div className="flex items-center gap-0 border border-border/60 dark:border-border rounded-xl bg-muted/30 dark:bg-muted/20 overflow-hidden focus-within:ring-2 focus-within:ring-primary/40 focus-within:border-primary/50 transition-colors">
+                <button
+                  type="button"
+                  onClick={toggleFollowUpListening}
+                  disabled={isTranscribing || isRefining}
+                  className={`flex items-center justify-center w-10 h-10 shrink-0 transition-colors disabled:opacity-40 disabled:cursor-not-allowed ${
+                    isListening && voiceTargetRef.current === "followup"
+                      ? "text-primary animate-pulse"
+                      : "text-muted-foreground hover:text-foreground"
+                  }`}
+                  title={t("home.aiMicTooltip")}
+                >
+                  {isTranscribing && voiceTargetRef.current === "followup" ? (
+                    <Loader2 className="w-4 h-4 animate-spin" />
+                  ) : (
+                    <Mic className="w-4 h-4" />
+                  )}
+                </button>
+                <input
+                  ref={followUpRef}
+                  type="text"
+                  value={followUpValue}
+                  onChange={(e) => setFollowUpValue(e.target.value)}
+                  onKeyDown={handleFollowUpKeyDown}
+                  placeholder={
+                    selectedChips.length > 0
+                      ? t("aiWidget.followUpPlaceholderOptional")
+                      : t("aiWidget.followUpPlaceholder")
+                  }
+                  disabled={isRefining}
+                  className="flex-1 min-w-0 bg-transparent px-0 py-2.5 text-sm text-foreground placeholder:text-muted-foreground/60 focus:outline-none disabled:opacity-50"
+                />
+                {followUpValue.length > 0 && (
+                  <span className={`text-xs tabular-nums px-1 shrink-0 ${
+                    followUpValue.length > 2800 ? "text-red-500" :
+                    followUpValue.length > 2500 ? "text-amber-500" :
+                    "text-muted-foreground/40"
+                  }`}>
+                    {followUpValue.length.toLocaleString()}/3000
+                  </span>
+                )}
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="sm"
+                  onClick={handleRefine}
+                  disabled={
+                    (selectedChips.length === 0 && followUpValue.trim().length < 3) ||
+                    isRefining ||
+                    !status?.canUse
+                  }
+                  className="h-9 px-3 shrink-0 gap-1.5 mr-1 text-primary hover:text-primary hover:bg-primary/10"
+                >
+                  {isRefining ? (
+                    <Loader2 className="w-4 h-4 animate-spin" />
+                  ) : (
+                    <Send className="w-4 h-4" />
+                  )}
+                  <span className="text-sm font-medium">{isRefining ? t("aiWidget.followUpLoading") : t("aiWidget.followUpSubmit")}</span>
+                </Button>
+              </div>
+            </div>
+            {refineError && (
+              <div className="mx-4 mb-3 flex items-start gap-2 rounded-lg bg-red-500/10 border border-red-500/20 px-3 py-2">
+                <AlertCircle className="w-4 h-4 text-red-500 shrink-0 mt-0.5" />
+                <p className="text-sm text-red-600 dark:text-red-400">{refineError}</p>
+              </div>
+            )}
+
+            {/* Quick suggestion chips */}
+            {(() => {
+              const chips = getQuickSuggestions(t, suggestion.pollType, localSettings);
+              if (chips.length === 0) return null;
+              const visibleChips = chips.filter((c) => !selectedChips.includes(c));
+              return (
+                <div className="px-4 pb-3">
+                  <p className="text-base font-semibold text-foreground mb-2">{t("aiWidget.quickSuggestionsLabel")}</p>
+                  {visibleChips.length > 0 ? (
+                    <div className="flex flex-col gap-2">
+                      {visibleChips.map((chip) => (
+                        <button
+                          key={chip}
+                          type="button"
+                          onClick={() => setSelectedChips((prev) => [...prev, chip])}
+                          className="text-left text-sm px-4 py-2.5 rounded-xl border-2 border-dashed border-muted-foreground/40 dark:border-muted-foreground/30 bg-muted/20 dark:bg-muted/10 hover:bg-primary/10 hover:border-primary/50 hover:border-solid text-foreground transition-all cursor-pointer"
+                        >
+                          {chip}
+                        </button>
+                      ))}
+                    </div>
+                  ) : (
+                    <p className="text-sm text-muted-foreground/60 italic">{t("aiWidget.allOptionsSelected")}</p>
+                  )}
+                </div>
+              );
+            })()}
+
+            {/* Selected chips as removable tags */}
+            {selectedChips.length > 0 && (
+              <div className="px-4 pb-3">
+                <p className="text-base font-semibold text-foreground mb-2">{t("aiWidget.beingAdjusted")}</p>
+                <div className="flex flex-col gap-2">
+                  {selectedChips.map((chip) => (
+                    <span
+                      key={chip}
+                      className="inline-flex items-center justify-between text-sm px-4 py-2.5 rounded-xl bg-primary text-primary-foreground font-medium"
+                    >
+                      <span>{chip}</span>
+                      <button
+                        type="button"
+                        onClick={() => setSelectedChips((prev) => prev.filter((c) => c !== chip))}
+                        className="ml-2 rounded-full hover:bg-primary-foreground/20 transition-colors p-0.5"
+                        aria-label={t("aiWidget.remove")}
+                      >
+                        <X className="w-3.5 h-3.5" />
+                      </button>
+                    </span>
+                  ))}
+                </div>
+              </div>
+            )}
+
+            {/* Apply button — pill style like settings toggles, but much larger */}
+            <div className="px-4 pb-4 pt-2 flex justify-center">
+              <button
+                type="button"
+                onClick={handleApply}
+                className="inline-flex items-center gap-2.5 text-lg font-bold px-8 py-3 rounded-full border-2 bg-green-500/15 border-green-500/30 text-green-600 dark:text-green-400 cursor-pointer transition-all hover:bg-green-500/25 hover:border-green-500/50 select-none"
+              >
+                <ArrowRight className="w-5 h-5" />
+                {`${t("home.aiApply")} → ${pollTypeLabel}`}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
+      {mutation.isError && !suggestion && (
+        <div className="mt-2 flex items-start justify-center gap-2">
+          <AlertCircle className="w-4 h-4 text-red-500 shrink-0 mt-0.5" />
+          <p className="text-xs text-red-600 dark:text-red-400">
+            {(() => {
+              try {
+                const errMsg = (mutation.error as any)?.message || "";
+                const jsonStart = errMsg.indexOf("{");
+                if (jsonStart !== -1) {
+                  const body = JSON.parse(errMsg.slice(jsonStart));
+                  if (body?.error) return body.error;
+                }
+              } catch {}
+              return t("home.aiError");
+            })()}
+          </p>
+        </div>
+      )}
+
+      <VoiceRecordingOverlay
+        isVisible={isListening || isTranscribing}
+        onStop={stopRecording}
+        audioStream={audioStream}
+        isTranscribing={isTranscribing}
+        isListening={isListening}
+      />
+    </div>
+  );
+}
diff --git a/client/src/components/ai/AiPollCreator.tsx b/client/src/components/ai/AiPollCreator.tsx
new file mode 100644
index 00000000..954a1715
--- /dev/null
+++ b/client/src/components/ai/AiPollCreator.tsx
@@ -0,0 +1,251 @@
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { apiRequest } from "@/lib/queryClient";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import { Textarea } from "@/components/ui/textarea";
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "@/components/ui/dialog";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Bot, Sparkles, Loader2, CheckCircle, AlertCircle, RefreshCw } from "lucide-react";
+import { useToast } from "@/hooks/use-toast";
+
+interface AiStatus {
+  enabled: boolean;
+  apiConfigured: boolean;
+  canUse: boolean;
+  remaining: number | null;
+  reason?: string;
+  resetAt?: string;
+}
+
+interface PollSuggestion {
+  title: string;
+  description: string;
+  options: string[];
+}
+
+interface AiPollCreatorProps {
+  onApply: (suggestion: PollSuggestion) => void;
+  pollType?: "schedule" | "survey" | "organization";
+}
+
+function BetaBadge() {
+  return (
+    <Badge
+      variant="secondary"
+      className="text-[10px] px-1.5 py-0 bg-amber-500/20 text-amber-600 dark:text-amber-400 border-amber-500/30"
+    >
+      Beta
+    </Badge>
+  );
+}
+
+function QuotaInfo({ remaining, t }: { remaining: number | null; t: (key: string, opts?: any) => string }) {
+  if (remaining === null) return <span className="text-xs text-muted-foreground">{t('aiCreator.unlimited')}</span>;
+  if (remaining === 0)
+    return <span className="text-xs text-red-500">{t('aiCreator.quotaExhausted')}</span>;
+  return (
+    <span className="text-xs text-muted-foreground">
+      {t('aiCreator.requestsRemaining', { count: remaining })}
+    </span>
+  );
+}
+
+export function AiPollCreatorButton({
+  onApply,
+  pollType,
+}: AiPollCreatorProps) {
+  const { t } = useTranslation();
+  const [open, setOpen] = useState(false);
+
+  const { data: status } = useQuery<AiStatus>({
+    queryKey: ["/api/v1/ai/status"],
+    refetchInterval: false,
+  });
+
+  if (!status?.enabled || !status?.apiConfigured) return null;
+
+  return (
+    <>
+      <Button
+        type="button"
+        variant="outline"
+        size="sm"
+        className="gap-2 border-primary/30 hover:border-primary/60"
+        onClick={() => setOpen(true)}
+      >
+        <Sparkles className="w-3.5 h-3.5 text-primary" />
+        {t('aiCreator.createWithAi')}
+        <BetaBadge />
+      </Button>
+
+      <AiPollCreatorDialog
+        open={open}
+        onClose={() => setOpen(false)}
+        onApply={(s) => {
+          onApply(s);
+          setOpen(false);
+        }}
+        status={status}
+        pollType={pollType}
+      />
+    </>
+  );
+}
+
+function AiPollCreatorDialog({
+  open,
+  onClose,
+  onApply,
+  status,
+  pollType,
+}: {
+  open: boolean;
+  onClose: () => void;
+  onApply: (s: PollSuggestion) => void;
+  status: AiStatus;
+  pollType?: "schedule" | "survey" | "organization";
+}) {
+  const { t, i18n } = useTranslation();
+  const { toast } = useToast();
+  const [description, setDescription] = useState("");
+  const [suggestion, setSuggestion] = useState<PollSuggestion | null>(null);
+
+  const lang = i18n.language?.startsWith("de") ? "de" : "en";
+
+  const placeholderKey = pollType
+    ? `aiCreator.placeholder${pollType.charAt(0).toUpperCase() + pollType.slice(1)}`
+    : "aiCreator.placeholderDefault";
+  const placeholder = t(placeholderKey);
+
+  const mutation = useMutation({
+    mutationFn: () =>
+      apiRequest("POST", "/api/v1/ai/create-poll", { description, language: lang }),
+    onSuccess: async (res) => {
+      const data = await res.json();
+      setSuggestion(data.suggestion);
+    },
+    onError: async (err: any) => {
+      let msg = t('aiCreator.requestFailed');
+      try {
+        const data = await err.json?.();
+        if (data?.error) msg = data.error;
+      } catch (_) {}
+      toast({ title: msg, variant: "destructive" });
+    },
+  });
+
+  const handleGenerate = () => {
+    if (description.trim().length < 5) return;
+    setSuggestion(null);
+    mutation.mutate();
+  };
+
+  const canUse = status.canUse;
+
+  const getReasonMessage = () => {
+    if (status.reason === "GUEST_NOT_ALLOWED") return t('aiCreator.guestNotAllowed');
+    if (status.reason === "RATE_LIMIT_EXCEEDED") {
+      const timeStr = status.resetAt
+        ? new Date(status.resetAt).toLocaleTimeString(lang === "de" ? "de-DE" : "en-US", { hour: "2-digit", minute: "2-digit" })
+        : t('aiCreator.rateLimitLater');
+      return t('aiCreator.rateLimitExceeded', { time: timeStr });
+    }
+    return t('aiCreator.notAvailable');
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) { onClose(); setSuggestion(null); setDescription(""); } }}>
+      <DialogContent className="max-w-lg">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Bot className="w-5 h-5 text-primary" />
+            {t('aiCreator.title')}
+            <BetaBadge />
+          </DialogTitle>
+          <DialogDescription>
+            {t('aiCreator.description')}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="flex items-center justify-between text-xs">
+            <span className="text-muted-foreground">{t('aiCreator.gdprNote')}</span>
+            <QuotaInfo remaining={status.remaining ?? null} t={t} />
+          </div>
+
+          {!canUse && (
+            <Alert className="border-red-500/30 bg-red-50 dark:bg-red-950/20">
+              <AlertCircle className="w-4 h-4 text-red-500" />
+              <AlertDescription className="text-red-700 dark:text-red-400 text-sm">
+                {getReasonMessage()}
+              </AlertDescription>
+            </Alert>
+          )}
+
+          <Textarea
+            placeholder={placeholder}
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+            rows={3}
+            className="resize-none"
+            disabled={!canUse || mutation.isPending}
+          />
+
+          <div className="flex gap-2">
+            <Button
+              onClick={handleGenerate}
+              disabled={!canUse || description.trim().length < 5 || mutation.isPending}
+              className="gap-2"
+            >
+              {mutation.isPending ? (
+                <Loader2 className="w-4 h-4 animate-spin" />
+              ) : (
+                <Sparkles className="w-4 h-4" />
+              )}
+              {mutation.isPending ? t('aiCreator.generating') : t('aiCreator.generate')}
+            </Button>
+            {suggestion && (
+              <Button variant="ghost" size="sm" onClick={handleGenerate} disabled={mutation.isPending}>
+                <RefreshCw className="w-3.5 h-3.5 mr-1" /> {t('aiCreator.regenerate')}
+              </Button>
+            )}
+          </div>
+
+          {suggestion && (
+            <div className="rounded-lg border border-border bg-muted/30 p-4 space-y-3">
+              <div className="flex items-center gap-1.5 text-sm font-medium text-green-600 dark:text-green-400">
+                <CheckCircle className="w-4 h-4" /> {t('aiCreator.suggestion')}
+              </div>
+              <div>
+                <p className="text-xs text-muted-foreground mb-0.5">{t('aiCreator.suggestionTitle')}</p>
+                <p className="text-sm font-medium">{suggestion.title}</p>
+              </div>
+              {suggestion.description && (
+                <div>
+                  <p className="text-xs text-muted-foreground mb-0.5">{t('aiCreator.suggestionDescription')}</p>
+                  <p className="text-sm">{suggestion.description}</p>
+                </div>
+              )}
+              <div>
+                <p className="text-xs text-muted-foreground mb-1">{t('aiCreator.suggestionOptions', { count: suggestion.options.length })}</p>
+                <ul className="space-y-1">
+                  {suggestion.options.map((opt, i) => (
+                    <li key={i} className="text-sm flex items-start gap-1.5">
+                      <span className="text-muted-foreground text-xs mt-0.5">{i + 1}.</span>
+                      {opt}
+                    </li>
+                  ))}
+                </ul>
+              </div>
+              <Button onClick={() => onApply(suggestion)} className="w-full gap-2" size="sm">
+                <CheckCircle className="w-4 h-4" /> {t('aiCreator.apply')}
+              </Button>
+            </div>
+          )}
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/client/src/components/ai/VoiceRecordingOverlay.tsx b/client/src/components/ai/VoiceRecordingOverlay.tsx
new file mode 100644
index 00000000..a95c3027
--- /dev/null
+++ b/client/src/components/ai/VoiceRecordingOverlay.tsx
@@ -0,0 +1,229 @@
+import { useEffect, useRef, useCallback, useState } from "react";
+import { Mic, Send, Loader2 } from "lucide-react";
+import { useTranslation } from "react-i18next";
+
+interface VoiceRecordingOverlayProps {
+  isVisible: boolean;
+  onStop: () => void;
+  audioStream?: MediaStream | null;
+  isTranscribing?: boolean;
+  isListening?: boolean;
+}
+
+export function VoiceRecordingOverlay({
+  isVisible,
+  onStop,
+  audioStream,
+  isTranscribing = false,
+  isListening = false,
+}: VoiceRecordingOverlayProps) {
+  const { t } = useTranslation();
+  const canvasRef = useRef<HTMLCanvasElement>(null);
+  const animationRef = useRef<number | null>(null);
+  const analyserRef = useRef<AnalyserNode | null>(null);
+  const audioContextRef = useRef<AudioContext | null>(null);
+  const [visualizationActive, setVisualizationActive] = useState(false);
+
+  const getPrimaryColor = useCallback(() => {
+    const rawValue = getComputedStyle(document.documentElement)
+      .getPropertyValue("--primary")
+      .trim();
+    if (!rawValue) return { full: "hsl(220, 70%, 45%)", half: "hsla(220, 70%, 45%, 0.4)" };
+    return {
+      full: `hsl(${rawValue})`,
+      half: `hsla(${rawValue}, 0.4)`,
+    };
+  }, []);
+
+  const drawWaveform = useCallback(() => {
+    const canvas = canvasRef.current;
+    const analyser = analyserRef.current;
+    if (!canvas || !analyser) return;
+    const ctx = canvas.getContext("2d");
+    if (!ctx) return;
+
+    const bufferLength = analyser.frequencyBinCount;
+    const dataArray = new Uint8Array(bufferLength);
+    analyser.getByteTimeDomainData(dataArray);
+
+    const { width, height } = canvas;
+    ctx.clearRect(0, 0, width, height);
+
+    ctx.lineWidth = 3;
+    const { full, half } = getPrimaryColor();
+    const gradient = ctx.createLinearGradient(0, 0, width, 0);
+    gradient.addColorStop(0, half);
+    gradient.addColorStop(0.5, full);
+    gradient.addColorStop(1, half);
+    ctx.strokeStyle = gradient;
+    ctx.beginPath();
+
+    const sliceWidth = width / bufferLength;
+    let x = 0;
+    for (let i = 0; i < bufferLength; i++) {
+      const y = (dataArray[i] / 128.0) * (height / 2);
+      if (i === 0) ctx.moveTo(x, y);
+      else ctx.lineTo(x, y);
+      x += sliceWidth;
+    }
+    ctx.lineTo(width, height / 2);
+    ctx.stroke();
+
+    animationRef.current = requestAnimationFrame(drawWaveform);
+  }, [getPrimaryColor]);
+
+  useEffect(() => {
+    if (!isVisible || !audioStream) {
+      if (animationRef.current) cancelAnimationFrame(animationRef.current);
+      setVisualizationActive(false);
+      return;
+    }
+
+    let cancelled = false;
+
+    const setupAudio = async () => {
+      try {
+        const AudioContextClass = window.AudioContext || (window as any).webkitAudioContext;
+        if (!AudioContextClass) {
+          console.warn("[VoiceOverlay] AudioContext not supported");
+          return;
+        }
+
+        const audioContext = new AudioContextClass();
+        audioContextRef.current = audioContext;
+
+        if (audioContext.state === "suspended") {
+          await audioContext.resume();
+        }
+
+        if (cancelled) {
+          audioContext.close();
+          return;
+        }
+
+        const analyser = audioContext.createAnalyser();
+        analyser.fftSize = 2048;
+        analyser.smoothingTimeConstant = 0.8;
+        analyserRef.current = analyser;
+
+        const source = audioContext.createMediaStreamSource(audioStream);
+        source.connect(analyser);
+
+        if (!cancelled) {
+          setVisualizationActive(true);
+          drawWaveform();
+        }
+      } catch (error: any) {
+        console.error("[VoiceOverlay] Audio visualization error:", error?.message || error);
+        setVisualizationActive(false);
+      }
+    };
+
+    setupAudio();
+
+    return () => {
+      cancelled = true;
+      if (animationRef.current) cancelAnimationFrame(animationRef.current);
+      if (audioContextRef.current) {
+        audioContextRef.current.close();
+        audioContextRef.current = null;
+      }
+      analyserRef.current = null;
+    };
+  }, [isVisible, audioStream, drawWaveform]);
+
+  useEffect(() => {
+    const canvas = canvasRef.current;
+    if (!canvas) return;
+    const resize = () => {
+      const container = canvas.parentElement;
+      if (container) {
+        canvas.width = container.clientWidth;
+        canvas.height = container.clientHeight;
+      }
+    };
+    resize();
+    window.addEventListener("resize", resize);
+    return () => window.removeEventListener("resize", resize);
+  }, [isVisible]);
+
+  if (!isVisible) return null;
+
+  const showFallbackAnimation = isListening && !visualizationActive;
+
+  return (
+    <div
+      className="fixed inset-0 z-[99999] flex items-center justify-center"
+      style={{ backgroundColor: "rgba(0,0,0,0.6)", backdropFilter: "blur(4px)" }}
+      onClick={(e) => {
+        if (e.target === e.currentTarget && isListening) onStop();
+      }}
+    >
+      <div
+        className="relative bg-card border border-border rounded-2xl shadow-2xl p-6 w-full max-w-md mx-4"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <div className="text-center mb-4">
+          <div className="inline-flex items-center justify-center w-14 h-14 rounded-full bg-primary/15 mb-3 animate-pulse">
+            <Mic className="w-7 h-7 text-primary" />
+          </div>
+          <h2 className="text-xl font-semibold text-foreground mb-1">
+            {isTranscribing ? t("home.aiTranscribing") : t("home.aiListening")}
+          </h2>
+          <p className="text-muted-foreground text-sm">
+            {isTranscribing ? t("home.aiTranscribingHint") : t("home.aiSpeak")}
+          </p>
+        </div>
+
+        <div className="relative h-20 mb-4 rounded-xl overflow-hidden bg-muted/30 border border-border">
+          <canvas ref={canvasRef} className="w-full h-full" />
+
+          {showFallbackAnimation && (
+            <div className="absolute inset-0 flex items-center justify-center gap-[3px]">
+              {Array.from({ length: 24 }).map((_, i) => (
+                <div
+                  key={i}
+                  className="bg-primary rounded-full"
+                  style={{
+                    width: "3px",
+                    animation: `voiceBar 1.2s ease-in-out ${i * 0.05}s infinite`,
+                  }}
+                />
+              ))}
+            </div>
+          )}
+
+          <div className="absolute left-3 top-1/2 -translate-y-1/2 flex items-center gap-1.5 z-10">
+            <div className="w-2.5 h-2.5 rounded-full bg-red-500 animate-pulse" />
+            <span className="text-xs text-red-400 font-semibold tracking-wider">REC</span>
+          </div>
+        </div>
+
+        <div className="flex justify-center">
+          <button
+            type="button"
+            onClick={isListening ? onStop : undefined}
+            disabled={!isListening}
+            className="flex items-center justify-center w-14 h-14 rounded-full bg-primary hover:bg-primary/90 text-primary-foreground shadow-lg disabled:opacity-50 transition-colors"
+          >
+            {isTranscribing ? (
+              <Loader2 className="w-6 h-6 animate-spin" />
+            ) : (
+              <Send className="w-6 h-6" />
+            )}
+          </button>
+        </div>
+        <p className="text-center text-sm text-muted-foreground mt-2">
+          {isTranscribing ? t("home.aiProcessingHint") : t("home.aiSendRecord")}
+        </p>
+      </div>
+
+      <style>{`
+        @keyframes voiceBar {
+          0%, 100% { height: 4px; }
+          50% { height: ${isListening ? '32px' : '4px'}; }
+        }
+      `}</style>
+    </div>
+  );
+}
diff --git a/client/src/components/ui/InDevelopmentBadge.tsx b/client/src/components/ui/InDevelopmentBadge.tsx
new file mode 100644
index 00000000..3aca55f6
--- /dev/null
+++ b/client/src/components/ui/InDevelopmentBadge.tsx
@@ -0,0 +1,25 @@
+import { useTranslation } from 'react-i18next';
+import { cn } from "@/lib/utils";
+import { FlaskConical } from "lucide-react";
+
+interface InDevelopmentBadgeProps {
+  className?: string;
+  size?: 'sm' | 'md';
+}
+
+export function InDevelopmentBadge({ className, size = 'sm' }: InDevelopmentBadgeProps) {
+  const { t } = useTranslation();
+
+  return (
+    <div
+      className={cn(
+        "inline-flex items-center rounded-full border font-semibold polly-badge-in-development",
+        size === 'sm' ? "px-2 py-0.5 text-[10px] gap-1" : "px-2.5 py-0.5 text-xs gap-1.5",
+        className
+      )}
+    >
+      <FlaskConical className={size === 'sm' ? "w-3 h-3" : "w-3.5 h-3.5"} />
+      {t('common.inDevelopment')}
+    </div>
+  );
+}
diff --git a/client/src/contexts/AuthContext.tsx b/client/src/contexts/AuthContext.tsx
index fb52ad53..8ab7b52a 100644
--- a/client/src/contexts/AuthContext.tsx
+++ b/client/src/contexts/AuthContext.tsx
@@ -2,6 +2,7 @@ import { createContext, useContext, useEffect, useState, useRef, ReactNode } fro
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { apiRequest } from '@/lib/queryClient';
 import type { User } from '@shared/schema';
+import i18n, { getSystemDefaultLanguage } from '@/lib/i18n';
 
 type SafeUser = Omit<User, 'passwordHash'>;
 
@@ -14,7 +15,7 @@ interface AuthContextType {
   login: (usernameOrEmail: string, password: string) => Promise<SafeUser>;
   register: (username: string, email: string, name: string, password: string) => Promise<SafeUser>;
   logout: () => Promise<void>;
-  authMethods: { local: boolean; keycloak: boolean; registrationEnabled: boolean };
+  authMethods: { local: boolean; keycloak: boolean; registrationEnabled: boolean; ssoButtonLabel?: string; showLoginForm?: boolean };
 }
 
 const AuthContext = createContext<AuthContextType | undefined>(undefined);
@@ -31,7 +32,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     retry: false,
   });
 
-  const { data: methods, isLoading: isAuthMethodsLoading } = useQuery<{ local: boolean; keycloak: boolean; registrationEnabled: boolean }>({
+  const { data: methods, isLoading: isAuthMethodsLoading } = useQuery<{ local: boolean; keycloak: boolean; registrationEnabled: boolean; ssoButtonLabel?: string; showLoginForm?: boolean }>({
     queryKey: ['/api/v1/auth/methods'],
     staleTime: 1000 * 60 * 5,
   });
@@ -43,9 +44,16 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     const currentUserId = authData?.user?.id ?? null;
     const previousUserId = previousUserIdRef.current;
     
-    // On first load, just set the previous ID
+    // On first load, just set the previous ID and apply user language
     if (previousUserId === undefined) {
       previousUserIdRef.current = currentUserId;
+      if (authData?.user?.languagePreference) {
+        const lang = authData.user.languagePreference;
+        localStorage.setItem('polly-language', lang);
+        if (i18n.language !== lang) {
+          i18n.changeLanguage(lang);
+        }
+      }
       setIsAuthReady(true);
       return;
     }
@@ -57,6 +65,17 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       // Clear ALL cached data immediately - this is critical for security
       queryClient.clear();
       
+      if (authData?.user?.languagePreference) {
+        const lang = authData.user.languagePreference;
+        localStorage.setItem('polly-language', lang);
+        i18n.changeLanguage(lang);
+      }
+      
+      if (!currentUserId && previousUserId) {
+        localStorage.removeItem('polly-language');
+        i18n.changeLanguage(getSystemDefaultLanguage());
+      }
+      
       previousUserIdRef.current = currentUserId;
     }
     
diff --git a/client/src/contexts/CustomizationContext.tsx b/client/src/contexts/CustomizationContext.tsx
index 87a001bf..936d2e38 100644
--- a/client/src/contexts/CustomizationContext.tsx
+++ b/client/src/contexts/CustomizationContext.tsx
@@ -1,6 +1,8 @@
 import { createContext, useContext, useEffect, useCallback } from 'react';
 import { useQuery } from '@tanstack/react-query';
 import type { CustomizationSettings } from '@shared/schema';
+import i18n from '@/lib/i18n';
+import type { SupportedLanguage } from '@/lib/i18n';
 
 interface CustomizationContextType {
   settings: CustomizationSettings | null;
@@ -176,6 +178,16 @@ export function CustomizationProvider({ children }: { children: React.ReactNode
     applyColors();
   }, [applyColors]);
 
+  useEffect(() => {
+    if (settings?.language?.defaultLanguage) {
+      const systemLang = settings.language.defaultLanguage as SupportedLanguage;
+      const stored = localStorage.getItem('polly-language');
+      if (!stored && i18n.language !== systemLang) {
+        i18n.changeLanguage(systemLang);
+      }
+    }
+  }, [settings?.language?.defaultLanguage]);
+
   useEffect(() => {
     if (!settings?.theme) return;
     
diff --git a/client/src/hooks/useLiveVoting.ts b/client/src/hooks/useLiveVoting.ts
index d90e7b84..7eae6377 100644
--- a/client/src/hooks/useLiveVoting.ts
+++ b/client/src/hooks/useLiveVoting.ts
@@ -28,6 +28,7 @@ interface UseLiveVotingOptions {
   pollToken: string;
   voterName?: string;
   isPresenter?: boolean;
+  adminToken?: string;
   onResultsRefresh?: () => void;
   onVoteFinalized?: (voterName: string) => void;
   onSlotUpdate?: (slotUpdates: Record<number, SlotUpdate>) => void;
@@ -37,6 +38,7 @@ export function useLiveVoting({
   pollToken,
   voterName,
   isPresenter = false,
+  adminToken,
   onResultsRefresh,
   onVoteFinalized,
   onSlotUpdate,
@@ -55,6 +57,7 @@ export function useLiveVoting({
   const voterNameRef = useRef<string | undefined>(voterName);
   const pollTokenRef = useRef<string>(pollToken);
   const isPresenterRef = useRef<boolean>(isPresenter);
+  const adminTokenRef = useRef<string | undefined>(adminToken);
   const onResultsRefreshRef = useRef(onResultsRefresh);
   const onVoteFinalizedRef = useRef(onVoteFinalized);
 
@@ -115,6 +118,10 @@ export function useLiveVoting({
         }
         break;
 
+      case 'error':
+        console.warn('[LiveVoting] Server error:', message.code, message.message);
+        break;
+
       case 'pong':
         break;
 
@@ -137,13 +144,16 @@ export function useLiveVoting({
         console.log('[LiveVoting] Connected to WebSocket');
         setState(prev => ({ ...prev, isConnected: true }));
 
-        ws.send(JSON.stringify({
+        const joinMessage: Record<string, unknown> = {
           type: 'join_poll',
           pollToken: pollTokenRef.current,
           voterName: voterNameRef.current,
           sessionId: sessionIdRef.current,
-          isPresenter: isPresenterRef.current,
-        }));
+        };
+        if (adminTokenRef.current) {
+          joinMessage.adminToken = adminTokenRef.current;
+        }
+        ws.send(JSON.stringify(joinMessage));
 
         pingIntervalRef.current = setInterval(() => {
           if (ws.readyState === WebSocket.OPEN) {
@@ -161,17 +171,20 @@ export function useLiveVoting({
         }
       };
 
-      ws.onclose = () => {
-        console.log('[LiveVoting] WebSocket closed');
+      ws.onclose = (event) => {
+        console.log('[LiveVoting] WebSocket closed', event.code);
         setState(prev => ({ ...prev, isConnected: false }));
         
         if (pingIntervalRef.current) {
           clearInterval(pingIntervalRef.current);
         }
 
-        reconnectTimeoutRef.current = setTimeout(() => {
-          connect();
-        }, 3000);
+        const terminalCodes = [4404, 4403, 4401];
+        if (!terminalCodes.includes(event.code)) {
+          reconnectTimeoutRef.current = setTimeout(() => {
+            connect();
+          }, 3000);
+        }
       };
 
       ws.onerror = (error) => {
@@ -228,6 +241,7 @@ export function useLiveVoting({
   useEffect(() => {
     pollTokenRef.current = pollToken;
     isPresenterRef.current = isPresenter;
+    adminTokenRef.current = adminToken;
     
     if (pollToken) {
       connect();
@@ -236,7 +250,7 @@ export function useLiveVoting({
     return () => {
       disconnect();
     };
-  }, [pollToken, isPresenter, connect, disconnect]);
+  }, [pollToken, isPresenter, adminToken, connect, disconnect]);
 
   return {
     ...state,
diff --git a/client/src/index.css b/client/src/index.css
index 85653fff..48d3e672 100644
--- a/client/src/index.css
+++ b/client/src/index.css
@@ -407,6 +407,11 @@
     @apply !bg-red-100 !text-red-900 !border-red-400 dark:!bg-red-900/30 dark:!text-red-300 dark:!border-red-700;
   }
 
+  /* "In Development / Coming Soon" badge */
+  .polly-badge-in-development {
+    @apply !bg-amber-100 !text-amber-800 !border-amber-300 dark:!bg-amber-900/30 dark:!text-amber-300 dark:!border-amber-700;
+  }
+
   /* Impact badges - solid backgrounds, WCAG AA 4.5:1 contrast with white text */
   .polly-badge-dev-only {
     @apply !bg-gray-800 !text-white !border-transparent;
diff --git a/client/src/lib/i18n.ts b/client/src/lib/i18n.ts
index f28ddd22..1a37d5a5 100644
--- a/client/src/lib/i18n.ts
+++ b/client/src/lib/i18n.ts
@@ -14,25 +14,58 @@ export const languageNames: Record<SupportedLanguage, string> = {
   en: 'English'
 };
 
-i18n
-  .use(LanguageDetector)
-  .use(initReactI18next)
-  .init({
-    resources: {
-      de: { translation: de },
-      en: { translation: en }
-    },
-    fallbackLng: 'en',
-    supportedLngs: supportedLanguages,
-    interpolation: {
-      escapeValue: false
-    },
-    detection: {
-      order: ['localStorage', 'navigator'],
-      caches: ['localStorage'],
-      lookupLocalStorage: 'polly-language'
+let systemDefaultLanguage: SupportedLanguage = 'en';
+
+async function fetchSystemLanguage(): Promise<SupportedLanguage> {
+  try {
+    const response = await fetch('/api/v1/system/language');
+    if (response.ok) {
+      const data = await response.json();
+      const lang = data?.defaultLanguage;
+      if (lang === 'de' || lang === 'en') {
+        return lang;
+      }
     }
-  });
+  } catch (_e) {}
+  return 'en';
+}
+
+export function getSystemDefaultLanguage(): SupportedLanguage {
+  return systemDefaultLanguage;
+}
+
+export async function initI18n() {
+  systemDefaultLanguage = await fetchSystemLanguage();
+
+  await i18n
+    .use(LanguageDetector)
+    .use(initReactI18next)
+    .init({
+      resources: {
+        de: { translation: de },
+        en: { translation: en }
+      },
+      fallbackLng: systemDefaultLanguage,
+      supportedLngs: supportedLanguages,
+      interpolation: {
+        escapeValue: false
+      },
+      detection: {
+        order: ['localStorage'],
+        caches: ['localStorage'],
+        lookupLocalStorage: 'polly-language'
+      }
+    });
+
+  return i18n;
+}
+
+export function applySystemLanguageIfNoPreference() {
+  const stored = localStorage.getItem('polly-language');
+  if (!stored && i18n.language !== systemDefaultLanguage) {
+    i18n.changeLanguage(systemDefaultLanguage);
+  }
+}
 
 export const getDateLocale = () => {
   return i18n.language === 'de' ? deLocale : enLocale;
diff --git a/client/src/locales/de.json b/client/src/locales/de.json
index bca83b5b..aa168763 100644
--- a/client/src/locales/de.json
+++ b/client/src/locales/de.json
@@ -29,6 +29,7 @@
     "copied": "Kopiert!",
     "share": "Teilen",
     "download": "Herunterladen",
+    "inDevelopment": "In Entwicklung",
     "export": "Exportieren",
     "import": "Importieren",
     "preview": "Vorschau",
@@ -95,343 +96,6 @@
       "pressToExit": "Drücken Sie",
       "toExit": "zum Beenden"
     },
-    "admin": {
-      "security": {
-        "breadcrumb": "Sicherheit & DSGVO",
-        "title": "Sicherheit & Datenschutz",
-        "description": "DSGVO-Konformität und Datensicherheit",
-        "gdprCompliant": "DSGVO-konform",
-        "encryption": "Verschlüsselung",
-        "encryptionDescription": "Informationen zur Datenverschlüsselung",
-        "transportEncryption": "Transport-Verschlüsselung",
-        "tlsDescription": "TLS 1.3 für alle Verbindungen",
-        "databaseEncryption": "Datenbank-Verschlüsselung",
-        "aesDescription": "AES-256 at rest encryption",
-        "passwordHashing": "Passwort-Hashing",
-        "bcryptDescription": "bcrypt mit Salt-Rounds: 12",
-        "sessionSecurity": "Session-Sicherheit",
-        "sessionDescription": "HTTP-Only, Secure, SameSite",
-        "active": "Aktiv",
-        "rateLimit": "Anmelde-Ratenbegrenzung",
-        "rateLimitDescription": "Schutz vor Brute-Force-Angriffen auf lokale Anmeldungen",
-        "enableRateLimit": "Ratenbegrenzung aktivieren",
-        "limitAttempts": "Begrenzt fehlgeschlagene Anmeldeversuche",
-        "maxAttempts": "Max. Versuche",
-        "attempts": "{{count}} Versuche",
-        "beforeLockout": "Anzahl vor Sperrung",
-        "timeWindow": "Zeitfenster",
-        "minutes": "{{count}} Minuten",
-        "counterWindow": "Zähler-Fenster",
-        "lockoutTime": "Sperrzeit",
-        "waitTimeAfterLockout": "Wartezeit nach Sperrung",
-        "currentlyTracked": "Aktuell verfolgt",
-        "lockedAccounts": "Gesperrte Konten",
-        "clearAllLocks": "Alle Sperren aufheben",
-        "clearLocksTitle": "Alle Rate-Limit-Sperren aufheben?",
-        "clearLocksDescription": "Dies hebt alle aktuellen Anmelde-Sperren auf. Benutzer können sofort wieder versuchen, sich anzumelden.",
-        "clearLocks": "Sperren aufheben",
-        "saveRateLimit": "Ratenbegrenzung speichern",
-        "apiRateLimits": "API-Ratenbegrenzungen",
-        "apiRateLimitsDescription": "Konfigurieren Sie die Ratenbegrenzungen für verschiedene API-Endpunkte",
-        "registrationLimit": "Registrierung",
-        "registrationLimitDescription": "Begrenzt Registrierungsversuche pro IP",
-        "passwordResetLimit": "Passwort-Zurücksetzen",
-        "passwordResetLimitDescription": "Begrenzt Passwort-Zurücksetzen-Anfragen",
-        "pollCreationLimit": "Umfrage-Erstellung",
-        "pollCreationLimitDescription": "Begrenzt die Erstellung neuer Umfragen",
-        "votingLimit": "Abstimmungen",
-        "votingLimitDescription": "Begrenzt Abstimmungen pro Zeitfenster",
-        "emailLimit": "E-Mail-Versand",
-        "emailLimitDescription": "Begrenzt E-Mail-Anfragen",
-        "apiGeneralLimit": "Allgemeine API",
-        "apiGeneralLimitDescription": "Generelle API-Rate-Limit",
-        "maxRequestsLabel": "Max. Anfragen",
-        "timeWindowSeconds": "Zeitfenster (Sek.)",
-        "limitEnabled": "Aktiv",
-        "saveApiRateLimits": "API-Limits speichern",
-        "apiRateLimitsSaved": "API-Ratenbegrenzungen wurden gespeichert",
-        "clearApiRateLimits": "Alle API-Limits zurücksetzen",
-        "requestsPerWindow": "{{count}} Anfragen / {{window}}",
-        "perHour": "pro Stunde",
-        "perMinute": "pro Minute",
-        "perSeconds": "pro {{count}} Sekunden",
-        "virusScanner": "Virenscanner (ClamAV)",
-        "virusScannerDescription": "Upload-Prüfung vor Persistierung - Pflicht für behördliche Pentests",
-        "virusScanInfo": "Alle Uploads werden VOR dem Speichern durch ClamAV geprüft. Dateien mit erkannten Viren werden abgelehnt und nie persistiert.",
-        "enableVirusScanner": "Virenscanner aktivieren",
-        "scanAllUploads": "Alle Uploads vor Speicherung prüfen",
-        "clamdServerAddress": "clamd Server-Adresse",
-        "port": "Port",
-        "defaultPort": "Standard: 3310",
-        "timeout": "Timeout (Sekunden)",
-        "seconds": "{{count}} Sekunden",
-        "maxScanWait": "Max. Scan-Wartezeit",
-        "maxFileSize": "Max. Dateigröße (MB)",
-        "largerFilesRejected": "Größere Dateien werden abgelehnt",
-        "testConnection": "Verbindung testen",
-        "testing": "Teste...",
-        "saveClamav": "ClamAV speichern",
-        "clamavWarningTitle": "ClamAV-Verbindung fehlgeschlagen",
-        "clamavWarningDescription": "Die Verbindung zum ClamAV-Virenscanner konnte nicht hergestellt werden. Wenn Sie den Scanner trotzdem aktivieren, werden alle Datei-Uploads aus Sicherheitsgründen blockiert (Fail-Secure-Prinzip).",
-        "clamavWarningConsequence": "Achtung: Kein Benutzer wird Bilder oder Dateien hochladen können, solange der Scanner aktiviert, aber nicht erreichbar ist!",
-        "clamavWarningCancel": "Abbrechen und korrigieren",
-        "clamavWarningProceed": "Trotzdem aktivieren",
-        "testingBeforeSave": "Verbindung wird geprüft...",
-        "dataRetentionDescription": "Konfigurieren Sie die automatische Bereinigung alter Daten getrennt nach Benutzertyp (DSGVO Art. 5)",
-        "guestUsers": "Gastnutzer",
-        "anonymous": "Anonym",
-        "ssoUsers": "SSO-Nutzer",
-        "authenticated": "Authentifiziert",
-        "guestUsersNote": "Gastnutzer sind anonyme Benutzer, die ohne Anmeldung an Umfragen teilnehmen. Ihre Daten sollten gemäß DSGVO-Grundsätzen zeitnah gelöscht werden.",
-        "day": "Tag",
-        "days": "Tage",
-        "never": "Nie",
-        "expiredGuestPolls": "Abgelaufene Gast-Terminumfragen",
-        "expiredPollsDescription": "Termine deren Datum verstrichen ist",
-        "anonymizeGuestVotes": "Gast-Stimmen anonymisieren",
-        "removeEmailsFromVotes": "E-Mail-Adressen bei Stimmen entfernen",
-        "immediateAfterPoll": "Sofort nach Umfrage",
-        "archiveExpiredPolls": "Abgelaufene Terminumfragen archivieren",
-        "saveDeprovision": "Deprovisionierung speichern",
-        "gdprFunctions": "DSGVO-Funktionen",
-        "gdprCompliance": "Datenschutz-Grundverordnung Konformität",
-        "rightToAccess": "Recht auf Auskunft (Art. 15)",
-        "dataExportAvailable": "Datenexport verfügbar",
-        "rightToErasure": "Recht auf Löschung (Art. 17)",
-        "accountDeletionPossible": "Account-Löschung möglich",
-        "dataMinimization": "Datenminimierung (Art. 5)",
-        "onlyNecessaryData": "Nur notwendige Daten",
-        "storageLimitation": "Speicherbegrenzung (Art. 5)",
-        "autoDeleteConfigurable": "Auto-Löschung konfigurierbar",
-        "saveSettings": "Einstellungen speichern",
-        "settingsSaved": "Sicherheitseinstellungen wurden gespeichert.",
-        "scanLogs": "Scan-Protokoll",
-        "scanLogsDescription": "Audit-Trail aller von ClamAV gescannten Datei-Uploads",
-        "viewScanLogs": "Scan-Protokoll ansehen",
-        "scanLogsTitle": "ClamAV Scan-Protokoll",
-        "allScans": "Alle Scans",
-        "cleanFiles": "Sauber",
-        "infectedFiles": "Infiziert",
-        "errorScans": "Fehler",
-        "filename": "Dateiname",
-        "fileSize": "Größe",
-        "status": "Status",
-        "virusName": "Erkannter Virus",
-        "uploader": "Uploader",
-        "scannedAt": "Gescannt",
-        "scanDuration": "Dauer",
-        "action": "Aktion",
-        "allowed": "Erlaubt",
-        "blocked": "Blockiert",
-        "noScansYet": "Noch keine Scans aufgezeichnet",
-        "loadingScans": "Lade Scan-Protokoll...",
-        "scanStats": "Scan-Statistiken",
-        "totalScans": "Gesamt-Scans",
-        "last24Hours": "Letzte 24 Stunden",
-        "last7Days": "Letzte 7 Tage",
-        "avgScanTime": "Ø Scan-Zeit",
-        "detectionRate": "Erkennungsrate",
-        "filterByStatus": "Nach Status filtern",
-        "allStatuses": "Alle Status",
-        "clean": "Sauber",
-        "infected": "Infiziert",
-        "error": "Fehler",
-        "skipped": "Übersprungen",
-        "exportLogs": "Logs exportieren",
-        "refreshLogs": "Aktualisieren",
-        "showDetails": "Details anzeigen",
-        "scanLogDetails": "Scan-Log Details",
-        "mimeType": "MIME-Typ",
-        "requestIp": "Anfrage-IP",
-        "errorMessage": "Fehlermeldung",
-        "adminNotified": "Admin benachrichtigt",
-        "notApplicable": "k.A.",
-        "dataRetention": "Datenaufbewahrung & Auto-Löschung",
-        "gdprDataRetentionNote": "Ihre Daten sollten gemäß DSGVO-Grundsätzen zeitnah gelöscht werden.",
-        "deleteInactiveGuestPolls": "Inaktive Gast-Umfragen löschen",
-        "anonymousPollsNoActivity": "Anonyme Umfragen ohne Aktivität",
-        "ssoUserNote": "SSO-Nutzer sind authentifizierte Benutzer über Keycloak/OIDC. Ihre Daten können länger aufbewahrt werden, da sie einer Organisation zugeordnet sind.",
-        "deleteInactiveUserPolls": "Inaktive Benutzer-Umfragen löschen",
-        "userPollsNoActivity": "Umfragen von authentifizierten Nutzern ohne Aktivität",
-        "schedulesArchived": "Termine werden archiviert, nicht gelöscht",
-        "cleanupDeletedUserData": "Gelöschte Benutzer-Daten bereinigen",
-        "afterKeycloakDeletion": "Nach Löschung des Keycloak-Accounts",
-        "pollsOnUserDeletion": "Umfragen bei Benutzer-Löschung",
-        "whatHappensToPolls": "Was passiert mit Umfragen gelöschter Benutzer",
-        "delete": "Löschen",
-        "keep": "Behalten",
-        "transfer": "An Admin übertragen",
-        "kafkaIntegration": "Integration mit Kafka/Keycloak Deprovisionierungsservice für automatische Benutzer-Löschung",
-        "deprovisionNote": "Bei aktivierter externer Deprovisionierung wird die Benutzer-Löschung zentral über Ihren Kafka/Keycloak-Service gesteuert.",
-        "userDeletionDisabled": "Benutzer-Löschung im Admin-Panel deaktiviert. Alle Löschungen erfolgen über den Deprovisionierungsservice."
-      },
-      "tests": {
-        "title": "Automatisierte Tests",
-        "description": "Backend-Integrationstests ausführen und überwachen",
-        "run": "Tests ausführen",
-        "pending": "Ausstehend",
-        "noTests": "Keine Tests verfügbar",
-        "testResults": "Testergebnisse",
-        "backToSettings": "Zurück zu Einstellungen",
-        "automatedTests": "Automatisierte Tests",
-        "automatedTestsDescription": "Backend-Integrationstests ausführen und überwachen",
-        "running": "Läuft...",
-        "startTests": "Tests starten",
-        "lastRun": "Letzter Test-Lauf",
-        "details": "Details",
-        "total": "Gesamt",
-        "passed": "Bestanden",
-        "failed": "Fehlgeschlagen",
-        "skipped": "Übersprungen",
-        "duration": "Dauer",
-        "testHistory": "Test-Historie",
-        "loadingHistory": "Lade Historie...",
-        "noTestsYet": "Noch keine Tests durchgeführt.",
-        "manual": "Manuell",
-        "scheduled": "Geplant",
-        "loadMoreHistory": "Ältere Ergebnisse laden ({{count}} weitere)",
-        "testMode": "Test-Modus",
-        "testModeDescription": "Wählen Sie, ob alle Tests automatisch oder nur ausgewählte Tests ausgeführt werden sollen.",
-        "automatic": "Automatisch",
-        "allTests": "(alle Tests)",
-        "manualMode": "Manuell",
-        "selectedTests": "(ausgewählte Tests)",
-        "synchronize": "Synchronisieren",
-        "testConfiguration": "Test-Konfiguration",
-        "autoModeActive": "Automatischer Modus: Alle Tests werden ausgeführt",
-        "manualModeActive": "Manueller Modus: Nur aktivierte Tests werden ausgeführt",
-        "loadingConfig": "Lade Test-Konfiguration...",
-        "noTestsInCategory": "Keine Tests in dieser Kategorie gefunden.",
-        "noTestsFound": "Keine Tests gefunden. Klicken Sie auf \"Synchronisieren\" um Tests zu scannen.",
-        "active": "aktiv",
-        "automaticExecution": "Automatische Ausführung",
-        "enableAutoTests": "Automatische Tests aktivieren",
-        "intervalDays": "Intervall (Tage)",
-        "runTime": "Uhrzeit",
-        "notificationEmail": "Benachrichtigungs-E-Mail",
-        "testRunDetails": "Test-Lauf #{{id}} - Details",
-        "showAllTests": "Alle Tests anzeigen",
-        "showPassedTests": "Nur bestandene Tests anzeigen",
-        "showFailedTests": "Nur fehlgeschlagene Tests anzeigen",
-        "showSkippedTests": "Nur übersprungene Tests anzeigen",
-        "testTypes": {
-          "unit": "Unit-Tests",
-          "unitDescription": "Einzelne Funktionen und Komponenten",
-          "integration": "Integrationstests",
-          "integrationDescription": "API-Endpunkte und Datenbankoperationen",
-          "e2e": "E2E-Tests",
-          "e2eDescription": "Browser-basierte End-to-End-Tests",
-          "data": "Datentests",
-          "dataDescription": "Fixtures und Testdaten-Generierung",
-          "accessibility": "Barrierefreiheit",
-          "accessibilityDescription": "WCAG 2.1 AA Farbkontrast und Zugänglichkeit"
-        },
-        "testDataManagement": "Testdaten-Verwaltung",
-        "testDataDescription": "Testdaten werden während der Testläufe erstellt und sind von den Dashboard-Statistiken ausgeschlossen.",
-        "loadingTestStats": "Lade Testdaten-Statistiken...",
-        "testPolls": "Test-Umfragen",
-        "testOptions": "Test-Optionen",
-        "testVotes": "Test-Stimmen",
-        "testUsers": "Test-Benutzer",
-        "noTestData": "Keine Testdaten vorhanden",
-        "testDataFound": "{{count}} Testdaten-Einträge gefunden",
-        "deleteTestData": "Testdaten löschen",
-        "deleteTestDataTitle": "Testdaten löschen?",
-        "deleteTestDataDescription": "Diese Aktion löscht alle Testdaten aus der Datenbank:",
-        "cannotBeUndone": "Diese Aktion kann nicht rückgängig gemacht werden.",
-        "modeChanged": "Modus geändert",
-        "modeChangedDescription": "Der Test-Modus wurde aktualisiert.",
-        "modeChangeError": "Modus konnte nicht geändert werden.",
-        "testChangeError": "Test konnte nicht geändert werden.",
-        "testsSynced": "Tests synchronisiert",
-        "testsSyncedDescription": "{{count}} Tests gefunden.",
-        "testsSyncError": "Tests konnten nicht synchronisiert werden.",
-        "testsStarted": "Tests gestartet",
-        "testsStartedDescription": "Die Tests werden im Hintergrund ausgeführt. Die Ergebnisse werden hier angezeigt.",
-        "testsStartError": "Tests konnten nicht gestartet werden.",
-        "scheduleSaved": "Zeitplan gespeichert",
-        "scheduleSavedDescription": "Die Scheduler-Einstellungen wurden aktualisiert.",
-        "scheduleSaveError": "Zeitplan konnte nicht gespeichert werden.",
-        "testDataDeleted": "Testdaten gelöscht",
-        "testDataDeletedDescription": "Alle Testdaten wurden erfolgreich aus der Datenbank entfernt.",
-        "completed": "Abgeschlossen",
-        "history": "Test-Historie",
-        "historyDescription": "Vergangene Testläufe und deren Ergebnisse",
-        "noRuns": "Keine Testläufe vorhanden",
-        "runTests": "Tests ausführen",
-        "pleaseEnterToken": "Bitte geben Sie einen API-Token ein.",
-        "progress": "Fortschritt",
-        "runTestsDescription": "Führen Sie automatisierte Tests aus, um die Systemstabilität zu überprüfen.",
-        "scanStartError": "Scan konnte nicht gestartet werden.",
-        "scanStopError": "Scan konnte nicht gestoppt werden.",
-        "scanStopped": "Scan gestoppt",
-        "scanStoppedDescription": "Der Scan wurde abgebrochen.",
-        "startError": "Tests konnten nicht gestartet werden.",
-        "started": "Tests gestartet",
-        "startedDescription": "Die Tests werden jetzt ausgeführt.",
-        "stopError": "Tests konnten nicht gestoppt werden.",
-        "stopTests": "Tests stoppen",
-        "stopped": "Tests gestoppt",
-        "stoppedDescription": "Die Tests wurden abgebrochen.",
-        "targetSyncError": "Target konnte nicht synchronisiert werden.",
-        "targetSynced": "Target synchronisiert",
-        "targetSyncedDescription": "Polly wurde als Scan-Ziel registriert.",
-        "tokenSaveError": "Token konnte nicht gespeichert werden.",
-        "testDataDeleteError": "Testdaten konnten nicht gelöscht werden.",
-        "lastTestRun": "Letzter Test-Lauf #{{id}}",
-        "testRunDetailsTitle": "Test-Lauf #{{id}} - Details",
-        "enableAutomaticTests": "Automatische Tests aktivieren",
-        "noTestsFoundClickSync": "Keine Tests gefunden. Klicken Sie auf \"Synchronisieren\" um Tests zu scannen.",
-        "runningTests": "Läuft...",
-        "noTestsRun": "Noch keine Tests durchgeführt.",
-        "loadOlderResults": "Ältere Ergebnisse laden ({{count}} weitere)",
-        "automaticModeNote": "Automatischer Modus: Alle Tests werden ausgeführt",
-        "automaticModeNoteAvailable": "Automatischer Modus: Alle verfügbaren Tests werden ausgeführt",
-        "manualModeNote": "Manueller Modus: Nur aktivierte Tests werden ausgeführt",
-        "environmentDetected": "{{environment}}-Umgebung erkannt",
-        "e2eOnlyInCICD": "E2E- und Barrierefreiheitstests sind nur in der CI/CD-Pipeline verfügbar (benötigen Playwright).",
-        "cicdOnly": "Nur in CI/CD-Pipeline verfügbar",
-        "notAvailable": "Nicht verfügbar",
-        "environments": {
-          "replit": "Replit",
-          "docker": "Docker",
-          "ci": "CI/CD-Pipeline",
-          "local": "Lokale Entwicklung"
-        },
-        "showSkippedOnly": "Nur übersprungene Tests anzeigen",
-        "showPassedOnly": "Nur bestandene Tests anzeigen",
-        "showFailedOnly": "Nur fehlgeschlagene Tests anzeigen",
-        "deleteTestDataWarning": "Diese Aktion löscht alle Testdaten aus der Datenbank:",
-        "deleteTestDataPermanent": "Diese Aktion kann nicht rückgängig gemacht werden.",
-        "delete": "Löschen",
-        "recommendedSolution": "Empfohlene Lösung:",
-        "loadingTestConfig": "Lade Test-Konfiguration...",
-        "noTestDataPresent": "Keine Testdaten vorhanden",
-        "loadingTestDataStats": "Lade Testdaten-Statistiken...",
-        "e2eSkippedNote": "E2E-Tests werden nur in CI/CD-Umgebungen ausgeführt",
-        "e2eSkippedDescription": "Browser-Tests benötigen Playwright und werden in der internen Umgebung übersprungen."
-      },
-      "sessionTimeout": {
-        "saved": "Session-Timeout-Einstellungen wurden gespeichert.",
-        "breadcrumb": "Session-Timeout",
-        "title": "Automatische Session-Abmeldung",
-        "description": "Konfigurieren Sie rollenbasierte Timeout-Zeiten für automatische Abmeldung",
-        "usersAutoLoggedOut": "Benutzer werden nach Inaktivität automatisch abgemeldet",
-        "timeoutEnabled": "Session-Timeout aktiviert",
-        "enableAutoLogout": "Automatische Abmeldung nach Inaktivität aktivieren",
-        "timeoutDisabledNote": "Bei deaktiviertem Session-Timeout bleiben Benutzer bis zum manuellen Logout oder Cookie-Ablauf (24 Stunden) angemeldet.",
-        "roleBasedTimeouts": "Rollenbasierte Timeouts",
-        "roleBasedDescription": "Unterschiedliche Timeout-Zeiten je nach Benutzerrolle",
-        "longestSessionForAdmins": "Längste Session für Administratoren",
-        "mediumSessionForManagers": "Mittlere Session für Manager",
-        "shortestSessionForUsers": "Kürzeste Session für normale Benutzer",
-        "hours": "Stunden",
-        "minutes": "Minuten",
-        "warningSettings": "Warnhinweis",
-        "warningNote": "Benutzer sehen {{minutes}} Minute(n) vor der Abmeldung einen Warnhinweis mit der Möglichkeit, die Session zu verlängern.",
-        "sessionInfo": "Die Session-Timeout-Funktion überprüft die letzte Aktivität des Benutzers und meldet ihn nach der konfigurierten Inaktivitätszeit automatisch ab. Aktivitäten wie Mausklicks, Tastatureingaben und Seitenwechsel verlängern die Session."
-      }
-    },
     "ui": {
       "datePicker": {
         "placeholder": "Datum auswählen"
@@ -549,11 +213,11 @@
       },
       "quickTemplates": "Schnellvorlagen",
       "selectTemplateAndDate": "Wählen Sie eine Vorlage und dann ein Datum"
-    }
+    },
+    "minLabel": "Min"
   },
   "nav": {
     "home": "Startseite",
-    "dashboard": "Dashboard",
     "myPolls": "Meine Umfragen",
     "createPoll": "Umfrage erstellen",
     "admin": "Administration",
@@ -619,6 +283,12 @@
       "serverError": "Ein Serverfehler ist aufgetreten. Bitte versuchen Sie es später erneut.",
       "passwordRequirements": "Bitte erfüllen Sie alle Passwort-Anforderungen",
       "pleaseEnterValidEmail": "Bitte geben Sie eine gültige E-Mail-Adresse ein."
+    },
+    "placeholders": {
+      "email": "max@example.de",
+      "name": "Max Mustermann",
+      "username": "max123",
+      "emailList": "max@example.de, anna@example.de"
     }
   },
   "polls": {
@@ -705,7 +375,13 @@
     "currentlyViewing": "betrachtet...",
     "liveResults": "Live-Ergebnisse",
     "fullscreen": "Vollbild",
-    "exitFullscreen": "Vollbild beenden"
+    "exitFullscreen": "Vollbild beenden",
+    "yes": "Ja",
+    "no": "Nein",
+    "maybe": "Vielleicht",
+    "noOptionsAvailable": "Keine Optionen verfügbar",
+    "clickToEnlarge": "Klicken zum Vergrößern",
+    "textOptions": "Text Optionen"
   },
   "schedule": {
     "selectDates": "Termine auswählen",
@@ -732,7 +408,12 @@
     "uploadImage": "Bild hochladen",
     "altText": "Alternativtext",
     "singleChoice": "Einzelauswahl",
-    "multipleChoice": "Mehrfachauswahl"
+    "multipleChoice": "Mehrfachauswahl",
+    "addFreeTextQuestion": "Frage hinzufügen",
+    "freeTextQuestion": "Offene Frage",
+    "freeTextQuestionPlaceholder": "Fragestellung eingeben...",
+    "freeTextAnswerPlaceholder": "Ihre Antwort...",
+    "freeTextAnswerOptional": "Antwort (optional)"
   },
   "organization": {
     "slotName": "Slot-Name",
@@ -763,7 +444,38 @@
     "exportToPdf": "PDF exportieren",
     "noResults": "Noch keine Ergebnisse",
     "votesForPoll": "Stimmabgaben zur Umfrage",
-    "total": "Gesamt"
+    "total": "Gesamt",
+    "openAnswers": "Offene Antworten",
+    "noAnswersYet": "Noch keine Antworten eingegangen.",
+    "entries": "Eintragungen",
+    "resultsTitle": "Ergebnisse",
+    "personSignedUpSingular": "{{count}} Person hat sich eingetragen",
+    "personSignedUpPlural": "{{count}} Personen haben sich eingetragen",
+    "personVotedSingular": "{{count}} Person hat abgestimmt",
+    "personVotedPlural": "{{count}} Personen haben abgestimmt",
+    "totalEntries": "Gesamte Eintragungen",
+    "totalVotes": "Gesamte Abstimmungen",
+    "entrySingular": "Eintragung",
+    "entriesPlural": "Eintragungen",
+    "voteSingular": "Stimme",
+    "votesPlural": "Stimmen",
+    "participantsLabel": "Teilnehmer: {{count}}",
+    "totalEntriesCount": "Gesamte Eintragungen: {{count}}",
+    "totalVotesCount": "Gesamte Stimmen: {{count}}",
+    "bestOption": "Beliebteste Option",
+    "points": "{{count}} Punkte",
+    "pointsLabel": "Punkte: {{count}}",
+    "scoringDescription": "Bewertung: Ja = 2 Punkte, Vielleicht = 1 Punkt, Nein = 0 Punkte",
+    "slotsAndEntries": "Slots und Eintragungen",
+    "detailedResults": "Detaillierte Ergebnisse",
+    "csvExport": "CSV Export",
+    "pdfExport": "PDF Export",
+    "icsExport": "Kalender",
+    "icsExportError": "Der Kalender-Export konnte nicht erstellt werden. Die Umfrageoptionen enthalten keine gültigen Datums-/Uhrzeitwerte.",
+    "option": "Option",
+    "noEntriesYet": "Noch keine Eintragungen vorhanden",
+    "full": "voll",
+    "pointsHeader": "Punkte"
   },
   "resultsChart": {
     "tie": "Gleichstand",
@@ -775,7 +487,29 @@
     "maxCapacity": "Kapazität darf maximal 9999 sein",
     "capacitySet": "Kapazität auf {{count}} gesetzt",
     "participantsOverview": "{{count}} Teilnehmer",
-    "votedAt": "Abgestimmt am"
+    "votedAt": "Abgestimmt am",
+    "confirmedDate": "Bestätigter Termin",
+    "confirmedResult": "Festgelegtes Ergebnis",
+    "confirmDate": "Bestätigen",
+    "confirmColumn": "Termin bestätigen",
+    "setResultColumn": "Ergebnis festlegen",
+    "setResult": "Festlegen",
+    "confirmed": "Bestätigt",
+    "undoConfirmation": "Zurücknehmen",
+    "dateConfirmed": "Termin wurde bestätigt.",
+    "resultConfirmed": "Ergebnis wurde festgelegt.",
+    "dateUnconfirmed": "Terminbestätigung wurde zurückgenommen",
+    "resultUnconfirmed": "Ergebnis wurde zurückgenommen",
+    "finalizeFailed": "Fehler beim Bestätigen des Termins",
+    "confirmDialogTitle": "Diesen Termin bestätigen?",
+    "confirmDialogDescription": "Möchten Sie {{date}} {{time}} als endgültigen Termin bestätigen? Dies wird für alle Teilnehmer sichtbar sein.",
+    "confirmResultDialogTitle": "Dieses Ergebnis festlegen?",
+    "confirmResultDialogDescription": "Möchten Sie \"{{option}}\" als endgültiges Ergebnis festlegen? Dies wird für alle Teilnehmer sichtbar sein.",
+    "closePollOption": "Umfrage beenden (keine weiteren Stimmen)",
+    "videoConferenceLink": "Videokonferenz beitreten",
+    "notifyParticipantsOption": "Teilnehmer per E-Mail benachrichtigen (mit Kalendereinladung)",
+    "pollClosed": "Die Umfrage wurde beendet.",
+    "participantsNotified": "Teilnehmer wurden benachrichtigt."
   },
   "pollTypes": {
     "schedule": "Termin",
@@ -943,9 +677,16 @@
       "joined": "Beigetreten",
       "password": "Passwort",
       "provider": "Anbieter",
+      "emailStatus": "E-Mail-Status",
+      "emailVerified": "Bestätigt",
+      "emailNotVerified": "Nicht bestätigt",
+      "verifyEmail": "E-Mail manuell bestätigen",
+      "emailVerifiedSuccess": "E-Mail bestätigt",
+      "emailVerifiedDescription": "Die E-Mail-Adresse wurde erfolgreich als bestätigt markiert.",
       "noUsersFound": "Keine Benutzer gefunden.",
       "noPolls": "Keine Umfragen",
       "userPolls": "Benutzer-Umfragen",
+      "userPollsDescription": "Umfragen, die dieser Benutzer erstellt hat",
       "viewDetails": "Details anzeigen",
       "details": "Details",
       "management": "Benutzerverwaltung",
@@ -957,7 +698,8 @@
       "editUser": "Benutzer bearbeiten",
       "addUserTitle": "Neuen Benutzer hinzufügen",
       "addUserDescription": "Erstellen Sie ein neues Benutzerkonto für das System.",
-      "totalCount": "{{count}} Benutzer"
+      "totalCount": "{{count}} Benutzer",
+      "saveError": "Fehler beim Speichern des Benutzers"
     },
     "userManagement": "Benutzerverwaltung",
     "createUser": "Benutzer erstellen",
@@ -967,6 +709,10 @@
     "roleUser": "Benutzer",
     "roleAdmin": "Administrator",
     "roleManager": "Manager",
+    "accessDenied": "Zugang verweigert",
+    "noPermission": "Sie haben keine Berechtigung, auf diesen Bereich zuzugreifen.",
+    "userRole": "Ihre Rolle",
+    "unknown": "Unbekannt",
     "allPolls": "Alle Umfragen",
     "systemSettings": "Systemeinstellungen",
     "emailTemplates": {
@@ -978,6 +724,8 @@
       "themeDescription": "Farben und Schriftarten für alle E-Mails",
       "resetTheme": "Zurücksetzen",
       "importTheme": "Theme importieren",
+      "importThemeDisabledHint": "Diese Funktion befindet sich in Entwicklung. Nutzen Sie die Farbeinstellungen unten, um Ihr E-Mail-Design anzupassen.",
+      "themeHint": "E-Mail-Farben werden direkt über die Einstellungen unten gesteuert.",
       "backdrop": "Hintergrund",
       "canvas": "Inhaltsfläche",
       "textColor": "Textfarbe",
@@ -1011,9 +759,9 @@
       "centralFooter": "Zentrale E-Mail-Fußzeile",
       "centralFooterDescription": "Diese Fußzeile wird automatisch an alle E-Mails angehängt",
       "footerText": "Fußzeilen-Text",
-      "footerPlaceholder": "z.B. Diese E-Mail wurde automatisch von {{siteName}} erstellt.",
-      "footerVariableHint": "Sie können {{siteName}} als Variable verwenden",
-      "footerVariableNote": "Sie können {{siteName}} als Variable verwenden",
+      "footerPlaceholder": "Diese E-Mail wurde automatisch von {{siteName}} erstellt.\n{{link:#|Datenschutz}}",
+      "footerVariableHint": "Variablen: {{siteName}} (Website-Name), {{siteUrl}} (Website-URL). Links: {{link:URL|Text}} z.B. {{link:#|Datenschutz}}",
+      "footerVariableNote": "Variablen: {{siteName}} (Website-Name), {{siteUrl}} (Website-URL). Links: {{link:URL|Text}} z.B. {{link:#|Datenschutz}}",
       "saveFooter": "Fußzeile speichern",
       "emailBranding": "E-Mail-Branding",
       "emailBrandingNote": "Der E-Mail-Header mit Logo und Titel wird automatisch aus Ihren Branding-Einstellungen (Anpassen → Logo & Branding) übernommen. Die Fußzeile oben gilt für alle E-Mails.",
@@ -1302,7 +1050,14 @@
       "days": "Tage",
       "day": "Tag",
       "settingsSaved": "Sicherheitseinstellungen wurden gespeichert.",
-      "saveSettings": "Einstellungen speichern"
+      "saveSettings": "Einstellungen speichern",
+      "clamavHost": "ClamAV Host",
+      "clamavWarningTitle": "ClamAV-Verbindung fehlgeschlagen",
+      "clamavWarningDescription": "Die Verbindung zum ClamAV-Virenscanner konnte nicht hergestellt werden. Wenn Sie den Scanner trotzdem aktivieren, werden alle Datei-Uploads aus Sicherheitsgründen blockiert (Fail-Secure-Prinzip).",
+      "clamavWarningConsequence": "Achtung: Kein Benutzer wird Bilder oder Dateien hochladen können, solange der Scanner aktiviert, aber nicht erreichbar ist!",
+      "clamavWarningCancel": "Abbrechen und korrigieren",
+      "clamavWarningProceed": "Trotzdem aktivieren",
+      "testingBeforeSave": "Verbindung wird geprüft..."
     },
     "securityScan": "Sicherheitsscan",
     "vulnerabilities": "Schwachstellen",
@@ -1606,6 +1361,11 @@
         "title": "Pentest-Tools",
         "description": "Sicherheits-Scanning und Schwachstellenanalyse"
       },
+      "ai": {
+        "title": "KI-Assistent",
+        "description": "GWDG SAIA API konfigurieren, Modell wählen und Kontingente pro Rolle festlegen",
+        "sectionTitle": "KI-Funktionen"
+      },
       "integrations": {
         "title": "Integrationen",
         "matrix": {
@@ -1669,6 +1429,7 @@
       "linkLabel": "Link-Bezeichnung",
       "logo": "Logo",
       "deleteLogo": "Logo löschen",
+      "uploadLogo": "Logo hochladen",
       "resetDefaults": "Auf Standard zurücksetzen",
       "saveBranding": "Branding speichern",
       "saveFooter": "Footer speichern",
@@ -1677,7 +1438,12 @@
       "siteNameAccent": "Akzent-Teil des Namens",
       "supportLinks": "Support-Links",
       "themeDescription": "Farben und Erscheinungsbild anpassen",
-      "themeSection": "Design-Einstellungen"
+      "themeSection": "Design-Einstellungen",
+      "languageSection": "Spracheinstellungen",
+      "languageDescription": "Systemweite Standardsprache für alle Besucher ohne eigene Spracheinstellung",
+      "defaultLanguage": "Standard-Sprache",
+      "defaultLanguageHint": "Diese Sprache wird für anonyme Besucher und neue Benutzer verwendet, die keine eigene Sprachpräferenz festgelegt haben.",
+      "saveLanguage": "Sprache speichern"
     },
     "toast": {
       "systemStatusUpdated": "System-Status aktualisiert",
@@ -1712,9 +1478,6 @@
       "logoUploaded": "Logo hochgeladen",
       "logoUploadedDescription": "Das Logo wurde erfolgreich hochgeladen.",
       "logoUploadError": "Logo konnte nicht hochgeladen werden.",
-      "logoDeleted": "Logo gelöscht",
-      "logoDeletedDescription": "Das Logo wurde erfolgreich entfernt.",
-      "logoDeleteError": "Logo konnte nicht gelöscht werden.",
       "uploadFailed": "Upload fehlgeschlagen",
       "deprovisionSaved": "Deprovisionierungs-Einstellungen wurden gespeichert.",
       "settingsSaveError": "Einstellungen konnten nicht gespeichert werden.",
@@ -1895,7 +1658,62 @@
         "notConnected": "Nicht verbunden",
         "configuredViaEnv": "Via Env konfiguriert",
         "openSettings": "Einstellungen öffnen"
-      }
+      },
+      "error": "Verbindungsfehler",
+      "pollingStoppedError": "Statusabfrage wurde gestoppt. Bitte Seite neu laden.",
+      "notificationEmailPlaceholder": "E-Mail-Adresse für Testberichte",
+      "notificationEmailHint": "Nach jedem Testlauf wird ein Bericht an diese Adresse gesendet.",
+      "notificationEmailSaved": "E-Mail-Adresse gespeichert",
+      "notificationEmailCleared": "E-Mail-Adresse entfernt",
+      "smtpNotConfigured": "SMTP nicht konfiguriert — E-Mails können derzeit nicht versendet werden.",
+      "noEmailConfigured": "Keine E-Mail-Adresse hinterlegt — kein automatischer Versand von Testberichten.",
+      "saveEmail": "Speichern",
+      "clearEmail": "Entfernen",
+      "run": "Tests ausführen",
+      "pending": "Ausstehend",
+      "noTests": "Keine Tests verfügbar",
+      "testResults": "Testergebnisse",
+      "lastRun": "Letzter Test-Lauf",
+      "details": "Details",
+      "testHistory": "Test-Historie",
+      "noTestsYet": "Noch keine Tests durchgeführt.",
+      "loadMoreHistory": "Ältere Ergebnisse laden ({{count}} weitere)",
+      "manualMode": "Manuell",
+      "synchronize": "Synchronisieren",
+      "autoModeActive": "Automatischer Modus: Alle Tests werden ausgeführt",
+      "manualModeActive": "Manueller Modus: Nur aktivierte Tests werden ausgeführt",
+      "loadingConfig": "Lade Test-Konfiguration...",
+      "noTestsFound": "Keine Tests gefunden. Klicken Sie auf \"Synchronisieren\" um Tests zu scannen.",
+      "enableAutoTests": "Automatische Tests aktivieren",
+      "testRunDetails": "Test-Lauf #{{id}} - Details",
+      "showPassedTests": "Nur bestandene Tests anzeigen",
+      "showFailedTests": "Nur fehlgeschlagene Tests anzeigen",
+      "showSkippedTests": "Nur übersprungene Tests anzeigen",
+      "loadingTestStats": "Lade Testdaten-Statistiken...",
+      "noTestData": "Keine Testdaten vorhanden",
+      "deleteTestDataDescription": "Diese Aktion löscht alle Testdaten aus der Datenbank:",
+      "cannotBeUndone": "Diese Aktion kann nicht rückgängig gemacht werden.",
+      "modeChanged": "Modus geändert",
+      "modeChangedDescription": "Der Test-Modus wurde aktualisiert.",
+      "modeChangeError": "Modus konnte nicht geändert werden.",
+      "testChangeError": "Test konnte nicht geändert werden.",
+      "testsSynced": "Tests synchronisiert",
+      "testsSyncedDescription": "{{count}} Tests gefunden.",
+      "testsSyncError": "Tests konnten nicht synchronisiert werden.",
+      "testsStartError": "Tests konnten nicht gestartet werden.",
+      "scheduleSaved": "Zeitplan gespeichert",
+      "scheduleSavedDescription": "Die Scheduler-Einstellungen wurden aktualisiert.",
+      "scheduleSaveError": "Zeitplan konnte nicht gespeichert werden.",
+      "pleaseEnterToken": "Bitte geben Sie einen API-Token ein.",
+      "scanStartError": "Scan konnte nicht gestartet werden.",
+      "scanStopError": "Scan konnte nicht gestoppt werden.",
+      "scanStopped": "Scan gestoppt",
+      "scanStoppedDescription": "Der Scan wurde abgebrochen.",
+      "targetSyncError": "Target konnte nicht synchronisiert werden.",
+      "targetSynced": "Target synchronisiert",
+      "targetSyncedDescription": "Polly wurde als Scan-Ziel registriert.",
+      "tokenSaveError": "Token konnte nicht gespeichert werden.",
+      "testDataDeleteError": "Testdaten konnten nicht gelöscht werden."
     },
     "oidc": {
       "backToSettings": "Zurück zu Einstellungen",
@@ -1921,12 +1739,28 @@
       "callbackUrlHint": "In Keycloak als gültige Redirect-URI eintragen",
       "enableOidc": "OIDC Authentifizierung aktivieren",
       "testConnection": "Verbindung testen",
-      "saveSettings": "Einstellungen speichern",
+      "testSuccess": "Keycloak-Verbindung erfolgreich hergestellt.",
+      "testFailed": "Keycloak-Verbindungstest fehlgeschlagen",
+      "testError": "Verbindungstest fehlgeschlagen",
+      "testing": "Teste Verbindung...",
+      "envHint": "Keycloak wird über Umgebungsvariablen konfiguriert. Ändern Sie die Werte in Ihrer .env-Datei oder docker-compose.yml.",
+      "notConfigured": "Keycloak ist nicht konfiguriert. Setzen Sie KEYCLOAK_AUTH_SERVER_URL, KEYCLOAK_REALM und KEYCLOAK_CLIENT_ID in Ihren Umgebungsvariablen.",
+      "active": "Aktiv",
+      "inactive": "Inaktiv",
       "configurationNotes": "Hinweise zur Konfiguration",
       "configNote1": "Die Admin-Rollenzuweisung erfolgt über Keycloak-Gruppen",
       "configNote2": "Benutzer mit der Gruppe \"polly-admins\" erhalten automatisch Admin-Rechte",
       "configNote3": "Die lokale Anmeldung bleibt als Fallback verfügbar",
       "configNote4": "Alle Sessions werden bei Konfigurationsänderungen invalidiert",
+      "ssoButtonLabel": "SSO-Button Beschriftung",
+      "ssoButtonLabelDescription": "Passen Sie den Text des Login-Buttons an, damit Ihre Nutzer den SSO-Anbieter sofort erkennen.",
+      "ssoButtonLabelPlaceholder": "z.B. Kita Hub Login",
+      "ssoButtonLabelHint": "Leer lassen für Standard: „Mit Keycloak anmelden“",
+      "ssoLabelSave": "Speichern",
+      "ssoLabelSaved": "Button-Beschriftung gespeichert",
+      "ssoLabelSavedDescription": "Die neue SSO-Button-Beschriftung wird auf der Login-Seite angezeigt.",
+      "ssoLabelFromEnv": "Aktuell aus Umgebungsvariable",
+      "ssoLabelPreview": "Vorschau:",
       "registrationActivated": "Registrierung aktiviert",
       "registrationActivatedDescription": "Neue Benutzer können sich jetzt registrieren.",
       "registrationDeactivated": "Registrierung deaktiviert",
@@ -1934,7 +1768,8 @@
       "saveError": "Einstellung konnte nicht gespeichert werden.",
       "saved": "Gespeichert",
       "oidcSaved": "OIDC-Einstellungen wurden gespeichert.",
-      "registrationSettingDescription": "Ob die lokale Registrierung aktiviert ist"
+      "registrationSettingDescription": "Ob die lokale Registrierung aktiviert ist",
+      "ssoButtonLabelSettingDescription": "Benutzerdefiniertes SSO-Button-Label für die Login-Seite"
     },
     "database": {
       "backToSettings": "Zurück zu Einstellungen",
@@ -1959,6 +1794,7 @@
       "emailConfig": "E-Mail Konfiguration",
       "smtpDescription": "SMTP-Einstellungen für Benachrichtigungen",
       "active": "Aktiv",
+      "inactive": "Inaktiv",
       "smtpSettings": "SMTP Einstellungen",
       "smtpSettingsDescription": "Konfigurieren Sie den E-Mail-Versand für Benachrichtigungen",
       "smtpHost": "SMTP Host",
@@ -1968,8 +1804,13 @@
       "senderEmail": "Absender E-Mail",
       "senderName": "Absender Name",
       "useTls": "TLS/SSL Verschlüsselung verwenden",
-      "testEmail": "Test-E-Mail senden",
-      "saveSettings": "Einstellungen speichern",
+      "testEmail": "Verbindung testen",
+      "testSuccess": "SMTP-Verbindung erfolgreich hergestellt.",
+      "testFailed": "SMTP-Verbindungstest fehlgeschlagen",
+      "testError": "Verbindungstest fehlgeschlagen",
+      "testing": "Teste Verbindung...",
+      "envHint": "SMTP wird über Umgebungsvariablen konfiguriert. Ändern Sie die Werte in Ihrer .env-Datei oder docker-compose.yml.",
+      "notConfigured": "SMTP ist nicht konfiguriert. Setzen Sie SMTP_HOST, SMTP_USER und SMTP_PASSWORD in Ihren Umgebungsvariablen.",
       "saved": "Gespeichert",
       "emailSaved": "E-Mail-Einstellungen wurden gespeichert."
     },
@@ -2074,7 +1915,7 @@
       "userDescription": "Standard-Benutzerrolle für alle registrierten Mitglieder",
       "manager": "Manager",
       "managerDescription": "Erweiterte Rechte für Team- und Gruppenleiter",
-      "admin": "Administrator",
+      "admin": "Admin",
       "adminDescription": "Vollzugriff auf alle Funktionen und Einstellungen",
       "permissions": {
         "createOwnPolls": "Eigene Umfragen erstellen",
@@ -2105,15 +1946,15 @@
     },
     "calendar": {
       "saved": "Kalender-Einstellungen wurden gespeichert.",
-      "prefixSettings": "Präfix-Einstellungen",
-      "prefixDescription": "Termine erhalten Präfixe je nach Status der Umfrage",
-      "enablePrefixes": "Präfixe aktivieren",
-      "enablePrefixesDescription": "Termine werden mit Status-Präfixen wie 'Vorläufig:' oder 'Bestätigt:' versehen",
-      "germanPrefixes": "Deutsche Präfixe",
-      "englishPrefixes": "Englische Präfixe",
-      "tentativePrefix": "Vorläufig-Präfix",
-      "confirmedPrefix": "Bestätigt-Präfix",
-      "myChoicePrefix": "Meine-Wahl-Präfix",
+      "prefixSettings": "Status-Label-Einstellungen",
+      "prefixDescription": "Termine erhalten Status-Labels als Suffix in Klammern, z.B. 'Terminname (Bestätigt)'",
+      "enablePrefixes": "Status-Labels aktivieren",
+      "enablePrefixesDescription": "Termine erhalten Status-Suffixe wie '(Vorläufig)' oder '(Bestätigt)' am Ende des Titels",
+      "germanPrefixes": "Deutsche Labels",
+      "englishPrefixes": "Englische Labels",
+      "tentativePrefix": "Vorläufig-Label",
+      "confirmedPrefix": "Bestätigt-Label",
+      "myChoicePrefix": "Meine-Wahl-Kennzeichnung",
       "exportScope": "Export-Umfang",
       "exportScopeDescription": "Welche Termine sollen in den Kalender exportiert werden?",
       "scopeAll": "Alle Termine",
@@ -2125,11 +1966,30 @@
       "markingSettings": "Markierungs-Einstellungen",
       "markingDescription": "Zusätzliche Markierungen für bestimmte Termine",
       "markOwnChoices": "Eigene Auswahl markieren",
-      "markOwnChoicesDescription": "Termine mit eigener Ja-Stimme erhalten ein Präfix (z.B. [Meine Wahl])",
+      "markOwnChoicesDescription": "Termine mit eigener Ja-Stimme erhalten eine Kennzeichnung (z.B. [Meine Wahl])",
       "highlightFinal": "Finalen Termin hervorheben",
       "highlightFinalDescription": "Der vom Ersteller gewählte Endtermin wird besonders gekennzeichnet",
       "syncInfo": "Automatische Synchronisation",
-      "syncInfoDescription": "Kalender-Apps aktualisieren abonnierte Feeds regelmäßig automatisch. Änderungen an Präfixen werden bei der nächsten Synchronisation sichtbar."
+      "syncInfoDescription": "Kalender-Apps aktualisieren abonnierte Feeds regelmäßig automatisch. Änderungen an Labels werden bei der nächsten Synchronisation sichtbar.",
+      "defaults": {
+        "tentativePrefix": "Vorläufig",
+        "confirmedPrefix": "Bestätigt",
+        "myChoicePrefix": "[Meine Wahl]",
+        "deTentative": "Vorläufig",
+        "deConfirmed": "Bestätigt",
+        "deMyChoice": "[Meine Wahl]",
+        "enTentative": "Tentative",
+        "enConfirmed": "Confirmed",
+        "enMyChoice": "[My Choice]"
+      },
+      "placeholders": {
+        "deTentative": "Vorläufig",
+        "deConfirmed": "Bestätigt",
+        "deMyChoice": "[Meine Wahl]",
+        "enTentative": "Tentative",
+        "enConfirmed": "Confirmed",
+        "enMyChoice": "[My Choice]"
+      }
     },
     "wcag": {
       "title": "WCAG Barrierefreiheit",
@@ -2167,45 +2027,18 @@
       "perModeCorrections": "Korrekturen werden pro Modus (Light/Dark) angewandt"
     },
     "matrix": {
-      "saved": "Matrix-Einstellungen wurden gespeichert.",
       "title": "Matrix Chat Integration",
       "description": "Chat-Benachrichtigungen über Matrix für SSO-Benutzer",
       "backToSettings": "Zurück zu Einstellungen",
-      "connection": "Matrix Verbindung",
-      "connectionDescription": "Konfigurieren Sie die Verbindung zu Ihrem Matrix Homeserver",
-      "enabled": "Aktiviert",
-      "disabled": "Deaktiviert",
-      "enableIntegration": "Matrix Integration aktivieren",
-      "ssoUsersCanReceive": "SSO-Benutzer können Chat-Benachrichtigungen erhalten",
-      "onlyEmailActive": "Nur E-Mail-Benachrichtigungen aktiv",
-      "homeserverNote": "Diese Integration funktioniert mit jedem Matrix-kompatiblen Homeserver, inkl. dem Bundesmessenger (BUM) oder Ihrem eigenen Matrix-Server.",
-      "homeserverUrlLabel": "Die URL Ihres Matrix Homeservers",
-      "botUserIdLabel": "Die vollständige Matrix-User-ID des Bots",
-      "searchEnabled": "Benutzersuche aktivieren",
-      "searchDescription": "Ermöglicht Type-Ahead-Suche nach Matrix-Benutzern beim Einladen",
-      "botAccessTokenLabel": "Access Token für den Bot",
-      "connectedAs": "Verbunden als {{userId}}",
-      "connectionFailed": "Verbindung fehlgeschlagen",
-      "connectionTestFailed": "Verbindungstest fehlgeschlagen",
-      "tokenHint": "Melden Sie sich als Bot an und generieren Sie einen Access Token über Element oder die Admin-API.",
-      "synapseConfigHint": "Für die vollständige Benutzersuche setzen Sie in Ihrer Synapse-Konfiguration:",
-      "homeserverUrl": "Homeserver URL",
-      "botUserId": "Bot User ID",
-      "botAccessToken": "Bot Access Token",
-      "leaveEmptyToKeep": "Access Token des Bot-Accounts. Leer lassen, um den vorhandenen Token beizubehalten.",
-      "userDirectorySearch": "User Directory Suche aktivieren",
-      "testing": "Teste...",
-      "testConnection": "Verbindung testen",
-      "saving": "Speichern...",
-      "saveSettings": "Einstellungen speichern",
-      "setupTitle": "Hinweise zur Einrichtung",
-      "setupHints": {
-        "createBotAccount": "Bot-Account erstellen",
-        "createBotAccountDescription": "Erstellen Sie einen Matrix-Benutzer (z.B. @pollbot:matrix.example.com) mit einem sicheren Passwort.",
-        "generateToken": "Access Token generieren",
-        "generateTokenDescription": "Melden Sie sich als Bot an und generieren Sie einen Access Token über Element oder die Admin-API.",
-        "userDirectory": "User Directory Suche",
-        "userDirectoryDescription": "Für die vollständige Benutzersuche setzen Sie in Ihrer Synapse-Konfiguration:"
+      "comingSoon": {
+        "badge": "Geplant",
+        "title": "Matrix-Integration kommt bald",
+        "description": "Erstellen und verwalten Sie Umfragen direkt über Matrix-Messenger. Die Integration wird Bot-Befehle, Abstimmungs-Benachrichtigungen und Ergebnis-Zusammenfassungen in Matrix-Räumen unterstützen.",
+        "feature1": "Bot-Account für Matrix/Synapse-Server",
+        "feature2": "Umfragen per Chat-Befehl erstellen",
+        "feature3": "Abstimmungs-Erinnerungen in Matrix-Räumen",
+        "feature4": "Ergebnis-Zusammenfassungen im Kanal",
+        "timeline": "Geplant für Version 1.0"
       }
     },
     "pentest": {
@@ -2314,10 +2147,58 @@
       "logoUploaded": "Logo hochgeladen",
       "logoUploadedDescription": "Das Logo wurde erfolgreich hochgeladen.",
       "logoUploadError": "Logo konnte nicht hochgeladen werden.",
+      "logoDeleted": "Logo gelöscht",
+      "logoDeletedDescription": "Das Logo wurde erfolgreich entfernt.",
+      "logoDeleteError": "Logo konnte nicht gelöscht werden.",
       "uploadFailed": "Upload fehlgeschlagen"
     },
     "time": {
       "now": "jetzt"
+    },
+    "aiSettings": {
+      "loading": "Lade...",
+      "back": "Zurück",
+      "title": "KI-Assistent",
+      "noApiKeyWarning": "Kein API-Key konfiguriert. Hinterlege den GWDG SAIA Bearer Token entweder als Umgebungsvariable (AI_API_KEY) oder über die Felder unten.",
+      "apiConfiguration": "API-Konfiguration",
+      "envPrecedence": "Umgebungsvariablen haben Vorrang. Wenn gesetzt, sind die Felder schreibgeschützt.",
+      "apiKey": "API-Key",
+      "apiKeyPlaceholderSaved": "••••••••  (gespeichert)",
+      "apiKeyPlaceholder": "Bearer Token eingeben",
+      "deleteKeyTitle": "Gespeicherten Key löschen",
+      "envAlternative": "Alternativ als Umgebungsvariable AI_API_KEY setzen",
+      "fallbackKey": "Fallback-Key",
+      "fallbackPlaceholder": "Optional: Fallback Bearer Token",
+      "deleteFallbackTitle": "Gespeicherten Fallback-Key löschen",
+      "fallbackUsageNote": "Wird bei HTTP 429 (Rate-Limit) automatisch verwendet",
+      "apiUrl": "API-URL",
+      "defaultUrl": "Standard:",
+      "general": "Allgemein",
+      "enableAi": "KI-Funktion aktivieren",
+      "enableAiDescription": "Aktiviert den KI-Assistenten für alle konfigurierten Rollen",
+      "model": "Modell",
+      "envOverride": "Env-Override aktiv:",
+      "apiKeyConfigured": "Konfiguriert",
+      "apiKeyNotSet": "Nicht gesetzt",
+      "fallbackKeyConfigured": "Fallback-Key: Konfiguriert",
+      "rateLimiting": "Rate-Limiting pro Rolle",
+      "rateLimitingDescription": "Kontingente pro Stunde. Unbegrenzt = keine Begrenzung, 0 = deaktiviert.",
+      "guests": "Gäste (nicht angemeldet)",
+      "authenticatedUsers": "Angemeldete Nutzer",
+      "administrators": "Administratoren",
+      "saving": "Speichert...",
+      "saveSettings": "Einstellungen speichern",
+      "cancel": "Abbrechen",
+      "savedToast": "KI-Einstellungen gespeichert",
+      "saveError": "Fehler beim Speichern",
+      "unlimited": "Unbegrenzt",
+      "perHour": "/Stunde",
+      "modelRecommended": "Empfohlen",
+      "modelFast": "Schnell",
+      "modelReasoning": "Reasoning",
+      "modelVeryStrong": "Sehr stark",
+      "modelLargest": "Größtes Modell",
+      "modelVeryFast": "Sehr schnell"
     }
   },
   "email": {
@@ -2649,7 +2530,95 @@
     "ctaTitle": "Bereit für bessere Abstimmungen?",
     "ctaDescription": "Starte noch heute mit deiner ersten Umfrage und erlebe, wie einfach Teamkoordination sein kann.",
     "startSchedulePoll": "Terminumfrage starten",
-    "createOrgList": "Orga-Liste erstellen"
+    "createOrgList": "Orga-Liste erstellen",
+    "aiChatTitle": "KI-Assistent",
+    "betaBadge": "Beta",
+    "aiChatHint": "Beschreib einfach, was du brauchst – die KI erstellt einen Entwurf für dich.",
+    "aiMicTooltip": "Spracheingabe",
+    "aiListening": "Ich höre zu...",
+    "aiTranscribing": "Wird verarbeitet...",
+    "aiSpeak": "Sprich jetzt",
+    "aiTranscribingHint": "Sprache wird in Text umgewandelt",
+    "aiSendRecord": "Fertig & Senden",
+    "aiProcessingHint": "Verarbeitet...",
+    "aiMicError": "Mikrofon-Zugriff verweigert",
+    "aiLoginRequired": "Anmeldung erforderlich",
+    "aiLimitReached": "Stundenlimit erreicht",
+    "aiRemaining": "übrig",
+    "aiStart": "Starten",
+    "aiGenerating": "Erstelle...",
+    "aiSuggestion": "Vorschlag",
+    "aiRegenerate": "Neu generieren",
+    "aiTitle": "Titel",
+    "aiDescription": "Beschreibung",
+    "aiOptions": "Optionen",
+    "aiApply": "Übernehmen",
+    "aiError": "KI-Anfrage fehlgeschlagen. Bitte versuche es erneut."
+  },
+  "aiWidget": {
+    "settingsResultsPrivate": "Ergebnisse versteckt",
+    "settingsResultsPublic": "Ergebnisse öffentlich",
+    "settingsNoMaybe": "Nur Ja/Nein",
+    "settingsMaybeAllowed": "Vielleicht erlaubt",
+    "settingsAllowVoteEdit": "Abgabe änderbar",
+    "settingsVoteEditLocked": "Abgabe unveränderbar",
+    "settingsAllowWithdrawal": "Abmeldung möglich",
+    "settingsNoWithdrawal": "Abmeldung nicht möglich",
+    "settingsMultipleSlots": "Mehrere Slots buchbar",
+    "settingsSingleSlot": "Einzelbuchung",
+    "followUpTitle": "Passt noch nicht ganz?",
+    "followUpHint": "Sag mir was du ändern möchtest — oder übernimm den aktuellen Stand und passe es selbst an.",
+    "followUpPlaceholder": "z.B. Die Termine sollen alle nach 15 Uhr sein, mehr Optionen hinzufügen...",
+    "followUpSubmit": "Anpassen",
+    "followUpLoading": "Wird angepasst...",
+    "quickSuggestionsLabel": "Häufige Anpassungen",
+    "quickSuggestionsHint": "Klicke auf eine Anpassung, um sie zu übernehmen.",
+    "followUpPlaceholderOptional": "Noch etwas ergänzen (optional)...",
+    "applyLoading": "Wird erstellt...",
+    "applyError": "Fehler beim Erstellen der Umfrage. Bitte versuche es erneut.",
+    "emailRequired": "E-Mail-Adresse eingeben um fortzufahren:",
+    "emailPlaceholder": "deine@email.de",
+    "allOptionsSelected": "Alle Optionen ausgewählt ✓",
+    "beingAdjusted": "Wird angepasst:",
+    "remove": "Entfernen",
+    "dragToSort": "Ziehen zum Sortieren",
+    "freeText": "Freitext",
+    "refineFailed": "Anpassung fehlgeschlagen. Bitte erneut versuchen.",
+    "pollTypeSchedule": "Terminumfrage",
+    "pollTypeSurvey": "Umfrage",
+    "pollTypeOrganization": "Orga-Liste",
+    "quickSuggestions": {
+      "resultsOnlyCreator": "Ergebnisse nur für den Ersteller sichtbar machen",
+      "resultsPublicAll": "Ergebnisse für alle Teilnehmer öffentlich machen",
+      "submissionsFinal": "Abgaben sollen endgültig sein – keine Änderungen mehr möglich",
+      "allowEditSubmission": "Teilnehmer sollen ihre Abgabe nachträglich ändern können",
+      "disableWithdrawals": "Abmeldungen sperren – Buchungen sollen verbindlich sein",
+      "allowWithdrawal": "Teilnehmer sollen sich nachträglich abmelden können",
+      "singleSlotOnly": "Jede Person darf sich nur für einen einzigen Slot anmelden",
+      "allowMultipleSlots": "Mehrere Slots pro Teilnehmer erlauben",
+      "limitSpots": "Begrenze die Plätze pro Station auf 5 Personen",
+      "addMoreStations": "Füge weitere Stationen oder Zeitslots hinzu",
+      "yesNoOnly": "Nur Ja/Nein als Antworten – kein 'Vielleicht'",
+      "addMaybe": "'Vielleicht' als Antwortmöglichkeit hinzufügen",
+      "addMaybeVoting": "'Vielleicht' als Abstimmungsoption hinzufügen",
+      "addMoreDates": "Füge weitere Terminoptionen hinzu",
+      "weekdaysOnly": "Beschränke die Termine auf Werktage",
+      "addMoreOptions": "Füge weitere Antwortmöglichkeiten hinzu"
+    },
+    "prompts": [
+      "Möchtest du ein Sommerfest planen und die Organisation für Helfer bereitstellen?",
+      "Soll ich dir helfen, einen Elternabend-Termin zu koordinieren?",
+      "Planst du eine Teambesprechung und suchst den besten Termin für alle?",
+      "Möchtest du eine Zufriedenheitsumfrage für dein Team erstellen?",
+      "Soll ich eine Mittagspausen-Einteilung für deine Gruppe organisieren?",
+      "Planst du einen Workshop und brauchst eine Anmeldeliste mit Zeitslots?",
+      "Möchtest du einen Fußballabend mit Freunden terminlich abstimmen?",
+      "Suchst du nach dem besten Wochentag für ein regelmäßiges Meeting?",
+      "Brauchst du eine Feedback-Umfrage nach eurer letzten Veranstaltung?",
+      "Soll ich einen Reinigungsplan mit Schichten für dein Büro erstellen?",
+      "Möchtest du eine Umfrage zu Essensvorlieben für euer Teamlunch machen?",
+      "Planst du ein Abteilungstreffen und brauchst Terminvorschläge?"
+    ]
   },
   "pollCreation": {
     "welcomeBack": "Willkommen zurück!",
@@ -2669,6 +2638,9 @@
     "datePlaceholder": "tt.mm.jjjj",
     "expiryHint": "Nach diesem Datum kann nicht mehr abgestimmt werden.",
     "expiryHintOrga": "Nach diesem Datum können keine Eintragungen mehr erfolgen.",
+    "videoConferenceLabel": "Videokonferenz-Link (optional)",
+    "videoConferencePlaceholder": "https://bbb.example.com/... oder Link eures Videodienstes",
+    "videoConferenceHint": "Link zu einer Videokonferenz (z.B. BigBlueButton oder dem Videodienst eures Vertrauens). Wird im Kalendereintrag und in der Benachrichtigung angezeigt.",
     "expiryReminder": "Erinnerung vor Ablauf",
     "expiryReminderDescription": "Teilnehmer erhalten eine E-Mail-Erinnerung vor dem Ablaufdatum",
     "expiryTooShort": "Die Umfrage endet in {{hours}} Stunden - zu kurz für Erinnerungen",
@@ -2680,8 +2652,10 @@
     "allowVoteWithdrawal": "Stimmen zurückziehen erlauben",
     "allowVoteWithdrawalDescription": "Dürfen Teilnehmende ihre Abstimmung komplett zurückziehen?",
     "resultsPublic": "Ergebnisse öffentlich",
+    "resultsPrivate": "Ergebnisse privat",
     "resultsPublicDescription": "Dürfen Teilnehmende die Ergebnisse einsehen?",
     "creationOptions": "Erstellungsoptionen",
+    "settings": "Einstellungen",
     "loggedInAs": "Angemeldet als {{name}}",
     "linksWillBeSentTo": "Sie erhalten alle Links an:",
     "participationLink": "Teilnahme-Link zum Teilen",
@@ -2730,6 +2704,7 @@
     "choices": "Auswahlmöglichkeiten",
     "addOption": "Option hinzufügen",
     "removeOption": "Option entfernen",
+    "moveOption": "Option verschieben",
     "optionsHint": "Fügen Sie mindestens 2 Optionen hinzu, zwischen denen die Teilnehmer wählen können.",
     "optionPlaceholder": "Option {{number}}",
     "addImage": "Bild hinzufügen (optional):",
@@ -2842,6 +2817,7 @@
     "inviteParticipants": "Teilnehmer einladen",
     "remindParticipants": "Teilnehmer erinnern",
     "endPoll": "Umfrage beenden",
+    "endingPoll": "Umfrage wird beendet …",
     "reactivatePoll": "Umfrage reaktivieren",
     "adminLink": "Admin-Link",
     "editDialogTitle": "Umfrage bearbeiten",
@@ -2891,7 +2867,10 @@
     "searchMatrixPlaceholder": "Benutzername eingeben...",
     "noMatrixResults": "Keine Benutzer gefunden",
     "selectedUsers": "Ausgewählte Benutzer",
+    "selectedParticipants": "Ausgewählte Teilnehmer",
     "sendMatrixInvitations": "Matrix-Einladungen senden",
+    "sendChatInvitations": "Chat-Einladungen senden",
+    "noOptionsAvailable": "Keine Optionen verfügbar",
     "shareDialogTitle": "Umfrage teilen",
     "shareDialogDescription": "Teilen Sie diese Umfrage mit anderen.",
     "publicLinkForParticipants": "Öffentlicher Link für Teilnehmer",
@@ -2944,7 +2923,8 @@
       "linkCopied": "Link wurde in die Zwischenablage kopiert.",
       "linkNotCopied": "Link konnte nicht kopiert werden.",
       "enterValidEmail": "Bitte geben Sie mindestens eine gültige E-Mail-Adresse ein."
-    }
+    },
+    "inviteEmailsPlaceholder": "max@example.de, anna@example.de"
   },
   "myPolls": {
     "title": "Meine Umfragen",
@@ -2961,7 +2941,10 @@
     "newOrga": "Orga",
     "tabCreated": "Meine Umfragen",
     "tabParticipated": "Teilnahmen",
+    "tabArchive": "Archiv",
     "tabAdmin": "Administration",
+    "noArchivedPolls": "Keine archivierten Umfragen",
+    "archiveDescription": "Hier werden abgelaufene und manuell geschlossene Umfragen angezeigt.",
     "emptyCreated": "Keine Umfragen erstellt",
     "emptyCreatedDesc": "Sie haben noch keine Umfragen erstellt. Erstellen Sie jetzt Ihre erste Umfrage!",
     "emptyParticipated": "Keine Teilnahmen",
@@ -2972,6 +2955,17 @@
     "subscriptionLink": "Abonnement-Link",
     "openInCalendar": "In Kalender öffnen",
     "regenerateToken": "Token erneuern",
+    "statsActivePolls": "Aktive Umfragen",
+    "statsTotalPolls": "Gesamt Umfragen",
+    "statsParticipations": "Teilnahmen",
+    "statsThisWeek": "Diese Woche",
+    "showResults": "Ergebnisse anzeigen",
+    "shareLinkCopied": "Der Abstimmungslink wurde in die Zwischenablage kopiert.",
+    "deleteConfirmTitle": "Umfrage löschen?",
+    "deleteConfirmDesc": "Möchten Sie die Umfrage \"{{title}}\" wirklich löschen? Diese Aktion kann nicht rückgängig gemacht werden.",
+    "pollDeleted": "Umfrage gelöscht",
+    "pollDeletedDesc": "Die Umfrage wurde erfolgreich gelöscht.",
+    "pollDeleteError": "Die Umfrage konnte nicht gelöscht werden.",
     "toasts": {
       "tokenRegenerated": "Kalender-Token erneuert",
       "tokenRegeneratedDesc": "Der alte Link funktioniert nicht mehr. Bitte aktualisieren Sie Ihre Kalender-App.",
@@ -3078,24 +3072,6 @@
     "creating": "Erstelle...",
     "createSchedulePoll": "Terminumfrage erstellen"
   },
-  "dashboard": {
-    "managePolls": "Verwalten Sie Ihre Umfragen und Termine übersichtlich",
-    "schedule": "Termin",
-    "activePolls": "Aktive Umfragen",
-    "totalPolls": "Gesamt Umfragen",
-    "participations": "Teilnahmen",
-    "thisWeek": "Diese Woche",
-    "sharedPolls": "Geteilte Umfragen",
-    "archive": "Archiv",
-    "noSharedPolls": "Keine geteilten Umfragen",
-    "sharedPollsDescription": "Umfragen, an denen Sie teilgenommen haben, werden hier angezeigt.",
-    "archiveComingSoon": "Archiv wird bald verfügbar sein",
-    "archiveDescription": "Abgelaufene und beendete Umfragen werden hier archiviert.",
-    "participants": "Teilnehmer",
-    "created": "Erstellt",
-    "expiresAt": "Läuft ab",
-    "showResults": "Ergebnisse anzeigen"
-  },
   "confirmEmail": {
     "unknownError": "Ein unbekannter Fehler ist aufgetreten.",
     "invalidLink": "Ungültiger oder fehlender Bestätigungslink.",
@@ -3174,7 +3150,15 @@
     "noChanges": "Keine Änderungen vorgenommen",
     "changesSaved": "Ihre Änderungen wurden gespeichert",
     "errorSaving": "Fehler beim Speichern der Änderungen",
-    "unsavedChanges": "Sie haben ungespeicherte Änderungen"
+    "unsavedChanges": "Sie haben ungespeicherte Änderungen",
+    "responsesChanged": "Ihre Antworten wurden aktualisiert",
+    "updateError": "Fehler beim Aktualisieren Ihrer Abstimmung",
+    "voteRemoved": "Ihre Abstimmung wurde zurückgezogen",
+    "withdrawError": "Fehler beim Zurückziehen Ihrer Abstimmung",
+    "loadingVote": "Abstimmung wird geladen …",
+    "voteNotFound": "Abstimmung nicht gefunden",
+    "invalidLink": "Dieser Link ist ungültig oder abgelaufen.",
+    "withdrawing": "Wird zurückgezogen …"
   },
   "liveResults": {
     "title": "Live-Ergebnisse",
@@ -3197,5 +3181,46 @@
     "scheduleType": "Terminumfrage",
     "surveyType": "Umfrage",
     "organizationType": "Orga-Liste"
+  },
+  "aiCreator": {
+    "createWithAi": "Mit KI erstellen",
+    "unlimited": "Unbegrenzt",
+    "quotaExhausted": "Kontingent aufgebraucht",
+    "requestsRemaining_one": "{{count}} Anfrage übrig",
+    "requestsRemaining_other": "{{count}} Anfragen übrig",
+    "title": "KI-Assistent",
+    "description": "Beschreibe deine Umfrage — die KI schlägt Titel, Beschreibung und Optionen vor.",
+    "gdprNote": "GWDG SAIA · DSGVO-konform · Server in Deutschland",
+    "guestNotAllowed": "Bitte melde dich an, um den KI-Assistenten zu nutzen.",
+    "rateLimitExceeded": "Stundenlimit erreicht. Versuche es {{time}} erneut.",
+    "rateLimitLater": "später",
+    "notAvailable": "KI-Assistent momentan nicht verfügbar.",
+    "placeholderSchedule": "z.B. Teambesprechung für nächste Woche planen, 5–6 Personen, bevorzugt Dienstag oder Donnerstag morgens",
+    "placeholderSurvey": "z.B. Zufriedenheitsumfrage für unsere letzte Teamveranstaltung",
+    "placeholderOrganization": "z.B. Mittagspausen-Schichten für 3 Personen, Montag bis Freitag",
+    "placeholderDefault": "Beschreibe deine Umfrage oder Terminabfrage...",
+    "requestFailed": "KI-Anfrage fehlgeschlagen",
+    "generating": "Erstelle...",
+    "generate": "Vorschlag generieren",
+    "regenerate": "Neu generieren",
+    "suggestion": "Vorschlag",
+    "suggestionTitle": "Titel",
+    "suggestionDescription": "Beschreibung",
+    "suggestionOptions": "Optionen ({{count}})",
+    "apply": "Vorschlag übernehmen",
+    "requestsRemaining": "{{count}} Anfragen verbleibend"
+  },
+  "forcePassword": {
+    "title": "Passwort ändern erforderlich",
+    "description": "Sie verwenden das Standard-Administratorpasswort. Aus Sicherheitsgründen müssen Sie Ihr Passwort ändern, bevor Sie fortfahren können.",
+    "currentPassword": "Aktuelles Passwort",
+    "newPassword": "Neues Passwort",
+    "confirmPassword": "Neues Passwort bestätigen",
+    "passwordsMismatch": "Passwörter stimmen nicht überein",
+    "passwordTooShort": "Passwort muss mindestens 8 Zeichen lang sein",
+    "error": "Fehler beim Ändern des Passworts",
+    "logout": "Abmelden",
+    "changing": "Wird geändert...",
+    "submit": "Passwort ändern"
   }
-}
\ No newline at end of file
+}
diff --git a/client/src/locales/en.json b/client/src/locales/en.json
index 6d517385..cac8e1b6 100644
--- a/client/src/locales/en.json
+++ b/client/src/locales/en.json
@@ -29,6 +29,7 @@
     "copied": "Copied!",
     "share": "Share",
     "download": "Download",
+    "inDevelopment": "In Development",
     "export": "Export",
     "import": "Import",
     "preview": "Preview",
@@ -95,343 +96,6 @@
       "pressToExit": "Press",
       "toExit": "to exit"
     },
-    "admin": {
-      "security": {
-        "breadcrumb": "Security & GDPR",
-        "title": "Security & Privacy",
-        "description": "GDPR compliance and data security",
-        "gdprCompliant": "GDPR-compliant",
-        "encryption": "Encryption",
-        "encryptionDescription": "Information about data encryption",
-        "transportEncryption": "Transport Encryption",
-        "tlsDescription": "TLS 1.3 for all connections",
-        "databaseEncryption": "Database Encryption",
-        "aesDescription": "AES-256 at rest encryption",
-        "passwordHashing": "Password Hashing",
-        "bcryptDescription": "bcrypt with Salt-Rounds: 12",
-        "sessionSecurity": "Session Security",
-        "sessionDescription": "HTTP-Only, Secure, SameSite",
-        "active": "Active",
-        "rateLimit": "Login Rate Limiting",
-        "rateLimitDescription": "Protection against brute-force attacks on local logins",
-        "enableRateLimit": "Enable rate limiting",
-        "limitAttempts": "Limits failed login attempts",
-        "maxAttempts": "Max. attempts",
-        "attempts": "{{count}} attempts",
-        "beforeLockout": "Count before lockout",
-        "timeWindow": "Time window",
-        "minutes": "{{count}} minutes",
-        "counterWindow": "Counter window",
-        "lockoutTime": "Lockout time",
-        "waitTimeAfterLockout": "Wait time after lockout",
-        "currentlyTracked": "Currently tracked",
-        "lockedAccounts": "Locked accounts",
-        "clearAllLocks": "Clear all locks",
-        "clearLocksTitle": "Clear all rate limit locks?",
-        "clearLocksDescription": "This will clear all current login locks. Users can immediately try to log in again.",
-        "clearLocks": "Clear locks",
-        "saveRateLimit": "Save rate limiting",
-        "apiRateLimits": "API Rate Limits",
-        "apiRateLimitsDescription": "Configure rate limits for various API endpoints",
-        "registrationLimit": "Registration",
-        "registrationLimitDescription": "Limits registration attempts per IP",
-        "passwordResetLimit": "Password Reset",
-        "passwordResetLimitDescription": "Limits password reset requests",
-        "pollCreationLimit": "Poll Creation",
-        "pollCreationLimitDescription": "Limits creation of new polls",
-        "votingLimit": "Voting",
-        "votingLimitDescription": "Limits votes per time window",
-        "emailLimit": "Email Sending",
-        "emailLimitDescription": "Limits email requests",
-        "apiGeneralLimit": "General API",
-        "apiGeneralLimitDescription": "General API rate limit",
-        "maxRequestsLabel": "Max. Requests",
-        "timeWindowSeconds": "Time Window (sec.)",
-        "limitEnabled": "Active",
-        "saveApiRateLimits": "Save API Limits",
-        "apiRateLimitsSaved": "API rate limits have been saved",
-        "clearApiRateLimits": "Clear all API limits",
-        "requestsPerWindow": "{{count}} requests / {{window}}",
-        "perHour": "per hour",
-        "perMinute": "per minute",
-        "perSeconds": "per {{count}} seconds",
-        "virusScanner": "Virus Scanner (ClamAV)",
-        "virusScannerDescription": "Upload checking before persistence - Required for government pentests",
-        "virusScanInfo": "All uploads are checked by ClamAV BEFORE saving. Files with detected viruses are rejected and never persisted.",
-        "enableVirusScanner": "Enable virus scanner",
-        "scanAllUploads": "Scan all uploads before saving",
-        "clamdServerAddress": "clamd server address",
-        "port": "Port",
-        "defaultPort": "Default: 3310",
-        "timeout": "Timeout (seconds)",
-        "seconds": "{{count}} seconds",
-        "maxScanWait": "Max. scan wait time",
-        "maxFileSize": "Max. file size (MB)",
-        "largerFilesRejected": "Larger files will be rejected",
-        "testConnection": "Test connection",
-        "testing": "Testing...",
-        "saveClamav": "Save ClamAV",
-        "clamavWarningTitle": "ClamAV Connection Failed",
-        "clamavWarningDescription": "The connection to the ClamAV virus scanner could not be established. If you enable the scanner anyway, all file uploads will be blocked for security reasons (fail-secure principle).",
-        "clamavWarningConsequence": "Warning: No user will be able to upload images or files as long as the scanner is enabled but unreachable!",
-        "clamavWarningCancel": "Cancel and correct",
-        "clamavWarningProceed": "Enable anyway",
-        "testingBeforeSave": "Testing connection...",
-        "dataRetentionDescription": "Configure automatic cleanup of old data by user type (GDPR Art. 5)",
-        "guestUsers": "Guest Users",
-        "anonymous": "Anonymous",
-        "ssoUsers": "SSO Users",
-        "authenticated": "Authenticated",
-        "guestUsersNote": "Guest users are anonymous users who participate in polls without logging in. Their data should be deleted promptly in accordance with GDPR principles.",
-        "day": "day",
-        "days": "days",
-        "never": "Never",
-        "expiredGuestPolls": "Expired guest schedule polls",
-        "expiredPollsDescription": "Dates that have passed",
-        "anonymizeGuestVotes": "Anonymize guest votes",
-        "removeEmailsFromVotes": "Remove email addresses from votes",
-        "immediateAfterPoll": "Immediately after poll",
-        "archiveExpiredPolls": "Archive expired schedule polls",
-        "saveDeprovision": "Save deprovisioning",
-        "gdprFunctions": "GDPR Functions",
-        "gdprCompliance": "General Data Protection Regulation Compliance",
-        "rightToAccess": "Right of Access (Art. 15)",
-        "dataExportAvailable": "Data export available",
-        "rightToErasure": "Right to Erasure (Art. 17)",
-        "accountDeletionPossible": "Account deletion possible",
-        "dataMinimization": "Data Minimization (Art. 5)",
-        "onlyNecessaryData": "Only necessary data",
-        "storageLimitation": "Storage Limitation (Art. 5)",
-        "autoDeleteConfigurable": "Auto-delete configurable",
-        "saveSettings": "Save settings",
-        "settingsSaved": "Security settings have been saved.",
-        "scanLogs": "Scan Logs",
-        "scanLogsDescription": "Audit trail of all file uploads scanned by ClamAV",
-        "viewScanLogs": "View Scan Logs",
-        "scanLogsTitle": "ClamAV Scan Log",
-        "allScans": "All Scans",
-        "cleanFiles": "Clean",
-        "infectedFiles": "Infected",
-        "errorScans": "Errors",
-        "filename": "Filename",
-        "fileSize": "Size",
-        "status": "Status",
-        "virusName": "Virus Detected",
-        "uploader": "Uploader",
-        "scannedAt": "Scanned",
-        "scanDuration": "Duration",
-        "action": "Action",
-        "allowed": "Allowed",
-        "blocked": "Blocked",
-        "noScansYet": "No scans recorded yet",
-        "loadingScans": "Loading scan logs...",
-        "scanStats": "Scan Statistics",
-        "totalScans": "Total Scans",
-        "last24Hours": "Last 24 Hours",
-        "last7Days": "Last 7 Days",
-        "avgScanTime": "Avg. Scan Time",
-        "detectionRate": "Detection Rate",
-        "filterByStatus": "Filter by Status",
-        "allStatuses": "All Statuses",
-        "clean": "Clean",
-        "infected": "Infected",
-        "error": "Error",
-        "skipped": "Skipped",
-        "exportLogs": "Export Logs",
-        "refreshLogs": "Refresh",
-        "showDetails": "Show Details",
-        "scanLogDetails": "Scan Log Details",
-        "mimeType": "MIME Type",
-        "requestIp": "Request IP",
-        "errorMessage": "Error Message",
-        "adminNotified": "Admin Notified",
-        "notApplicable": "N/A",
-        "dataRetention": "Data Retention & Auto-Delete",
-        "gdprDataRetentionNote": "Your data should be deleted promptly in accordance with GDPR principles.",
-        "deleteInactiveGuestPolls": "Delete inactive guest polls",
-        "anonymousPollsNoActivity": "Anonymous polls without activity",
-        "ssoUserNote": "SSO users are authenticated users via Keycloak/OIDC. Their data can be retained longer as they are assigned to an organization.",
-        "deleteInactiveUserPolls": "Delete inactive user polls",
-        "userPollsNoActivity": "Polls from authenticated users without activity",
-        "schedulesArchived": "Schedules are archived, not deleted",
-        "cleanupDeletedUserData": "Clean up deleted user data",
-        "afterKeycloakDeletion": "After Keycloak account deletion",
-        "pollsOnUserDeletion": "Polls on user deletion",
-        "whatHappensToPolls": "What happens to polls of deleted users",
-        "delete": "Delete",
-        "keep": "Keep",
-        "transfer": "Transfer to Admin",
-        "kafkaIntegration": "Integration with Kafka/Keycloak deprovisioning service for automatic user deletion",
-        "deprovisionNote": "With external deprovisioning enabled, user deletion is controlled centrally via your Kafka/Keycloak service.",
-        "userDeletionDisabled": "User deletion in admin panel disabled. All deletions are done via the deprovisioning service."
-      },
-      "tests": {
-        "title": "Automated Tests",
-        "description": "Run and monitor backend integration tests",
-        "run": "Run Tests",
-        "running": "Running...",
-        "passed": "Passed",
-        "failed": "Failed",
-        "pending": "Pending",
-        "noTests": "No tests available",
-        "testResults": "Test Results",
-        "backToSettings": "Back to Settings",
-        "automatedTests": "Automated Tests",
-        "automatedTestsDescription": "Run and monitor backend integration tests",
-        "startTests": "Start Tests",
-        "lastRun": "Last Test Run",
-        "details": "Details",
-        "total": "Total",
-        "skipped": "Skipped",
-        "duration": "Duration",
-        "testHistory": "Test History",
-        "loadingHistory": "Loading history...",
-        "noTestsYet": "No tests have been run yet.",
-        "manual": "Manual",
-        "scheduled": "Scheduled",
-        "loadMoreHistory": "Load older results ({{count}} more)",
-        "testMode": "Test Mode",
-        "testModeDescription": "Choose whether to run all tests automatically or only selected tests.",
-        "automatic": "Automatic",
-        "allTests": "(all tests)",
-        "manualMode": "Manual",
-        "selectedTests": "(selected tests)",
-        "synchronize": "Synchronize",
-        "testConfiguration": "Test Configuration",
-        "autoModeActive": "Automatic mode: All tests will be executed",
-        "manualModeActive": "Manual mode: Only enabled tests will be executed",
-        "loadingConfig": "Loading test configuration...",
-        "noTestsInCategory": "No tests found in this category.",
-        "noTestsFound": "No tests found. Click \"Synchronize\" to scan for tests.",
-        "active": "active",
-        "automaticExecution": "Automatic Execution",
-        "enableAutoTests": "Enable automatic tests",
-        "intervalDays": "Interval (Days)",
-        "runTime": "Run Time",
-        "notificationEmail": "Notification Email",
-        "testRunDetails": "Test Run #{{id}} - Details",
-        "showAllTests": "Show all tests",
-        "showPassedTests": "Show only passed tests",
-        "showFailedTests": "Show only failed tests",
-        "showSkippedTests": "Show only skipped tests",
-        "testTypes": {
-          "unit": "Unit Tests",
-          "unitDescription": "Individual functions and components",
-          "integration": "Integration Tests",
-          "integrationDescription": "API endpoints and database operations",
-          "e2e": "E2E Tests",
-          "e2eDescription": "Browser-based end-to-end tests",
-          "data": "Data Tests",
-          "dataDescription": "Fixtures and test data generation",
-          "accessibility": "Accessibility",
-          "accessibilityDescription": "WCAG 2.1 AA color contrast and accessibility"
-        },
-        "testDataManagement": "Test Data Management",
-        "testDataDescription": "Test data is created during test runs and is excluded from dashboard statistics.",
-        "loadingTestStats": "Loading test data statistics...",
-        "testPolls": "Test Polls",
-        "testOptions": "Test Options",
-        "testVotes": "Test Votes",
-        "testUsers": "Test Users",
-        "noTestData": "No test data available",
-        "testDataFound": "{{count}} test data entries found",
-        "deleteTestData": "Delete Test Data",
-        "deleteTestDataTitle": "Delete Test Data?",
-        "deleteTestDataDescription": "This action will delete all test data from the database:",
-        "cannotBeUndone": "This action cannot be undone.",
-        "modeChanged": "Mode changed",
-        "modeChangedDescription": "The test mode has been updated.",
-        "modeChangeError": "Mode could not be changed.",
-        "testChangeError": "Test could not be changed.",
-        "testsSynced": "Tests synchronized",
-        "testsSyncedDescription": "{{count}} tests found.",
-        "testsSyncError": "Tests could not be synchronized.",
-        "testsStarted": "Tests started",
-        "testsStartedDescription": "Tests are running in the background. Results will be displayed here.",
-        "testsStartError": "Tests could not be started.",
-        "scheduleSaved": "Schedule saved",
-        "scheduleSavedDescription": "The scheduler settings have been updated.",
-        "scheduleSaveError": "Schedule could not be saved.",
-        "testDataDeleted": "Test data deleted",
-        "testDataDeletedDescription": "All test data has been successfully removed from the database.",
-        "testDataDeleteError": "Test data could not be deleted.",
-        "completed": "Completed",
-        "history": "Test History",
-        "historyDescription": "Past test runs and their results",
-        "noRuns": "No test runs available",
-        "runTests": "Run Tests",
-        "runTestsDescription": "Run automated tests to verify system stability.",
-        "progress": "Progress",
-        "started": "Tests started",
-        "startedDescription": "Tests are now running.",
-        "startError": "Tests could not be started.",
-        "stopped": "Tests stopped",
-        "stoppedDescription": "Tests have been aborted.",
-        "stopError": "Tests could not be stopped.",
-        "stopTests": "Stop Tests",
-        "pleaseEnterToken": "Please enter an API token.",
-        "tokenSaveError": "Token could not be saved.",
-        "targetSynced": "Target synchronized",
-        "targetSyncedDescription": "Polly has been registered as a scan target.",
-        "targetSyncError": "Target could not be synchronized.",
-        "scanStartError": "Scan could not be started.",
-        "scanStopped": "Scan stopped",
-        "scanStoppedDescription": "The scan has been aborted.",
-        "scanStopError": "Scan could not be stopped.",
-        "lastTestRun": "Last Test Run #{{id}}",
-        "testRunDetailsTitle": "Test Run #{{id}} - Details",
-        "enableAutomaticTests": "Enable automatic tests",
-        "noTestsFoundClickSync": "No tests found. Click \"Synchronize\" to scan for tests.",
-        "runningTests": "Running...",
-        "noTestsRun": "No tests have been run yet.",
-        "loadOlderResults": "Load older results ({{count}} more)",
-        "automaticModeNote": "Automatic mode: All tests will be run",
-        "automaticModeNoteAvailable": "Automatic mode: All available tests will be run",
-        "manualModeNote": "Manual mode: Only enabled tests will be run",
-        "environmentDetected": "{{environment}} environment detected",
-        "e2eOnlyInCICD": "E2E and accessibility tests are only available in the CI/CD pipeline (require Playwright).",
-        "cicdOnly": "Only available in CI/CD pipeline",
-        "notAvailable": "Not available",
-        "environments": {
-          "replit": "Replit",
-          "docker": "Docker",
-          "ci": "CI/CD Pipeline",
-          "local": "Local Development"
-        },
-        "showSkippedOnly": "Show only skipped tests",
-        "showPassedOnly": "Show only passed tests",
-        "showFailedOnly": "Show only failed tests",
-        "deleteTestDataWarning": "This action will delete all test data from the database:",
-        "deleteTestDataPermanent": "This action cannot be undone.",
-        "delete": "Delete",
-        "recommendedSolution": "Recommended Solution:",
-        "loadingTestConfig": "Loading test configuration...",
-        "noTestDataPresent": "No test data present",
-        "loadingTestDataStats": "Loading test data statistics...",
-        "e2eSkippedNote": "E2E tests only run in CI/CD environments",
-        "e2eSkippedDescription": "Browser tests require Playwright and are skipped in the internal environment."
-      },
-      "sessionTimeout": {
-        "saved": "Session timeout settings have been saved.",
-        "breadcrumb": "Session Timeout",
-        "title": "Automatic Session Logout",
-        "description": "Configure role-based timeout times for automatic logout",
-        "usersAutoLoggedOut": "Users are automatically logged out after inactivity",
-        "timeoutEnabled": "Session timeout enabled",
-        "enableAutoLogout": "Enable automatic logout after inactivity",
-        "timeoutDisabledNote": "With session timeout disabled, users remain logged in until manual logout or cookie expiry (24 hours).",
-        "roleBasedTimeouts": "Role-based Timeouts",
-        "roleBasedDescription": "Different timeout times based on user role",
-        "longestSessionForAdmins": "Longest session for administrators",
-        "mediumSessionForManagers": "Medium session for managers",
-        "shortestSessionForUsers": "Shortest session for regular users",
-        "hours": "hours",
-        "minutes": "minutes",
-        "warningSettings": "Warning",
-        "warningNote": "Users see a warning {{minutes}} minute(s) before logout with the option to extend the session.",
-        "sessionInfo": "The session timeout function checks the user's last activity and logs them out automatically after the configured inactivity time. Activities like mouse clicks, keyboard inputs, and page changes extend the session."
-      }
-    },
     "ui": {
       "datePicker": {
         "placeholder": "Select date"
@@ -549,11 +213,11 @@
       },
       "quickTemplates": "Quick Templates",
       "selectTemplateAndDate": "Select a template and then a date"
-    }
+    },
+    "minLabel": "Min"
   },
   "nav": {
     "home": "Home",
-    "dashboard": "Dashboard",
     "myPolls": "My Polls",
     "createPoll": "Create Poll",
     "admin": "Administration",
@@ -619,6 +283,12 @@
       "serverError": "A server error occurred. Please try again later.",
       "passwordRequirements": "Please meet all password requirements",
       "pleaseEnterValidEmail": "Please enter valid email id."
+    },
+    "placeholders": {
+      "email": "john@example.com",
+      "name": "John Doe",
+      "username": "john123",
+      "emailList": "john@example.com, anna@example.com"
     }
   },
   "polls": {
@@ -705,7 +375,13 @@
     "currentlyViewing": "viewing...",
     "liveResults": "Live Results",
     "fullscreen": "Fullscreen",
-    "exitFullscreen": "Exit Fullscreen"
+    "exitFullscreen": "Exit Fullscreen",
+    "yes": "Yes",
+    "no": "No",
+    "maybe": "Maybe",
+    "noOptionsAvailable": "No options available",
+    "clickToEnlarge": "Click to enlarge",
+    "textOptions": "Text options"
   },
   "schedule": {
     "selectDates": "Select Dates",
@@ -732,7 +408,12 @@
     "uploadImage": "Upload Image",
     "altText": "Alt Text",
     "singleChoice": "Single Choice",
-    "multipleChoice": "Multiple Choice"
+    "multipleChoice": "Multiple Choice",
+    "addFreeTextQuestion": "Add question",
+    "freeTextQuestion": "Open question",
+    "freeTextQuestionPlaceholder": "Enter question...",
+    "freeTextAnswerPlaceholder": "Your answer...",
+    "freeTextAnswerOptional": "Answer (optional)"
   },
   "organization": {
     "slotName": "Slot Name",
@@ -763,7 +444,38 @@
     "exportToPdf": "Export PDF",
     "noResults": "No results yet",
     "votesForPoll": "Votes for poll",
-    "total": "Total"
+    "total": "Total",
+    "openAnswers": "Open answers",
+    "noAnswersYet": "No answers submitted yet.",
+    "entries": "Entries",
+    "resultsTitle": "Results",
+    "personSignedUpSingular": "{{count}} person signed up",
+    "personSignedUpPlural": "{{count}} people signed up",
+    "personVotedSingular": "{{count}} person voted",
+    "personVotedPlural": "{{count}} people voted",
+    "totalEntries": "Total entries",
+    "totalVotes": "Total votes",
+    "entrySingular": "entry",
+    "entriesPlural": "entries",
+    "voteSingular": "vote",
+    "votesPlural": "votes",
+    "participantsLabel": "Participants: {{count}}",
+    "totalEntriesCount": "Total entries: {{count}}",
+    "totalVotesCount": "Total votes: {{count}}",
+    "bestOption": "Most popular option",
+    "points": "{{count}} points",
+    "pointsLabel": "Points: {{count}}",
+    "scoringDescription": "Scoring: Yes = 2 points, Maybe = 1 point, No = 0 points",
+    "slotsAndEntries": "Slots and entries",
+    "detailedResults": "Detailed results",
+    "csvExport": "CSV Export",
+    "pdfExport": "PDF Export",
+    "icsExport": "Calendar",
+    "icsExportError": "Calendar export could not be created. The poll options do not contain valid date/time values.",
+    "option": "Option",
+    "noEntriesYet": "No entries yet",
+    "full": "full",
+    "pointsHeader": "Points"
   },
   "resultsChart": {
     "tie": "Tie",
@@ -775,7 +487,29 @@
     "maxCapacity": "Capacity must be at most 9999",
     "capacitySet": "Capacity set to {{count}}",
     "participantsOverview": "{{count}} participants",
-    "votedAt": "Voted at"
+    "votedAt": "Voted at",
+    "confirmedDate": "Confirmed Date",
+    "confirmedResult": "Confirmed Result",
+    "confirmDate": "Confirm",
+    "confirmColumn": "Confirm Date",
+    "setResultColumn": "Set Result",
+    "setResult": "Set",
+    "confirmed": "Confirmed",
+    "undoConfirmation": "Undo",
+    "dateConfirmed": "Date has been confirmed.",
+    "resultConfirmed": "Result has been set.",
+    "dateUnconfirmed": "Date confirmation has been removed",
+    "resultUnconfirmed": "Result has been removed",
+    "finalizeFailed": "Error confirming the date",
+    "confirmDialogTitle": "Confirm this date?",
+    "confirmDialogDescription": "Are you sure you want to confirm {{date}} {{time}} as the final date? This will be visible to all participants.",
+    "confirmResultDialogTitle": "Set this result?",
+    "confirmResultDialogDescription": "Are you sure you want to set \"{{option}}\" as the final result? This will be visible to all participants.",
+    "closePollOption": "Close poll (no more votes)",
+    "videoConferenceLink": "Join video conference",
+    "notifyParticipantsOption": "Notify participants via email (with calendar invitation)",
+    "pollClosed": "The poll has been closed.",
+    "participantsNotified": "Participants have been notified."
   },
   "pollTypes": {
     "schedule": "Schedule",
@@ -943,9 +677,16 @@
       "joined": "Joined",
       "password": "Password",
       "provider": "Provider",
+      "emailStatus": "Email Status",
+      "emailVerified": "Verified",
+      "emailNotVerified": "Not verified",
+      "verifyEmail": "Manually verify email",
+      "emailVerifiedSuccess": "Email verified",
+      "emailVerifiedDescription": "The email address has been marked as verified.",
       "noUsersFound": "No users found.",
       "noPolls": "No Polls",
       "userPolls": "User Polls",
+      "userPollsDescription": "Polls created by this user",
       "viewDetails": "View Details",
       "details": "Details",
       "management": "User Management",
@@ -957,7 +698,8 @@
       "editUser": "Edit User",
       "addUserTitle": "Add New User",
       "addUserDescription": "Create a new user account for the system.",
-      "totalCount": "{{count}} Users"
+      "totalCount": "{{count}} Users",
+      "saveError": "Error saving user"
     },
     "userManagement": "User Management",
     "createUser": "Create User",
@@ -967,6 +709,10 @@
     "roleUser": "User",
     "roleAdmin": "Administrator",
     "roleManager": "Manager",
+    "accessDenied": "Access Denied",
+    "noPermission": "You do not have permission to access this area.",
+    "userRole": "Your role",
+    "unknown": "Unknown",
     "allPolls": "All Polls",
     "systemSettings": "System Settings",
     "emailTemplates": {
@@ -978,6 +724,8 @@
       "themeDescription": "Colors and fonts for all emails",
       "resetTheme": "Reset",
       "importTheme": "Import Theme",
+      "importThemeDisabledHint": "This feature is in development. Use the color settings below to customize your email design.",
+      "themeHint": "Email colors are controlled directly via the settings below.",
       "backdrop": "Backdrop",
       "canvas": "Content Area",
       "textColor": "Text Color",
@@ -1011,9 +759,9 @@
       "centralFooter": "Central Email Footer",
       "centralFooterDescription": "This footer is automatically appended to all emails",
       "footerText": "Footer Text",
-      "footerPlaceholder": "e.g. This email was automatically generated by {{siteName}}.",
-      "footerVariableHint": "You can use {{siteName}} as a variable",
-      "footerVariableNote": "You can use {{siteName}} as a variable",
+      "footerPlaceholder": "This email was automatically generated by {{siteName}}.\n{{link:#|Privacy Policy}}",
+      "footerVariableHint": "Variables: {{siteName}} (site name), {{siteUrl}} (site URL). Links: {{link:URL|Text}} e.g. {{link:#|Privacy Policy}}",
+      "footerVariableNote": "Variables: {{siteName}} (site name), {{siteUrl}} (site URL). Links: {{link:URL|Text}} e.g. {{link:#|Privacy Policy}}",
       "saveFooter": "Save Footer",
       "emailBranding": "Email Branding",
       "emailBrandingNote": "The email header with logo and title is automatically taken from your branding settings (Customize → Logo & Branding). The footer above applies to all emails.",
@@ -1302,7 +1050,14 @@
       "days": "days",
       "day": "day",
       "settingsSaved": "Security settings have been saved.",
-      "saveSettings": "Save settings"
+      "saveSettings": "Save settings",
+      "clamavHost": "ClamAV Host",
+      "clamavWarningTitle": "ClamAV Connection Failed",
+      "clamavWarningDescription": "The connection to the ClamAV virus scanner could not be established. If you enable the scanner anyway, all file uploads will be blocked for security reasons (fail-secure principle).",
+      "clamavWarningConsequence": "Warning: No user will be able to upload images or files as long as the scanner is enabled but unreachable!",
+      "clamavWarningCancel": "Cancel and correct",
+      "clamavWarningProceed": "Enable anyway",
+      "testingBeforeSave": "Testing connection..."
     },
     "securityScan": "Security Scan",
     "vulnerabilities": "Vulnerabilities",
@@ -1606,6 +1361,11 @@
         "title": "Pentest Tools",
         "description": "Security scanning and vulnerability analysis"
       },
+      "ai": {
+        "title": "AI Assistant",
+        "description": "Configure GWDG SAIA API, select model and set quotas per role",
+        "sectionTitle": "AI Features"
+      },
       "integrations": {
         "title": "Integrations",
         "matrix": {
@@ -1669,6 +1429,7 @@
       "linkLabel": "Link Label",
       "logo": "Logo",
       "deleteLogo": "Delete logo",
+      "uploadLogo": "Upload logo",
       "resetDefaults": "Reset to Defaults",
       "saveBranding": "Save Branding",
       "saveFooter": "Save Footer",
@@ -1677,7 +1438,12 @@
       "siteNameAccent": "Accent Part (colored)",
       "supportLinks": "Support Links",
       "themeDescription": "Color scheme and theme settings",
-      "themeSection": "Theme Section"
+      "themeSection": "Theme Section",
+      "languageSection": "Language Settings",
+      "languageDescription": "System-wide default language for all visitors without a personal language preference",
+      "defaultLanguage": "Default Language",
+      "defaultLanguageHint": "This language is used for anonymous visitors and new users who have not set a personal language preference.",
+      "saveLanguage": "Save Language"
     },
     "tests": {
       "backToSettings": "Back to Settings",
@@ -1789,7 +1555,62 @@
         "notConnected": "Not connected",
         "configuredViaEnv": "Configured via Env",
         "openSettings": "Open Settings"
-      }
+      },
+      "error": "Connection error",
+      "pollingStoppedError": "Status polling stopped. Please reload the page.",
+      "notificationEmailPlaceholder": "Email address for test reports",
+      "notificationEmailHint": "A report will be sent to this address after each test run.",
+      "notificationEmailSaved": "Email address saved",
+      "notificationEmailCleared": "Email address removed",
+      "smtpNotConfigured": "SMTP not configured — emails cannot currently be sent.",
+      "noEmailConfigured": "No email address configured — no automatic test report delivery.",
+      "saveEmail": "Save",
+      "clearEmail": "Remove",
+      "run": "Run Tests",
+      "pending": "Pending",
+      "noTests": "No tests available",
+      "testResults": "Test Results",
+      "lastRun": "Last Test Run",
+      "details": "Details",
+      "testHistory": "Test History",
+      "noTestsYet": "No tests have been run yet.",
+      "loadMoreHistory": "Load older results ({{count}} more)",
+      "manualMode": "Manual",
+      "synchronize": "Synchronize",
+      "autoModeActive": "Automatic mode: All tests will be executed",
+      "manualModeActive": "Manual mode: Only enabled tests will be executed",
+      "loadingConfig": "Loading test configuration...",
+      "noTestsFound": "No tests found. Click \"Synchronize\" to scan for tests.",
+      "enableAutoTests": "Enable automatic tests",
+      "testRunDetails": "Test Run #{{id}} - Details",
+      "showPassedTests": "Show only passed tests",
+      "showFailedTests": "Show only failed tests",
+      "showSkippedTests": "Show only skipped tests",
+      "loadingTestStats": "Loading test data statistics...",
+      "noTestData": "No test data available",
+      "deleteTestDataDescription": "This action will delete all test data from the database:",
+      "cannotBeUndone": "This action cannot be undone.",
+      "modeChanged": "Mode changed",
+      "modeChangedDescription": "The test mode has been updated.",
+      "modeChangeError": "Mode could not be changed.",
+      "testChangeError": "Test could not be changed.",
+      "testsSynced": "Tests synchronized",
+      "testsSyncedDescription": "{{count}} tests found.",
+      "testsSyncError": "Tests could not be synchronized.",
+      "testsStartError": "Tests could not be started.",
+      "scheduleSaved": "Schedule saved",
+      "scheduleSavedDescription": "The scheduler settings have been updated.",
+      "scheduleSaveError": "Schedule could not be saved.",
+      "testDataDeleteError": "Test data could not be deleted.",
+      "pleaseEnterToken": "Please enter an API token.",
+      "tokenSaveError": "Token could not be saved.",
+      "targetSynced": "Target synchronized",
+      "targetSyncedDescription": "Polly has been registered as a scan target.",
+      "targetSyncError": "Target could not be synchronized.",
+      "scanStartError": "Scan could not be started.",
+      "scanStopped": "Scan stopped",
+      "scanStoppedDescription": "The scan has been aborted.",
+      "scanStopError": "Scan could not be stopped."
     },
     "deprovision": {
       "title": "External Deprovisioning",
@@ -1843,9 +1664,6 @@
       "logoUploaded": "Logo Uploaded",
       "logoUploadedDescription": "The logo has been successfully uploaded.",
       "logoUploadError": "Logo could not be uploaded.",
-      "logoDeleted": "Logo Deleted",
-      "logoDeletedDescription": "The logo has been successfully removed.",
-      "logoDeleteError": "Logo could not be deleted.",
       "uploadFailed": "Upload failed",
       "deprovisionSaved": "Deprovisioning settings have been saved.",
       "settingsSaveError": "Settings could not be saved.",
@@ -1940,12 +1758,28 @@
       "callbackUrlHint": "Add to Keycloak as valid redirect URI",
       "enableOidc": "Enable OIDC Authentication",
       "testConnection": "Test Connection",
-      "saveSettings": "Save Settings",
+      "testSuccess": "Keycloak connection established successfully.",
+      "testFailed": "Keycloak connection test failed",
+      "testError": "Connection test failed",
+      "testing": "Testing connection...",
+      "envHint": "Keycloak is configured via environment variables. Change the values in your .env file or docker-compose.yml.",
+      "notConfigured": "Keycloak is not configured. Set KEYCLOAK_AUTH_SERVER_URL, KEYCLOAK_REALM and KEYCLOAK_CLIENT_ID in your environment variables.",
+      "active": "Active",
+      "inactive": "Inactive",
       "configurationNotes": "Configuration Notes",
       "configNote1": "Admin role assignment is done via Keycloak groups",
       "configNote2": "Users with the group \"polly-admins\" automatically receive admin rights",
       "configNote3": "Local login remains available as fallback",
       "configNote4": "All sessions are invalidated on configuration changes",
+      "ssoButtonLabel": "SSO Button Label",
+      "ssoButtonLabelDescription": "Customize the login button text so your users immediately recognize the SSO provider.",
+      "ssoButtonLabelPlaceholder": "e.g. Company SSO Login",
+      "ssoButtonLabelHint": "Leave empty for default: \"Login with Keycloak\"",
+      "ssoLabelSave": "Save",
+      "ssoLabelSaved": "Button label saved",
+      "ssoLabelSavedDescription": "The new SSO button label will be shown on the login page.",
+      "ssoLabelFromEnv": "Currently from environment variable",
+      "ssoLabelPreview": "Preview:",
       "registrationActivated": "Registration activated",
       "registrationActivatedDescription": "New users can now register.",
       "registrationDeactivated": "Registration deactivated",
@@ -1953,7 +1787,8 @@
       "saveError": "Setting could not be saved.",
       "saved": "Saved",
       "oidcSaved": "OIDC settings have been saved.",
-      "registrationSettingDescription": "Whether local registration is enabled"
+      "registrationSettingDescription": "Whether local registration is enabled",
+      "ssoButtonLabelSettingDescription": "Custom SSO button label for login page"
     },
     "database": {
       "backToSettings": "Back to Settings",
@@ -1978,6 +1813,7 @@
       "emailConfig": "Email Configuration",
       "smtpDescription": "SMTP settings for notifications",
       "active": "Active",
+      "inactive": "Inactive",
       "smtpSettings": "SMTP Settings",
       "smtpSettingsDescription": "Configure email sending for notifications",
       "smtpHost": "SMTP Host",
@@ -1987,8 +1823,13 @@
       "senderEmail": "Sender Email",
       "senderName": "Sender Name",
       "useTls": "Use TLS/SSL Encryption",
-      "testEmail": "Send Test Email",
-      "saveSettings": "Save Settings",
+      "testEmail": "Test Connection",
+      "testSuccess": "SMTP connection established successfully.",
+      "testFailed": "SMTP connection test failed",
+      "testError": "Connection test failed",
+      "testing": "Testing connection...",
+      "envHint": "SMTP is configured via environment variables. Change the values in your .env file or docker-compose.yml.",
+      "notConfigured": "SMTP is not configured. Set SMTP_HOST, SMTP_USER and SMTP_PASSWORD in your environment variables.",
       "saved": "Saved",
       "emailSaved": "Email settings have been saved."
     },
@@ -2093,7 +1934,7 @@
       "userDescription": "Standard user role for all registered members",
       "manager": "Manager",
       "managerDescription": "Extended rights for team and group leaders",
-      "admin": "Administrator",
+      "admin": "Admin",
       "adminDescription": "Full access to all functions and settings",
       "permissions": {
         "createOwnPolls": "Create own polls",
@@ -2124,15 +1965,15 @@
     },
     "calendar": {
       "saved": "Calendar settings have been saved.",
-      "prefixSettings": "Prefix Settings",
-      "prefixDescription": "Events receive prefixes based on poll status",
-      "enablePrefixes": "Enable prefixes",
-      "enablePrefixesDescription": "Events are prefixed with status indicators like 'Tentative:' or 'Confirmed:'",
-      "germanPrefixes": "German Prefixes",
-      "englishPrefixes": "English Prefixes",
-      "tentativePrefix": "Tentative prefix",
-      "confirmedPrefix": "Confirmed prefix",
-      "myChoicePrefix": "My choice prefix",
+      "prefixSettings": "Status Label Settings",
+      "prefixDescription": "Events receive status labels as suffix in parentheses, e.g. 'Event Name (Confirmed)'",
+      "enablePrefixes": "Enable status labels",
+      "enablePrefixesDescription": "Events receive status suffixes like '(Tentative)' or '(Confirmed)' at the end of the title",
+      "germanPrefixes": "German Labels",
+      "englishPrefixes": "English Labels",
+      "tentativePrefix": "Tentative label",
+      "confirmedPrefix": "Confirmed label",
+      "myChoicePrefix": "My choice marker",
       "exportScope": "Export Scope",
       "exportScopeDescription": "Which events should be exported to the calendar?",
       "scopeAll": "All events",
@@ -2144,11 +1985,30 @@
       "markingSettings": "Marking Settings",
       "markingDescription": "Additional markings for specific events",
       "markOwnChoices": "Mark own choices",
-      "markOwnChoicesDescription": "Events with own yes vote receive a prefix (e.g. [My Choice])",
+      "markOwnChoicesDescription": "Events with own yes vote receive a marker (e.g. [My Choice])",
       "highlightFinal": "Highlight final event",
       "highlightFinalDescription": "The final event chosen by the creator is specially marked",
       "syncInfo": "Automatic Synchronization",
-      "syncInfoDescription": "Calendar apps automatically update subscribed feeds regularly. Changes to prefixes will be visible at the next sync."
+      "syncInfoDescription": "Calendar apps automatically update subscribed feeds regularly. Changes to labels will be visible at the next sync.",
+      "defaults": {
+        "tentativePrefix": "Tentative",
+        "confirmedPrefix": "Confirmed",
+        "myChoicePrefix": "[My Choice]",
+        "deTentative": "Vorläufig",
+        "deConfirmed": "Bestätigt",
+        "deMyChoice": "[Meine Wahl]",
+        "enTentative": "Tentative",
+        "enConfirmed": "Confirmed",
+        "enMyChoice": "[My Choice]"
+      },
+      "placeholders": {
+        "deTentative": "Vorläufig",
+        "deConfirmed": "Bestätigt",
+        "deMyChoice": "[Meine Wahl]",
+        "enTentative": "Tentative",
+        "enConfirmed": "Confirmed",
+        "enMyChoice": "[My Choice]"
+      }
     },
     "wcag": {
       "title": "WCAG Accessibility",
@@ -2186,45 +2046,18 @@
       "perModeCorrections": "Corrections are applied per mode (Light/Dark)"
     },
     "matrix": {
-      "saved": "Matrix settings have been saved.",
       "title": "Matrix Chat Integration",
       "description": "Chat notifications via Matrix for SSO users",
       "backToSettings": "Back to Settings",
-      "connection": "Matrix Connection",
-      "connectionDescription": "Configure the connection to your Matrix homeserver",
-      "enabled": "Enabled",
-      "disabled": "Disabled",
-      "enableIntegration": "Enable Matrix Integration",
-      "ssoUsersCanReceive": "SSO users can receive chat notifications",
-      "onlyEmailActive": "Only email notifications active",
-      "homeserverNote": "This integration works with any Matrix-compatible homeserver, including Bundesmessenger (BUM) or your own Matrix server.",
-      "homeserverUrlLabel": "The URL of your Matrix homeserver",
-      "botUserIdLabel": "The full Matrix user ID of the bot",
-      "searchEnabled": "Enable user search",
-      "searchDescription": "Enables type-ahead search for Matrix users when inviting",
-      "botAccessTokenLabel": "Access token for the bot",
-      "connectedAs": "Connected as {{userId}}",
-      "connectionFailed": "Connection failed",
-      "connectionTestFailed": "Connection test failed",
-      "tokenHint": "Log in as the bot and generate an access token via Element or the Admin API.",
-      "synapseConfigHint": "For full user search, set in your Synapse configuration:",
-      "homeserverUrl": "Homeserver URL",
-      "botUserId": "Bot User ID",
-      "botAccessToken": "Bot Access Token",
-      "leaveEmptyToKeep": "Access token for the bot account. Leave empty to keep the existing token.",
-      "userDirectorySearch": "Enable User Directory Search",
-      "testing": "Testing...",
-      "testConnection": "Test Connection",
-      "saving": "Saving...",
-      "saveSettings": "Save Settings",
-      "setupTitle": "Setup Instructions",
-      "setupHints": {
-        "createBotAccount": "Create Bot Account",
-        "createBotAccountDescription": "Create a Matrix user (e.g. @pollbot:matrix.example.com) with a secure password.",
-        "generateToken": "Generate Access Token",
-        "generateTokenDescription": "Log in as the bot and generate an access token via Element or the Admin API.",
-        "userDirectory": "User Directory Search",
-        "userDirectoryDescription": "For full user search, set in your Synapse configuration:"
+      "comingSoon": {
+        "badge": "Planned",
+        "title": "Matrix integration coming soon",
+        "description": "Create and manage polls directly via Matrix messenger. The integration will support bot commands, vote notifications and result summaries in Matrix rooms.",
+        "feature1": "Bot account for Matrix/Synapse servers",
+        "feature2": "Create polls via chat commands",
+        "feature3": "Vote reminders in Matrix rooms",
+        "feature4": "Result summaries posted to the channel",
+        "timeline": "Planned for Version 1.0"
       }
     },
     "pentest": {
@@ -2314,10 +2147,58 @@
       "logoUploaded": "Logo uploaded",
       "logoUploadedDescription": "The logo has been uploaded successfully.",
       "logoUploadError": "Logo could not be uploaded.",
+      "logoDeleted": "Logo Deleted",
+      "logoDeletedDescription": "The logo has been successfully removed.",
+      "logoDeleteError": "Logo could not be deleted.",
       "uploadFailed": "Upload failed"
     },
     "time": {
       "now": "now"
+    },
+    "aiSettings": {
+      "loading": "Loading...",
+      "back": "Back",
+      "title": "AI Assistant",
+      "noApiKeyWarning": "No API key configured. Set the GWDG SAIA bearer token either as an environment variable (AI_API_KEY) or via the fields below.",
+      "apiConfiguration": "API Configuration",
+      "envPrecedence": "Environment variables take precedence. If set, the fields are read-only.",
+      "apiKey": "API Key",
+      "apiKeyPlaceholderSaved": "••••••••  (saved)",
+      "apiKeyPlaceholder": "Enter bearer token",
+      "deleteKeyTitle": "Delete saved key",
+      "envAlternative": "Alternatively set as environment variable AI_API_KEY",
+      "fallbackKey": "Fallback Key",
+      "fallbackPlaceholder": "Optional: Fallback bearer token",
+      "deleteFallbackTitle": "Delete saved fallback key",
+      "fallbackUsageNote": "Used automatically on HTTP 429 (rate limit)",
+      "apiUrl": "API URL",
+      "defaultUrl": "Default:",
+      "general": "General",
+      "enableAi": "Enable AI feature",
+      "enableAiDescription": "Enables the AI assistant for all configured roles",
+      "model": "Model",
+      "envOverride": "Env override active:",
+      "apiKeyConfigured": "Configured",
+      "apiKeyNotSet": "Not set",
+      "fallbackKeyConfigured": "Fallback key: Configured",
+      "rateLimiting": "Rate limiting per role",
+      "rateLimitingDescription": "Quotas per hour. Unlimited = no limit, 0 = disabled.",
+      "guests": "Guests (not logged in)",
+      "authenticatedUsers": "Authenticated users",
+      "administrators": "Administrators",
+      "saving": "Saving...",
+      "saveSettings": "Save settings",
+      "cancel": "Cancel",
+      "savedToast": "AI settings saved",
+      "saveError": "Error saving",
+      "unlimited": "Unlimited",
+      "perHour": "/hour",
+      "modelRecommended": "Recommended",
+      "modelFast": "Fast",
+      "modelReasoning": "Reasoning",
+      "modelVeryStrong": "Very powerful",
+      "modelLargest": "Largest model",
+      "modelVeryFast": "Very fast"
     }
   },
   "email": {
@@ -2649,7 +2530,95 @@
     "ctaTitle": "Ready for better voting?",
     "ctaDescription": "Start your first poll today and experience how easy team coordination can be.",
     "startSchedulePoll": "Start Schedule Poll",
-    "createOrgList": "Create Org List"
+    "createOrgList": "Create Org List",
+    "aiChatTitle": "AI Assistant",
+    "betaBadge": "Beta",
+    "aiChatHint": "Just describe what you need – the AI will create a draft for you.",
+    "aiMicTooltip": "Voice input",
+    "aiListening": "Listening...",
+    "aiTranscribing": "Processing...",
+    "aiSpeak": "Speak now",
+    "aiTranscribingHint": "Converting speech to text",
+    "aiSendRecord": "Done & Send",
+    "aiProcessingHint": "Processing...",
+    "aiMicError": "Microphone access denied",
+    "aiLoginRequired": "Sign in required",
+    "aiLimitReached": "Hourly limit reached",
+    "aiRemaining": "remaining",
+    "aiStart": "Start",
+    "aiGenerating": "Creating...",
+    "aiSuggestion": "Suggestion",
+    "aiRegenerate": "Regenerate",
+    "aiTitle": "Title",
+    "aiDescription": "Description",
+    "aiOptions": "Options",
+    "aiApply": "Apply",
+    "aiError": "AI request failed. Please try again."
+  },
+  "aiWidget": {
+    "settingsResultsPrivate": "Results hidden",
+    "settingsResultsPublic": "Results public",
+    "settingsNoMaybe": "Yes/No only",
+    "settingsMaybeAllowed": "Maybe allowed",
+    "settingsAllowVoteEdit": "Submission editable",
+    "settingsVoteEditLocked": "Submission locked",
+    "settingsAllowWithdrawal": "Withdrawal allowed",
+    "settingsNoWithdrawal": "Withdrawal not allowed",
+    "settingsMultipleSlots": "Multiple slots",
+    "settingsSingleSlot": "Single booking",
+    "followUpTitle": "Not quite right?",
+    "followUpHint": "Tell me what you'd like to change — or apply the current suggestion and adjust it yourself.",
+    "followUpPlaceholder": "e.g. Make all times after 3pm, add more options, make it anonymous...",
+    "followUpSubmit": "Refine",
+    "followUpLoading": "Refining...",
+    "quickSuggestionsLabel": "Common refinements",
+    "quickSuggestionsHint": "Click a refinement to apply it.",
+    "followUpPlaceholderOptional": "Add something else (optional)...",
+    "applyLoading": "Creating...",
+    "applyError": "Failed to create the poll. Please try again.",
+    "emailRequired": "Enter your email address to continue:",
+    "emailPlaceholder": "your@email.com",
+    "allOptionsSelected": "All options selected ✓",
+    "beingAdjusted": "Being adjusted:",
+    "remove": "Remove",
+    "dragToSort": "Drag to sort",
+    "freeText": "Free text",
+    "refineFailed": "Refinement failed. Please try again.",
+    "pollTypeSchedule": "Schedule poll",
+    "pollTypeSurvey": "Survey",
+    "pollTypeOrganization": "Signup list",
+    "quickSuggestions": {
+      "resultsOnlyCreator": "Make results visible only to the creator",
+      "resultsPublicAll": "Make results visible to all participants",
+      "submissionsFinal": "Submissions should be final – no changes allowed after submitting",
+      "allowEditSubmission": "Allow participants to change their submission later",
+      "disableWithdrawals": "Disable withdrawals – sign-ups should be binding",
+      "allowWithdrawal": "Allow participants to withdraw their sign-up later",
+      "singleSlotOnly": "Each person may only sign up for one slot",
+      "allowMultipleSlots": "Allow participants to sign up for multiple slots",
+      "limitSpots": "Limit spots per slot to 5 people",
+      "addMoreStations": "Add more stations or time slots",
+      "yesNoOnly": "Only Yes/No answers – remove 'Maybe' option",
+      "addMaybe": "Add 'Maybe' as an answer option",
+      "addMaybeVoting": "Add 'Maybe' as a voting option",
+      "addMoreDates": "Add more date and time options",
+      "weekdaysOnly": "Restrict the options to weekdays only",
+      "addMoreOptions": "Add more answer options"
+    },
+    "prompts": [
+      "Do you want to plan a summer party and organize helpers with sign-up slots?",
+      "Shall I help you coordinate a parent-teacher meeting time?",
+      "Planning a team meeting and looking for the best time slot for everyone?",
+      "Would you like to create a satisfaction survey for your team?",
+      "Shall I set up a lunch break schedule with time slots for your group?",
+      "Planning a workshop and need a sign-up sheet with time options?",
+      "Want to schedule a movie night with friends — which date works best?",
+      "Looking for the best weekday for a recurring standup meeting?",
+      "Need a feedback survey after your last company event?",
+      "Shall I create a cleaning rota with shifts for your office?",
+      "Want to survey your team's food preferences for the next team lunch?",
+      "Planning a department offsite and need to find a date that works?"
+    ]
   },
   "pollCreation": {
     "welcomeBack": "Welcome back!",
@@ -2669,6 +2638,9 @@
     "datePlaceholder": "mm/dd/yyyy",
     "expiryHint": "Voting is not possible after this date.",
     "expiryHintOrga": "Sign-ups are not possible after this date.",
+    "videoConferenceLabel": "Video Conference Link (optional)",
+    "videoConferencePlaceholder": "https://bbb.example.com/... or your video service link",
+    "videoConferenceHint": "Link to a video conference (e.g. BigBlueButton or your preferred video service). Will be shown in the calendar entry and notification.",
     "expiryReminder": "Reminder before expiry",
     "expiryReminderDescription": "Participants will receive an email reminder before the expiry date",
     "expiryTooShort": "The poll ends in {{hours}} hours - too short for reminders",
@@ -2680,8 +2652,10 @@
     "allowVoteWithdrawal": "Allow vote withdrawal",
     "allowVoteWithdrawalDescription": "Can participants completely withdraw their vote?",
     "resultsPublic": "Results public",
+    "resultsPrivate": "Results private",
     "resultsPublicDescription": "Can participants view the results?",
     "creationOptions": "Creation Options",
+    "settings": "Settings",
     "loggedInAs": "Logged in as {{name}}",
     "linksWillBeSentTo": "You will receive all links at:",
     "participationLink": "Participation link to share",
@@ -2730,6 +2704,7 @@
     "choices": "Choices",
     "addOption": "Add Option",
     "removeOption": "Remove Option",
+    "moveOption": "Reorder option",
     "optionsHint": "Add at least 2 options for participants to choose from.",
     "optionPlaceholder": "Option {{number}}",
     "addImage": "Add image (optional):",
@@ -2842,6 +2817,7 @@
     "inviteParticipants": "Invite Participants",
     "remindParticipants": "Remind Participants",
     "endPoll": "End Poll",
+    "endingPoll": "Ending poll...",
     "reactivatePoll": "Reactivate Poll",
     "adminLink": "Admin Link",
     "editDialogTitle": "Edit Poll",
@@ -2891,6 +2867,9 @@
     "searchMatrixPlaceholder": "Enter username...",
     "noMatrixResults": "No users found",
     "selectedUsers": "Selected Users",
+    "selectedParticipants": "Selected participants",
+    "sendChatInvitations": "Send chat invitations",
+    "noOptionsAvailable": "No options available",
     "sendMatrixInvitations": "Send Matrix Invitations",
     "shareDialogTitle": "Share Poll",
     "shareDialogDescription": "Share this poll with others.",
@@ -2944,7 +2923,8 @@
       "linkCopied": "Link copied to clipboard.",
       "linkNotCopied": "Link could not be copied.",
       "enterValidEmail": "Please enter at least one valid email address."
-    }
+    },
+    "inviteEmailsPlaceholder": "john@example.com, anna@example.com"
   },
   "myPolls": {
     "title": "My Polls",
@@ -2961,7 +2941,10 @@
     "newOrga": "Org List",
     "tabCreated": "My Polls",
     "tabParticipated": "Participations",
+    "tabArchive": "Archive",
     "tabAdmin": "Administration",
+    "noArchivedPolls": "No archived polls",
+    "archiveDescription": "Expired and manually closed polls are shown here.",
     "emptyCreated": "No Polls Created",
     "emptyCreatedDesc": "You haven't created any polls yet. Create your first poll now!",
     "emptyParticipated": "No Participations",
@@ -2972,6 +2955,17 @@
     "subscriptionLink": "Subscription Link",
     "openInCalendar": "Open in Calendar",
     "regenerateToken": "Regenerate Token",
+    "statsActivePolls": "Active Polls",
+    "statsTotalPolls": "Total Polls",
+    "statsParticipations": "Participations",
+    "statsThisWeek": "This Week",
+    "showResults": "Show Results",
+    "shareLinkCopied": "The voting link has been copied to the clipboard.",
+    "deleteConfirmTitle": "Delete Poll?",
+    "deleteConfirmDesc": "Are you sure you want to delete the poll \"{{title}}\"? This action cannot be undone.",
+    "pollDeleted": "Poll Deleted",
+    "pollDeletedDesc": "The poll has been successfully deleted.",
+    "pollDeleteError": "The poll could not be deleted.",
     "toasts": {
       "tokenRegenerated": "Calendar Token Regenerated",
       "tokenRegeneratedDesc": "The old link no longer works. Please update your calendar app.",
@@ -3078,24 +3072,6 @@
     "creating": "Creating...",
     "createSchedulePoll": "Create Schedule Poll"
   },
-  "dashboard": {
-    "managePolls": "Manage your polls and schedules clearly",
-    "schedule": "Schedule",
-    "activePolls": "Active Polls",
-    "totalPolls": "Total Polls",
-    "participations": "Participations",
-    "thisWeek": "This Week",
-    "sharedPolls": "Shared Polls",
-    "archive": "Archive",
-    "noSharedPolls": "No shared polls",
-    "sharedPollsDescription": "Polls you have participated in will be displayed here.",
-    "archiveComingSoon": "Archive coming soon",
-    "archiveDescription": "Expired and closed polls will be archived here.",
-    "participants": "Participants",
-    "created": "Created",
-    "expiresAt": "Expires",
-    "showResults": "Show results"
-  },
   "confirmEmail": {
     "unknownError": "An unknown error occurred.",
     "invalidLink": "Invalid or missing confirmation link.",
@@ -3174,7 +3150,15 @@
     "noChanges": "No changes made",
     "changesSaved": "Your changes have been saved",
     "errorSaving": "Error saving changes",
-    "unsavedChanges": "You have unsaved changes"
+    "unsavedChanges": "You have unsaved changes",
+    "responsesChanged": "Your responses have been updated",
+    "updateError": "Error updating your vote",
+    "voteRemoved": "Your vote has been withdrawn",
+    "withdrawError": "Error withdrawing your vote",
+    "loadingVote": "Loading vote...",
+    "voteNotFound": "Vote not found",
+    "invalidLink": "This link is invalid or has expired.",
+    "withdrawing": "Withdrawing..."
   },
   "liveResults": {
     "title": "Live Results",
@@ -3197,5 +3181,46 @@
     "scheduleType": "Schedule Poll",
     "surveyType": "Survey",
     "organizationType": "Organization List"
+  },
+  "aiCreator": {
+    "createWithAi": "Create with AI",
+    "unlimited": "Unlimited",
+    "quotaExhausted": "Quota exhausted",
+    "requestsRemaining_one": "{{count}} request remaining",
+    "requestsRemaining_other": "{{count}} requests remaining",
+    "title": "AI Assistant",
+    "description": "Describe your poll — the AI will suggest a title, description and options.",
+    "gdprNote": "GWDG SAIA · GDPR-compliant · Servers in Germany",
+    "guestNotAllowed": "Please log in to use the AI assistant.",
+    "rateLimitExceeded": "Hourly limit reached. Try again {{time}}.",
+    "rateLimitLater": "later",
+    "notAvailable": "AI assistant currently unavailable.",
+    "placeholderSchedule": "e.g. Plan a team meeting for next week, 5-6 people, preferably Tuesday or Thursday morning",
+    "placeholderSurvey": "e.g. Satisfaction survey for our last team event",
+    "placeholderOrganization": "e.g. Lunch break shifts for 3 people, Monday to Friday",
+    "placeholderDefault": "Describe your poll or schedule...",
+    "requestFailed": "AI request failed",
+    "generating": "Generating...",
+    "generate": "Generate suggestion",
+    "regenerate": "Regenerate",
+    "suggestion": "Suggestion",
+    "suggestionTitle": "Title",
+    "suggestionDescription": "Description",
+    "suggestionOptions": "Options ({{count}})",
+    "apply": "Apply suggestion",
+    "requestsRemaining": "{{count}} requests remaining"
+  },
+  "forcePassword": {
+    "title": "Password change required",
+    "description": "You are using the default administrator password. For security reasons, you must change your password before you can continue.",
+    "currentPassword": "Current password",
+    "newPassword": "New password",
+    "confirmPassword": "Confirm new password",
+    "passwordsMismatch": "Passwords do not match",
+    "passwordTooShort": "Password must be at least 8 characters long",
+    "error": "Error changing password",
+    "logout": "Log out",
+    "changing": "Changing...",
+    "submit": "Change password"
   }
-}
\ No newline at end of file
+}
diff --git a/client/src/main.tsx b/client/src/main.tsx
index c2a2fa6f..732f1692 100644
--- a/client/src/main.tsx
+++ b/client/src/main.tsx
@@ -1,6 +1,8 @@
 import { createRoot } from "react-dom/client";
 import App from "./App";
 import "./index.css";
-import "./lib/i18n";
+import { initI18n } from "./lib/i18n";
 
-createRoot(document.getElementById("root")!).render(<App />);
+initI18n().then(() => {
+  createRoot(document.getElementById("root")!).render(<App />);
+});
diff --git a/client/src/pages/create-organization.tsx b/client/src/pages/create-organization.tsx
index fa7fdee8..0344c638 100644
--- a/client/src/pages/create-organization.tsx
+++ b/client/src/pages/create-organization.tsx
@@ -11,13 +11,31 @@ import { Switch } from "@/components/ui/switch";
 import { useToast } from "@/hooks/use-toast";
 import { useFormPersistence } from "@/hooks/useFormPersistence";
 import { apiRequest } from "@/lib/queryClient";
-import { ArrowLeft, ClipboardList, Plus, Trash2, Users, Clock, Info, Mail, CheckCircle, QrCode, Link as LinkIcon, CalendarDays, Bell, Sparkles, Coffee, Repeat, Timer } from "lucide-react";
+import { ArrowLeft, ClipboardList, Plus, Trash2, Users, Clock, Info, Mail, CheckCircle, QrCode, Link as LinkIcon, CalendarDays, Bell, Sparkles, Coffee, Repeat, Timer, ChevronDown, GripVertical } from "lucide-react";
 import { DatePicker } from "@/components/ui/date-picker";
 import { TimePicker } from "@/components/ui/time-picker";
 import { DateTimePicker } from "@/components/ui/datetime-picker";
 import { useAuth } from "@/contexts/AuthContext";
+import {
+  DndContext,
+  closestCenter,
+  KeyboardSensor,
+  PointerSensor,
+  useSensor,
+  useSensors,
+  type DragEndEvent,
+} from "@dnd-kit/core";
+import {
+  SortableContext,
+  sortableKeyboardCoordinates,
+  useSortable,
+  verticalListSortingStrategy,
+  arrayMove,
+} from "@dnd-kit/sortable";
+import { CSS } from "@dnd-kit/utilities";
 
 interface OrgaSlot {
+  id: string;
   text: string;
   startTime?: string;
   endTime?: string;
@@ -50,6 +68,150 @@ interface OrgaFormData {
   dayModeDates?: string[];
 }
 
+interface SortableSlotItemProps {
+  slot: OrgaSlot;
+  index: number;
+  slotsLength: number;
+  isDayMode: boolean;
+  updateSlot: (index: number, updates: Partial<OrgaSlot>) => void;
+  removeSlot: (index: number) => void;
+  t: (key: string) => string;
+}
+
+function SortableSlotItem({ slot, index, slotsLength, isDayMode, updateSlot, removeSlot, t }: SortableSlotItemProps) {
+  const { attributes, listeners, setNodeRef, transform, transition, isDragging } = useSortable({ id: slot.id });
+  const style = { transform: CSS.Transform.toString(transform), transition, opacity: isDragging ? 0.5 : 1 };
+
+  return (
+    <div
+      ref={setNodeRef}
+      style={style}
+      className="border rounded-lg p-4 bg-muted/30"
+      data-testid={`slot-${index}`}
+    >
+      <div className="flex items-start gap-2">
+        <button
+          type="button"
+          className="mt-1 cursor-grab active:cursor-grabbing text-muted-foreground hover:text-foreground touch-none"
+          aria-label="Verschieben"
+          {...attributes}
+          {...listeners}
+        >
+          <GripVertical className="w-4 h-4" />
+        </button>
+        <div className="flex-1 space-y-4">
+          <div>
+            <Label>{t('createOrganization.slotDescription')}</Label>
+            <Input
+              value={slot.text}
+              onChange={(e) => updateSlot(index, { text: e.target.value })}
+              placeholder={t('createOrganization.slotDescriptionPlaceholder')}
+              className="mt-1"
+              data-testid={`input-slot-text-${index}`}
+            />
+          </div>
+
+          {isDayMode ? (
+            <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+              <div>
+                <Label>{t('createOrganization.fromTime')}</Label>
+                <div className="mt-1">
+                  <TimePicker
+                    time={slot.startTime}
+                    onTimeChange={(time) => updateSlot(index, { startTime: time })}
+                    placeholder={t('createOrganization.startTime')}
+                    data-testid={`input-slot-start-${index}`}
+                  />
+                </div>
+              </div>
+              <div>
+                <Label>{t('createOrganization.toTime')}</Label>
+                <div className="mt-1">
+                  <TimePicker
+                    time={slot.endTime}
+                    onTimeChange={(time) => updateSlot(index, { endTime: time })}
+                    placeholder={t('createOrganization.endTime')}
+                    data-testid={`input-slot-end-${index}`}
+                  />
+                </div>
+                {slot.startTime && slot.endTime && slot.startTime === slot.endTime && (
+                  <p className="text-xs text-destructive mt-1">{t('createOrganization.timesMustDiffer')}</p>
+                )}
+              </div>
+              <div>
+                <Label>{t('createOrganization.maxSpots')}</Label>
+                <Input
+                  type="number"
+                  min={1}
+                  value={slot.maxCapacity ?? ""}
+                  onChange={(e) => updateSlot(index, { maxCapacity: e.target.value ? Math.max(1, parseInt(e.target.value) || 1) : undefined })}
+                  placeholder={t('createOrganization.unlimitedPlaceholder')}
+                  className="mt-1"
+                  data-testid={`input-slot-capacity-${index}`}
+                />
+              </div>
+            </div>
+          ) : (
+            <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+              <div>
+                <Label>{t('createOrganization.fromOptional')}</Label>
+                <div className="mt-1">
+                  <DateTimePicker
+                    value={slot.startTime}
+                    onChange={(value) => updateSlot(index, { startTime: value })}
+                    placeholder={t('createOrganization.dateTimePlaceholder')}
+                    data-testid={`input-slot-start-${index}`}
+                  />
+                </div>
+              </div>
+              <div>
+                <Label>{t('createOrganization.toOptional')}</Label>
+                <div className="mt-1">
+                  <DateTimePicker
+                    value={slot.endTime}
+                    onChange={(value) => updateSlot(index, { endTime: value })}
+                    placeholder={t('createOrganization.dateTimePlaceholder')}
+                    data-testid={`input-slot-end-${index}`}
+                  />
+                </div>
+                {slot.startTime && slot.endTime && slot.startTime === slot.endTime && (
+                  <p className="text-xs text-destructive mt-1">{t('createOrganization.timesMustDiffer')}</p>
+                )}
+              </div>
+              <div>
+                <Label>{t('createOrganization.maxSpots')}</Label>
+                <Input
+                  type="number"
+                  min={1}
+                  value={slot.maxCapacity ?? ""}
+                  onChange={(e) => updateSlot(index, { maxCapacity: e.target.value ? Math.max(1, parseInt(e.target.value) || 1) : undefined })}
+                  placeholder={t('createOrganization.unlimitedPlaceholder')}
+                  className="mt-1"
+                  data-testid={`input-slot-capacity-${index}`}
+                />
+              </div>
+            </div>
+          )}
+        </div>
+
+        {slotsLength > 1 && (
+          <Button
+            type="button"
+            variant="ghost"
+            size="icon"
+            onClick={() => removeSlot(index)}
+            className="text-destructive hover:text-destructive mt-1"
+            aria-label={t('createOrganization.removeSlot')}
+            data-testid={`button-remove-slot-${index}`}
+          >
+            <Trash2 className="w-4 h-4" />
+          </Button>
+        )}
+      </div>
+    </div>
+  );
+}
+
 export default function CreateOrganization() {
   const [, setLocation] = useLocation();
   const { toast } = useToast();
@@ -66,14 +228,32 @@ export default function CreateOrganization() {
   const [allowVoteEdit, setAllowVoteEdit] = useState(false);
   const [allowVoteWithdrawal, setAllowVoteWithdrawal] = useState(false);
   const [resultsPublic, setResultsPublic] = useState(true);
+  const [settingsExpanded, setSettingsExpanded] = useState(false);
   const [isDayMode, setIsDayMode] = useState(false);
   const [dayModeDate, setDayModeDate] = useState<string>("");
   const [dayModeDates, setDayModeDates] = useState<string[]>([]);
   const [slotDuration, setSlotDuration] = useState(30);
+  const nextSlotIdRef = useRef(1);
   const [slots, setSlots] = useState<OrgaSlot[]>([
-    { text: "", maxCapacity: undefined, order: 0 }
+    { id: "0", text: "", maxCapacity: undefined, order: 0 }
   ]);
 
+  const slotSensors = useSensors(
+    useSensor(PointerSensor),
+    useSensor(KeyboardSensor, { coordinateGetter: sortableKeyboardCoordinates })
+  );
+
+  const handleSlotDragEnd = (event: DragEndEvent) => {
+    const { active, over } = event;
+    if (over && active.id !== over.id) {
+      setSlots((items) => {
+        const oldIndex = items.findIndex((s) => s.id === active.id);
+        const newIndex = items.findIndex((s) => s.id === over.id);
+        return arrayMove(items, oldIndex, newIndex).map((s, idx) => ({ ...s, order: idx }));
+      });
+    }
+  };
+
   const formPersistence = useFormPersistence<OrgaFormData>({ key: 'create-organization' });
   const hasRestoredRef = useRef(false);
   const autoSubmitTriggeredRef = useRef(false);
@@ -95,7 +275,9 @@ export default function CreateOrganization() {
       setDayModeDate(stored.data.dayModeDate ?? "");
       setDayModeDates(stored.data.dayModeDates ?? (stored.data.dayModeDate ? [stored.data.dayModeDate] : []));
       if (stored.data.slots && stored.data.slots.length >= 1) {
-        setSlots(stored.data.slots);
+        const restored = stored.data.slots.map((s: OrgaSlot, i: number) => ({ ...s, id: s.id ?? String(i) }));
+        nextSlotIdRef.current = restored.length;
+        setSlots(restored);
       }
       if (stored.data.expiresAt) {
         setExpiresAt(new Date(stored.data.expiresAt));
@@ -110,6 +292,107 @@ export default function CreateOrganization() {
     }
   }, []);
 
+  // Read AI suggestion from sessionStorage if present
+  useEffect(() => {
+    const raw = sessionStorage.getItem("ai-suggestion");
+    if (!raw) return;
+    try {
+      const suggestion = JSON.parse(raw);
+      if (suggestion.pollType !== "organization") return;
+      sessionStorage.removeItem("ai-suggestion");
+      if (suggestion.title) setTitle(suggestion.title);
+      if (suggestion.description) setDescription(suggestion.description);
+      if (Array.isArray(suggestion.options) && suggestion.options.length >= 1) {
+        const DATE_PREFIX_RE = /^(\d{1,2})\.(\d{1,2})\.(\d{4})\s+/;
+
+        type RawSlot = { id: string; text: string; startTime?: string; endTime?: string; maxCapacity?: number; order: number; _isoDate?: string };
+
+        const optionTexts: string[] = suggestion.options.map((opt: any) =>
+          typeof opt === "string" ? opt : opt.text || ""
+        );
+        const aiBaseId = nextSlotIdRef.current;
+        nextSlotIdRef.current += optionTexts.length;
+
+        const toIso = (date: string, time: string): string | undefined => {
+          if (!date || !time) return undefined;
+          try {
+            const combined = new Date(`${date}T${time}`);
+            if (isNaN(combined.getTime())) return undefined;
+            return combined.toISOString();
+          } catch { return undefined; }
+        };
+
+        const rawParsed: RawSlot[] = optionTexts.map((text: string, i: number) => {
+          const dateMatch = text.match(DATE_PREFIX_RE);
+          const timeMatch = text.match(/(\d{2}:\d{2})\s*-\s*(\d{2}:\d{2})/);
+          const capMatch = text.match(/\(max\.?\s*(\d+)/i);
+
+          let isoDate: string | undefined;
+          if (dateMatch) {
+            const [, dd, mm, yyyy] = dateMatch;
+            isoDate = `${yyyy}-${mm.padStart(2, '0')}-${dd.padStart(2, '0')}`;
+          }
+
+          let cleanText = text;
+          if (dateMatch) {
+            cleanText = text.replace(DATE_PREFIX_RE, '');
+          }
+          if (timeMatch) {
+            const timeIndex = cleanText.indexOf(timeMatch[0]);
+            const before = cleanText.substring(0, timeIndex).trim();
+            cleanText = before || cleanText;
+          }
+          cleanText = cleanText.replace(/\(max\.?\s*\d+[^)]*\)/gi, '').trim() || text;
+
+          return {
+            id: String(aiBaseId + i),
+            text: cleanText,
+            startTime: timeMatch ? timeMatch[1] : undefined,
+            endTime: timeMatch ? timeMatch[2] : undefined,
+            maxCapacity: capMatch ? parseInt(capMatch[1]) : undefined,
+            order: i,
+            _isoDate: isoDate,
+          };
+        });
+
+        const datesFound = rawParsed.map((s: RawSlot) => s._isoDate).filter(Boolean) as string[];
+        const uniqueDates = [...new Set(datesFound)];
+        const allSameDate = datesFound.length === rawParsed.length && uniqueDates.length === 1;
+        const hasAnyTimes = rawParsed.some((s: RawSlot) => s.startTime || s.endTime);
+
+        if (allSameDate) {
+          const sharedDate = uniqueDates[0];
+          setIsDayMode(true);
+          setDayModeDate(sharedDate);
+          setDayModeDates([sharedDate]);
+        } else if (datesFound.length > 0) {
+          for (const slot of rawParsed) {
+            if (slot._isoDate) {
+              if (slot.startTime) {
+                slot.startTime = toIso(slot._isoDate, slot.startTime) || slot.startTime;
+              }
+              if (slot.endTime) {
+                slot.endTime = toIso(slot._isoDate, slot.endTime) || slot.endTime;
+              }
+            }
+          }
+        } else if (hasAnyTimes) {
+          setIsDayMode(true);
+        }
+
+        const parsedSlots = rawParsed.map(({ _isoDate: _d, ...slot }: RawSlot) => slot);
+        setSlots(parsedSlots);
+      }
+      const s = suggestion.settings;
+      if (s && typeof s === "object") {
+        if (typeof s.resultsPublic === "boolean") setResultsPublic(s.resultsPublic);
+        if (typeof s.allowVoteEdit === "boolean") setAllowVoteEdit(s.allowVoteEdit);
+        if (typeof s.allowVoteWithdrawal === "boolean") setAllowVoteWithdrawal(s.allowVoteWithdrawal);
+        if (typeof s.allowMultipleSlots === "boolean") setAllowMultipleSlots(s.allowMultipleSlots);
+      }
+    } catch (_) {}
+  }, []);
+
   const combineDateTime = (date: string, time: string): string | undefined => {
     if (!date || !time) return undefined;
     if (time.includes('T')) return undefined;
@@ -156,21 +439,25 @@ export default function CreateOrganization() {
         startTimeISO = combineDateTime(dayDate, slot.startTime || "");
         endTimeISO = combineDateTime(dayDate, slot.endTime || "");
       } else if (!useDayMode && slot.startTime) {
-        if (slot.startTime.includes('T')) {
-          try {
-            const parsed = new Date(slot.startTime);
-            if (!isNaN(parsed.getTime())) {
-              startTimeISO = parsed.toISOString();
-            }
-          } catch {}
-        }
-        if (slot.endTime && slot.endTime.includes('T')) {
-          try {
-            const parsed = new Date(slot.endTime);
-            if (!isNaN(parsed.getTime())) {
-              endTimeISO = parsed.toISOString();
-            }
-          } catch {}
+        const parseTimeField = (val: string): string | undefined => {
+          if (val.includes('T')) {
+            try {
+              const parsed = new Date(val);
+              if (!isNaN(parsed.getTime())) return parsed.toISOString();
+            } catch {}
+          }
+          if (/^\d{2}:\d{2}$/.test(val)) {
+            try {
+              const today = new Date().toISOString().split('T')[0];
+              const fallback = new Date(`${today}T${val}`);
+              if (!isNaN(fallback.getTime())) return fallback.toISOString();
+            } catch {}
+          }
+          return undefined;
+        };
+        startTimeISO = parseTimeField(slot.startTime);
+        if (slot.endTime) {
+          endTimeISO = parseTimeField(slot.endTime);
         }
       }
       
@@ -293,6 +580,7 @@ export default function CreateOrganization() {
   };
 
   const addSlot = () => {
+    const id = String(nextSlotIdRef.current++);
     const lastSlot = slots[slots.length - 1];
     if (isDayMode && lastSlot?.endTime) {
       const [h, m] = lastSlot.endTime.split(':').map(Number);
@@ -300,15 +588,24 @@ export default function CreateOrganization() {
       const endMin = startMin + slotDuration;
       const newStart = `${Math.floor(startMin / 60).toString().padStart(2, '0')}:${(startMin % 60).toString().padStart(2, '0')}`;
       const newEnd = `${Math.floor(endMin / 60).toString().padStart(2, '0')}:${(endMin % 60).toString().padStart(2, '0')}`;
-      setSlots([...slots, { text: "", startTime: newStart, endTime: newEnd, maxCapacity: undefined, order: slots.length }]);
+      setSlots([...slots, { id, text: "", startTime: newStart, endTime: newEnd, maxCapacity: undefined, order: slots.length }]);
     } else {
-      setSlots([...slots, { text: "", maxCapacity: undefined, order: slots.length }]);
+      setSlots([...slots, { id, text: "", maxCapacity: undefined, order: slots.length }]);
     }
   };
 
+  const addSlotTop = () => {
+    const id = String(nextSlotIdRef.current++);
+    const newSlot: OrgaSlot = { id, text: "", maxCapacity: undefined, order: 0 };
+    setSlots([newSlot, ...slots.map((s, i) => ({ ...s, order: i + 1 }))]);
+  };
+
   const applyTemplate = (templateId: string) => {
     const templateSlots = getTemplateSlots(templateId);
+    const baseId = nextSlotIdRef.current;
+    nextSlotIdRef.current += templateSlots.length;
     const newSlots: OrgaSlot[] = templateSlots.map((s, idx) => ({
+      id: String(baseId + idx),
       text: s.description,
       startTime: s.startTime,
       endTime: s.endTime,
@@ -334,6 +631,7 @@ export default function CreateOrganization() {
       const endH = Math.floor(endMin / 60).toString().padStart(2, '0');
       const endM = (endMin % 60).toString().padStart(2, '0');
       newSlots.push({
+        id: `gen-${idx}`,
         text: `${description} ${idx + 1}`,
         startTime: `${startH}:${startM}`,
         endTime: `${endH}:${endM}`,
@@ -639,73 +937,262 @@ export default function CreateOrganization() {
         </Card>
 
         <Card className="polly-card">
-          <CardHeader>
-            <CardTitle className="flex items-center">
-              <Users className="w-5 h-5 mr-2 text-green-600" />
-              {t('createOrganization.settings')}
-            </CardTitle>
+          <CardHeader className={settingsExpanded ? "pb-0" : ""}>
+            <button
+              type="button"
+              onClick={() => setSettingsExpanded(p => !p)}
+              className="flex items-center justify-between w-full text-left"
+              aria-expanded={settingsExpanded}
+            >
+              <CardTitle className="flex items-center">
+                <Users className="w-5 h-5 mr-2 text-green-600" />
+                {t('createOrganization.settings')}
+              </CardTitle>
+              <ChevronDown className={`w-4 h-4 text-muted-foreground transition-transform duration-200 ${settingsExpanded ? "rotate-180" : ""}`} />
+            </button>
           </CardHeader>
-          <CardContent className="space-y-6">
-            <div className="flex items-center justify-between">
-              <div className="space-y-0.5">
-                <Label>{t('createOrganization.allowMultipleSlots')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('createOrganization.allowMultipleSlotsDescription')}
-                </p>
+          {settingsExpanded && (
+            <CardContent className="space-y-6 pt-6">
+              <div className="flex items-center justify-between">
+                <div className="space-y-0.5">
+                  <Label>{t('createOrganization.allowMultipleSlots')}</Label>
+                  <p className="text-sm text-muted-foreground">
+                    {t('createOrganization.allowMultipleSlotsDescription')}
+                  </p>
+                </div>
+                <Switch
+                  checked={allowMultipleSlots}
+                  onCheckedChange={setAllowMultipleSlots}
+                  data-testid="switch-multiple-slots"
+                  aria-label={t('createOrganization.allowMultipleSlots')}
+                />
               </div>
-              <Switch
-                checked={allowMultipleSlots}
-                onCheckedChange={setAllowMultipleSlots}
-                data-testid="switch-multiple-slots"
-                aria-label={t('createOrganization.allowMultipleSlots')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.allowVoteEdit')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('createOrganization.allowEntryEditDescription')}
-                </p>
+              
+              <div className="flex items-center justify-between">
+                <div className="space-y-0.5">
+                  <Label>{t('pollCreation.allowVoteEdit')}</Label>
+                  <p className="text-sm text-muted-foreground">
+                    {t('createOrganization.allowEntryEditDescription')}
+                  </p>
+                </div>
+                <Switch
+                  checked={allowVoteEdit}
+                  onCheckedChange={setAllowVoteEdit}
+                  data-testid="switch-allow-vote-edit"
+                  aria-label={t('pollCreation.allowVoteEdit')}
+                />
               </div>
-              <Switch
-                checked={allowVoteEdit}
-                onCheckedChange={setAllowVoteEdit}
-                data-testid="switch-allow-vote-edit"
-                aria-label={t('pollCreation.allowVoteEdit')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.allowVoteWithdrawal')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('createOrganization.allowEntryWithdrawalDescription')}
-                </p>
+              
+              <div className="flex items-center justify-between pt-4 border-t">
+                <div className="space-y-0.5">
+                  <Label>{t('pollCreation.allowVoteWithdrawal')}</Label>
+                  <p className="text-sm text-muted-foreground">
+                    {t('createOrganization.allowEntryWithdrawalDescription')}
+                  </p>
+                </div>
+                <Switch
+                  checked={allowVoteWithdrawal}
+                  onCheckedChange={setAllowVoteWithdrawal}
+                  data-testid="switch-allow-vote-withdrawal"
+                  aria-label={t('pollCreation.allowVoteWithdrawal')}
+                />
               </div>
-              <Switch
-                checked={allowVoteWithdrawal}
-                onCheckedChange={setAllowVoteWithdrawal}
-                data-testid="switch-allow-vote-withdrawal"
-                aria-label={t('pollCreation.allowVoteWithdrawal')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.resultsPublic')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('pollCreation.resultsPublicDescription')}
-                </p>
+              
+              <div className="flex items-center justify-between pt-4 border-t">
+                <div className="space-y-0.5">
+                  <Label>{t('pollCreation.resultsPublic')}</Label>
+                  <p className="text-sm text-muted-foreground">
+                    {t('pollCreation.resultsPublicDescription')}
+                  </p>
+                </div>
+                <Switch
+                  checked={resultsPublic}
+                  onCheckedChange={setResultsPublic}
+                  data-testid="switch-results-public"
+                  aria-label={t('pollCreation.resultsPublic')}
+                />
               </div>
-              <Switch
-                checked={resultsPublic}
-                onCheckedChange={setResultsPublic}
-                data-testid="switch-results-public"
-                aria-label={t('pollCreation.resultsPublic')}
-              />
-            </div>
-          </CardContent>
+
+              <div className="pt-4 border-t">
+                <div className="flex items-center justify-between p-4 border rounded-lg bg-blue-50 dark:bg-blue-900/20">
+                  <div className="flex items-center gap-3">
+                    <CalendarDays className="w-5 h-5 text-blue-600" />
+                    <div className="space-y-0.5">
+                      <Label className="font-medium">{t('createOrganization.dayOrganization')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('createOrganization.dayOrganizationDescription')}
+                      </p>
+                    </div>
+                  </div>
+                  <Switch
+                    checked={isDayMode}
+                    onCheckedChange={(checked) => {
+                      setIsDayMode(checked);
+                      if (checked) {
+                        const extractTime = (dt: string | undefined): string | undefined => {
+                          if (!dt) return undefined;
+                          if (dt.includes('T')) {
+                            const timePart = dt.split('T')[1];
+                            return timePart ? timePart.substring(0, 5) : undefined;
+                          }
+                          return dt.length === 5 ? dt : undefined;
+                        };
+                        setSlots(slots.map(s => ({
+                          ...s,
+                          startTime: extractTime(s.startTime),
+                          endTime: extractTime(s.endTime)
+                        })));
+                      } else {
+                        setDayModeDate("");
+                        setDayModeDates([]);
+                      }
+                    }}
+                    data-testid="switch-day-mode"
+                    aria-label={t('createOrganization.dayOrganization')}
+                  />
+                </div>
+
+                {isDayMode && (
+                  <div className="space-y-4 mt-4">
+                    <div className="p-4 border rounded-lg bg-muted/30">
+                      <Label className="flex items-center gap-2 mb-3">
+                        <Timer className="w-4 h-4" />
+                        {t('createOrganization.slotDuration')}
+                      </Label>
+                      <div className="grid grid-cols-3 sm:grid-cols-6 gap-2" data-testid="slider-duration">
+                        {DURATION_OPTIONS.map(d => (
+                          <button
+                            key={d}
+                            type="button"
+                            onClick={() => {
+                              setSlotDuration(d);
+                              recalcSlotTimes(d);
+                            }}
+                            className={`py-2 px-3 rounded-lg text-sm font-medium border transition-all ${
+                              slotDuration === d
+                                ? 'bg-primary text-primary-foreground border-primary shadow-sm'
+                                : 'bg-background border-border hover:border-primary/50 hover:bg-accent/50 text-foreground'
+                            }`}
+                            data-testid={`duration-btn-${d}`}
+                          >
+                            <span data-testid={d === slotDuration ? "duration-value" : undefined}>
+                              {d} {t('createOrganization.minutes')}
+                            </span>
+                          </button>
+                        ))}
+                      </div>
+                    </div>
+
+                    <div className="p-4 border rounded-lg bg-muted/30">
+                      <Label className="flex items-center gap-2 mb-2">
+                        <CalendarDays className="w-4 h-4" />
+                        {t('createOrganization.dateForAllSlots')}
+                      </Label>
+                      <p className="text-xs text-muted-foreground mb-2">
+                        {t('createOrganization.multiDateHint')}
+                      </p>
+                      <div className="flex gap-2 items-start">
+                        <DatePicker
+                          date={null}
+                          onDateChange={(date) => {
+                            if (date) {
+                              const year = date.getFullYear();
+                              const month = String(date.getMonth() + 1).padStart(2, '0');
+                              const day = String(date.getDate()).padStart(2, '0');
+                              const dateStr = `${year}-${month}-${day}`;
+                              if (!dayModeDates.includes(dateStr)) {
+                                const updated = [...dayModeDates, dateStr].sort();
+                                setDayModeDates(updated);
+                                setDayModeDate(updated[0]);
+                              }
+                            }
+                          }}
+                          minDate={new Date()}
+                          placeholder={t('createOrganization.addDate')}
+                          showClearButton={false}
+                          data-testid="input-day-mode-date"
+                        />
+                      </div>
+                      {dayModeDates.length > 0 && (
+                        <div className="flex flex-wrap gap-2 mt-3">
+                          {[...dayModeDates].sort().map((dateStr) => {
+                            const [y, m, d] = dateStr.split('-').map(Number);
+                            const dateObj = new Date(y, m - 1, d, 12, 0, 0);
+                            const label = dateObj.toLocaleDateString(undefined, { weekday: 'short', day: '2-digit', month: '2-digit', year: 'numeric' });
+                            return (
+                              <span
+                                key={dateStr}
+                                className="inline-flex items-center gap-1 px-3 py-1 rounded-full text-sm bg-primary/10 text-primary border border-primary/20"
+                                data-testid={`date-chip-${dateStr}`}
+                              >
+                                <CalendarDays className="w-3 h-3" />
+                                {label}
+                                <button
+                                  type="button"
+                                  onClick={() => {
+                                    const updated = dayModeDates.filter(dd => dd !== dateStr);
+                                    setDayModeDates(updated);
+                                    setDayModeDate(updated[0] || "");
+                                  }}
+                                  className="ml-1 hover:text-destructive transition-colors"
+                                  aria-label={t('createOrganization.removeDate')}
+                                >
+                                  <Trash2 className="w-3 h-3" />
+                                </button>
+                              </span>
+                            );
+                          })}
+                        </div>
+                      )}
+                      {dayModeDates.length > 1 && (
+                        <p className="text-xs text-amber-600 dark:text-amber-400 mt-2">
+                          {t('createOrganization.multiDateInfo', { count: dayModeDates.length })}
+                        </p>
+                      )}
+                    </div>
+
+                    <div className="p-4 border rounded-lg bg-muted/30">
+                      <div className="flex items-center gap-2 mb-3">
+                        <Sparkles className="w-4 h-4 text-amber-500" />
+                        <Label className="font-medium">{t('createOrganization.templates.title')}</Label>
+                      </div>
+                      <p className="text-sm text-muted-foreground mb-3">
+                        {t('createOrganization.templates.subtitle')}
+                      </p>
+                      <div className="grid grid-cols-1 sm:grid-cols-2 gap-2">
+                        {orgaTemplateDefinitions.map((template) => {
+                          const Icon = template.icon;
+                          return (
+                            <button
+                              key={template.id}
+                              type="button"
+                              onClick={() => applyTemplate(template.id)}
+                              className="flex items-start gap-3 p-3 rounded-lg border border-border hover:border-primary/50 hover:bg-accent/50 transition-colors text-left group"
+                              data-testid={`template-${template.id}`}
+                            >
+                              <Icon className="w-5 h-5 mt-0.5 text-amber-500 group-hover:text-amber-400 shrink-0" />
+                              <div>
+                                <p className="font-medium text-sm">{t(template.nameKey)}</p>
+                                <p className="text-xs text-muted-foreground">{t(template.descriptionKey)}</p>
+                              </div>
+                            </button>
+                          );
+                        })}
+                      </div>
+                      <div className="mt-3 p-2 rounded bg-blue-50 dark:bg-blue-900/20 text-xs text-blue-700 dark:text-blue-300">
+                        💡 {t('createOrganization.templates.tip')}
+                      </div>
+                    </div>
+
+                    <Button type="button" onClick={addSlotTop} variant="outline" size="sm" className="w-full" data-testid="button-add-slot-day">
+                      <Plus className="w-4 h-4 mr-2" />
+                      {t('createOrganization.addSlot')}
+                    </Button>
+                  </div>
+                )}
+              </div>
+            </CardContent>
+          )}
         </Card>
 
         <Card className="polly-card">
@@ -715,7 +1202,7 @@ export default function CreateOrganization() {
                 <Clock className="w-5 h-5 mr-2 text-green-600" />
                 {t('createOrganization.slots')}
               </span>
-              <Button type="button" onClick={addSlot} variant="outline" size="sm" data-testid="button-add-slot">
+              <Button type="button" onClick={addSlotTop} variant="outline" size="sm" data-testid="button-add-slot">
                 <Plus className="w-4 h-4 mr-2" />
                 {t('createOrganization.addSlot')}
               </Button>
@@ -728,311 +1215,22 @@ export default function CreateOrganization() {
             </CardDescription>
           </CardHeader>
           <CardContent className="space-y-4">
-            <div className="flex items-center justify-between p-4 border rounded-lg bg-blue-50 dark:bg-blue-900/20">
-              <div className="flex items-center gap-3">
-                <CalendarDays className="w-5 h-5 text-blue-600" />
-                <div className="space-y-0.5">
-                  <Label className="font-medium">{t('createOrganization.dayOrganization')}</Label>
-                  <p className="text-sm text-muted-foreground">
-                    {t('createOrganization.dayOrganizationDescription')}
-                  </p>
-                </div>
-              </div>
-              <Switch
-                checked={isDayMode}
-                onCheckedChange={(checked) => {
-                  setIsDayMode(checked);
-                  if (checked) {
-                    const extractTime = (dt: string | undefined): string | undefined => {
-                      if (!dt) return undefined;
-                      if (dt.includes('T')) {
-                        const timePart = dt.split('T')[1];
-                        return timePart ? timePart.substring(0, 5) : undefined;
-                      }
-                      return dt.length === 5 ? dt : undefined;
-                    };
-                    setSlots(slots.map(s => ({ 
-                      ...s, 
-                      startTime: extractTime(s.startTime),
-                      endTime: extractTime(s.endTime)
-                    })));
-                  } else {
-                    setDayModeDate("");
-                    setDayModeDates([]);
-                    setSlots(slots.map(s => ({ ...s, startTime: undefined, endTime: undefined })));
-                  }
-                }}
-                data-testid="switch-day-mode"
-                aria-label={t('createOrganization.dayOrganization')}
-              />
-            </div>
-            
-            <div className="p-4 border rounded-lg bg-muted/30">
-              <div className="flex items-center gap-2 mb-3">
-                <Sparkles className="w-4 h-4 text-amber-500" />
-                <Label className="font-medium">{t('createOrganization.templates.title')}</Label>
-              </div>
-              <p className="text-sm text-muted-foreground mb-3">
-                {t('createOrganization.templates.subtitle')}
-              </p>
-              <div className="grid grid-cols-1 sm:grid-cols-2 gap-2">
-                {orgaTemplateDefinitions.map((template) => {
-                  const Icon = template.icon;
-                  return (
-                    <button
-                      key={template.id}
-                      type="button"
-                      onClick={() => {
-                        if (!isDayMode) {
-                          setIsDayMode(true);
-                        }
-                        applyTemplate(template.id);
-                      }}
-                      className="flex items-start gap-3 p-3 rounded-lg border border-border hover:border-primary/50 hover:bg-accent/50 transition-colors text-left group"
-                      data-testid={`template-${template.id}`}
-                    >
-                      <Icon className="w-5 h-5 mt-0.5 text-amber-500 group-hover:text-amber-400 shrink-0" />
-                      <div>
-                        <p className="font-medium text-sm">{t(template.nameKey)}</p>
-                        <p className="text-xs text-muted-foreground">{t(template.descriptionKey)}</p>
-                      </div>
-                    </button>
-                  );
-                })}
-              </div>
-              <div className="mt-3 p-2 rounded bg-blue-50 dark:bg-blue-900/20 text-xs text-blue-700 dark:text-blue-300">
-                💡 {t('createOrganization.templates.tip')}
-              </div>
-            </div>
-
-            {isDayMode && (
-              <>
-                <div className="p-4 border rounded-lg bg-muted/30">
-                  <Label className="flex items-center gap-2 mb-2">
-                    <CalendarDays className="w-4 h-4" />
-                    {t('createOrganization.dateForAllSlots')}
-                  </Label>
-                  <p className="text-xs text-muted-foreground mb-2">
-                    {t('createOrganization.multiDateHint')}
-                  </p>
-                  <div className="flex gap-2 items-start">
-                    <DatePicker
-                      date={null}
-                      onDateChange={(date) => {
-                        if (date) {
-                          const year = date.getFullYear();
-                          const month = String(date.getMonth() + 1).padStart(2, '0');
-                          const day = String(date.getDate()).padStart(2, '0');
-                          const dateStr = `${year}-${month}-${day}`;
-                          if (!dayModeDates.includes(dateStr)) {
-                            const updated = [...dayModeDates, dateStr].sort();
-                            setDayModeDates(updated);
-                            setDayModeDate(updated[0]);
-                          }
-                        }
-                      }}
-                      minDate={new Date()}
-                      placeholder={t('createOrganization.addDate')}
-                      showClearButton={false}
-                      data-testid="input-day-mode-date"
-                    />
-                  </div>
-                  {dayModeDates.length > 0 && (
-                    <div className="flex flex-wrap gap-2 mt-3">
-                      {[...dayModeDates].sort().map((dateStr) => {
-                        const [y, m, d] = dateStr.split('-').map(Number);
-                        const dateObj = new Date(y, m - 1, d, 12, 0, 0);
-                        const label = dateObj.toLocaleDateString(undefined, { weekday: 'short', day: '2-digit', month: '2-digit', year: 'numeric' });
-                        return (
-                          <span
-                            key={dateStr}
-                            className="inline-flex items-center gap-1 px-3 py-1 rounded-full text-sm bg-primary/10 text-primary border border-primary/20"
-                            data-testid={`date-chip-${dateStr}`}
-                          >
-                            <CalendarDays className="w-3 h-3" />
-                            {label}
-                            <button
-                              type="button"
-                              onClick={() => {
-                                const updated = dayModeDates.filter(dd => dd !== dateStr);
-                                setDayModeDates(updated);
-                                setDayModeDate(updated[0] || "");
-                              }}
-                              className="ml-1 hover:text-destructive transition-colors"
-                              aria-label={t('createOrganization.removeDate')}
-                            >
-                              <Trash2 className="w-3 h-3" />
-                            </button>
-                          </span>
-                        );
-                      })}
-                    </div>
-                  )}
-                  {dayModeDates.length > 1 && (
-                    <p className="text-xs text-amber-600 dark:text-amber-400 mt-2">
-                      {t('createOrganization.multiDateInfo', { count: dayModeDates.length })}
-                    </p>
-                  )}
-                </div>
-
-                <div className="p-4 border rounded-lg bg-muted/30">
-                  <Label className="flex items-center gap-2 mb-3">
-                    <Timer className="w-4 h-4" />
-                    {t('createOrganization.slotDuration')}
-                  </Label>
-                  <div className="grid grid-cols-3 sm:grid-cols-6 gap-2" data-testid="slider-duration">
-                    {DURATION_OPTIONS.map(d => (
-                      <button
-                        key={d}
-                        type="button"
-                        onClick={() => {
-                          setSlotDuration(d);
-                          recalcSlotTimes(d);
-                        }}
-                        className={`py-2 px-3 rounded-lg text-sm font-medium border transition-all ${
-                          slotDuration === d 
-                            ? 'bg-primary text-primary-foreground border-primary shadow-sm' 
-                            : 'bg-background border-border hover:border-primary/50 hover:bg-accent/50 text-foreground'
-                        }`}
-                        data-testid={`duration-btn-${d}`}
-                      >
-                        <span data-testid={d === slotDuration ? "duration-value" : undefined}>
-                          {d} {t('createOrganization.minutes')}
-                        </span>
-                      </button>
-                    ))}
-                  </div>
-                </div>
-
-                <Button type="button" onClick={addSlot} variant="outline" size="sm" className="w-full" data-testid="button-add-slot-day">
-                  <Plus className="w-4 h-4 mr-2" />
-                  {t('createOrganization.addSlot')}
-                </Button>
-              </>
-            )}
-            
-            {slots.map((slot, index) => (
-              <div 
-                key={index} 
-                className="border rounded-lg p-4 bg-muted/30"
-                data-testid={`slot-${index}`}
-              >
-                <div className="flex items-start gap-4">
-                  <div className="flex-1 space-y-4">
-                    <div>
-                      <Label>{t('createOrganization.slotDescription')}</Label>
-                      <Input
-                        value={slot.text}
-                        onChange={(e) => updateSlot(index, { text: e.target.value })}
-                        placeholder={t('createOrganization.slotDescriptionPlaceholder')}
-                        className="mt-1"
-                        data-testid={`input-slot-text-${index}`}
-                      />
-                    </div>
-                    
-                    {isDayMode ? (
-                      <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
-                        <div>
-                          <Label>{t('createOrganization.fromTime')}</Label>
-                          <div className="mt-1">
-                            <TimePicker
-                              time={slot.startTime}
-                              onTimeChange={(time) => updateSlot(index, { startTime: time })}
-                              placeholder={t('createOrganization.startTime')}
-                              data-testid={`input-slot-start-${index}`}
-                            />
-                          </div>
-                        </div>
-                        <div>
-                          <Label>{t('createOrganization.toTime')}</Label>
-                          <div className="mt-1">
-                            <TimePicker
-                              time={slot.endTime}
-                              onTimeChange={(time) => updateSlot(index, { endTime: time })}
-                              placeholder={t('createOrganization.endTime')}
-                              data-testid={`input-slot-end-${index}`}
-                            />
-                          </div>
-                          {slot.startTime && slot.endTime && slot.startTime === slot.endTime && (
-                            <p className="text-xs text-destructive mt-1">
-                              {t('createOrganization.timesMustDiffer')}
-                            </p>
-                          )}
-                        </div>
-                        <div>
-                          <Label>{t('createOrganization.maxSpots')}</Label>
-                          <Input
-                            type="number"
-                            min={1}
-                            value={slot.maxCapacity ?? ""}
-                            onChange={(e) => updateSlot(index, { maxCapacity: e.target.value ? Math.max(1, parseInt(e.target.value) || 1) : undefined })}
-                            placeholder={t('createOrganization.unlimitedPlaceholder')}
-                            className="mt-1"
-                            data-testid={`input-slot-capacity-${index}`}
-                          />
-                        </div>
-                      </div>
-                    ) : (
-                      <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
-                        <div>
-                          <Label>{t('createOrganization.fromOptional')}</Label>
-                          <div className="mt-1">
-                            <DateTimePicker
-                              value={slot.startTime}
-                              onChange={(value) => updateSlot(index, { startTime: value })}
-                              placeholder={t('createOrganization.dateTimePlaceholder')}
-                              data-testid={`input-slot-start-${index}`}
-                            />
-                          </div>
-                        </div>
-                        <div>
-                          <Label>{t('createOrganization.toOptional')}</Label>
-                          <div className="mt-1">
-                            <DateTimePicker
-                              value={slot.endTime}
-                              onChange={(value) => updateSlot(index, { endTime: value })}
-                              placeholder={t('createOrganization.dateTimePlaceholder')}
-                              data-testid={`input-slot-end-${index}`}
-                            />
-                          </div>
-                          {slot.startTime && slot.endTime && slot.startTime === slot.endTime && (
-                            <p className="text-xs text-destructive mt-1">
-                              {t('createOrganization.timesMustDiffer')}
-                            </p>
-                          )}
-                        </div>
-                        <div>
-                          <Label>{t('createOrganization.maxSpots')}</Label>
-                          <Input
-                            type="number"
-                            min={1}
-                            value={slot.maxCapacity ?? ""}
-                            onChange={(e) => updateSlot(index, { maxCapacity: e.target.value ? Math.max(1, parseInt(e.target.value) || 1) : undefined })}
-                            placeholder={t('createOrganization.unlimitedPlaceholder')}
-                            className="mt-1"
-                            data-testid={`input-slot-capacity-${index}`}
-                          />
-                        </div>
-                      </div>
-                    )}
-                  </div>
-                  
-                  {slots.length > 1 && (
-                    <Button
-                      type="button"
-                      variant="ghost"
-                      size="icon"
-                      onClick={() => removeSlot(index)}
-                      className="text-destructive hover:text-destructive"
-                      aria-label={t('createOrganization.removeSlot')}
-                      data-testid={`button-remove-slot-${index}`}
-                    >
-                      <Trash2 className="w-4 h-4" />
-                    </Button>
-                  )}
-                </div>
-              </div>
-            ))}
+            <DndContext sensors={slotSensors} collisionDetection={closestCenter} onDragEnd={handleSlotDragEnd}>
+              <SortableContext items={slots.map((s) => s.id)} strategy={verticalListSortingStrategy}>
+                {slots.map((slot, index) => (
+                  <SortableSlotItem
+                    key={slot.id}
+                    slot={slot}
+                    index={index}
+                    slotsLength={slots.length}
+                    isDayMode={isDayMode}
+                    updateSlot={updateSlot}
+                    removeSlot={removeSlot}
+                    t={t}
+                  />
+                ))}
+              </SortableContext>
+            </DndContext>
 
             <Button type="button" onClick={addSlot} variant="outline" size="sm" className="w-full" data-testid="button-add-slot-bottom">
               <Plus className="w-4 h-4 mr-2" />
diff --git a/client/src/pages/create-poll.tsx b/client/src/pages/create-poll.tsx
index 5094005f..f9c270b4 100644
--- a/client/src/pages/create-poll.tsx
+++ b/client/src/pages/create-poll.tsx
@@ -21,7 +21,7 @@ import { useToast } from "@/hooks/use-toast";
 import { useFormPersistence } from "@/hooks/useFormPersistence";
 import { apiRequest } from "@/lib/queryClient";
 import { formatScheduleOptionText } from "@/lib/utils";
-import { ArrowLeft, Calendar, Clock, Mail, Trash2, Pencil, CheckCircle, QrCode, Link as LinkIcon, Info, Bell } from "lucide-react";
+import { ArrowLeft, Calendar, Clock, Mail, Trash2, Pencil, CheckCircle, QrCode, Link as LinkIcon, Info, Bell, ChevronDown, Video } from "lucide-react";
 import { DatePicker } from "@/components/ui/date-picker";
 import { useAuth } from "@/contexts/AuthContext";
 
@@ -42,12 +42,13 @@ interface PollFormData {
   allowVoteWithdrawal: boolean;
   resultsPublic: boolean;
   expiresAt: string | null;
+  videoConferenceUrl?: string;
 }
 
 export default function CreatePoll() {
   const [, setLocation] = useLocation();
   const { toast } = useToast();
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
   const { user, isAuthenticated } = useAuth();
   
   const [title, setTitle] = useState("");
@@ -59,6 +60,8 @@ export default function CreatePoll() {
   const [allowVoteEdit, setAllowVoteEdit] = useState(false);
   const [allowVoteWithdrawal, setAllowVoteWithdrawal] = useState(false);
   const [resultsPublic, setResultsPublic] = useState(true);
+  const [videoConferenceUrl, setVideoConferenceUrl] = useState("");
+  const [settingsExpanded, setSettingsExpanded] = useState(false);
   const [options, setOptions] = useState<PollOption[]>([]);
   
   const [editDialogOpen, setEditDialogOpen] = useState(false);
@@ -84,6 +87,7 @@ export default function CreatePoll() {
       setAllowVoteEdit(stored.data.allowVoteEdit ?? false);
       setAllowVoteWithdrawal(stored.data.allowVoteWithdrawal ?? false);
       setResultsPublic(stored.data.resultsPublic ?? true);
+      setVideoConferenceUrl(stored.data.videoConferenceUrl || "");
       if (stored.data.expiresAt) {
         setExpiresAt(new Date(stored.data.expiresAt));
       }
@@ -97,6 +101,43 @@ export default function CreatePoll() {
     }
   }, []);
 
+  // Read AI suggestion from sessionStorage if present
+  useEffect(() => {
+    const raw = sessionStorage.getItem("ai-suggestion");
+    if (!raw) return;
+    try {
+      const suggestion = JSON.parse(raw);
+      if (suggestion.pollType !== "schedule") return;
+      sessionStorage.removeItem("ai-suggestion");
+      if (suggestion.title) setTitle(suggestion.title);
+      if (suggestion.description) setDescription(suggestion.description);
+      if (Array.isArray(suggestion.options) && suggestion.options.length > 0) {
+        const parsed: PollOption[] = [];
+        suggestion.options.forEach((rawOpt: any, i: number) => {
+          const opt = typeof rawOpt === "string" ? rawOpt : rawOpt.text || "";
+          const match = opt.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})\s+(\d{2}:\d{2})\s*-\s*(\d{2}:\d{2})/);
+          if (match) {
+            const [, day, month, year, startH, endH] = match;
+            const dateObj = new Date(parseInt(year), parseInt(month) - 1, parseInt(day));
+            parsed.push({
+              text: `${dateObj.toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')} ${startH} - ${endH}`,
+              startTime: new Date(dateObj.toDateString() + " " + startH).toISOString(),
+              endTime: new Date(dateObj.toDateString() + " " + endH).toISOString(),
+              order: i,
+            });
+          }
+        });
+        if (parsed.length > 0) setOptions(parsed);
+      }
+      const s = suggestion.settings;
+      if (s && typeof s === "object") {
+        if (typeof s.resultsPublic === "boolean") setResultsPublic(s.resultsPublic);
+        if (typeof s.allowVoteEdit === "boolean") setAllowVoteEdit(s.allowVoteEdit);
+        if (typeof s.allowVoteWithdrawal === "boolean") setAllowVoteWithdrawal(s.allowVoteWithdrawal);
+      }
+    } catch (_) {}
+  }, []);
+
   useEffect(() => {
     if (autoSubmitTriggeredRef.current) return;
     if (!hasRestoredRef.current) return;
@@ -123,6 +164,7 @@ export default function CreatePoll() {
           allowVoteEdit: allowVoteEdit,
           allowVoteWithdrawal: allowVoteWithdrawal,
           resultsPublic: resultsPublic,
+          videoConferenceUrl: videoConferenceUrl.trim() || undefined,
           options: options.map((option) => {
             const opt: any = {
               text: option.text,
@@ -183,7 +225,7 @@ export default function CreatePoll() {
       
       if (requiresLogin) {
         formPersistence.saveBeforeRedirect(
-          { title, description, creatorEmail, options, allowVoteEdit, allowVoteWithdrawal, resultsPublic, expiresAt: expiresAt ? expiresAt.toISOString() : null },
+          { title, description, creatorEmail, options, allowVoteEdit, allowVoteWithdrawal, resultsPublic, expiresAt: expiresAt ? expiresAt.toISOString() : null, videoConferenceUrl: videoConferenceUrl || undefined },
           '/create-poll'
         );
         
@@ -198,7 +240,7 @@ export default function CreatePoll() {
   const addTimeSlot = (date: Date, startTime: string, endTime: string) => {
     setOptions((prevOptions) => {
       const option: PollOption = {
-        text: `${date.toLocaleDateString('de-DE')} ${startTime} - ${endTime}`,
+        text: `${date.toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')} ${startTime} - ${endTime}`,
         startTime: new Date(date.toDateString() + ' ' + startTime).toISOString(),
         endTime: new Date(date.toDateString() + ' ' + endTime).toISOString(),
         order: prevOptions.length,
@@ -240,7 +282,7 @@ export default function CreatePoll() {
         if (i === editIndex) {
           return {
             ...opt,
-            text: `${editDate.toLocaleDateString('de-DE')} ${editStartTime} - ${editEndTime}`,
+            text: `${editDate.toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')} ${editStartTime} - ${editEndTime}`,
             startTime: new Date(editDate.toDateString() + ' ' + editStartTime).toISOString(),
             endTime: new Date(editDate.toDateString() + ' ' + editEndTime).toISOString(),
           };
@@ -293,6 +335,7 @@ export default function CreatePoll() {
       allowVoteEdit,
       allowVoteWithdrawal,
       resultsPublic,
+      videoConferenceUrl: videoConferenceUrl.trim() || undefined,
       options: options.map((option) => {
         const opt: any = {
           text: option.text,
@@ -377,6 +420,24 @@ export default function CreatePoll() {
               </p>
             </div>
 
+            <div>
+              <Label htmlFor="videoConferenceUrl" className="flex items-center gap-2">
+                <Video className="w-4 h-4 text-polly-orange" />
+                {t('pollCreation.videoConferenceLabel')}
+              </Label>
+              <Input
+                id="videoConferenceUrl"
+                type="url"
+                value={videoConferenceUrl}
+                onChange={(e) => setVideoConferenceUrl(e.target.value)}
+                placeholder={t('pollCreation.videoConferencePlaceholder')}
+                className="mt-1"
+              />
+              <p className="text-xs text-muted-foreground mt-1">
+                {t('pollCreation.videoConferenceHint')}
+              </p>
+            </div>
+
             {expiresAt && (() => {
               const hoursUntilExpiry = Math.max(0, (expiresAt.getTime() - Date.now()) / (1000 * 60 * 60));
               const isTooShort = hoursUntilExpiry < 6;
@@ -432,49 +493,70 @@ export default function CreatePoll() {
               );
             })()}
             
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.allowVoteEdit')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('pollCreation.allowVoteEditDescription')}
-                </p>
-              </div>
-              <Switch
-                checked={allowVoteEdit}
-                onCheckedChange={setAllowVoteEdit}
-                data-testid="switch-allow-vote-edit"
-                aria-label={t('pollCreation.allowVoteEdit')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.allowVoteWithdrawal')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('pollCreation.allowVoteWithdrawalDescription')}
-                </p>
-              </div>
-              <Switch
-                checked={allowVoteWithdrawal}
-                onCheckedChange={setAllowVoteWithdrawal}
-                data-testid="switch-allow-vote-withdrawal"
-                aria-label={t('pollCreation.allowVoteWithdrawal')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.resultsPublic')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('pollCreation.resultsPublicDescription')}
-                </p>
-              </div>
-              <Switch
-                checked={resultsPublic}
-                onCheckedChange={setResultsPublic}
-                data-testid="switch-results-public"
-                aria-label={t('pollCreation.resultsPublic')}
-              />
+            <div className="pt-4 border-t">
+              <button
+                type="button"
+                onClick={() => setSettingsExpanded(p => !p)}
+                className="flex items-center justify-between w-full text-left"
+                aria-expanded={settingsExpanded}
+              >
+                <span className="text-sm font-medium text-muted-foreground">{t('pollCreation.settings')}</span>
+                <div className="flex items-center gap-2">
+                  {!settingsExpanded && (
+                    <div className="flex gap-1">
+                      {allowVoteEdit && <span className="text-[10px] px-1.5 py-0.5 rounded bg-muted text-muted-foreground">{t('pollCreation.allowVoteEdit')}</span>}
+                      {!resultsPublic && <span className="text-[10px] px-1.5 py-0.5 rounded bg-muted text-muted-foreground">{t('pollCreation.resultsPrivate')}</span>}
+                    </div>
+                  )}
+                  <ChevronDown className={`w-4 h-4 text-muted-foreground transition-transform duration-200 ${settingsExpanded ? "rotate-180" : ""}`} />
+                </div>
+              </button>
+              {settingsExpanded && (
+                <div className="space-y-4 mt-4">
+                  <div className="flex items-center justify-between">
+                    <div className="space-y-0.5">
+                      <Label>{t('pollCreation.allowVoteEdit')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('pollCreation.allowVoteEditDescription')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={allowVoteEdit}
+                      onCheckedChange={setAllowVoteEdit}
+                      data-testid="switch-allow-vote-edit"
+                      aria-label={t('pollCreation.allowVoteEdit')}
+                    />
+                  </div>
+                  <div className="flex items-center justify-between pt-4 border-t">
+                    <div className="space-y-0.5">
+                      <Label>{t('pollCreation.allowVoteWithdrawal')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('pollCreation.allowVoteWithdrawalDescription')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={allowVoteWithdrawal}
+                      onCheckedChange={setAllowVoteWithdrawal}
+                      data-testid="switch-allow-vote-withdrawal"
+                      aria-label={t('pollCreation.allowVoteWithdrawal')}
+                    />
+                  </div>
+                  <div className="flex items-center justify-between pt-4 border-t">
+                    <div className="space-y-0.5">
+                      <Label>{t('pollCreation.resultsPublic')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('pollCreation.resultsPublicDescription')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={resultsPublic}
+                      onCheckedChange={setResultsPublic}
+                      data-testid="switch-results-public"
+                      aria-label={t('pollCreation.resultsPublic')}
+                    />
+                  </div>
+                </div>
+              )}
             </div>
           </CardContent>
         </Card>
@@ -631,7 +713,7 @@ export default function CreatePoll() {
             <DialogDescription>
               {editDate && (
                 <span className="font-medium text-foreground">
-                  {editDate.toLocaleDateString('de-DE', { 
+                  {editDate.toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                     weekday: 'long', 
                     year: 'numeric', 
                     month: 'long', 
diff --git a/client/src/pages/create-survey.tsx b/client/src/pages/create-survey.tsx
index af882b88..0ae0ed3c 100644
--- a/client/src/pages/create-survey.tsx
+++ b/client/src/pages/create-survey.tsx
@@ -11,15 +11,34 @@ import { Switch } from "@/components/ui/switch";
 import { useToast } from "@/hooks/use-toast";
 import { useFormPersistence } from "@/hooks/useFormPersistence";
 import { apiRequest } from "@/lib/queryClient";
-import { ArrowLeft, Vote, Mail, Plus, Trash2, CheckCircle, QrCode, Link as LinkIcon, Info, Bell } from "lucide-react";
+import { ArrowLeft, Vote, Mail, Plus, Trash2, CheckCircle, QrCode, Link as LinkIcon, Info, Bell, ChevronDown, GripVertical } from "lucide-react";
 import { DatePicker } from "@/components/ui/date-picker";
 import { ImageUpload } from "@/components/ImageUpload";
 import { useAuth } from "@/contexts/AuthContext";
+import {
+  DndContext,
+  closestCenter,
+  KeyboardSensor,
+  PointerSensor,
+  useSensor,
+  useSensors,
+  type DragEndEvent,
+} from "@dnd-kit/core";
+import {
+  SortableContext,
+  sortableKeyboardCoordinates,
+  useSortable,
+  verticalListSortingStrategy,
+  arrayMove,
+} from "@dnd-kit/sortable";
+import { CSS } from "@dnd-kit/utilities";
 
 interface SurveyOption {
+  id: string;
   text: string;
   imageUrl?: string;
   altText?: string;
+  isFreeText?: boolean;
   order: number;
 }
 
@@ -35,6 +54,69 @@ interface SurveyFormData {
   expiresAt: string | null;
 }
 
+interface SortableSurveyRowProps {
+  option: SurveyOption;
+  index: number;
+  options: SurveyOption[];
+  onUpdate: (text: string) => void;
+  onRemove: () => void;
+  onImageUploaded: (url: string) => void;
+  onImageRemoved: () => void;
+  onAltTextChange: (alt: string) => void;
+  t: (key: string, opts?: Record<string, unknown>) => string;
+}
+
+function SortableSurveyRow({ option, index, options, onUpdate, onRemove, onImageUploaded, onImageRemoved, onAltTextChange, t }: SortableSurveyRowProps) {
+  const { attributes, listeners, setNodeRef, transform, transition, isDragging } = useSortable({ id: option.id });
+  const style = { transform: CSS.Transform.toString(transform), transition, opacity: isDragging ? 0.5 : 1 };
+
+  const optionIndex = index + 1;
+  const canDelete = options.length > 2;
+
+  return (
+    <div ref={setNodeRef} style={style} className="border rounded-lg p-4 space-y-3">
+      <div className="flex items-center space-x-3">
+        <button type="button" className="cursor-grab text-muted-foreground hover:text-foreground shrink-0" aria-label={t('createSurvey.moveOption')} {...attributes} {...listeners}>
+          <GripVertical className="w-4 h-4" />
+        </button>
+        <div className="flex items-center justify-center w-8 h-8 rounded-full bg-muted shrink-0">
+          <span className="text-sm font-medium">{optionIndex}</span>
+        </div>
+        <Input
+          value={option.text}
+          onChange={(e) => onUpdate(e.target.value)}
+          placeholder={t('createSurvey.optionPlaceholder', { number: optionIndex })}
+          className="flex-1"
+          data-testid={`input-option-${index}`}
+        />
+        {canDelete && (
+          <Button
+            type="button"
+            variant="ghost"
+            size="sm"
+            onClick={onRemove}
+            className="text-destructive hover:text-destructive"
+            aria-label={t('createSurvey.removeOption')}
+            data-testid={`button-delete-option-${index}`}
+          >
+            <Trash2 className="w-4 h-4" />
+          </Button>
+        )}
+      </div>
+      <div className="space-y-2">
+        <span className="text-sm text-muted-foreground">{t('createSurvey.addImage')}</span>
+        <ImageUpload
+          onImageUploaded={onImageUploaded}
+          onImageRemoved={onImageRemoved}
+          onAltTextChange={onAltTextChange}
+          currentImageUrl={option.imageUrl}
+          currentAltText={option.altText}
+        />
+      </div>
+    </div>
+  );
+}
+
 export default function CreateSurvey() {
   const [, setLocation] = useLocation();
   const { toast } = useToast();
@@ -51,11 +133,29 @@ export default function CreateSurvey() {
   const [allowVoteWithdrawal, setAllowVoteWithdrawal] = useState(false);
   const [resultsPublic, setResultsPublic] = useState(true);
   const [allowMaybe, setAllowMaybe] = useState(true);
+  const [settingsExpanded, setSettingsExpanded] = useState(false);
+  const nextIdRef = useRef(2);
   const [options, setOptions] = useState<SurveyOption[]>([
-    { text: "", order: 0 },
-    { text: "", order: 1 },
+    { id: "0", text: "", order: 0 },
+    { id: "1", text: "", order: 1 },
   ]);
 
+  const sensors = useSensors(
+    useSensor(PointerSensor),
+    useSensor(KeyboardSensor, { coordinateGetter: sortableKeyboardCoordinates })
+  );
+
+  const handleDragEnd = (event: DragEndEvent) => {
+    const { active, over } = event;
+    if (over && active.id !== over.id) {
+      setOptions((items) => {
+        const oldIndex = items.findIndex((i) => i.id === active.id);
+        const newIndex = items.findIndex((i) => i.id === over.id);
+        return arrayMove(items, oldIndex, newIndex).map((opt, idx) => ({ ...opt, order: idx }));
+      });
+    }
+  };
+
   const formPersistence = useFormPersistence<SurveyFormData>({ key: 'create-survey' });
   const hasRestoredRef = useRef(false);
   const autoSubmitTriggeredRef = useRef(false);
@@ -74,7 +174,9 @@ export default function CreateSurvey() {
       setResultsPublic(stored.data.resultsPublic ?? true);
       setAllowMaybe(stored.data.allowMaybe ?? true);
       if (stored.data.options && stored.data.options.length >= 2) {
-        setOptions(stored.data.options);
+        const restored = stored.data.options.map((o: SurveyOption, i: number) => ({ ...o, id: o.id ?? String(i) }));
+        nextIdRef.current = restored.length;
+        setOptions(restored);
       }
       if (stored.data.expiresAt) {
         setExpiresAt(new Date(stored.data.expiresAt));
@@ -89,6 +191,34 @@ export default function CreateSurvey() {
     }
   }, []);
 
+  // Read AI suggestion from sessionStorage if present
+  useEffect(() => {
+    const raw = sessionStorage.getItem("ai-suggestion");
+    if (!raw) return;
+    try {
+      const suggestion = JSON.parse(raw);
+      if (suggestion.pollType !== "survey") return;
+      sessionStorage.removeItem("ai-suggestion");
+      if (suggestion.title) setTitle(suggestion.title);
+      if (suggestion.description) setDescription(suggestion.description);
+      if (Array.isArray(suggestion.options) && suggestion.options.length >= 1) {
+        const mapped = suggestion.options.map((opt: any, i: number) => {
+          if (typeof opt === "string") return { id: String(i), text: opt, order: i };
+          return { id: String(i), text: opt.text || "", isFreeText: opt.isFreeText ?? false, order: i };
+        });
+        nextIdRef.current = mapped.length;
+        setOptions(mapped);
+      }
+      const s = suggestion.settings;
+      if (s && typeof s === "object") {
+        if (typeof s.resultsPublic === "boolean") setResultsPublic(s.resultsPublic);
+        if (typeof s.allowVoteEdit === "boolean") setAllowVoteEdit(s.allowVoteEdit);
+        if (typeof s.allowVoteWithdrawal === "boolean") setAllowVoteWithdrawal(s.allowVoteWithdrawal);
+        if (typeof s.allowMaybe === "boolean") setAllowMaybe(s.allowMaybe);
+      }
+    } catch (_) {}
+  }, []);
+
   useEffect(() => {
     if (autoSubmitTriggeredRef.current) return;
     if (!hasRestoredRef.current) return;
@@ -183,12 +313,13 @@ export default function CreateSurvey() {
   });
 
   const addOption = () => {
-    setOptions([...options, { text: "", order: options.length }]);
+    const id = String(nextIdRef.current++);
+    setOptions(prev => [...prev, { id, text: "", order: prev.length }]);
   };
 
   const removeOption = (index: number) => {
     if (options.length > 2) {
-      setOptions(options.filter((_, i) => i !== index));
+      setOptions(options.filter((_, i) => i !== index).map((o, idx) => ({ ...o, order: idx })));
     }
   };
 
@@ -230,7 +361,10 @@ export default function CreateSurvey() {
     }
 
     const validOptions = options.filter(opt => opt.text.trim());
-    if (validOptions.length < 2) {
+    const validNormalOptions = validOptions.filter(opt => !opt.isFreeText);
+    const validFreeTextOptions = validOptions.filter(opt => opt.isFreeText);
+    // Need at least: 2 normal options, OR 1 free-text question (pure feedback form), OR 1 normal + 1 free-text
+    if (validOptions.length < 1 || (validFreeTextOptions.length === 0 && validNormalOptions.length < 2)) {
       toast({
         title: t('pollCreation.error'),
         description: t('createSurvey.minOptionsError'),
@@ -263,9 +397,10 @@ export default function CreateSurvey() {
       options: validOptions.map((option, index) => {
         const opt: any = {
           text: option.text.trim(),
+          isFreeText: option.isFreeText ?? false,
           order: index,
         };
-        if (option.imageUrl && option.imageUrl.trim()) {
+        if (!option.isFreeText && option.imageUrl && option.imageUrl.trim()) {
           opt.imageUrl = option.imageUrl.trim();
           if (option.altText && option.altText.trim()) {
             opt.altText = option.altText.trim();
@@ -400,64 +535,84 @@ export default function CreateSurvey() {
               );
             })()}
             
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.allowVoteEdit')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('pollCreation.allowVoteEditDescription')}
-                </p>
-              </div>
-              <Switch
-                checked={allowVoteEdit}
-                onCheckedChange={setAllowVoteEdit}
-                data-testid="switch-allow-vote-edit"
-                aria-label={t('pollCreation.allowVoteEdit')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.allowVoteWithdrawal')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('pollCreation.allowVoteWithdrawalDescription')}
-                </p>
-              </div>
-              <Switch
-                checked={allowVoteWithdrawal}
-                onCheckedChange={setAllowVoteWithdrawal}
-                data-testid="switch-allow-vote-withdrawal"
-                aria-label={t('pollCreation.allowVoteWithdrawal')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('pollCreation.resultsPublic')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('pollCreation.resultsPublicDescription')}
-                </p>
-              </div>
-              <Switch
-                checked={resultsPublic}
-                onCheckedChange={setResultsPublic}
-                data-testid="switch-results-public"
-                aria-label={t('pollCreation.resultsPublic')}
-              />
-            </div>
-            
-            <div className="flex items-center justify-between pt-4 border-t">
-              <div className="space-y-0.5">
-                <Label>{t('createSurvey.allowMaybe')}</Label>
-                <p className="text-sm text-muted-foreground">
-                  {t('createSurvey.allowMaybeDescription')}
-                </p>
-              </div>
-              <Switch
-                checked={allowMaybe}
-                onCheckedChange={setAllowMaybe}
-                data-testid="switch-allow-maybe"
-                aria-label={t('createSurvey.allowMaybe')}
-              />
+            <div className="pt-4 border-t">
+              <button
+                type="button"
+                onClick={() => setSettingsExpanded(p => !p)}
+                className="flex items-center justify-between w-full text-left"
+                aria-expanded={settingsExpanded}
+              >
+                <span className="text-sm font-medium text-muted-foreground">{t('pollCreation.settings')}</span>
+                <div className="flex items-center gap-2">
+                  {!settingsExpanded && (
+                    <div className="flex gap-1">
+                      {allowVoteEdit && <span className="text-[10px] px-1.5 py-0.5 rounded bg-muted text-muted-foreground">{t('pollCreation.allowVoteEdit')}</span>}
+                      {!resultsPublic && <span className="text-[10px] px-1.5 py-0.5 rounded bg-muted text-muted-foreground">{t('pollCreation.resultsPrivate')}</span>}
+                    </div>
+                  )}
+                  <ChevronDown className={`w-4 h-4 text-muted-foreground transition-transform duration-200 ${settingsExpanded ? "rotate-180" : ""}`} />
+                </div>
+              </button>
+              {settingsExpanded && (
+                <div className="space-y-4 mt-4">
+                  <div className="flex items-center justify-between">
+                    <div className="space-y-0.5">
+                      <Label>{t('pollCreation.allowVoteEdit')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('pollCreation.allowVoteEditDescription')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={allowVoteEdit}
+                      onCheckedChange={setAllowVoteEdit}
+                      data-testid="switch-allow-vote-edit"
+                      aria-label={t('pollCreation.allowVoteEdit')}
+                    />
+                  </div>
+                  <div className="flex items-center justify-between pt-4 border-t">
+                    <div className="space-y-0.5">
+                      <Label>{t('pollCreation.allowVoteWithdrawal')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('pollCreation.allowVoteWithdrawalDescription')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={allowVoteWithdrawal}
+                      onCheckedChange={setAllowVoteWithdrawal}
+                      data-testid="switch-allow-vote-withdrawal"
+                      aria-label={t('pollCreation.allowVoteWithdrawal')}
+                    />
+                  </div>
+                  <div className="flex items-center justify-between pt-4 border-t">
+                    <div className="space-y-0.5">
+                      <Label>{t('pollCreation.resultsPublic')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('pollCreation.resultsPublicDescription')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={resultsPublic}
+                      onCheckedChange={setResultsPublic}
+                      data-testid="switch-results-public"
+                      aria-label={t('pollCreation.resultsPublic')}
+                    />
+                  </div>
+                  <div className="flex items-center justify-between pt-4 border-t">
+                    <div className="space-y-0.5">
+                      <Label>{t('createSurvey.allowMaybe')}</Label>
+                      <p className="text-sm text-muted-foreground">
+                        {t('createSurvey.allowMaybeDescription')}
+                      </p>
+                    </div>
+                    <Switch
+                      checked={allowMaybe}
+                      onCheckedChange={setAllowMaybe}
+                      data-testid="switch-allow-maybe"
+                      aria-label={t('createSurvey.allowMaybe')}
+                    />
+                  </div>
+                </div>
+              )}
             </div>
           </CardContent>
         </Card>
@@ -486,46 +641,29 @@ export default function CreateSurvey() {
               <p className="text-sm text-muted-foreground">
                 {t('createSurvey.optionsHint')}
               </p>
-              
-              {options.map((option, index) => (
-                <div key={index} className="border rounded-lg p-4 space-y-3">
-                  <div className="flex items-center space-x-3">
-                    <div className="flex items-center justify-center w-8 h-8 rounded-full bg-muted">
-                      <span className="text-sm font-medium">{index + 1}</span>
-                    </div>
-                    <Input
-                      value={option.text}
-                      onChange={(e) => updateOption(index, e.target.value)}
-                      placeholder={t('createSurvey.optionPlaceholder', { number: index + 1 })}
-                      className="flex-1"
-                      data-testid={`input-option-${index}`}
-                    />
-                    {options.length > 2 && (
-                      <Button
-                        type="button"
-                        variant="ghost"
-                        size="sm"
-                        onClick={() => removeOption(index)}
-                        className="text-destructive hover:text-destructive"
-                        aria-label={t('createSurvey.removeOption')}
-                        data-testid={`button-delete-option-${index}`}
-                      >
-                        <Trash2 className="w-4 h-4" />
-                      </Button>
-                    )}
-                  </div>
-                  <div className="space-y-2">
-                    <span className="text-sm text-muted-foreground">{t('createSurvey.addImage')}</span>
-                    <ImageUpload
-                      onImageUploaded={(imageUrl) => updateOptionImage(index, imageUrl)}
+
+              <DndContext
+                sensors={sensors}
+                collisionDetection={closestCenter}
+                onDragEnd={handleDragEnd}
+              >
+                <SortableContext items={options.map(o => o.id)} strategy={verticalListSortingStrategy}>
+                  {options.map((option, index) => (
+                    <SortableSurveyRow
+                      key={option.id}
+                      option={option}
+                      index={index}
+                      options={options}
+                      onUpdate={(text) => updateOption(index, text)}
+                      onRemove={() => removeOption(index)}
+                      onImageUploaded={(url) => updateOptionImage(index, url)}
                       onImageRemoved={() => removeOptionImage(index)}
-                      onAltTextChange={(altText) => updateOptionAltText(index, altText)}
-                      currentImageUrl={option.imageUrl}
-                      currentAltText={option.altText}
+                      onAltTextChange={(alt) => updateOptionAltText(index, alt)}
+                      t={t}
                     />
-                  </div>
-                </div>
-              ))}
+                  ))}
+                </SortableContext>
+              </DndContext>
             </div>
             
             <div className="mt-6 p-4 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
diff --git a/client/src/pages/dashboard.tsx b/client/src/pages/dashboard.tsx
deleted file mode 100644
index a96840ad..00000000
--- a/client/src/pages/dashboard.tsx
+++ /dev/null
@@ -1,351 +0,0 @@
-import { useQuery } from "@tanstack/react-query";
-import { useTranslation } from 'react-i18next';
-import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
-import { Button } from "@/components/ui/button";
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
-import { Badge } from "@/components/ui/badge";
-import { Skeleton } from "@/components/ui/skeleton";
-import { Link } from "wouter";
-import { 
-  Plus, 
-  Calendar, 
-  Vote, 
-  Users, 
-  BarChart3, 
-  Clock, 
-  Share2, 
-  Edit,
-  Trash2,
-  TrendingUp,
-  Activity
-} from "lucide-react";
-import type { PollWithOptions } from "@shared/schema";
-
-// Mock user ID - in real app this would come from auth context
-const CURRENT_USER_ID = 1;
-
-interface DashboardData {
-  userPolls: PollWithOptions[];
-  sharedPolls: PollWithOptions[];
-}
-
-export default function Dashboard() {
-  const { t, i18n } = useTranslation();
-  const { data: dashboardData, isLoading } = useQuery<DashboardData>({
-    queryKey: [`/api/v1/users/${CURRENT_USER_ID}/dashboard`],
-  });
-
-  const { data: stats } = useQuery({
-    queryKey: [`/api/v1/admin/stats`],
-  });
-
-  if (isLoading) {
-    return (
-      <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
-        <div className="space-y-6">
-          <Skeleton className="h-8 w-1/3" />
-          <div className="grid grid-cols-1 md:grid-cols-4 gap-4">
-            {[...Array(4)].map((_, i) => (
-              <Skeleton key={i} className="h-24" />
-            ))}
-          </div>
-          <Skeleton className="h-96" />
-        </div>
-      </div>
-    );
-  }
-
-  const userPolls = dashboardData?.userPolls || [];
-  const sharedPolls = dashboardData?.sharedPolls || [];
-
-  const activePolls = userPolls.filter((poll: PollWithOptions) => 
-    poll.isActive && (!poll.expiresAt || new Date() < new Date(poll.expiresAt))
-  ).length;
-
-  const totalVotes = userPolls.reduce((sum: number, poll: PollWithOptions) => 
-    sum + poll.votes.length, 0
-  );
-
-  const thisWeekPolls = userPolls.filter((poll: PollWithOptions) => {
-    const weekAgo = new Date();
-    weekAgo.setDate(weekAgo.getDate() - 7);
-    return new Date(poll.createdAt) > weekAgo;
-  }).length;
-
-  return (
-    <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
-      {/* Header */}
-      <div className="mb-8">
-        <div className="flex items-center justify-between">
-          <div>
-            <h1 className="text-3xl font-bold text-foreground">{t('nav.dashboard')}</h1>
-            <p className="text-muted-foreground mt-2">
-              {t('dashboard.managePolls')}
-            </p>
-          </div>
-          <div className="flex space-x-3">
-            <Link href="/create-poll">
-              <Button className="polly-button-primary">
-                <Plus className="w-4 h-4 mr-2" />
-                {t('dashboard.schedule')}
-              </Button>
-            </Link>
-            <Link href="/create-survey">
-              <Button className="polly-button-secondary">
-                <Plus className="w-4 h-4 mr-2" />
-                {t('polls.survey')}
-              </Button>
-            </Link>
-          </div>
-        </div>
-      </div>
-
-      {/* Stats Cards */}
-      <div className="grid grid-cols-1 md:grid-cols-4 gap-4 mb-8">
-        <Card className="polly-gradient-orange text-white">
-          <CardContent className="p-4">
-            <div className="flex items-center justify-between">
-              <div>
-                <p className="text-orange-100 text-sm">{t('dashboard.activePolls')}</p>
-                <p className="text-2xl font-bold">{activePolls}</p>
-              </div>
-              <Activity className="w-8 h-8 text-orange-200" />
-            </div>
-          </CardContent>
-        </Card>
-        
-        <Card className="polly-gradient-blue text-white">
-          <CardContent className="p-4">
-            <div className="flex items-center justify-between">
-              <div>
-                <p className="text-blue-100 text-sm">{t('dashboard.totalPolls')}</p>
-                <p className="text-2xl font-bold">{userPolls.length}</p>
-              </div>
-              <BarChart3 className="w-8 h-8 text-blue-200" />
-            </div>
-          </CardContent>
-        </Card>
-        
-        <Card className="bg-gradient-to-r from-green-500 to-green-600 text-white">
-          <CardContent className="p-4">
-            <div className="flex items-center justify-between">
-              <div>
-                <p className="text-green-100 text-sm">{t('dashboard.participations')}</p>
-                <p className="text-2xl font-bold">{totalVotes}</p>
-              </div>
-              <Users className="w-8 h-8 text-green-200" />
-            </div>
-          </CardContent>
-        </Card>
-        
-        <Card className="bg-gradient-to-r from-purple-500 to-purple-600 text-white">
-          <CardContent className="p-4">
-            <div className="flex items-center justify-between">
-              <div>
-                <p className="text-purple-100 text-sm">{t('dashboard.thisWeek')}</p>
-                <p className="text-2xl font-bold">{thisWeekPolls}</p>
-              </div>
-              <TrendingUp className="w-8 h-8 text-purple-200" />
-            </div>
-          </CardContent>
-        </Card>
-      </div>
-
-      {/* Main Content */}
-      <Tabs defaultValue="my-polls" className="space-y-6">
-        <TabsList className="grid w-full grid-cols-3">
-          <TabsTrigger value="my-polls">
-            {t('nav.myPolls')} ({userPolls.length})
-          </TabsTrigger>
-          <TabsTrigger value="shared-polls">
-            {t('dashboard.sharedPolls')} ({sharedPolls.length})
-          </TabsTrigger>
-          <TabsTrigger value="archived">
-            {t('dashboard.archive')}
-          </TabsTrigger>
-        </TabsList>
-
-        <TabsContent value="my-polls" className="space-y-4">
-          {userPolls.length === 0 ? (
-            <Card className="polly-card">
-              <CardContent className="p-8 text-center">
-                <Vote className="w-12 h-12 text-muted-foreground mx-auto mb-4" />
-                <h3 className="text-lg font-semibold text-foreground mb-2">
-                  {t('polls.noPolls')}
-                </h3>
-                <p className="text-muted-foreground mb-6">
-                  {t('polls.noPollsDescription')}
-                </p>
-                <div className="flex flex-col sm:flex-row gap-3 justify-center">
-                  <Link href="/create-poll">
-                    <Button className="polly-button-primary">
-                      <Plus className="w-4 h-4 mr-2" />
-                      {t('dashboard.schedule')}
-                    </Button>
-                  </Link>
-                  <Link href="/create-survey">
-                    <Button className="polly-button-secondary">
-                      <Plus className="w-4 h-4 mr-2" />
-                      {t('polls.survey')}
-                    </Button>
-                  </Link>
-                </div>
-              </CardContent>
-            </Card>
-          ) : (
-            <div className="space-y-4">
-              {userPolls.map((poll: PollWithOptions) => (
-                <PollCard key={poll.id} poll={poll} isOwner={true} />
-              ))}
-            </div>
-          )}
-        </TabsContent>
-
-        <TabsContent value="shared-polls" className="space-y-4">
-          {sharedPolls.length === 0 ? (
-            <Card className="polly-card">
-              <CardContent className="p-8 text-center">
-                <Share2 className="w-12 h-12 text-muted-foreground mx-auto mb-4" />
-                <h3 className="text-lg font-semibold text-foreground mb-2">
-                  {t('dashboard.noSharedPolls')}
-                </h3>
-                <p className="text-muted-foreground">
-                  {t('dashboard.sharedPollsDescription')}
-                </p>
-              </CardContent>
-            </Card>
-          ) : (
-            <div className="space-y-4">
-              {sharedPolls.map((poll: PollWithOptions) => (
-                <PollCard key={poll.id} poll={poll} isOwner={false} />
-              ))}
-            </div>
-          )}
-        </TabsContent>
-
-        <TabsContent value="archived" className="space-y-4">
-          <Card className="polly-card">
-            <CardContent className="p-8 text-center">
-              <Clock className="w-12 h-12 text-muted-foreground mx-auto mb-4" />
-              <h3 className="text-lg font-semibold text-foreground mb-2">
-                {t('dashboard.archiveComingSoon')}
-              </h3>
-              <p className="text-muted-foreground">
-                {t('dashboard.archiveDescription')}
-              </p>
-            </CardContent>
-          </Card>
-        </TabsContent>
-      </Tabs>
-    </div>
-  );
-}
-
-interface PollCardProps {
-  poll: PollWithOptions;
-  isOwner: boolean;
-}
-
-function PollCard({ poll, isOwner }: PollCardProps) {
-  const isPollExpired = poll.expiresAt && new Date() > new Date(poll.expiresAt);
-  const uniqueVoters = new Set(
-    poll.votes.map(v => v.userId ? `user_${v.userId}` : `anon_${v.voterName}`)
-  ).size;
-
-  const { t, i18n } = useTranslation();
-  
-  const getStatusBadge = () => {
-    if (!poll.isActive) {
-      return <Badge variant="secondary">{t('polls.inactive')}</Badge>;
-    }
-    if (isPollExpired) {
-      return <Badge variant="secondary">{t('polls.expired')}</Badge>;
-    }
-    return <Badge className="bg-green-100 text-green-900">{t('polls.active')}</Badge>;
-  };
-
-  const getPollTypeInfo = () => {
-    if (poll.type === 'schedule') {
-      return {
-        icon: <Calendar className="w-4 h-4" />,
-        label: t('dashboard.schedule'),
-        color: 'bg-polly-orange text-white'
-      };
-    }
-    return {
-      icon: <Vote className="w-4 h-4" />,
-      label: t('polls.survey'),
-      color: 'bg-polly-blue text-white'
-    };
-  };
-
-  const typeInfo = getPollTypeInfo();
-
-  return (
-    <Card className="polly-card hover:shadow-md transition-shadow">
-      <CardContent className="p-6">
-        <div className="flex items-start justify-between">
-          <div className="flex-1">
-            <div className="flex items-center space-x-3 mb-2">
-              <Badge className={typeInfo.color}>
-                {typeInfo.icon}
-                <span className="ml-1">{typeInfo.label}</span>
-              </Badge>
-              {getStatusBadge()}
-            </div>
-            
-            <h3 className="text-lg font-semibold text-foreground mb-1">
-              {poll.title}
-            </h3>
-            
-            {poll.description && (
-              <p className="text-sm text-muted-foreground mb-3 line-clamp-2">
-                {poll.description}
-              </p>
-            )}
-            
-            <div className="flex items-center space-x-6 text-sm text-muted-foreground">
-              <span className="flex items-center">
-                <Users className="w-4 h-4 mr-1" />
-                {uniqueVoters} {t('dashboard.participants')}
-              </span>
-              <span className="flex items-center">
-                <Calendar className="w-4 h-4 mr-1" />
-                {t('dashboard.created')}: {new Date(poll.createdAt).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')}
-              </span>
-              {poll.expiresAt && (
-                <span className="flex items-center">
-                  <Clock className="w-4 h-4 mr-1" />
-                  {t('dashboard.expiresAt')}: {new Date(poll.expiresAt).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')}
-                </span>
-              )}
-            </div>
-          </div>
-          
-          <div className="flex items-center space-x-2 ml-4">
-            <Link href={`/poll/${poll.publicToken}`}>
-              <Button variant="ghost" size="sm" title={t('dashboard.showResults')}>
-                <BarChart3 className="w-4 h-4" />
-              </Button>
-            </Link>
-            <Button variant="ghost" size="sm" title={t('common.share')}>
-              <Share2 className="w-4 h-4" />
-            </Button>
-            {isOwner && (
-              <>
-                <Link href={`/admin/${poll.adminToken}`}>
-                  <Button variant="ghost" size="sm" title={t('common.edit')}>
-                    <Edit className="w-4 h-4" />
-                  </Button>
-                </Link>
-                <Button variant="ghost" size="sm" title={t('common.delete')} className="text-destructive hover:text-destructive">
-                  <Trash2 className="w-4 h-4" />
-                </Button>
-              </>
-            )}
-          </div>
-        </div>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/client/src/pages/home.tsx b/client/src/pages/home.tsx
index 008adbc5..55d1beae 100644
--- a/client/src/pages/home.tsx
+++ b/client/src/pages/home.tsx
@@ -3,6 +3,7 @@ import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
 import { Calendar, Vote, Clock, Share2, BarChart3, Shield, FileText, Users, CalendarCheck, Zap, ClipboardList } from "lucide-react";
 import { useTranslation } from 'react-i18next';
+import { AiChatWidget } from "@/components/ai/AiChatWidget";
 
 export default function Home() {
   const { t } = useTranslation();
@@ -22,7 +23,7 @@ export default function Home() {
           </p>
           
           {/* Main Action Buttons - Order matches title: abstimmen (Orange), planen (Green), organisieren (Teal) */}
-          <div className="flex flex-col sm:flex-row gap-6 justify-center items-center mb-16">
+          <div className="flex flex-col sm:flex-row gap-6 justify-center items-center mb-10">
             <Button asChild variant="feature" className="polly-button-schedule wcag-themed-bg text-white text-lg px-8 py-4 h-auto min-w-[200px] shadow-lg hover:shadow-xl transform hover:-translate-y-1 transition-all duration-200 [text-shadow:0_1px_2px_rgba(0,0,0,0.2)]" data-testid="button-create-poll">
               <Link href="/create-poll">
                 <Calendar className="w-5 h-5 mr-3" />
@@ -42,6 +43,11 @@ export default function Home() {
               </Link>
             </Button>
           </div>
+
+          {/* AI Chat Widget */}
+          <div className="mb-16 px-4">
+            <AiChatWidget />
+          </div>
         </div>
       </section>
 
diff --git a/client/src/pages/login.tsx b/client/src/pages/login.tsx
index 6b8386c2..a1f4063d 100644
--- a/client/src/pages/login.tsx
+++ b/client/src/pages/login.tsx
@@ -169,7 +169,7 @@ export default function Login() {
   const getRedirectUrl = () => {
     const searchParams = new URLSearchParams(window.location.search);
     const redirect = searchParams.get('redirect') || searchParams.get('returnTo');
-    return redirect ? decodeURIComponent(redirect) : '/meine-umfragen';
+    return redirect ? decodeURIComponent(redirect) : '/';
   };
 
   useEffect(() => {
@@ -276,7 +276,7 @@ export default function Login() {
             </div>
           )}
 
-          {authMethods.registrationEnabled ? (
+          {authMethods.showLoginForm !== false && authMethods.registrationEnabled ? (
             <Tabs defaultValue="login" className="w-full">
               <TabsList className="grid w-full grid-cols-2">
                 <TabsTrigger value="login" data-testid="tab-login">
@@ -298,7 +298,7 @@ export default function Login() {
                       type="text"
                       value={loginForm.usernameOrEmail}
                       onChange={(e) => setLoginForm({ ...loginForm, usernameOrEmail: e.target.value })}
-                      placeholder="max@example.de"
+                      placeholder={t('auth.placeholders.email')}
                       required
                       data-testid="input-login-email"
                     />
@@ -313,6 +313,7 @@ export default function Login() {
                         onChange={(e) => setLoginForm({ ...loginForm, password: e.target.value })}
                         placeholder="••••••••"
                         required
+                        autoComplete="off"
                         className="pr-10"
                         data-testid="input-login-password"
                       />
@@ -352,7 +353,7 @@ export default function Login() {
                       type="text"
                       value={registerForm.name}
                       onChange={(e) => setRegisterForm({ ...registerForm, name: e.target.value })}
-                      placeholder="Max Mustermann"
+                      placeholder={t('auth.placeholders.name')}
                       required
                       data-testid="input-register-name"
                     />
@@ -364,7 +365,7 @@ export default function Login() {
                       type="text"
                       value={registerForm.username}
                       onChange={(e) => setRegisterForm({ ...registerForm, username: e.target.value })}
-                      placeholder="max123"
+                      placeholder={t('auth.placeholders.username')}
                       required
                       minLength={3}
                       data-testid="input-register-username"
@@ -377,7 +378,7 @@ export default function Login() {
                       type="email"
                       value={registerForm.email}
                       onChange={(e) => setRegisterForm({ ...registerForm, email: e.target.value })}
-                      placeholder="max@example.de"
+                      placeholder={t('auth.placeholders.email')}
                       required
                       data-testid="input-register-email"
                       className={registerForm.email.length > 0 && !emailValid ? "border-red-500" : ""}
@@ -398,6 +399,7 @@ export default function Login() {
                         onChange={(e) => setRegisterForm({ ...registerForm, password: e.target.value })}
                         placeholder={t('auth.enterSecurePassword')}
                         required
+                        autoComplete="off"
                         className="pr-10"
                         data-testid="input-register-password"
                       />
@@ -422,6 +424,7 @@ export default function Login() {
                         onChange={(e) => setRegisterForm({ ...registerForm, confirmPassword: e.target.value })}
                         placeholder={t('auth.repeatPassword')}
                         required
+                        autoComplete="off"
                         className="pr-10"
                         data-testid="input-register-confirm"
                       />
@@ -454,7 +457,7 @@ export default function Login() {
                 </form>
               </TabsContent>
             </Tabs>
-          ) : (
+          ) : authMethods.showLoginForm !== false ? (
             <form onSubmit={handleLogin} className="space-y-4">
               <div className="space-y-2">
                 <Label htmlFor="login-username">{t('auth.usernameOrEmail')}</Label>
@@ -463,7 +466,7 @@ export default function Login() {
                   type="text"
                   value={loginForm.usernameOrEmail}
                   onChange={(e) => setLoginForm({ ...loginForm, usernameOrEmail: e.target.value })}
-                  placeholder="max@example.de"
+                  placeholder={t('auth.placeholders.email')}
                   required
                   data-testid="input-login-email"
                 />
@@ -478,6 +481,7 @@ export default function Login() {
                     onChange={(e) => setLoginForm({ ...loginForm, password: e.target.value })}
                     placeholder="••••••••"
                     required
+                    autoComplete="off"
                     className="pr-10"
                     data-testid="input-login-password"
                   />
@@ -506,18 +510,20 @@ export default function Login() {
                 </a>
               </div>
             </form>
-          )}
+          ) : null}
 
           {authMethods.keycloak && (
             <>
-              <div className="relative my-6">
-                <div className="absolute inset-0 flex items-center">
-                  <span className="w-full border-t" />
-                </div>
-                <div className="relative flex justify-center text-xs uppercase">
-                  <span className="bg-background px-2 text-muted-foreground">{t('common.or')}</span>
+              {authMethods.showLoginForm !== false && (
+                <div className="relative my-6">
+                  <div className="absolute inset-0 flex items-center">
+                    <span className="w-full border-t" />
+                  </div>
+                  <div className="relative flex justify-center text-xs uppercase">
+                    <span className="bg-background px-2 text-muted-foreground">{t('common.or')}</span>
+                  </div>
                 </div>
-              </div>
+              )}
 
               <Button
                 type="button"
@@ -527,7 +533,7 @@ export default function Login() {
                 data-testid="button-keycloak-login"
               >
                 <KeyRound className="h-4 w-4 mr-2" />
-                {t('auth.loginWithKeycloak')}
+                {authMethods.ssoButtonLabel || t('auth.loginWithKeycloak')}
               </Button>
             </>
           )}
diff --git a/client/src/pages/my-polls.tsx b/client/src/pages/my-polls.tsx
index cc41ab52..a9baeccb 100644
--- a/client/src/pages/my-polls.tsx
+++ b/client/src/pages/my-polls.tsx
@@ -8,10 +8,27 @@ import { Button } from '@/components/ui/button';
 import { PollTypeBadge } from '@/components/ui/PollTypeBadge';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { Skeleton } from '@/components/ui/skeleton';
-import { ClipboardList, Users, Calendar, BarChart3, Plus, ExternalLink, Clock, CheckCircle, Shield, ListChecks, Copy, Check, RefreshCw, Info, ChevronDown } from 'lucide-react';
-import { apiRequest } from '@/lib/queryClient';
+import { ClipboardList, Users, Calendar, BarChart3, Plus, ExternalLink, Clock, CheckCircle, Shield, ListChecks, Copy, Check, RefreshCw, Info, ChevronDown, Activity, TrendingUp, Archive, Share2, Edit, Trash2 } from 'lucide-react';
+import { apiRequest, queryClient } from '@/lib/queryClient';
 import { useToast } from '@/hooks/use-toast';
 import { useState } from 'react';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+} from "@/components/ui/alert-dialog";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipProvider,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
 import {
   Collapsible,
   CollapsibleContent,
@@ -44,14 +61,52 @@ interface ExtendedStats {
 function PollCard({ poll, showAdminLink = false }: { poll: PollWithOptions; showAdminLink?: boolean }) {
   const { t } = useTranslation();
   const [, navigate] = useLocation();
+  const { toast } = useToast();
+  const [deleteDialogOpen, setDeleteDialogOpen] = useState(false);
   const isActive = poll.isActive && (!poll.expiresAt || new Date(poll.expiresAt) > new Date());
   const voteCount = poll.votes?.length || 0;
   const optionCount = poll.options?.length || 0;
 
+  const deleteMutation = useMutation({
+    mutationFn: () => apiRequest('DELETE', `/api/v1/polls/admin/${poll.adminToken}`),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/user/polls'] });
+      queryClient.invalidateQueries({ queryKey: ['/api/v1/user/participations'] });
+      toast({
+        title: t('myPolls.pollDeleted'),
+        description: t('myPolls.pollDeletedDesc'),
+      });
+    },
+    onError: () => {
+      toast({
+        title: t('myPolls.toasts.error'),
+        description: t('myPolls.pollDeleteError'),
+        variant: 'destructive',
+      });
+    },
+  });
+
+  const handleShare = (e: React.MouseEvent) => {
+    e.stopPropagation();
+    const shareUrl = `${window.location.origin}/poll/${poll.publicToken}`;
+    navigator.clipboard.writeText(shareUrl).then(() => {
+      toast({
+        title: t('myPolls.toasts.copied'),
+        description: t('myPolls.shareLinkCopied'),
+      });
+    }).catch(() => {
+      toast({
+        title: t('myPolls.toasts.error'),
+        description: t('myPolls.toasts.linkNotCopied'),
+        variant: 'destructive',
+      });
+    });
+  };
+
   return (
     <Card 
       className="hover:shadow-md transition-shadow cursor-pointer"
-      onClick={() => navigate(showAdminLink ? `/admin/${poll.adminToken}` : `/poll/${poll.publicToken}`)}
+      onClick={() => navigate(`/poll/${poll.publicToken}`)}
       data-testid={`poll-card-${poll.id}`}
     >
       <CardHeader className="pb-2">
@@ -97,6 +152,92 @@ function PollCard({ poll, showAdminLink = false }: { poll: PollWithOptions; show
             {t('myPolls.expiresAt')}: {format(new Date(poll.expiresAt), 'dd. MMM yyyy, HH:mm', { locale: getDateLocale() })}
           </div>
         )}
+        <div className="flex items-center gap-1 mt-3 pt-3 border-t" onClick={(e) => e.stopPropagation()}>
+          <TooltipProvider>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  variant="ghost"
+                  size="sm"
+                  onClick={(e) => { e.stopPropagation(); navigate(`/poll/${poll.publicToken}`); }}
+                  data-testid={`poll-action-stats-${poll.id}`}
+                >
+                  <BarChart3 className="h-4 w-4" />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>{t('myPolls.showResults')}</TooltipContent>
+            </Tooltip>
+
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  variant="ghost"
+                  size="sm"
+                  onClick={handleShare}
+                  data-testid={`poll-action-share-${poll.id}`}
+                >
+                  <Share2 className="h-4 w-4" />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>{t('common.share')}</TooltipContent>
+            </Tooltip>
+
+            {showAdminLink && (
+              <>
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      onClick={(e) => { e.stopPropagation(); navigate(`/admin/${poll.adminToken}`); }}
+                      data-testid={`poll-action-edit-${poll.id}`}
+                    >
+                      <Edit className="h-4 w-4" />
+                    </Button>
+                  </TooltipTrigger>
+                  <TooltipContent>{t('common.edit')}</TooltipContent>
+                </Tooltip>
+
+                <AlertDialog open={deleteDialogOpen} onOpenChange={setDeleteDialogOpen}>
+                  <Tooltip>
+                    <TooltipTrigger asChild>
+                      <AlertDialogTrigger asChild>
+                        <Button
+                          variant="ghost"
+                          size="sm"
+                          className="text-destructive hover:text-destructive"
+                          onClick={(e) => e.stopPropagation()}
+                          data-testid={`poll-action-delete-${poll.id}`}
+                        >
+                          <Trash2 className="h-4 w-4" />
+                        </Button>
+                      </AlertDialogTrigger>
+                    </TooltipTrigger>
+                    <TooltipContent>{t('common.delete')}</TooltipContent>
+                  </Tooltip>
+                  <AlertDialogContent onClick={(e) => e.stopPropagation()}>
+                    <AlertDialogHeader>
+                      <AlertDialogTitle>{t('myPolls.deleteConfirmTitle')}</AlertDialogTitle>
+                      <AlertDialogDescription>
+                        {t('myPolls.deleteConfirmDesc', { title: poll.title })}
+                      </AlertDialogDescription>
+                    </AlertDialogHeader>
+                    <AlertDialogFooter>
+                      <AlertDialogCancel>{t('common.cancel')}</AlertDialogCancel>
+                      <AlertDialogAction
+                        className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+                        onClick={() => deleteMutation.mutate()}
+                        disabled={deleteMutation.isPending}
+                      >
+                        {deleteMutation.isPending ? t('common.loading') : t('common.delete')}
+                      </AlertDialogAction>
+                    </AlertDialogFooter>
+                  </AlertDialogContent>
+                </AlertDialog>
+              </>
+            )}
+          </TooltipProvider>
+        </div>
       </CardContent>
     </Card>
   );
@@ -404,71 +545,170 @@ export default function MyPolls() {
         </div>
       </div>
 
-      <CalendarSubscriptionCard enabled={queriesEnabled} />
+      <div className="grid grid-cols-1 md:grid-cols-4 gap-4 mb-6">
+        <Card className="polly-gradient-orange text-white">
+          <CardContent className="p-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <p className="text-orange-100 text-sm">{t('myPolls.statsActivePolls')}</p>
+                <p className="text-2xl font-bold">
+                  {createdLoading ? '–' : (createdPolls?.filter(p => p.isActive && (!p.expiresAt || new Date(p.expiresAt) > new Date())).length || 0)}
+                </p>
+              </div>
+              <Activity className="w-8 h-8 text-orange-200" />
+            </div>
+          </CardContent>
+        </Card>
 
-      <Tabs defaultValue="created" className="w-full">
-        <TabsList className={`grid w-full ${isAdmin ? 'grid-cols-3' : 'grid-cols-2'} mb-6`}>
-          <TabsTrigger value="created" data-testid="tab-created">
-            <ClipboardList className="h-4 w-4 mr-2" />
-            {t('myPolls.tabCreated')}
-            {createdPolls && createdPolls.length > 0 && (
-              <Badge variant="secondary" className="ml-2">{createdPolls.length}</Badge>
-            )}
-          </TabsTrigger>
-          <TabsTrigger value="participated" data-testid="tab-participated">
-            <Users className="h-4 w-4 mr-2" />
-            {t('myPolls.tabParticipated')}
-            {participatedPolls && participatedPolls.length > 0 && (
-              <Badge variant="secondary" className="ml-2">{participatedPolls.length}</Badge>
-            )}
-          </TabsTrigger>
-          {isAdmin && (
-            <TabsTrigger value="admin" data-testid="tab-admin">
-              <Shield className="h-4 w-4 mr-2" />
-              {t('myPolls.tabAdmin')}
-            </TabsTrigger>
-          )}
-        </TabsList>
-
-        <TabsContent value="created">
-          {createdLoading ? (
-            <PollListSkeleton />
-          ) : createdPolls && createdPolls.length > 0 ? (
-            <div className="space-y-4">
-              {createdPolls.map((poll) => (
-                <PollCard key={poll.id} poll={poll} showAdminLink />
-              ))}
+        <Card className="polly-gradient-blue text-white">
+          <CardContent className="p-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <p className="text-blue-100 text-sm">{t('myPolls.statsTotalPolls')}</p>
+                <p className="text-2xl font-bold">
+                  {createdLoading ? '–' : (createdPolls?.length || 0)}
+                </p>
+              </div>
+              <BarChart3 className="w-8 h-8 text-blue-200" />
             </div>
-          ) : (
-            <EmptyState type="created" />
-          )}
-        </TabsContent>
-
-        <TabsContent value="participated">
-          {participatedLoading ? (
-            <PollListSkeleton />
-          ) : participatedPolls && participatedPolls.length > 0 ? (
-            <div className="space-y-4">
-              {participatedPolls.map((poll) => (
-                <PollCard key={poll.id} poll={poll} />
-              ))}
+          </CardContent>
+        </Card>
+
+        <Card className="bg-gradient-to-r from-green-500 to-green-600 text-white">
+          <CardContent className="p-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <p className="text-green-100 text-sm">{t('myPolls.statsParticipations')}</p>
+                <p className="text-2xl font-bold">
+                  {createdLoading ? '–' : (createdPolls?.reduce((sum, p) => sum + (p.votes?.length || 0), 0) || 0)}
+                </p>
+              </div>
+              <Users className="w-8 h-8 text-green-200" />
             </div>
-          ) : (
-            <EmptyState type="participated" />
-          )}
-        </TabsContent>
-
-        {isAdmin && (
-          <TabsContent value="admin" className="mt-0">
-            <AdminDashboard 
-              stats={adminStats}
-              users={adminUsers}
-              polls={adminPolls}
-              settings={adminSettings}
-              userRole="admin"
-            />
-          </TabsContent>
-        )}
+          </CardContent>
+        </Card>
+
+        <Card className="bg-gradient-to-r from-purple-500 to-purple-600 text-white">
+          <CardContent className="p-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <p className="text-purple-100 text-sm">{t('myPolls.statsThisWeek')}</p>
+                <p className="text-2xl font-bold">
+                  {createdLoading ? '–' : (createdPolls?.filter(p => {
+                    const weekAgo = new Date();
+                    weekAgo.setDate(weekAgo.getDate() - 7);
+                    return new Date(p.createdAt) > weekAgo;
+                  }).length || 0)}
+                </p>
+              </div>
+              <TrendingUp className="w-8 h-8 text-purple-200" />
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+
+      <CalendarSubscriptionCard enabled={queriesEnabled} />
+
+      <Tabs defaultValue="created" className="w-full">
+        {(() => {
+          const now = new Date();
+          const activePolls = createdPolls?.filter(p => p.isActive && (!p.expiresAt || new Date(p.expiresAt) > now)) || [];
+          const archivedPolls = createdPolls?.filter(p => !p.isActive || (p.expiresAt && new Date(p.expiresAt) <= now)) || [];
+          return (
+            <>
+              <TabsList className={`grid w-full ${isAdmin ? 'grid-cols-4' : 'grid-cols-3'} mb-6`}>
+                <TabsTrigger value="created" data-testid="tab-created">
+                  <ClipboardList className="h-4 w-4 mr-2" />
+                  {t('myPolls.tabCreated')}
+                  {activePolls.length > 0 && (
+                    <Badge variant="secondary" className="ml-2">{activePolls.length}</Badge>
+                  )}
+                </TabsTrigger>
+                <TabsTrigger value="participated" data-testid="tab-participated">
+                  <Users className="h-4 w-4 mr-2" />
+                  {t('myPolls.tabParticipated')}
+                  {participatedPolls && participatedPolls.length > 0 && (
+                    <Badge variant="secondary" className="ml-2">{participatedPolls.length}</Badge>
+                  )}
+                </TabsTrigger>
+                <TabsTrigger value="archive" data-testid="tab-archive">
+                  <Archive className="h-4 w-4 mr-2" />
+                  {t('myPolls.tabArchive')}
+                  {archivedPolls.length > 0 && (
+                    <Badge variant="secondary" className="ml-2">{archivedPolls.length}</Badge>
+                  )}
+                </TabsTrigger>
+                {isAdmin && (
+                  <TabsTrigger value="admin" data-testid="tab-admin">
+                    <Shield className="h-4 w-4 mr-2" />
+                    {t('myPolls.tabAdmin')}
+                  </TabsTrigger>
+                )}
+              </TabsList>
+
+              <TabsContent value="created">
+                {createdLoading ? (
+                  <PollListSkeleton />
+                ) : activePolls.length > 0 ? (
+                  <div className="space-y-4">
+                    {activePolls.map((poll) => (
+                      <PollCard key={poll.id} poll={poll} showAdminLink />
+                    ))}
+                  </div>
+                ) : (
+                  <EmptyState type="created" />
+                )}
+              </TabsContent>
+
+              <TabsContent value="participated">
+                {participatedLoading ? (
+                  <PollListSkeleton />
+                ) : participatedPolls && participatedPolls.length > 0 ? (
+                  <div className="space-y-4">
+                    {participatedPolls.map((poll) => (
+                      <PollCard key={poll.id} poll={poll} />
+                    ))}
+                  </div>
+                ) : (
+                  <EmptyState type="participated" />
+                )}
+              </TabsContent>
+
+              <TabsContent value="archive">
+                {createdLoading ? (
+                  <PollListSkeleton />
+                ) : archivedPolls.length > 0 ? (
+                  <div className="space-y-4">
+                    <p className="text-sm text-muted-foreground mb-2">{t('myPolls.archiveDescription')}</p>
+                    {archivedPolls.map((poll) => (
+                      <PollCard key={poll.id} poll={poll} showAdminLink />
+                    ))}
+                  </div>
+                ) : (
+                  <Card className="border-dashed">
+                    <CardContent className="flex flex-col items-center justify-center py-12 text-center">
+                      <Archive className="h-12 w-12 text-muted-foreground mb-4" />
+                      <CardTitle className="text-lg mb-2">{t('myPolls.noArchivedPolls')}</CardTitle>
+                      <CardDescription>{t('myPolls.archiveDescription')}</CardDescription>
+                    </CardContent>
+                  </Card>
+                )}
+              </TabsContent>
+
+              {isAdmin && (
+                <TabsContent value="admin" className="mt-0">
+                  <AdminDashboard 
+                    stats={adminStats}
+                    users={adminUsers}
+                    polls={adminPolls}
+                    settings={adminSettings}
+                    userRole="admin"
+                  />
+                </TabsContent>
+              )}
+            </>
+          );
+        })()}
       </Tabs>
     </div>
   );
diff --git a/client/src/pages/not-found.tsx b/client/src/pages/not-found.tsx
index 74e4065b..fbb0fd20 100644
--- a/client/src/pages/not-found.tsx
+++ b/client/src/pages/not-found.tsx
@@ -20,11 +20,11 @@ export default function NotFound() {
             
             <h1 className="text-6xl font-bold text-foreground mb-2">404</h1>
             <h2 className="text-xl font-semibold text-foreground mb-4">
-              {t('notFound.title', 'Seite nicht gefunden')}
+              {t('notFound.title')}
             </h2>
 
             <p className="text-muted-foreground mb-8 max-w-sm mx-auto">
-              {t('notFound.description', 'Die gesuchte Seite existiert nicht oder wurde verschoben.')}
+              {t('notFound.description')}
             </p>
 
             <div className="flex flex-col sm:flex-row gap-3 justify-center">
@@ -35,12 +35,12 @@ export default function NotFound() {
                 data-testid="button-go-back"
               >
                 <ArrowLeft className="h-4 w-4" />
-                {t('notFound.goBack', 'Zurück')}
+                {t('notFound.goBack')}
               </Button>
               <Button asChild className="gap-2 polly-button-primary w-full sm:w-auto" data-testid="button-go-home">
                 <Link href="/">
                   <Home className="h-4 w-4" />
-                  {t('notFound.goHome', 'Zur Startseite')}
+                  {t('notFound.goHome')}
                 </Link>
               </Button>
             </div>
diff --git a/client/src/pages/poll.tsx b/client/src/pages/poll.tsx
index d8a76f66..29ff7ce9 100644
--- a/client/src/pages/poll.tsx
+++ b/client/src/pages/poll.tsx
@@ -2,6 +2,7 @@ import { useParams, useLocation, Link } from "wouter";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { useEffect, useState } from "react";
 import { useTranslation, Trans } from 'react-i18next';
+import i18n from 'i18next';
 import { VotingInterface } from "@/components/VotingInterface";
 import { ResultsChart } from "@/components/ResultsChart";
 import { LiveResultsView } from "@/components/LiveResultsView";
@@ -97,6 +98,21 @@ const extractTimeFromISO = (isoStr: string | null | undefined): string => {
   return `${hours}:${minutes}`;
 };
 
+const addMinutesToTime = (time: string, minutes: number): string => {
+  const [h, m] = time.split(':').map(Number);
+  const totalMinutes = Math.min(h * 60 + m + minutes, 23 * 60 + 59);
+  const newH = Math.floor(totalMinutes / 60);
+  const newM = totalMinutes % 60;
+  return `${newH.toString().padStart(2, '0')}:${newM.toString().padStart(2, '0')}`;
+};
+
+const ensureEndTimeAfterStart = (startTime: string, endTime: string): string => {
+  if (startTime >= endTime) {
+    return addMinutesToTime(startTime, 30);
+  }
+  return endTime;
+};
+
 const combineDateAndTime = (date: Date | null, time: string): string | undefined => {
   if (!date) return undefined;
   const dateOnly = date.toDateString();
@@ -108,7 +124,7 @@ const generateOptionText = (startTime: string | undefined, endTime: string | und
   const startDate = new Date(startTime);
   const endDate = new Date(endTime);
   if (isNaN(startDate.getTime()) || isNaN(endDate.getTime())) return '';
-  const dateStr = startDate.toLocaleDateString('de-DE');
+  const dateStr = startDate.toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US');
   const startTimeStr = extractTimeFromISO(startTime);
   const endTimeStr = extractTimeFromISO(endTime);
   return `${dateStr} ${startTimeStr} - ${endTimeStr}`;
@@ -127,7 +143,7 @@ export default function Poll() {
   const [activeTab, setActiveTab] = useState("vote");
   const { toast } = useToast();
   const queryClient = useQueryClient();
-  const { isAuthenticated } = useAuth();
+  const { isAuthenticated, user } = useAuth();
   const [authError, setAuthError] = useState<{ type: 'unauthorized' | 'forbidden'; message: string } | null>(null);
   
   const [editDialogOpen, setEditDialogOpen] = useState(false);
@@ -193,13 +209,16 @@ export default function Poll() {
     queryKey: [endpoint],
     enabled: !!token,
     retry: (failureCount, error: any) => {
-      // Don't retry on auth errors
       if (error?.status === 401 || error?.status === 403) {
         return false;
       }
       return failureCount < 3;
     },
   });
+
+  const isOwner = !!(user && poll?.userId === user.id);
+  const isEffectiveAdmin = isAdminAccess || isOwner;
+  const effectiveAdminToken = isAdminAccess ? token : (isOwner ? poll?.adminToken : undefined);
   
   // Handle auth errors from query
   useEffect(() => {
@@ -264,8 +283,9 @@ export default function Poll() {
   }, [poll, editDialogOpen]);
   
   const updatePollMutation = useMutation({
-    mutationFn: async (updates: { title?: string; description?: string; isActive?: boolean; resultsPublic?: boolean; allowVoteEdit?: boolean; allowVoteWithdrawal?: boolean; allowMaybe?: boolean; allowMultipleSlots?: boolean }) => {
-      const response = await apiRequest("PATCH", `/api/v1/polls/admin/${token}`, updates);
+    mutationFn: async (updates: { title?: string; description?: string; isActive?: boolean; resultsPublic?: boolean; allowVoteEdit?: boolean; allowVoteWithdrawal?: boolean; allowMaybe?: boolean; allowMultipleSlots?: boolean; notifyParticipants?: boolean }) => {
+      if (!effectiveAdminToken) throw new Error('No admin token');
+      const response = await apiRequest("PATCH", `/api/v1/polls/admin/${effectiveAdminToken}`, updates);
       return response.json();
     },
     onSuccess: () => {
@@ -281,7 +301,8 @@ export default function Poll() {
 
   const addOptionMutation = useMutation({
     mutationFn: async (option: { text: string; startTime?: string; endTime?: string; maxCapacity?: number }) => {
-      const response = await apiRequest("POST", `/api/v1/polls/admin/${token}/options`, option);
+      if (!effectiveAdminToken) throw new Error('No admin token');
+      const response = await apiRequest("POST", `/api/v1/polls/admin/${effectiveAdminToken}/options`, option);
       return response.json();
     },
     onSuccess: () => {
@@ -291,7 +312,8 @@ export default function Poll() {
 
   const updateOptionMutation = useMutation({
     mutationFn: async ({ optionId, updates }: { optionId: number; updates: Record<string, any> }) => {
-      const response = await apiRequest("PATCH", `/api/v1/polls/admin/${token}/options/${optionId}`, updates);
+      if (!effectiveAdminToken) throw new Error('No admin token');
+      const response = await apiRequest("PATCH", `/api/v1/polls/admin/${effectiveAdminToken}/options/${optionId}`, updates);
       return response.json();
     },
     onSuccess: () => {
@@ -301,7 +323,8 @@ export default function Poll() {
 
   const deleteOptionMutation = useMutation({
     mutationFn: async (optionId: number) => {
-      const response = await apiRequest("DELETE", `/api/v1/polls/admin/${token}/options/${optionId}`);
+      if (!effectiveAdminToken) throw new Error('No admin token');
+      const response = await apiRequest("DELETE", `/api/v1/polls/admin/${effectiveAdminToken}/options/${optionId}`);
       return response.json();
     },
     onSuccess: () => {
@@ -642,7 +665,7 @@ export default function Poll() {
             )}
           </div>
           
-          {isAdminAccess && (
+          {isEffectiveAdmin && (
             <div className="flex space-x-2 ml-4">
               <Button variant="outline" size="sm" onClick={() => setEditDialogOpen(true)} data-testid="button-edit-poll">
                 <Settings className="w-4 h-4 mr-2" />
@@ -670,12 +693,12 @@ export default function Poll() {
           )}
           <span className="flex items-center">
             <Clock className="w-4 h-4 mr-1" />
-            {t('pollView.created')}: {new Date(poll.createdAt).toLocaleDateString('de-DE')}
+            {t('pollView.created')}: {new Date(poll.createdAt).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')}
           </span>
           {poll.expiresAt && (
             <span className="flex items-center">
               <Calendar className="w-4 h-4 mr-1" />
-              {t('pollView.expiresAt')}: {new Date(poll.expiresAt).toLocaleDateString('de-DE')}
+              {t('pollView.expiresAt')}: {new Date(poll.expiresAt).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US')}
             </span>
           )}
           {results && (
@@ -700,14 +723,14 @@ export default function Poll() {
         </TabsList>
 
         <TabsContent value="vote" className="space-y-6">
-          <VotingInterface poll={poll} isAdminAccess={isAdminAccess} />
+          <VotingInterface poll={poll} isAdminAccess={isEffectiveAdmin} />
         </TabsContent>
 
         <TabsContent value="live" className="space-y-6">
           <LiveResultsView 
             poll={poll} 
             publicToken={poll.publicToken}
-            isAdminAccess={isAdminAccess}
+            isAdminAccess={isEffectiveAdmin}
           />
         </TabsContent>
 
@@ -732,10 +755,16 @@ export default function Poll() {
             <ResultsChart 
               results={results} 
               publicToken={poll.publicToken}
-              isAdminAccess={isAdminAccess}
-              onCapacityUpdate={isAdminAccess ? async (optionId, newCapacity) => {
+              adminToken={isEffectiveAdmin ? poll.adminToken : undefined}
+              isAdminAccess={isEffectiveAdmin}
+              isOwner={isOwner}
+              onCapacityUpdate={isEffectiveAdmin ? async (optionId, newCapacity) => {
                 await updateOptionMutation.mutateAsync({ optionId, updates: { maxCapacity: newCapacity === null ? null : newCapacity } });
               } : undefined}
+              onFinalize={() => {
+                queryClient.invalidateQueries({ queryKey: [endpoint] });
+                queryClient.invalidateQueries({ queryKey: [`/api/v1/polls/${token}/results`] });
+              }}
             />
           ) : (
             <Card>
@@ -848,11 +877,33 @@ export default function Poll() {
                   <Download className="w-4 h-4 mr-2" />
                   {t('pollView.exportPdf')}
                 </Button>
-                {poll.type === 'schedule' && (
+                {poll.type === 'schedule' && poll.finalOptionId != null && poll.finalOptionId > 0 && (
                   <Button 
                     variant="outline" 
                     className="w-full justify-start"
-                    onClick={() => window.open(`/api/v1/polls/${poll.publicToken}/export/ics`, '_blank')}
+                    onClick={async () => {
+                      try {
+                        const response = await fetch(`/api/v1/polls/${poll.publicToken}/export/ics?lang=${i18n.language}`);
+                        if (!response.ok) {
+                          const data = await response.json().catch(() => null);
+                          toast({ title: t('pollView.toasts.error'), description: data?.error || t('results.icsExportError'), variant: "destructive" });
+                          return;
+                        }
+                        const blob = await response.blob();
+                        const url = URL.createObjectURL(blob);
+                        const a = document.createElement('a');
+                        a.href = url;
+                        const disposition = response.headers.get('Content-Disposition');
+                        const match = disposition?.match(/filename="?([^"]+)"?/);
+                        a.download = match?.[1] || 'poll.ics';
+                        document.body.appendChild(a);
+                        a.click();
+                        document.body.removeChild(a);
+                        URL.revokeObjectURL(url);
+                      } catch {
+                        toast({ title: t('pollView.toasts.error'), description: t('results.icsExportError'), variant: "destructive" });
+                      }
+                    }}
                     data-testid="button-export-ics"
                   >
                     <Calendar className="w-4 h-4 mr-2" />
@@ -863,7 +914,7 @@ export default function Poll() {
             </Card>
 
             {/* Admin Tools - only visible for poll owner or admin access */}
-            {isAdminAccess && (
+            {isEffectiveAdmin && (
               <Card className="polly-card md:col-span-2">
                 <CardHeader>
                   <CardTitle className="flex items-center">
@@ -943,7 +994,7 @@ export default function Poll() {
                     )}
                   </div>
                   <p className="text-xs text-muted-foreground">
-                    {t('pollView.adminLink')}: <code className="bg-muted px-1 py-0.5 rounded text-xs">{window.location.origin}/poll/{poll.adminToken}</code>
+                    {t('pollView.adminLink')}: <code className="bg-muted px-1 py-0.5 rounded text-xs">{window.location.origin}/admin/{poll.adminToken}</code>
                   </p>
                 </CardContent>
               </Card>
@@ -1134,7 +1185,8 @@ export default function Poll() {
                               date={extractDateFromISO(newOptionForm.startTime)}
                               onDateChange={(date) => {
                                 const currentStartTime = extractTimeFromISO(newOptionForm.startTime) || '09:00';
-                                const currentEndTime = extractTimeFromISO(newOptionForm.endTime) || '10:00';
+                                const rawEndTime = extractTimeFromISO(newOptionForm.endTime) || '09:30';
+                                const currentEndTime = ensureEndTimeAfterStart(currentStartTime, rawEndTime);
                                 const newStartTime = date ? combineDateAndTime(date, currentStartTime) : '';
                                 const newEndTime = date ? combineDateAndTime(date, currentEndTime) : '';
                                 const newText = isAutoGeneratedText(newOptionForm.text) || !newOptionForm.text
@@ -1155,10 +1207,14 @@ export default function Poll() {
                                 onChange={(time) => {
                                   const currentDate = extractDateFromISO(newOptionForm.startTime);
                                   const newStartTime = currentDate ? combineDateAndTime(currentDate, time) : '';
+                                  const currentEndTime = extractTimeFromISO(newOptionForm.endTime) || '09:30';
+                                  const adjustedEndTime = ensureEndTimeAfterStart(time, currentEndTime);
+                                  const endDate = extractDateFromISO(newOptionForm.endTime) || currentDate;
+                                  const newEndTime = endDate ? combineDateAndTime(endDate, adjustedEndTime) : '';
                                   const newText = isAutoGeneratedText(newOptionForm.text) || !newOptionForm.text
-                                    ? generateOptionText(newStartTime, newOptionForm.endTime)
+                                    ? generateOptionText(newStartTime, newEndTime)
                                     : newOptionForm.text;
-                                  setNewOptionForm({ ...newOptionForm, startTime: newStartTime || '', text: newText });
+                                  setNewOptionForm({ ...newOptionForm, startTime: newStartTime || '', endTime: newEndTime || '', text: newText });
                                 }}
                                 data-testid="new-option-start"
                               />
@@ -1166,7 +1222,7 @@ export default function Poll() {
                             <div>
                               <Label className="text-xs text-muted-foreground">{t('pollView.end')}</Label>
                               <TimePickerDropdown
-                                value={extractTimeFromISO(newOptionForm.endTime) || '10:00'}
+                                value={extractTimeFromISO(newOptionForm.endTime) || '09:30'}
                                 onChange={(time) => {
                                   const currentDate = extractDateFromISO(newOptionForm.endTime);
                                   const newEndTime = currentDate ? combineDateAndTime(currentDate, time) : '';
@@ -1271,7 +1327,8 @@ export default function Poll() {
                                           onDateChange={(date) => {
                                             const updated = [...editingOptions];
                                             const currentStartTime = extractTimeFromISO(option.startTime) || '09:00';
-                                            const currentEndTime = extractTimeFromISO(option.endTime) || '17:00';
+                                            const rawEndTime = extractTimeFromISO(option.endTime) || '09:30';
+                                            const currentEndTime = ensureEndTimeAfterStart(currentStartTime, rawEndTime);
                                             const newStartTime = date ? combineDateAndTime(date, currentStartTime) : '';
                                             const newEndTime = date ? combineDateAndTime(date, currentEndTime) : '';
                                             const newText = isAutoGeneratedText(option.text) 
@@ -1299,12 +1356,17 @@ export default function Poll() {
                                               const updated = [...editingOptions];
                                               const currentDate = extractDateFromISO(option.startTime);
                                               const newStartTime = currentDate ? combineDateAndTime(currentDate, time) : '';
+                                              const currentEndTime = extractTimeFromISO(option.endTime) || '09:30';
+                                              const adjustedEndTime = ensureEndTimeAfterStart(time, currentEndTime);
+                                              const endDate = extractDateFromISO(option.endTime) || currentDate;
+                                              const newEndTime = endDate ? combineDateAndTime(endDate, adjustedEndTime) : '';
                                               const newText = isAutoGeneratedText(option.text) 
-                                                ? generateOptionText(newStartTime, option.endTime) 
+                                                ? generateOptionText(newStartTime, newEndTime) 
                                                 : option.text;
                                               updated[index] = { 
                                                 ...updated[index], 
                                                 startTime: newStartTime,
+                                                endTime: newEndTime,
                                                 text: newText
                                               };
                                               setEditingOptions(updated);
@@ -1315,7 +1377,7 @@ export default function Poll() {
                                         <div>
                                           <Label className="text-xs text-muted-foreground">{t('pollView.end')}</Label>
                                           <TimePickerDropdown
-                                            value={extractTimeFromISO(option.endTime) || '17:00'}
+                                            value={extractTimeFromISO(option.endTime) || '09:30'}
                                             onChange={(time) => {
                                               const updated = [...editingOptions];
                                               const currentDate = extractDateFromISO(option.endTime);
@@ -1519,7 +1581,7 @@ export default function Poll() {
                     id="invite-emails"
                     value={inviteEmails}
                     onChange={(e) => setInviteEmails(e.target.value)}
-                    placeholder="max@example.de, anna@example.de"
+                    placeholder={t('pollView.inviteEmailsPlaceholder')}
                     rows={4}
                     data-testid="input-invite-emails"
                   />
@@ -1655,7 +1717,7 @@ export default function Poll() {
                   id="invite-emails"
                   value={inviteEmails}
                   onChange={(e) => setInviteEmails(e.target.value)}
-                  placeholder="max@example.de, anna@example.de"
+                  placeholder={t('pollView.inviteEmailsPlaceholder')}
                   rows={4}
                   data-testid="input-invite-emails"
                 />
@@ -1720,19 +1782,19 @@ export default function Poll() {
                 </Button>
               </div>
             </div>
-            {isAdminAccess && (
+            {isEffectiveAdmin && poll.adminToken && (
               <div className="space-y-2">
                 <Label>{t('pollView.adminLinkForYou')}</Label>
                 <div className="flex">
                   <Input
-                    value={`${window.location.origin}/admin/${token}`}
+                    value={`${window.location.origin}/admin/${poll.adminToken}`}
                     readOnly
                     className="rounded-r-none"
                   />
                   <Button 
                     variant="outline" 
                     className="rounded-l-none"
-                    onClick={() => handleCopyLink(`${window.location.origin}/admin/${token}`, 'admin')}
+                    onClick={() => handleCopyLink(`${window.location.origin}/admin/${poll.adminToken}`, 'admin')}
                   >
                     {copiedLink === 'admin' ? <Check className="w-4 h-4" /> : <Copy className="w-4 h-4" />}
                   </Button>
@@ -1866,7 +1928,8 @@ export default function Poll() {
               onClick={() => {
                 updatePollMutation.mutate({ 
                   isActive: false, 
-                  resultsPublic: endPollResultsPublic 
+                  resultsPublic: endPollResultsPublic,
+                  notifyParticipants: endPollNotifyParticipants,
                 });
               }}
               disabled={updatePollMutation.isPending}
diff --git a/client/src/pages/profile.tsx b/client/src/pages/profile.tsx
index c044f44c..4633ebd6 100644
--- a/client/src/pages/profile.tsx
+++ b/client/src/pages/profile.tsx
@@ -42,7 +42,7 @@ export default function Profile() {
   const { user, isLoading: authLoading } = useAuth();
   const { theme, setTheme } = useTheme();
   const { toast } = useToast();
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
 
   const [name, setName] = useState("");
   const [organization, setOrganization] = useState("");
@@ -389,7 +389,7 @@ export default function Profile() {
                   </div>
                   <div className="flex items-center gap-2">
                     <Calendar className="w-4 h-4" />
-                    <span>{t('profile.memberSince')}: {profile?.createdAt ? new Date(profile.createdAt).toLocaleDateString('de-DE') : '-'}</span>
+                    <span>{t('profile.memberSince')}: {profile?.createdAt ? new Date(profile.createdAt).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US') : '-'}</span>
                   </div>
                 </div>
               </CardContent>
@@ -531,7 +531,7 @@ export default function Profile() {
                         <p className="font-medium text-amber-800 dark:text-amber-200">{t('profile.deletionRequestSubmitted')}</p>
                         <p className="text-sm text-amber-700 dark:text-amber-300">
                           {t('profile.deletionRequestDescription', { 
-                            date: new Date(profile.deletionRequestedAt).toLocaleDateString('de-DE', { 
+                            date: new Date(profile.deletionRequestedAt).toLocaleDateString(i18n.language === 'de' ? 'de-DE' : 'en-US', { 
                               day: '2-digit', 
                               month: '2-digit', 
                               year: 'numeric',
@@ -642,6 +642,7 @@ export default function Profile() {
               <Input
                 id="currentPassword"
                 type="password"
+                autoComplete="off"
                 value={currentPassword}
                 onChange={(e) => setCurrentPassword(e.target.value)}
                 className="mt-1"
@@ -653,6 +654,7 @@ export default function Profile() {
               <Input
                 id="newPassword"
                 type="password"
+                autoComplete="off"
                 value={newPassword}
                 onChange={(e) => setNewPassword(e.target.value)}
                 className="mt-1"
@@ -665,6 +667,7 @@ export default function Profile() {
               <Input
                 id="confirmPassword"
                 type="password"
+                autoComplete="off"
                 value={confirmPassword}
                 onChange={(e) => setConfirmPassword(e.target.value)}
                 className="mt-1"
@@ -714,6 +717,7 @@ export default function Profile() {
               <Input
                 id="emailPassword"
                 type="password"
+                autoComplete="off"
                 value={emailPassword}
                 onChange={(e) => setEmailPassword(e.target.value)}
                 className="mt-1"
diff --git a/client/src/pages/reset-password.tsx b/client/src/pages/reset-password.tsx
index a21f2d85..e2f7f3f5 100644
--- a/client/src/pages/reset-password.tsx
+++ b/client/src/pages/reset-password.tsx
@@ -253,6 +253,7 @@ export default function ResetPassword() {
               <Input
                 id="newPassword"
                 type="password"
+                autoComplete="off"
                 value={newPassword}
                 onChange={(e) => setNewPassword(e.target.value)}
                 className="mt-1"
@@ -264,6 +265,7 @@ export default function ResetPassword() {
               <Input
                 id="confirmPassword"
                 type="password"
+                autoComplete="off"
                 value={confirmPassword}
                 onChange={(e) => setConfirmPassword(e.target.value)}
                 className="mt-1"
diff --git a/docker-compose.yml b/docker-compose.yml
index 6eb49406..9c340a50 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -62,22 +62,35 @@ services:
       postgres:
         condition: service_healthy
     environment:
+      # Default: Built automatically from POSTGRES_* variables (for integrated docker-compose setup)
+      # External DB: Set DATABASE_URL directly in .env (POSTGRES_* variables will be ignored)
+      # Example: DATABASE_URL=postgresql://user:pass@your-db-host:5432/polly
       DATABASE_URL: postgresql://${POSTGRES_USER:-polly}:${POSTGRES_PASSWORD:-polly_secret}@postgres:5432/${POSTGRES_DB:-polly}
       SESSION_SECRET: ${SESSION_SECRET:-change-this-in-production-to-a-secure-random-string}
       BASE_URL: ${BASE_URL:-http://localhost:3080}
       APP_URL: ${APP_URL:-http://localhost:3080}
       VITE_APP_URL: ${VITE_APP_URL:-http://localhost:3080}
+      # Email (SMTP)
       SMTP_HOST: ${SMTP_HOST:-}
       SMTP_PORT: ${SMTP_PORT:-587}
       SMTP_SECURE: ${SMTP_SECURE:-false}
       SMTP_USER: ${SMTP_USER:-}
       SMTP_PASSWORD: ${SMTP_PASSWORD:-}
-      EMAIL_FROM: ${EMAIL_FROM:-noreply@localhost}
+      FROM_EMAIL: ${FROM_EMAIL:-${EMAIL_FROM:-noreply@localhost}}
+      FROM_NAME: ${FROM_NAME:-Polly}
+      # Keycloak OIDC
       KEYCLOAK_REALM: ${KEYCLOAK_REALM:-}
       KEYCLOAK_CLIENT_ID: ${KEYCLOAK_CLIENT_ID:-}
       KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET:-}
       KEYCLOAK_AUTH_SERVER_URL: ${KEYCLOAK_AUTH_SERVER_URL:-}
+      KEYCLOAK_ISSUER_URL: ${KEYCLOAK_ISSUER_URL:-}
+      SSO_BUTTON_LABEL: ${SSO_BUTTON_LABEL:-}
+      HIDE_LOGIN_FORM: ${HIDE_LOGIN_FORM:-false}
+      # Runtime
       NODE_ENV: ${NODE_ENV:-production}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+      DATABASE_SSL: ${DATABASE_SSL:-false}
+      FORCE_HTTPS: ${FORCE_HTTPS:-false}
       SEED_DEMO_DATA: ${SEED_DEMO_DATA:-false}
       DOCKER_ENV: "true"
       # Initial Admin (created on first start, updated if changed)
@@ -88,6 +101,17 @@ services:
       CLAMAV_ENABLED: ${CLAMAV_ENABLED:-false}
       CLAMAV_HOST: ${CLAMAV_HOST:-localhost}
       CLAMAV_PORT: ${CLAMAV_PORT:-3310}
+      # Security Scanning
+      PENTEST_TOOLS_API_TOKEN: ${PENTEST_TOOLS_API_TOKEN:-}
+      # AI Assistant (Optional) — see docs/SELF-HOSTING.md for details
+      # AI_API_URL: ${AI_API_URL:-}
+      # AI_API_KEY: ${AI_API_KEY:-}
+      # AI_API_KEY_FALLBACK: ${AI_API_KEY_FALLBACK:-}
+      # AI_MODEL: ${AI_MODEL:-llama-3.3-70b-instruct}
+      # E2E Testing
+      TEST_MODE_SECRET: ${TEST_MODE_SECRET:-polly-e2e-test-mode}
+      # WCAG Override
+      POLLY_WCAG_OVERRIDE: ${POLLY_WCAG_OVERRIDE:-false}
     ports:
       - "${APP_PORT:-3080}:5000"
     volumes:
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index a5aa6d96..081424e3 100644
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -16,10 +16,25 @@ fi
 # =========================================
 # Step 1: Wait for PostgreSQL
 # =========================================
-echo "[DB] Waiting for PostgreSQL..."
+
+# Extract host and port from DATABASE_URL using Node.js URL parser
+# This safely handles special characters in passwords (: @ # etc.)
+if [ -n "$DATABASE_URL" ]; then
+  DB_HOST=$(node -e "try { console.log(new URL(process.env.DATABASE_URL).hostname) } catch(e) { console.error('[DB] ERROR: Invalid DATABASE_URL format'); process.exit(1) }")
+  DB_PORT=$(node -e "try { console.log(new URL(process.env.DATABASE_URL).port || '5432') } catch(e) { process.exit(1) }")
+  if [ -z "$DB_HOST" ]; then
+    echo "[DB] ERROR: Could not parse DATABASE_URL — check the format (postgresql://user:pass@host:port/dbname)"
+    exit 1
+  fi
+else
+  DB_HOST=${POSTGRES_HOST:-postgres}
+  DB_PORT=${POSTGRES_PORT:-5432}
+fi
+
+echo "[DB] Waiting for PostgreSQL at ${DB_HOST}:${DB_PORT}..."
 MAX_RETRIES=60
 RETRY_COUNT=0
-until pg_isready -h postgres -U ${POSTGRES_USER:-polly} -d ${POSTGRES_DB:-polly} 2>/dev/null; do
+until pg_isready -h "$DB_HOST" -p "$DB_PORT" 2>/dev/null; do
   RETRY_COUNT=$((RETRY_COUNT + 1))
   if [ $RETRY_COUNT -ge $MAX_RETRIES ]; then
     echo "[DB] ERROR: Connection timeout after ${MAX_RETRIES} seconds"
diff --git a/docs/API-DOCUMENTATION.md b/docs/API-DOCUMENTATION.md
new file mode 100644
index 00000000..7e2f6083
--- /dev/null
+++ b/docs/API-DOCUMENTATION.md
@@ -0,0 +1,1971 @@
+# Polly – API-Dokumentation
+
+**Version:** 2.0  
+**Zuletzt aktualisiert:** 2026-03-25  
+**API-Präfix:** `/api/v1/`  
+**API-Typ:** REST  
+**Datenformat:** JSON (`Content-Type: application/json`, sofern nicht anders angegeben)  
+**Authentifizierung:** Session-basiert (Cookie `polly.sid`) + optionaler Bearer-Token (Keycloak)
+
+---
+
+## Inhaltsverzeichnis
+
+1. [Authentifizierung](#1-authentifizierung)
+2. [Polls – Umfragen](#2-polls--umfragen)
+3. [Voting – Abstimmungen](#3-voting--abstimmungen)
+4. [Vote-Bearbeitung](#4-vote-bearbeitung)
+5. [Benutzer-Profil](#5-benutzer-profil)
+6. [Export](#6-export)
+7. [Kalender-Integration](#7-kalender-integration)
+8. [KI-Funktionen](#8-ki-funktionen)
+9. [System-Endpunkte (öffentlich)](#9-system-endpunkte-öffentlich)
+10. [Datei-Upload](#10-datei-upload)
+11. [Admin – Übersicht](#11-admin--übersicht)
+12. [Admin – Benutzerverwaltung](#12-admin--benutzerverwaltung)
+13. [Admin – Umfragenverwaltung](#13-admin--umfragenverwaltung)
+14. [Admin – Systemeinstellungen](#14-admin--systemeinstellungen)
+15. [Admin – Sicherheit & Rate Limiting](#15-admin--sicherheit--rate-limiting)
+16. [Admin – Customization & Branding](#16-admin--customization--branding)
+17. [Admin – E-Mail-Templates](#17-admin--e-mail-templates)
+18. [Admin – WCAG Barrierefreiheit](#18-admin--wcag-barrierefreiheit)
+19. [Admin – Benachrichtigungen & Session](#19-admin--benachrichtigungen--session)
+20. [Admin – Antivirus (ClamAV)](#20-admin--antivirus-clamav)
+21. [Admin – Kalender & Deprovisioning](#21-admin--kalender--deprovisioning)
+22. [Admin – Pentest-Tools & Tests](#22-admin--pentest-tools--tests)
+23. [Admin – DSGVO-Löschanträge](#23-admin--dsgvo-löschanträge)
+24. [Admin – System-Status](#24-admin--system-status)
+25. [Externes Deprovisioning](#25-externes-deprovisioning)
+26. [Fehlercodes](#26-fehlercodes)
+27. [Rate Limiting – Übersicht](#27-rate-limiting--übersicht)
+28. [Passwort-Anforderungen](#28-passwort-anforderungen)
+
+---
+
+## 1. Authentifizierung
+
+**Basis-Pfad:** `/api/v1/auth/`
+
+Die API unterstützt zwei Authentifizierungsmethoden:
+- **Cookie-Session**: Web-Browser. Cookie-Name: `polly.sid`. HttpOnly, SameSite=Lax, Secure=auto. Gültig 24 Stunden.
+- **Bearer-Token**: Mobile Apps. Keycloak Access-Token im `Authorization: Bearer <token>` Header.
+
+Session wird bei Login und Registrierung regeneriert (Session-Fixation-Schutz).
+
+---
+
+### `POST /api/v1/auth/login`
+
+Lokale Anmeldung.
+
+**Rate Limiting:** 5 Versuche pro 15 Min. (IP + Account). Danach 15 Min. Sperre.
+
+**Request Body:**
+```json
+{
+  "usernameOrEmail": "admin@example.com",
+  "password": "MyPassword1!"
+}
+```
+
+**Response (200 OK):**
+```json
+{
+  "user": {
+    "id": 1,
+    "username": "admin",
+    "email": "admin@example.com",
+    "name": "Admin User",
+    "role": "admin",
+    "organization": null,
+    "themePreference": "system",
+    "languagePreference": "de"
+  }
+}
+```
+
+**Response (401):**
+```json
+{ "error": "Ungültige Anmeldedaten", "remainingAttempts": 3 }
+```
+
+**Response (429):**
+```json
+{ "error": "Zu viele Anmeldeversuche...", "retryAfter": 900 }
+```
+
+---
+
+### `POST /api/v1/auth/logout`
+
+Beendet die aktive Session.
+
+**Auth:** Erforderlich
+
+**Response (200 OK):**
+```json
+{ "success": true }
+```
+
+---
+
+### `POST /api/v1/auth/register`
+
+Neuen Benutzer registrieren.
+
+**Rate Limiting:** 5 Registrierungen pro Stunde.
+
+**Request Body:**
+```json
+{
+  "username": "maxmuster",
+  "email": "max@example.com",
+  "name": "Max Mustermann",
+  "password": "SecurePass1!"
+}
+```
+
+| Feld | Typ | Pflicht | Validierung |
+|---|---|---|---|
+| `username` | String | Ja | 3-30 Zeichen, alphanumerisch + Unterstrich |
+| `email` | String | Ja | Gültige E-Mail-Adresse |
+| `name` | String | Ja | 1-100 Zeichen |
+| `password` | String | Ja | [Passwort-Anforderungen](#28-passwort-anforderungen) |
+
+**Response (200 OK):**
+```json
+{ "user": { ... } }
+```
+
+**Response (403):** `{ "error": "Registrierung ist deaktiviert" }`
+
+---
+
+### `GET /api/v1/auth/me`
+
+Gibt den aktuell eingeloggten Benutzer zurück.
+
+**Auth:** Erforderlich
+
+**Response (200 OK):** Benutzer-Objekt (wie Login-Response)
+
+**Response (401):** `{ "error": "Not authenticated" }`
+
+---
+
+### `GET /api/v1/auth/methods`
+
+Verfügbare Authentifizierungsmethoden abfragen.
+
+**Auth:** Keine
+
+**Response (200 OK):**
+```json
+{
+  "local": true,
+  "oidc": false,
+  "hideLoginForm": false
+}
+```
+
+---
+
+### `POST /api/v1/auth/check-email`
+
+Prüft ob eine E-Mail bereits registriert ist.
+
+**Rate Limiting:** 10 Anfragen pro Minute.
+
+**Request Body:**
+```json
+{ "email": "max@example.com" }
+```
+
+---
+
+### `GET /api/v1/auth/verify-email/:token`
+
+E-Mail-Adresse über Verifizierungs-Token bestätigen.
+
+**Response (200 OK):**
+```json
+{ "success": true, "message": "E-Mail wurde verifiziert" }
+```
+
+---
+
+### `POST /api/v1/auth/resend-verification`
+
+Verifizierungs-E-Mail erneut senden.
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/auth/request-password-reset`
+
+Passwort-Reset anfordern.
+
+**Rate Limiting:** 3 Anfragen pro 15 Minuten.
+
+**Request Body:**
+```json
+{ "email": "max@example.com" }
+```
+
+**Response (200 OK):** Immer erfolgreich (E-Mail-Enumeration-Schutz):
+```json
+{ "success": true, "message": "Falls ein Konto mit dieser E-Mail existiert, wurde eine E-Mail gesendet." }
+```
+
+---
+
+### `POST /api/v1/auth/reset-password`
+
+Passwort mit Reset-Token zurücksetzen.
+
+**Request Body:**
+```json
+{
+  "token": "abc123...",
+  "newPassword": "NewSecure1!"
+}
+```
+
+---
+
+### `POST /api/v1/auth/change-password`
+
+Passwort ändern (eingeloggt).
+
+**Auth:** Erforderlich
+
+**Request Body:**
+```json
+{
+  "currentPassword": "OldPassword1!",
+  "newPassword": "NewPassword1!"
+}
+```
+
+---
+
+### `POST /api/v1/auth/request-email-change`
+
+E-Mail-Änderung anfordern.
+
+**Auth:** Erforderlich
+
+**Request Body:**
+```json
+{
+  "newEmail": "neuemail@example.com",
+  "password": "CurrentPassword1!"
+}
+```
+
+---
+
+### `POST /api/v1/auth/confirm-email-change`
+
+E-Mail-Änderung bestätigen.
+
+**Request Body:**
+```json
+{ "token": "abc123..." }
+```
+
+---
+
+### `POST /api/v1/auth/request-deletion`
+
+DSGVO-Kontolöschung beantragen (Art. 17).
+
+**Auth:** Erforderlich
+
+---
+
+### `DELETE /api/v1/auth/request-deletion`
+
+Löschantrag zurückziehen.
+
+**Auth:** Erforderlich
+
+---
+
+### `GET /api/v1/auth/keycloak`
+
+Keycloak OIDC Login initiieren (Redirect).
+
+---
+
+### `GET /api/v1/auth/keycloak/callback`
+
+OIDC Callback (automatisch nach Keycloak-Login).
+
+---
+
+## 2. Polls – Umfragen
+
+**Basis-Pfad:** `/api/v1/polls/`
+
+Polls werden über Token adressiert, nicht über IDs:
+- **publicToken**: Für öffentlichen/Teilnehmer-Zugriff
+- **adminToken**: Für Ersteller/Admin-Zugriff
+
+### Poll-Typen
+
+| Typ | Beschreibung | Optionsfelder | Abstimmungsantworten |
+|---|---|---|---|
+| `schedule` | Terminumfrage | `startTime`, `endTime` | `yes`, `maybe`, `no` |
+| `survey` | Klassische Umfrage | `isFreeText` | `yes`, `maybe`, `no`, `freetext` |
+| `organization` | Orga-Liste/Buchung | `maxCapacity` | `signup` (intern → `yes`) |
+
+---
+
+### `POST /api/v1/polls`
+
+Neue Umfrage erstellen.
+
+**Auth:** Optional (anonym möglich; `creatorEmail` für Admin-Link-Zustellung)
+
+**Request Body:**
+```json
+{
+  "title": "Dienstbesprechung März",
+  "description": "Terminabstimmung für das Team",
+  "type": "schedule",
+  "creatorEmail": "admin@example.com",
+  "expiresAt": "2025-04-01T23:59:59Z",
+  "enableExpiryReminder": true,
+  "expiryReminderHours": 24,
+  "allowMultipleSlots": true,
+  "allowVoteEdit": false,
+  "allowVoteWithdrawal": false,
+  "resultsPublic": true,
+  "options": [
+    {
+      "text": "Montag Vormittag",
+      "startTime": "2025-03-15T09:00:00Z",
+      "endTime": "2025-03-15T10:00:00Z",
+      "order": 0
+    },
+    {
+      "text": "Dienstag Nachmittag",
+      "startTime": "2025-03-16T14:00:00Z",
+      "endTime": "2025-03-16T15:00:00Z",
+      "order": 1
+    }
+  ]
+}
+```
+
+| Feld | Typ | Pflicht | Validierung |
+|---|---|---|---|
+| `title` | String | Ja | 1-200 Zeichen |
+| `description` | String | Nein | Max. 5000 Zeichen |
+| `type` | String | Ja | `schedule`, `survey`, `organization` |
+| `creatorEmail` | String | Nein | Gültige E-Mail |
+| `expiresAt` | String | Nein | ISO 8601 |
+| `enableExpiryReminder` | Boolean | Nein | Standard: `false` |
+| `expiryReminderHours` | Number | Nein | 1-168, Standard: 24 |
+| `allowMultipleSlots` | Boolean | Nein | Standard: `true` |
+| `allowVoteEdit` | Boolean | Nein | Standard: `false` |
+| `allowVoteWithdrawal` | Boolean | Nein | Standard: `false` |
+| `resultsPublic` | Boolean | Nein | Standard: `true` |
+| `options` | Array | Ja | Min. 1 Element |
+| `options[].text` | String | Ja | 1-500 Zeichen |
+| `options[].imageUrl` | String | Nein | URL |
+| `options[].altText` | String | Nein | |
+| `options[].startTime` | String | Nein | ISO 8601 (Schedule) |
+| `options[].endTime` | String | Nein | ISO 8601 (Schedule) |
+| `options[].maxCapacity` | Number | Nein | Min. 1 (Organisation) |
+| `options[].isFreeText` | Boolean | Nein | Standard: `false` (Survey) |
+| `options[].order` | Number | Nein | Standard: 0 |
+
+**Response (201 Created):**
+```json
+{
+  "poll": {
+    "id": 42,
+    "title": "Dienstbesprechung März",
+    "type": "schedule",
+    "isActive": true,
+    "options": [...]
+  },
+  "publicToken": "a1b2c3d4e5f6...",
+  "adminToken": "f6e5d4c3b2a1..."
+}
+```
+
+---
+
+### `GET /api/v1/polls/public/:token`
+
+Öffentliche Umfrage abrufen (Teilnehmer-Ansicht).
+
+**Auth:** Keine (optional: eingeloggter Owner bekommt `adminToken`)
+
+**Parameter:** `token` – publicToken (Hex-String)
+
+**Response (200 OK):**
+```json
+{
+  "id": 42,
+  "title": "Dienstbesprechung März",
+  "description": "...",
+  "type": "schedule",
+  "isActive": true,
+  "expiresAt": "2025-04-01T23:59:59Z",
+  "resultsPublic": true,
+  "allowVoteEdit": false,
+  "allowVoteWithdrawal": false,
+  "allowMaybe": true,
+  "allowMultipleSlots": true,
+  "createdAt": "2025-03-01T10:00:00Z",
+  "userId": 1,
+  "adminToken": "f6e5d4c3b2a1...",
+  "options": [
+    {
+      "id": 1,
+      "text": "Montag Vormittag",
+      "startTime": "2025-03-15T09:00:00Z",
+      "endTime": "2025-03-15T10:00:00Z",
+      "order": 0,
+      "maxCapacity": null,
+      "currentCount": 3
+    }
+  ],
+  "votes": [
+    {
+      "id": 100,
+      "optionId": 1,
+      "voterName": "Max",
+      "response": "yes",
+      "createdAt": "2025-03-02T08:00:00Z"
+    }
+  ]
+}
+```
+
+> **Hinweis:** `adminToken` wird nur zurückgegeben, wenn der eingeloggte Benutzer der Ersteller ist.
+
+---
+
+### `GET /api/v1/polls/admin/:token`
+
+Admin-Ansicht der Umfrage (Ersteller/Admin).
+
+**Auth:** Erforderlich (Ersteller oder Admin-Rolle)
+
+**Parameter:** `token` – adminToken (Hex-String)
+
+**Response (200 OK):** Wie öffentliche Ansicht, aber mit `adminToken` und erweiterten Informationen.
+
+---
+
+### `PATCH /api/v1/polls/admin/:token`
+
+Umfrage bearbeiten.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+**Request Body (alle Felder optional):**
+```json
+{
+  "isActive": true,
+  "title": "Neuer Titel",
+  "description": "Neue Beschreibung",
+  "expiresAt": "2025-05-01T00:00:00Z",
+  "resultsPublic": true,
+  "allowVoteEdit": true,
+  "allowVoteWithdrawal": true,
+  "allowMaybe": true,
+  "allowMultipleSlots": false
+}
+```
+
+**Response (200 OK):** Aktualisiertes Poll-Objekt.
+
+---
+
+### `DELETE /api/v1/polls/admin/:token`
+
+Umfrage dauerhaft löschen.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+**Response (200 OK):**
+```json
+{ "success": true, "message": "Umfrage gelöscht" }
+```
+
+---
+
+### `POST /api/v1/polls/admin/:token/finalize`
+
+Ergebnis einer Umfrage bestätigen/finalisieren.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+**Request Body:**
+```json
+{
+  "selectedOptionId": 1,
+  "closePoll": true
+}
+```
+
+---
+
+### `POST /api/v1/polls/admin/:token/options`
+
+Neue Option hinzufügen.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+**Request Body:**
+```json
+{
+  "text": "Mittwoch Abend",
+  "startTime": "2025-03-17T18:00:00Z",
+  "endTime": "2025-03-17T19:00:00Z"
+}
+```
+
+---
+
+### `PATCH /api/v1/polls/admin/:token/options/:optionId`
+
+Option bearbeiten.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+---
+
+### `DELETE /api/v1/polls/admin/:token/options/:optionId`
+
+Option löschen.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+---
+
+### `POST /api/v1/polls/admin/:token/invite`
+
+E-Mail-Einladungen an Teilnehmer senden.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+**Request Body:**
+```json
+{
+  "emails": ["teilnehmer1@example.com", "teilnehmer2@example.com"],
+  "message": "Bitte an der Umfrage teilnehmen."
+}
+```
+
+---
+
+### `POST /api/v1/polls/admin/:token/remind`
+
+Erinnerungen an eingeladene Teilnehmer senden.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+---
+
+### `GET /api/v1/polls/admin/:token/vote-count`
+
+Stimmenzahl für eine Umfrage abfragen.
+
+**Auth:** Erforderlich (Ersteller oder Admin)
+
+---
+
+### `GET /api/v1/polls/:token/results`
+
+Ergebnisse einer Umfrage abrufen.
+
+**Auth:** Keine (wenn `resultsPublic = true`)
+
+---
+
+### `GET /api/v1/polls/my-polls`
+
+Eigene erstellte Umfragen abrufen.
+
+**Auth:** Erforderlich
+
+---
+
+### `GET /api/v1/polls/shared-polls`
+
+Umfragen, an denen der Benutzer teilgenommen hat.
+
+**Auth:** Erforderlich
+
+---
+
+### `GET /api/v1/polls/:token/reminder-status`
+
+Status der Erinnerungen für eine Umfrage.
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/polls/:id/send-reminder`
+
+Erinnerung für eine Umfrage senden (per Poll-ID).
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/polls/:token/invite`
+
+Teilnehmer über Token einladen.
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/polls/:token/invite/matrix`
+
+Matrix-Benutzer zu einer Umfrage einladen.
+
+**Auth:** Erforderlich
+
+---
+
+## 3. Voting – Abstimmungen
+
+**Basis-Pfad:** `/api/v1/polls/`
+
+### `POST /api/v1/polls/:token/vote`
+
+Einzelne Stimme abgeben.
+
+**Auth:** Keine (anonyme Teilnahme möglich)
+
+**Parameter:** `token` – publicToken
+
+**Request Body:**
+```json
+{
+  "voterName": "Max Mustermann",
+  "voterEmail": "max@example.com",
+  "votes": [
+    { "optionId": 1, "response": "yes" },
+    { "optionId": 2, "response": "maybe", "comment": "Nur nachmittags" },
+    { "optionId": 3, "response": "no" }
+  ]
+}
+```
+
+| Feld | Typ | Pflicht | Validierung |
+|---|---|---|---|
+| `voterName` | String | Ja | 1-100 Zeichen |
+| `voterEmail` | String | Ja | Gültige E-Mail, max. 254 Zeichen |
+| `votes` | Array | Ja | Min. 1 Element |
+| `votes[].optionId` | Number | Ja | Gültige Options-ID |
+| `votes[].response` | String | Ja | `yes`, `maybe`, `no`, `freetext`, `signup` |
+| `votes[].comment` | String | Nein | |
+| `votes[].freeTextAnswer` | String | Nein | Max. 2000 Zeichen (Survey-Freitext) |
+
+**Validierungsregeln:**
+- Inaktive Umfrage → `400 POLL_INACTIVE`
+- Abgelaufene Umfrage → `400 POLL_EXPIRED`
+- Bereits abgestimmt (ohne allowVoteEdit) → `400 ALREADY_VOTED`
+- Eingeloggt mit fremder E-Mail → `403 EMAIL_BELONGS_TO_ANOTHER_USER`
+- Anonym mit registrierter E-Mail → `409 REQUIRES_LOGIN`
+
+**Response (200 OK):**
+```json
+{
+  "success": true,
+  "votes": [...],
+  "voterEditToken": "edit_abc123..."
+}
+```
+
+---
+
+### `POST /api/v1/polls/:token/vote-bulk`
+
+Mehrere Stimmen gleichzeitig abgeben. Gleiches Schema wie `/vote`.
+
+---
+
+### `DELETE /api/v1/polls/:token/vote`
+
+Stimme zurückziehen.
+
+**Auth:** Keine (Token-basiert)
+
+---
+
+### `GET /api/v1/polls/:token/my-votes`
+
+Eigene Stimmen für eine Umfrage abrufen.
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/polls/:token/resend-email`
+
+Bestätigungs-E-Mail erneut senden.
+
+---
+
+### `POST /api/v1/polls/:token/votes-by-email`
+
+Stimmen per E-Mail-Adresse suchen.
+
+**Request Body:**
+```json
+{ "email": "max@example.com" }
+```
+
+---
+
+## 4. Vote-Bearbeitung
+
+**Basis-Pfad:** `/api/v1/votes/`
+
+Token-basierte Bearbeitung ohne Anmeldung.
+
+### `GET /api/v1/votes/edit/:editToken`
+
+Stimme zum Bearbeiten abrufen.
+
+**Auth:** Keine (Token-basiert)
+
+**Response (200 OK):**
+```json
+{
+  "poll": {
+    "id": 42,
+    "title": "...",
+    "type": "schedule",
+    "isActive": true,
+    "options": [...]
+  },
+  "votes": [...],
+  "voterName": "Max",
+  "voterEmail": "max@example.com",
+  "allowVoteWithdrawal": true
+}
+```
+
+---
+
+### `PUT /api/v1/votes/edit/:editToken`
+
+Bestehende Stimme bearbeiten.
+
+**Request Body:**
+```json
+{
+  "votes": [
+    { "optionId": 1, "response": "no" },
+    { "optionId": 2, "response": "yes" }
+  ]
+}
+```
+
+**Response (200 OK):**
+```json
+{ "success": true, "votes": [...] }
+```
+
+---
+
+### `DELETE /api/v1/votes/edit/:editToken`
+
+Stimme komplett zurückziehen.
+
+**Response (200 OK):**
+```json
+{ "success": true, "message": "...", "withdrawnCount": 3 }
+```
+
+**Fehler:**
+- `403`: Rückzug nicht erlaubt (`allowVoteWithdrawal = false`)
+- `400`: Umfrage inaktiv
+
+---
+
+## 5. Benutzer-Profil
+
+**Basis-Pfad:** `/api/v1/user/` und `/api/v1/users/`
+
+### `GET /api/v1/user/profile`
+
+Eigenes Profil abrufen.
+
+**Auth:** Erforderlich
+
+**Response (200 OK):**
+```json
+{
+  "id": 1,
+  "username": "maxmuster",
+  "email": "max@example.com",
+  "name": "Max Mustermann",
+  "organization": "Kita Sonnenschein",
+  "role": "user",
+  "provider": "local",
+  "themePreference": "system",
+  "languagePreference": "de",
+  "createdAt": "2025-01-01T00:00:00Z",
+  "lastLoginAt": "2025-03-25T08:00:00Z",
+  "deletionRequestedAt": null
+}
+```
+
+---
+
+### `PUT /api/v1/user/profile`
+
+Profil aktualisieren.
+
+**Auth:** Erforderlich
+
+**Request Body (alle Felder optional):**
+```json
+{
+  "name": "Max Mustermann",
+  "organization": "Kita Sonnenschein",
+  "themePreference": "dark",
+  "languagePreference": "en"
+}
+```
+
+| Feld | Typ | Werte |
+|---|---|---|
+| `name` | String | |
+| `organization` | String | |
+| `themePreference` | String | `light`, `dark`, `system` |
+| `languagePreference` | String | `de`, `en` |
+
+---
+
+### `PATCH /api/v1/users/me/language`
+
+Sprachpräferenz ändern.
+
+**Auth:** Erforderlich
+
+**Request Body:**
+```json
+{ "language": "de" }
+```
+
+---
+
+### `PUT /api/v1/user/theme`
+
+Theme-Präferenz ändern.
+
+**Auth:** Erforderlich
+
+**Request Body:**
+```json
+{ "themePreference": "dark" }
+```
+
+---
+
+### `GET /api/v1/user/polls`
+
+Eigene erstellte Umfragen.
+
+**Auth:** Erforderlich
+
+---
+
+### `GET /api/v1/user/participations`
+
+Umfragen, an denen teilgenommen wurde.
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/users/me/device-tokens`
+
+Push-Notification Device-Token registrieren.
+
+**Auth:** Erforderlich
+
+---
+
+### `DELETE /api/v1/users/me/device-tokens`
+
+Device-Token entfernen.
+
+**Auth:** Erforderlich
+
+---
+
+## 6. Export
+
+**Basis-Pfad:** `/api/v1/polls/`
+
+### `GET /api/v1/polls/:token/qr`
+
+QR-Code für eine Umfrage generieren.
+
+**Auth:** Keine
+
+**Query-Parameter:**
+
+| Parameter | Typ | Standard | Beschreibung |
+|---|---|---|---|
+| `format` | String | `png` | `svg` oder `png` |
+
+**Response (200 OK):**
+```json
+{
+  "qrCode": "data:image/png;base64,...",
+  "format": "png",
+  "pollUrl": "https://example.com/poll/abc123..."
+}
+```
+
+---
+
+### `GET /api/v1/polls/:token/qr/download`
+
+QR-Code als Bilddatei herunterladen.
+
+**Content-Type:** `image/png` oder `image/svg+xml`
+
+---
+
+### `GET /api/v1/polls/:token/export/pdf`
+
+Umfrage-Ergebnisse als PDF exportieren.
+
+**Auth:** Öffentlich wenn `resultsPublic = true`, sonst Ersteller/Admin erforderlich.
+
+**Content-Type:** `application/pdf`
+
+---
+
+### `GET /api/v1/polls/:token/export/csv`
+
+Umfrage-Ergebnisse als CSV exportieren.
+
+**Auth:** Wie PDF.
+
+**Query-Parameter:**
+
+| Parameter | Typ | Beschreibung |
+|---|---|---|
+| `lang` | String | `de` oder `en` |
+
+**Content-Type:** `text/csv; charset=utf-8`
+
+---
+
+### `GET /api/v1/polls/:token/export/ics`
+
+Umfrage-Optionen als ICS-Kalender exportieren.
+
+**Query-Parameter:**
+
+| Parameter | Typ | Beschreibung |
+|---|---|---|
+| `lang` | String | `de` oder `en` |
+| `email` | String | Optional: nur Termine für diesen Teilnehmer |
+
+**Content-Type:** `text/calendar; charset=utf-8`
+
+---
+
+## 7. Kalender-Integration
+
+### `GET /api/v1/calendar/token`
+
+Persönlichen Kalender-Feed-Token abrufen.
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/calendar/token/regenerate`
+
+Kalender-Token erneuern (alter Token wird ungültig).
+
+**Auth:** Erforderlich
+
+---
+
+### `GET /api/v1/calendar/:calendarToken/feed.ics`
+
+Öffentlicher ICS-Feed mit allen Umfragen des Benutzers.
+
+**Auth:** Keine (Token-basiert)
+
+**Content-Type:** `text/calendar; charset=utf-8`
+
+Unterstützt `webcal://` Subscription.
+
+---
+
+## 8. KI-Funktionen
+
+**Basis-Pfad:** `/api/v1/ai/`
+
+> Automatisch aktiviert wenn `AI_API_KEY` gesetzt ist.
+
+### `GET /api/v1/ai/status`
+
+KI-Service-Status und Benutzerkontingent.
+
+**Auth:** Erforderlich
+
+---
+
+### `POST /api/v1/ai/transcribe`
+
+Audio-Datei transkribieren (Whisper API).
+
+**Auth:** Erforderlich
+
+**Content-Type:** `multipart/form-data`
+
+---
+
+### `POST /api/v1/ai/create-poll`
+
+KI-gestützte Umfrageerstellung / -verfeinerung.
+
+**Auth:** Erforderlich
+
+**Rate Limiting:** Ja
+
+---
+
+### `POST /api/v1/ai/apply`
+
+KI-Vorschlag als Umfrage übernehmen.
+
+**Auth:** Erforderlich
+
+---
+
+### `GET /api/v1/ai/admin/settings`
+
+KI-Einstellungen abrufen.
+
+**Auth:** Admin
+
+---
+
+### `PUT /api/v1/ai/admin/settings`
+
+KI-Einstellungen aktualisieren.
+
+**Auth:** Admin
+
+---
+
+### `GET /api/v1/ai/admin/usage`
+
+KI-Nutzungsstatistiken.
+
+**Auth:** Admin
+
+---
+
+## 9. System-Endpunkte (öffentlich)
+
+**Basis-Pfad:** `/api/v1/`
+
+### `GET /api/v1/health`
+
+Service Health-Check.
+
+**Auth:** Keine
+
+**Response (200 OK):**
+```json
+{ "status": "ok" }
+```
+
+---
+
+### `GET /api/v1/email-status`
+
+Prüft ob SMTP konfiguriert ist.
+
+**Auth:** Keine
+
+---
+
+### `GET /api/v1/customization`
+
+Öffentliche Branding/Theme-Einstellungen.
+
+**Auth:** Keine
+
+---
+
+### `GET /api/v1/system/language`
+
+System-Standardsprache.
+
+**Auth:** Keine
+
+**Response (200 OK):**
+```json
+{ "language": "de" }
+```
+
+---
+
+### `GET /api/v1/settings/accessibility`
+
+WCAG-Barrierefreiheits-Erzwingungsstatus.
+
+**Auth:** Keine
+
+---
+
+### `GET /api/v1/customization/mobile`
+
+Mobile-optimierte Branding/Theme-Daten (für KH App).
+
+**Auth:** Keine
+
+---
+
+### `GET /api/v1/theme`
+
+Aktuelle Theme-Präferenz (Benutzer > Cookie > System-Standard).
+
+**Auth:** Keine
+
+---
+
+### `POST /api/v1/theme`
+
+Theme-Präferenz als Cookie setzen.
+
+**Auth:** Keine
+
+---
+
+### `GET /api/v1/matrix/status`
+
+Matrix-Chat-Integration aktiviert?
+
+**Auth:** Keine
+
+---
+
+### `GET /api/v1/matrix/users/search`
+
+Matrix-Benutzer suchen.
+
+**Auth:** Erforderlich
+
+---
+
+## 10. Datei-Upload
+
+### `POST /api/v1/upload/image`
+
+Bild hochladen (mit optionalem Antivirus-Scan via ClamAV).
+
+**Auth:** Keine
+
+**Content-Type:** `multipart/form-data`
+
+**Feld:** `image` (Datei)
+
+**Response (200 OK):**
+```json
+{ "imageUrl": "/uploads/abc123.jpg" }
+```
+
+**Fehler:**
+- `422`: Virus erkannt
+- `503`: Scanner nicht verfügbar
+
+---
+
+## 11. Admin – Übersicht
+
+**Basis-Pfad:** `/api/v1/admin/`
+
+**Auth:** Alle Admin-Endpunkte erfordern die Rolle `admin`.
+
+**Rollen:**
+
+| Rolle | Beschreibung |
+|---|---|
+| `user` | Standard-Benutzer |
+| `manager` | Erweiterte Rechte |
+| `admin` | Vollzugriff |
+
+---
+
+## 12. Admin – Benutzerverwaltung
+
+### `GET /api/v1/admin/users`
+
+Alle Benutzer auflisten.
+
+**Response (200 OK):**
+```json
+[
+  {
+    "id": 1,
+    "username": "maxmuster",
+    "email": "max@example.com",
+    "name": "Max Mustermann",
+    "role": "user",
+    "organization": "Kita Sonnenschein",
+    "emailVerified": true,
+    "provider": "local",
+    "createdAt": "2025-01-01T00:00:00Z",
+    "lastLoginAt": "2025-03-25T08:00:00Z"
+  }
+]
+```
+
+---
+
+### `POST /api/v1/admin/users`
+
+Benutzer manuell anlegen.
+
+**Request Body:**
+```json
+{
+  "name": "Erika Musterfrau",
+  "email": "erika@example.com",
+  "username": "erikam",
+  "password": "SecurePass1!",
+  "role": "user"
+}
+```
+
+| Feld | Typ | Pflicht | Validierung |
+|---|---|---|---|
+| `name` | String | Ja | |
+| `email` | String | Ja | Gültige E-Mail, eindeutig |
+| `username` | String | Ja | 3-30 Zeichen, alphanumerisch + `_`, eindeutig |
+| `password` | String | Ja | [Passwort-Anforderungen](#28-passwort-anforderungen) |
+| `role` | String | Nein | `user`, `manager`, `admin` (Standard: `user`) |
+
+---
+
+### `PATCH /api/v1/admin/users/:id`
+
+Benutzer bearbeiten.
+
+**Request Body (alle Felder optional):**
+```json
+{
+  "role": "manager",
+  "name": "Neuer Name",
+  "email": "neu@example.com",
+  "organization": "Neue Organisation",
+  "emailVerified": true
+}
+```
+
+---
+
+### `DELETE /api/v1/admin/users/:id`
+
+Benutzer löschen.
+
+> Gesperrt wenn externes Deprovisioning aktiv ist. Eigenes Konto kann nicht gelöscht werden.
+
+**Response (200 OK):**
+```json
+{ "success": true, "message": "Benutzer gelöscht" }
+```
+
+---
+
+## 13. Admin – Umfragenverwaltung
+
+### `GET /api/v1/admin/polls`
+
+Alle Umfragen im System auflisten.
+
+---
+
+### `PATCH /api/v1/admin/polls/:id`
+
+Beliebige Umfrage bearbeiten/moderieren.
+
+**Request Body (optional):**
+```json
+{
+  "isActive": false,
+  "title": "...",
+  "description": "...",
+  "expiresAt": "2025-05-01T00:00:00Z",
+  "resultsPublic": true
+}
+```
+
+---
+
+### `DELETE /api/v1/admin/polls/:id`
+
+Umfrage dauerhaft löschen.
+
+---
+
+## 14. Admin – Systemeinstellungen
+
+### `GET /api/v1/admin/settings`
+
+Alle Systemeinstellungen auflisten.
+
+**Response (200 OK):**
+```json
+[
+  { "key": "registration_enabled", "value": true, "description": "..." }
+]
+```
+
+---
+
+### `POST /api/v1/admin/settings`
+
+Einstellung erstellen oder aktualisieren.
+
+**Request Body:**
+```json
+{
+  "key": "registration_enabled",
+  "value": true,
+  "description": "Registrierung aktivieren/deaktivieren"
+}
+```
+
+---
+
+### `DELETE /api/v1/admin/settings/:key`
+
+Einstellung löschen.
+
+---
+
+## 15. Admin – Sicherheit & Rate Limiting
+
+### Login-Rate-Limiting
+
+#### `GET /api/v1/admin/security`
+
+Aktuelle Sicherheitseinstellungen und Login-Statistiken.
+
+**Response (200 OK):**
+```json
+{
+  "settings": {
+    "maxAttempts": 5,
+    "windowSeconds": 900,
+    "cooldownSeconds": 900
+  },
+  "stats": { ... }
+}
+```
+
+---
+
+#### `PUT /api/v1/admin/security`
+
+Sicherheitseinstellungen aktualisieren.
+
+| Feld | Typ | Bereich |
+|---|---|---|
+| `maxAttempts` | Number | 1-100 |
+| `windowSeconds` | Number | 60-86400 |
+| `cooldownSeconds` | Number | 60-86400 |
+
+---
+
+#### `POST /api/v1/admin/security/clear-rate-limits`
+
+Alle Login-Rate-Limit-Sperren aufheben.
+
+---
+
+### API-Rate-Limiting
+
+#### `GET /api/v1/admin/api-rate-limits`
+
+API-Rate-Limit-Einstellungen und Statistiken.
+
+---
+
+#### `PUT /api/v1/admin/api-rate-limits`
+
+API-Rate-Limits konfigurieren.
+
+| Feld je Limiter | Typ | Bereich |
+|---|---|---|
+| `maxRequests` | Number | 1-1000 |
+| `windowSeconds` | Number | 1-86400 |
+
+---
+
+#### `POST /api/v1/admin/api-rate-limits/clear`
+
+Spezifische API-Rate-Limiter zurücksetzen.
+
+---
+
+## 16. Admin – Customization & Branding
+
+### `GET /api/v1/admin/customization`
+
+Vollständige Branding- und Theme-Einstellungen.
+
+**Response (200 OK):**
+```json
+{
+  "theme": {
+    "primaryColor": "#4f46e5",
+    "secondaryColor": "#6366f1",
+    "borderRadius": "8px"
+  },
+  "branding": {
+    "logoUrl": "/uploads/logo.png",
+    "faviconUrl": "/uploads/favicon.ico",
+    "siteName": "Polly",
+    "siteNameAccent": ""
+  },
+  "footer": {
+    "description": "...",
+    "copyrightText": "...",
+    "supportLinks": [
+      { "label": "Datenschutz", "url": "/datenschutz" }
+    ]
+  },
+  "matrix": {
+    "enabled": false,
+    "homeserverUrl": "",
+    "botUserId": "",
+    "botAccessToken": "",
+    "searchEnabled": false
+  }
+}
+```
+
+---
+
+### `PUT /api/v1/admin/customization`
+
+Branding/Theme aktualisieren (partielle Updates möglich).
+
+---
+
+### `POST /api/v1/admin/customization/logo`
+
+Logo hochladen.
+
+**Content-Type:** `multipart/form-data`
+
+---
+
+### `DELETE /api/v1/admin/customization/logo`
+
+Logo entfernen.
+
+---
+
+### `POST /api/v1/admin/branding/reset`
+
+Alle Branding-Einstellungen auf Systemstandard zurücksetzen.
+
+---
+
+## 17. Admin – E-Mail-Templates
+
+**Template-Typen:** `poll_created`, `invitation`, `vote_confirmation`, `reminder`, `password_reset`, `email_change`, `password_changed`, `welcome`, `test_report`, `poll_finalized`
+
+### `GET /api/v1/admin/email-templates`
+
+Alle Templates auflisten.
+
+---
+
+### `GET /api/v1/admin/email-templates/:type`
+
+Einzelnes Template abrufen.
+
+---
+
+### `PUT /api/v1/admin/email-templates/:type`
+
+Template bearbeiten.
+
+**Request Body:**
+```json
+{
+  "subject": "Einladung: {{pollTitle}}",
+  "jsonContent": { ... },
+  "textContent": "..."
+}
+```
+
+---
+
+### `POST /api/v1/admin/email-templates/:type/reset`
+
+Template auf Systemstandard zurücksetzen.
+
+---
+
+### `POST /api/v1/admin/email-templates/:type/preview`
+
+Vorschau mit Beispieldaten rendern.
+
+**Response (200 OK):**
+```json
+{
+  "html": "<html>...</html>",
+  "text": "..."
+}
+```
+
+---
+
+### `POST /api/v1/admin/email-templates/:type/test`
+
+Test-E-Mail für ein Template versenden.
+
+---
+
+### `GET /api/v1/admin/email-templates/:type/variables`
+
+Verfügbare Template-Variablen auflisten.
+
+---
+
+### `GET /api/v1/admin/email-footer`
+
+Globalen E-Mail-Footer abrufen.
+
+---
+
+### `PUT /api/v1/admin/email-footer`
+
+Globalen E-Mail-Footer aktualisieren.
+
+---
+
+### `GET /api/v1/admin/email-theme`
+
+E-Mail-Theme-Einstellungen.
+
+---
+
+### `PUT /api/v1/admin/email-theme`
+
+E-Mail-Theme aktualisieren.
+
+---
+
+### `POST /api/v1/admin/email-theme/reset`
+
+E-Mail-Theme auf Standard zurücksetzen.
+
+---
+
+### `POST /api/v1/admin/email-theme/import`
+
+Theme aus JSON importieren (Vorschau).
+
+---
+
+### `POST /api/v1/admin/email-theme/import/confirm`
+
+Importiertes Theme speichern.
+
+---
+
+## 18. Admin – WCAG Barrierefreiheit
+
+### `POST /api/v1/admin/wcag/audit`
+
+Automatischen Farbkontrast-Audit durchführen (WCAG 2.1 AA, 4.5:1 Kontrastverhältnis).
+
+**Response:** Audit-Ergebnis mit `suggestedValue` für nicht-konforme Farben.
+
+---
+
+### `POST /api/v1/admin/wcag/apply-corrections`
+
+Vorgeschlagene Barrierefreiheits-Korrekturen automatisch anwenden.
+
+---
+
+### `PUT /api/v1/admin/wcag/settings`
+
+WCAG-Erzwingung ein-/ausschalten.
+
+---
+
+## 19. Admin – Benachrichtigungen & Session
+
+### `GET /api/v1/admin/notifications`
+
+Globale Benachrichtigungseinstellungen.
+
+---
+
+### `PUT /api/v1/admin/notifications`
+
+Benachrichtigungsverhalten aktualisieren.
+
+---
+
+### `GET /api/v1/admin/session-timeout`
+
+Session-Timeout-Einstellungen (rollenbasiert).
+
+---
+
+### `PUT /api/v1/admin/session-timeout`
+
+Session-Timeout konfigurieren.
+
+---
+
+## 20. Admin – Antivirus (ClamAV)
+
+### `GET /api/v1/admin/clamav`
+
+ClamAV-Scanner-Konfiguration.
+
+---
+
+### `PUT /api/v1/admin/clamav`
+
+ClamAV-Einstellungen aktualisieren.
+
+---
+
+### `POST /api/v1/admin/clamav/test`
+
+Verbindung zum ClamAV-Service testen.
+
+---
+
+### `POST /api/v1/admin/clamav/test-config`
+
+Spezifische ClamAV-Konfiguration testen.
+
+---
+
+### `GET /api/v1/admin/clamav/scan-logs`
+
+Antivirus-Scan-Protokoll abrufen.
+
+---
+
+### `GET /api/v1/admin/clamav/scan-logs/:id`
+
+Details zu einem bestimmten Scan.
+
+---
+
+### `GET /api/v1/admin/clamav/scan-stats`
+
+Antivirus-Statistiken.
+
+---
+
+## 21. Admin – Kalender & Deprovisioning
+
+### `GET /api/v1/admin/calendar`
+
+System-Kalendereinstellungen (ICS/Exports).
+
+---
+
+### `PUT /api/v1/admin/calendar`
+
+Kalendereinstellungen aktualisieren.
+
+---
+
+### `GET /api/v1/admin/deprovision-settings`
+
+Konfiguration für externes Benutzer-Deprovisioning.
+
+---
+
+### `PUT /api/v1/admin/deprovision-settings`
+
+Deprovisioning-Konfiguration aktualisieren.
+
+---
+
+## 22. Admin – Pentest-Tools & Tests
+
+### `GET /api/v1/admin/pentest-tools/status`
+
+Verbindungsstatus zu Pentest-Tools.com.
+
+---
+
+### `GET /api/v1/admin/pentest-tools/config`
+
+Pentest-Tools-Konfiguration.
+
+---
+
+### `POST /api/v1/admin/pentest-tools/config`
+
+Pentest-Tools API-Token aktualisieren.
+
+---
+
+### `GET /api/v1/admin/tests/data-stats`
+
+Statistiken über E2E-Testdaten.
+
+---
+
+### `DELETE /api/v1/admin/tests/purge-data`
+
+Alle als Testdaten markierten Einträge löschen.
+
+---
+
+### `GET /api/v1/admin/test-runs`
+
+History der System-Testläufe.
+
+---
+
+### `GET /api/v1/admin/test-runs/current`
+
+Status des aktuell laufenden Tests.
+
+---
+
+### `POST /api/v1/admin/test-runs`
+
+Neuen System-Testlauf starten.
+
+---
+
+### `POST /api/v1/admin/test-runs/stop`
+
+Laufenden Testlauf stoppen.
+
+---
+
+## 23. Admin – DSGVO-Löschanträge
+
+### `GET /api/v1/admin/deletion-requests`
+
+Offene Kontolöschanträge auflisten (Art. 17 DSGVO).
+
+---
+
+### `POST /api/v1/admin/deletion-requests/:id/confirm`
+
+Löschantrag bestätigen und ausführen.
+
+---
+
+### `POST /api/v1/admin/deletion-requests/:id/reject`
+
+Löschantrag ablehnen.
+
+---
+
+## 24. Admin – System-Status
+
+### `GET /api/v1/admin/stats`
+
+Basis-Systemstatistiken.
+
+---
+
+### `GET /api/v1/admin/extended-stats`
+
+Detaillierte Statistiken (gecached).
+
+---
+
+### `GET /api/v1/admin/system-status`
+
+Echtzeit-Systemstatus (CPU, RAM, Festplatte).
+
+---
+
+### `GET /api/v1/admin/vulnerabilities`
+
+npm-Audit für Sicherheitslücken.
+
+---
+
+### `GET /api/v1/admin/system-packages`
+
+Installierte Systempakete und Updates.
+
+---
+
+### SMTP & OIDC (Admin)
+
+#### `GET /api/v1/smtp-config`
+
+SMTP-Verbindungsdetails anzeigen.
+
+**Auth:** Admin
+
+---
+
+#### `POST /api/v1/smtp-test`
+
+SMTP-Verbindung testen.
+
+**Auth:** Admin
+
+---
+
+#### `GET /api/v1/oidc-config`
+
+OpenID Connect Konfiguration anzeigen.
+
+**Auth:** Admin
+
+---
+
+#### `POST /api/v1/oidc-test`
+
+OIDC-Provider-Verbindung testen.
+
+**Auth:** Admin
+
+---
+
+#### `POST /api/v1/matrix/test`
+
+Matrix-Bot-Verbindung testen.
+
+**Auth:** Admin
+
+---
+
+## 25. Externes Deprovisioning
+
+### `DELETE /api/v1/deprovision/user`
+
+Benutzer extern löschen/anonymisieren (für Kafka/Keycloak-Integration).
+
+**Auth:** Basic Auth (Credentials in System-Settings `deprovision_config` konfiguriert)
+
+**Request Body:**
+```json
+{
+  "email": "user@example.com",
+  "action": "delete"
+}
+```
+
+| Feld | Typ | Pflicht | Beschreibung |
+|---|---|---|---|
+| `email` | String | Eines von dreien | E-Mail des Benutzers |
+| `keycloakId` | String | Eines von dreien | Keycloak-ID |
+| `userId` | Number | Eines von dreien | Interne Benutzer-ID |
+| `action` | String | Nein | `delete` (Standard) oder `anonymize` |
+
+**Response (200 OK):**
+```json
+{
+  "success": true,
+  "message": "Benutzer gelöscht",
+  "userId": 1,
+  "action": "deleted"
+}
+```
+
+**Fehler:**
+- `401`: Nicht autorisiert
+- `404`: Benutzer nicht gefunden
+- `503`: Deprovisioning deaktiviert
+
+---
+
+## 26. Fehlercodes
+
+| HTTP-Status | Bedeutung |
+|---|---|
+| 200 | Erfolg |
+| 201 | Erstellt |
+| 204 | Kein Inhalt (Löschen) |
+| 400 | Ungültige Anfrage / Validierungsfehler |
+| 401 | Nicht authentifiziert (keine/abgelaufene Session) |
+| 403 | Keine Berechtigung (falsche Rolle / nicht verifiziert) |
+| 404 | Ressource nicht gefunden |
+| 409 | Konflikt (z.B. E-Mail bereits vergeben, Login erforderlich) |
+| 422 | Unverarbeitbar (z.B. Virus erkannt) |
+| 429 | Zu viele Anfragen (Rate Limit) |
+| 500 | Interner Serverfehler |
+| 503 | Service nicht verfügbar (z.B. ClamAV offline) |
+
+---
+
+## 27. Rate Limiting – Übersicht
+
+| Endpunkt | Max. Versuche | Zeitfenster | Sperre |
+|---|---|---|---|
+| Login | 5 | 15 Min. | 15 Min. |
+| Registrierung | 5 | 1 Stunde | – |
+| Passwort-Reset | 3 | 15 Min. | – |
+| E-Mail-Check | 10 | 1 Min. | – |
+
+> Rate-Limit-Einstellungen können über die Admin-API dynamisch angepasst werden.
+
+---
+
+## 28. Passwort-Anforderungen
+
+Passwörter müssen folgende Kriterien erfüllen:
+
+- Mindestens 8 Zeichen
+- Mindestens 1 Großbuchstabe (`A-Z`)
+- Mindestens 1 Kleinbuchstabe (`a-z`)
+- Mindestens 1 Ziffer (`0-9`)
+- Mindestens 1 Sonderzeichen (`!@#$%^&*()_+-=[]{};\':\"\\|,.<>/?`~`)
+
+---
+
+## Testaccounts (Pentest)
+
+| Rolle | E-Mail | Passwort |
+|---|---|---|
+| Admin | pentest01@kita.bayern.de | ⚠️ [REDACTED] |
+| Admin | pentest02@kita.bayern.de | ⚠️ [REDACTED] |
+| User | pentest03@kita.bayern.de | ⚠️ [REDACTED] |
+| User | pentest04@kita.bayern.de | ⚠️ [REDACTED] |
+
+> ⚠️ Passwörter vor Einreichung eintragen und sicher übermitteln.
+
+---
+
+## Änderungshistorie
+
+| Datum | Version | Änderung |
+|---|---|---|
+| 2026-03-25 | 2.0 | Vollständige Neufassung basierend auf tatsächlichem Codestand |
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 20cab5ad..b9870198 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -1,8 +1,8 @@
 # Polly Architecture Documentation
 
-**Version:** 2.0  
-**Last Updated:** 2026-01-08  
-**Status:** Pre-Beta (WCAG 2.1 AA Compliant)
+**Version:** 3.0  
+**Last Updated:** 2026-03-25  
+**Status:** Beta
 
 ---
 
@@ -28,18 +28,21 @@
 Polly is a **self-hosted polling and scheduling platform** that supports three distinct poll types:
 
 1. **Schedule Polls** (Terminumfragen) - Find the best date/time with Yes/Maybe/No voting
-2. **Survey Polls** (Umfragen) - Classic polls with text/image options
-3. **Organization Lists** (Orga-Listen) - Slot booking with capacity management
+2. **Survey Polls** (Umfragen) - Classic polls with text/image options and optional free-text answers
+3. **Organization Lists** (Orga-Listen) - Slot booking with capacity management and real-time reservation
 
 ### Key Characteristics
 
 - **Self-Hosted:** No cloud dependencies, full data ownership
-- **Multi-Language:** German & English (extensible via i18next)
-- **Real-Time:** WebSocket-based live updates
-- **GDPR-Compliant:** Privacy-first design with account deletion workflow
+- **Multi-Language:** German & English with system-wide default language setting and per-user preference
+- **Real-Time:** WebSocket-based live updates and fullscreen presentation mode
+- **GDPR-Compliant:** Privacy-first design with account deletion workflow (Art. 17)
 - **WCAG 2.1 AA Compliant:** Accessibility-first for public sector use
 - **Anonymous & Authenticated:** Works for guests and registered users
 - **Enterprise SSO:** Optional Keycloak OIDC integration
+- **AI-Assisted:** Optional AI-powered poll creation and voice input (Whisper transcription)
+- **Calendar Integration:** ICS export, webcal subscription, calendar feed for finalized dates
+- **Email Templates:** Customizable V3 template system with visual builder and dark mode support
 
 ---
 
@@ -48,38 +51,47 @@ Polly is a **self-hosted polling and scheduling platform** that supports three d
 ### 1. Simplicity Over Complexity
 - **Monolithic architecture** (not microservices) for easier deployment
 - Single Docker container for production
-- PostgreSQL as the only database (no Redis required for MVP)
+- PostgreSQL as the only database (no Redis required)
 
 ### 2. Developer Experience
 - **TypeScript everywhere** (frontend + backend)
 - **Shared types** between client and server (`/shared/schema.ts`)
-- **Hot-reload** in development
+- **Hot-reload** in development via Vite
 - **Type-safe database queries** with Drizzle ORM
+- **Zod schema validation** shared between frontend forms and backend routes
 
 ### 3. Performance & Scalability
 - **WebSocket** for real-time updates (scales to ~100 concurrent users per instance)
-- **Database indexing** on critical queries
-- **Row-level locking + Advisory locks** for race condition prevention (slot booking)
+- **Database indexing** on critical queries (polls, votes, tokens)
+- **Row-level locking + Advisory locks** for race condition prevention (Orga-Listen slot booking)
+- **Admin stats caching** (5-minute TTL with background warming)
 
 ### 4. Security First
-- **Server-side validation** with Zod
-- **Session-based authentication** (not JWT for better security)
-- **Rate limiting** on login endpoints (5 failed attempts → 15 min lockout)
-- **XSS prevention** through React auto-escaping
+- **Server-side validation** with Zod schemas
+- **Session-based authentication** (not JWT for better revocation)
+- **Rate limiting** on login (5 attempts → 15 min lockout), registration, password reset, and API endpoints
+- **XSS prevention** through React auto-escaping and `htmlEscape()` for email templates
 - **ClamAV integration** for file upload scanning (optional)
+- **SSRF protection** on logo URL fetching for email embedding
+- **Session fixation prevention** via session regeneration on login/register
+- **Generic error messages** (no `error.message` leaks to client)
+- **Cache-Control `no-store`** on all API responses
+- **Force-password-change** for default admin credentials
 
 ### 5. Accessibility First
 - **WCAG 2.1 AA compliant** by default
 - **Color contrast ratios** meet 4.5:1 minimum
 - **Focus indicators** on all interactive elements
 - **Screen reader compatible** with ARIA labels
+- **Admin WCAG audit** with automated contrast checking and correction suggestions
 - **Admin override** available for corporate design requirements
 
 ### 6. Extensibility
 - **Plugin-ready** i18n system (easy to add new languages)
-- **Customizable theming** via admin panel
+- **Customizable theming** via admin panel (colors, logo, branding, footer)
 - **Modular poll types** (easy to add new types)
-- **Email template editor** with visual builder
+- **Email template editor** with V3 shell, dark mode support, and footer customization
+- **External deprovisioning API** for Keycloak/Kafka integration
 
 ---
 
@@ -87,43 +99,57 @@ Polly is a **self-hosted polling and scheduling platform** that supports three d
 
 ### Frontend
 ```
-React 18           → UI library
-TypeScript         → Type safety
-Vite               → Build tool & dev server
-TanStack Query v5  → Data fetching & caching
-Shadcn/ui          → Component library (Radix UI based)
-Radix UI           → Headless UI primitives
-Tailwind CSS       → Styling
-Wouter             → Lightweight routing
-react-i18next      → Internationalization
-Framer Motion      → Animations
-Recharts           → Charts & visualizations
+React 18            → UI library
+TypeScript          → Type safety
+Vite                → Build tool & dev server
+TanStack Query v5   → Data fetching & caching
+Shadcn/ui           → Component library (Radix UI based)
+Radix UI            → Headless UI primitives
+Tailwind CSS        → Styling
+Wouter              → Lightweight routing
+react-i18next       → Internationalization
+Framer Motion       → Animations
+Recharts            → Charts & visualizations
+react-hook-form     → Form management
+react-markdown      → Markdown rendering
+Embla Carousel      → Carousel / image gallery
+@dnd-kit            → Drag and drop (option reordering)
+cmdk                → Command palette
 ```
 
 ### Backend
 ```
-Node.js 22 LTS     → Runtime
-Express.js         → Web framework
-TypeScript         → Type safety
-Drizzle ORM        → Database queries
-PostgreSQL         → Database (Neon-backed on Replit)
-Passport.js        → Authentication (local + OIDC)
-express-session    → Session management
-connect-pg-simple  → PostgreSQL session store
-ws                 → WebSocket server
-Nodemailer         → Email sending
-Puppeteer          → PDF generation
+Node.js 22 LTS      → Runtime
+Express.js          → Web framework
+TypeScript          → Type safety
+Drizzle ORM         → Database queries
+PostgreSQL          → Database (Neon-backed on Replit)
+Passport.js         → Authentication (local + OIDC)
+express-session     → Session management
+connect-pg-simple   → PostgreSQL session store
+ws                  → WebSocket server
+Nodemailer          → Email sending (SMTP)
+@sendgrid/mail      → Email sending (SendGrid alternative)
+Puppeteer           → PDF generation
+OpenAI SDK          → AI poll creation (GWDG SAIA compatible)
+openid-client       → Keycloak OIDC integration
+matrix-js-sdk       → Matrix chat integration
+bcryptjs            → Password hashing
+multer              → File upload handling
+qrcode              → QR code generation
+nanoid              → Token generation
 ```
 
 ### DevOps
 ```
-Docker             → Containerization
-Docker Compose     → Local development & production
-Playwright         → E2E testing
-axe-core           → Accessibility testing
-Vitest             → Unit testing
-GitHub Actions     → CI/CD
-GitLab CI          → Alternative CI/CD
+Docker              → Containerization
+Docker Compose      → Local development & production
+Playwright          → E2E testing
+axe-core            → Accessibility testing
+Vitest              → Unit & integration testing
+GitHub Actions      → CI/CD (lint, test, build, release)
+GitLab CI           → Alternative CI/CD
+ESLint + Prettier   → Code formatting & linting
 ```
 
 ---
@@ -154,15 +180,16 @@ GitLab CI          → Alternative CI/CD
 │                            │                                │
 │                  ┌─────────▼──────────┐                     │
 │                  │   Business Logic   │                     │
-│                  │   (storage.ts)     │                     │
+│                  │   (storage.ts +    │                     │
+│                  │    services/*.ts)  │                     │
 │                  └─────────┬──────────┘                     │
 │                            │                                │
-│         ┌──────────────────┼──────────────────┐             │
-│         ▼                  ▼                  ▼             │
-│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐     │
-│  │  Nodemailer │    │  Puppeteer  │    │  ClamAV     │     │
-│  │  (Email)    │    │  (PDF)      │    │  (Scanning) │     │
-│  └─────────────┘    └─────────────┘    └─────────────┘     │
+│    ┌───────────┬───────────┼───────────┬───────────┐        │
+│    ▼           ▼           ▼           ▼           ▼        │
+│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐
+│ │Nodemailer│ │Puppeteer│ │ ClamAV  │ │   AI    │ │ Matrix  │
+│ │(Email)   │ │(PDF)    │ │(Scan)   │ │(OpenAI) │ │(Chat)   │
+│ └─────────┘ └─────────┘ └─────────┘ └─────────┘ └─────────┘
 └────────────────────────────┼────────────────────────────────┘
                              │
                     ┌────────▼─────────┐
@@ -175,34 +202,80 @@ GitLab CI          → Alternative CI/CD
                     └──────────────────┘
 ```
 
+### Route Architecture
+
+```
+server/routes/
+├── index.ts        → Route mounting & middleware registration
+├── common.ts       → Shared schemas (Zod), middleware (requireAuth, requireAdmin, extractUserId)
+├── auth.ts         → /api/v1/auth/* (login, register, password reset, email change, OIDC)
+├── polls.ts        → /api/v1/polls/* (CRUD, options, invite, remind, finalize)
+├── votes.ts        → /api/v1/polls/:token/vote*, /api/v1/votes/edit/:editToken
+├── users.ts        → /api/v1/user/profile, /api/v1/users/me/*
+├── admin.ts        → /api/v1/admin/* (users, polls, settings, security, customization, email templates, WCAG, ClamAV, pentest-tools, test runs, GDPR)
+├── export.ts       → /api/v1/polls/:token/export/* (QR, PDF, CSV, ICS), calendar feed
+├── system.ts       → /api/v1/health, /api/v1/customization, /api/v1/theme, /api/v1/upload/image, /api/v1/matrix/*, SMTP/OIDC config
+└── ai.ts           → /api/v1/ai/* (transcribe, create-poll, apply, admin settings)
+```
+
+### Service Architecture
+
+```
+server/services/
+├── authService.ts           → Local + OIDC authentication logic
+├── tokenService.ts          → Bearer token (JWT) validation
+├── emailService.ts          → Email sending (SMTP/SendGrid)
+├── emailTemplateService.ts  → V3 email template rendering & management
+├── liveVotingService.ts     → WebSocket rooms, live updates, presence tracking
+├── icsService.ts            → ICS calendar generation & parsing
+├── pdfService.ts            → PDF report generation (Puppeteer)
+├── qrService.ts             → QR code generation (PNG/SVG)
+├── imageService.ts          → Image upload + ClamAV scanning
+├── clamavService.ts         → ClamAV daemon interface
+├── aiService.ts             → AI-powered poll creation (OpenAI-compatible)
+├── whisperService.ts        → Audio transcription (Whisper + ffmpeg)
+├── matrixService.ts         → Matrix protocol chat integration
+├── rateLimiterService.ts    → Login-specific rate limiting
+├── apiRateLimiterService.ts → General API rate limiting (configurable)
+├── aiRateLimiterService.ts  → AI feature rate limiting
+├── deviceTokenService.ts    → Anonymous voter device token signing
+├── adminCacheService.ts     → Dashboard stats caching (5-min TTL)
+├── npmAuditService.ts       → npm audit vulnerability scanning
+├── pentestToolsService.ts   → Pentest-Tools.com API integration
+├── systemPackageService.ts  → System package monitoring
+└── testRunnerService.ts     → Vitest/Playwright execution from admin UI
+```
+
 ### Request Flow
 
 #### 1. Poll Creation (Authenticated User)
 ```
 User → React Form → POST /api/v1/polls
                     ↓
-                Check Auth (session)
+                Check Auth (session, optional)
                     ↓
-                Validate (Zod)
+                Validate (Zod: createPollSchema)
                     ↓
                 Insert to DB (Drizzle)
                     ↓
-                Generate Tokens (publicToken, adminToken)
+                Generate Tokens (publicToken, adminToken via nanoid)
+                    ↓
+                [Optional] Send Creator Email (adminToken link)
                     ↓
-                Return Poll Data
+                Return { poll, publicToken, adminToken }
                     ↓
-User ← Poll Detail Page
+User ← Poll Success Page (links to share/admin)
 ```
 
 #### 2. Vote Submission (Anonymous or Authenticated)
 ```
 User → React Form → POST /api/v1/polls/:token/vote
                     ↓
-                Validate Input (Zod)
+                Validate Input (Zod: bulkVoteSchema)
                     ↓
-                Check Poll Exists & Active
+                Check Poll Exists & Active & Not Expired
                     ↓
-                Check Poll Not Expired
+                Check Voter Identity (email ownership for logged-in users)
                     ↓
                 [Organization Only] Acquire Advisory Lock
                     ↓
@@ -210,7 +283,7 @@ User → React Form → POST /api/v1/polls/:token/vote
                     ↓
                 Broadcast to WebSocket Clients
                     ↓
-                [Optional] Send Email Confirmation
+                [Optional] Send Email Confirmation (with voterEditToken link)
                     ↓
 User ← Confirmation + Edit Link (voterEditToken)
 ```
@@ -221,7 +294,7 @@ User A votes → Server receives vote
                     ↓
                 WebSocket.broadcast({ type: 'vote_update' })
                     ↓
-User B, C, D... ← Receive update, invalidate cache
+User B, C, D... ← Receive update, invalidate TanStack Query cache
 ```
 
 ---
@@ -235,19 +308,20 @@ User B, C, D... ← Receive update, invalidate cache
 │                          users                               │
 ├─────────────────────────────────────────────────────────────┤
 │ id (serial PK)           │ Primary key                      │
-│ username (text UNIQUE)   │ Display name                     │
+│ username (text UNIQUE)   │ Login name (3-30 chars)           │
 │ email (text UNIQUE)      │ Login identifier                 │
-│ name (text)              │ Full name                        │
-│ role (text)              │ user / admin / manager           │
-│ organization (text)      │ Company/org name                 │
+│ name (text)              │ Full name (1-100 chars)           │
+│ role (text)              │ user / manager / admin            │
+│ organization (text?)     │ Company/org name                 │
 │ passwordHash (text?)     │ bcrypt hash (null for OIDC)      │
-│ keycloakId (text?)       │ OIDC subject ID from Keycloak    │
+│ keycloakId (text? UNIQUE)│ OIDC subject ID from Keycloak    │
 │ provider (text)          │ 'local' or 'keycloak'            │
 │ themePreference (text)   │ light / dark / system            │
 │ languagePreference (text)│ de / en                          │
-│ calendarToken (text?)    │ Secret for ICS subscription      │
+│ emailVerified (boolean)  │ Email address confirmed          │
+│ calendarToken (text? UNI)│ Secret for ICS subscription      │
 │ isTestData (boolean)     │ Test accounts excluded from prod │
-│ isInitialAdmin (boolean) │ First admin created at startup   │
+│ isInitialAdmin (boolean) │ First admin (force pwd change)   │
 │ deletionRequestedAt (ts?)│ GDPR: Account deletion request   │
 │ lastLoginAt (timestamp?) │ Last successful login            │
 │ createdAt (timestamp)    │                                  │
@@ -259,13 +333,13 @@ User B, C, D... ← Receive update, invalidate cache
 │                          polls                               │
 ├─────────────────────────────────────────────────────────────┤
 │ id (UUID PK)             │ Primary key (auto-generated)     │
-│ title (text)             │ Poll title                       │
-│ description (text?)      │ Optional description             │
+│ title (text)             │ Poll title (1-200 chars)          │
+│ description (text?)      │ Optional description (max 5000)  │
 │ type (text)              │ schedule / survey / organization │
 │ userId (int FK?)         │ Creator (null for anonymous)     │
 │ creatorEmail (text?)     │ Email for anonymous polls        │
-│ adminToken (text UNIQUE) │ For owner/admin access           │
-│ publicToken (text UNIQUE)│ For public voting                │
+│ adminToken (text UNIQUE) │ For owner/admin access (hex)     │
+│ publicToken (text UNIQUE)│ For public voting (hex)          │
 │ isActive (boolean)       │ Can receive votes                │
 │ isAnonymous (boolean)    │ Hide voter names                 │
 │ allowAnonymousVoting     │ Guest voting allowed             │
@@ -275,6 +349,7 @@ User B, C, D... ← Receive update, invalidate cache
 │ allowVoteWithdrawal      │ Voters can delete submissions    │
 │ resultsPublic (boolean)  │ Results visible to everyone      │
 │ allowMaybe (boolean)     │ Schedule: show maybe option      │
+│ finalOptionId (int?)     │ Confirmed/finalized option       │
 │ isTestData (boolean)     │ Excluded from production stats   │
 │ expiresAt (timestamp?)   │ Auto-close date                  │
 │ enableExpiryReminder     │ Send reminder before expiry      │
@@ -282,23 +357,28 @@ User B, C, D... ← Receive update, invalidate cache
 │ expiryReminderSent       │ Reminder already sent            │
 │ createdAt (timestamp)    │                                  │
 │ updatedAt (timestamp)    │                                  │
+├─────────────────────────────────────────────────────────────┤
+│ Indexes: user_id, type, is_active, expires_at              │
 └─────────────────────────────────────────────────────────────┘
        │
        │ pollId (FK)
        ▼
 ┌─────────────────────────────────────────────────────────────┐
-│                       pollOptions                            │
+│                       poll_options                           │
 ├─────────────────────────────────────────────────────────────┤
 │ id (serial PK)           │ Primary key                      │
 │ pollId (UUID FK)         │ Parent poll                      │
-│ text (text)              │ Option label                     │
+│ text (text)              │ Option label (1-500 chars)       │
 │ imageUrl (text?)         │ For survey with images           │
 │ altText (text?)          │ Alt text for accessibility       │
 │ startTime (timestamp?)   │ Schedule: slot start time (UTC)  │
 │ endTime (timestamp?)     │ Schedule: slot end time (UTC)    │
 │ maxCapacity (int?)       │ Orga: max signups per slot       │
+│ isFreeText (boolean)     │ Survey: free-text answer field   │
 │ order (int)              │ Display order                    │
 │ createdAt (timestamp)    │                                  │
+├─────────────────────────────────────────────────────────────┤
+│ Indexes: poll_id                                            │
 └─────────────────────────────────────────────────────────────┘
        │
        │ optionId (FK)
@@ -309,74 +389,102 @@ User B, C, D... ← Receive update, invalidate cache
 │ id (serial PK)           │ Primary key                      │
 │ pollId (UUID FK)         │ Parent poll                      │
 │ optionId (int FK)        │ Selected option                  │
-│ voterName (text)         │ Display name                     │
+│ voterName (text)         │ Display name (1-100 chars)       │
 │ voterEmail (text)        │ For confirmation emails          │
 │ userId (int FK?)         │ Logged-in user (null for guests) │
-│ voterKey (text?)         │ Dedup key: "user:123" / "device:x"│
+│ voterKey (text?)         │ Dedup key: "user:123"/"device:x" │
 │ voterSource (text?)      │ "user" or "device"               │
-│ response (text)          │ yes / maybe / no / signup        │
+│ response (text)          │ yes/maybe/no/freetext/signup     │
 │ comment (text?)          │ Optional comment                 │
+│ freeTextAnswer (text?)   │ Survey free-text (max 2000)      │
 │ voterEditToken (text?)   │ Unique token for vote editing    │
+│ isTestData (boolean)     │ Excluded from production stats   │
 │ createdAt (timestamp)    │                                  │
 │ updatedAt (timestamp)    │                                  │
+├─────────────────────────────────────────────────────────────┤
+│ Indexes: poll_id, option_id, voter_email, voter_key,       │
+│          voter_edit_token                                    │
 └─────────────────────────────────────────────────────────────┘
 ```
 
 ### Supporting Tables
 
 ```
-┌───────────────────┐  ┌───────────────────┐  ┌───────────────────┐
-│  systemSettings   │  │  emailTemplates   │  │  notificationLogs │
-├───────────────────┤  ├───────────────────┤  ├───────────────────┤
-│ id (serial PK)    │  │ id (serial PK)    │  │ id (serial PK)    │
-│ key (text UNIQUE) │  │ type (text UNIQUE)│  │ pollId (UUID FK)  │
-│ value (jsonb)     │  │ name (text)       │  │ type (text)       │
-│ description       │  │ subject (text)    │  │ recipientEmail    │
-│ updatedAt         │  │ jsonContent (json)│  │ sentBy            │
-└───────────────────┘  │ htmlContent       │  │ success (boolean) │
-                       │ textContent       │  │ errorMessage      │
-                       │ variables (json)  │  │ createdAt         │
-                       │ isDefault         │  └───────────────────┘
-                       │ isActive          │
+┌───────────────────┐  ┌───────────────────┐  ┌────────────────────┐
+│  system_settings  │  │  email_templates  │  │  notification_logs │
+├───────────────────┤  ├───────────────────┤  ├────────────────────┤
+│ id (serial PK)    │  │ id (serial PK)    │  │ id (serial PK)     │
+│ key (text UNIQUE) │  │ type (text UNIQUE)│  │ pollId (UUID FK)   │
+│ value (jsonb)     │  │ name (text)       │  │ type (text)        │
+│ description       │  │ subject (text)    │  │ recipientEmail     │
+│ updatedAt         │  │ jsonContent (jsonb│  │ sentBy             │
+└───────────────────┘  │ htmlContent (text)│  │ sentByGuest (bool) │
+                       │ textContent (text)│  │ success (boolean)  │
+                       │ variables (jsonb) │  │ errorMessage       │
+                       │ isDefault (bool)  │  │ createdAt          │
+                       │ isActive (bool)   │  └────────────────────┘
                        │ createdAt         │
                        │ updatedAt         │
                        └───────────────────┘
 
-┌───────────────────────┐  ┌───────────────────────┐
-│  passwordResetTokens  │  │  emailChangeTokens    │
-├───────────────────────┤  ├───────────────────────┤
-│ id (serial PK)        │  │ id (serial PK)        │
-│ userId (int FK)       │  │ userId (int FK)       │
-│ token (text UNIQUE)   │  │ newEmail (text)       │
-│ expiresAt (timestamp) │  │ token (text UNIQUE)   │
-│ usedAt (timestamp?)   │  │ expiresAt (timestamp) │
-│ createdAt (timestamp) │  │ usedAt (timestamp?)   │
-└───────────────────────┘  │ createdAt (timestamp) │
+┌───────────────────────┐  ┌───────────────────────┐  ┌───────────────────────┐
+│  password_reset_tokens│  │  email_change_tokens  │  │  email_verification_  │
+├───────────────────────┤  ├───────────────────────┤  │  tokens               │
+│ id (serial PK)        │  │ id (serial PK)        │  ├───────────────────────┤
+│ userId (int FK)       │  │ userId (int FK)       │  │ id (serial PK)        │
+│ token (text UNIQUE)   │  │ newEmail (text)       │  │ userId (int FK)       │
+│ expiresAt (timestamp) │  │ token (text UNIQUE)   │  │ token (text UNIQUE)   │
+│ usedAt (timestamp?)   │  │ expiresAt (timestamp) │  │ expiresAt (timestamp) │
+│ createdAt (timestamp) │  │ usedAt (timestamp?)   │  │ createdAt (timestamp) │
+├───────────────────────┤  │ createdAt (timestamp) │  ├───────────────────────┤
+│ Idx: token, user_id   │  ├───────────────────────┤  │ Idx: token, user_id   │
+└───────────────────────┘  │ Idx: token, user_id   │  └───────────────────────┘
                            └───────────────────────┘
 
-┌───────────────────┐  ┌───────────────────┐  ┌───────────────────┐
-│     testRuns      │  │    testResults    │  │  clamavScanLogs   │
-├───────────────────┤  ├───────────────────┤  ├───────────────────┤
-│ id (serial PK)    │  │ id (serial PK)    │  │ id (serial PK)    │
-│ status (text)     │  │ runId (int FK)    │  │ filename (text)   │
-│ triggeredBy       │  │ testFile (text)   │  │ fileSize (int)    │
-│ totalTests        │  │ testName (text)   │  │ mimeType (text)   │
-│ passed            │  │ category (text)   │  │ scanResult        │
-│ failed            │  │ status (text)     │  │ isInfected        │
-│ skipped           │  │ duration (int)    │  │ virusName         │
-│ duration          │  │ error (text?)     │  │ scannedBy         │
-│ startedAt         │  │ errorStack        │  │ createdAt         │
-│ completedAt       │  │ createdAt         │  └───────────────────┘
-└───────────────────┘  └───────────────────┘
+┌───────────────────┐  ┌───────────────────┐  ┌───────────────────────┐
+│     test_runs     │  │    test_results   │  │  test_configurations  │
+├───────────────────┤  ├───────────────────┤  ├───────────────────────┤
+│ id (serial PK)    │  │ id (serial PK)    │  │ id (serial PK)        │
+│ status (text)     │  │ runId (int FK)    │  │ testId (text UNIQUE)  │
+│ triggeredBy       │  │ testFile (text)   │  │ testFile (text)       │
+│ totalTests        │  │ testName (text)   │  │ testName (text)       │
+│ passed            │  │ category (text)   │  │ testType (text)       │
+│ failed            │  │ status (text)     │  │ category (text)       │
+│ skipped           │  │ duration (int)    │  │ description (text?)   │
+│ duration          │  │ error (text?)     │  │ enabled (boolean)     │
+│ startedAt         │  │ errorStack        │  │ lastStatus (text?)    │
+│ completedAt       │  │ createdAt         │  │ lastRunAt (timestamp?)│
+└───────────────────┘  └───────────────────┘  │ createdAt             │
+                                               │ updatedAt             │
+                                               └───────────────────────┘
+
+┌─────────────────────────┐
+│     clamav_scan_logs    │
+├─────────────────────────┤
+│ id (serial PK)          │
+│ filename (text)         │
+│ fileSize (int)          │
+│ mimeType (text?)        │
+│ scanStatus (text)       │
+│ virusName (text?)       │
+│ errorMessage (text?)    │
+│ actionTaken (text)      │
+│ uploaderUserId (int?)   │
+│ uploaderEmail (text?)   │
+│ requestIp (text?)       │
+│ scanDurationMs (int?)   │
+│ adminNotifiedAt (ts?)   │
+│ createdAt (timestamp)   │
+└─────────────────────────┘
 ```
 
 ### Poll Types & Option Types
 
 | Poll Type | Option Fields | Vote Response | Special Logic |
 |-----------|---------------|---------------|---------------|
-| **Schedule** | startTime, endTime | yes/maybe/no | Best Match Calculation, Calendar Export |
-| **Survey** | text, imageUrl | Single/Multiple Choice | Percentage Calculation |
-| **Organization** | text, maxCapacity | signup + comment | Row-Level Locking, Capacity Enforcement |
+| **Schedule** | startTime, endTime | yes/maybe/no | Best Match Calculation, Calendar Export (ICS), Finalization |
+| **Survey** | text, imageUrl, isFreeText | yes/maybe/no/freetext | Percentage Calculation, Free-Text Answers |
+| **Organization** | text, maxCapacity | signup (→ yes) + comment | Row-Level Locking, Advisory Locks, Capacity Enforcement, Real-Time Slot Updates |
 
 ---
 
@@ -385,15 +493,17 @@ User B, C, D... ← Receive update, invalidate cache
 ### 1. Token-Based Access
 
 Every poll has two tokens:
-- **Public Token:** For sharing (voting + viewing results)
-- **Admin Token:** For owner (editing, deleting, managing)
+- **Public Token (publicToken):** For sharing — voting + viewing results
+- **Admin Token (adminToken):** For owner — editing, deleting, managing, finalizing
 
 Additionally, each vote can have:
-- **Voter Edit Token:** Allows anonymous voters to edit their submission
+- **Voter Edit Token (voterEditToken):** Allows anonymous voters to edit/withdraw their submission
+
+**Owner on Public URL:** When a logged-in poll creator accesses their poll via the public URL, the system detects ownership (`userId` match) and automatically shows all admin features — the same as via the admin URL.
 
-**Why?** 
+**Why?**
 - No login required for basic participation
-- Owner can edit without exposing admin rights
+- Owner can manage without exposing admin token
 - Voters can modify their own votes via unique link
 
 ### 2. Polymorphic Poll Types
@@ -401,31 +511,31 @@ Additionally, each vote can have:
 All three poll types share the same `polls` table but have different `options` structures:
 
 ```typescript
-// Shared Poll Base
 type PollBase = {
-  id: string; // UUID
+  id: string;  // UUID
   title: string;
   type: 'schedule' | 'survey' | 'organization';
   publicToken: string;
   adminToken: string;
+  finalOptionId?: number;  // Set when owner confirms a result
 };
 
-// Type-Specific Options
 type ScheduleOption = {
-  text: string; // Display label (can be auto-formatted)
-  startTime: Date; // UTC
-  endTime?: Date; // UTC
+  text: string;
+  startTime: Date;  // UTC
+  endTime?: Date;   // UTC
 };
 
 type SurveyOption = {
   text: string;
   imageUrl?: string;
-  altText?: string; // Accessibility
+  altText?: string;
+  isFreeText?: boolean;  // Enables free-text answer input
 };
 
 type OrganizationOption = {
   text: string;
-  maxCapacity: number; // 0 = unlimited
+  maxCapacity: number;  // 0 = unlimited
 };
 ```
 
@@ -433,366 +543,178 @@ type OrganizationOption = {
 
 **WebSocket Server** runs alongside Express on `/ws`:
 
-```typescript
-// server/websocket.ts
-wss.on('connection', (ws) => {
-  ws.on('message', (data) => {
-    const msg = JSON.parse(data);
-    
-    if (msg.type === 'join') {
-      // Subscribe to poll updates
-      ws.pollId = msg.pollId;
-    }
-  });
-});
-
-// Broadcast vote update to all clients watching this poll
-function broadcastVoteUpdate(pollId: string, data: any) {
-  wss.clients.forEach((client) => {
-    if (client.pollId === pollId) {
-      client.send(JSON.stringify({ type: 'vote_update', ...data }));
-    }
-  });
-}
-
-// Broadcast slot capacity update (for organization polls)
-function broadcastSlotUpdate(pollId: string, optionId: number, currentCount: number) {
-  wss.clients.forEach((client) => {
-    if (client.pollId === pollId) {
-      client.send(JSON.stringify({ 
-        type: 'slot_update', 
-        optionId, 
-        currentCount 
-      }));
-    }
-  });
-}
-```
-
-**Client subscribes via `useLiveVoting` hook:**
-
-```typescript
-// client/src/hooks/useLiveVoting.ts
-useEffect(() => {
-  const ws = new WebSocket(`wss://${host}/ws`);
-  
-  ws.onopen = () => {
-    ws.send(JSON.stringify({ type: 'join', pollId }));
-  };
+```
+Messages:
+  join     → Subscribe to poll room
+  leave    → Leave poll room
   
-  ws.onmessage = (event) => {
-    const update = JSON.parse(event.data);
-    if (update.type === 'vote_update') {
-      queryClient.invalidateQueries(['poll', pollId]);
-    }
-    if (update.type === 'slot_update') {
-      setLiveSlotUpdates(prev => ({
-        ...prev,
-        [update.optionId]: update.currentCount
-      }));
-    }
-  };
-}, [pollId]);
+Broadcasts:
+  vote_update       → New/changed vote
+  slot_update       → Capacity change (Orga)
+  results_refresh   → Full results invalidation
+  presence_update   → Active participant count
 ```
 
-### 4. Race Condition Prevention (Slot Booking)
-
-**Problem:** Two users booking the last slot simultaneously.
+**Client subscribes via `useLiveVoting` hook** — manages WebSocket connection, presence tracking, and TanStack Query cache invalidation.
 
-**Solution:** PostgreSQL advisory locks + row-level locking
+### 4. Authentication Model
 
-```typescript
-// server/storage.ts
-async function bookSlot(pollId: string, optionId: number, voterEmail: string) {
-  return await db.transaction(async (tx) => {
-    // Acquire advisory lock based on poll + voter email
-    // Prevents same user from double-booking simultaneously
-    const lockKey = hashToInt(`${pollId}:${voterEmail}`);
-    await tx.execute(sql`SELECT pg_advisory_xact_lock(${lockKey})`);
-    
-    // Lock the option row
-    const [slot] = await tx
-      .select()
-      .from(pollOptions)
-      .where(eq(pollOptions.id, optionId))
-      .for('update'); // Row-level lock
-    
-    // Count current bookings
-    const [{ count }] = await tx
-      .select({ count: sql<number>`count(*)` })
-      .from(votes)
-      .where(and(
-        eq(votes.optionId, optionId),
-        eq(votes.response, 'signup')
-      ));
-    
-    // Check capacity
-    if (slot.maxCapacity && count >= slot.maxCapacity) {
-      throw new Error('SLOT_FULL');
-    }
-    
-    // Check if already signed up
-    const existing = await tx.select().from(votes)
-      .where(and(
-        eq(votes.pollId, pollId),
-        eq(votes.voterEmail, voterEmail)
-      ));
-    
-    if (existing.length > 0 && !poll.allowMultipleSlots) {
-      throw new Error('ALREADY_SIGNED_UP');
-    }
-    
-    // Insert vote
-    await tx.insert(votes).values({ 
-      pollId, 
-      optionId, 
-      voterEmail,
-      response: 'signup' 
-    });
-    
-    // Broadcast update
-    broadcastSlotUpdate(pollId, optionId, count + 1);
-  });
-}
-```
-
-**Why Advisory Locks + FOR UPDATE?**
-- Advisory lock prevents same user from racing against themselves
-- Row-level lock prevents different users from overbooking
-- Both release automatically when transaction commits
-- Returns clear error codes: `SLOT_FULL` (409) or `ALREADY_SIGNED_UP` (409)
+```
+                    ┌──────────────────┐
+                    │   extractUserId  │
+                    │   middleware     │
+                    └────────┬─────────┘
+                             │
+                    ┌────────┴────────┐
+                    │                 │
+            ┌───────▼──────┐  ┌──────▼───────┐
+            │ Session Cookie│  │ Bearer Token │
+            │ (polly.sid)  │  │ (Keycloak)   │
+            └──────────────┘  └──────────────┘
+
+Middleware chain:
+  extractUserId    → Checks session OR Bearer token
+  requireAuth      → Ensures user is authenticated
+  requireAdmin     → Ensures admin role
+  requireEmailVerified → Ensures email is verified
+```
+
+**Session Management:**
+- Store: PostgreSQL (`connect-pg-simple`) or MemoryStore (fallback)
+- Cookie: `polly.sid`, HttpOnly, SameSite=Lax, Secure=auto
+- Expiry: 24 hours
+- Role-based idle timeout: Admin 8h, Manager 4h, User 1h
+- Session regeneration on login/register (session fixation prevention)
 
 ---
 
 ## Feature Architecture
 
-### 1. Authentication System
+### Email Template System (V3)
 
 ```
-┌─────────────────────────────────────────────────────────────┐
-│                  Authentication Flow                         │
-├─────────────────────────────────────────────────────────────┤
-│                                                              │
-│  ┌────────────┐     ┌────────────┐     ┌────────────┐      │
-│  │   Local    │     │  Keycloak  │     │ Anonymous  │      │
-│  │   Login    │     │   OIDC     │     │   Token    │      │
-│  └─────┬──────┘     └─────┬──────┘     └─────┬──────┘      │
-│        │                  │                   │             │
-│        ▼                  ▼                   ▼             │
-│  ┌──────────────────────────────────────────────────────┐  │
-│  │               Passport.js Strategies                  │  │
-│  │  • passport-local (email/password + bcrypt)          │  │
-│  │  • openid-client (Keycloak/OIDC)                     │  │
-│  └──────────────────────────────────────────────────────┘  │
-│                          │                                  │
-│                          ▼                                  │
-│  ┌──────────────────────────────────────────────────────┐  │
-│  │               express-session                         │  │
-│  │  • Store: PostgreSQL (connect-pg-simple)             │  │
-│  │  • Cookie: polly.sid (httpOnly, secure='auto')       │  │
-│  │  • TTL: Configurable (default 24h)                   │  │
-│  └──────────────────────────────────────────────────────┘  │
-│                          │                                  │
-│                          ▼                                  │
-│  ┌──────────────────────────────────────────────────────┐  │
-│  │           Rate Limiting (Login Protection)            │  │
-│  │  • 5 failed attempts → 15 min lockout per IP/email   │  │
-│  │  • In-memory store (Redis recommended for prod)      │  │
-│  └──────────────────────────────────────────────────────┘  │
-│                                                              │
-└─────────────────────────────────────────────────────────────┘
+Template Rendering Pipeline:
+  1. Load template by type from DB
+  2. Check isDefault → use V3 body builder OR custom htmlContent
+  3. Wrap in v3Shell() (beige outer, white card, compact header)
+  4. Substitute {{VARIABLE}} placeholders
+  5. Apply htmlEscape() on user-supplied variables
+  6. Embed logo as base64 data URI (5-min cache)
+  7. Apply ensureButtonTextContrast() for button accessibility
+  8. Load centralized footer from getEmailFooter()
+  9. Render footer markup ({{link:URL|Label}} syntax)
+  10. Generate plain-text version via stripFooterMarkupToText()
 ```
 
-**User Roles:**
-| Role | Permissions |
-|------|-------------|
-| `user` | Create polls, vote, view own polls |
-| `manager` | + View all polls in organization |
-| `admin` | + System settings, user management, email templates |
+**Template Types:** `poll_created`, `invitation`, `vote_confirmation`, `reminder`, `password_reset`, `email_change`, `password_changed`, `welcome`, `test_report`, `poll_finalized`
 
-### 2. Email System
+### Calendar Integration
 
-```
-┌─────────────────────────────────────────────────────────────┐
-│                    Email Architecture                        │
-├─────────────────────────────────────────────────────────────┤
-│                                                              │
-│  ┌────────────────────────────────────────────────────────┐ │
-│  │              Email Template Editor (Admin)              │ │
-│  │  • Visual builder (@usewaypoint/email-builder)         │ │
-│  │  • JSON storage in database                            │ │
-│  │  • Variable substitution ({pollTitle}, {voterName})    │ │
-│  │  • Preview & test functionality                        │ │
-│  └────────────────────────────────────────────────────────┘ │
-│                          │                                   │
-│                          ▼                                   │
-│  ┌────────────────────────────────────────────────────────┐ │
-│  │              Email Service (Nodemailer)                 │ │
-│  │  • SMTP transport (configurable)                       │ │
-│  │  • SendGrid integration (optional)                     │ │
-│  │  • HTML + plain text versions                          │ │
-│  └────────────────────────────────────────────────────────┘ │
-│                          │                                   │
-│                          ▼                                   │
-│  ┌────────────────────────────────────────────────────────┐ │
-│  │              Notification Logs (Audit)                  │ │
-│  │  • All sent emails logged to database                  │ │
-│  │  • Rate limiting: Max 10 emails per poll per day       │ │
-│  │  • Success/failure tracking                            │ │
-│  └────────────────────────────────────────────────────────┘ │
-│                                                              │
-└─────────────────────────────────────────────────────────────┘
-```
+- **ICS Export:** Download calendar file for finalized poll dates (only available after finalization)
+- **ICS Feed (webcal):** Subscribe to personal calendar feed with all participated polls
+- **Finalization:** Owner confirms a poll option → optionally closes poll + notifies participants with ICS attachment
+- **Empty ICS Protection:** Backend returns 400 error if options have no valid date/time values
 
-**Email Template Types:**
-- `poll_created` - Sent to creator after poll creation
-- `invitation` - Invite participants to vote
-- `vote_confirmation` - Confirm vote submission
-- `reminder` - Manual reminder from poll creator
-- `expiry_reminder` - Automatic reminder before poll expires
-- `password_reset` - Password reset link
-- `email_change` - Email change confirmation
-- `password_changed` - Password change notification
-- `test_report` - Automated test results (admin)
+### AI Features (Optional)
 
-### 3. Calendar Integration
+Requires `AI_API_KEY` environment variable. Auto-enabled unless admin disables.
 
-```
-┌─────────────────────────────────────────────────────────────┐
-│                  Calendar Architecture                       │
-├─────────────────────────────────────────────────────────────┤
-│                                                              │
-│  Schedule Polls ──────────────────────────────────────────► │
-│                                                              │
-│  ┌────────────────┐    ┌────────────────┐                   │
-│  │  ICS Download  │    │  webcal://     │                   │
-│  │  (One-time)    │    │  Subscription  │                   │
-│  └───────┬────────┘    └───────┬────────┘                   │
-│          │                     │                             │
-│          ▼                     ▼                             │
-│  ┌────────────────────────────────────────────────────────┐ │
-│  │              ICS Generator                              │ │
-│  │  • VEVENT for each option with votes                   │ │
-│  │  • VTIMEZONE for correct timezone handling             │ │
-│  │  • UID based on pollId + optionId                      │ │
-│  │  • ATTENDEE list from vote responses                   │ │
-│  └────────────────────────────────────────────────────────┘ │
-│                                                              │
-│  Subscription Feed:                                          │
-│  • User-specific calendarToken for authentication           │
-│  • Auto-updates when polls change                           │
-│  • Shows all user's schedule polls with voted dates         │
-│                                                              │
-└─────────────────────────────────────────────────────────────┘
-```
+- **Poll Creation Assistant:** Natural language → structured poll suggestion via OpenAI-compatible API
+- **Voice Input (Whisper):** Microphone recording → audio transcription → text input
+- **Admin Controls:** Enable/disable, usage quotas, model selection
 
-### 4. PDF Export
+### Admin Panel
 
 ```
-┌─────────────────────────────────────────────────────────────┐
-│                   PDF Export Architecture                    │
-├─────────────────────────────────────────────────────────────┤
-│                                                              │
-│  GET /api/v1/polls/admin/:token/export/pdf                  │
-│                          │                                   │
-│                          ▼                                   │
-│  ┌────────────────────────────────────────────────────────┐ │
-│  │              HTML Template Rendering                    │ │
-│  │  • Server-side React rendering                         │ │
-│  │  • Full CSS styling (matching app theme)               │ │
-│  │  • Charts and visualizations (Recharts)                │ │
-│  │  • QR code for poll link                               │ │
-│  └────────────────────────────────────────────────────────┘ │
-│                          │                                   │
-│                          ▼                                   │
-│  ┌────────────────────────────────────────────────────────┐ │
-│  │              Puppeteer (Headless Chrome)                │ │
-│  │  • page.setContent(html)                               │ │
-│  │  • page.pdf({ format: 'A4' })                          │ │
-│  │  • High-quality vector output                          │ │
-│  └────────────────────────────────────────────────────────┘ │
-│                          │                                   │
-│                          ▼                                   │
-│  ┌────────────────────────────────────────────────────────┐ │
-│  │              PDF Response                               │ │
-│  │  • Content-Type: application/pdf                       │ │
-│  │  • Content-Disposition: attachment                     │ │
-│  └────────────────────────────────────────────────────────┘ │
-│                                                              │
-└─────────────────────────────────────────────────────────────┘
+client/src/pages/admin.tsx
+└── Admin Panel Tabs:
+    ├── OverviewPanel.tsx        → Stats, system health, recent activity
+    ├── UsersPanel.tsx           → User CRUD, role management, email verification
+    ├── PollsPanel.tsx           → All polls, moderation, deletion
+    ├── CustomizePanel.tsx       → Branding, theme, footer, language, Matrix, email templates
+    ├── SettingsPanel.tsx        → Security, rate limits, session timeout, calendar, ClamAV, AI
+    ├── MonitoringPanel.tsx      → System status, npm audit, system packages, pentest tools
+    ├── TestsPanel.tsx           → Test runner, test history, data cleanup
+    └── DeletionRequestsPanel   → GDPR Art. 17 deletion queue
 ```
 
----
-
-## Security Architecture
-
-### 1. Authentication & Authorization
-
-| Layer | Implementation |
-|-------|----------------|
-| Password Storage | bcrypt (cost factor 10) |
-| Session Storage | PostgreSQL (connect-pg-simple) |
-| Session Cookie | httpOnly, secure='auto', sameSite=lax |
-| Rate Limiting | 5 attempts / 15 min lockout (per IP + email) |
-| OIDC | Keycloak (OpenID Connect, optional) |
-
-### 2. Input Validation
+### Frontend Page Architecture
 
-```typescript
-// All API inputs validated with Zod schemas
-// Example: Vote submission
-const voteSchema = z.object({
-  optionId: z.number().positive(),
-  voterName: z.string().min(1).max(100),
-  voterEmail: z.string().email(),
-  response: z.enum(['yes', 'maybe', 'no', 'signup']),
-  comment: z.string().max(500).optional()
-});
-
-// Middleware applies validation
-app.post('/api/v1/polls/:token/vote', 
-  validateBody(voteSchema),
-  async (req, res) => { ... }
-);
+```
+client/src/pages/
+├── home.tsx              → Landing page with AI chat + quick-start
+├── login.tsx             → Combined login + registration
+├── poll.tsx              → Main poll view (vote, results, live, tools)
+├── my-polls.tsx          → User dashboard (active/archived polls)
+├── create-poll.tsx       → Schedule poll creation
+├── create-survey.tsx     → Survey creation
+├── create-organization.tsx → Organization list creation
+├── poll-success.tsx      → Post-creation success page
+├── vote-success.tsx      → Post-voting confirmation
+├── vote-edit.tsx         → Edit/withdraw existing votes
+├── profile.tsx           → User profile & security settings
+├── admin.tsx             → Admin dashboard
+├── confirm-email.tsx     → Email verification handler
+├── forgot-password.tsx   → Password recovery request
+├── reset-password.tsx    → Password reset form
+└── not-found.tsx         → 404 page
 ```
 
-### 3. File Upload Security
+### Context Providers
 
 ```
-┌─────────────────────────────────────────────────────────────┐
-│                 File Upload Security                         │
-├─────────────────────────────────────────────────────────────┤
-│                                                              │
-│  Upload Request ─────────────────────────────────────────►  │
-│                                                              │
-│  ┌────────────────┐                                         │
-│  │  Multer        │  • memoryStorage (no disk write)        │
-│  │  (Middleware)  │  • File size limit: 5MB                 │
-│  │                │  • Allowed types: image/*, pdf          │
-│  └───────┬────────┘                                         │
-│          │                                                   │
-│          ▼                                                   │
-│  ┌────────────────┐                                         │
-│  │  ClamAV Scan   │  • On-the-fly virus scanning           │
-│  │  (Optional)    │  • Reject infected files (HTTP 422)    │
-│  │                │  • Log all scans to database            │
-│  └───────┬────────┘                                         │
-│          │                                                   │
-│          ▼                                                   │
-│  ┌────────────────┐                                         │
-│  │  Storage       │  • Save to /uploads directory          │
-│  │                │  • Generate unique filename             │
-│  └────────────────┘                                         │
-│                                                              │
-└─────────────────────────────────────────────────────────────┘
+client/src/contexts/
+├── AuthContext.tsx          → User session, login/logout, auth methods
+├── CustomizationContext.tsx → Dynamic CSS variables, branding, system language
+└── ThemeContext.tsx         → Light/Dark/System theme management
 ```
 
-### 4. Security Scanning (Admin)
+---
+
+## Security Architecture
 
-- **npm audit**: Dependency vulnerability scanning
-- **ClamAV**: File upload malware detection
-- **Pentest-Tools.com**: External vulnerability scanning (optional, requires API key)
-- **System packages**: Nix package version monitoring
+### Rate Limiting
+
+| Endpoint | Max Attempts | Window | Lockout |
+|----------|-------------|--------|---------|
+| Login | 5 | 15 min | 15 min (IP + account) |
+| Registration | 5 | 1 hour | – |
+| Password Reset | 3 | 15 min | – |
+| Email Check | 10 | 1 min | – |
+| AI Features | Role-based | Configurable | – |
+| Voting | Configurable | Configurable | – |
+
+All rate limit settings are dynamically configurable via Admin API.
+
+### Password Requirements
+
+- Minimum 8 characters
+- At least 1 uppercase letter (A-Z)
+- At least 1 lowercase letter (a-z)
+- At least 1 digit (0-9)
+- At least 1 special character
+
+### Security Hardening
+
+- `X-Powered-By` disabled
+- `Cache-Control: no-store` on all API responses
+- JSON body limit: 1MB
+- Field-level input length validation (voter names 100, option text 500, description 5000, email 254)
+- `autocomplete="off"` on all password fields
+- Generic error messages (no stack traces or `error.message` leaks)
+- Content Security Policy (CSP) headers
+- HSTS in production
+- X-Frame-Options for clickjacking prevention
+- Permissions-Policy for browser feature restriction
+- SSRF-safe URL validation for logo fetching (only http/https protocols)
+- XSS-safe data URI validation for embedded logos
+
+### GDPR Compliance
+
+- Account deletion request flow (Art. 17)
+- Admin approval/rejection queue
+- External deprovisioning API (Basic Auth, for Keycloak/Kafka)
+- `anonymize` option (preserve data, remove identity)
 
 ---
 
@@ -800,157 +722,200 @@ app.post('/api/v1/polls/:token/vote',
 
 ### Docker Deployment
 
-```yaml
-# docker-compose.yml
-version: '3.8'
-
-services:
-  polly:
-    build: .
-    ports:
-      - "3000:5000"
-    environment:
-      - DATABASE_URL=postgresql://...
-      - SESSION_SECRET=...
-      - SMTP_HOST=...
-    depends_on:
-      - db
-    restart: unless-stopped
-
-  db:
-    image: postgres:16
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_DB=polly
-      - POSTGRES_USER=polly
-      - POSTGRES_PASSWORD=...
-    restart: unless-stopped
-
-volumes:
-  postgres_data:
-```
-
-### Environment Variables
+```
+┌──────────────────────────────────┐
+│         Docker Container         │
+│  ┌────────────────────────────┐  │
+│  │      Node.js Server       │  │
+│  │  (Express + Vite SSR)     │  │
+│  │  Port: 3080 (internal)    │  │
+│  └────────────┬───────────────┘  │
+│               │                  │
+│  ┌────────────▼───────────────┐  │
+│  │   docker-entrypoint.sh    │  │
+│  │   - Wait for PostgreSQL   │  │
+│  │   - Run ensureSchema.ts   │  │
+│  │   - Seed admin user       │  │
+│  │   - Start server          │  │
+│  └────────────────────────────┘  │
+└──────────────────────────────────┘
+         │
+         │ DATABASE_URL
+         ▼
+┌──────────────────────────────────┐
+│        PostgreSQL (external)     │
+└──────────────────────────────────┘
+```
+
+### Key Environment Variables
 
 | Variable | Required | Description |
 |----------|----------|-------------|
 | `DATABASE_URL` | Yes | PostgreSQL connection string |
-| `SESSION_SECRET` | Yes | Random 32+ char secret |
-| `SMTP_HOST` | No | SMTP server hostname |
-| `SMTP_PORT` | No | SMTP port (default 587) |
+| `SESSION_SECRET` | Yes | Session encryption key |
+| `APP_URL` | Yes | Public URL (for emails, OIDC redirects) |
+| `SMTP_HOST` | No | SMTP server for emails |
+| `SMTP_PORT` | No | SMTP port |
 | `SMTP_USER` | No | SMTP username |
-| `SMTP_PASSWORD` | No | SMTP password |
-| `SMTP_FROM` | No | Sender email address |
-| `KEYCLOAK_ISSUER` | No | Keycloak realm URL |
+| `SMTP_PASS` | No | SMTP password |
+| `SENDGRID_API_KEY` | No | SendGrid API key (alternative to SMTP) |
+| `KEYCLOAK_REALM_URL` | No | Keycloak OIDC realm URL |
 | `KEYCLOAK_CLIENT_ID` | No | OIDC client ID |
 | `KEYCLOAK_CLIENT_SECRET` | No | OIDC client secret |
-| `CLAMAV_HOST` | No | ClamAV daemon host |
-| `CLAMAV_PORT` | No | ClamAV daemon port |
+| `AI_API_KEY` | No | OpenAI-compatible API key |
+| `AI_API_URL` | No | AI endpoint URL |
+| `HIDE_LOGIN_FORM` | No | Hide local login when SSO is primary |
+| `ADMIN_USERNAME` | No | Initial admin username (seed) |
+| `ADMIN_EMAIL` | No | Initial admin email (seed) |
+| `ADMIN_PASSWORD` | No | Initial admin password (seed) |
+
+### Schema Management
+
+Schema changes involve updating `shared/schema.ts` and `server/scripts/ensureSchema.ts`. The `ensureSchema.ts` script automatically adds missing columns, tables, and indexes on startup — no manual migration needed.
 
 ---
 
-## Architecture Decision Records (ADRs)
+## Architecture Decision Records
 
 ### ADR-001: Monolithic Architecture
 
-**Decision:** Single application (not microservices)
+**Status:** Accepted  
+**Context:** Polly serves teams of 10-500 users, typically self-hosted.
 
-**Context:** Polly is designed for small-medium teams (10-1000 users)
+**Decision:** Single Node.js process serving both frontend and API.
 
 **Consequences:**
-- ✅ Simple deployment (one Docker container)
-- ✅ Easier debugging
-- ✅ Lower operational overhead
-- ❌ Harder to scale horizontally (future consideration)
+- ✅ Single Docker container deployment
+- ✅ Shared TypeScript types between frontend and backend
+- ✅ Simple WebSocket integration (same process)
+- ❌ Vertical scaling only (single instance)
+
+---
 
-### ADR-002: PostgreSQL as Single Database
+### ADR-002: PostgreSQL as Sole Datastore
 
-**Decision:** Use PostgreSQL for everything (data, sessions, advisory locks)
+**Status:** Accepted  
+**Context:** Need reliable storage for polls, votes, sessions, and settings.
 
-**Context:** Reduces operational complexity
+**Decision:** PostgreSQL for everything — application data, sessions (`connect-pg-simple`), and system settings.
 
 **Consequences:**
-- ✅ Single backup strategy
-- ✅ Transactional guarantees across all data
-- ✅ Built-in row-level locking
-- ❌ May need Redis for high-traffic scenarios (caching, rate limiting)
+- ✅ Single dependency to manage
+- ✅ ACID transactions for slot booking
+- ✅ JSONB for flexible settings storage
+- ❌ No built-in caching (in-memory admin cache as workaround)
 
-### ADR-003: Session-Based Authentication (not JWT)
+---
+
+### ADR-003: Token-Based Poll Access
 
-**Decision:** Use server-side sessions instead of JWT
+**Status:** Accepted  
+**Context:** Polls need to be shareable without requiring authentication.
 
-**Context:** Better security for stateful applications
+**Decision:** Each poll gets a `publicToken` (sharing) and `adminToken` (management). Votes get an optional `voterEditToken`. Logged-in owners see admin features on public URL.
 
 **Consequences:**
-- ✅ Immediate logout (session invalidation)
-- ✅ No token in localStorage (XSS protection)
-- ✅ Server-controlled session lifetime
-- ❌ Requires sticky sessions for horizontal scaling
+- ✅ Anonymous participation (no account required)
+- ✅ Simple URL sharing
+- ✅ Owner convenience (admin features visible on any URL when logged in)
+- ❌ Token compromise = full access (mitigated by separate public/admin tokens)
 
-### ADR-004: UUID for Poll IDs
+---
+
+### ADR-004: WebSocket for Real-Time Updates
 
-**Decision:** Use UUID instead of sequential integers for poll IDs
+**Status:** Accepted  
+**Context:** Organization polls need instant capacity updates to prevent overbooking.
 
-**Context:** Prevent enumeration attacks, enable URL-based access
+**Decision:** Native WebSocket server (`ws` library) alongside Express.
 
 **Consequences:**
-- ✅ Non-guessable poll URLs
-- ✅ Distributed ID generation
-- ✅ No need for separate token columns
-- ❌ Larger storage, slower indexing
+- ✅ Sub-second updates for slot booking
+- ✅ Live voting presentation mode
+- ✅ Presence tracking (active participant count)
+- ❌ Requires sticky sessions for horizontal scaling
 
-### ADR-005: Row-Level Locking for Slot Booking
+---
+
+### ADR-005: V3 Email Template System
 
-**Decision:** Use PostgreSQL `SELECT ... FOR UPDATE` + advisory locks
+**Status:** Accepted  
+**Context:** Need customizable, branded emails that work across email clients and support dark mode.
 
-**Context:** Prevent overbooking in organization polls
+**Decision:** Server-side HTML rendering with V3 shell template, `{{VARIABLE}}` substitution, centralized footer, and base64-embedded logos.
 
 **Consequences:**
-- ✅ Correct capacity enforcement
-- ✅ Simple to implement with Drizzle
-- ❌ Slightly slower than optimistic locking
-- ✅ Correctness > performance for booking use case
+- ✅ Consistent branding across all email types
+- ✅ Admin can customize templates via visual builder
+- ✅ Dark mode support via `@media (prefers-color-scheme: dark)`
+- ✅ XSS-safe variable substitution
+- ❌ Complex rendering pipeline
 
-### ADR-006: WCAG 2.1 AA by Default
+---
 
-**Decision:** Ship with accessibility compliance enabled, allow admin override
+### ADR-006: WCAG 2.1 AA Default Compliance
 
-**Context:** Public sector requirements in Germany (BITV 2.0, EU Directive 2016/2102)
+**Status:** Accepted  
+**Context:** Public sector deployment requires accessibility compliance.
 
-**Implementation:**
+**Decision:** Ship with WCAG AA compliant color scheme by default. Admin can override for corporate branding (takes responsibility for compliance).
 
 1. **Default Mode (`enforceDefaultTheme: true`):**
    - System ships with WCAG AA compliant color scheme
-   - Default primary color: `#7A3800` (4.5:1 contrast with white)
-   - E2E tests enforce zero critical/serious violations
+   - Automated color contrast audit in admin panel
 
 2. **Custom Mode (`enforceDefaultTheme: false`):**
-   - Auto-enabled when admin customizes theme colors in Admin Panel → Anpassen
+   - Auto-enabled when admin customizes theme colors
    - Admin takes responsibility for accessibility compliance
-   - E2E tests log warning but don't fail on contrast issues
 
-3. **Environment Override:**
-   - Set `POLLY_WCAG_OVERRIDE=true` to disable default theme without UI changes
-   - Useful for custom corporate branding in self-hosted instances
-
-4. **API Endpoint:**
+3. **API Endpoint:**
    - `GET /api/v1/settings/accessibility` returns current compliance mode
-   - Used by E2E tests and frontend to determine enforcement level
-
-5. **axe-core Limitation:**
-   - `color-contrast` rule excluded from E2E tests (false positives with CSS variables)
-   - Manual verification of all color combinations documented in `index.css`
 
 **Consequences:**
 - ✅ Meets public sector accessibility requirements out of the box
-- ✅ Better UX for all users
 - ✅ Admin can override for corporate branding
 - ✅ Clear responsibility handoff when colors are customized
 - ❌ More restrictive color choices by default
 
 ---
 
+### ADR-007: System-Wide Default Language
+
+**Status:** Accepted  
+**Context:** Anonymous visitors should see the admin-configured language, not browser-detected.
+
+**Decision:** System-wide `defaultLanguage` setting in customization. i18n loads system language from `/api/v1/system/language` on startup. Per-user language preference overrides system default for logged-in users.
+
+**Consequences:**
+- ✅ Consistent experience for anonymous visitors
+- ✅ Admin controls default language
+- ✅ Per-user preference still works
+- ❌ Extra API call on app initialization
+
+---
+
+## API Documentation
+
+- **REST API Reference:** `docs/API-DOCUMENTATION.md` — Complete endpoint documentation with schemas, auth requirements, and error codes. **Must be updated when API changes.**
+- **OpenAPI Spec:** `docs/openapi.yaml` — Machine-readable API specification for Flutter/Mobile integration.
+- **Flutter Integration:** `docs/FLUTTER_INTEGRATION.md` — Mobile app integration guide.
+- **Self-Hosting Guide:** `docs/SELF-HOSTING.md` — Docker/Production deployment instructions.
+
+---
+
+## Test Coverage (454+ tests)
+
+- **API**: 174 tests (admin CRUD, user profile/theme/language, poll CRUD/voting/export, email templates, security, validation)
+- **Auth**: 55 tests (login, registration, password reset, session persistence, cookie security)
+- **Polls**: 30 tests (CRUD, voting, finalize, types)
+- **Data/Storage**: 40 tests (settings, branding, storage, test data)
+- **Unit**: 34 tests (validation, token service, QR service)
+- **Services**: 132+ tests (email templates 63, email integration 13, live voting WebSocket multi-user 19, image upload file types 16, ClamAV, ICS, PDF, WCAG audit)
+- **Security**: 31 tests (WebSocket presenter escalation, poll token validation, email HTML escaping/XSS, deprovision Basic Auth, timing attack resistance)
+- **E2E/Integration**: 49 tests (poll flow, multi-voter, Docker build, deployment readiness, DB migration)
+
+---
+
 ## Future Considerations
 
 ### Potential Enhancements
@@ -984,24 +949,8 @@ volumes:
 
 ---
 
-## API Documentation
-
-- **OpenAPI Spec:** `docs/openapi.yaml`
-- **Flutter Integration:** `docs/FLUTTER_INTEGRATION.md`
-- **Self-Hosting Guide:** `docs/SELF-HOSTING.md`
-
----
-
-## Questions & Feedback
-
-For architecture discussions, open an issue on GitHub/GitLab:
-- 🐛 Bug reports: `architecture:bug` label
-- 💡 Feature requests: `architecture:enhancement` label
-- 🤔 Questions: `architecture:question` label
-
----
-
 **Maintained by:** @manfredsteger  
 **Version History:**
-- v2.0 (2026-01-08): Updated to current implementation, added WCAG, security scanning, calendar integration
-- v1.0 (2026-01-05): Initial architecture documentation
+- v3.0 (2026-03-25): Complete rewrite to match actual codebase. Added all tables (email_verification_tokens, test_configurations), corrected clamav_scan_logs schema, added finalOptionId/isFreeText/freeTextAnswer/emailVerified fields, updated service/route/component listings, added ADR-007 (system language), updated security architecture, added calendar/ICS and AI feature documentation.
+- v2.0 (2026-01-08): Updated to current implementation, added WCAG, security scanning, calendar integration.
+- v1.0 (2026-01-05): Initial architecture documentation.
diff --git a/docs/FLUTTER_INTEGRATION.md b/docs/FLUTTER_INTEGRATION.md
index 17cfaa5e..f7d8c384 100644
--- a/docs/FLUTTER_INTEGRATION.md
+++ b/docs/FLUTTER_INTEGRATION.md
@@ -597,6 +597,70 @@ Bild für Umfrage-Optionen hochladen.
 
 ---
 
+## 9. AI-Assistent (Optional)
+
+> **Voraussetzung:** Der AI-Assistent muss serverseitig konfiguriert sein.
+> Folgende Umgebungsvariablen werden benötigt:
+> - `AI_API_URL` — OpenAI-kompatible API-URL (optional, Standard: GWDG SAIA)
+> - `AI_API_KEY` — API-Schlüssel (wird serverseitig gespeichert, nie an Clients übermittelt)
+> - `AI_API_KEY_FALLBACK` — Fallback-Schlüssel bei Rate-Limiting (optional)
+> - `AI_MODEL` — Modellname (optional, Standard: `llama-3.3-70b-instruct`)
+>
+> Prüfe mit `GET /api/v1/ai/status` ob der Assistent aktiv ist, bevor AI-Features im Client angezeigt werden.
+
+### GET /api/v1/ai/status
+Prüft ob der AI-Assistent verfügbar ist.
+
+**Response:**
+```json
+{
+  "enabled": true,
+  "apiConfigured": true,
+  "model": "llama-3.3-70b-instruct"
+}
+```
+
+### POST /api/v1/ai/create-poll
+Umfrage-Vorschlag aus natürlicher Sprache erstellen.
+
+**Request:**
+```json
+{
+  "message": "Erstelle eine Terminumfrage für nächste Woche",
+  "conversationHistory": []
+}
+```
+
+**Response:**
+```json
+{
+  "suggestion": {
+    "pollType": "schedule",
+    "title": "Team Meeting",
+    "description": "...",
+    "options": ["Montag 10:00 - 11:00", "Dienstag 14:00 - 15:00"],
+    "settings": { "resultsPublic": true, "allowMaybe": true }
+  }
+}
+```
+
+### POST /api/v1/ai/transcribe
+Audio zu Text transkribieren (Spracheingabe).
+
+**Request:** `multipart/form-data`
+- `audio` - Die Audio-Datei
+
+**Response:**
+```json
+{
+  "success": true,
+  "text": "Transcribed text...",
+  "language": "de"
+}
+```
+
+---
+
 ## Fehler-Codes
 
 Die API verwendet einheitliche Fehler-Codes für Mobile-Handling:
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 17dac83c..3f85e056 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -19,6 +19,8 @@ Für automatisches Tag-Mirroring zu GitLab:
 |--------|-------------|
 | `GITLAB_TOKEN` | GitLab Personal Access Token mit `write_repository` Berechtigung |
 
+---
+
 ## Release erstellen
 
 ### Automatisch (empfohlen)
@@ -26,15 +28,23 @@ Für automatisches Tag-Mirroring zu GitLab:
 Der Release-Prozess wird über Git-Tags gesteuert. Sobald ein Tag mit dem Prefix `v` gepusht wird, startet die Pipeline automatisch.
 
 ```bash
-# 1. Sicherstellen, dass main aktuell ist
+# 1. feature/ai-agent → main mergen (falls noch nicht geschehen)
 git checkout main
 git pull origin main
+git merge --no-ff feature/ai-agent -m "Merge feature/ai-agent into main for v0.1.0-beta.2"
+git push origin main
+
+# 2. Version in package.json manuell auf 0.1.0-beta.2 setzen, committen
+#    (package.json → "version": "0.1.0-beta.2")
+git add package.json
+git commit -m "chore: bump version to 0.1.0-beta.2"
+git push origin main
 
-# 2. Tag erstellen
-git tag -a v0.1.0-beta.1 -m "Beta Release 0.1.0-beta.1"
+# 3. Tag erstellen
+git tag -a v0.1.0-beta.2 -m "Beta Release 0.1.0-beta.2"
 
-# 3. Tag pushen → Pipeline startet automatisch
-git push origin v0.1.0-beta.1
+# 4. Tag pushen → Pipeline startet automatisch
+git push origin v0.1.0-beta.2
 ```
 
 ### Was die Pipeline macht
@@ -51,7 +61,7 @@ Je nach Versionstyp werden automatisch zusätzliche Tags gesetzt:
 
 | Version | Image Tags |
 |---------|-----------|
-| `v0.1.0-beta.1` | `manfredsteger/polly:0.1.0-beta.1` + `manfredsteger/polly:beta` |
+| `v0.1.0-beta.2` | `manfredsteger/polly:0.1.0-beta.2` + `manfredsteger/polly:beta` |
 | `v0.1.0-rc.1` | `manfredsteger/polly:0.1.0-rc.1` + `manfredsteger/polly:rc` |
 | `v1.0.0` | `manfredsteger/polly:1.0.0` + `manfredsteger/polly:latest` |
 
@@ -65,13 +75,15 @@ docker login
 
 # Image bauen und pushen
 make release
-# → Fragt nach der Version (z.B. 0.1.0-beta.1)
+# → Fragt nach der Version (z.B. 0.1.0-beta.2)
 # → Baut, taggt und pusht automatisch
 
 # Oder mit expliziter Version:
-IMAGE_TAG=0.1.0-beta.1 make publish
+IMAGE_TAG=0.1.0-beta.2 make publish
 ```
 
+---
+
 ## Versionierung
 
 Polly folgt [Semantic Versioning](https://semver.org/):
@@ -80,20 +92,29 @@ Polly folgt [Semantic Versioning](https://semver.org/):
 - **Release Candidate**: `0.x.y-rc.z` — Feature-vollständig, letzte Tests
 - **Stable**: `x.y.z` — Produktionsreif
 
-### Nächste Schritte nach Beta
+### Aktuelle Versionsfolge
 
 ```
 0.1.0-beta.1  →  0.1.0-beta.2  →  ...  →  0.1.0-rc.1  →  0.1.0
 ```
 
+---
+
 ## Checkliste vor einem Release
 
+- [ ] Branch `feature/ai-agent` in `main` gemergt
+- [ ] `git pull origin main` — lokaler Stand aktuell
 - [ ] Alle Tests bestehen (`make test`)
 - [ ] TypeScript kompiliert fehlerfrei (`npx tsc --noEmit`)
 - [ ] Übersetzungen vollständig (`make validate-translations`)
 - [ ] Docker Build funktioniert lokal (`make build`)
-- [ ] Changelog / Release Notes vorbereitet
-- [ ] SELF-HOSTING.md aktuell
+- [ ] `CHANGELOG.md` vorbereitet (Unreleased-Abschnitt abgeschlossen)
+- [ ] `ROADMAP.md` aktuell
+- [ ] `package.json` Version gesetzt (z.B. `0.1.0-beta.2`)
+- [ ] `SELF-HOSTING.md` aktuell
+- [ ] Tag erstellt und gepusht
+
+---
 
 ## Fehlerbehebung
 
@@ -109,8 +130,8 @@ Docker Hub erlaubt das Überschreiben bestehender Tags. Falls ein Tag nochmal ge
 
 ```bash
 # Tag lokal löschen und neu erstellen
-git tag -d v0.1.0-beta.1
-git push origin :refs/tags/v0.1.0-beta.1
-git tag -a v0.1.0-beta.1 -m "Beta Release 0.1.0-beta.1 (fixed)"
-git push origin v0.1.0-beta.1
+git tag -d v0.1.0-beta.2
+git push origin :refs/tags/v0.1.0-beta.2
+git tag -a v0.1.0-beta.2 -m "Beta Release 0.1.0-beta.2 (fixed)"
+git push origin v0.1.0-beta.2
 ```
diff --git a/docs/SELF-HOSTING.md b/docs/SELF-HOSTING.md
index 7155bb66..1a89eb40 100644
--- a/docs/SELF-HOSTING.md
+++ b/docs/SELF-HOSTING.md
@@ -153,12 +153,49 @@ npm start
 | `DATABASE_URL` | PostgreSQL connection URL | `postgresql://user:pass@host:5432/db` |
 | `SESSION_SECRET` | Session encryption key (min 32 chars) | `your-secure-random-string` |
 
-### Application URLs
+### External Database (Managed PostgreSQL)
+
+If you use a managed or external PostgreSQL instance (e.g. AWS RDS, Azure Database, GWDG, Hetzner), you only need to set the `DATABASE_URL` environment variable. The entrypoint script automatically parses host and port from the URL using Node.js — special characters in passwords (`:`, `@`, `#`, URL-encoded like `%40`) are handled correctly.
+
+```bash
+# .env
+DATABASE_URL=postgresql://user:pass@your-db-host:5432/polly
+SESSION_SECRET=your-secure-random-string
+```
+
+- **PostgreSQL 14+ recommended**
+- The `POSTGRES_USER`, `POSTGRES_PASSWORD`, and `POSTGRES_DB` variables are only used by the bundled docker-compose PostgreSQL service — they are ignored when `DATABASE_URL` is set directly
+- SSL connections are supported via query parameters: `?sslmode=require`
+
+#### Using docker-compose with an external database
+
+To use an external database, start only the `app` service (skip the bundled `postgres` container) and pass `DATABASE_URL` directly:
+
+```bash
+DATABASE_URL=postgresql://user:pass@your-db-host:5432/polly \
+  docker compose up -d app
+```
+
+Alternatively, create a `docker-compose.override.yml` to override the database connection:
+
+```yaml
+# docker-compose.override.yml
+services:
+  app:
+    depends_on: []
+    environment:
+      DATABASE_URL: postgresql://user:pass@your-db-host:5432/polly
+```
+
+Then start with `docker compose up -d app` (omit the `postgres` service).
+
+### Application URL
 
 | Variable | Description | Example |
 |----------|-------------|---------|
-| `APP_URL` | Public URL of your application | `https://poll.example.com` |
-| `VITE_APP_URL` | Same as APP_URL (for frontend) | `https://poll.example.com` |
+| `APP_URL` | Public URL of your application (required for OIDC, emails, sharing) | `https://poll.example.com` |
+
+> **Note:** `BASE_URL` and `VITE_APP_URL` are supported as deprecated aliases for backward compatibility. Use `APP_URL` for new deployments.
 
 ### Email Configuration (Optional)
 
@@ -166,10 +203,27 @@ npm start
 |----------|-------------|---------|
 | `SMTP_HOST` | SMTP server hostname | `smtp.example.com` |
 | `SMTP_PORT` | SMTP port | `587` |
-| `SMTP_SECURE` | Use TLS | `false` |
+| `SMTP_SECURE` | Use TLS (`true`/`false`) | `false` |
 | `SMTP_USER` | SMTP username | `user@example.com` |
 | `SMTP_PASSWORD` | SMTP password | `password` |
-| `EMAIL_FROM` | From address | `noreply@example.com` |
+| `FROM_EMAIL` | Sender address for outgoing emails | `noreply@example.com` |
+| `FROM_NAME` | Sender display name | `Polly` |
+
+> **Legacy aliases:** `EMAIL_FROM` (same as `FROM_EMAIL`), `SMTP_PASS` (same as `SMTP_PASSWORD`)
+
+### Initial Admin Account (Docker)
+
+When running via Docker, the admin account is automatically created or updated on each start.
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `ADMIN_USERNAME` | Admin username | `admin` |
+| `ADMIN_EMAIL` | Admin email address | `admin@polly.local` |
+| `ADMIN_PASSWORD` | Admin password | `Admin123!` |
+| `SITE_NAME` | Website name (main part) | `Poll` |
+| `SITE_NAME_ACCENT` | Accented part of the site name | `y` |
+
+> **Security Warning:** Change the default admin credentials after first login, or set custom values via environment variables before starting.
 
 ### Keycloak OIDC (Optional)
 
@@ -179,6 +233,11 @@ npm start
 | `KEYCLOAK_CLIENT_ID` | Client ID | `polly` |
 | `KEYCLOAK_CLIENT_SECRET` | Client secret | `secret-uuid` |
 | `KEYCLOAK_AUTH_SERVER_URL` | Keycloak base URL | `https://keycloak.example.com` |
+| `KEYCLOAK_ISSUER_URL` | Full OIDC issuer URL (auto-derived from realm + server URL if not set) | `https://keycloak.example.com/realms/myrealm` |
+| `SSO_BUTTON_LABEL` | Custom login button text (default: "Login with Keycloak"). Also configurable in Admin → Authentication | `Kita Hub Login` |
+| `HIDE_LOGIN_FORM` | Hide the local username+password login form. Set to `true` when SSO is the primary login method | `false` |
+
+> **Legacy alias:** `KEYCLOAK_URL` (same as `KEYCLOAK_AUTH_SERVER_URL`)
 
 ### ClamAV Virus Scanning (Optional)
 
@@ -238,6 +297,35 @@ env:
     value: "true"
 ```
 
+### AI Assistant (Optional)
+
+Polly includes an optional AI assistant that helps users create polls through natural language. It uses any OpenAI-compatible API (recommended: GWDG SAIA).
+
+#### Environment Variables
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `AI_API_URL` | OpenAI-compatible API endpoint | `https://saia.2.rahtiapp.fi/v1` |
+| `AI_API_KEY` | API key. When set via ENV, AI chat is **auto-enabled** without admin toggle | `your-api-key` |
+| `AI_API_KEY_FALLBACK` | Fallback key (used on HTTP 429 rate limit) | `your-fallback-key` |
+| `AI_MODEL` | AI model name | `llama-3.3-70b-instruct` |
+
+#### Voice Input
+
+The Docker image includes ffmpeg for voice input (WebM → MP3 audio conversion). No additional setup required.
+
+#### GDPR Compliance
+
+When using GWDG SAIA, all AI processing stays within European data centers (GDPR-compliant).
+
+#### Docker Compose Example
+
+```yaml
+environment:
+  - AI_API_URL=https://saia.2.rahtiapp.fi/v1
+  - AI_API_KEY=your-api-key
+```
+
 ### Instance-Specific Branding
 
 Polly supports instance-specific branding (colors, logo, site name) that persists across deployments without being committed to git. This is useful for organizations running their own branded instance.
@@ -320,6 +408,21 @@ npm run dev  # or docker compose restart
 
 Set `POLLY_WCAG_OVERRIDE=true` to disable default theme enforcement without creating a local config file.
 
+### Advanced Settings
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `PORT` | Server port inside the container | `5000` |
+| `NODE_ENV` | Node environment (`production`, `development`) | `production` |
+| `DATABASE_SSL` | Enable SSL for database connections (e.g., managed PostgreSQL with TLS) | `false` |
+| `FORCE_HTTPS` | Force secure cookies even when `APP_URL` is not HTTPS (behind TLS-terminating proxy) | auto-detect from `APP_URL` |
+| `LOG_LEVEL` | Logging level: `debug`, `info`, `warn`, `error` | `info` (prod) / `debug` (dev) |
+| `SEED_DEMO_DATA` | Seed demo polls showing all three poll types on first start | `false` |
+| `PUPPETEER_EXECUTABLE_PATH` | Chromium path for PDF export (set automatically in Docker image) | auto-detected |
+| `POLLY_WCAG_OVERRIDE` | Disable WCAG default theme enforcement without a `branding.local.json` | `false` |
+| `PENTEST_TOOLS_API_TOKEN` | Pentest-Tools.com Pro API token for vulnerability scanning | — |
+| `TEST_MODE_SECRET` | Custom header value for E2E test mode (`X-Test-Mode` header) | `polly-e2e-test-mode` |
+
 ---
 
 ## Security Hardening
@@ -493,8 +596,11 @@ docker compose logs app
 ### Database Connection Issues
 
 ```bash
-# Test connection from app container
-docker compose exec app sh -c "pg_isready -h postgres -U polly"
+# Test connection from app container (bundled PostgreSQL)
+docker compose exec app sh -c "pg_isready -h postgres -p 5432"
+
+# Test connection to external database
+docker compose exec app sh -c "pg_isready -h your-db-host -p 5432"
 
 # Check environment variable
 docker compose exec app sh -c "echo \$DATABASE_URL"
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 6d5a6545..496f5831 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -42,6 +42,8 @@ tags:
     description: Corporate Design und Branding
   - name: Matrix
     description: Matrix-Chat-Integration
+  - name: AI
+    description: KI-Assistent für Umfrage-Erstellung (Optional, erfordert serverseitige Konfiguration von AI_API_KEY)
 
 security:
   - BearerAuth: []
@@ -1054,3 +1056,130 @@ paths:
                 properties:
                   imageUrl:
                     type: string
+
+  /ai/status:
+    get:
+      tags: [AI]
+      summary: AI-Verfügbarkeit prüfen
+      description: Prüft ob der KI-Assistent serverseitig konfiguriert und verfügbar ist. Erfordert serverseitige AI_API_KEY Konfiguration.
+      responses:
+        '200':
+          description: AI-Status
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  enabled:
+                    type: boolean
+                    description: Ob der AI-Assistent aktiviert ist
+                  apiConfigured:
+                    type: boolean
+                    description: Ob ein API-Key serverseitig konfiguriert ist
+                  model:
+                    type: string
+                    description: Konfiguriertes AI-Modell (z.B. llama-3.3-70b-instruct)
+
+  /ai/create-poll:
+    post:
+      tags: [AI]
+      summary: Umfrage-Vorschlag aus natürlicher Sprache erstellen
+      description: Erstellt einen strukturierten Umfrage-Vorschlag basierend auf einer natürlichsprachigen Beschreibung. Erfordert serverseitige AI_API_KEY Konfiguration.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - message
+              properties:
+                message:
+                  type: string
+                  description: Natürlichsprachige Beschreibung der gewünschten Umfrage
+                conversationHistory:
+                  type: array
+                  description: Bisheriger Gesprächsverlauf für Kontext
+                  items:
+                    type: object
+                    properties:
+                      role:
+                        type: string
+                        enum: [user, assistant]
+                      content:
+                        type: string
+      responses:
+        '200':
+          description: AI-generierter Umfrage-Vorschlag
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  suggestion:
+                    type: object
+                    properties:
+                      title:
+                        type: string
+                      description:
+                        type: string
+                      type:
+                        type: string
+                        enum: [schedule, survey, organization]
+                      options:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            text:
+                              type: string
+                  message:
+                    type: string
+                    description: Begleitende Nachricht des AI-Assistenten
+        '503':
+          description: AI-Service nicht verfügbar (API-Key nicht konfiguriert)
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+
+  /ai/transcribe:
+    post:
+      tags: [AI]
+      summary: Audio-Transkription
+      description: Transkribiert eine Audio-Datei in Text mittels Whisper. Erfordert serverseitige AI_API_KEY Konfiguration.
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required:
+                - audio
+              properties:
+                audio:
+                  type: string
+                  format: binary
+                  description: Audio-Datei zur Transkription
+      responses:
+        '200':
+          description: Transkriptionsergebnis
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  success:
+                    type: boolean
+                  text:
+                    type: string
+                    description: Transkribierter Text
+                  language:
+                    type: string
+                    description: Erkannte Sprache (z.B. de, en)
+        '503':
+          description: AI-Service nicht verfügbar (API-Key nicht konfiguriert)
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
diff --git a/e2e/comprehensive.spec.ts b/e2e/comprehensive.spec.ts
index ab34e245..55b635c1 100644
--- a/e2e/comprehensive.spec.ts
+++ b/e2e/comprehensive.spec.ts
@@ -1,7 +1,7 @@
 import { test, expect, Page, BrowserContext, request } from '@playwright/test';
 import { nanoid } from 'nanoid';
 
-const BASE_URL = process.env.BASE_URL || 'http://localhost:5000';
+const BASE_URL = process.env.APP_URL || process.env.BASE_URL || 'http://localhost:5000';
 
 // Helper function to create a poll via API
 async function createPollViaAPI(page: Page, type: 'schedule' | 'survey' | 'organization', options: {
diff --git a/migrations/0001_video_conference_url.sql b/migrations/0001_video_conference_url.sql
new file mode 100644
index 00000000..4f9eb3f7
--- /dev/null
+++ b/migrations/0001_video_conference_url.sql
@@ -0,0 +1 @@
+ALTER TABLE "polls" ADD COLUMN "video_conference_url" text;
diff --git a/migrations/meta/_journal.json b/migrations/meta/_journal.json
index d1ff430d..bde3ba8e 100644
--- a/migrations/meta/_journal.json
+++ b/migrations/meta/_journal.json
@@ -8,6 +8,13 @@
       "when": 1766409567958,
       "tag": "0000_old_vance_astro",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1774512310093,
+      "tag": "0001_video_conference_url",
+      "breakpoints": true
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/package-lock.json b/package-lock.json
index 5e95aa63..be3a9498 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,6 +10,9 @@
       "license": "MIT",
       "dependencies": {
         "@axe-core/playwright": "^4.11.0",
+        "@dnd-kit/core": "^6.3.1",
+        "@dnd-kit/sortable": "^10.0.0",
+        "@dnd-kit/utilities": "^3.2.2",
         "@hookform/resolvers": "^3.10.0",
         "@jridgewell/trace-mapping": "^0.3.25",
         "@playwright/test": "^1.57.0",
@@ -82,6 +85,7 @@
         "nanoid": "^5.1.5",
         "next-themes": "^0.4.6",
         "nodemailer": "^7.0.5",
+        "openai": "^6.25.0",
         "openid-client": "^6.8.1",
         "passport": "^0.7.0",
         "passport-local": "^1.0.0",
@@ -448,6 +452,59 @@
         "node": ">=18"
       }
     },
+    "node_modules/@dnd-kit/accessibility": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/accessibility/-/accessibility-3.1.1.tgz",
+      "integrity": "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/core": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/core/-/core-6.3.1.tgz",
+      "integrity": "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@dnd-kit/accessibility": "^3.1.1",
+        "@dnd-kit/utilities": "^3.2.2",
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/sortable": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/sortable/-/sortable-10.0.0.tgz",
+      "integrity": "sha512-+xqhmIIzvAYMGfBYYnbKuNicfSsk4RksY2XdmJhT+HAC01nix6fHCztU68jooFiMUB01Ky3F0FyOvhG/BZrWkg==",
+      "license": "MIT",
+      "dependencies": {
+        "@dnd-kit/utilities": "^3.2.2",
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "@dnd-kit/core": "^6.3.0",
+        "react": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/utilities": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/utilities/-/utilities-3.2.2.tgz",
+      "integrity": "sha512-+MKAJEOfaBe5SmV6t34p80MMKhjvUz0vRrvVJbPT0WElzaOJ/1xs+D+KDv+tD/NE5ujfrChEcshd4fLn0wpiqg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0"
+      }
+    },
     "node_modules/@drizzle-team/brocli": {
       "version": "0.10.2",
       "resolved": "https://registry.npmjs.org/@drizzle-team/brocli/-/brocli-0.10.2.tgz",
@@ -1359,9 +1416,9 @@
       }
     },
     "node_modules/@eslint/config-array/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -1437,9 +1494,9 @@
       }
     },
     "node_modules/@eslint/eslintrc/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -4320,9 +4377,9 @@
       "license": "MIT"
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.53.3.tgz",
-      "integrity": "sha512-mRSi+4cBjrRLoaal2PnqH82Wqyb+d3HsPUN/W+WslCXsZsyHa9ZeQQX/pQsZaVIWDkPcpV6jJ+3KLbTbgnwv8w==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
+      "integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
       "cpu": [
         "arm"
       ],
@@ -4333,9 +4390,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.53.3.tgz",
-      "integrity": "sha512-CbDGaMpdE9sh7sCmTrTUyllhrg65t6SwhjlMJsLr+J8YjFuPmCEjbBSx4Z/e4SmDyH3aB5hGaJUP2ltV/vcs4w==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
+      "integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
       "cpu": [
         "arm64"
       ],
@@ -4346,9 +4403,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.53.3.tgz",
-      "integrity": "sha512-Nr7SlQeqIBpOV6BHHGZgYBuSdanCXuw09hon14MGOLGmXAFYjx1wNvquVPmpZnl0tLjg25dEdr4IQ6GgyToCUA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
+      "integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
       "cpu": [
         "arm64"
       ],
@@ -4359,9 +4416,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.53.3.tgz",
-      "integrity": "sha512-DZ8N4CSNfl965CmPktJ8oBnfYr3F8dTTNBQkRlffnUarJ2ohudQD17sZBa097J8xhQ26AwhHJ5mvUyQW8ddTsQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
+      "integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
       "cpu": [
         "x64"
       ],
@@ -4372,9 +4429,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.53.3.tgz",
-      "integrity": "sha512-yMTrCrK92aGyi7GuDNtGn2sNW+Gdb4vErx4t3Gv/Tr+1zRb8ax4z8GWVRfr3Jw8zJWvpGHNpss3vVlbF58DZ4w==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
+      "integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
       "cpu": [
         "arm64"
       ],
@@ -4385,9 +4442,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.53.3.tgz",
-      "integrity": "sha512-lMfF8X7QhdQzseM6XaX0vbno2m3hlyZFhwcndRMw8fbAGUGL3WFMBdK0hbUBIUYcEcMhVLr1SIamDeuLBnXS+Q==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
+      "integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
       "cpu": [
         "x64"
       ],
@@ -4398,9 +4455,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.53.3.tgz",
-      "integrity": "sha512-k9oD15soC/Ln6d2Wv/JOFPzZXIAIFLp6B+i14KhxAfnq76ajt0EhYc5YPeX6W1xJkAdItcVT+JhKl1QZh44/qw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
+      "integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
       "cpu": [
         "arm"
       ],
@@ -4411,9 +4468,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.53.3.tgz",
-      "integrity": "sha512-vTNlKq+N6CK/8UktsrFuc+/7NlEYVxgaEgRXVUVK258Z5ymho29skzW1sutgYjqNnquGwVUObAaxae8rZ6YMhg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
+      "integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
       "cpu": [
         "arm"
       ],
@@ -4424,9 +4481,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.53.3.tgz",
-      "integrity": "sha512-RGrFLWgMhSxRs/EWJMIFM1O5Mzuz3Xy3/mnxJp/5cVhZ2XoCAxJnmNsEyeMJtpK+wu0FJFWz+QF4mjCA7AUQ3w==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
+      "integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
       "cpu": [
         "arm64"
       ],
@@ -4437,9 +4494,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.53.3.tgz",
-      "integrity": "sha512-kASyvfBEWYPEwe0Qv4nfu6pNkITLTb32p4yTgzFCocHnJLAHs+9LjUu9ONIhvfT/5lv4YS5muBHyuV84epBo/A==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
+      "integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
       "cpu": [
         "arm64"
       ],
@@ -4450,9 +4507,22 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.53.3.tgz",
-      "integrity": "sha512-JiuKcp2teLJwQ7vkJ95EwESWkNRFJD7TQgYmCnrPtlu50b4XvT5MOmurWNrCj3IFdyjBQ5p9vnrX4JM6I8OE7g==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
+      "integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
+      "integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
       "cpu": [
         "loong64"
       ],
@@ -4463,9 +4533,22 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.53.3.tgz",
-      "integrity": "sha512-EoGSa8nd6d3T7zLuqdojxC20oBfNT8nexBbB/rkxgKj5T5vhpAQKKnD+h3UkoMuTyXkP5jTjK/ccNRmQrPNDuw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
+      "integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
+      "integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
       "cpu": [
         "ppc64"
       ],
@@ -4476,9 +4559,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.53.3.tgz",
-      "integrity": "sha512-4s+Wped2IHXHPnAEbIB0YWBv7SDohqxobiiPA1FIWZpX+w9o2i4LezzH/NkFUl8LRci/8udci6cLq+jJQlh+0g==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
+      "integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
       "cpu": [
         "riscv64"
       ],
@@ -4489,9 +4572,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.53.3.tgz",
-      "integrity": "sha512-68k2g7+0vs2u9CxDt5ktXTngsxOQkSEV/xBbwlqYcUrAVh6P9EgMZvFsnHy4SEiUl46Xf0IObWVbMvPrr2gw8A==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
+      "integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
       "cpu": [
         "riscv64"
       ],
@@ -4502,9 +4585,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.53.3.tgz",
-      "integrity": "sha512-VYsFMpULAz87ZW6BVYw3I6sWesGpsP9OPcyKe8ofdg9LHxSbRMd7zrVrr5xi/3kMZtpWL/wC+UIJWJYVX5uTKg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
+      "integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
       "cpu": [
         "s390x"
       ],
@@ -4515,9 +4598,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.53.3.tgz",
-      "integrity": "sha512-3EhFi1FU6YL8HTUJZ51imGJWEX//ajQPfqWLI3BQq4TlvHy4X0MOr5q3D2Zof/ka0d5FNdPwZXm3Yyib/UEd+w==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
       "cpu": [
         "x64"
       ],
@@ -4528,9 +4611,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.53.3.tgz",
-      "integrity": "sha512-eoROhjcc6HbZCJr+tvVT8X4fW3/5g/WkGvvmwz/88sDtSJzO7r/blvoBDgISDiCjDRZmHpwud7h+6Q9JxFwq1Q==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
+      "integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
       "cpu": [
         "x64"
       ],
@@ -4540,10 +4623,23 @@
         "linux"
       ]
     },
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
+      "integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ]
+    },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.53.3.tgz",
-      "integrity": "sha512-OueLAWgrNSPGAdUdIjSWXw+u/02BRTcnfw9PN41D2vq/JSEPnJnVuBgw18VkN8wcd4fjUs+jFHVM4t9+kBSNLw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
+      "integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
       "cpu": [
         "arm64"
       ],
@@ -4554,9 +4650,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.53.3.tgz",
-      "integrity": "sha512-GOFuKpsxR/whszbF/bzydebLiXIHSgsEUp6M0JI8dWvi+fFa1TD6YQa4aSZHtpmh2/uAlj/Dy+nmby3TJ3pkTw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
+      "integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
       "cpu": [
         "arm64"
       ],
@@ -4567,9 +4663,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.53.3.tgz",
-      "integrity": "sha512-iah+THLcBJdpfZ1TstDFbKNznlzoxa8fmnFYK4V67HvmuNYkVdAywJSoteUszvBQ9/HqN2+9AZghbajMsFT+oA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
+      "integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
       "cpu": [
         "ia32"
       ],
@@ -4580,9 +4676,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.53.3.tgz",
-      "integrity": "sha512-J9QDiOIZlZLdcot5NXEepDkstocktoVjkaKUtqzgzpt2yWjGlbYiKyp05rWwk4nypbYUNoFAztEgixoLaSETkg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
       "cpu": [
         "x64"
       ],
@@ -4593,9 +4689,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.53.3.tgz",
-      "integrity": "sha512-UhTd8u31dXadv0MopwGgNOBpUVROFKWVQgAg5N1ESyCz8AuBcMqm4AuTjrwgQKGDfoFuz02EuMRHQIw/frmYKQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
+      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
       "cpu": [
         "x64"
       ],
@@ -6042,9 +6138,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -6395,13 +6491,13 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.2.tgz",
-      "integrity": "sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==",
+      "version": "1.13.6",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz",
+      "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.4",
+        "follow-redirects": "^1.15.11",
+        "form-data": "^4.0.5",
         "proxy-from-env": "^1.1.0"
       }
     },
@@ -6539,9 +6635,9 @@
       "license": "MIT"
     },
     "node_modules/basic-ftp": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.0.5.tgz",
-      "integrity": "sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz",
+      "integrity": "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -6580,23 +6676,23 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.3",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz",
-      "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==",
+      "version": "1.20.4",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
+      "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==",
       "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
+        "bytes": "~3.1.2",
         "content-type": "~1.0.5",
         "debug": "2.6.9",
         "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "on-finished": "2.4.1",
-        "qs": "6.13.0",
-        "raw-body": "2.5.2",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.14.0",
+        "raw-body": "~2.5.3",
         "type-is": "~1.6.18",
-        "unpipe": "1.0.0"
+        "unpipe": "~1.0.0"
       },
       "engines": {
         "node": ">= 0.8",
@@ -6612,12 +6708,41 @@
         "ms": "2.0.0"
       }
     },
+    "node_modules/body-parser/node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/body-parser/node_modules/ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "license": "MIT"
     },
+    "node_modules/body-parser/node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
@@ -7821,9 +7946,9 @@
       }
     },
     "node_modules/drizzle-kit": {
-      "version": "0.31.8",
-      "resolved": "https://registry.npmjs.org/drizzle-kit/-/drizzle-kit-0.31.8.tgz",
-      "integrity": "sha512-O9EC/miwdnRDY10qRxM8P3Pg8hXe3LyU4ZipReKOgTwn4OqANmftj8XJz1UPUAS6NMHf0E2htjsbQujUTkncCg==",
+      "version": "0.31.9",
+      "resolved": "https://registry.npmjs.org/drizzle-kit/-/drizzle-kit-0.31.9.tgz",
+      "integrity": "sha512-GViD3IgsXn7trFyBUUHyTFBpH/FsHTxYJ66qdbVggxef4UBPHRYxQaRzYLTuekYnk9i5FIEL9pbBIwMqX/Uwrg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8534,9 +8659,9 @@
       }
     },
     "node_modules/eslint-plugin-react/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -8653,9 +8778,9 @@
       }
     },
     "node_modules/eslint/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -8849,39 +8974,39 @@
       }
     },
     "node_modules/express": {
-      "version": "4.21.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
-      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
+      "version": "4.22.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
+      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.3",
-        "content-disposition": "0.5.4",
+        "body-parser": "~1.20.3",
+        "content-disposition": "~0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.7.1",
-        "cookie-signature": "1.0.6",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.3.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
         "merge-descriptors": "1.0.3",
         "methods": "~1.1.2",
-        "on-finished": "2.4.1",
+        "on-finished": "~2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.12",
+        "path-to-regexp": "~0.1.12",
         "proxy-addr": "~2.0.7",
-        "qs": "6.13.0",
+        "qs": "~6.14.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
-        "send": "0.19.0",
-        "serve-static": "1.16.2",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
         "setprototypeof": "1.2.0",
-        "statuses": "2.0.1",
+        "statuses": "~2.0.1",
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
         "vary": "~1.1.2"
@@ -9159,9 +9284,9 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.9",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.9.tgz",
-      "integrity": "sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==",
+      "version": "1.15.11",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
+      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
       "funding": [
         {
           "type": "individual",
@@ -9227,9 +9352,9 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
+      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
@@ -10975,9 +11100,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
       "license": "MIT"
     },
     "node_modules/lodash.castarray": {
@@ -11877,12 +12002,12 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -11915,18 +12040,6 @@
       "integrity": "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==",
       "license": "MIT"
     },
-    "node_modules/mkdirp": {
-      "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
-      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
-      "license": "MIT",
-      "dependencies": {
-        "minimist": "^1.2.6"
-      },
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      }
-    },
     "node_modules/mkdirp-classic": {
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
@@ -11956,21 +12069,22 @@
       "license": "MIT"
     },
     "node_modules/multer": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.0.2.tgz",
-      "integrity": "sha512-u7f2xaZ/UG8oLXHvtF/oWTRvT44p9ecwBBqTwgJVq0+4BW1g8OW01TyMEGWBHbyMOYVHXslaut7qEQ1meATXgw==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.1.1.tgz",
+      "integrity": "sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",
         "busboy": "^1.6.0",
         "concat-stream": "^2.0.0",
-        "mkdirp": "^0.5.6",
-        "object-assign": "^4.1.1",
-        "type-is": "^1.6.18",
-        "xtend": "^4.0.2"
+        "type-is": "^1.6.18"
       },
       "engines": {
         "node": ">= 10.16.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/mz": {
@@ -12316,6 +12430,27 @@
         "wrappy": "1"
       }
     },
+    "node_modules/openai": {
+      "version": "6.25.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.25.0.tgz",
+      "integrity": "sha512-mEh6VZ2ds2AGGokWARo18aPISI1OhlgdEIC1ewhkZr8pSIT31dec0ecr9Nhxx0JlybyOgoAT1sWeKtwPZzJyww==",
+      "license": "Apache-2.0",
+      "bin": {
+        "openai": "bin/cli"
+      },
+      "peerDependencies": {
+        "ws": "^8.18.0",
+        "zod": "^3.25 || ^4.0"
+      },
+      "peerDependenciesMeta": {
+        "ws": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/openid-client": {
       "version": "6.8.1",
       "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-6.8.1.tgz",
@@ -13267,12 +13402,12 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.13.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
-      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
+      "version": "6.14.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
+      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.6"
+        "side-channel": "^1.1.0"
       },
       "engines": {
         "node": ">=0.6"
@@ -13320,20 +13455,49 @@
       }
     },
     "node_modules/raw-body": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
-      "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==",
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
       "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "unpipe": "1.0.0"
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
       },
       "engines": {
         "node": ">= 0.8"
       }
     },
+    "node_modules/raw-body/node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/raw-body/node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/rc": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
@@ -13814,9 +13978,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.53.3.tgz",
-      "integrity": "sha512-w8GmOxZfBmKknvdXU1sdM9NHcoQejwF/4mNgj2JuEEdRaHwwF12K7e9eXn1nLZ07ad+du76mkVsyeb2rKGllsA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
+      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "1.0.8"
@@ -13829,28 +13993,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.53.3",
-        "@rollup/rollup-android-arm64": "4.53.3",
-        "@rollup/rollup-darwin-arm64": "4.53.3",
-        "@rollup/rollup-darwin-x64": "4.53.3",
-        "@rollup/rollup-freebsd-arm64": "4.53.3",
-        "@rollup/rollup-freebsd-x64": "4.53.3",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.53.3",
-        "@rollup/rollup-linux-arm-musleabihf": "4.53.3",
-        "@rollup/rollup-linux-arm64-gnu": "4.53.3",
-        "@rollup/rollup-linux-arm64-musl": "4.53.3",
-        "@rollup/rollup-linux-loong64-gnu": "4.53.3",
-        "@rollup/rollup-linux-ppc64-gnu": "4.53.3",
-        "@rollup/rollup-linux-riscv64-gnu": "4.53.3",
-        "@rollup/rollup-linux-riscv64-musl": "4.53.3",
-        "@rollup/rollup-linux-s390x-gnu": "4.53.3",
-        "@rollup/rollup-linux-x64-gnu": "4.53.3",
-        "@rollup/rollup-linux-x64-musl": "4.53.3",
-        "@rollup/rollup-openharmony-arm64": "4.53.3",
-        "@rollup/rollup-win32-arm64-msvc": "4.53.3",
-        "@rollup/rollup-win32-ia32-msvc": "4.53.3",
-        "@rollup/rollup-win32-x64-gnu": "4.53.3",
-        "@rollup/rollup-win32-x64-msvc": "4.53.3",
+        "@rollup/rollup-android-arm-eabi": "4.59.0",
+        "@rollup/rollup-android-arm64": "4.59.0",
+        "@rollup/rollup-darwin-arm64": "4.59.0",
+        "@rollup/rollup-darwin-x64": "4.59.0",
+        "@rollup/rollup-freebsd-arm64": "4.59.0",
+        "@rollup/rollup-freebsd-x64": "4.59.0",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.59.0",
+        "@rollup/rollup-linux-arm-musleabihf": "4.59.0",
+        "@rollup/rollup-linux-arm64-gnu": "4.59.0",
+        "@rollup/rollup-linux-arm64-musl": "4.59.0",
+        "@rollup/rollup-linux-loong64-gnu": "4.59.0",
+        "@rollup/rollup-linux-loong64-musl": "4.59.0",
+        "@rollup/rollup-linux-ppc64-gnu": "4.59.0",
+        "@rollup/rollup-linux-ppc64-musl": "4.59.0",
+        "@rollup/rollup-linux-riscv64-gnu": "4.59.0",
+        "@rollup/rollup-linux-riscv64-musl": "4.59.0",
+        "@rollup/rollup-linux-s390x-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-musl": "4.59.0",
+        "@rollup/rollup-openbsd-x64": "4.59.0",
+        "@rollup/rollup-openharmony-arm64": "4.59.0",
+        "@rollup/rollup-win32-arm64-msvc": "4.59.0",
+        "@rollup/rollup-win32-ia32-msvc": "4.59.0",
+        "@rollup/rollup-win32-x64-gnu": "4.59.0",
+        "@rollup/rollup-win32-x64-msvc": "4.59.0",
         "fsevents": "~2.3.2"
       }
     },
@@ -16640,9 +16807,10 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.24.2",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.24.2.tgz",
-      "integrity": "sha512-lY7CDW43ECgW9u1TcT3IoXHflywfVqDYze4waEz812jR/bZ8FHDsl7pFQoSZTz5N+2NqRXs8GBwnAwo3ZNxqhQ==",
+      "version": "3.25.76",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
+      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
diff --git a/package.json b/package.json
index f39978d5..aaf15acd 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,9 @@
   },
   "dependencies": {
     "@axe-core/playwright": "^4.11.0",
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
     "@hookform/resolvers": "^3.10.0",
     "@jridgewell/trace-mapping": "^0.3.25",
     "@playwright/test": "^1.57.0",
@@ -84,6 +87,7 @@
     "nanoid": "^5.1.5",
     "next-themes": "^0.4.6",
     "nodemailer": "^7.0.5",
+    "openai": "^6.25.0",
     "openid-client": "^6.8.1",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
diff --git a/playwright.config.ts b/playwright.config.ts
index 21a54c50..18aede24 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -12,7 +12,7 @@ export default defineConfig({
     timeout: 15000,
   },
   use: {
-    baseURL: process.env.BASE_URL || 'http://localhost:5000',
+    baseURL: process.env.APP_URL || process.env.BASE_URL || 'http://localhost:5000',
     trace: 'on-first-retry',
     screenshot: 'only-on-failure',
     actionTimeout: 15000,
diff --git a/replit.md b/replit.md
index beef1de4..6f91caa1 100644
--- a/replit.md
+++ b/replit.md
@@ -6,10 +6,25 @@ Polly is an open-source, full-stack polling and scheduling platform designed for
 ## User Preferences
 - **Communication**: Simple, everyday language (German).
 - **Git Commits**: Aussagekräftige, beschreibende Commit-Nachrichten auf Englisch (kein "saved progress"). Format: Kurzer Titel + optionale Details zu den Änderungen.
-
-## CRITICAL Rules (MUST check every time)
-- **Makefile MUST use TAB indentation** — NEVER spaces. GNU Make requires TABs for recipe lines. Every time the Makefile is edited, verify with `python3 -c "..." ` that indentation bytes are `\t` (0x09), not spaces (0x20). The `write`/`edit` tools may silently convert tabs to spaces — always verify and fix after editing.
-- **Git Sync Flow**: Replit → GitHub (source of truth) → GitLab (read-only mirror). GitLab NEVER pushes to GitHub. One-way only!
+- **Admin Credentials (MANDATORY)**: Admin credentials are stored in Replit Secrets/Env Vars: `ADMIN_USERNAME` (env var), `ADMIN_EMAIL` (env var), `ADMIN_PASSWORD` (secret). **In the Replit environment, always read credentials from `process.env`** — never hardcode usernames, emails, or passwords. For E2E testing and login, use `$ADMIN_USERNAME` and `$ADMIN_PASSWORD` from the environment. For backend test files: `server/tests/testCredentials.ts` reads env vars with Docker fallbacks. For Docker seeding: `server/seed-admin.ts` reads env vars. **No test file may hardcode its own credentials** — always import from `testCredentials.ts`. The `dockerSmokeTest.ts` reads env vars directly (no fallback, exits with error if missing — it runs in Docker where env vars are always set). Docker/CI fallback passwords exist only for containerized environments — they are irrelevant in Replit.
+- **Test Discipline (MANDATORY)**: When adding a new feature, fixing a bug, or changing existing functionality:
+  1. First check if tests already exist for the affected code (search `server/tests/`).
+  2. If no tests exist, always create or extend tests to cover the change.
+  3. If tests exist but don't cover the new behavior, extend them.
+  4. Ask the user for confirmation only if the test scope is unclear — by default, tests should be written.
+  5. All existing tests must still pass after changes (`npx vitest run`).
+- **Test-Cleanup (MANDATORY)**: When a test modifies database settings (`storage.setCustomizationSettings()`, `storage.setSetting()`, `service.saveTemplate()` etc.), it MUST save and restore the original state:
+  1. `beforeAll`: Read the current state into a variable (e.g. `origCustomization = await storage.getCustomizationSettings();`)
+  2. `afterAll`: Restore the saved state (e.g. `await storage.setCustomizationSettings(origCustomization);`). `afterAll` runs even when tests fail.
+  3. Tests must NOT pollute production DB — after a test run, all settings must be identical to before.
+  4. Pattern: `const orig = await storage.getCustomizationSettings(); ... afterAll: await storage.setCustomizationSettings(orig);`
+  5. **Template cleanup**: Any `describe` block that calls `service.saveTemplate()` MUST call `service.resetTemplate(type)` for all modified types in its `afterEach`. Without this, test crashes leave custom templates in the DB, breaking V3 rendering (templates with `htmlContent` set → `isDefault=false` → V3 body builder is skipped).
+- **i18n Discipline (MANDATORY)**: Every user-visible string in the frontend MUST use `t()` from react-i18next. When adding, changing, or removing any UI text:
+  1. Always add/update the key in BOTH `client/src/locales/de.json` AND `client/src/locales/en.json`.
+  2. If a text is modified, update the translation in both locale files immediately.
+  3. If a new key is added, both German and English translations must be provided — never leave one language empty or missing.
+  4. Run `node scripts/validate-translations.cjs` after locale changes to verify key parity, no duplicates, and no empty values.
+  5. The i18n regression test suite (`server/tests/ui/i18n-hardcoded-strings.test.ts`, 152 tests) must pass before any PR or deployment.
 
 ## System Architecture
 
@@ -18,148 +33,77 @@ Polly is an open-source, full-stack polling and scheduling platform designed for
 -   **Frontend**: React 18 with TypeScript, Vite, Shadcn/ui (Radix UI) + Tailwind CSS, TanStack Query v5, Wouter
 -   **Backend**: Express.js server with TypeScript
 -   **Database**: PostgreSQL with Drizzle ORM
--   **API Routing**: Modular structure in `server/routes/` with 156 endpoints:
-    -   `admin.ts` (89): Admin dashboard, tests, security, Pentest-Tools
-    -   `auth.ts` (15): Login, registration, Keycloak, password reset
-    -   `polls.ts` (17): Poll CRUD, options, invitations, reminders
-    -   `votes.ts` (7): Voting, bulk votes, edit tokens
-    -   `users.ts` (9): Profile, language, device tokens, user polls
-    -   `system.ts` (11): Health, theme, Matrix, upload, customization
-    -   `export.ts` (8): PDF, CSV, ICS, QR code, calendar feed
-    -   `common.ts`: Shared middleware, schemas, auth helpers
+-   **API Routing**: Modular structure in `server/routes/` with endpoints for admin, authentication, polls, votes, users, system, export, and common utilities.
 
 ### Key Features
 - **Poll Types**: Terminumfrage (Schedule), Umfrage (Survey), Orga-Liste (Organization/Booking).
-- **Vote Management**: Configurable vote editing, unique edit links, and results visibility (public/private).
-- **Authentication**: Anonymous token-based, local email/password, and optional Keycloak OIDC with role-based access.
+- **Schedule Poll Voting**: Time slots sorted chronologically and grouped by day with compact card layout. Dark-mode-safe voting buttons.
+- **Schedule Poll Editing**: End time auto-adjusts to Start + 30 minutes when Start >= End. Time defaults: Start=09:00, End=09:30.
+- **Vote Management**: Configurable vote editing, unique edit links, and results visibility.
+- **Authentication**: Anonymous token-based, local email/password, and optional Keycloak OIDC with role-based access. `HIDE_LOGIN_FORM=true` hides local form when SSO is primary (safety: auto-shows if SSO unavailable).
 - **Data Export**: CSV and PDF export of results, including QR code sharing for polls.
 - **Customization**: Admin panel for branding (theme, logo, site name) and dark mode settings.
 - **Multi-Language Support**: German (de) and English (en) with automatic browser detection and per-user preference storage.
-- **API Versioning**: `/api/v1/` endpoints with redirects from legacy paths.
-- **Notification System**: Configurable email reminders (expiry, manual), with spam protection and rate limiting.
+- **API Versioning**: `/api/v1/` endpoints.
+- **Notification System**: Configurable email reminders with spam protection and rate limiting.
 - **Profile Security**: Secure password reset, email change, and GDPR-compliant account deletion request flow.
 - **Live Voting**: Real-time vote tracking via WebSocket with fullscreen presentation mode.
-- **Admin Tools**: User management, email template customization, security scanning integration (ClamAV, npm audit, Pentest-Tools.com), and system package monitoring (Nix).
-- **Calendar Integration**: ICS export and webcal:// subscription for schedule polls with dynamic status prefixes (Tentative/Confirmed) and automatic cleanup when creator sets final date.
-- **Test Data Isolation**: `isTestData` flags in database for development and purging.
-    -   **Test Mode Header**: API requests with `X-Test-Mode: polly-e2e-test-mode` header automatically set `isTestData: true` on created polls, votes, and users
-    -   **Middleware**: `testModeMiddleware` in `server/routes/common.ts` sets `req.isTestMode = true`
-    -   **Secret Override**: Set `TEST_MODE_SECRET` env var to customize the header value
-    -   **Admin Purge**: Admin dashboard "Tests" panel has "Testdaten löschen" to remove all test data
+- **AI Auto-Enable**: AI chat is automatically enabled if `AI_API_KEY` is set unless explicitly disabled by admin.
+- **Voice Input (AI Chat)**: Microphone button records audio, transcodes to text via Whisper API, and inserts into chat.
+- **Admin Tools**: User management (incl. manual email verification), email template customization, security scanning integration, and system package monitoring.
+- **Post-Login Flow**: Regular users land on Home (`/`) with AI chat front and center; admins redirect to `/admin`.
+- **Meine Umfragen**: Consolidated poll management with stat cards (active/total/participations/this week), inline action buttons (stats/share/edit/delete), and archive tab for expired/closed polls. Dashboard page removed.
+- **Calendar Integration**: ICS export and webcal:// subscription for schedule polls. Finalization optionally closes the poll and sends notification emails with ICS calendar attachment to all participants. Optional video conference URL (Zoom, Teams, Google Meet) stored per schedule poll, shown as LOCATION in ICS/CalDAV, in finalization emails, and on the results page.
+- **Test Data Isolation**: `isTestData` flags for development and purging, with specific API header for test mode.
+- **Real-Time Slot Reservation (Orga-Listen)**: Uses transactional locking and advisory locks with WebSocket updates for capacity management.
 
 ### Technical Implementations
-- **Timezone Handling**: Schedule poll times stored in UTC, frontend displays and converts to local time.
-- **PDF Export**: Utilizes Puppeteer (Headless Chrome) for high-quality HTML/CSS-based PDF generation.
-- **Email Templates**: JSON-based, customizable templates with variable substitution and admin preview/test functionality.
-- **Internationalization (i18n)**:
-    -   **Library**: react-i18next with i18next-browser-languagedetector
-    -   **Languages**: German (de), English (en) - fallback
-    -   **Translation Files**: `client/src/locales/de.json`, `client/src/locales/en.json`
-    -   **Configuration**: `client/src/lib/i18n.ts`
-    -   **Language Switcher**: Globe icon in navigation bar
-    -   **User Preference**: Stored in database (`users.language_preference`), synced with localStorage
-    -   **API Endpoint**: `PATCH /api/v1/users/me/language` for updating preference
-    -   **Detection Order**: localStorage → browser navigator → fallback to English
-    -   **Coverage**: Complete frontend localization including:
-        -   All UI components (date-picker, time-picker, datetime-picker, CalendarPicker)
-        -   Large components (LiveResultsView, VotingInterface, OrganizationSlotVoting, AdminDashboard)
-        -   All poll creation pages (create-poll, create-survey, create-organization)
-        -   All poll viewing pages (poll, my-polls, poll-success, vote-success)
-    -   **Translation Key Structure**: Organized by component/page (e.g., `pollCreation.*`, `admin.*`, `liveResults.*`)
-- **WCAG 2.1 AA Color Contrast**:
-    -   **Audit**: Admin panel checks all theme colors against BOTH Light (#ffffff) and Dark (#0f172a) backgrounds
-    -   **Per-Mode Issues**: Reports separate issues for Light Mode and Dark Mode (no combined "worst of both")
-    -   **Per-Mode Corrections**: Stores separate color overrides per mode (e.g., `primaryColorLight`, `primaryColorDark`)
-    -   **CustomizationContext**: Uses per-mode overrides based on current dark/light mode; MutationObserver re-applies on mode toggle
-    -   **No Infinite Loop**: After applying corrections and re-auditing, all colors pass (verified by automated test)
-    -   **Schema Fields**: `themeSettingsSchema` has 8 optional per-mode override fields; `wcagAuditIssueSchema` includes `mode` and `bgColor`
-    -   **Endpoints**: `POST /api/v1/admin/wcag/audit`, `POST /api/v1/admin/wcag/apply-corrections`, `PUT /api/v1/admin/wcag/settings`
-- **Security Scanning**:
-    -   **ClamAV**: On-the-fly virus scanning of file uploads using `multer.memoryStorage`. Fail-secure: blocks uploads when enabled but daemon unreachable.
-    -   **ClamAV Scan Logs**: Stored in `clamav_scan_logs` table with context (userId, email, IP) for forensic analysis
-    -   **npm Audit**: Local scanning for dependency vulnerabilities with severity and impact labels.
-    -   **Pentest-Tools.com**: Integration for automated vulnerability scanning with real-time results.
-- **System Package Monitoring**: Displays Nix package information and versions for core dependencies.
-- **Session Management**:
-    -   **Store**: PostgreSQL (connect-pg-simple) when DATABASE_URL is set, MemoryStore fallback otherwise
-    -   **Cookie**: `polly.sid`, httpOnly, secure='auto' (adapts to HTTPS/HTTP), sameSite=lax
-    -   **Proxy Trust**: Auto-detected via REPL_ID, REPLIT_DEV_DOMAIN environment variables
-    -   **Session Save**: Explicit `req.session.save()` before response in login/register/callback endpoints
-    -   **Table**: `session` table auto-created by connect-pg-simple with pruning every 15 minutes
-    -   **Persistence**: Sessions survive server restarts when using PostgreSQL store
-- **Rate Limiting**:
-    -   **Login Endpoint**: 5 failed attempts per IP/Account → 15 Minuten Sperre (HTTP 429)
-    -   **Implementation**: `server/services/rateLimiterService.ts` mit In-Memory-Speicher
-    -   **Logging**: Gesperrte Konten werden mit IP-Adresse protokolliert
-    -   **Test Coverage**: Automatisierte Tests verifizieren Rate-Limit-Durchsetzung
-    -   **Production Note**: Rate-Limiter-Status geht bei Server-Neustart verloren; Redis empfohlen für Produktion
-- **Real-Time Slot Reservation (Orga-Listen)**:
-    -   **Transactional Locking**: `storage.vote()` für Organization Polls nutzt PostgreSQL `db.transaction()` mit `SELECT ... FOR UPDATE` Row-Level Locking
-    -   **Advisory Locks**: `pg_advisory_xact_lock()` basierend auf Poll+Voter-Email verhindert Race Conditions beim gleichzeitigen Buchen
-    -   **Überbuchungsschutz**: Kapazitätsprüfung innerhalb der Transaktion garantiert, dass maxCapacity nie überschritten wird
-    -   **WebSocket slot_update**: Nach jeder Buchung/Stornierung werden aktuelle Platzzahlen per WebSocket an alle verbundenen Clients gesendet
-    -   **Frontend Live-Updates**: `useLiveVoting` Hook empfängt `slot_update` Events, `VotingInterface` nutzt `liveSlotUpdates` State für Echtzeit-Anzeige
-    -   **Error Codes**: `SLOT_FULL` (HTTP 409), `ALREADY_SIGNED_UP` (HTTP 409) mit lokalisierten Fehlermeldungen
-
-## API Documentation
-
--   **OpenAPI Spec**: `docs/openapi.yaml` - Vollständige API-Spezifikation im OpenAPI 3.0 Format
--   **Flutter Integration**: `docs/FLUTTER_INTEGRATION.md` - Detaillierte Dokumentation für Mobile App Integration
--   **Self-Hosting Guide**: `docs/SELF-HOSTING.md` - Anleitung für Docker/Production Deployment
-
-## Docker Migration Path
-
-When schema changes are made (new columns in `shared/schema.ts`), existing Docker databases need to be updated:
-
-### For Developers Adding New Schema Columns
-1. Add the column to `shared/schema.ts` (Drizzle schema)
-2. Add matching entry to `server/scripts/ensureSchema.ts` in `COLUMN_UPDATES` array
-3. Update `migrations/0000_old_vance_astro.sql` for fresh installs
-4. Update `createCoreTables()` fallback function in `ensureSchema.ts`
-
-### For Users Updating Existing Docker Installations
-After pulling new code with schema changes:
-```bash
-docker compose down
-docker compose build --no-cache app
-make complete
-```
-
-The `ensureSchema.ts` script automatically adds missing columns via `ALTER TABLE ADD COLUMN IF NOT EXISTS`.
-
-### Fresh Install (No Existing Data)
-```bash
-docker compose down -v  # Removes database volumes
-make complete
-```
-
-## Release & CI/CD
-
-### GitHub Actions Workflows
--   **CI** (`.github/workflows/ci.yml`): Runs on push/PR to main/develop — lint, type check, unit tests, build, E2E tests, security audit
--   **Release** (`.github/workflows/release.yml`): Triggered by `v*` tags — validates, builds Docker image, pushes to Docker Hub (`manfredsteger/polly`), creates GitHub Release, mirrors tags to GitLab
-
-### Release Process
-1. Create annotated tag: `git tag -a v0.1.0-beta.1 -m "Beta Release"`
-2. Push tag: `git push origin v0.1.0-beta.1`
-3. Pipeline runs automatically: validate → Docker build+push → Docker Hub README sync → GitHub Release → GitLab mirror
-4. Required GitHub Secrets: `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`, optionally `GITLAB_TOKEN`
-
-### Docker Image: `manfredsteger/polly`
-- Beta tags: `manfredsteger/polly:0.1.0-beta.1` + `manfredsteger/polly:beta`
-- Stable tags: `manfredsteger/polly:1.0.0` + `manfredsteger/polly:latest`
-
-### Makefile
-- Default `IMAGE_NAME`: `manfredsteger/polly`
-- `make publish` — Build + push to Docker Hub
-- `make release` — Interactive version prompt, build + push versioned + latest tags
-- Full documentation: `docs/RELEASING.md`
+- **Timezone Handling**: Schedule poll times stored in UTC, frontend converts to local time.
+- **PDF Export**: Utilizes Puppeteer for HTML/CSS-based PDF generation.
+- **Email Templates (V3)**: Single-HTML-template system with `{{VARIABLE}}` substitution. All 10 email types (poll_created, invitation, vote_confirmation, reminder, password_reset, email_change, password_changed, welcome, test_report, poll_finalized) render via `emailTemplateService.renderEmail()` using `v3Shell()` + per-type body builders. V3 design: beige outer (#f0ede8), white card (border-radius: 10px), compact header (logo|separator|wordmark), structured body (tag + headline + subline + link sections + notice), **centralized footer** (loaded from `getEmailFooter()` with `{{siteName}}` and `{{siteUrl}}` variable substitution, `{{link:URL}}` and `{{link:URL|Label}}` template syntax for clickable links rendered via `renderFooterMarkup()` — XSS-safe with URL protocol validation (only http/https/#/mailto allowed), newlines converted to `<br>`, plain-text version via `stripFooterMarkupToText()`. Default footer includes Datenschutz placeholder: `{{link:#|Datenschutz}}`. Privacy link from customization supportLinks shown separately). **Dark mode**: `@media (prefers-color-scheme: dark)` CSS with named classes (.shell, .email-header, .btn-primary, .btn-secondary, .notice, .email-footer). **Logo embedding**: Logos fetched and converted to base64 data URIs at render time (5-min cache, SSRF-safe URL validation, strict data URI MIME validation, fallback to text-only header). **Button contrast**: `ensureButtonTextContrast()` auto-selects dark/light text based on background luminance. XSS protection: `htmlEscape()` for all user-supplied variables, strict data URI validation for logos. Custom templates wrapped in V3 shell via `buildV3GenericBody()`. `wrapWithEmailTheme()` also uses V3 shell for ad-hoc emails. **Subject cleanup**: Empty `[]` prefix auto-removed when siteName is not configured. **Privacy URL**: `resolvePrivacyUrl()` returns empty string (no fallback) when no privacy link configured in customization supportLinks — Datenschutz link hidden in footer.
+- **Internationalization (i18n)**: React-i18next for localization, covering all UI components and pages, with language preference stored in the database.
+- **WCAG 2.1 AA Color Contrast**: Admin panel audits theme colors against accessibility standards, with separate corrections for light and dark modes.
+- **Security Scanning**: ClamAV for file uploads, npm audit for dependencies, and Pentest-Tools.com integration for vulnerability scanning.
+- **System Package Monitoring**: Displays Nix package information for core dependencies.
+- **Session Management**: PostgreSQL-backed sessions with `polly.sid` cookie, secure and sameSite configuration, proxy trust detection, session regeneration on login/register (session fixation prevention), role-based idle timeout middleware (admin/manager/user), and `lastActivity` tracking.
+- **Rate Limiting**: In-memory rate limiter for login attempts (5 failed attempts per IP/Account → 15 min lockout).
+- **Security Hardening**: Force-password-change for default admin credentials (`isInitialAdmin` middleware blocks API until password changed), Cache-Control `no-store` on all API responses, generic error messages (no `error.message` leaks), JSON body limit 1MB, field-level input length validation (voter names 100, option text 500, description 5000, email 254), `autocomplete="off"` on all password fields, `X-Powered-By` disabled.
+
+### API Documentation
+-   **API-Dokumentation (Pentest-tauglich)**: `docs/API-DOCUMENTATION.md` — vollständige REST-API-Referenz mit allen Endpunkten, Schemas, Auth-Mechanismen, Rate Limiting und Fehlercodes. **Muss bei jeder API-Änderung aktualisiert werden.**
+-   **OpenAPI Spec**: `docs/openapi.yaml` provides a full API specification for Flutter/Mobile integration.
+-   **Flutter Integration**: `docs/FLUTTER_INTEGRATION.md` for mobile app integration.
+-   **Self-Hosting Guide**: `docs/SELF-HOSTING.md` for Docker/Production Deployment.
+
+### Docker Migration Path
+Schema changes involve updating `shared/schema.ts`, `server/scripts/ensureSchema.ts`, and migration files. `ensureSchema.ts` automatically adds missing columns and indexes on startup.
+
+### Database Indexes
+Token tables (`password_reset_tokens`, `email_verification_tokens`, `email_change_tokens`) have indexes on `token` and `user_id`. `notification_logs` is indexed on `poll_id` and `type`. `votes` is indexed on `poll_id`, `option_id`, `voter_email`, `voter_key`, and `voter_edit_token`.
+
+### Test Coverage (454+ tests)
+- **API**: 174 tests (admin CRUD, user profile/theme/language, poll CRUD/voting/export, email templates, security, validation)
+- **Auth**: 55 tests (login, registration, password reset, session persistence, cookie security)
+- **Polls**: 30 tests (CRUD, voting, finalize, types)
+- **Data/Storage**: 40 tests (settings, branding, storage, test data)
+- **Unit**: 34 tests (validation, token service, QR service)
+- **Services**: 132+ tests (email templates 63, email integration 13, live voting WebSocket multi-user 19, image upload file types 16, ClamAV, ICS, PDF, WCAG audit)
+- **Security**: 31 tests (WebSocket presenter escalation, poll token validation, email HTML escaping/XSS, deprovision Basic Auth, timing attack resistance)
+- **E2E/Integration**: 49 tests (poll flow, multi-voter, Docker build, deployment readiness, DB migration)
+
+### Release & CI/CD
+-   **GitHub Actions**: Workflows for CI (lint, type check, tests, build, E2E, security audit) and Release (Docker image build/push to Docker Hub, GitHub Release, GitLab mirror).
+-   **Docker Image**: `manfredsteger/polly` with beta and stable tags.
+
+### Docker Deployment
+-   **APP_URL**: Single environment variable for the public application URL, used for OIDC redirects, email links, and sharing.
+-   **Entrypoint**: `docker-entrypoint.sh` parses `DATABASE_URL` and handles `pg_isready` checks.
 
 ## External Dependencies
 
--   **PostgreSQL**: Main database for all application data.
--   **Keycloak OIDC**: Optional OpenID Connect provider for enterprise SSO.
--   **SMTP Service**: For sending application emails (notifications, password resets).
--   **Chromium**: Required for PDF export functionality (used by Puppeteer).
--   **ClamAV**: External antivirus engine for file upload scanning.
+-   **PostgreSQL**: Main database.
+-   **Keycloak OIDC**: Optional OpenID Connect provider.
+-   **SMTP Service**: For sending application emails.
+-   **Chromium**: Used by Puppeteer for PDF export.
+-   **ClamAV**: External antivirus engine for file uploads.
 -   **Pentest-Tools.com Pro API**: For automated security vulnerability scanning.
\ No newline at end of file
diff --git a/scripts/post-merge.sh b/scripts/post-merge.sh
new file mode 100644
index 00000000..a12a3803
--- /dev/null
+++ b/scripts/post-merge.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+npm install
+npm run db:push
diff --git a/server/index.ts b/server/index.ts
index 0df80dd8..8783edea 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -9,6 +9,7 @@ import { setupVite, serveStatic, log } from "./vite";
 import { liveVotingService } from "./services/liveVotingService";
 import { bootstrapBranding } from "./scripts/applyBranding";
 import { errorHandler } from "./lib/errorHandler";
+import { getBaseUrl, warnIfLocalhostInProduction } from "./utils/baseUrl";
 
 const MemoryStore = createMemoryStore(session);
 const PgSession = connectPgSimple(session);
@@ -20,15 +21,17 @@ app.disable('x-powered-by');
 
 // Trust proxy - required for secure cookies behind reverse proxy (Replit, Heroku, etc.)
 // Enable always when running behind a proxy (detected via common proxy headers or explicit config)
+const resolvedAppUrl = getBaseUrl();
+warnIfLocalhostInProduction();
 const isProxied = process.env.NODE_ENV === 'production' || 
-                  process.env.BASE_URL?.includes('replit') ||
+                  resolvedAppUrl.includes('replit') ||
                   process.env.REPLIT_DEV_DOMAIN ||
                   process.env.REPL_ID;
 if (isProxied) {
   app.set('trust proxy', 1);
 }
 
-app.use(express.json());
+app.use(express.json({ limit: '1mb' }));
 app.use(express.urlencoded({ extended: false }));
 app.use(cookieParser());
 
@@ -41,15 +44,13 @@ app.use((req, res, next) => {
   
   // Check if app is actually running over HTTPS
   const isHttps = req.secure || req.headers['x-forwarded-proto'] === 'https' || 
-    (process.env.BASE_URL && process.env.BASE_URL.startsWith('https://'));
+    (resolvedAppUrl && resolvedAppUrl.startsWith('https://'));
   
   const cspDirectives = [
     "default-src 'self'",
-    // In production: no unsafe-eval (Vite bundles everything)
-    // In development: unsafe-eval needed for Vite HMR
     isDev 
       ? "script-src 'self' 'unsafe-inline' 'unsafe-eval'" 
-      : "script-src 'self' 'unsafe-inline'",
+      : "script-src 'self'",
     "style-src 'self' 'unsafe-inline'", // Required for Tailwind CSS - cannot be avoided
     "img-src 'self' data: blob: https:",
     "font-src 'self' data:",
@@ -80,7 +81,7 @@ app.use((req, res, next) => {
   // Permissions-Policy - Restricts browser features
   res.setHeader('Permissions-Policy', [
     'camera=()',
-    'microphone=()',
+    'microphone=(self)',
     'geolocation=()',
     'payment=()',
   ].join(', '));
@@ -129,7 +130,7 @@ app.use(session({
   saveUninitialized: false,
   name: 'polly.sid',
   cookie: {
-    secure: 'auto',
+    secure: isProxied ? true : false,
     httpOnly: true,
     maxAge: 24 * 60 * 60 * 1000, // 24 hours
     sameSite: 'lax',
@@ -138,6 +139,81 @@ app.use(session({
   store: createSessionStore(),
 }));
 
+app.use((req, res, next) => {
+  if (req.path.startsWith('/api/')) {
+    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+    res.setHeader('Pragma', 'no-cache');
+    res.setHeader('Expires', '0');
+  }
+  next();
+});
+
+app.use(async (req, res, next) => {
+  if (!req.session?.userId) return next();
+
+  const now = Date.now();
+
+  try {
+    const { storage } = await import('./storage');
+
+    if (req.session.lastActivity) {
+      const setting = await storage.getSetting('session_timeout_settings');
+      const config = setting?.value as { enabled?: boolean; adminTimeoutMinutes?: number; managerTimeoutMinutes?: number; userTimeoutMinutes?: number } | null;
+
+      if (config?.enabled) {
+        const user = await storage.getUser(req.session.userId);
+        if (user) {
+          let timeoutMs: number;
+          if (user.role === 'admin') {
+            timeoutMs = (config.adminTimeoutMinutes || 480) * 60 * 1000;
+          } else if (user.role === 'manager') {
+            timeoutMs = (config.managerTimeoutMinutes || 240) * 60 * 1000;
+          } else {
+            timeoutMs = (config.userTimeoutMinutes || 60) * 60 * 1000;
+          }
+
+          const elapsed = now - req.session.lastActivity;
+          if (elapsed > timeoutMs) {
+            return req.session.destroy((err) => {
+              if (err) console.error('Session timeout destroy error:', err);
+              res.status(401).json({ error: 'Session abgelaufen', code: 'SESSION_EXPIRED' });
+            });
+          }
+        }
+      }
+    }
+
+    req.session.lastActivity = now;
+  } catch (err) {
+    console.error('Session timeout middleware error:', err);
+  }
+
+  next();
+});
+
+app.use(async (req, res, next) => {
+  if (!req.session?.userId) return next();
+  if (!req.path.startsWith('/api/')) return next();
+
+  const allowedPaths = ['/api/v1/auth/me', '/api/v1/auth/logout', '/api/v1/auth/change-password'];
+  if (allowedPaths.some(p => req.path === p)) return next();
+
+  try {
+    const { storage } = await import('./storage');
+    const user = await storage.getUser(req.session.userId);
+    if (user?.isInitialAdmin) {
+      return res.status(403).json({
+        error: 'Passwortänderung erforderlich',
+        code: 'PASSWORD_CHANGE_REQUIRED',
+      });
+    }
+  } catch (err) {
+    console.error('Force password change middleware error:', err);
+  }
+
+  next();
+});
+
 app.use((req, res, next) => {
   const start = Date.now();
   const path = req.path;
diff --git a/server/routes/admin.ts b/server/routes/admin.ts
index afdcdf39..4f96a40e 100644
--- a/server/routes/admin.ts
+++ b/server/routes/admin.ts
@@ -15,7 +15,7 @@ import type { User } from "@shared/schema";
 import { apiRateLimitsSettingsSchema } from "@shared/schema";
 import { db } from "../db";
 import { testRuns } from "@shared/schema";
-import { eq, ne, or, and, desc } from "drizzle-orm";
+import { eq, or, and, desc } from "drizzle-orm";
 
 const router = Router();
 
@@ -136,6 +136,11 @@ router.post('/users', requireAdmin, async (req, res) => {
       return res.status(400).json({ error: 'Dieser Benutzername wird bereits verwendet.' });
     }
     
+    const validRoles = ['user', 'admin', 'manager'];
+    if (role && !validRoles.includes(role)) {
+      return res.status(400).json({ error: `Ungültige Rolle. Erlaubte Rollen: ${validRoles.join(', ')}` });
+    }
+    
     const passwordHash = await bcrypt.hash(password, 12);
     
     const newUser = await storage.createUser({
@@ -144,7 +149,7 @@ router.post('/users', requireAdmin, async (req, res) => {
       username: username.toLowerCase().trim(),
       passwordHash,
       provider: 'local',
-      role: role && ['user', 'admin', 'manager'].includes(role) ? role : 'user',
+      role: role || 'user',
     });
     
     console.log(`[Admin] User created manually by admin: ${newUser.email} (ID: ${newUser.id})`);
@@ -159,7 +164,7 @@ router.post('/users', requireAdmin, async (req, res) => {
 router.patch('/users/:id', requireAdmin, async (req, res) => {
   try {
     const userId = parseInt(req.params.id);
-    const { role, name, email, organization } = req.body;
+    const { role, name, email, organization, emailVerified } = req.body;
     
     const updates: Record<string, any> = {};
     if (role && ['user', 'admin', 'manager'].includes(role)) {
@@ -168,6 +173,7 @@ router.patch('/users/:id', requireAdmin, async (req, res) => {
     if (name) updates.name = name;
     if (email) updates.email = email;
     if (organization !== undefined) updates.organization = organization;
+    if (emailVerified === true) updates.emailVerified = true;
     
     if (Object.keys(updates).length === 0) {
       return res.status(400).json({ error: 'Keine gültigen Updates angegeben' });
@@ -288,6 +294,12 @@ router.get('/polls', requireAdmin, async (req, res) => {
 router.patch('/polls/:id', requireAdmin, async (req, res) => {
   try {
     const pollId = req.params.id;
+    
+    const existing = await storage.getPoll(pollId);
+    if (!existing) {
+      return res.status(404).json({ error: 'Umfrage nicht gefunden' });
+    }
+    
     const { isActive, title, description, expiresAt, resultsPublic } = req.body;
     
     const updates: Record<string, any> = {};
@@ -312,6 +324,12 @@ router.patch('/polls/:id', requireAdmin, async (req, res) => {
 router.delete('/polls/:id', requireAdmin, async (req, res) => {
   try {
     const pollId = req.params.id;
+    
+    const existing = await storage.getPoll(pollId);
+    if (!existing) {
+      return res.status(404).json({ error: 'Umfrage nicht gefunden' });
+    }
+    
     await storage.deletePoll(pollId);
     res.json({ success: true, message: 'Umfrage gelöscht' });
   } catch (error) {
@@ -346,7 +364,7 @@ router.post('/settings', requireAdmin, async (req, res) => {
 router.delete('/settings/:key', requireAdmin, async (req, res) => {
   try {
     const key = req.params.key;
-    await storage.setSetting({ key, value: null, description: 'Deleted' });
+    await storage.deleteSetting(key);
     res.json({ success: true, message: 'Einstellung gelöscht' });
   } catch (error) {
     console.error('Error deleting setting:', error);
@@ -1652,12 +1670,12 @@ router.post('/email-templates/:type/test', requireAdmin, async (req, res) => {
     };
     
     const rendered = await emailTemplateService.renderEmail(type as any, sampleVariables[type] || {});
-    await emailService.sendCustomEmail(recipientEmail, rendered.subject, rendered.html, rendered.text);
+    await emailService.sendPreRenderedEmail(recipientEmail, rendered.subject, rendered.html, rendered.text);
     
     res.json({ success: true, message: 'Test-E-Mail gesendet' });
   } catch (error: any) {
     console.error('Error sending test email:', error);
-    res.status(500).json({ error: error.message || 'Fehler beim Senden der Test-E-Mail' });
+    res.status(500).json({ error: 'Fehler beim Senden der Test-E-Mail' });
   }
 });
 
@@ -1826,7 +1844,7 @@ router.post('/matrix/test', requireAdmin, async (req, res) => {
     res.json(result);
   } catch (error: any) {
     console.error('Matrix connection test error:', error);
-    res.json({ success: false, error: error.message });
+    res.json({ success: false, error: 'Verbindungstest fehlgeschlagen' });
   }
 });
 
@@ -1884,21 +1902,7 @@ router.get('/test-runs/current', requireAdmin, async (req, res) => {
     // For running tests, get live progress
     const liveProgress = testRunnerService.getLiveProgress();
     
-    // For running tests, use estimated total from last completed run if no results yet
     let estimatedTotal = currentRun.totalTests || 0;
-    if (currentRun.status === 'running' && estimatedTotal === 0) {
-      // Get last completed test run's total as estimate
-      const [lastRun] = await db
-        .select({ totalTests: testRuns.totalTests })
-        .from(testRuns)
-        .where(and(
-          ne(testRuns.id, currentRun.id),
-          or(eq(testRuns.status, 'completed'), eq(testRuns.status, 'failed'))
-        ))
-        .orderBy(desc(testRuns.id))
-        .limit(1);
-      estimatedTotal = lastRun?.totalTests || 320; // fallback estimate
-    }
     
     // Use live progress if test is running
     const passed = liveProgress ? liveProgress.passed : (currentRun.passed || 0);
@@ -1923,7 +1927,7 @@ router.get('/test-runs/current', requireAdmin, async (req, res) => {
         failed,
         skipped
       },
-      isEstimated: currentRun.status === 'running' && (currentRun.totalTests || 0) === 0,
+      isEstimated: false,
       liveProgress: liveProgress ? {
         currentTest: liveProgress.currentTest,
         currentFile: liveProgress.currentFile
@@ -1961,7 +1965,18 @@ router.post('/test-runs/stop', requireAdmin, async (req, res) => {
 
 // ============== LOGO UPLOAD (admin) ==============
 
-router.post('/customization/logo', requireAdmin, imageService.getUploadMiddleware().single('logo'), async (req, res) => {
+router.post('/customization/logo', requireAdmin, (req, res, next) => {
+  const upload = imageService.getUploadMiddleware().single('logo');
+  upload(req, res, (err: any) => {
+    if (err) {
+      if (err.code === 'LIMIT_FILE_SIZE') {
+        return res.status(400).json({ error: 'Datei ist zu groß (max. 5 MB)' });
+      }
+      return res.status(400).json({ error: 'Upload fehlgeschlagen' });
+    }
+    next();
+  });
+}, async (req, res) => {
   try {
     if (!req.file) {
       return res.status(400).json({ error: 'No logo file provided' });
@@ -1974,7 +1989,8 @@ router.post('/customization/logo', requireAdmin, imageService.getUploadMiddlewar
 
     if (!result.success) {
       let statusCode = 500;
-      if (result.virusName) statusCode = 422;
+      if (result.invalidFileType) statusCode = 400;
+      else if (result.virusName) statusCode = 422;
       else if (result.scannerUnavailable) statusCode = 503;
       return res.status(statusCode).json({
         error: result.error,
diff --git a/server/routes/ai.ts b/server/routes/ai.ts
new file mode 100644
index 00000000..b7ddc23e
--- /dev/null
+++ b/server/routes/ai.ts
@@ -0,0 +1,424 @@
+import { Router } from "express";
+import { requireAuth } from "./common";
+import {
+  createPollFromDescription,
+  refinePollSuggestion,
+  getAiSettings,
+  saveAiSettings,
+  getEffectiveApiKey,
+  getEffectiveApiUrl,
+} from "../services/aiService";
+import {
+  aiRateLimitMiddleware,
+  checkAiRateLimit,
+  logAiUsage,
+} from "../services/aiRateLimiterService";
+import { transcribeLargeFile } from "../services/whisperService";
+import { aiSettingsSchema } from "@shared/schema";
+import { z } from "zod";
+import { storage } from "../storage";
+import { emailService } from "../services/emailService";
+import { pollCreationRateLimiter } from "../services/apiRateLimiterService";
+import multer from "multer";
+
+const router = Router();
+
+const audioUpload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 100 * 1024 * 1024 },
+});
+
+// POST /api/v1/ai/transcribe — Audio → Text via GWDG Whisper
+router.post("/transcribe", audioUpload.single("audio"), async (req, res) => {
+  try {
+    const transcribeSettings = await getAiSettings();
+    if (!getEffectiveApiKey(transcribeSettings)) {
+      return res.status(503).json({ success: false, error: "AI API nicht konfiguriert" });
+    }
+
+    const file = req.file;
+    if (!file) {
+      return res.status(400).json({ success: false, error: "Keine Audiodatei gefunden" });
+    }
+
+    const language = typeof req.body.language === "string" ? req.body.language : undefined;
+    const mimeType = file.mimetype || "audio/webm";
+
+    console.log(`[Transcribe] ${file.originalname}, ${(file.size / 1024 / 1024).toFixed(2)} MB, ${mimeType}`);
+
+    const result = await transcribeLargeFile(file.buffer, mimeType, language);
+
+    if (!result.success) {
+      return res.status(500).json({ success: false, error: result.error });
+    }
+
+    return res.json({ success: true, text: result.text, language: result.language });
+  } catch (error) {
+    console.error("[Transcribe] Error:", error);
+    return res.status(500).json({
+      success: false,
+      error: "Transkription fehlgeschlagen",
+    });
+  }
+});
+
+// GET /api/v1/ai/status — public (shows enabled state + quota for current user)
+router.get("/status", async (req, res) => {
+  try {
+    const settings = await getAiSettings();
+    const userId = (req.session as any)?.userId ?? null;
+    const role: "guest" | "user" | "admin" =
+      userId === null ? "guest" : "user";
+    const sessionId =
+      req.cookies?.["polly.sid"] ||
+      (req.headers["x-session-id"] as string) ||
+      req.ip ||
+      "unknown";
+
+    const rateCheck = await checkAiRateLimit(userId, role, sessionId);
+
+    res.json({
+      enabled: settings.enabled,
+      apiConfigured: !!getEffectiveApiKey(settings),
+      model: settings.model,
+      canUse: rateCheck.allowed,
+      remaining: rateCheck.remaining,
+      reason: rateCheck.reason,
+      resetAt: rateCheck.resetAt?.toISOString() ?? null,
+      limits: {
+        guest: settings.guestLimits,
+        user: settings.userLimits,
+        admin: settings.adminLimits,
+      },
+    });
+  } catch (err) {
+    console.error("[AI] Status error:", err);
+    res.status(500).json({ error: "Interner Fehler" });
+  }
+});
+
+// POST /api/v1/ai/create-poll — rate-limited, creates or refines poll suggestion
+router.post("/create-poll", aiRateLimitMiddleware, async (req, res) => {
+  const schema = z.object({
+    description: z.string().min(5).max(10000),
+    language: z.enum(["de", "en"]).default("de"),
+    refinement: z.string().min(3).max(3000).optional(),
+    previousSuggestion: z.object({
+      pollType: z.enum(["schedule", "survey", "organization"]),
+      title: z.string(),
+      description: z.string(),
+      options: z.array(z.union([z.string(), z.object({ text: z.string(), isFreeText: z.boolean().optional() })])),
+      settings: z.record(z.boolean()).optional(),
+    }).optional(),
+  });
+
+  const parsed = schema.safeParse(req.body);
+  if (!parsed.success) {
+    return res
+      .status(400)
+      .json({ error: "Ungültige Eingabe", details: parsed.error.errors });
+  }
+
+  const { description, language, refinement, previousSuggestion } = parsed.data;
+  const userId = (req as any).aiUserId ?? null;
+  const sessionId = (req as any).aiSessionId ?? "unknown";
+  const settings = await getAiSettings();
+  const model = process.env.AI_MODEL || settings.model;
+  const isRefinement = !!(refinement && previousSuggestion);
+
+  try {
+    const suggestion = isRefinement
+      ? await refinePollSuggestion(description, previousSuggestion as any, refinement!, language)
+      : await createPollFromDescription(description, language);
+
+    await logAiUsage({
+      userId,
+      sessionId,
+      endpoint: isRefinement ? "refine-poll" : "create-poll",
+      model,
+      success: true,
+    });
+
+    res.json({ suggestion });
+  } catch (err: any) {
+    const errorCode = err?.message || "AI_REQUEST_FAILED";
+
+    await logAiUsage({
+      userId,
+      sessionId,
+      endpoint: isRefinement ? "refine-poll" : "create-poll",
+      model,
+      success: false,
+      errorMessage: errorCode,
+    });
+
+    const messages: Record<string, { status: number; message: string }> = {
+      AI_DISABLED: { status: 503, message: "KI-Funktion ist deaktiviert" },
+      AI_NOT_CONFIGURED: { status: 503, message: "KI-API nicht konfiguriert" },
+      AI_MODEL_LOADING: { status: 503, message: "Das KI-Modell wird gerade gestartet. Bitte in einer Minute erneut versuchen." },
+      AI_EMPTY_RESPONSE: { status: 502, message: "Keine Antwort von der KI erhalten" },
+      AI_INVALID_JSON: { status: 502, message: "Ungültige Antwort der KI" },
+      AI_INVALID_STRUCTURE: { status: 502, message: "KI-Antwort hat unerwartetes Format" },
+      AI_REQUEST_FAILED: { status: 502, message: "KI-Anfrage fehlgeschlagen" },
+    };
+
+    const mapped = messages[errorCode] || { status: 500, message: "Interner Fehler" };
+    console.error("[AI] create-poll error:", errorCode, err);
+    res.status(mapped.status).json({ error: mapped.message, code: errorCode });
+  }
+});
+
+// POST /api/v1/ai/apply — create a poll directly from an AI suggestion
+router.post("/apply", pollCreationRateLimiter, async (req, res) => {
+  const settingsSchema = z.object({
+    resultsPublic: z.boolean().optional(),
+    allowVoteEdit: z.boolean().optional(),
+    allowVoteWithdrawal: z.boolean().optional(),
+    allowMaybe: z.boolean().optional(),
+    allowMultipleSlots: z.boolean().optional(),
+  });
+
+  const schema = z.object({
+    suggestion: z.object({
+      pollType: z.enum(["schedule", "survey", "organization"]),
+      title: z.string().min(1).max(200),
+      description: z.string().optional(),
+      options: z.array(z.union([z.string().min(1), z.object({ text: z.string().min(1), isFreeText: z.boolean().optional() })])).min(1),
+      settings: settingsSchema.optional(),
+    }),
+    settings: settingsSchema,
+    creatorEmail: z.string().email().optional(),
+  });
+
+  const parsed = schema.safeParse(req.body);
+  if (!parsed.success) {
+    return res.status(400).json({ error: "Ungültige Eingabe", details: parsed.error.errors });
+  }
+
+  const { suggestion, settings, creatorEmail: bodyEmail } = parsed.data;
+
+  let userId: number | null = null;
+  let creatorEmail: string | null = null;
+
+  if ((req.session as any)?.userId) {
+    const sessionUser = await storage.getUser((req.session as any).userId);
+    if (!sessionUser) return res.status(401).json({ error: "Ungültige Session" });
+    userId = sessionUser.id;
+    creatorEmail = sessionUser.email;
+  } else {
+    creatorEmail = bodyEmail || null;
+    if (creatorEmail) {
+      const registeredUser = await storage.getUserByEmail(creatorEmail.toLowerCase().trim());
+      if (registeredUser) {
+        return res.status(409).json({
+          error: "Diese E-Mail-Adresse gehört zu einem registrierten Konto. Bitte melden Sie sich an.",
+          errorCode: "REQUIRES_LOGIN",
+        });
+      }
+    }
+  }
+
+  // Transform options per poll type
+  const transformedOptions = suggestion.options.map((rawOpt, index) => {
+    const opt = typeof rawOpt === 'string' ? rawOpt : (rawOpt as any).text || String(rawOpt);
+    if (suggestion.pollType === "schedule") {
+      const match = opt.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})\s+(\d{2}:\d{2})\s*-\s*(\d{2}:\d{2})/);
+      if (match) {
+        const [, day, month, year, startH, endH] = match;
+        const d = new Date(parseInt(year), parseInt(month) - 1, parseInt(day));
+        const startTime = new Date(d.toDateString() + " " + startH);
+        const endTime = new Date(d.toDateString() + " " + endH);
+        return {
+          text: opt,
+          startTime: isNaN(startTime.getTime()) ? null : startTime,
+          endTime: isNaN(endTime.getTime()) ? null : endTime,
+          maxCapacity: null,
+          order: index,
+          pollId: "",
+        };
+      }
+      return { text: opt, startTime: null, endTime: null, maxCapacity: null, order: index, pollId: "" };
+    }
+
+    if (suggestion.pollType === "organization") {
+      const timeMatch = opt.match(/(\d{2}:\d{2})\s*-\s*(\d{2}:\d{2})/);
+      const capMatch = opt.match(/\(max\.?\s*(\d+)/i);
+      let cleanText = opt;
+      if (timeMatch) {
+        const timeIndex = opt.indexOf(timeMatch[0]);
+        const before = opt.substring(0, timeIndex).trim();
+        cleanText = before || opt;
+      }
+      cleanText = cleanText.replace(/\(max\.?\s*\d+[^)]*\)/gi, "").trim() || opt;
+      return {
+        text: cleanText,
+        startTime: null,
+        endTime: null,
+        maxCapacity: capMatch ? parseInt(capMatch[1]) : null,
+        order: index,
+        pollId: "",
+      };
+    }
+
+    return { text: opt, startTime: null, endTime: null, maxCapacity: null, order: index, pollId: "" };
+  });
+
+  // Merge settings: AI defaults overridden by user toggles
+  const finalSettings = { ...suggestion.settings, ...settings };
+
+  const pollData = {
+    title: suggestion.title,
+    description: suggestion.description || "",
+    type: suggestion.pollType,
+    userId,
+    creatorEmail,
+    expiresAt: undefined,
+    enableExpiryReminder: false,
+    expiryReminderHours: 24,
+    allowMultipleSlots: finalSettings.allowMultipleSlots ?? (suggestion.pollType === "organization" ? false : true),
+    allowVoteEdit: finalSettings.allowVoteEdit ?? false,
+    allowVoteWithdrawal: finalSettings.allowVoteWithdrawal ?? false,
+    resultsPublic: finalSettings.resultsPublic ?? true,
+    isTestData: (req as any).isTestMode === true,
+  };
+
+  try {
+    const result = await storage.createPoll(pollData, transformedOptions as any);
+
+    if (creatorEmail) {
+      const { getBaseUrl } = await import("../utils/baseUrl");
+      const baseUrl = getBaseUrl();
+      const publicLink = `${baseUrl}/poll/${result.poll.publicToken}`;
+      const adminLink = `${baseUrl}/admin/${result.poll.adminToken}`;
+      await emailService.sendPollCreationEmails(
+        creatorEmail,
+        suggestion.title,
+        publicLink,
+        adminLink,
+        suggestion.pollType,
+        userId !== null
+      );
+    }
+
+    res.json({
+      poll: { ...result.poll, options: result.options },
+      publicToken: result.publicToken,
+      adminToken: result.adminToken,
+    });
+  } catch (err) {
+    console.error("[AI] apply error:", err);
+    res.status(500).json({ error: "Fehler beim Erstellen der Umfrage" });
+  }
+});
+
+// GET /api/v1/admin/ai/settings — admin only
+router.get("/admin/settings", requireAuth, async (req, res) => {
+  try {
+    const user = await import("../storage").then((m) =>
+      m.storage.getUser((req.session as any).userId)
+    );
+    if (!user || user.role !== "admin") {
+      return res.status(403).json({ error: "Nur für Administratoren" });
+    }
+
+    const settings = await getAiSettings();
+    const safeSettings = { ...settings, apiKey: undefined, apiKeyFallback: undefined };
+    res.json({
+      settings: safeSettings,
+      apiConfigured: !!getEffectiveApiKey(settings),
+      fallbackConfigured: !!(process.env.AI_API_KEY_FALLBACK || settings.apiKeyFallback),
+      hasApiKey: !!settings.apiKey,
+      hasApiKeyFallback: !!settings.apiKeyFallback,
+      apiKeyViaEnv: !!process.env.AI_API_KEY,
+      apiKeyFallbackViaEnv: !!process.env.AI_API_KEY_FALLBACK,
+      apiUrlViaEnv: !!process.env.AI_API_URL,
+      envModel: process.env.AI_MODEL || null,
+      envApiUrl: process.env.AI_API_URL || null,
+    });
+  } catch (err) {
+    console.error("[AI] Admin settings GET error:", err);
+    res.status(500).json({ error: "Interner Fehler" });
+  }
+});
+
+// PUT /api/v1/admin/ai/settings — admin only
+router.put("/admin/settings", requireAuth, async (req, res) => {
+  try {
+    const user = await import("../storage").then((m) =>
+      m.storage.getUser((req.session as any).userId)
+    );
+    if (!user || user.role !== "admin") {
+      return res.status(403).json({ error: "Nur für Administratoren" });
+    }
+
+    const parsed = aiSettingsSchema.safeParse(req.body);
+    if (!parsed.success) {
+      return res
+        .status(400)
+        .json({ error: "Ungültige Einstellungen", details: parsed.error.errors });
+    }
+
+    const existing = await getAiSettings();
+    const toSave = { ...parsed.data };
+    if (toSave.apiKey === "__CLEAR__") {
+      toSave.apiKey = "";
+    } else if (!toSave.apiKey && existing.apiKey) {
+      toSave.apiKey = existing.apiKey;
+    }
+    if (toSave.apiKeyFallback === "__CLEAR__") {
+      toSave.apiKeyFallback = "";
+    } else if (!toSave.apiKeyFallback && existing.apiKeyFallback) {
+      toSave.apiKeyFallback = existing.apiKeyFallback;
+    }
+
+    await saveAiSettings(toSave);
+    const safeResponse = { ...toSave, apiKey: undefined, apiKeyFallback: undefined };
+    res.json({ success: true, settings: safeResponse });
+  } catch (err) {
+    console.error("[AI] Admin settings PUT error:", err);
+    res.status(500).json({ error: "Interner Fehler" });
+  }
+});
+
+// GET /api/v1/admin/ai/usage — admin only, last 24h usage stats
+router.get("/admin/usage", requireAuth, async (req, res) => {
+  try {
+    const user = await import("../storage").then((m) =>
+      m.storage.getUser((req.session as any).userId)
+    );
+    if (!user || user.role !== "admin") {
+      return res.status(403).json({ error: "Nur für Administratoren" });
+    }
+
+    const { db } = await import("../db");
+    const { aiUsageLogs } = await import("@shared/schema");
+    const { gte, sql } = await import("drizzle-orm");
+
+    const since24h = new Date(Date.now() - 24 * 60 * 60 * 1000);
+    const logs = await db
+      .select()
+      .from(aiUsageLogs)
+      .where(gte(aiUsageLogs.createdAt, since24h))
+      .orderBy(aiUsageLogs.createdAt);
+
+    const total = logs.length;
+    const successful = logs.filter((l) => l.success).length;
+    const failed = total - successful;
+    const uniqueUsers = new Set(logs.map((l) => l.userId).filter(Boolean)).size;
+    const uniqueGuests = new Set(logs.map((l) => (!l.userId ? l.sessionId : null)).filter(Boolean)).size;
+
+    res.json({
+      total,
+      successful,
+      failed,
+      uniqueUsers,
+      uniqueGuests,
+      logs: logs.slice(-50), // last 50 entries
+    });
+  } catch (err) {
+    console.error("[AI] Admin usage GET error:", err);
+    res.status(500).json({ error: "Interner Fehler" });
+  }
+});
+
+export default router;
diff --git a/server/routes/auth.ts b/server/routes/auth.ts
index d564f15b..9554411a 100644
--- a/server/routes/auth.ts
+++ b/server/routes/auth.ts
@@ -68,6 +68,19 @@ router.post('/request-deletion', requireAuth, async (req, res) => {
 
     const updatedUser = await storage.requestDeletion(userId);
     console.log(`[GDPR] User ${user.email} requested account deletion`);
+
+    try {
+      const adminUsers = await storage.getAdminUsers();
+      const adminEmails = adminUsers.map(a => a.email).filter(Boolean) as string[];
+      if (adminEmails.length > 0) {
+        const { getBaseUrl } = await import('../utils/baseUrl');
+        const adminPanelUrl = `${getBaseUrl()}/admin?tab=deletion-requests`;
+        emailService.sendDeletionRequestNotification(adminEmails, user.name || '', user.email, adminPanelUrl)
+          .catch(err => console.error('[GDPR] Failed to notify admins:', err));
+      }
+    } catch (notifyError) {
+      console.error('[GDPR] Error notifying admins about deletion request:', notifyError);
+    }
     
     res.json({ 
       success: true, 
@@ -123,12 +136,28 @@ router.get('/methods', async (req, res) => {
       keycloakAccountUrl = `${process.env.KEYCLOAK_ISSUER_URL}/account`;
     }
     
+    // Custom SSO button label: DB setting > ENV > undefined (frontend uses default i18n)
+    let ssoButtonLabel: string | undefined;
+    if (authService.isKeycloakEnabled()) {
+      const labelSetting = await storage.getSetting('oidc_button_label');
+      const dbLabel = typeof labelSetting?.value === 'string' ? labelSetting.value : undefined;
+      ssoButtonLabel = dbLabel || process.env.SSO_BUTTON_LABEL || undefined;
+    }
+    
+    // Hide local login form: ENV HIDE_LOGIN_FORM=true hides username/password form (default: visible)
+    // Safety: if SSO is not available, always show the local form to prevent lockout
+    const hideLoginFormEnv = process.env.HIDE_LOGIN_FORM;
+    const hideLoginForm = hideLoginFormEnv !== undefined && hideLoginFormEnv.toLowerCase() === 'true';
+    const showLoginForm = !authService.isKeycloakEnabled() ? true : !hideLoginForm;
+    
     res.json({
       local: true,
       keycloak: authService.isKeycloakEnabled(),
       bearerToken: tokenService.isOIDCEnabled(),
       registrationEnabled,
       keycloakAccountUrl,
+      ssoButtonLabel,
+      showLoginForm,
     });
   } catch (error) {
     console.error('Error getting auth methods:', error);
@@ -137,6 +166,7 @@ router.get('/methods', async (req, res) => {
       keycloak: authService.isKeycloakEnabled(),
       bearerToken: tokenService.isOIDCEnabled(),
       registrationEnabled: true,
+      showLoginForm: true,
     });
   }
 });
@@ -250,15 +280,20 @@ router.post('/login', async (req, res) => {
     }
 
     await loginRateLimiter.recordSuccessfulLogin(data.usernameOrEmail, clientIp);
-    req.session.userId = user.id;
     
-    // Explicitly save session before responding to ensure cookie is set
-    req.session.save((err) => {
-      if (err) {
-        console.error('Session save error:', err);
+    req.session.regenerate((regenerateErr) => {
+      if (regenerateErr) {
+        console.error('Session regenerate error:', regenerateErr);
         return res.status(500).json({ error: 'Interner Fehler' });
       }
-      res.json({ user: authService.sanitizeUser(user) });
+      req.session.userId = user.id;
+      req.session.save((err) => {
+        if (err) {
+          console.error('Session save error:', err);
+          return res.status(500).json({ error: 'Interner Fehler' });
+        }
+        res.json({ user: authService.sanitizeUser(user) });
+      });
     });
   } catch (error) {
     // Validation errors are expected for missing/invalid fields,
@@ -293,10 +328,10 @@ router.post('/register', registrationRateLimiter, async (req, res) => {
     );
     
     if (!user) {
-      return res.status(400).json({ error: 'Benutzername oder E-Mail bereits vergeben' });
+      console.log('[Register] Registration blocked: username or email already taken');
+      return res.status(400).json({ error: 'Registrierung fehlgeschlagen. Bitte überprüfen Sie Ihre Eingaben.' });
     }
 
-    // Create email verification token and send welcome email
     try {
       const verificationToken = await storage.createEmailVerificationToken(user.id);
       const { getBaseUrl } = await import('../utils/baseUrl');
@@ -310,15 +345,19 @@ router.post('/register', registrationRateLimiter, async (req, res) => {
       console.error('Failed to create verification token or send welcome email:', emailError);
     }
 
-    req.session.userId = user.id;
-    
-    // Explicitly save session before responding
-    req.session.save((err) => {
-      if (err) {
-        console.error('Session save error:', err);
+    req.session.regenerate((regenerateErr) => {
+      if (regenerateErr) {
+        console.error('Session regenerate error:', regenerateErr);
         return res.status(500).json({ error: 'Interner Fehler' });
       }
-      res.json({ user: authService.sanitizeUser(user) });
+      req.session.userId = user.id;
+      req.session.save((err) => {
+        if (err) {
+          console.error('Session save error:', err);
+          return res.status(500).json({ error: 'Interner Fehler' });
+        }
+        res.json({ user: authService.sanitizeUser(user) });
+      });
     });
   } catch (error) {
     // Validation errors should not be logged as server errors;
@@ -502,9 +541,12 @@ router.post('/change-password', requireAuth, async (req, res) => {
       return res.status(400).json({ error: 'Aktuelles Passwort ist falsch' });
     }
 
-    // Hash new password and update user
     const hashedPassword = await bcrypt.hash(newPassword, 10);
-    await storage.updateUser(user.id, { passwordHash: hashedPassword });
+    const updateData: Record<string, any> = { passwordHash: hashedPassword };
+    if (user.isInitialAdmin) {
+      updateData.isInitialAdmin = false;
+    }
+    await storage.updateUser(user.id, updateData);
 
     // Send notification email
     emailService.sendPasswordChangedEmail(user.email, user.name)
@@ -659,17 +701,22 @@ router.get('/keycloak/callback', async (req, res) => {
       return res.redirect('/?error=auth_failed');
     }
 
-    // Clear Keycloak session data
-    delete req.session.keycloakCodeVerifier;
-    delete req.session.keycloakState;
-
-    req.session.userId = user.id;
-    req.session.save((err) => {
+    // Clear Keycloak session data and regenerate session to prevent fixation
+    const keycloakUserId = user.id;
+    req.session.regenerate((err) => {
       if (err) {
-        console.error('Session save error:', err);
+        console.error('Session regeneration error:', err);
         return res.redirect('/?error=session_error');
       }
-      res.redirect('/dashboard');
+      req.session.userId = keycloakUserId;
+      req.session.lastActivity = Date.now();
+      req.session.save((saveErr) => {
+        if (saveErr) {
+          console.error('Session save error:', saveErr);
+          return res.redirect('/?error=session_error');
+        }
+        res.redirect('/');
+      });
     });
   } catch (error) {
     console.error('Keycloak callback error:', error);
diff --git a/server/routes/common.ts b/server/routes/common.ts
index bf12daee..86098f11 100644
--- a/server/routes/common.ts
+++ b/server/routes/common.ts
@@ -18,6 +18,7 @@ declare module "express-session" {
     userId?: number;
     keycloakCodeVerifier?: string;
     keycloakState?: string;
+    lastActivity?: number;
   }
 }
 
@@ -63,7 +64,7 @@ export const registerSchema = z.object({
 
 export const createPollSchema = z.object({
   title: z.string().min(1).max(200),
-  description: z.string().optional(),
+  description: z.string().max(5000).optional(),
   type: z.enum(['schedule', 'survey', 'organization']),
   creatorEmail: z.string().email().optional(),
   userId: z.number().optional(),
@@ -74,37 +75,43 @@ export const createPollSchema = z.object({
   allowVoteEdit: z.boolean().optional().default(false),
   allowVoteWithdrawal: z.boolean().optional().default(false),
   resultsPublic: z.boolean().optional().default(true),
+  videoConferenceUrl: z.string().url().max(2000).refine(
+    (url) => /^https?:\/\//i.test(url),
+    { message: 'Only http and https URLs are allowed' }
+  ).optional().nullable(),
   options: z.array(z.object({
-    text: z.string().min(1),
+    text: z.string().min(1).max(500),
     imageUrl: z.string().optional(),
     altText: z.string().optional(),
     startTime: z.string().datetime().optional(),
     endTime: z.string().datetime().optional(),
     maxCapacity: z.number().min(1).optional(),
+    isFreeText: z.boolean().optional().default(false),
     order: z.number().default(0),
   })).min(1),
 });
 
 export const voteSchema = z.object({
   optionId: z.number(),
-  voterName: z.string().min(1),
-  voterEmail: z.string().email(),
+  voterName: z.string().min(1).max(100),
+  voterEmail: z.string().email().max(254),
   response: z.enum(['yes', 'maybe', 'no']),
   comment: z.string().optional(),
 });
 
 export const inviteSchema = z.object({
-  emails: z.array(z.string().email()),
-  customMessage: z.string().optional(),
+  emails: z.array(z.string().email()).max(100),
+  customMessage: z.string().max(2000).optional(),
 });
 
 export const bulkVoteSchema = z.object({
-  voterName: z.string().min(1),
-  voterEmail: z.string().email(),
+  voterName: z.string().min(1).max(100),
+  voterEmail: z.string().email().max(254),
   votes: z.array(z.object({
     optionId: z.number(),
-    response: z.enum(['yes', 'maybe', 'no']),
+    response: z.enum(['yes', 'maybe', 'no', 'freetext', 'signup']),
     comment: z.string().optional(),
+    freeTextAnswer: z.string().max(2000).optional(),
   })).min(1),
 });
 
@@ -161,8 +168,7 @@ export const requireAdmin = async (req: Request, res: Response, next: NextFuncti
       throw new AuthorizationError('Administratorberechtigung erforderlich');
     }
     
-    // Admins must have verified email
-    if (!user.emailVerified) {
+    if (!user.emailVerified && user.provider === 'local') {
       return res.status(403).json({ 
         error: 'E-Mail-Adresse nicht verifiziert',
         code: 'EMAIL_NOT_VERIFIED',
@@ -192,8 +198,7 @@ export const requireEmailVerified = async (req: Request, res: Response, next: Ne
       return next();
     }
     
-    // If user is logged in but email not verified, block the action
-    if (!user.emailVerified) {
+    if (!user.emailVerified && user.provider === 'local') {
       return res.status(403).json({ 
         error: 'E-Mail-Adresse nicht verifiziert',
         code: 'EMAIL_NOT_VERIFIED',
diff --git a/server/routes/export.ts b/server/routes/export.ts
index fe5129a9..6cfbc667 100644
--- a/server/routes/export.ts
+++ b/server/routes/export.ts
@@ -264,6 +264,13 @@ router.get('/polls/:token/export/ics', async (req, res) => {
         voterEmail,
       }
     );
+
+    if (!icsContent.includes('BEGIN:VEVENT')) {
+      const errorMsg = language === 'de'
+        ? 'Keine exportierbaren Termine vorhanden. Die Umfrageoptionen enthalten keine gültigen Datums-/Uhrzeitwerte.'
+        : 'No exportable calendar events found. The poll options do not contain valid date/time values.';
+      return res.status(400).json({ error: errorMsg });
+    }
     
     const sanitizedTitle = poll.title.replace(/[^a-zA-Z0-9äöüÄÖÜß\-_]/g, '_').substring(0, 50);
     
diff --git a/server/routes/index.ts b/server/routes/index.ts
index 81e0264c..a2e39b71 100644
--- a/server/routes/index.ts
+++ b/server/routes/index.ts
@@ -3,6 +3,7 @@ import { createServer, type Server } from "http";
 import { Router } from "express";
 import express from "express";
 import path from "path";
+import crypto from "crypto";
 import { storage } from "../storage";
 import bcrypt from "bcryptjs";
 import type { User } from "@shared/schema";
@@ -15,6 +16,7 @@ import adminRouter from "./admin";
 import usersRouter from "./users";
 import exportRouter from "./export";
 import systemRouter from "./system";
+import aiRouter from "./ai";
 
 export function registerRoutes(app: Express): Server {
   // Serve uploaded images (unversioned static files) - MUST be before API routes
@@ -51,6 +53,9 @@ export function registerRoutes(app: Express): Server {
   // System routes - mounted on v1Router root for health, customization, matrix, etc.
   v1Router.use('/', systemRouter);
 
+  // AI routes: /api/v1/ai/*
+  v1Router.use('/ai', aiRouter);
+
   // ============== DEPROVISION API (External Kafka/Keycloak Integration) ==============
   // Note: User dashboard routes (user/polls, user/participations) are now in users.ts
   
@@ -85,17 +90,15 @@ export function registerRoutes(app: Express): Server {
       const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');
       const [username, password] = credentials.split(':');
       
-      if (username !== config.username) {
-        console.log(`[DEPROVISION] Request rejected: invalid username "${username}"`);
-        return res.status(401).json({ 
-          error: 'Ungültige Anmeldedaten',
-          code: 'INVALID_CREDENTIALS'
-        });
-      }
+      const usernameBuffer = Buffer.from(username || '');
+      const configUsernameBuffer = Buffer.from(config.username || '');
+      const usernameMatch = usernameBuffer.length === configUsernameBuffer.length &&
+        crypto.timingSafeEqual(usernameBuffer, configUsernameBuffer);
+      
+      const isValidPassword = await bcrypt.compare(password || '', config.passwordHash);
       
-      const isValidPassword = await bcrypt.compare(password, config.passwordHash);
-      if (!isValidPassword) {
-        console.log('[DEPROVISION] Request rejected: invalid password');
+      if (!usernameMatch || !isValidPassword) {
+        console.log('[DEPROVISION] Request rejected: invalid credentials');
         return res.status(401).json({ 
           error: 'Ungültige Anmeldedaten',
           code: 'INVALID_CREDENTIALS'
diff --git a/server/routes/polls.ts b/server/routes/polls.ts
index 8c0c04ee..4dde15c6 100644
--- a/server/routes/polls.ts
+++ b/server/routes/polls.ts
@@ -82,6 +82,7 @@ router.post('/', pollCreationRateLimiter, requireEmailVerified, async (req, res)
       allowVoteEdit: data.allowVoteEdit,
       allowVoteWithdrawal: data.allowVoteWithdrawal,
       resultsPublic: data.resultsPublic,
+      videoConferenceUrl: data.type === 'schedule' ? (data.videoConferenceUrl || null) : null,
       isTestData: req.isTestMode === true,
     };
 
@@ -92,6 +93,7 @@ router.post('/', pollCreationRateLimiter, requireEmailVerified, async (req, res)
       startTime: opt.startTime ? new Date(opt.startTime) : null,
       endTime: opt.endTime ? new Date(opt.endTime) : null,
       maxCapacity: opt.maxCapacity || null,
+      isFreeText: opt.isFreeText ?? false,
       order: index,
       pollId: "",
     }));
@@ -109,7 +111,8 @@ router.post('/', pollCreationRateLimiter, requireEmailVerified, async (req, res)
         data.title,
         publicLink,
         adminLink,
-        data.type
+        data.type,
+        userId !== null
       );
     }
 
@@ -138,8 +141,13 @@ router.get('/public/:token', async (req, res) => {
       return res.status(404).json({ error: 'Poll not found' });
     }
     
-    const { adminToken, ...pollData } = poll;
-    res.json(pollData);
+    const isOwner = poll.userId != null && req.session?.userId === poll.userId;
+    if (isOwner) {
+      res.json(poll);
+    } else {
+      const { adminToken, ...pollData } = poll;
+      res.json(pollData);
+    }
   } catch (error) {
     console.error('Error fetching poll:', error);
     res.status(500).json({ error: 'Internal server error' });
@@ -199,7 +207,7 @@ router.patch('/admin/:token', async (req, res) => {
       }
     }
     
-    const { isActive, title, description, expiresAt, resultsPublic, allowVoteEdit, allowVoteWithdrawal, allowMaybe, allowMultipleSlots } = req.body;
+    const { isActive, title, description, expiresAt, resultsPublic, allowVoteEdit, allowVoteWithdrawal, allowMaybe, allowMultipleSlots, videoConferenceUrl, notifyParticipants } = req.body;
     
     const updates: Record<string, any> = {};
     if (isActive !== undefined) updates.isActive = isActive;
@@ -211,6 +219,24 @@ router.patch('/admin/:token', async (req, res) => {
     if (allowVoteWithdrawal !== undefined) updates.allowVoteWithdrawal = allowVoteWithdrawal;
     if (allowMaybe !== undefined) updates.allowMaybe = allowMaybe;
     if (allowMultipleSlots !== undefined) updates.allowMultipleSlots = allowMultipleSlots;
+    if (videoConferenceUrl !== undefined && poll.type === 'schedule') {
+      if (videoConferenceUrl && typeof videoConferenceUrl === 'string') {
+        try {
+          new URL(videoConferenceUrl);
+          if (!/^https?:\/\//i.test(videoConferenceUrl)) {
+            return res.status(400).json({ error: 'Nur HTTP/HTTPS-URLs sind erlaubt' });
+          }
+          if (videoConferenceUrl.length > 2000) {
+            return res.status(400).json({ error: 'URL ist zu lang (max. 2000 Zeichen)' });
+          }
+          updates.videoConferenceUrl = videoConferenceUrl;
+        } catch {
+          return res.status(400).json({ error: 'Ungültige URL' });
+        }
+      } else {
+        updates.videoConferenceUrl = null;
+      }
+    }
     
     if (Object.keys(updates).length === 0) {
       return res.status(400).json({ error: 'Keine gültigen Updates angegeben' });
@@ -218,6 +244,119 @@ router.patch('/admin/:token', async (req, res) => {
     
     const updatedPoll = await storage.updatePoll(poll.id, updates);
     res.json(updatedPoll);
+
+    // Send end-of-poll notifications if requested
+    if (isActive === false && notifyParticipants === true) {
+      try {
+        const participantEmails = (poll.votes as Array<{ voterEmail: string }>)
+          .map((v) => v.voterEmail)
+          .filter((e) => e && e.includes('@'));
+
+        const allRecipients = new Set<string>(participantEmails);
+        if (poll.creatorEmail && poll.creatorEmail.includes('@')) {
+          allRecipients.add(poll.creatorEmail);
+        }
+        const uniqueEmails = [...allRecipients];
+
+        if (uniqueEmails.length > 0) {
+          const { getBaseUrl } = await import('../utils/baseUrl');
+          const baseUrl = getBaseUrl();
+          const pollLink = `${baseUrl}/poll/${poll.publicToken}`;
+          const effectiveResultsPublic = resultsPublic !== undefined ? resultsPublic : (poll.resultsPublic ?? true);
+
+          if (poll.type === 'schedule') {
+            // Schedule poll: send finalization email if a date was already confirmed
+            const confirmedOption = poll.finalOptionId
+              ? poll.options.find((o: { id: number }) => o.id === poll.finalOptionId)
+              : undefined;
+
+            if (confirmedOption) {
+              const startTime = confirmedOption.startTime ? new Date(confirmedOption.startTime) : null;
+              const endTime = confirmedOption.endTime ? new Date(confirmedOption.endTime) : null;
+
+              const confirmedDate = startTime
+                ? startTime.toLocaleDateString('de-DE', { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric' })
+                : confirmedOption.text;
+
+              let confirmedTime = '';
+              if (startTime && (startTime.getHours() !== 0 || startTime.getMinutes() !== 0)) {
+                confirmedTime = startTime.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' });
+                if (endTime && (endTime.getHours() !== 0 || endTime.getMinutes() !== 0)) {
+                  confirmedTime += ` \u2013 ${endTime.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' })} Uhr`;
+                } else {
+                  confirmedTime += ' Uhr';
+                }
+              }
+
+              const { generateSingleEventIcs } = await import('../services/icsService');
+              const icsContent = generateSingleEventIcs(updatedPoll, confirmedOption, baseUrl, undefined, true);
+              const icsBuffer = Buffer.from(icsContent, 'utf-8');
+
+              await emailService.sendFinalizationEmails(
+                uniqueEmails,
+                poll.title,
+                confirmedDate,
+                confirmedTime,
+                pollLink,
+                icsBuffer,
+                poll.videoConferenceUrl
+              );
+            } else {
+              // No confirmed date yet — send generic "poll ended" notification
+              await emailService.sendPollEndedEmails(
+                uniqueEmails,
+                poll.title,
+                pollLink,
+                effectiveResultsPublic,
+                'survey'
+              );
+            }
+          } else if (poll.type === 'organization') {
+            // Build compact slot summary: count 'yes' votes per option
+            const yesVotesByOption = new Map<number, number>();
+            for (const vote of (poll.votes as Array<{ optionId: number; response: string }>)) {
+              if (vote.response === 'yes') {
+                yesVotesByOption.set(vote.optionId, (yesVotesByOption.get(vote.optionId) || 0) + 1);
+              }
+            }
+            const slotSummary = (poll.options as Array<{ id: number; text: string; maxCapacity: number | null }>)
+              .map((opt) => ({
+                text: opt.text,
+                filled: yesVotesByOption.get(opt.id) || 0,
+                total: opt.maxCapacity,
+              }));
+
+            await emailService.sendPollEndedEmails(
+              uniqueEmails,
+              poll.title,
+              pollLink,
+              effectiveResultsPublic,
+              'organization',
+              undefined,
+              slotSummary
+            );
+          } else if (poll.type === 'survey') {
+            let finalOptionText: string | undefined;
+            if (poll.finalOptionId) {
+              const winningOption = (poll.options as Array<{ id: number; text: string }>)
+                .find((o) => o.id === poll.finalOptionId);
+              finalOptionText = winningOption?.text;
+            }
+
+            await emailService.sendPollEndedEmails(
+              uniqueEmails,
+              poll.title,
+              pollLink,
+              effectiveResultsPublic,
+              'survey',
+              finalOptionText
+            );
+          }
+        }
+      } catch (emailError) {
+        console.error('Error sending poll-ended emails:', emailError);
+      }
+    }
   } catch (error) {
     console.error('Error updating poll:', error);
     res.status(500).json({ error: 'Internal server error' });
@@ -252,6 +391,8 @@ router.delete('/admin/:token', async (req, res) => {
 // Finalize poll schema
 const finalizeSchema = z.object({
   optionId: z.number().int().nonnegative(),
+  closePoll: z.boolean().optional().default(false),
+  notifyParticipants: z.boolean().optional().default(false),
 }).strict();
 
 // Finalize poll (set final option)
@@ -265,7 +406,7 @@ router.post('/admin/:token/finalize', async (req, res) => {
       });
     }
     
-    const { optionId } = parseResult.data;
+    const { optionId, closePoll, notifyParticipants } = parseResult.data;
     
     const poll = await storage.getPollByAdminToken(req.params.token);
     if (!poll) {
@@ -292,12 +433,86 @@ router.post('/admin/:token/finalize', async (req, res) => {
     }
     
     const finalOptionId = optionId === 0 ? null : optionId;
-    const updatedPoll = await storage.updatePoll(poll.id, { finalOptionId });
+    const updateData: { finalOptionId: number | null; isActive?: boolean } = { finalOptionId };
+    if (finalOptionId && closePoll) {
+      updateData.isActive = false;
+    }
+    const updatedPoll = await storage.updatePoll(poll.id, updateData);
+
+    let emailResult: { sent: number; failed: number } | undefined;
+    if (notifyParticipants && finalOptionId) {
+      try {
+        const participantEmails = poll.votes
+          .map((v: { voterEmail: string }) => v.voterEmail)
+          .filter((e: string) => e && e.includes('@'));
+
+        const allRecipients = new Set<string>(participantEmails);
+        if (poll.creatorEmail && poll.creatorEmail.includes('@')) {
+          allRecipients.add(poll.creatorEmail);
+        }
+        const uniqueEmails = [...allRecipients];
+
+        if (uniqueEmails.length > 0) {
+          const { getBaseUrl } = await import('../utils/baseUrl');
+          const baseUrl = getBaseUrl();
+          const pollLink = `${baseUrl}/poll/${poll.publicToken}`;
+
+          if (poll.type === 'schedule') {
+            const confirmedOption = poll.options.find((o: { id: number }) => o.id === finalOptionId);
+            if (confirmedOption) {
+              const startTime = confirmedOption.startTime ? new Date(confirmedOption.startTime) : null;
+              const endTime = confirmedOption.endTime ? new Date(confirmedOption.endTime) : null;
+
+              const confirmedDate = startTime
+                ? startTime.toLocaleDateString('de-DE', { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric' })
+                : confirmedOption.text;
+
+              let confirmedTime = '';
+              if (startTime && (startTime.getHours() !== 0 || startTime.getMinutes() !== 0)) {
+                confirmedTime = startTime.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' });
+                if (endTime && (endTime.getHours() !== 0 || endTime.getMinutes() !== 0)) {
+                  confirmedTime += ` – ${endTime.toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' })} Uhr`;
+                } else {
+                  confirmedTime += ' Uhr';
+                }
+              }
+
+              const { generateSingleEventIcs } = await import('../services/icsService');
+              const icsContent = generateSingleEventIcs(updatedPoll, confirmedOption, baseUrl, undefined, true);
+              const icsBuffer = Buffer.from(icsContent, 'utf-8');
+
+              emailResult = await emailService.sendFinalizationEmails(
+                uniqueEmails,
+                poll.title,
+                confirmedDate,
+                confirmedTime,
+                pollLink,
+                icsBuffer,
+                poll.videoConferenceUrl
+              );
+            }
+          } else {
+            const winningOption = poll.options.find((o: { id: number }) => o.id === finalOptionId);
+            emailResult = await emailService.sendPollEndedEmails(
+              uniqueEmails,
+              poll.title,
+              pollLink,
+              poll.resultsPublic ?? true,
+              poll.type as 'survey' | 'organization',
+              winningOption?.text
+            );
+          }
+        }
+      } catch (emailError) {
+        console.error('Error sending finalization emails:', emailError);
+      }
+    }
     
     res.json({ 
       success: true, 
       poll: updatedPoll,
-      message: finalOptionId ? 'Finaler Termin wurde festgelegt' : 'Finalisierung wurde aufgehoben'
+      message: finalOptionId ? 'Finaler Termin wurde festgelegt' : 'Finalisierung wurde aufgehoben',
+      emailResult,
     });
   } catch (error) {
     console.error('Error finalizing poll:', error);
diff --git a/server/routes/system.ts b/server/routes/system.ts
index cecc955a..ad820661 100644
--- a/server/routes/system.ts
+++ b/server/routes/system.ts
@@ -4,6 +4,8 @@ import { requireAuth, requireAdmin } from "./common";
 import { matrixService } from "../services/matrixService";
 import { imageService } from "../services/imageService";
 import { emailService } from "../services/emailService";
+import { authService } from "../services/authService";
+import { getBaseUrl } from "../utils/baseUrl";
 
 const router = Router();
 
@@ -16,6 +18,24 @@ router.get('/email-status', (req, res) => {
   res.json({ smtpConfigured: emailService.smtpConfigured });
 });
 
+router.get('/smtp-config', requireAdmin, (req, res) => {
+  res.json(emailService.getDisplayConfig());
+});
+
+router.post('/smtp-test', requireAdmin, async (req, res) => {
+  const result = await emailService.testConnection();
+  res.json(result);
+});
+
+router.get('/oidc-config', requireAdmin, (req, res) => {
+  res.json(authService.getDisplayConfig());
+});
+
+router.post('/oidc-test', requireAdmin, async (req, res) => {
+  const result = await authService.testOidcConnection();
+  res.json(result);
+});
+
 // Public endpoint for theme/branding (for frontend to apply without auth)
 router.get('/customization', async (req, res) => {
   try {
@@ -27,6 +47,18 @@ router.get('/customization', async (req, res) => {
   }
 });
 
+// Public endpoint for system default language (lightweight, no auth required)
+router.get('/system/language', async (req, res) => {
+  try {
+    const setting = await storage.getSetting('customization_language');
+    const lang = (setting?.value as Record<string, string>)?.defaultLanguage || 'en';
+    res.json({ defaultLanguage: lang });
+  } catch (error) {
+    console.error('Error fetching system language:', error);
+    res.json({ defaultLanguage: 'en' });
+  }
+});
+
 // Public endpoint for accessibility settings (for E2E tests and frontend)
 router.get('/settings/accessibility', async (req, res) => {
   try {
@@ -52,11 +84,11 @@ router.get('/settings/accessibility', async (req, res) => {
 router.get('/customization/mobile', async (req, res) => {
   try {
     const settings = await storage.getCustomizationSettings();
-    const baseUrl = process.env.APP_URL || process.env.VITE_APP_URL || `https://${req.get('host')}`;
+    const baseUrl = getBaseUrl();
     
-    const siteName = settings.branding?.siteName || 'Polly';
-    const siteNameAccent = settings.branding?.siteNameAccent || 'y';
-    const siteNameFirst = siteName.replace(siteNameAccent, '').trim();
+    const siteName = settings.branding?.siteName || '';
+    const siteNameAccent = settings.branding?.siteNameAccent || '';
+    const siteNameFirst = siteNameAccent ? siteName.replace(siteNameAccent, '').trim() : siteName;
     
     const mobileTheme = {
       branding: {
@@ -123,7 +155,7 @@ router.get('/matrix/users/search', requireAuth, async (req, res) => {
     res.json(result);
   } catch (error: any) {
     console.error('Matrix user search error:', error);
-    res.status(500).json({ error: error.message || 'Suche fehlgeschlagen' });
+    res.status(500).json({ error: 'Suche fehlgeschlagen' });
   }
 });
 
@@ -149,7 +181,7 @@ router.post('/polls/:token/invite/matrix', requireAuth, async (req, res) => {
       return res.status(403).json({ error: 'Keine Berechtigung' });
     }
 
-    const baseUrl = process.env.APP_URL || process.env.VITE_APP_URL || `https://${req.get('host')}`;
+    const baseUrl = getBaseUrl();
     const pollUrl = `${baseUrl}/poll/${poll.publicToken}`;
 
     const result = await matrixService.sendPollInvitation(
@@ -167,7 +199,7 @@ router.post('/polls/:token/invite/matrix', requireAuth, async (req, res) => {
     });
   } catch (error: any) {
     console.error('Matrix invitation error:', error);
-    res.status(500).json({ error: error.message || 'Einladung fehlgeschlagen' });
+    res.status(500).json({ error: 'Einladung fehlgeschlagen' });
   }
 });
 
@@ -179,7 +211,7 @@ router.post('/matrix/test', requireAdmin, async (req, res) => {
     res.json(result);
   } catch (error: any) {
     console.error('Matrix connection test error:', error);
-    res.json({ success: false, error: error.message });
+    res.json({ success: false, error: 'Matrix-Verbindungstest fehlgeschlagen' });
   }
 });
 
@@ -267,7 +299,8 @@ router.post('/upload/image', imageService.getUploadMiddleware().single('image'),
   
   if (!result.success) {
     let statusCode = 500;
-    if (result.virusName) statusCode = 422;
+    if (result.invalidFileType) statusCode = 400;
+    else if (result.virusName) statusCode = 422;
     else if (result.scannerUnavailable) statusCode = 503;
     return res.status(statusCode).json({ 
       error: result.error,
diff --git a/server/routes/users.ts b/server/routes/users.ts
index a5058781..1654f0de 100644
--- a/server/routes/users.ts
+++ b/server/routes/users.ts
@@ -5,31 +5,12 @@ import { deviceTokenService } from "../services/deviceTokenService";
 
 const router = Router();
 
-// Get user dashboard data
-router.get('/users/:userId/dashboard', async (req, res) => {
+router.get('/user/profile', requireAuth, async (req, res) => {
   try {
-    const userId = parseInt(req.params.userId);
-    const userPolls = await storage.getUserPolls(userId);
-    const sharedPolls = await storage.getSharedPolls(userId);
-    
-    res.json({
-      userPolls,
-      sharedPolls,
-    });
-  } catch (error) {
-    console.error('Error fetching dashboard:', error);
-    res.status(500).json({ error: 'Internal server error' });
-  }
-});
+    const userId = await extractUserId(req);
+    if (!userId) return res.status(401).json({ error: 'Nicht angemeldet' });
 
-// Get user profile
-router.get('/user/profile', async (req, res) => {
-  try {
-    if (!req.session.userId) {
-      return res.status(401).json({ error: 'Nicht angemeldet' });
-    }
-    
-    const user = await storage.getUser(req.session.userId);
+    const user = await storage.getUser(userId);
     if (!user) {
       return res.status(404).json({ error: 'Benutzer nicht gefunden' });
     }
@@ -54,13 +35,11 @@ router.get('/user/profile', async (req, res) => {
   }
 });
 
-// Update user profile
-router.put('/user/profile', async (req, res) => {
+router.put('/user/profile', requireAuth, async (req, res) => {
   try {
-    if (!req.session.userId) {
-      return res.status(401).json({ error: 'Nicht angemeldet' });
-    }
-    
+    const userId = await extractUserId(req);
+    if (!userId) return res.status(401).json({ error: 'Nicht angemeldet' });
+
     const { name, organization, themePreference, languagePreference } = req.body;
     const updates: Record<string, any> = {};
     
@@ -77,7 +56,7 @@ router.put('/user/profile', async (req, res) => {
       return res.status(400).json({ error: 'Keine gültigen Updates angegeben' });
     }
     
-    const user = await storage.updateUser(req.session.userId, updates);
+    const user = await storage.updateUser(userId, updates);
     res.json({
       id: user.id,
       username: user.username,
@@ -97,19 +76,17 @@ router.put('/user/profile', async (req, res) => {
   }
 });
 
-// Update user language preference (dedicated endpoint)
-router.patch('/users/me/language', async (req, res) => {
+router.patch('/users/me/language', requireAuth, async (req, res) => {
   try {
-    if (!req.session.userId) {
-      return res.status(401).json({ error: 'Nicht angemeldet' });
-    }
-    
+    const userId = await extractUserId(req);
+    if (!userId) return res.status(401).json({ error: 'Nicht angemeldet' });
+
     const { language } = req.body;
     if (!language || !['de', 'en'].includes(language)) {
       return res.status(400).json({ error: 'Ungültige Sprache. Erlaubt: de, en' });
     }
     
-    const user = await storage.updateUser(req.session.userId, { languagePreference: language });
+    const user = await storage.updateUser(userId, { languagePreference: language });
     res.json({
       languagePreference: user.languagePreference || 'de',
     });
@@ -119,13 +96,10 @@ router.patch('/users/me/language', async (req, res) => {
   }
 });
 
-// Register device token for push notifications
 router.post('/users/me/device-tokens', requireAuth, async (req, res) => {
   try {
     const userId = await extractUserId(req);
-    if (!userId) {
-      return res.status(401).json({ error: 'Nicht angemeldet' });
-    }
+    if (!userId) return res.status(401).json({ error: 'Nicht angemeldet' });
 
     const { token, platform } = req.body;
     if (!token || !platform) {
@@ -144,13 +118,10 @@ router.post('/users/me/device-tokens', requireAuth, async (req, res) => {
   }
 });
 
-// Remove device token
 router.delete('/users/me/device-tokens', requireAuth, async (req, res) => {
   try {
     const userId = await extractUserId(req);
-    if (!userId) {
-      return res.status(401).json({ error: 'Nicht angemeldet' });
-    }
+    if (!userId) return res.status(401).json({ error: 'Nicht angemeldet' });
 
     const { token } = req.body;
     if (!token) {
@@ -165,20 +136,12 @@ router.delete('/users/me/device-tokens', requireAuth, async (req, res) => {
   }
 });
 
-// Get user's created polls
 router.get('/user/polls', requireAuth, async (req, res) => {
   try {
-    const userId = req.session.userId;
-    if (!userId) {
-      console.error('[SECURITY] /user/polls called without userId in session');
-      return res.status(401).json({ error: 'Nicht authentifiziert' });
-    }
+    const userId = await extractUserId(req);
+    if (!userId) return res.status(401).json({ error: 'Nicht authentifiziert' });
     
     const polls = await storage.getUserPolls(userId);
-    
-    // SECURITY: Log for debugging cross-account data issues
-    console.log(`[USER-POLLS] userId=${userId} returned ${polls.length} polls`);
-    
     res.json(polls);
   } catch (error) {
     console.error('Error getting user polls:', error);
@@ -186,20 +149,12 @@ router.get('/user/polls', requireAuth, async (req, res) => {
   }
 });
 
-// Get polls user has participated in
 router.get('/user/participations', requireAuth, async (req, res) => {
   try {
-    const userId = req.session.userId;
-    if (!userId) {
-      console.error('[SECURITY] /user/participations called without userId in session');
-      return res.status(401).json({ error: 'Nicht authentifiziert' });
-    }
+    const userId = await extractUserId(req);
+    if (!userId) return res.status(401).json({ error: 'Nicht authentifiziert' });
     
     const polls = await storage.getUserParticipatedPolls(userId);
-    
-    // SECURITY: Log for debugging cross-account data issues
-    console.log(`[USER-PARTICIPATIONS] userId=${userId} returned ${polls.length} participations`);
-    
     res.json(polls);
   } catch (error) {
     console.error('Error getting user participations:', error);
@@ -207,19 +162,17 @@ router.get('/user/participations', requireAuth, async (req, res) => {
   }
 });
 
-// Update user theme preference
-router.put('/user/theme', async (req, res) => {
+router.put('/user/theme', requireAuth, async (req, res) => {
   try {
-    if (!req.session.userId) {
-      return res.status(401).json({ error: 'Nicht angemeldet' });
-    }
-    
+    const userId = await extractUserId(req);
+    if (!userId) return res.status(401).json({ error: 'Nicht angemeldet' });
+
     const { themePreference } = req.body;
     if (!themePreference || !['light', 'dark', 'system'].includes(themePreference)) {
       return res.status(400).json({ error: 'Ungültige Theme-Einstellung' });
     }
     
-    const user = await storage.updateUser(req.session.userId, { themePreference });
+    const user = await storage.updateUser(userId, { themePreference });
     res.json({ success: true, themePreference: user.themePreference });
   } catch (error) {
     console.error('Error updating theme preference:', error);
diff --git a/server/routes/votes.ts b/server/routes/votes.ts
index 506dd6d6..67bc3e16 100644
--- a/server/routes/votes.ts
+++ b/server/routes/votes.ts
@@ -105,6 +105,7 @@ router.post('/polls/:token/vote', async (req, res) => {
           voterEmail: data.voterEmail,
           response: voteData.response,
           comment: voteData.comment,
+          freeTextAnswer: (voteData as any).freeTextAnswer || null,
           userId: userId,
           isTestData: isTestMode,
         }, voterEditToken);
@@ -287,6 +288,7 @@ router.post('/polls/:token/vote-bulk', async (req, res) => {
           voterEmail: data.voterEmail,
           response: voteData.response,
           comment: voteData.comment,
+          freeTextAnswer: (voteData as any).freeTextAnswer || null,
           userId: userId,
           isTestData: isTestMode,
         }, voterEditToken);
diff --git a/server/scripts/applyBranding.ts b/server/scripts/applyBranding.ts
index 9daaaa00..04ff6bd2 100644
--- a/server/scripts/applyBranding.ts
+++ b/server/scripts/applyBranding.ts
@@ -159,9 +159,27 @@ async function isDatabaseEmpty(storage: any): Promise<boolean> {
   }
 }
 
+/**
+ * Build branding overrides from environment variables.
+ * Supported: SITE_NAME, SITE_NAME_ACCENT
+ */
+function getEnvBrandingOverrides(): Partial<BrandingConfig> {
+  const overrides: Partial<BrandingConfig> = {};
+  const envSiteName = process.env.SITE_NAME;
+  const envSiteNameAccent = process.env.SITE_NAME_ACCENT;
+
+  if (envSiteName !== undefined || envSiteNameAccent !== undefined) {
+    overrides.branding = {};
+    if (envSiteName !== undefined) overrides.branding.siteName = envSiteName;
+    if (envSiteNameAccent !== undefined) overrides.branding.siteNameAccent = envSiteNameAccent;
+  }
+  return overrides;
+}
+
 /**
  * Bootstrap branding on server startup
  * Only applies file-based config if database is empty (fresh install or reset)
+ * Environment variables (SITE_NAME, SITE_NAME_ACCENT) override file-based defaults on fresh install.
  */
 export async function bootstrapBranding(storage: any): Promise<void> {
   const dbEmpty = await isDatabaseEmpty(storage);
@@ -181,6 +199,15 @@ export async function bootstrapBranding(storage: any): Promise<void> {
   
   // No local config - use defaults
   const defaultConfig = loadDefaultBrandingConfig();
+  const envOverrides = getEnvBrandingOverrides();
+
+  if (Object.keys(envOverrides).length > 0) {
+    console.log('[Branding] Applying environment variable overrides (SITE_NAME / SITE_NAME_ACCENT)');
+    if (envOverrides.branding) {
+      defaultConfig.branding = { ...defaultConfig.branding, ...envOverrides.branding };
+    }
+  }
+
   if (Object.keys(defaultConfig).length > 0) {
     console.log('[Branding] Bootstrapping from branding.default.json (fresh install)');
     await applyConfigToDatabase(storage, defaultConfig, false);
diff --git a/server/scripts/dockerSmokeTest.ts b/server/scripts/dockerSmokeTest.ts
index e6198801..577de1e6 100644
--- a/server/scripts/dockerSmokeTest.ts
+++ b/server/scripts/dockerSmokeTest.ts
@@ -1,9 +1,14 @@
 #!/usr/bin/env npx tsx
 import http from 'http';
+import { getBaseUrl } from '../utils/baseUrl';
 
-const BASE_URL = process.env.BASE_URL || 'http://localhost:5000';
-const ADMIN_EMAIL = process.env.ADMIN_EMAIL || 'admin@example.com';
-const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'admin';
+const BASE_URL = getBaseUrl();
+const ADMIN_EMAIL = process.env.ADMIN_EMAIL;
+const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD;
+if (!ADMIN_EMAIL || !ADMIN_PASSWORD) {
+  console.error('[Smoke Test] ADMIN_EMAIL and ADMIN_PASSWORD must be set as environment variables.');
+  process.exit(1);
+}
 const MAX_RETRIES = 30;
 const RETRY_DELAY_MS = 2000;
 
diff --git a/server/scripts/ensureSchema.ts b/server/scripts/ensureSchema.ts
index 59a2222f..efbbd61c 100644
--- a/server/scripts/ensureSchema.ts
+++ b/server/scripts/ensureSchema.ts
@@ -36,6 +36,9 @@ const COLUMN_UPDATES: { table: string; column: string; definition: string }[] =
   { table: 'votes', column: 'voter_source', definition: 'TEXT' },
   { table: 'votes', column: 'comment', definition: 'TEXT' },
   { table: 'users', column: 'email_verified', definition: 'BOOLEAN NOT NULL DEFAULT FALSE' },
+  { table: 'poll_options', column: 'is_free_text', definition: 'BOOLEAN NOT NULL DEFAULT FALSE' },
+  { table: 'votes', column: 'free_text_answer', definition: 'TEXT' },
+  { table: 'polls', column: 'video_conference_url', definition: 'TEXT' },
 ];
 
 async function ensureSchema(): Promise<void> {
@@ -146,6 +149,29 @@ async function ensureSchema(): Promise<void> {
       await client.query(`
         CREATE INDEX IF NOT EXISTS "IDX_session_expire" ON "session" ("expire")
       `);
+
+      console.log('🔧 Ensuring indexes...');
+      const indexStatements = [
+        'CREATE INDEX IF NOT EXISTS "password_reset_tokens_token_idx" ON "password_reset_tokens" ("token")',
+        'CREATE INDEX IF NOT EXISTS "password_reset_tokens_user_id_idx" ON "password_reset_tokens" ("user_id")',
+        'CREATE INDEX IF NOT EXISTS "email_change_tokens_token_idx" ON "email_change_tokens" ("token")',
+        'CREATE INDEX IF NOT EXISTS "email_change_tokens_user_id_idx" ON "email_change_tokens" ("user_id")',
+        'CREATE INDEX IF NOT EXISTS "email_verification_tokens_token_idx" ON "email_verification_tokens" ("token")',
+        'CREATE INDEX IF NOT EXISTS "email_verification_tokens_user_id_idx" ON "email_verification_tokens" ("user_id")',
+        'CREATE INDEX IF NOT EXISTS "notification_logs_poll_id_idx" ON "notification_logs" ("poll_id")',
+        'CREATE INDEX IF NOT EXISTS "notification_logs_type_idx" ON "notification_logs" ("type")',
+        'CREATE INDEX IF NOT EXISTS "votes_voter_edit_token_idx" ON "votes" ("voter_edit_token")',
+      ];
+      for (const stmt of indexStatements) {
+        try {
+          await client.query(stmt);
+        } catch (err: any) {
+          if (!err.message?.includes('already exists')) {
+            console.warn(`  ⚠️ Index warning: ${err.message?.substring(0, 100)}`);
+          }
+        }
+      }
+      console.log('✅ Indexes ensured');
     } finally {
       client.release();
     }
@@ -203,6 +229,7 @@ async function createCoreTables(client: any): Promise<void> {
       allow_maybe BOOLEAN NOT NULL DEFAULT TRUE,
       is_test_data BOOLEAN NOT NULL DEFAULT FALSE,
       expires_at TIMESTAMP,
+      video_conference_url TEXT,
       final_option_id INTEGER,
       enable_expiry_reminder BOOLEAN NOT NULL DEFAULT FALSE,
       expiry_reminder_hours INTEGER DEFAULT 24,
diff --git a/server/seed-admin.ts b/server/seed-admin.ts
index 6100c9a4..9ef00b2e 100644
--- a/server/seed-admin.ts
+++ b/server/seed-admin.ts
@@ -8,6 +8,12 @@
  *   ADMIN_PASSWORD  (default: Admin123!)
  * 
  * Can be used standalone (npx tsx server/seed-admin.ts) or imported.
+ * 
+ * Credential policy: Two files share the same fallback defaults:
+ *   - This file (seed-admin.ts) for Docker/production seeding
+ *   - server/tests/testCredentials.ts for test imports
+ * When defaults are used here, isInitialAdmin=true forces a password change
+ * on first login. No other file may hardcode its own admin credentials.
  */
 
 import { db } from "./db";
@@ -15,14 +21,30 @@ import { users } from "@shared/schema";
 import bcrypt from "bcryptjs";
 import { eq } from "drizzle-orm";
 
+const DEFAULTS = {
+  username: "admin",
+  email: "admin@polly.local",
+  password: "Admin123!",
+};
+
 function getAdminConfig() {
+  const username = process.env.ADMIN_USERNAME || DEFAULTS.username;
+  const email = process.env.ADMIN_EMAIL || DEFAULTS.email;
+  const password = process.env.ADMIN_PASSWORD || DEFAULTS.password;
+
+  const isUsingDefaults =
+    username === DEFAULTS.username &&
+    email === DEFAULTS.email &&
+    password === DEFAULTS.password;
+
   const config = {
-    username: process.env.ADMIN_USERNAME || "admin",
-    email: process.env.ADMIN_EMAIL || "admin@polly.local",
-    password: process.env.ADMIN_PASSWORD || "Admin123!",
-    name: "Initial Administrator",
+    username,
+    email,
+    password,
+    name: isUsingDefaults ? "Initial Administrator" : username,
+    isUsingDefaults,
   };
-  console.log(`[Admin Seed] Config: username=${config.username}, email=${config.email}`);
+  console.log(`[Admin Seed] Config: username=${config.username}, email=${config.email}, usingDefaults=${config.isUsingDefaults}`);
   return config;
 }
 
@@ -49,7 +71,8 @@ export async function seedInitialAdmin() {
         console.log("[Admin Seed] Password comparison failed, will reset password");
       }
 
-      const needsUpdate = !passwordMatches || admin.email !== config.email || admin.role !== "admin" || !admin.emailVerified;
+      const shouldBeInitialAdmin = config.isUsingDefaults;
+      const needsUpdate = !passwordMatches || admin.email !== config.email || admin.role !== "admin" || !admin.emailVerified || admin.isInitialAdmin !== shouldBeInitialAdmin;
 
       if (needsUpdate) {
         const newHash = await bcrypt.hash(config.password, 10);
@@ -58,11 +81,13 @@ export async function seedInitialAdmin() {
           .set({
             passwordHash: newHash,
             email: config.email,
+            name: config.name,
             role: "admin",
             emailVerified: true,
+            isInitialAdmin: shouldBeInitialAdmin,
           })
           .where(eq(users.username, config.username));
-        console.log("[Admin Seed] Admin credentials updated successfully");
+        console.log(`[Admin Seed] Admin credentials updated successfully (isInitialAdmin=${shouldBeInitialAdmin})`);
 
         const verify = await bcrypt.compare(config.password, newHash);
         console.log(`[Admin Seed] Password verification: ${verify ? 'OK' : 'FAILED'}`);
@@ -86,7 +111,7 @@ export async function seedInitialAdmin() {
       passwordHash,
       role: "admin",
       provider: "local",
-      isInitialAdmin: true,
+      isInitialAdmin: config.isUsingDefaults,
       emailVerified: true,
     });
 
diff --git a/server/services/accessibilityService.ts b/server/services/accessibilityService.ts
deleted file mode 100644
index 47ce4648..00000000
--- a/server/services/accessibilityService.ts
+++ /dev/null
@@ -1,249 +0,0 @@
-/**
- * Accessibility Service - WCAG 2.1 AA Color Contrast Verification
- * Provides server-side color contrast checking for the admin panel
- */
-
-export interface ColorContrastResult {
-  colorName: string;
-  colorValue: string;
-  backgroundColorValue: string;
-  contrastRatio: number;
-  passesAA: boolean;
-  passesAAA: boolean;
-  requiredRatio: number;
-  textSize: 'normal' | 'large';
-}
-
-export interface AccessibilityAuditResult {
-  timestamp: string;
-  totalColors: number;
-  passedCount: number;
-  failedCount: number;
-  overallPass: boolean;
-  results: ColorContrastResult[];
-  recommendations: string[];
-}
-
-// HSL to RGB conversion
-function hslToRgb(h: number, s: number, l: number): [number, number, number] {
-  s /= 100;
-  l /= 100;
-  const a = s * Math.min(l, 1 - l);
-  const f = (n: number): number => {
-    const k = (n + h / 30) % 12;
-    return l - a * Math.max(Math.min(k - 3, 9 - k, 1), -1);
-  };
-  return [Math.round(f(0) * 255), Math.round(f(8) * 255), Math.round(f(4) * 255)];
-}
-
-// Hex to RGB conversion
-function hexToRgb(hex: string): [number, number, number] {
-  const cleanHex = hex.replace('#', '');
-  return [
-    parseInt(cleanHex.slice(0, 2), 16),
-    parseInt(cleanHex.slice(2, 4), 16),
-    parseInt(cleanHex.slice(4, 6), 16)
-  ];
-}
-
-// Calculate relative luminance (WCAG 2.1 formula)
-function luminance(r: number, g: number, b: number): number {
-  const [rs, gs, bs] = [r, g, b].map(c => {
-    const sRGB = c / 255;
-    return sRGB <= 0.03928 ? sRGB / 12.92 : Math.pow((sRGB + 0.055) / 1.055, 2.4);
-  });
-  return 0.2126 * rs + 0.7152 * gs + 0.0722 * bs;
-}
-
-// Calculate contrast ratio (WCAG 2.1 formula)
-function contrastRatio(l1: number, l2: number): number {
-  const lighter = Math.max(l1, l2);
-  const darker = Math.min(l1, l2);
-  return (lighter + 0.05) / (darker + 0.05);
-}
-
-// Parse color value (supports HSL, Hex)
-function parseColor(color: string): [number, number, number] | null {
-  color = color.trim();
-  
-  // HSL format: hsl(h, s%, l%) or hsl(h s% l%)
-  const hslMatch = color.match(/hsl\((\d+),?\s*(\d+(?:\.\d+)?)%?,?\s*(\d+(?:\.\d+)?)%?\)/i);
-  if (hslMatch) {
-    return hslToRgb(
-      parseFloat(hslMatch[1]),
-      parseFloat(hslMatch[2]),
-      parseFloat(hslMatch[3])
-    );
-  }
-  
-  // Hex format: #RGB or #RRGGBB
-  if (color.startsWith('#')) {
-    if (color.length === 4) {
-      // Short hex
-      const r = color[1] + color[1];
-      const g = color[2] + color[2];
-      const b = color[3] + color[3];
-      return hexToRgb(`#${r}${g}${b}`);
-    }
-    return hexToRgb(color);
-  }
-  
-  return null;
-}
-
-// Default Polly theme colors (from index.css)
-const DEFAULT_THEME_COLORS = {
-  // Light mode - text colors on white background
-  lightMode: {
-    schedule: 'hsl(25, 95%, 25%)',
-    survey: 'hsl(142, 71%, 22%)',
-    organization: 'hsl(199, 89%, 25%)',
-    pollyOrange: 'hsl(17, 100%, 35%)',
-    success: '#15803d',
-    warning: '#b45309',
-    error: '#b91c1c',
-    info: '#1d4ed8',
-    mutedForeground: 'hsl(25, 5.3%, 37%)',
-  },
-  // Button colors with white text
-  buttons: {
-    schedule: 'hsl(25, 95%, 25%)',
-    survey: 'hsl(142, 71%, 22%)',
-    organization: 'hsl(199, 89%, 25%)',
-  }
-};
-
-/**
- * Run a full accessibility audit on the current theme colors
- */
-export function runAccessibilityAudit(customColors?: Record<string, string>): AccessibilityAuditResult {
-  const results: ColorContrastResult[] = [];
-  const recommendations: string[] = [];
-  
-  const colors = customColors || {};
-  const white = '#ffffff';
-  const whiteLum = luminance(255, 255, 255);
-  
-  // Test text colors on white background
-  const textColors: Array<{ name: string; value: string; defaultValue: string }> = [
-    { name: 'Schedule (Terminumfrage)', value: colors.schedule || DEFAULT_THEME_COLORS.lightMode.schedule, defaultValue: DEFAULT_THEME_COLORS.lightMode.schedule },
-    { name: 'Survey (Umfrage)', value: colors.survey || DEFAULT_THEME_COLORS.lightMode.survey, defaultValue: DEFAULT_THEME_COLORS.lightMode.survey },
-    { name: 'Organization (Orga-Liste)', value: colors.organization || DEFAULT_THEME_COLORS.lightMode.organization, defaultValue: DEFAULT_THEME_COLORS.lightMode.organization },
-    { name: 'Primary Orange', value: colors.pollyOrange || DEFAULT_THEME_COLORS.lightMode.pollyOrange, defaultValue: DEFAULT_THEME_COLORS.lightMode.pollyOrange },
-    { name: 'Success', value: colors.success || DEFAULT_THEME_COLORS.lightMode.success, defaultValue: DEFAULT_THEME_COLORS.lightMode.success },
-    { name: 'Warning', value: colors.warning || DEFAULT_THEME_COLORS.lightMode.warning, defaultValue: DEFAULT_THEME_COLORS.lightMode.warning },
-    { name: 'Error', value: colors.error || DEFAULT_THEME_COLORS.lightMode.error, defaultValue: DEFAULT_THEME_COLORS.lightMode.error },
-    { name: 'Info', value: colors.info || DEFAULT_THEME_COLORS.lightMode.info, defaultValue: DEFAULT_THEME_COLORS.lightMode.info },
-    { name: 'Muted Foreground', value: colors.mutedForeground || DEFAULT_THEME_COLORS.lightMode.mutedForeground, defaultValue: DEFAULT_THEME_COLORS.lightMode.mutedForeground },
-  ];
-  
-  // Check text colors on white background
-  for (const color of textColors) {
-    const rgb = parseColor(color.value);
-    if (!rgb) continue;
-    
-    const colorLum = luminance(...rgb);
-    const ratio = contrastRatio(colorLum, whiteLum);
-    
-    results.push({
-      colorName: `${color.name} (Text)`,
-      colorValue: color.value,
-      backgroundColorValue: white,
-      contrastRatio: Math.round(ratio * 100) / 100,
-      passesAA: ratio >= 4.5,
-      passesAAA: ratio >= 7,
-      requiredRatio: 4.5,
-      textSize: 'normal',
-    });
-    
-    if (ratio < 4.5) {
-      recommendations.push(`${color.name}: Kontrast (${ratio.toFixed(2)}:1) ist unter WCAG AA (4.5:1). Empfehlung: Dunklere Farbe verwenden.`);
-    }
-  }
-  
-  // Test button colors (white text on colored background)
-  const buttonColors: Array<{ name: string; bgValue: string }> = [
-    { name: 'Schedule Button', bgValue: colors.scheduleButton || DEFAULT_THEME_COLORS.buttons.schedule },
-    { name: 'Survey Button', bgValue: colors.surveyButton || DEFAULT_THEME_COLORS.buttons.survey },
-    { name: 'Organization Button', bgValue: colors.organizationButton || DEFAULT_THEME_COLORS.buttons.organization },
-  ];
-  
-  for (const button of buttonColors) {
-    const rgb = parseColor(button.bgValue);
-    if (!rgb) continue;
-    
-    const bgLum = luminance(...rgb);
-    const ratio = contrastRatio(whiteLum, bgLum);
-    
-    results.push({
-      colorName: `${button.name} (Weiße Schrift)`,
-      colorValue: '#ffffff',
-      backgroundColorValue: button.bgValue,
-      contrastRatio: Math.round(ratio * 100) / 100,
-      passesAA: ratio >= 4.5,
-      passesAAA: ratio >= 7,
-      requiredRatio: 4.5,
-      textSize: 'normal',
-    });
-    
-    if (ratio < 4.5) {
-      recommendations.push(`${button.name}: Kontrast (${ratio.toFixed(2)}:1) ist unter WCAG AA (4.5:1). Empfehlung: Dunkleren Hintergrund verwenden.`);
-    }
-  }
-  
-  const passedCount = results.filter(r => r.passesAA).length;
-  const failedCount = results.filter(r => !r.passesAA).length;
-  
-  return {
-    timestamp: new Date().toISOString(),
-    totalColors: results.length,
-    passedCount,
-    failedCount,
-    overallPass: failedCount === 0,
-    results,
-    recommendations,
-  };
-}
-
-/**
- * Check if a single color combination meets WCAG AA requirements
- */
-export function checkColorContrast(
-  foreground: string, 
-  background: string,
-  textSize: 'normal' | 'large' = 'normal'
-): ColorContrastResult {
-  const fgRgb = parseColor(foreground);
-  const bgRgb = parseColor(background);
-  
-  if (!fgRgb || !bgRgb) {
-    return {
-      colorName: 'Invalid',
-      colorValue: foreground,
-      backgroundColorValue: background,
-      contrastRatio: 0,
-      passesAA: false,
-      passesAAA: false,
-      requiredRatio: textSize === 'large' ? 3 : 4.5,
-      textSize,
-    };
-  }
-  
-  const fgLum = luminance(...fgRgb);
-  const bgLum = luminance(...bgRgb);
-  const ratio = contrastRatio(fgLum, bgLum);
-  
-  const requiredRatioAA = textSize === 'large' ? 3 : 4.5;
-  const requiredRatioAAA = textSize === 'large' ? 4.5 : 7;
-  
-  return {
-    colorName: 'Custom',
-    colorValue: foreground,
-    backgroundColorValue: background,
-    contrastRatio: Math.round(ratio * 100) / 100,
-    passesAA: ratio >= requiredRatioAA,
-    passesAAA: ratio >= requiredRatioAAA,
-    requiredRatio: requiredRatioAA,
-    textSize,
-  };
-}
diff --git a/server/services/aiRateLimiterService.ts b/server/services/aiRateLimiterService.ts
new file mode 100644
index 00000000..8fa6fd5d
--- /dev/null
+++ b/server/services/aiRateLimiterService.ts
@@ -0,0 +1,165 @@
+import type { Request, Response, NextFunction } from "express";
+import { db } from "../db";
+import { aiUsageLogs } from "@shared/schema";
+import { and, gte, eq, isNull, sql } from "drizzle-orm";
+import { getAiSettings } from "./aiService";
+
+export interface AiRateLimitResult {
+  allowed: boolean;
+  remaining: number | null; // null = unlimited
+  resetAt: Date | null;
+  reason?: string;
+}
+
+export async function checkAiRateLimit(
+  userId: number | null,
+  role: "guest" | "user" | "admin",
+  sessionId?: string
+): Promise<AiRateLimitResult> {
+  const settings = await getAiSettings();
+
+  if (!settings.enabled) {
+    return { allowed: false, remaining: 0, resetAt: null, reason: "AI_DISABLED" };
+  }
+
+  const limits =
+    role === "admin"
+      ? settings.adminLimits
+      : role === "user"
+      ? settings.userLimits
+      : settings.guestLimits;
+
+  if (!limits.enabled || limits.requestsPerHour === 0) {
+    return {
+      allowed: false,
+      remaining: 0,
+      resetAt: null,
+      reason: role === "guest" ? "GUEST_NOT_ALLOWED" : "ROLE_DISABLED",
+    };
+  }
+
+  if (limits.requestsPerHour === null) {
+    return { allowed: true, remaining: null, resetAt: null };
+  }
+
+  const windowStart = new Date(Date.now() - 60 * 60 * 1000);
+
+  let countResult;
+  if (userId !== null) {
+    countResult = await db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(aiUsageLogs)
+      .where(
+        and(
+          eq(aiUsageLogs.userId, userId),
+          gte(aiUsageLogs.createdAt, windowStart)
+        )
+      );
+  } else if (sessionId) {
+    countResult = await db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(aiUsageLogs)
+      .where(
+        and(
+          isNull(aiUsageLogs.userId),
+          eq(aiUsageLogs.sessionId, sessionId),
+          gte(aiUsageLogs.createdAt, windowStart)
+        )
+      );
+  } else {
+    return { allowed: false, remaining: 0, resetAt: null, reason: "NO_SESSION" };
+  }
+
+  const usedThisHour = countResult[0]?.count ?? 0;
+  const limit = limits.requestsPerHour;
+  const remaining = Math.max(0, limit - usedThisHour);
+
+  if (usedThisHour >= limit) {
+    const resetAt = new Date(Date.now() + 60 * 60 * 1000);
+    return { allowed: false, remaining: 0, resetAt, reason: "RATE_LIMIT_EXCEEDED" };
+  }
+
+  return { allowed: true, remaining: remaining - 1, resetAt: null };
+}
+
+export async function logAiUsage(opts: {
+  userId: number | null;
+  sessionId?: string;
+  endpoint: string;
+  model: string;
+  promptTokens?: number;
+  completionTokens?: number;
+  success: boolean;
+  errorMessage?: string;
+}): Promise<void> {
+  try {
+    await db.insert(aiUsageLogs).values({
+      userId: opts.userId ?? null,
+      sessionId: opts.sessionId ?? null,
+      endpoint: opts.endpoint,
+      model: opts.model,
+      promptTokens: opts.promptTokens ?? null,
+      completionTokens: opts.completionTokens ?? null,
+      success: opts.success,
+      errorMessage: opts.errorMessage ?? null,
+    });
+  } catch (err) {
+    console.error("[AI Rate Limiter] Failed to log usage:", err);
+  }
+}
+
+export function aiRateLimitMiddleware(
+  req: Request,
+  res: Response,
+  next: NextFunction
+): void {
+  const userId = (req.session as any)?.userId ?? null;
+  const user = (req as any).user;
+  const role: "guest" | "user" | "admin" =
+    userId === null
+      ? "guest"
+      : user?.role === "admin"
+      ? "admin"
+      : "user";
+
+  const sessionId =
+    req.cookies?.["polly.sid"] ||
+    req.headers["x-session-id"] as string ||
+    req.ip ||
+    "unknown";
+
+  checkAiRateLimit(userId, role, sessionId)
+    .then((result) => {
+      if (!result.allowed) {
+        const messages: Record<string, string> = {
+          AI_DISABLED: "KI-Funktion ist deaktiviert",
+          GUEST_NOT_ALLOWED: "Gäste können die KI-Funktion nicht nutzen. Bitte melden Sie sich an.",
+          ROLE_DISABLED: "KI-Funktion ist für Ihre Rolle deaktiviert",
+          RATE_LIMIT_EXCEEDED: "KI-Kontingent für diese Stunde aufgebraucht",
+          NO_SESSION: "Keine gültige Session",
+        };
+        const message = messages[result.reason || ""] || "KI-Anfrage nicht erlaubt";
+        res.status(429).json({
+          error: message,
+          reason: result.reason,
+          resetAt: result.resetAt?.toISOString(),
+        });
+        return;
+      }
+
+      if (result.remaining !== null) {
+        res.setHeader("X-AI-RateLimit-Remaining", result.remaining.toString());
+      } else {
+        res.setHeader("X-AI-RateLimit-Remaining", "unlimited");
+      }
+
+      (req as any).aiUserId = userId;
+      (req as any).aiRole = role;
+      (req as any).aiSessionId = sessionId;
+      next();
+    })
+    .catch((err) => {
+      console.error("[AI Rate Limiter] Error:", err);
+      next();
+    });
+}
diff --git a/server/services/aiService.ts b/server/services/aiService.ts
new file mode 100644
index 00000000..b7059076
--- /dev/null
+++ b/server/services/aiService.ts
@@ -0,0 +1,455 @@
+import OpenAI from "openai";
+import { storage } from "../storage";
+import { aiSettingsSchema, type AiSettings } from "@shared/schema";
+
+let openaiClient: OpenAI | null = null;
+let openaiClientFallback: OpenAI | null = null;
+
+export function getEffectiveApiKey(settings: AiSettings, fallback = false): string {
+  if (fallback) {
+    return process.env.AI_API_KEY_FALLBACK || settings.apiKeyFallback || '';
+  }
+  return process.env.AI_API_KEY || settings.apiKey || '';
+}
+
+export function getEffectiveApiUrl(settings: AiSettings): string {
+  return process.env.AI_API_URL || settings.apiUrl || 'https://saia.gwdg.de/v1';
+}
+
+function getClient(fallback = false): OpenAI | null {
+  const apiKey = fallback
+    ? process.env.AI_API_KEY_FALLBACK
+    : process.env.AI_API_KEY;
+  if (!apiKey) return null;
+  const baseURL =
+    process.env.AI_API_URL || "https://saia.gwdg.de/v1";
+  return new OpenAI({ apiKey, baseURL });
+}
+
+async function getClientWithDbFallback(fallback = false): Promise<OpenAI | null> {
+  const settings = await getAiSettings();
+  const apiKey = getEffectiveApiKey(settings, fallback);
+  if (!apiKey) return null;
+  const baseURL = getEffectiveApiUrl(settings);
+  return new OpenAI({ apiKey, baseURL });
+}
+
+let aiSettingsCache: { value: AiSettings; expiresAt: number } | null = null;
+const AI_SETTINGS_TTL_MS = 60_000;
+
+export async function getAiSettings(): Promise<AiSettings> {
+  if (aiSettingsCache && Date.now() < aiSettingsCache.expiresAt) {
+    return aiSettingsCache.value;
+  }
+  try {
+    const setting = await storage.getSetting("ai_settings");
+    if (setting?.value) {
+      const raw = setting.value as Record<string, unknown>;
+      const parsed = aiSettingsSchema.parse(raw);
+      const result = applyEnvAutoEnable(parsed, raw);
+      aiSettingsCache = { value: result, expiresAt: Date.now() + AI_SETTINGS_TTL_MS };
+      return result;
+    }
+  } catch (err) {
+    console.warn('[AI] Failed to load AI settings from DB, using defaults:', (err as Error).message);
+  }
+  const defaults = applyEnvAutoEnable(aiSettingsSchema.parse({}), {});
+  aiSettingsCache = { value: defaults, expiresAt: Date.now() + AI_SETTINGS_TTL_MS };
+  return defaults;
+}
+
+function applyEnvAutoEnable(settings: AiSettings, rawDbValue: Record<string, unknown>): AiSettings {
+  if (!process.env.AI_API_KEY) return settings;
+  if (settings.enabled) return settings;
+  const adminExplicitlySetEnabled = 'enabled' in rawDbValue && rawDbValue.enabled === false;
+  if (adminExplicitlySetEnabled) return settings;
+  return { ...settings, enabled: true };
+}
+
+export async function saveAiSettings(settings: AiSettings): Promise<void> {
+  aiSettingsCache = null;
+  openaiClient = null;
+  openaiClientFallback = null;
+  await storage.setSetting({ key: "ai_settings", value: settings });
+}
+
+export interface PollSuggestionSettings {
+  resultsPublic?: boolean;
+  allowVoteEdit?: boolean;
+  allowVoteWithdrawal?: boolean;
+  allowMaybe?: boolean;
+  allowMultipleSlots?: boolean;
+}
+
+export interface SurveyOption {
+  text: string;
+  isFreeText?: boolean;
+}
+
+export interface PollSuggestion {
+  title: string;
+  description: string;
+  options: string[] | SurveyOption[];
+  pollType: "schedule" | "survey" | "organization";
+  settings?: PollSuggestionSettings;
+}
+
+function buildSystemPrompt(todayStr: string): string {
+  return `You are a helpful assistant for creating polls, surveys and organization lists.
+The user will describe what they need, and you must respond ONLY with a valid JSON object.
+Do NOT include any explanation or markdown — just the raw JSON.
+
+Today's date: ${todayStr}. Use this to calculate realistic future dates.
+
+Decide which poll type fits best:
+- "schedule": finding a date/time (Terminumfrage) — when users want to coordinate meeting times, events, appointments
+- "survey": collecting opinions/votes on topics (Umfrage) — when users want to ask questions or gather feedback
+- "organization": sign-up sheets with time slots and capacity (Orga-Liste) — when users need helpers, volunteers, or slot booking
+
+The JSON must have this exact structure:
+{
+  "pollType": "schedule" | "survey" | "organization",
+  "title": "Title here",
+  "description": "Helpful description of the purpose, max 200 characters",
+  "options": ["Option 1", "Option 2", ...],
+  "settings": {
+    "resultsPublic": true or false,
+    "allowVoteEdit": true or false,
+    "allowVoteWithdrawal": true or false,
+    "allowMaybe": true or false,
+    "allowMultipleSlots": true or false
+  }
+}
+
+Rules per poll type for the OPTIONS field:
+- schedule: options must be date+time strings in EXACTLY this format: "DD.MM.YYYY HH:MM - HH:MM"
+  Example: ["15.07.2026 09:00 - 10:00", "16.07.2026 14:00 - 15:30", "17.07.2026 10:00 - 11:00"]
+  Use realistic future dates (within the next 2-4 weeks from today: ${todayStr}).
+  If the user specifies a count or lists specific dates, generate exactly that many. Otherwise, suggest 3-5 options.
+- survey: TWO formats depending on context:
+  (A) CHOICE questions (preferences, opinions, ratings, food, activities — "Lieblingsessen", "Welcher Tag passt?", etc.):
+      options are plain strings: ["Option A", "Option B", "Option C"]
+      Participants pick yes/no/maybe for each option.
+      If the user specifies a count or lists specific choices, generate exactly that many. Otherwise, suggest 4-6 options.
+  (B) OPEN-ENDED / FEEDBACK forms (collecting text responses, feelings, suggestions, contact info, evaluation — keywords: Feedback, Meinung, Gefühle, Bedürfnisse, Wünsche, Vorschläge, offene Fragen, freier Text, NVC, Kita, Schule, Eltern, Team-Klima, Rückmeldung, anonymous input, open question):
+      options are objects with "isFreeText": true — each is an open question participants type an answer to.
+      Format: [{"text": "Question here?", "isFreeText": true}, ...]
+      Participants fill in free text for each. No yes/no/maybe buttons.
+      Use this format when the request is about gathering written feedback, opinions in free form, or contact details.
+      Example for a Kita feedback survey: [{"text": "Folgende Situation habe ich erlebt / wahrgenommen:", "isFreeText": true}, {"text": "Ich fühle mich dadurch:", "isFreeText": true}, {"text": "Mein Bedürfnis ist / Mir ist wichtig:", "isFreeText": true}, {"text": "Folgende Lösung würde ich mir wünschen:", "isFreeText": true}, {"text": "Name und Kontaktdaten (freiwillig):", "isFreeText": true}]
+  You may also MIX both formats in one survey (some string options + some isFreeText objects) when appropriate.
+- organization: TWO formats depending on context:
+  (A) FIXED-DATE events (party, festival, Sommerfest, Sportfest, workshop, Tag der offenen Tür, Firmenevent, etc. — any event with an implied specific day):
+      ALWAYS include the concrete event date in EVERY slot. Format: "DD.MM.YYYY Description HH:MM - HH:MM (max. N)"
+      Choose a realistic future date based on context (e.g., Sommerfest → a Saturday in summer; workshop → next or following week).
+      Example for a Sommerfest on 20.06.2026: ["20.06.2026 Aufbau 08:00 - 10:00 (max. 5)", "20.06.2026 Betreuung 10:00 - 14:00 (max. 3)", "20.06.2026 Abbau 14:00 - 16:00 (max. 4)"]
+  (B) ONGOING / RECURRING sign-up lists WITHOUT a fixed date (cleaning rota, recurring duty schedule, etc.):
+      Omit the date. Format: "Description HH:MM - HH:MM (max. N)"
+      Example: ["Aufbau 08:00 - 10:00 (max. 5)", "Betreuung 10:00 - 14:00 (max. 3)", "Abbau 14:00 - 16:00"]
+  Always include capacity (max. N) when context implies limited spots.
+  If the user specifies a count or lists specific stations/tasks, generate exactly that many slots. Otherwise, suggest 5-8 slots.
+
+Rules for the SETTINGS field — you MUST decide based on context:
+
+For SCHEDULE polls:
+- resultsPublic: true (participants should see each other's availability)
+- allowVoteEdit: true (people often need to change availability)
+- allowVoteWithdrawal: true
+- allowMaybe: true (common for schedule coordination)
+- allowMultipleSlots: true
+
+For ORGANIZATION polls:
+- resultsPublic: true (participants MUST see who signed up for what slot — this is the whole point)
+- allowVoteEdit: true (people may need to change slots)
+- allowVoteWithdrawal: true (people may need to cancel)
+- allowMaybe: false (not applicable for sign-up lists)
+- allowMultipleSlots: true (participants may want to sign up for multiple slots; set to false only if the user explicitly requests single-slot-only booking)
+
+For SURVEY polls — decide based on sensitivity:
+- SENSITIVE topics (keywords: satisfaction, Zufriedenheit, mood, Stimmung, feedback, Bewertung, evaluation, Beurteilung, salary, Gehalt, anonymous, anonym, team climate, Teamklima, confidential, vertraulich, well-being, Wohlbefinden, peer review, performance, opinion about people):
+  - resultsPublic: false (participants should NOT see each other's answers — it would bias responses)
+  - allowVoteEdit: false (anonymous answers should be final)
+  - allowVoteWithdrawal: false
+  - allowMaybe: false (use clear yes/no or rating scales)
+- NEUTRAL topics (preferences, planning, choices, food, events, activities):
+  - resultsPublic: true
+  - allowVoteEdit: false
+  - allowVoteWithdrawal: false
+  - allowMaybe: true
+
+General rules:
+- title: short and clear, max 80 characters
+- description: explain the purpose well so participants understand what they are voting on, max 200 characters
+- Respond in the same language as the user's request (German if German, English if English)
+- Always include the settings field with all relevant boolean values`;
+}
+
+function buildRefinePrompt(todayStr: string): string {
+  return `You are a helpful assistant for creating polls, surveys and organization lists.
+The user already has a poll suggestion and wants to modify it.
+You will receive the current suggestion as JSON and the user's requested change.
+Respond ONLY with a valid JSON object in the exact same structure as the current suggestion — no explanation, no markdown.
+
+Today's date: ${todayStr}. Use this to calculate realistic future dates.
+
+Apply the user's requested change to the suggestion. You may:
+- Change the poll type if the user explicitly asks for it
+- Add, remove, or modify options
+- Update the title or description
+- Change the settings (resultsPublic, allowMaybe, etc.)
+- Adjust dates/times if requested
+
+Keep everything else the same unless the user asks to change it.
+The JSON must follow this exact structure:
+{
+  "pollType": "schedule" | "survey" | "organization",
+  "title": "Title here",
+  "description": "Description here",
+  "options": ["Option 1", "Option 2", ...],
+  "settings": {
+    "resultsPublic": true or false,
+    "allowVoteEdit": true or false,
+    "allowVoteWithdrawal": true or false,
+    "allowMaybe": true or false,
+    "allowMultipleSlots": true or false
+  }
+}
+
+For schedule options, use EXACTLY this format: "DD.MM.YYYY HH:MM - HH:MM"
+For organization options with a fixed event date, use: "DD.MM.YYYY Description HH:MM - HH:MM (max. N)"
+For organization options without a fixed date, use: "Description HH:MM - HH:MM (max. N)"
+For survey options: plain strings for choice questions, or objects {"text": "...", "isFreeText": true} for open-ended text questions. Keep the same format as the existing options unless the user explicitly asks to change the survey type.
+If the user asks to add more items, add them freely — even if the total exceeds the initial count. If the user asks to remove items, remove them. Always honor the user's requested count exactly.
+Respond in the same language as the user's refinement request.`;
+}
+
+export async function refinePollSuggestion(
+  originalDescription: string,
+  previousSuggestion: PollSuggestion,
+  refinement: string,
+  language: string = "de"
+): Promise<PollSuggestion> {
+  const settings = await getAiSettings();
+
+  if (!settings.enabled) {
+    throw new Error("AI_DISABLED");
+  }
+
+  const model =
+    process.env.AI_MODEL || settings.model || "llama-3.3-70b-instruct";
+
+  const todayStr = new Date().toLocaleDateString("de-DE", { day: "2-digit", month: "2-digit", year: "numeric" });
+
+  const langHint =
+    language === "de"
+      ? "Please respond in German."
+      : "Please respond in English.";
+
+  const userMessage = `Original request: "${originalDescription}"
+
+Current suggestion:
+${JSON.stringify(previousSuggestion, null, 2)}
+
+User wants to change: "${refinement}"
+
+${langHint}`;
+
+  let client = openaiClient || await getClientWithDbFallback(false);
+  openaiClient = client;
+
+  if (!client) {
+    throw new Error("AI_NOT_CONFIGURED");
+  }
+
+  let lastError: Error | null = null;
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const activeClient = attempt === 0 ? client : (openaiClientFallback || await getClientWithDbFallback(true));
+      if (!activeClient) throw new Error("AI_NOT_CONFIGURED");
+      if (attempt === 1) openaiClientFallback = activeClient;
+
+      const response = await activeClient.chat.completions.create({
+        model,
+        messages: [
+          { role: "system", content: buildRefinePrompt(todayStr) },
+          { role: "user", content: userMessage },
+        ],
+        temperature: 0.5,
+        max_tokens: 2000,
+      });
+
+      const content = response.choices[0]?.message?.content?.trim();
+      if (!content) throw new Error("AI_EMPTY_RESPONSE");
+
+      const jsonMatch = content.match(/\{[\s\S]*\}/);
+      if (!jsonMatch) throw new Error("AI_INVALID_JSON");
+
+      const parsed = JSON.parse(jsonMatch[0]) as PollSuggestion;
+
+      if (!parsed.title || !Array.isArray(parsed.options) || parsed.options.length < 1) {
+        throw new Error("AI_INVALID_STRUCTURE");
+      }
+
+      const validTypes = ["schedule", "survey", "organization"];
+      const pollType = validTypes.includes(parsed.pollType) ? parsed.pollType : previousSuggestion.pollType;
+
+      const rawSettings = parsed.settings as Record<string, unknown> | undefined;
+      const resolvedSettings: PollSuggestionSettings = {};
+
+      if (rawSettings && typeof rawSettings === "object") {
+        if (typeof rawSettings.resultsPublic === "boolean") resolvedSettings.resultsPublic = rawSettings.resultsPublic;
+        if (typeof rawSettings.allowVoteEdit === "boolean") resolvedSettings.allowVoteEdit = rawSettings.allowVoteEdit;
+        if (typeof rawSettings.allowVoteWithdrawal === "boolean") resolvedSettings.allowVoteWithdrawal = rawSettings.allowVoteWithdrawal;
+        if (typeof rawSettings.allowMaybe === "boolean") resolvedSettings.allowMaybe = rawSettings.allowMaybe;
+        if (typeof rawSettings.allowMultipleSlots === "boolean") resolvedSettings.allowMultipleSlots = rawSettings.allowMultipleSlots;
+      }
+
+      const normalizeOptions = (opts: any[]): string[] | SurveyOption[] =>
+        opts.map((o) => {
+          if (typeof o === "string") return o.slice(0, 120);
+          if (o && typeof o === "object" && typeof o.text === "string") {
+            return { text: o.text.slice(0, 120), isFreeText: !!o.isFreeText };
+          }
+          return String(o).slice(0, 120);
+        }).slice(0, 50) as string[] | SurveyOption[];
+
+      return {
+        pollType: pollType as PollSuggestion["pollType"],
+        title: String(parsed.title).slice(0, 80),
+        description: String(parsed.description || "").slice(0, 200),
+        options: normalizeOptions(parsed.options as any[]),
+        settings: resolvedSettings,
+      };
+    } catch (err: any) {
+      lastError = err;
+      if (err?.status === 503) {
+        console.warn("[AI] Model not loaded (503), not retrying.");
+        throw new Error("AI_MODEL_LOADING");
+      }
+      const isRateLimit =
+        err?.status === 429 ||
+        err?.message?.includes("rate") ||
+        err?.message?.includes("quota");
+      const fallbackSettings = await getAiSettings();
+      if (isRateLimit && attempt === 0 && getEffectiveApiKey(fallbackSettings, true)) {
+        console.warn("[AI] Primary key rate-limited, trying fallback key...");
+        continue;
+      }
+      break;
+    }
+  }
+
+  throw lastError || new Error("AI_REQUEST_FAILED");
+}
+
+export async function createPollFromDescription(
+  description: string,
+  language: string = "de"
+): Promise<PollSuggestion> {
+  const settings = await getAiSettings();
+
+  if (!settings.enabled) {
+    throw new Error("AI_DISABLED");
+  }
+
+  const model =
+    process.env.AI_MODEL || settings.model || "llama-3.3-70b-instruct";
+
+  const todayStr = new Date().toLocaleDateString("de-DE", { day: "2-digit", month: "2-digit", year: "numeric" });
+
+  const langHint =
+    language === "de"
+      ? "Please respond in German."
+      : "Please respond in English.";
+
+  const userMessage = `${description}\n\n${langHint}`;
+
+  let client = openaiClient || await getClientWithDbFallback(false);
+  openaiClient = client;
+
+  if (!client) {
+    throw new Error("AI_NOT_CONFIGURED");
+  }
+
+  let lastError: Error | null = null;
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const activeClient = attempt === 0 ? client : (openaiClientFallback || await getClientWithDbFallback(true));
+      if (!activeClient) throw new Error("AI_NOT_CONFIGURED");
+      if (attempt === 1) openaiClientFallback = activeClient;
+
+      const response = await activeClient.chat.completions.create({
+        model,
+        messages: [
+          { role: "system", content: buildSystemPrompt(todayStr) },
+          { role: "user", content: userMessage },
+        ],
+        temperature: 0.7,
+        max_tokens: 2000,
+      });
+
+      const content = response.choices[0]?.message?.content?.trim();
+      if (!content) throw new Error("AI_EMPTY_RESPONSE");
+
+      const jsonMatch = content.match(/\{[\s\S]*\}/);
+      if (!jsonMatch) throw new Error("AI_INVALID_JSON");
+
+      const parsed = JSON.parse(jsonMatch[0]) as PollSuggestion;
+
+      if (!parsed.title || !Array.isArray(parsed.options) || parsed.options.length < 2) {
+        throw new Error("AI_INVALID_STRUCTURE");
+      }
+
+      const validTypes = ["schedule", "survey", "organization"];
+      const pollType = validTypes.includes(parsed.pollType) ? parsed.pollType : "survey";
+
+      const rawSettings = parsed.settings as Record<string, unknown> | undefined;
+      const resolvedSettings: PollSuggestionSettings = {};
+
+      if (rawSettings && typeof rawSettings === "object") {
+        if (typeof rawSettings.resultsPublic === "boolean") resolvedSettings.resultsPublic = rawSettings.resultsPublic;
+        if (typeof rawSettings.allowVoteEdit === "boolean") resolvedSettings.allowVoteEdit = rawSettings.allowVoteEdit;
+        if (typeof rawSettings.allowVoteWithdrawal === "boolean") resolvedSettings.allowVoteWithdrawal = rawSettings.allowVoteWithdrawal;
+        if (typeof rawSettings.allowMaybe === "boolean") resolvedSettings.allowMaybe = rawSettings.allowMaybe;
+        if (typeof rawSettings.allowMultipleSlots === "boolean") resolvedSettings.allowMultipleSlots = rawSettings.allowMultipleSlots;
+      }
+
+      const normalizeOpts = (opts: any[]): string[] | SurveyOption[] =>
+        opts.map((o) => {
+          if (typeof o === "string") return o.slice(0, 120);
+          if (o && typeof o === "object" && typeof o.text === "string") {
+            return { text: o.text.slice(0, 120), isFreeText: !!o.isFreeText };
+          }
+          return String(o).slice(0, 120);
+        }).slice(0, 50) as string[] | SurveyOption[];
+
+      return {
+        pollType: pollType as PollSuggestion["pollType"],
+        title: String(parsed.title).slice(0, 80),
+        description: String(parsed.description || "").slice(0, 200),
+        options: normalizeOpts(parsed.options as any[]),
+        settings: resolvedSettings,
+      };
+    } catch (err: any) {
+      lastError = err;
+      if (err?.status === 503) {
+        console.warn("[AI] Model not loaded (503), not retrying.");
+        throw new Error("AI_MODEL_LOADING");
+      }
+      const isRateLimit =
+        err?.status === 429 ||
+        err?.message?.includes("rate") ||
+        err?.message?.includes("quota");
+      const fallbackSettings2 = await getAiSettings();
+      if (isRateLimit && attempt === 0 && getEffectiveApiKey(fallbackSettings2, true)) {
+        console.warn("[AI] Primary key rate-limited, trying fallback key...");
+        continue;
+      }
+      break;
+    }
+  }
+
+  throw lastError || new Error("AI_REQUEST_FAILED");
+}
diff --git a/server/services/authService.ts b/server/services/authService.ts
index 4b45652e..287a04d9 100644
--- a/server/services/authService.ts
+++ b/server/services/authService.ts
@@ -2,6 +2,7 @@ import * as client from 'openid-client';
 import bcrypt from 'bcryptjs';
 import { storage } from '../storage';
 import type { User } from '@shared/schema';
+import { getBaseUrl } from '../utils/baseUrl';
 
 let oidcConfig: client.Configuration | null = null;
 
@@ -86,7 +87,7 @@ interface KeycloakConfig {
 
 const getKeycloakConfig = (): KeycloakConfig | null => {
   const realm = process.env.KEYCLOAK_REALM;
-  const serverUrl = process.env.KEYCLOAK_URL;
+  const serverUrl = process.env.KEYCLOAK_AUTH_SERVER_URL || process.env.KEYCLOAK_URL;
   const clientId = process.env.KEYCLOAK_CLIENT_ID;
   const clientSecret = process.env.KEYCLOAK_CLIENT_SECRET;
 
@@ -94,16 +95,12 @@ const getKeycloakConfig = (): KeycloakConfig | null => {
     return null;
   }
 
-  const baseUrl = process.env.BASE_URL 
-    || (process.env.REPLIT_DOMAINS ? `https://${process.env.REPLIT_DOMAINS.split(',')[0]}` : null)
-    || 'http://localhost:5000';
-
   return {
     realm,
     serverUrl,
     clientId,
     clientSecret,
-    redirectUri: `${baseUrl}/api/v1/auth/keycloak/callback`
+    redirectUri: `${getBaseUrl()}/api/v1/auth/keycloak/callback`
   };
 };
 
@@ -130,20 +127,96 @@ export const authService = {
     return oidcConfig !== null;
   },
 
-  getKeycloakAuthUrl(state: string): { url: string; codeVerifier: string } | null {
+  getDisplayConfig(): {
+    configured: boolean;
+    enabled: boolean;
+    issuerUrl: string;
+    clientId: string;
+    hasClientSecret: boolean;
+    callbackUrl: string;
+  } {
+    const config = getKeycloakConfig();
+    const issuerUrl = config ? `${config.serverUrl}/realms/${config.realm}` : '';
+
+    return {
+      configured: config !== null,
+      enabled: oidcConfig !== null,
+      issuerUrl,
+      clientId: config?.clientId || '',
+      hasClientSecret: !!(config?.clientSecret),
+      callbackUrl: config?.redirectUri || '',
+    };
+  },
+
+  async testOidcConnection(): Promise<{ success: boolean; error?: string; details?: string }> {
+    const config = getKeycloakConfig();
+    if (!config) {
+      return { success: false, error: 'Keycloak not configured' };
+    }
+    try {
+      const wellKnownUrl = `${config.serverUrl}/realms/${config.realm}/.well-known/openid-configuration`;
+      const discoveryResponse = await fetch(wellKnownUrl, { signal: AbortSignal.timeout(10000) });
+      if (!discoveryResponse.ok) {
+        return { success: false, error: `Discovery endpoint: HTTP ${discoveryResponse.status} ${discoveryResponse.statusText}` };
+      }
+      const discoveryData = await discoveryResponse.json();
+      if (!discoveryData.issuer) {
+        return { success: false, error: 'Invalid OpenID Configuration: missing issuer' };
+      }
+
+      if (config.clientSecret && discoveryData.token_endpoint) {
+        try {
+          const tokenResponse = await fetch(discoveryData.token_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+              grant_type: 'client_credentials',
+              client_id: config.clientId,
+              client_secret: config.clientSecret,
+            }),
+            signal: AbortSignal.timeout(10000),
+          });
+          let tokenData: any;
+          try {
+            tokenData = await tokenResponse.json();
+          } catch {
+            return { success: true, details: `Discovery OK, token endpoint returned non-JSON (HTTP ${tokenResponse.status})` };
+          }
+          if (tokenResponse.ok && tokenData.access_token) {
+            return { success: true, details: 'Discovery OK, client credentials verified' };
+          }
+          if (tokenData.error === 'invalid_client') {
+            return { success: false, error: `Client authentication failed: ${tokenData.error_description || tokenData.error}` };
+          }
+          if (tokenData.error === 'unauthorized_client' || tokenData.error === 'unsupported_grant_type') {
+            return { success: true, details: 'Discovery OK, client_credentials grant not enabled (normal for authorization-code clients)' };
+          }
+          return { success: true, details: `Discovery OK, token endpoint responded: ${tokenData.error || 'unknown'}` };
+        } catch (tokenError: any) {
+          return { success: false, error: `Discovery OK, but token endpoint unreachable: ${tokenError.message}` };
+        }
+      }
+
+      return { success: true, details: 'Discovery OK (no client secret configured for credential verification)' };
+    } catch (error: any) {
+      return { success: false, error: error.message || 'Connection failed' };
+    }
+  },
+
+  async getKeycloakAuthUrl(state: string): Promise<{ url: string; codeVerifier: string } | null> {
     if (!oidcConfig) return null;
 
     const config = getKeycloakConfig();
     if (!config) return null;
 
     const codeVerifier = client.randomPKCECodeVerifier();
-    const codeChallenge = client.calculatePKCECodeChallenge(codeVerifier);
+    const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
     
     const parameters: Record<string, string> = {
       redirect_uri: config.redirectUri,
       scope: 'openid email profile',
       state,
-      code_challenge: codeChallenge as unknown as string,
+      code_challenge: codeChallenge,
       code_challenge_method: 'S256',
     };
 
@@ -154,7 +227,7 @@ export const authService = {
 
   async initiateKeycloakLogin(req: any): Promise<{ authUrl: string; codeVerifier: string; state: string }> {
     const state = Math.random().toString(36).substring(7);
-    const result = this.getKeycloakAuthUrl(state);
+    const result = await this.getKeycloakAuthUrl(state);
     if (!result) {
       throw new Error('Keycloak not configured');
     }
@@ -208,8 +281,8 @@ export const authService = {
           const updateData: Record<string, any> = {
             keycloakId,
             provider: 'keycloak',
+            emailVerified: true,
           };
-          // Only update role if Keycloak provides one
           if (keycloakRole) {
             updateData.role = keycloakRole;
           }
@@ -223,13 +296,20 @@ export const authService = {
             role: keycloakRole || 'user',
             keycloakId,
             provider: 'keycloak',
+            emailVerified: true,
           });
           await storage.updateUserLastLogin(user.id);
         }
       } else {
-        // Sync role from Keycloak on every login (if role is provided in token)
+        const syncData: Record<string, any> = {};
         if (keycloakRole && user.role !== keycloakRole) {
-          user = await storage.updateUser(user.id, { role: keycloakRole });
+          syncData.role = keycloakRole;
+        }
+        if (!user.emailVerified) {
+          syncData.emailVerified = true;
+        }
+        if (Object.keys(syncData).length > 0) {
+          user = await storage.updateUser(user.id, syncData);
         }
         await storage.updateUserLastLogin(user.id);
       }
@@ -277,7 +357,7 @@ export const authService = {
       return null;
     }
 
-    const passwordHash = await bcrypt.hash(password, 10);
+    const passwordHash = await bcrypt.hash(password, 12);
 
     const user = await storage.createUser({
       username,
@@ -293,7 +373,7 @@ export const authService = {
   },
 
   async hashPassword(password: string): Promise<string> {
-    return bcrypt.hash(password, 10);
+    return bcrypt.hash(password, 12);
   },
 
   async verifyPassword(password: string, hash: string): Promise<boolean> {
diff --git a/server/services/deviceTokenService.ts b/server/services/deviceTokenService.ts
index 9e836385..a3d12efd 100644
--- a/server/services/deviceTokenService.ts
+++ b/server/services/deviceTokenService.ts
@@ -111,7 +111,7 @@ export const deviceTokenService = {
   getCookieOptions() {
     return {
       httpOnly: true,
-      secure: process.env.FORCE_HTTPS === 'true' || (process.env.NODE_ENV === 'production' && process.env.BASE_URL?.startsWith('https://')),
+      secure: process.env.FORCE_HTTPS === 'true' || (process.env.NODE_ENV === 'production' && (process.env.APP_URL || process.env.BASE_URL || '').startsWith('https://')),
       sameSite: 'lax' as const,
       maxAge: TOKEN_TTL_DAYS * 24 * 60 * 60 * 1000,
       path: '/',
diff --git a/server/services/emailService.ts b/server/services/emailService.ts
index ec60d155..dbfa951a 100644
--- a/server/services/emailService.ts
+++ b/server/services/emailService.ts
@@ -1,5 +1,17 @@
 import nodemailer from 'nodemailer';
 import { qrService } from './qrService';
+import { emailTemplateService } from './emailTemplateService';
+import type { EmailTemplateType } from '@shared/schema';
+import { getBaseUrl, validateEmailUrl, warnIfLocalhostInProduction } from '../utils/baseUrl';
+
+function escapeHtml(str: string): string {
+  return str
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
 
 interface EmailConfig {
   host: string;
@@ -11,6 +23,19 @@ interface EmailConfig {
   };
 }
 
+type EmailPriority = 'high' | 'normal';
+
+interface SendMailOptions {
+  to: string;
+  subject: string;
+  html: string;
+  text: string;
+  priority?: EmailPriority;
+  fromPrefix?: string;
+  attachments?: nodemailer.SendMailOptions['attachments'];
+  isBulk?: boolean;
+}
+
 export class EmailService {
   private transporter: nodemailer.Transporter | null = null;
   private isConfigured: boolean = false;
@@ -19,15 +44,57 @@ export class EmailService {
     return this.isConfigured;
   }
 
+  configureForTesting(transporter: nodemailer.Transporter): void {
+    this.transporter = transporter;
+    this.isConfigured = true;
+  }
+
+  getDisplayConfig(): {
+    configured: boolean;
+    host: string;
+    port: number;
+    user: string;
+    hasPassword: boolean;
+    secure: boolean;
+    fromEmail: string;
+    fromName: string;
+  } {
+    const smtpPassword = process.env.SMTP_PASSWORD || process.env.SMTP_PASS || '';
+    const portRaw = parseInt(process.env.SMTP_PORT || '587');
+    const port = Number.isNaN(portRaw) ? 587 : portRaw;
+
+    return {
+      configured: this.isConfigured,
+      host: process.env.SMTP_HOST || '',
+      port,
+      user: process.env.SMTP_USER || '',
+      hasPassword: smtpPassword.length > 0,
+      secure: process.env.SMTP_SECURE === 'true',
+      fromEmail: process.env.FROM_EMAIL || process.env.EMAIL_FROM || 'noreply@polly.example.com',
+      fromName: process.env.FROM_NAME || 'Polly',
+    };
+  }
+
+  async testConnection(): Promise<{ success: boolean; error?: string }> {
+    if (!this.isConfigured || !this.transporter) {
+      return { success: false, error: 'SMTP not configured' };
+    }
+    try {
+      await this.transporter.verify();
+      return { success: true };
+    } catch (error: any) {
+      return { success: false, error: error.message || 'Connection failed' };
+    }
+  }
+
   constructor() {
-    // Check if SMTP is properly configured
-    // Support both SMTP_PASSWORD (docker-compose.yml) and SMTP_PASS (legacy) for compatibility
     const smtpPassword = process.env.SMTP_PASSWORD || process.env.SMTP_PASS;
     const hasSmtpConfig = process.env.SMTP_HOST && 
                          process.env.SMTP_USER && 
                          smtpPassword;
+    const isTestEnv = process.env.NODE_ENV === 'test';
 
-    if (hasSmtpConfig) {
+    if (hasSmtpConfig && !isTestEnv) {
       const config: EmailConfig = {
         host: process.env.SMTP_HOST!,
         port: parseInt(process.env.SMTP_PORT || '587'),
@@ -38,93 +105,118 @@ export class EmailService {
         },
       };
 
-      // Additional anti-spam configuration with reduced timeouts
       const transporterOptions = {
         ...config,
         pool: true,
         maxConnections: 1,
         maxMessages: 3,
-        rateDelta: 20000, // 20 seconds between messages
-        rateLimit: 3, // max 3 messages per rateDelta
-        dnsTimeout: 10000, // 10 seconds
-        connectionTimeout: 15000, // 15 seconds
-        greetingTimeout: 10000, // 10 seconds
-        socketTimeout: 15000, // 15 seconds
+        rateDelta: 20000,
+        rateLimit: 3,
+        dnsTimeout: 10000,
+        connectionTimeout: 15000,
+        greetingTimeout: 10000,
+        socketTimeout: 15000,
       };
 
       this.transporter = nodemailer.createTransport(transporterOptions);
       this.isConfigured = true;
+
+      warnIfLocalhostInProduction();
     } else {
       console.warn('SMTP not configured. Email notifications will be disabled.');
       this.isConfigured = false;
     }
   }
 
+  private getFromAddress(prefix?: string): string {
+    const fromName = process.env.FROM_NAME || 'Polly';
+    const fromEmail = process.env.FROM_EMAIL || process.env.EMAIL_FROM || 'noreply@polly.example.com';
+    const displayName = prefix ? `${fromName} ${prefix}` : fromName;
+    return `"${displayName}" <${fromEmail}>`;
+  }
+
+  private getReplyTo(): string {
+    return process.env.FROM_EMAIL || process.env.EMAIL_FROM || 'noreply@polly.example.com';
+  }
+
+  private async renderTemplate(
+    type: EmailTemplateType,
+    variables: Record<string, string | undefined>
+  ): Promise<{ subject: string; html: string; text: string }> {
+    return emailTemplateService.renderEmail(type, variables);
+  }
+
+  async sendMail(options: SendMailOptions): Promise<void> {
+    if (!this.isConfigured || !this.transporter) {
+      console.log(`[Email] Would send to ${options.to}: ${options.subject}`);
+      return;
+    }
+
+    const priority = options.priority || 'normal';
+    const isHigh = priority === 'high';
+    const fromEmail = process.env.FROM_EMAIL || process.env.EMAIL_FROM || 'noreply@polly.example.com';
+
+    const headers: Record<string, string> = {
+      'X-Mailer': 'Polly',
+      'Reply-To': this.getReplyTo(),
+      'Auto-Submitted': 'auto-generated',
+    };
+
+    if (isHigh) {
+      headers['X-Priority'] = '1';
+      headers['X-MSMail-Priority'] = 'High';
+      headers['Importance'] = 'high';
+    }
+
+    if (options.isBulk) {
+      headers['Precedence'] = 'bulk';
+      headers['List-Unsubscribe'] = `<mailto:${fromEmail}?subject=Abbestellen>`;
+      headers['List-Unsubscribe-Post'] = 'List-Unsubscribe=One-Click';
+    }
+
+    const mailOptions: nodemailer.SendMailOptions = {
+      from: this.getFromAddress(options.fromPrefix),
+      to: options.to,
+      subject: options.subject,
+      html: options.html,
+      text: options.text,
+      headers,
+    };
+
+    if (options.attachments) {
+      mailOptions.attachments = options.attachments;
+    }
+
+    await this.transporter.sendMail(mailOptions);
+  }
+
   async sendPollCreationEmails(
     creatorEmail: string,
     pollTitle: string,
     publicLink: string,
     adminLink: string,
-    pollType: 'schedule' | 'survey' | 'organization'
+    pollType: 'schedule' | 'survey' | 'organization',
+    isRegisteredUser: boolean = false
   ): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`Email would be sent to ${creatorEmail} for poll: ${pollTitle}`);
-      console.log(`Public link: ${publicLink}`);
-      console.log(`Admin link: ${adminLink}`);
-      return; // Skip sending email if not configured
-    }
-
     try {
-    const pollTypeText = pollType === 'schedule' ? 'Terminumfrage' : pollType === 'organization' ? 'Orga' : 'Umfrage';
-    
-    // Admin email
-    const adminSubject = `[Polly] Ihre ${pollTypeText} wurde erstellt: ${pollTitle}`;
-    const adminHtml = `
-      <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-        <h2 style="color: #FF6B35;">Ihre ${pollTypeText} wurde erfolgreich erstellt!</h2>
-        
-        <p>Hallo,</p>
-        
-        <p>Ihre ${pollTypeText} "<strong>${pollTitle}</strong>" wurde erfolgreich erstellt.</p>
-        
-        <div style="background-color: #f8f9fa; padding: 20px; border-radius: 8px; margin: 20px 0;">
-          <h3 style="color: #212529; margin-top: 0;">Administratorlink (nur für Sie):</h3>
-          <p>Mit diesem Link können Sie Ihre Umfrage verwalten, bearbeiten und löschen:</p>
-          <a href="${adminLink}" style="background-color: #FF6B35; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">Umfrage verwalten</a>
-        </div>
-        
-        <div style="background-color: #e8f4f8; padding: 20px; border-radius: 8px; margin: 20px 0;">
-          <h3 style="color: #212529; margin-top: 0;">Öffentlicher Link zum Teilen:</h3>
-          <p>Teilen Sie diesen Link mit den Teilnehmern:</p>
-          <a href="${publicLink}" style="background-color: #4A90A4; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">Zur Abstimmung</a>
-        </div>
-        
-        <p><strong>Wichtig:</strong> Bewahren Sie den Administratorlink sicher auf. Nur damit können Sie Ihre Umfrage verwalten.</p>
-        
-        <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-        <p style="color: #6c757d; font-size: 14px;">
-          Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-          Open-Source Abstimmungsplattform für Teams
-        </p>
-      </div>
-    `;
+      const pollTypeText = pollType === 'schedule' ? 'Terminumfrage' : pollType === 'organization' ? 'Orga-Liste' : 'Umfrage';
+
+      const rendered = await this.renderTemplate('poll_created', {
+        pollTitle,
+        pollType: pollTypeText,
+        publicLink: validateEmailUrl(publicLink),
+        adminLink: validateEmailUrl(adminLink),
+        isRegisteredUser: isRegisteredUser ? 'true' : '',
+      });
 
-    await this.transporter.sendMail({
-      from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
-      to: creatorEmail,
-      subject: adminSubject,
-      html: adminHtml,
-      text: adminHtml.replace(/<[^>]*>/g, '').replace(/\s+/g, ' ').trim(),
-      headers: {
-        'X-Mailer': 'Polly System',
-        'X-Priority': '3',
-        'X-MSMail-Priority': 'Normal',
-        'Reply-To': process.env.FROM_EMAIL || 'noreply@polly.example.com',
-      },
-    });
+      await this.sendMail({
+        to: creatorEmail,
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
+      });
     } catch (error) {
       console.error('Failed to send poll creation email:', error);
-      // Don't throw error - just log it so poll creation continues
     }
   }
 
@@ -135,71 +227,31 @@ export class EmailService {
     pollLink: string,
     customMessage?: string
   ): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`Invitation email would be sent to ${inviteeEmail} for poll: ${pollTitle}`);
-      return;
-    }
-
-    try {
-    let qrCodeDataUrl = '';
     try {
-      qrCodeDataUrl = await qrService.generateQRCode(pollLink, 'png');
-    } catch (qrError) {
-      console.error('Failed to generate QR code for email:', qrError);
-    }
-    
-    const subject = `Einladung zur Abstimmung: ${pollTitle}`;
-    const html = `
-      <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-        <h2 style="color: #FF6B35;">Sie wurden zur Abstimmung eingeladen</h2>
-        
-        <p>Hallo,</p>
-        
-        <p><strong>${inviterName}</strong> hat Sie zur Teilnahme an der Umfrage "<strong>${pollTitle}</strong>" eingeladen.</p>
-        
-        ${customMessage ? `
-          <div style="background-color: #f8f9fa; padding: 15px; border-radius: 6px; margin: 20px 0; border-left: 4px solid #FF6B35;">
-            <p style="margin: 0; font-style: italic;">"${customMessage}"</p>
-          </div>
-        ` : ''}
-        
-        <div style="text-align: center; margin: 30px 0;">
-          <a href="${pollLink}" style="background-color: #FF6B35; color: white; padding: 15px 30px; text-decoration: none; border-radius: 6px; display: inline-block; font-weight: bold;">Jetzt abstimmen</a>
-        </div>
-        
-        ${qrCodeDataUrl ? `
-        <div style="text-align: center; margin: 30px 0; padding: 20px; background-color: #f8f9fa; border-radius: 8px;">
-          <p style="margin: 0 0 15px 0; font-weight: bold; color: #495057;">Oder scannen Sie den QR-Code:</p>
-          <img src="${qrCodeDataUrl}" alt="QR-Code zur Umfrage" style="width: 180px; height: 180px; border: 1px solid #dee2e6; border-radius: 4px;" />
-        </div>
-        ` : ''}
-        
-        <div style="background-color: #e8f4f8; padding: 15px; border-radius: 6px; margin: 20px 0;">
-          <p style="margin: 0 0 5px 0; font-weight: bold; color: #495057;">Direkter Link:</p>
-          <p style="word-break: break-all; margin: 0;"><a href="${pollLink}" style="color: #4A90A4;">${pollLink}</a></p>
-        </div>
-        
-        <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-        <p style="color: #6c757d; font-size: 14px;">
-          Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-          Open-Source Abstimmungsplattform für Teams
-        </p>
-      </div>
-    `;
+      const validatedLink = validateEmailUrl(pollLink);
 
-    await this.transporter.sendMail({
-      from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
-      to: inviteeEmail,
-      subject,
-      html,
-      text: `Sie wurden zur Abstimmung "${pollTitle}" eingeladen.\n\nLink: ${pollLink}\n\n${customMessage ? 'Nachricht: ' + customMessage + '\n\n' : ''}Diese E-Mail wurde automatisch von Polly (https://github.com/manfredsteger/polly) erstellt.`,
-      headers: {
-        'X-Mailer': 'Polly System',
-        'X-Priority': '3',
-        'X-MSMail-Priority': 'Normal',
-        'Reply-To': process.env.FROM_EMAIL || 'noreply@polly.example.com',
-      },
-    });
+      let qrCodeDataUrl = '';
+      try {
+        qrCodeDataUrl = await qrService.generateQRCode(validatedLink, 'png');
+      } catch (qrError) {
+        console.error('Failed to generate QR code for email:', qrError);
+      }
+
+      const rendered = await this.renderTemplate('invitation', {
+        pollTitle,
+        inviterName,
+        publicLink: validatedLink,
+        message: customMessage || '',
+        qrCodeUrl: qrCodeDataUrl,
+      });
+
+      await this.sendMail({
+        to: inviteeEmail,
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
+        isBulk: true,
+      });
     } catch (error) {
       console.error('Failed to send invitation email:', error);
     }
@@ -213,67 +265,24 @@ export class EmailService {
     publicLink: string,
     resultsLink: string
   ): Promise<void> {
-    if (!this.isConfigured || !this.transporter || !voterEmail) {
-      console.log(`Voting confirmation email would be sent to ${voterEmail} for poll: ${pollTitle}`);
-      return;
-    }
+    if (!voterEmail) return;
 
     try {
       const pollTypeText = pollType === 'schedule' ? 'Terminumfrage' : 'Umfrage';
-      const confirmationText = pollType === 'schedule' 
-        ? 'Ihre Auswahl wurde erfolgreich gespeichert.' 
-        : 'Ihre Stimme wurde erfolgreich gespeichert.';
-      const subject = `Polly - ${pollTitle}`;
-      const html = `
-        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; color: #333;">
-          <h2 style="color: #FF6B35;">Vielen Dank für Ihre Teilnahme!</h2>
-          
-          <p>Hallo ${voterName},</p>
-          
-          <p>vielen Dank für Ihre Teilnahme an der ${pollTypeText} "<strong>${pollTitle}</strong>".</p>
-          <p>${confirmationText}</p>
-          
-          <div style="background-color: #f8f9fa; padding: 20px; border-radius: 8px; margin: 20px 0;">
-            <h3 style="color: #495057; margin-top: 0;">Ihr persönlicher Link:</h3>
-            <p>Mit diesem Link können Sie jederzeit zur Umfrage zurückkehren:</p>
-            <a href="${publicLink}" style="background-color: #FF6B35; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">Zur Umfrage</a>
-          </div>
-          
-          <div style="background-color: #e8f4f8; padding: 20px; border-radius: 8px; margin: 20px 0;">
-            <h3 style="color: #495057; margin-top: 0;">Ergebnisse ansehen:</h3>
-            <p>Hier können Sie die aktuellen Ergebnisse einsehen:</p>
-            <a href="${resultsLink}" style="background-color: #4A90A4; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">Ergebnisse anzeigen</a>
-          </div>
-          
-          <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-          <p style="color: #6c757d; font-size: 14px;">
-            Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-            Open-Source Abstimmungsplattform für Teams
-          </p>
-        </div>
-      `;
-
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
-        to: voterEmail,
-        subject,
-        html,
-        text: `Hallo ${voterName},
-
-vielen Dank für Ihre Teilnahme an der ${pollTypeText} "${pollTitle}".
-${confirmationText}
 
-IHR PERSÖNLICHER LINK:
-${publicLink}
-
-ERGEBNISSE ANSEHEN:
-${resultsLink}
+      const rendered = await this.renderTemplate('vote_confirmation', {
+        voterName,
+        pollTitle,
+        pollType: pollTypeText,
+        publicLink: validateEmailUrl(publicLink),
+        resultsLink: validateEmailUrl(resultsLink),
+      });
 
-Diese E-Mail wurde automatisch von Polly (https://github.com/manfredsteger/polly) erstellt.
-Open-Source Abstimmungsplattform für Teams`,
-        headers: {
-          'Reply-To': process.env.FROM_EMAIL || 'noreply@polly.example.com',
-        },
+      await this.sendMail({
+        to: voterEmail,
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
       });
     } catch (error) {
       console.error('Failed to send voting confirmation email:', error);
@@ -288,72 +297,34 @@ Open-Source Abstimmungsplattform für Teams`,
     pollLink: string,
     expiresAt?: Date | null
   ): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`Reminder email would be sent to ${recipientEmail} for poll: ${pollTitle}`);
-      return;
-    }
-
     try {
+      const validatedLink = validateEmailUrl(pollLink);
+
       let qrCodeDataUrl = '';
       try {
-        qrCodeDataUrl = await qrService.generateQRCode(pollLink, 'png');
+        qrCodeDataUrl = await qrService.generateQRCode(validatedLink, 'png');
       } catch (qrError) {
         console.error('Failed to generate QR code for reminder email:', qrError);
       }
 
-      const expiryText = expiresAt 
-        ? `<p style="color: #dc3545; font-weight: bold;">⏰ Die Umfrage endet am ${new Date(expiresAt).toLocaleDateString('de-DE', { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric', hour: '2-digit', minute: '2-digit' })} Uhr!</p>`
+      const expiryText = expiresAt
+        ? `Die Umfrage endet am ${new Date(expiresAt).toLocaleDateString('de-DE', { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric', hour: '2-digit', minute: '2-digit' })} Uhr.`
         : '';
 
-      const subject = `Erinnerung: Ihre Teilnahme wird benötigt - ${pollTitle}`;
-      const html = `
-        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2 style="color: #FF6B35;">📣 Erinnerung zur Abstimmung</h2>
-          
-          <p>Hallo,</p>
-          
-          <p><strong>${senderName}</strong> erinnert Sie freundlich an die Teilnahme an der Umfrage "<strong>${pollTitle}</strong>".</p>
-          
-          <p>Ihre Stimme ist wichtig! Bitte nehmen Sie sich kurz Zeit, um abzustimmen.</p>
-          
-          ${expiryText}
-          
-          <div style="text-align: center; margin: 30px 0;">
-            <a href="${pollLink}" style="background-color: #FF6B35; color: white; padding: 15px 30px; text-decoration: none; border-radius: 6px; display: inline-block; font-weight: bold;">Jetzt abstimmen</a>
-          </div>
-          
-          ${qrCodeDataUrl ? `
-          <div style="text-align: center; margin: 30px 0; padding: 20px; background-color: #f8f9fa; border-radius: 8px;">
-            <p style="margin: 0 0 15px 0; font-weight: bold; color: #495057;">Oder scannen Sie den QR-Code:</p>
-            <img src="${qrCodeDataUrl}" alt="QR-Code zur Umfrage" style="width: 150px; height: 150px; border: 1px solid #dee2e6; border-radius: 4px;" />
-          </div>
-          ` : ''}
-          
-          <div style="background-color: #e8f4f8; padding: 15px; border-radius: 6px; margin: 20px 0;">
-            <p style="margin: 0 0 5px 0; font-weight: bold; color: #495057;">Direkter Link:</p>
-            <p style="word-break: break-all; margin: 0;"><a href="${pollLink}" style="color: #4A90A4;">${pollLink}</a></p>
-          </div>
-          
-          <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-          <p style="color: #6c757d; font-size: 14px;">
-            Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-            Open-Source Abstimmungsplattform für Teams
-          </p>
-        </div>
-      `;
+      const rendered = await this.renderTemplate('reminder', {
+        senderName,
+        pollTitle,
+        pollLink: validatedLink,
+        expiresAt: expiryText,
+        qrCodeUrl: qrCodeDataUrl,
+      });
 
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+      await this.sendMail({
         to: recipientEmail,
-        subject,
-        html,
-        text: `Erinnerung: Ihre Teilnahme wird benötigt\n\n${senderName} erinnert Sie an die Umfrage "${pollTitle}".\n\n${expiresAt ? 'Die Umfrage endet am ' + new Date(expiresAt).toLocaleDateString('de-DE') + '!\n\n' : ''}Link: ${pollLink}\n\nDiese E-Mail wurde automatisch von Polly (https://github.com/manfredsteger/polly) erstellt.`,
-        headers: {
-          'X-Mailer': 'Polly System',
-          'X-Priority': '3',
-          'X-MSMail-Priority': 'Normal',
-          'Reply-To': process.env.FROM_EMAIL || 'noreply@polly.example.com',
-        },
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
+        isBulk: true,
       });
     } catch (error) {
       console.error('Failed to send reminder email:', error);
@@ -361,67 +332,18 @@ Open-Source Abstimmungsplattform für Teams`,
     }
   }
 
-  async testConnection(): Promise<boolean> {
-    if (!this.isConfigured || !this.transporter) {
-      return false;
-    }
-    
-    try {
-      await this.transporter.verify();
-      return true;
-    } catch (error) {
-      console.error('Email service connection failed:', error);
-      return false;
-    }
-  }
-
   async sendPasswordResetEmail(email: string, resetLink: string, userName?: string): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`[Email] Password reset would be sent to ${email}`);
-      console.log(`[Email] Reset link: ${resetLink}`);
-      return;
-    }
-
-    const displayName = userName || '';
-    const greeting = displayName ? `Hallo ${displayName},` : 'Hallo,';
-
     try {
-      const subject = '[Polly] Passwort zurücksetzen';
-      const html = `
-        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2 style="color: #FF6B35;">Passwort zurücksetzen</h2>
-          
-          <p>${greeting}</p>
-          
-          <p>Sie haben angefordert, Ihr Passwort für Ihren <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> Account zurückzusetzen.</p>
-          
-          <div style="background-color: #f8f9fa; padding: 20px; border-radius: 8px; margin: 20px 0;">
-            <p>Klicken Sie auf den folgenden Button, um ein neues Passwort zu vergeben:</p>
-            <a href="${resetLink}" style="background-color: #FF6B35; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">Passwort zurücksetzen</a>
-          </div>
-          
-          <p><strong>Dieser Link ist 1 Stunde gültig.</strong></p>
-          
-          <p style="color: #6c757d;">Falls Sie diese Anfrage nicht gestellt haben, können Sie diese E-Mail ignorieren. Ihr Passwort bleibt unverändert.</p>
-          
-          <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-          <p style="color: #6c757d; font-size: 14px;">
-            Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-            Open-Source Abstimmungsplattform für Teams
-          </p>
-        </div>
-      `;
+      const rendered = await this.renderTemplate('password_reset', {
+        userName: userName || '',
+        resetLink: validateEmailUrl(resetLink),
+      });
 
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+      await this.sendMail({
         to: email,
-        subject,
-        html,
-        text: `Passwort zurücksetzen\n\n${greeting}\n\nSie haben angefordert, Ihr Passwort zurückzusetzen.\n\nKlicken Sie auf den folgenden Link:\n${resetLink}\n\nDieser Link ist 1 Stunde gültig.\n\nFalls Sie diese Anfrage nicht gestellt haben, können Sie diese E-Mail ignorieren.`,
-        headers: {
-          'X-Mailer': 'Polly System',
-          'X-Priority': '3',
-        },
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
       });
     } catch (error) {
       console.error('Failed to send password reset email:', error);
@@ -430,52 +352,18 @@ Open-Source Abstimmungsplattform für Teams`,
   }
 
   async sendEmailChangeConfirmation(oldEmail: string, newEmail: string, confirmLink: string): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`[Email] Email change confirmation would be sent to ${newEmail}`);
-      console.log(`[Email] Confirm link: ${confirmLink}`);
-      return;
-    }
-
     try {
-      const subject = '[Polly] E-Mail-Adresse bestätigen';
-      const html = `
-        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2 style="color: #FF6B35;">E-Mail-Adresse bestätigen</h2>
-          
-          <p>Hallo,</p>
-          
-          <p>Sie haben angefordert, Ihre E-Mail-Adresse für Ihren <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> Account zu ändern.</p>
-          
-          <p><strong>Alte E-Mail:</strong> ${oldEmail}<br>
-          <strong>Neue E-Mail:</strong> ${newEmail}</p>
-          
-          <div style="background-color: #f8f9fa; padding: 20px; border-radius: 8px; margin: 20px 0;">
-            <p>Klicken Sie auf den folgenden Button, um Ihre neue E-Mail-Adresse zu bestätigen:</p>
-            <a href="${confirmLink}" style="background-color: #FF6B35; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">E-Mail bestätigen</a>
-          </div>
-          
-          <p><strong>Dieser Link ist 24 Stunden gültig.</strong></p>
-          
-          <p style="color: #6c757d;">Falls Sie diese Anfrage nicht gestellt haben, können Sie diese E-Mail ignorieren. Ihre E-Mail-Adresse bleibt unverändert.</p>
-          
-          <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-          <p style="color: #6c757d; font-size: 14px;">
-            Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-            Open-Source Abstimmungsplattform für Teams
-          </p>
-        </div>
-      `;
+      const rendered = await this.renderTemplate('email_change', {
+        oldEmail,
+        newEmail,
+        confirmLink: validateEmailUrl(confirmLink),
+      });
 
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+      await this.sendMail({
         to: newEmail,
-        subject,
-        html,
-        text: `E-Mail-Adresse bestätigen\n\nSie haben angefordert, Ihre E-Mail-Adresse zu ändern.\n\nAlte E-Mail: ${oldEmail}\nNeue E-Mail: ${newEmail}\n\nKlicken Sie auf den folgenden Link:\n${confirmLink}\n\nDieser Link ist 24 Stunden gültig.\n\nFalls Sie diese Anfrage nicht gestellt haben, können Sie diese E-Mail ignorieren.`,
-        headers: {
-          'X-Mailer': 'Polly System',
-          'X-Priority': '3',
-        },
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
       });
     } catch (error) {
       console.error('Failed to send email change confirmation:', error);
@@ -483,45 +371,21 @@ Open-Source Abstimmungsplattform für Teams`,
     }
   }
 
-  async sendPasswordChangedNotification(email: string): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`[Email] Password changed notification would be sent to ${email}`);
-      return;
-    }
-
+  async sendPasswordChangedEmail(email: string, userName?: string): Promise<void> {
     try {
-      const subject = '[Polly] Ihr Passwort wurde geändert';
-      const html = `
-        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2 style="color: #FF6B35;">Passwort wurde geändert</h2>
-          
-          <p>Hallo,</p>
-          
-          <p>Ihr Passwort für Ihren <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> Account wurde erfolgreich geändert.</p>
-          
-          <p style="color: #6c757d;">Falls Sie diese Änderung nicht vorgenommen haben, kontaktieren Sie bitte umgehend den Support.</p>
-          
-          <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-          <p style="color: #6c757d; font-size: 14px;">
-            Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-            Open-Source Abstimmungsplattform für Teams
-          </p>
-        </div>
-      `;
+      const rendered = await this.renderTemplate('password_changed', {
+        userName: userName || '',
+      });
 
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+      await this.sendMail({
         to: email,
-        subject,
-        html,
-        text: `Passwort wurde geändert\n\nIhr Passwort für Ihren Polly (https://github.com/manfredsteger/polly) Account wurde erfolgreich geändert.\n\nFalls Sie diese Änderung nicht vorgenommen haben, kontaktieren Sie bitte umgehend den Support.`,
-        headers: {
-          'X-Mailer': 'Polly System',
-          'X-Priority': '3',
-        },
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
       });
+      console.log(`[Email] Password changed notification sent to ${email}`);
     } catch (error) {
-      console.error('Failed to send password changed notification:', error);
+      console.error(`[Password Changed] Failed to send notification to ${email}:`, error);
     }
   }
 
@@ -541,18 +405,11 @@ Open-Source Abstimmungsplattform für Teams`,
     },
     pdfBuffer?: Buffer
   ): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`[Email] Test report would be sent to ${recipientEmail}`);
-      console.log(`[Email] Test run #${testRun.id}: ${testRun.passed}/${testRun.totalTests} passed`);
-      return;
-    }
-
     try {
       const isSuccess = testRun.status === 'completed' && testRun.failed === 0;
       const statusEmoji = isSuccess ? '✅' : '❌';
       const statusText = isSuccess ? 'Alle Tests bestanden' : `${testRun.failed} Test(s) fehlgeschlagen`;
-      const statusColor = isSuccess ? '#28a745' : '#dc3545';
-      
+
       const durationText = testRun.duration 
         ? `${Math.round(testRun.duration / 1000)} Sekunden`
         : 'Unbekannt';
@@ -565,109 +422,29 @@ Open-Source Abstimmungsplattform für Teams`,
         minute: '2-digit',
       });
 
-      const subject = `${statusEmoji} [Polly] Testbericht #${testRun.id}: ${statusText}`;
-      const html = `
-        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2 style="color: ${statusColor};">${statusEmoji} Automatischer Testbericht</h2>
-          
-          <p>Hallo,</p>
-          
-          <p>Der automatische Testlauf <strong>#${testRun.id}</strong> wurde abgeschlossen.</p>
-          
-          <div style="background-color: ${isSuccess ? '#d4edda' : '#f8d7da'}; padding: 20px; border-radius: 8px; margin: 20px 0; border-left: 4px solid ${statusColor};">
-            <h3 style="color: ${statusColor}; margin-top: 0;">${statusText}</h3>
-            <table style="width: 100%; border-collapse: collapse;">
-              <tr>
-                <td style="padding: 5px 10px 5px 0; color: #495057;">Gesamte Tests:</td>
-                <td style="padding: 5px 0; font-weight: bold;">${testRun.totalTests}</td>
-              </tr>
-              <tr>
-                <td style="padding: 5px 10px 5px 0; color: #495057;">Bestanden:</td>
-                <td style="padding: 5px 0; font-weight: bold; color: #28a745;">${testRun.passed}</td>
-              </tr>
-              <tr>
-                <td style="padding: 5px 10px 5px 0; color: #495057;">Fehlgeschlagen:</td>
-                <td style="padding: 5px 0; font-weight: bold; color: ${testRun.failed > 0 ? '#dc3545' : '#495057'};">${testRun.failed}</td>
-              </tr>
-              <tr>
-                <td style="padding: 5px 10px 5px 0; color: #495057;">Übersprungen:</td>
-                <td style="padding: 5px 0; font-weight: bold; color: #ffc107;">${testRun.skipped}</td>
-              </tr>
-              <tr>
-                <td style="padding: 5px 10px 5px 0; color: #495057;">Dauer:</td>
-                <td style="padding: 5px 0;">${durationText}</td>
-              </tr>
-              <tr>
-                <td style="padding: 5px 10px 5px 0; color: #495057;">Gestartet:</td>
-                <td style="padding: 5px 0;">${startedAtText}</td>
-              </tr>
-              <tr>
-                <td style="padding: 5px 10px 5px 0; color: #495057;">Ausgelöst durch:</td>
-                <td style="padding: 5px 0;">${testRun.triggeredBy === 'scheduled' ? 'Zeitplan' : 'Manuell'}</td>
-              </tr>
-            </table>
-          </div>
-          
-          ${pdfBuffer ? `
-          <p style="background-color: #e8f4f8; padding: 15px; border-radius: 6px;">
-            📎 Der vollständige Testbericht ist als PDF angehängt.
-          </p>
-          ` : ''}
-          
-          ${testRun.failed > 0 ? `
-          <div style="background-color: #fff3cd; padding: 15px; border-radius: 6px; margin: 20px 0;">
-            <p style="margin: 0; color: #856404;">
-              <strong>⚠️ Achtung:</strong> Es sind Tests fehlgeschlagen. 
-              Bitte überprüfen Sie die Details im Admin-Dashboard oder im angehängten PDF-Bericht.
-            </p>
-          </div>
-          ` : ''}
-          
-          <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-          <p style="color: #6c757d; font-size: 14px;">
-            Diese E-Mail wurde automatisch vom Polly Testsystem erstellt.<br>
-            Open-Source Abstimmungsplattform für Teams
-          </p>
-        </div>
-      `;
-
-      const textContent = `Automatischer Testbericht #${testRun.id}
-
-Status: ${statusText}
-Gesamte Tests: ${testRun.totalTests}
-Bestanden: ${testRun.passed}
-Fehlgeschlagen: ${testRun.failed}
-Übersprungen: ${testRun.skipped}
-Dauer: ${durationText}
-Gestartet: ${startedAtText}
-Ausgelöst durch: ${testRun.triggeredBy === 'scheduled' ? 'Zeitplan' : 'Manuell'}
-
-${pdfBuffer ? 'Der vollständige Testbericht ist als PDF angehängt.' : ''}
+      const rendered = await this.renderTemplate('test_report', {
+        testRunId: String(testRun.id),
+        status: `${statusEmoji} ${statusText}`,
+        totalTests: String(testRun.totalTests),
+        passed: String(testRun.passed),
+        failed: String(testRun.failed),
+        skipped: String(testRun.skipped),
+        duration: durationText,
+        startedAt: startedAtText,
+      });
 
-Diese E-Mail wurde automatisch vom Polly Testsystem erstellt.`;
+      const attachments: nodemailer.SendMailOptions['attachments'] = pdfBuffer
+        ? [{ filename: `testbericht-${testRun.id}.pdf`, content: pdfBuffer, contentType: 'application/pdf' }]
+        : undefined;
 
-      const mailOptions: nodemailer.SendMailOptions = {
-        from: `"Polly Tests" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+      await this.sendMail({
         to: recipientEmail,
-        subject,
-        html,
-        text: textContent,
-        headers: {
-          'X-Mailer': 'Polly Test System',
-          'X-Priority': testRun.failed > 0 ? '1' : '3',
-          'X-MSMail-Priority': testRun.failed > 0 ? 'High' : 'Normal',
-        },
-      };
-
-      if (pdfBuffer) {
-        mailOptions.attachments = [{
-          filename: `testbericht-${testRun.id}-${new Date().toISOString().split('T')[0]}.pdf`,
-          content: pdfBuffer,
-          contentType: 'application/pdf',
-        }];
-      }
-
-      await this.transporter.sendMail(mailOptions);
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
+        priority: isSuccess ? 'normal' : 'high',
+        attachments,
+      });
       console.log(`[Email] Test report sent to ${recipientEmail} for run #${testRun.id}`);
     } catch (error) {
       console.error('Failed to send test report email:', error);
@@ -675,36 +452,165 @@ Diese E-Mail wurde automatisch vom Polly Testsystem erstellt.`;
     }
   }
 
-  async sendCustomEmail(
+  async sendPreRenderedEmail(
     recipientEmail: string,
     subject: string,
     html: string,
     text: string
   ): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`[Email] Custom email would be sent to ${recipientEmail}`);
-      console.log(`[Email] Subject: ${subject}`);
-      return;
-    }
-
     try {
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+      await this.sendMail({
         to: recipientEmail,
         subject,
         html,
         text,
-        headers: {
-          'X-Mailer': 'Polly System',
-        },
       });
-      console.log(`[Email] Custom email sent to ${recipientEmail}`);
+      console.log(`[Email] Pre-rendered email sent to ${recipientEmail}`);
     } catch (error) {
-      console.error('Failed to send custom email:', error);
+      console.error('Failed to send pre-rendered email:', error);
       throw error;
     }
   }
 
+  async sendFinalizationEmails(
+    participantEmails: string[],
+    pollTitle: string,
+    confirmedDate: string,
+    confirmedTime: string,
+    pollLink: string,
+    icsBuffer: Buffer,
+    videoConferenceUrl?: string | null
+  ): Promise<{ sent: number; failed: number }> {
+    if (participantEmails.length === 0) {
+      console.log('[Email] No participant emails for finalization notification');
+      return { sent: 0, failed: 0 };
+    }
+
+    const escapeHtml = (s: string) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+    const videoConfHtml = videoConferenceUrl
+      ? `<strong>Videokonferenz:</strong> <a href="${escapeHtml(videoConferenceUrl)}" style="color:#7A3800;text-decoration:underline;">${escapeHtml(videoConferenceUrl)}</a>`
+      : '';
+
+    const rendered = await this.renderTemplate('poll_finalized', {
+      pollType: 'schedule',
+      statusLabel: 'Termin bestätigt',
+      pollTitle,
+      confirmedDate,
+      confirmedTime: confirmedTime ? `<strong>Uhrzeit:</strong> ${confirmedTime}` : '',
+      pollLink,
+      buttonLink: pollLink,
+      buttonLabel: 'Zur Umfrage \u2192',
+      videoConferenceUrl: videoConferenceUrl || '',
+      videoConferenceHtml: videoConfHtml,
+      resultsPublic: 'true',
+    });
+
+    const attachments: nodemailer.SendMailOptions['attachments'] = [
+      {
+        filename: 'termin.ics',
+        content: icsBuffer,
+        contentType: 'text/calendar; method=PUBLISH',
+      },
+    ];
+
+    let sent = 0;
+    let failed = 0;
+
+    for (const email of participantEmails) {
+      try {
+        await this.sendMail({
+          to: email,
+          subject: rendered.subject,
+          html: rendered.html,
+          text: rendered.text,
+          attachments,
+          isBulk: true,
+        });
+        sent++;
+        console.log(`[Email] Finalization notification sent to ${email}`);
+      } catch (error) {
+        failed++;
+        console.error(`[Email] Failed to send finalization notification to ${email}:`, error);
+      }
+    }
+
+    console.log(`[Email] Finalization notifications: ${sent} sent, ${failed} failed`);
+    return { sent, failed };
+  }
+
+  async sendPollEndedEmails(
+    recipientEmails: string[],
+    pollTitle: string,
+    pollLink: string,
+    resultsPublic: boolean,
+    pollType: 'survey' | 'organization' = 'survey',
+    finalOptionText?: string,
+    slotSummary?: Array<{ text: string; filled: number; total: number | null }>
+  ): Promise<{ sent: number; failed: number }> {
+    if (recipientEmails.length === 0) {
+      console.log('[Email] No recipient emails for poll-ended notification');
+      return { sent: 0, failed: 0 };
+    }
+
+    const buttonLabel = resultsPublic ? 'Ergebnisse anzeigen \u2192' : 'Zur Umfrage \u2192';
+    const buttonLink = resultsPublic ? `${pollLink}#results` : pollLink;
+
+    // Build slot summary HTML for orga polls
+    let slotSummaryHtml = '';
+    if (slotSummary && slotSummary.length > 0) {
+      const MAX_SLOTS = 5;
+      const displayed = slotSummary.slice(0, MAX_SLOTS);
+      const remaining = slotSummary.length - displayed.length;
+      const rows = displayed.map((s) => {
+        const capacityStr = s.total !== null ? ` / ${s.total}` : '';
+        return `<li style="margin:2px 0;">${escapeHtml(s.text)}: <strong>${s.filled}${capacityStr}</strong> belegt</li>`;
+      });
+      if (remaining > 0) {
+        rows.push(`<li style="margin:2px 0; color:#666;">… und ${remaining} weitere</li>`);
+      }
+      slotSummaryHtml = `<ul style="margin:8px 0 0 0; padding-left:18px;">${rows.join('')}</ul>`;
+    }
+
+    const rendered = await this.renderTemplate('poll_finalized', {
+      pollType,
+      statusLabel: 'Umfrage beendet',
+      pollTitle,
+      pollLink,
+      buttonLink,
+      buttonLabel,
+      resultsPublic: String(resultsPublic),
+      confirmedDate: '',
+      confirmedTime: '',
+      videoConferenceUrl: '',
+      videoConferenceHtml: '',
+      finalOptionText: finalOptionText ? escapeHtml(finalOptionText) : '',
+      slotSummaryHtml,
+    });
+
+    let sent = 0;
+    let failed = 0;
+
+    for (const email of recipientEmails) {
+      try {
+        await this.sendMail({
+          to: email,
+          subject: rendered.subject,
+          html: rendered.html,
+          text: rendered.text,
+          isBulk: true,
+        });
+        sent++;
+        console.log(`[Email] Poll-ended notification sent to ${email}`);
+      } catch (error) {
+        failed++;
+        console.error(`[Email] Failed to send poll-ended notification to ${email}:`, error);
+      }
+    }
+
+    console.log(`[Email] Poll-ended notifications: ${sent} sent, ${failed} failed`);
+    return { sent, failed };
+  }
+
   async sendVirusDetectionAlert(
     adminEmails: string[],
     details: {
@@ -716,12 +622,6 @@ Diese E-Mail wurde automatisch vom Polly Testsystem erstellt.`;
       scannedAt: Date;
     }
   ): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`[Email] Virus detection alert would be sent to ${adminEmails.join(', ')}`);
-      console.log(`[Email] Virus detected: ${details.virusName} in ${details.filename}`);
-      return;
-    }
-
     if (adminEmails.length === 0) {
       console.log('[Email] No admin emails configured for virus alerts');
       return;
@@ -733,26 +633,26 @@ Diese E-Mail wurde automatisch vom Polly Testsystem erstellt.`;
         ? `${(details.fileSize / 1024).toFixed(2)} KB`
         : `${(details.fileSize / 1024 / 1024).toFixed(2)} MB`;
 
-    const subject = `[Polly Security Alert] Virus erkannt: ${details.virusName}`;
-    const html = `
-      <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
+    const subject = `[Polly Security Alert] Virus erkannt: ${escapeHtml(details.virusName)}`;
+    const bodyHtml = `
+      <div style="padding: 16px 24px;">
         <div style="background-color: #dc3545; color: white; padding: 20px; border-radius: 8px 8px 0 0;">
-          <h2 style="margin: 0; font-size: 24px;">⚠️ Sicherheitswarnung: Virus erkannt</h2>
+          <h2 class="email-heading" style="margin: 0; font-size: 24px; color: white;">⚠️ Sicherheitswarnung: Virus erkannt</h2>
         </div>
         
         <div style="background-color: #fff5f5; border: 1px solid #dc3545; border-top: none; padding: 20px; border-radius: 0 0 8px 8px;">
-          <p style="font-size: 16px; margin-bottom: 20px;">
+          <p class="email-text" style="font-size: 16px; margin-bottom: 20px;">
             ClamAV hat einen Virus in einer hochgeladenen Datei erkannt. <strong>Die Datei wurde automatisch blockiert und nicht gespeichert.</strong>
           </p>
           
           <table style="width: 100%; border-collapse: collapse;">
             <tr style="border-bottom: 1px solid #f5c6cb;">
               <td style="padding: 10px 0; font-weight: bold; color: #721c24; width: 140px;">Erkannter Virus:</td>
-              <td style="padding: 10px 0; color: #dc3545; font-weight: bold;">${details.virusName}</td>
+              <td style="padding: 10px 0; color: #dc3545; font-weight: bold;">${escapeHtml(details.virusName)}</td>
             </tr>
             <tr style="border-bottom: 1px solid #f5c6cb;">
               <td style="padding: 10px 0; font-weight: bold; color: #721c24;">Dateiname:</td>
-              <td style="padding: 10px 0;">${details.filename}</td>
+              <td style="padding: 10px 0;">${escapeHtml(details.filename)}</td>
             </tr>
             <tr style="border-bottom: 1px solid #f5c6cb;">
               <td style="padding: 10px 0; font-weight: bold; color: #721c24;">Dateigröße:</td>
@@ -760,7 +660,7 @@ Diese E-Mail wurde automatisch vom Polly Testsystem erstellt.`;
             </tr>
             <tr style="border-bottom: 1px solid #f5c6cb;">
               <td style="padding: 10px 0; font-weight: bold; color: #721c24;">Uploader:</td>
-              <td style="padding: 10px 0;">${details.uploaderEmail || 'Anonym / Unbekannt'}</td>
+              <td style="padding: 10px 0;">${details.uploaderEmail ? escapeHtml(details.uploaderEmail) : 'Anonym / Unbekannt'}</td>
             </tr>
             <tr style="border-bottom: 1px solid #f5c6cb;">
               <td style="padding: 10px 0; font-weight: bold; color: #721c24;">IP-Adresse:</td>
@@ -777,50 +677,23 @@ Diese E-Mail wurde automatisch vom Polly Testsystem erstellt.`;
               <strong>✓ Automatische Maßnahme:</strong> Die infizierte Datei wurde abgelehnt und nicht im System gespeichert.
             </p>
           </div>
-          
-          <p style="margin-top: 20px; font-size: 14px; color: #6c757d;">
-            Diese Benachrichtigung können Sie im Admin-Panel unter Sicherheit → ClamAV → Scan-Protokoll einsehen.
-          </p>
         </div>
-        
-        <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-        <p style="color: #6c757d; font-size: 12px; text-align: center;">
-          Automatische Sicherheitsbenachrichtigung von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a><br>
-          Open-Source Abstimmungsplattform für Teams
-        </p>
       </div>
     `;
 
-    const text = `
-POLLY SECURITY ALERT - Virus erkannt!
-
-ClamAV hat einen Virus in einer hochgeladenen Datei erkannt.
-Die Datei wurde automatisch blockiert und nicht gespeichert.
-
-Erkannter Virus: ${details.virusName}
-Dateiname: ${details.filename}
-Dateigröße: ${fileSizeFormatted}
-Uploader: ${details.uploaderEmail || 'Anonym / Unbekannt'}
-IP-Adresse: ${details.requestIp || 'Nicht verfügbar'}
-Zeitpunkt: ${details.scannedAt.toLocaleString('de-DE')}
-
-Die infizierte Datei wurde abgelehnt und nicht im System gespeichert.
-    `.trim();
+    const plainText = `POLLY SECURITY ALERT - Virus erkannt!\n\nClamAV hat einen Virus in einer hochgeladenen Datei erkannt.\nDie Datei wurde automatisch blockiert und nicht gespeichert.\n\nErkannter Virus: ${details.virusName}\nDateiname: ${details.filename}\nDateigröße: ${fileSizeFormatted}\nUploader: ${details.uploaderEmail || 'Anonym / Unbekannt'}\nIP-Adresse: ${details.requestIp || 'Nicht verfügbar'}\nZeitpunkt: ${details.scannedAt.toLocaleString('de-DE')}\n\nDie infizierte Datei wurde abgelehnt und nicht im System gespeichert.`;
 
     try {
+      const rendered = await emailTemplateService.wrapWithEmailTheme(subject, bodyHtml, plainText);
+
       for (const adminEmail of adminEmails) {
-        await this.transporter.sendMail({
-          from: `"Polly Security" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+        await this.sendMail({
           to: adminEmail,
-          subject,
-          html,
-          text,
-          headers: {
-            'X-Mailer': 'Polly System',
-            'X-Priority': '1',
-            'X-MSMail-Priority': 'High',
-            'Importance': 'high',
-          },
+          subject: rendered.subject,
+          html: rendered.html,
+          text: rendered.text,
+          priority: 'high',
+          fromPrefix: 'Security',
         });
         console.log(`[Email] Virus detection alert sent to ${adminEmail}`);
       }
@@ -829,107 +702,84 @@ Die infizierte Datei wurde abgelehnt und nicht im System gespeichert.
     }
   }
 
-  async sendPasswordChangedEmail(email: string, userName?: string): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.warn(`[Email] Cannot send password changed email - SMTP not configured`);
-      return;
-    }
-
-    const displayName = userName || '';
-    const greeting = displayName ? `Hallo ${displayName},` : 'Hallo,';
-
+  async sendWelcomeEmail(email: string, userName: string, verificationLink: string): Promise<void> {
     try {
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
+      const rendered = await this.renderTemplate('welcome', {
+        userName,
+        userEmail: email,
+        verificationLink: validateEmailUrl(verificationLink),
+      });
+
+      await this.sendMail({
         to: email,
-        subject: '[Polly] Ihr Passwort wurde geändert',
-        text: `${greeting}\n\nIhr Passwort für Ihren Polly (https://github.com/manfredsteger/polly) Account wurde erfolgreich geändert.\n\nFalls Sie diese Änderung nicht vorgenommen haben, kontaktieren Sie bitte umgehend den Administrator.`,
-        html: `
-          <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-            <h2 style="color: #FF6B35;">Passwort erfolgreich geändert</h2>
-            
-            <p>${greeting}</p>
-            
-            <p>Ihr Passwort für Ihren <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> Account wurde erfolgreich geändert.</p>
-            
-            <p style="color: #dc3545; font-weight: bold;">Falls Sie diese Änderung nicht vorgenommen haben, kontaktieren Sie bitte umgehend den Administrator.</p>
-            
-            <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-            <p style="color: #6c757d; font-size: 14px;">
-              Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-              Open-Source Abstimmungsplattform für Teams
-            </p>
-          </div>
-        `,
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
       });
-      console.log(`[Email] Password changed notification sent to ${email}`);
+      console.log(`[Email] Welcome email sent to ${email}`);
     } catch (error) {
-      console.error('Failed to send password changed email:', error);
+      console.error('Failed to send welcome email:', error);
       throw error;
     }
   }
 
-  async sendWelcomeEmail(email: string, userName: string, verificationLink: string): Promise<void> {
-    if (!this.isConfigured || !this.transporter) {
-      console.log(`[Email] Welcome email would be sent to ${email}`);
-      console.log(`[Email] Verification link: ${verificationLink}`);
-      return;
-    }
-
+  async sendDeletionRequestNotification(adminEmails: string[], userName: string, userEmail: string, adminPanelUrl: string): Promise<void> {
     try {
-      const subject = '[Polly] Willkommen bei Polly!';
-      const html = `
-        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2 style="color: #FF6B35;">Willkommen bei <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a>!</h2>
-          
-          <p>Hallo ${userName},</p>
-          
-          <p>vielen Dank für Ihre Registrierung bei <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a>!</p>
-          
-          <p>Ihr Account wurde erfolgreich erstellt. Bitte bestätigen Sie Ihre E-Mail-Adresse, indem Sie auf den folgenden Button klicken:</p>
-          
-          <div style="background-color: #f8f9fa; padding: 20px; border-radius: 8px; margin: 20px 0; text-align: center;">
-            <a href="${verificationLink}" style="background-color: #FF6B35; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">E-Mail bestätigen</a>
-          </div>
-          
-          <p><strong>Dieser Link ist 24 Stunden gültig.</strong></p>
-          
-          <p>Nach der Bestätigung können Sie alle Funktionen von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> nutzen.</p>
-          
-          <hr style="margin: 30px 0; border: none; border-top: 1px solid #e9ecef;">
-          <p style="color: #6c757d; font-size: 14px;">
-            Diese E-Mail wurde automatisch von <a href="https://github.com/manfredsteger/polly" style="color: #FF6B35; text-decoration: none;">Polly</a> erstellt.<br>
-            Open-Source Abstimmungsplattform für Teams
+      const requestDate = new Date().toLocaleString('de-DE', { dateStyle: 'medium', timeStyle: 'short' });
+      const subject = '[Polly] Neuer Löschantrag eingegangen';
+      const validatedUrl = validateEmailUrl(adminPanelUrl);
+      const bodyHtml = `
+        <div style="padding: 16px 24px;">
+          <h2 class="email-heading" style="margin: 0 0 16px 0;">Neuer Löschantrag</h2>
+          <p class="email-text" style="margin-bottom: 16px;">
+            Ein Benutzer hat die Löschung seines Kontos beantragt:
+          </p>
+          <table style="width: 100%; border-collapse: collapse;">
+            <tr style="border-bottom: 1px solid #e5e7eb;">
+              <td style="padding: 8px 0; font-weight: bold; width: 120px;">Benutzer:</td>
+              <td style="padding: 8px 0;">${escapeHtml(userName)}</td>
+            </tr>
+            <tr style="border-bottom: 1px solid #e5e7eb;">
+              <td style="padding: 8px 0; font-weight: bold;">E-Mail:</td>
+              <td style="padding: 8px 0;">${escapeHtml(userEmail)}</td>
+            </tr>
+            <tr>
+              <td style="padding: 8px 0; font-weight: bold;">Datum:</td>
+              <td style="padding: 8px 0;">${requestDate}</td>
+            </tr>
+          </table>
+          <p class="email-text" style="margin-top: 16px;">
+            <a href="${escapeHtml(validatedUrl)}" style="display: inline-block; padding: 10px 20px; background-color: #dc3545; color: white; text-decoration: none; border-radius: 6px;">Löschanträge verwalten</a>
           </p>
         </div>
       `;
 
-      await this.transporter.sendMail({
-        from: `"Polly" <${process.env.FROM_EMAIL || 'noreply@polly.example.com'}>`,
-        to: email,
-        subject,
-        html,
-        text: `Willkommen bei Polly (https://github.com/manfredsteger/polly)!\n\nHallo ${userName},\n\nvielen Dank für Ihre Registrierung bei Polly!\n\nIhr Account wurde erfolgreich erstellt. Bitte bestätigen Sie Ihre E-Mail-Adresse:\n${verificationLink}\n\nDieser Link ist 24 Stunden gültig.\n\nNach der Bestätigung können Sie alle Funktionen von Polly nutzen.`,
-        headers: {
-          'X-Mailer': 'Polly System',
-          'X-Priority': '3',
-        },
-      });
-      console.log(`[Email] Welcome email sent to ${email}`);
+      const plainText = `Neuer Löschantrag\n\nEin Benutzer hat die Löschung seines Kontos beantragt:\n\nBenutzer: ${userName}\nE-Mail: ${userEmail}\nDatum: ${requestDate}\n\nLöschanträge verwalten: ${validatedUrl}`;
+
+      const rendered = await emailTemplateService.wrapWithEmailTheme(subject, bodyHtml, plainText);
+
+      for (const adminEmail of adminEmails) {
+        await this.sendMail({
+          to: adminEmail,
+          subject: rendered.subject,
+          html: rendered.html,
+          text: rendered.text,
+          priority: 'high',
+        });
+        console.log(`[Email] Deletion request notification sent to ${adminEmail}`);
+      }
     } catch (error) {
-      console.error('Failed to send welcome email:', error);
-      throw error;
+      console.error('Failed to send deletion request notification:', error);
     }
   }
 
   async sendBulkInvitations(emails: string[], pollTitle: string, senderName: string, pollUrl: string, customMessage?: string): Promise<{ sent: number; failed: string[]; smtpConfigured: boolean }> {
-    const failed: string[] = [];
-    let sent = 0;
-
     if (!this.isConfigured || !this.transporter) {
-      console.warn('[Email] SMTP not configured - invitations cannot be sent');
       return { sent: 0, failed: emails, smtpConfigured: false };
     }
+    
+    const failed: string[] = [];
+    let sent = 0;
 
     for (const email of emails) {
       try {
diff --git a/server/services/emailTemplateService.ts b/server/services/emailTemplateService.ts
index 2d4b5acb..f0765b5a 100644
--- a/server/services/emailTemplateService.ts
+++ b/server/services/emailTemplateService.ts
@@ -8,15 +8,21 @@ import {
 
 // Email theme settings that can be imported from emailbuilder.js
 export interface EmailTheme {
-  backdropColor: string;      // Background color behind the email
-  canvasColor: string;        // Email content box background
-  textColor: string;          // Body text color
-  headingColor: string;       // Heading color
-  linkColor: string;          // Link color
+  backdropColor: string;
+  canvasColor: string;
+  textColor: string;
+  headingColor: string;
+  linkColor: string;
   buttonBackgroundColor: string;
   buttonTextColor: string;
   buttonBorderRadius: number;
   fontFamily: string;
+  secondaryButtonBackgroundColor: string;
+  secondaryButtonTextColor: string;
+  darkBackdropColor: string;
+  darkCanvasColor: string;
+  darkTextColor: string;
+  darkHeadingColor: string;
 }
 
 // Default email theme
@@ -29,7 +35,13 @@ const DEFAULT_EMAIL_THEME: EmailTheme = {
   buttonBackgroundColor: '#FF6B35',
   buttonTextColor: '#FFFFFF',
   buttonBorderRadius: 6,
-  fontFamily: 'Arial, sans-serif'
+  fontFamily: 'Arial, sans-serif',
+  secondaryButtonBackgroundColor: '#4A90A4',
+  secondaryButtonTextColor: '#FFFFFF',
+  darkBackdropColor: '#1a1a2e',
+  darkCanvasColor: '#16213e',
+  darkTextColor: '#e0e0e0',
+  darkHeadingColor: '#FF8C5A',
 };
 
 // Validate and sanitize CSS color values (hex, rgb, rgba, named colors)
@@ -85,6 +97,146 @@ function sanitizeBorderRadius(value: unknown): number | null {
   return null;
 }
 
+function lightenColorByPercent(hex: string, percent: number): string {
+  const num = parseInt(hex.replace('#', ''), 16);
+  const r = Math.min(255, ((num >> 16) & 0xFF) + Math.round(255 * percent / 100));
+  const g = Math.min(255, ((num >> 8) & 0xFF) + Math.round(255 * percent / 100));
+  const b = Math.min(255, (num & 0xFF) + Math.round(255 * percent / 100));
+  return `#${((r << 16) | (g << 8) | b).toString(16).padStart(6, '0')}`;
+}
+
+function darkenColor(hex: string, percent: number): string {
+  const num = parseInt(hex.replace('#', ''), 16);
+  const r = Math.max(0, ((num >> 16) & 0xFF) - Math.round(255 * percent / 100));
+  const g = Math.max(0, ((num >> 8) & 0xFF) - Math.round(255 * percent / 100));
+  const b = Math.max(0, (num & 0xFF) - Math.round(255 * percent / 100));
+  return `#${((r << 16) | (g << 8) | b).toString(16).padStart(6, '0')}`;
+}
+
+const NAMED_COLORS: Record<string, string> = {
+  white: '#FFFFFF', black: '#000000', red: '#FF0000', green: '#008000',
+  blue: '#0000FF', yellow: '#FFFF00', orange: '#FFA500', gray: '#808080',
+  grey: '#808080', transparent: '#000000',
+};
+
+function colorToRgb(color: string): { r: number; g: number; b: number } {
+  const c = color.trim().toLowerCase();
+
+  const namedHex = NAMED_COLORS[c];
+  if (namedHex) {
+    const num = parseInt(namedHex.slice(1), 16);
+    return { r: (num >> 16) & 0xFF, g: (num >> 8) & 0xFF, b: num & 0xFF };
+  }
+
+  const rgbMatch = c.match(/^rgba?\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})/);
+  if (rgbMatch) {
+    return { r: parseInt(rgbMatch[1]), g: parseInt(rgbMatch[2]), b: parseInt(rgbMatch[3]) };
+  }
+
+  let hex = c.startsWith('#') ? c.slice(1) : c;
+  if (/^[0-9a-f]{3}$/.test(hex)) {
+    hex = hex[0] + hex[0] + hex[1] + hex[1] + hex[2] + hex[2];
+  }
+  if (/^[0-9a-f]{8}$/.test(hex)) {
+    hex = hex.slice(0, 6);
+  }
+  if (!/^[0-9a-f]{6}$/.test(hex)) {
+    throw new Error(`Invalid color: ${color}`);
+  }
+  const num = parseInt(hex, 16);
+  return { r: (num >> 16) & 0xFF, g: (num >> 8) & 0xFF, b: num & 0xFF };
+}
+
+function getRelativeLuminance(color: string): number {
+  const { r, g, b } = colorToRgb(color);
+  const [rs, gs, bs] = [r / 255, g / 255, b / 255].map(c =>
+    c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4)
+  );
+  return 0.2126 * rs + 0.7152 * gs + 0.0722 * bs;
+}
+
+function getContrastRatio(hex1: string, hex2: string): number {
+  const l1 = getRelativeLuminance(hex1);
+  const l2 = getRelativeLuminance(hex2);
+  const lighter = Math.max(l1, l2);
+  const darker = Math.min(l1, l2);
+  return (lighter + 0.05) / (darker + 0.05);
+}
+
+export function ensureButtonTextContrast(bgColor: string, preferredTextColor: string, fallbackDark: string = '#1a1a1a'): string {
+  try {
+    const ratio = getContrastRatio(bgColor, preferredTextColor);
+    if (ratio >= 4.5) return preferredTextColor;
+    const whiteRatio = getContrastRatio(bgColor, '#FFFFFF');
+    const darkRatio = getContrastRatio(bgColor, fallbackDark);
+    return darkRatio > whiteRatio ? fallbackDark : '#FFFFFF';
+  } catch {
+    return preferredTextColor;
+  }
+}
+
+const logoBase64Cache = new Map<string, { data: string; fetchedAt: number }>();
+const LOGO_CACHE_TTL = 5 * 60 * 1000;
+
+function isSafeUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return false;
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') return false;
+    if (hostname === '0.0.0.0' || hostname.endsWith('.local') || hostname.endsWith('.internal')) return false;
+    if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.)/.test(hostname)) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function fetchLogoAsBase64(url: string): Promise<string | null> {
+  try {
+    if (!isSafeUrl(url)) return null;
+    const cached = logoBase64Cache.get(url);
+    if (cached && Date.now() - cached.fetchedAt < LOGO_CACHE_TTL) {
+      return cached.data;
+    }
+    const response = await fetch(url, { signal: AbortSignal.timeout(5000), redirect: 'error' });
+    if (!response.ok) return null;
+    const contentType = response.headers.get('content-type') || 'image/png';
+    const buffer = await response.arrayBuffer();
+    if (buffer.byteLength === 0 || buffer.byteLength > 500_000) return null;
+    const base64 = Buffer.from(buffer).toString('base64');
+    const dataUri = `data:${contentType};base64,${base64}`;
+    logoBase64Cache.set(url, { data: dataUri, fetchedAt: Date.now() });
+    return dataUri;
+  } catch {
+    return null;
+  }
+}
+
+async function readLocalLogoAsBase64(relativePath: string): Promise<string | null> {
+  try {
+    const cached = logoBase64Cache.get(relativePath);
+    if (cached && Date.now() - cached.fetchedAt < LOGO_CACHE_TTL) {
+      return cached.data;
+    }
+    const filename = relativePath.replace(/^\/uploads\//, '');
+    if (filename.includes('..') || filename.includes('/')) return null;
+    const { readFile } = await import('fs/promises');
+    const { join } = await import('path');
+    const filePath = join(process.cwd(), 'uploads', filename);
+    const buffer = await readFile(filePath);
+    if (buffer.byteLength === 0 || buffer.byteLength > 500_000) return null;
+    const ext = filename.split('.').pop()?.toLowerCase() || 'png';
+    const mimeMap: Record<string, string> = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', svg: 'image/svg+xml', webp: 'image/webp' };
+    const mime = mimeMap[ext] || 'image/png';
+    const dataUri = `data:${mime};base64,${buffer.toString('base64')}`;
+    logoBase64Cache.set(relativePath, { data: dataUri, fetchedAt: Date.now() });
+    return dataUri;
+  } catch {
+    return null;
+  }
+}
+
 // Default email template JSON structures for email-builder-js
 // These follow the email-builder-js format with blocks
 
@@ -107,259 +259,410 @@ interface EmailBuilderDocument {
   [blockId: string]: EmailBuilderBlock;
 }
 
-// Helper to create a simple email template structure
-function createDefaultTemplate(
-  type: EmailTemplateType,
-  name: string,
-  subject: string,
-  heading: string,
-  bodyParagraphs: string[],
-  buttonText?: string,
-  buttonVariable?: string,
-  footerText?: string
-): { name: string; subject: string; jsonContent: EmailBuilderDocument; textContent: string } {
-  const blockIds: string[] = [];
-  const blocks: Record<string, EmailBuilderBlock> = {};
-  
-  // Header block
-  const headerId = 'header-1';
-  blockIds.push(headerId);
-  blocks[headerId] = {
-    type: 'Heading',
-    data: {
-      props: {
-        text: heading,
-        level: 'h2',
-      },
-      style: {
-        color: '#FF6B35',
-        fontWeight: 'bold',
-        textAlign: 'left',
-        padding: { top: 16, bottom: 8, left: 24, right: 24 },
-      },
-    },
-  };
+interface TemplateDefinition {
+  name: string;
+  subject: string;
+  jsonContent: EmailBuilderDocument;
+  textContent: string;
+}
 
-  // Body paragraphs
-  bodyParagraphs.forEach((para, index) => {
-    const paraId = `text-${index + 1}`;
-    blockIds.push(paraId);
-    blocks[paraId] = {
-      type: 'Text',
+function tpl(
+  blocks: Record<string, EmailBuilderBlock>,
+  childrenIds: string[]
+): EmailBuilderDocument {
+  return {
+    root: {
+      type: 'EmailLayout',
       data: {
-        props: { text: para },
-        style: {
-          color: '#333333',
-          fontSize: 16,
-          padding: { top: 8, bottom: 8, left: 24, right: 24 },
-        },
+        backdropColor: '#F5F5F5',
+        canvasColor: '#FFFFFF',
+        textColor: '#333333',
+        fontFamily: 'Arial, sans-serif',
+        childrenIds,
       },
-    };
-  });
+    },
+    ...blocks,
+  };
+}
 
-  // Button block if provided
-  if (buttonText && buttonVariable) {
-    const buttonId = 'button-1';
-    blockIds.push(buttonId);
-    blocks[buttonId] = {
-      type: 'Button',
-      data: {
-        props: {
-          text: buttonText,
-          url: `{{${buttonVariable}}}`,
-        },
-        style: {
-          backgroundColor: '#FF6B35',
-          color: '#FFFFFF',
-          padding: { top: 12, bottom: 12, left: 24, right: 24 },
-          borderRadius: 6,
-          textAlign: 'center',
-          fontWeight: 'bold',
-          margin: { top: 16, bottom: 16 },
-        },
-      },
-    };
-  }
+function heading(id: string, text: string, level: string = 'h2'): [string, EmailBuilderBlock] {
+  return [id, {
+    type: 'Heading',
+    data: {
+      props: { text, level },
+      style: { fontWeight: 'bold', padding: { top: 16, bottom: 8, left: 24, right: 24 } },
+    },
+  }];
+}
 
-  // Divider
-  const dividerId = 'divider-1';
-  blockIds.push(dividerId);
-  blocks[dividerId] = {
-    type: 'Divider',
+function txt(id: string, text: string, opts?: { bold?: boolean; color?: string; fontSize?: number }): [string, EmailBuilderBlock] {
+  return [id, {
+    type: 'Text',
     data: {
+      props: { text },
       style: {
-        padding: { top: 24, bottom: 24, left: 24, right: 24 },
+        fontSize: opts?.fontSize || 16,
+        padding: { top: 8, bottom: 8, left: 24, right: 24 },
+        ...(opts?.bold ? { fontWeight: 'bold' } : {}),
+        ...(opts?.color ? { color: opts.color } : {}),
       },
     },
-  };
+  }];
+}
 
-  // Footer
-  const footerId = 'footer-1';
-  blockIds.push(footerId);
-  blocks[footerId] = {
-    type: 'Text',
+function btn(id: string, text: string, urlVar: string, type: 'primary' | 'secondary' = 'primary'): [string, EmailBuilderBlock] {
+  return [id, {
+    type: 'Button',
     data: {
-      props: { text: footerText || 'Diese E-Mail wurde automatisch von {{siteName}} erstellt.' },
+      props: { text, url: `{{${urlVar}}}`, buttonType: type },
       style: {
-        color: '#6c757d',
-        fontSize: 14,
-        padding: { top: 8, bottom: 16, left: 24, right: 24 },
+        padding: { top: 12, bottom: 12, left: 24, right: 24 },
+        margin: { top: 12, bottom: 12, left: 0, right: 0 },
       },
     },
-  };
+  }];
+}
 
-  const jsonContent: EmailBuilderDocument = {
-    root: {
-      type: 'EmailLayout',
+function lightenColor(hex: string, amount: number): string {
+  try {
+    const { r, g, b } = colorToRgb(hex);
+    const lr = Math.round(r + (255 - r) * amount);
+    const lg = Math.round(g + (255 - g) * amount);
+    const lb = Math.round(b + (255 - b) * amount);
+    return `#${((lr << 16) | (lg << 8) | lb).toString(16).padStart(6, '0').toUpperCase()}`;
+  } catch {
+    return '#f8f9fa';
+  }
+}
+
+function darkenColorForDarkMode(hex: string): string {
+  try {
+    const { r, g, b } = colorToRgb(hex);
+    const dr = Math.round(r * 0.15 + 20);
+    const dg = Math.round(g * 0.15 + 20);
+    const db = Math.round(b * 0.15 + 30);
+    return `#${((dr << 16) | (dg << 8) | db).toString(16).padStart(6, '0')}`;
+  } catch {
+    return '#2a2a3e';
+  }
+}
+
+function container(
+  id: string,
+  fallbackBg: string,
+  fallbackDarkBg: string,
+  childDefs: [string, EmailBuilderBlock][],
+  variant: 'primary' | 'secondary' = 'primary'
+): { entry: [string, EmailBuilderBlock]; children: Record<string, EmailBuilderBlock> } {
+  const childIds = childDefs.map(([cid]) => cid);
+  const children: Record<string, EmailBuilderBlock> = {};
+  for (const [cid, cblock] of childDefs) {
+    children[cid] = cblock;
+  }
+  return {
+    entry: [id, {
+      type: 'Container',
       data: {
-        backdropColor: '#F5F5F5',
-        canvasColor: '#FFFFFF',
-        textColor: '#333333',
-        fontFamily: 'Arial, sans-serif',
-        childrenIds: blockIds,
+        childrenIds: childIds,
+        props: { containerVariant: variant },
+        style: {
+          backgroundColor: fallbackBg,
+          darkBackgroundColor: fallbackDarkBg,
+          borderRadius: 8,
+          padding: { top: 20, right: 24, bottom: 20, left: 24 },
+          margin: { top: 12, right: 24, bottom: 12, left: 24 },
+        },
       },
-    },
-    ...blocks,
+    }],
+    children,
   };
+}
 
-  // Generate plain text version
-  let textContent = `${heading}\n\n`;
-  textContent += bodyParagraphs.join('\n\n');
-  if (buttonText && buttonVariable) {
-    textContent += `\n\n${buttonText}: {{${buttonVariable}}}`;
-  }
-  textContent += `\n\n---\n${footerText || 'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'}`;
+function img(id: string, srcVar: string, alt: string, width: string = '150px'): [string, EmailBuilderBlock] {
+  return [id, {
+    type: 'Image',
+    data: {
+      props: { src: `{{${srcVar}}}`, alt },
+      style: { width, padding: { top: 16, right: 0, bottom: 16, left: 0 } },
+    },
+  }];
+}
 
-  return { name, subject, jsonContent, textContent };
+function divider(id: string): [string, EmailBuilderBlock] {
+  return [id, {
+    type: 'Divider',
+    data: { style: { padding: { top: 16, bottom: 16, left: 24, right: 24 } } },
+  }];
 }
 
-// Default templates for each type
-const DEFAULT_TEMPLATES: Record<EmailTemplateType, ReturnType<typeof createDefaultTemplate>> = {
-  poll_created: createDefaultTemplate(
-    'poll_created',
-    'Umfrage erstellt',
-    '[{{siteName}}] Ihre {{pollType}} wurde erstellt: {{pollTitle}}',
-    '{{pollType}} erfolgreich erstellt!',
-    [
-      'Ihre {{pollType}} "{{pollTitle}}" wurde erfolgreich erstellt.',
-      'Teilen Sie den folgenden Link mit Ihren Teilnehmern:',
-      '{{publicLink}}',
-      'Als Administrator können Sie die Umfrage über diesen Link verwalten:',
-      '{{adminLink}}',
-    ],
-    'Umfrage öffnen',
-    'publicLink',
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.\nOpen-Source Abstimmungsplattform für Teams'
-  ),
-  
-  invitation: createDefaultTemplate(
-    'invitation',
-    'Einladung zur Umfrage',
-    '[{{siteName}}] {{inviterName}} lädt Sie ein: {{pollTitle}}',
-    '📣 Einladung zur Abstimmung',
-    [
-      'Hallo,',
-      '{{inviterName}} lädt Sie ein, an der Umfrage "{{pollTitle}}" teilzunehmen.',
-      '{{message}}',
-    ],
-    'Jetzt abstimmen',
-    'publicLink',
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
-  ),
-  
-  vote_confirmation: createDefaultTemplate(
-    'vote_confirmation',
-    'Abstimmungsbestätigung',
-    '[{{siteName}}] Vielen Dank für Ihre Teilnahme - {{pollTitle}}',
-    'Vielen Dank für Ihre Teilnahme!',
-    [
-      'Hallo {{voterName}},',
-      'vielen Dank für Ihre Teilnahme an der {{pollType}} "{{pollTitle}}".',
-      'Ihre Auswahl wurde erfolgreich gespeichert.',
-      'Mit diesem Link können Sie jederzeit zur Umfrage zurückkehren:',
-      '{{publicLink}}',
-      'Hier können Sie die aktuellen Ergebnisse einsehen:',
-      '{{resultsLink}}',
-    ],
-    'Ergebnisse anzeigen',
-    'resultsLink',
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
-  ),
+
+function buildTemplate(
+  name: string,
+  subject: string,
+  defs: [string, EmailBuilderBlock][],
+  containers: { entry: [string, EmailBuilderBlock]; children: Record<string, EmailBuilderBlock> }[],
+  textContent: string
+): TemplateDefinition {
+  const allBlocks: Record<string, EmailBuilderBlock> = {};
+  const topIds: string[] = [];
+  for (const [bid, block] of defs) {
+    allBlocks[bid] = block;
+    topIds.push(bid);
+  }
+  for (const c of containers) {
+    const [cid, cblock] = c.entry;
+    allBlocks[cid] = cblock;
+    topIds.push(cid);
+    for (const [chid, chblock] of Object.entries(c.children)) {
+      allBlocks[chid] = chblock;
+    }
+  }
+  return { name, subject, jsonContent: tpl(allBlocks, topIds), textContent };
+}
+
+function buildSimpleTemplate(
+  name: string,
+  subject: string,
+  headingText: string,
+  paragraphs: string[],
+  buttonText?: string,
+  buttonVar?: string,
+  buttonType: 'primary' | 'secondary' = 'primary',
+): TemplateDefinition {
+  const defs: [string, EmailBuilderBlock][] = [];
+  defs.push(heading('h1', headingText, 'h1'));
+  paragraphs.forEach((p, i) => defs.push(txt(`t${i}`, p)));
+  if (buttonText && buttonVar) defs.push(btn('b1', buttonText, buttonVar, buttonType));
+  defs.push(divider('d1'));
   
-  reminder: createDefaultTemplate(
-    'reminder',
-    'Erinnerung',
-    '[{{siteName}}] Erinnerung: {{pollTitle}}',
-    '📣 Erinnerung zur Abstimmung',
-    [
-      'Hallo,',
-      '{{senderName}} erinnert Sie freundlich an die Teilnahme an der Umfrage "{{pollTitle}}".',
-      'Ihre Stimme ist wichtig! Bitte nehmen Sie sich kurz Zeit, um abzustimmen.',
-      '{{expiresAt}}',
-    ],
-    'Jetzt abstimmen',
-    'pollLink',
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
-  ),
+  let textContent = `${headingText}\n\n${paragraphs.join('\n\n')}`;
+  if (buttonText && buttonVar) textContent += `\n\n${buttonText}: {{${buttonVar}}}`;
   
-  password_reset: createDefaultTemplate(
-    'password_reset',
-    'Passwort zurücksetzen',
-    '[{{siteName}}] Passwort zurücksetzen',
-    'Passwort zurücksetzen',
-    [
-      'Hallo {{userName}},',
-      'Sie haben angefordert, Ihr Passwort für Ihren {{siteName}} Account zurückzusetzen.',
-      'Klicken Sie auf den folgenden Button, um ein neues Passwort zu vergeben:',
-      'Dieser Link ist 1 Stunde gültig.',
-      'Falls Sie diese Anfrage nicht gestellt haben, können Sie diese E-Mail ignorieren. Ihr Passwort bleibt unverändert.',
-    ],
-    'Passwort zurücksetzen',
-    'resetLink',
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
-  ),
+  return buildTemplate(name, subject, defs, [], textContent);
+}
+
+// ---- poll_created: the showcase template with containers ----
+function buildPollCreatedTemplate(): TemplateDefinition {
+  const adminBox = container('admin-box', '#f8f9fa', '#2a2a3e', [
+    heading('ab-h', 'Administratorlink', 'h3'),
+    txt('ab-t', 'Mit diesem Link l\u00E4sst sich die Umfrage verwalten, bearbeiten und die Ergebnisse einsehen.'),
+    btn('ab-btn', 'Umfrage verwalten', 'adminLink', 'primary'),
+  ]);
+
+  const publicBox = container('public-box', '#e8f4f8', '#1e3a4a', [
+    heading('pb-h', 'Öffentlicher Link zum Teilen', 'h3'),
+    txt('pb-t', 'Diesen Link an alle Teilnehmer weiterleiten, damit diese an der Abstimmung teilnehmen k\u00F6nnen.'),
+    btn('pb-btn', 'Zur Abstimmung', 'publicLink', 'secondary'),
+  ], 'secondary');
+
+  const topDefs: [string, EmailBuilderBlock][] = [
+    heading('h1', '{{pollType}} erfolgreich erstellt!', 'h1'),
+    txt('t1', 'Hallo,'),
+    txt('t2', 'Die {{pollType}} <strong>"{{pollTitle}}"</strong> wurde erfolgreich erstellt.'),
+  ];
+
+  const bottomDefs: [string, EmailBuilderBlock][] = [
+    txt('warn', '<strong>\u26A0\uFE0F Wichtig:</strong> Den Administratorlink sicher aufbewahren. Nur damit l\u00E4sst sich die Umfrage verwalten.', { bold: true }),
+    divider('d1'),
+  ];
+
+  const allBlocks: Record<string, EmailBuilderBlock> = {};
+  const topIds: string[] = [];
+
+  for (const [id, block] of topDefs) { allBlocks[id] = block; topIds.push(id); }
   
-  email_change: createDefaultTemplate(
-    'email_change',
+  const [adminId, adminBlock] = adminBox.entry;
+  allBlocks[adminId] = adminBlock; topIds.push(adminId);
+  for (const [cid, cb] of Object.entries(adminBox.children)) allBlocks[cid] = cb;
+
+  const [pubId, pubBlock] = publicBox.entry;
+  allBlocks[pubId] = pubBlock; topIds.push(pubId);
+  for (const [cid, cb] of Object.entries(publicBox.children)) allBlocks[cid] = cb;
+
+  for (const [id, block] of bottomDefs) { allBlocks[id] = block; topIds.push(id); }
+
+  const textContent = `{{pollType}} erfolgreich erstellt!\n\nHallo,\n\nDie {{pollType}} "{{pollTitle}}" wurde erfolgreich erstellt.\n\nAdministratorlink:\nUmfrage verwalten: {{adminLink}}\n\n\u00D6ffentlicher Link zum Teilen:\nZur Abstimmung: {{publicLink}}\n\nWichtig: Den Administratorlink sicher aufbewahren. Nur damit l\u00E4sst sich die Umfrage verwalten.`;
+
+  return { name: 'Umfrage erstellt', subject: '[{{siteName}}] {{pollType}} wurde erstellt: {{pollTitle}}', jsonContent: tpl(allBlocks, topIds), textContent };
+}
+
+// ---- invitation with QR code ----
+function buildInvitationTemplate(): TemplateDefinition {
+  const defs: [string, EmailBuilderBlock][] = [];
+  defs.push(heading('h1', 'Einladung zur Abstimmung', 'h1'));
+  defs.push(txt('t0', 'Hallo,'));
+  defs.push(txt('t1', '{{inviterName}} lädt Sie ein, an der Umfrage <strong>"{{pollTitle}}"</strong> teilzunehmen.'));
+  defs.push(txt('t2', '{{message}}'));
+  defs.push(btn('b1', 'Jetzt abstimmen', 'publicLink', 'primary'));
+  defs.push(img('qr', 'qrCodeUrl', 'QR-Code zur Umfrage', '150px'));
+  defs.push(divider('d1'));
+
+  const textContent = `Einladung zur Abstimmung\n\nHallo,\n\n{{inviterName}} lädt Sie ein, an der Umfrage "{{pollTitle}}" teilzunehmen.\n\n{{message}}\n\nJetzt abstimmen: {{publicLink}}`;
+
+  return buildTemplate('Einladung zur Umfrage', '[{{siteName}}] {{inviterName}} lädt Sie ein: {{pollTitle}}', defs, [], textContent);
+}
+
+// ---- reminder with QR code ----
+function buildReminderTemplate(): TemplateDefinition {
+  const defs: [string, EmailBuilderBlock][] = [];
+  defs.push(heading('h1', 'Erinnerung zur Abstimmung', 'h1'));
+  defs.push(txt('t0', 'Hallo,'));
+  defs.push(txt('t1', '{{senderName}} erinnert Sie freundlich an die Teilnahme an der Umfrage <strong>"{{pollTitle}}"</strong>.'));
+  defs.push(txt('t2', 'Ihre Stimme ist wichtig! Bitte nehmen Sie sich kurz Zeit, um abzustimmen.'));
+  defs.push(txt('t3', '{{expiresAt}}'));
+  defs.push(btn('b1', 'Jetzt abstimmen', 'pollLink', 'primary'));
+  defs.push(img('qr', 'qrCodeUrl', 'QR-Code zur Umfrage', '150px'));
+  defs.push(divider('d1'));
+
+  const textContent = `Erinnerung zur Abstimmung\n\nHallo,\n\n{{senderName}} erinnert Sie freundlich an die Teilnahme an der Umfrage "{{pollTitle}}".\n\nIhre Stimme ist wichtig! Bitte nehmen Sie sich kurz Zeit, um abzustimmen.\n\n{{expiresAt}}\n\nJetzt abstimmen: {{pollLink}}`;
+
+  return buildTemplate('Erinnerung', '[{{siteName}}] Erinnerung: {{pollTitle}}', defs, [], textContent);
+}
+
+// ---- vote_confirmation with container ----
+function buildVoteConfirmationTemplate(): TemplateDefinition {
+  const linkBox = container('link-box', '#e8f4f8', '#1e3a4a', [
+    txt('lb-t', 'Mit diesem Link können Sie jederzeit zur Umfrage zurückkehren oder die aktuellen Ergebnisse einsehen.'),
+    btn('lb-btn1', 'Ergebnisse anzeigen', 'resultsLink', 'secondary'),
+  ], 'secondary');
+
+  const topDefs: [string, EmailBuilderBlock][] = [
+    heading('h1', 'Vielen Dank für Ihre Teilnahme!', 'h1'),
+    txt('t1', 'Hallo {{voterName}},'),
+    txt('t2', 'vielen Dank für Ihre Teilnahme an der {{pollType}} <strong>"{{pollTitle}}"</strong>. Ihre Auswahl wurde erfolgreich gespeichert.'),
+  ];
+
+  const bottomDefs: [string, EmailBuilderBlock][] = [
+    divider('d1'),
+  ];
+
+  const allBlocks: Record<string, EmailBuilderBlock> = {};
+  const topIds: string[] = [];
+  for (const [id, block] of topDefs) { allBlocks[id] = block; topIds.push(id); }
+  const [boxId, boxBlock] = linkBox.entry;
+  allBlocks[boxId] = boxBlock; topIds.push(boxId);
+  for (const [cid, cb] of Object.entries(linkBox.children)) allBlocks[cid] = cb;
+  for (const [id, block] of bottomDefs) { allBlocks[id] = block; topIds.push(id); }
+
+  return {
+    name: 'Abstimmungsbestätigung',
+    subject: '[{{siteName}}] Vielen Dank für Ihre Teilnahme - {{pollTitle}}',
+    jsonContent: tpl(allBlocks, topIds),
+    textContent: 'Vielen Dank für Ihre Teilnahme!\n\nHallo {{voterName}},\n\nvielen Dank für Ihre Teilnahme an der {{pollType}} "{{pollTitle}}". Ihre Auswahl wurde erfolgreich gespeichert.\n\nErgebnisse anzeigen: {{resultsLink}}',
+  };
+}
+
+// ---- password_reset with container ----
+function buildPasswordResetTemplate(): TemplateDefinition {
+  const actionBox = container('action-box', '#f8f9fa', '#2a2a3e', [
+    txt('ab-t', 'Klicken Sie auf den folgenden Button, um ein neues Passwort zu vergeben. Dieser Link ist 1 Stunde gültig.'),
+    btn('ab-btn', 'Passwort zurücksetzen', 'resetLink', 'primary'),
+  ]);
+
+  const topDefs: [string, EmailBuilderBlock][] = [
+    heading('h1', 'Passwort zurücksetzen', 'h1'),
+    txt('t1', 'Hallo {{userName}},'),
+    txt('t2', 'Sie haben angefordert, Ihr Passwort für Ihren {{siteName}} Account zurückzusetzen.'),
+  ];
+
+  const bottomDefs: [string, EmailBuilderBlock][] = [
+    txt('t3', 'Falls Sie diese Anfrage nicht gestellt haben, können Sie diese E-Mail ignorieren. Ihr Passwort bleibt unverändert.', { color: '#6c757d', fontSize: 14 }),
+    divider('d1'),
+  ];
+
+  const allBlocks: Record<string, EmailBuilderBlock> = {};
+  const topIds: string[] = [];
+  for (const [id, block] of topDefs) { allBlocks[id] = block; topIds.push(id); }
+  const [boxId, boxBlock] = actionBox.entry;
+  allBlocks[boxId] = boxBlock; topIds.push(boxId);
+  for (const [cid, cb] of Object.entries(actionBox.children)) allBlocks[cid] = cb;
+  for (const [id, block] of bottomDefs) { allBlocks[id] = block; topIds.push(id); }
+
+  return {
+    name: 'Passwort zurücksetzen',
+    subject: '[{{siteName}}] Passwort zurücksetzen',
+    jsonContent: tpl(allBlocks, topIds),
+    textContent: 'Passwort zurücksetzen\n\nHallo {{userName}},\n\nSie haben angefordert, Ihr Passwort zurückzusetzen.\n\nPasswort zurücksetzen: {{resetLink}}\n\nDieser Link ist 1 Stunde gültig.',
+  };
+}
+
+// ---- welcome with container ----
+function buildWelcomeTemplate(): TemplateDefinition {
+  const actionBox = container('action-box', '#e8f4f8', '#1e3a4a', [
+    txt('ab-t', 'Bitte bestätigen Sie Ihre E-Mail-Adresse, um alle Funktionen von {{siteName}} nutzen zu können.'),
+    btn('ab-btn', 'E-Mail bestätigen', 'verificationLink', 'secondary'),
+  ], 'secondary');
+
+  const topDefs: [string, EmailBuilderBlock][] = [
+    heading('h1', 'Willkommen bei {{siteName}}!', 'h1'),
+    txt('t1', 'Hallo {{userName}},'),
+    txt('t2', 'vielen Dank für Ihre Registrierung bei {{siteName}}! Ihr Account wurde erfolgreich erstellt.'),
+  ];
+
+  const bottomDefs: [string, EmailBuilderBlock][] = [
+    divider('d1'),
+  ];
+
+  const allBlocks: Record<string, EmailBuilderBlock> = {};
+  const topIds: string[] = [];
+  for (const [id, block] of topDefs) { allBlocks[id] = block; topIds.push(id); }
+  const [boxId, boxBlock] = actionBox.entry;
+  allBlocks[boxId] = boxBlock; topIds.push(boxId);
+  for (const [cid, cb] of Object.entries(actionBox.children)) allBlocks[cid] = cb;
+  for (const [id, block] of bottomDefs) { allBlocks[id] = block; topIds.push(id); }
+
+  return {
+    name: 'Willkommen',
+    subject: '[{{siteName}}] Willkommen bei {{siteName}}!',
+    jsonContent: tpl(allBlocks, topIds),
+    textContent: 'Willkommen bei {{siteName}}!\n\nHallo {{userName}},\n\nvielen Dank für Ihre Registrierung! Ihr Account wurde erfolgreich erstellt.\n\nE-Mail bestätigen: {{verificationLink}}',
+  };
+}
+
+const DEFAULT_TEMPLATES: Record<EmailTemplateType, TemplateDefinition> = {
+  poll_created: buildPollCreatedTemplate(),
+
+  invitation: buildInvitationTemplate(),
+
+  vote_confirmation: buildVoteConfirmationTemplate(),
+
+  reminder: buildReminderTemplate(),
+
+  password_reset: buildPasswordResetTemplate(),
+
+  email_change: buildSimpleTemplate(
     'E-Mail-Adresse ändern',
     '[{{siteName}}] E-Mail-Adresse bestätigen',
     'E-Mail-Adresse bestätigen',
     [
       'Hallo,',
       'Sie haben angefordert, Ihre E-Mail-Adresse für Ihren {{siteName}} Account zu ändern.',
-      'Alte E-Mail: {{oldEmail}}',
-      'Neue E-Mail: {{newEmail}}',
-      'Klicken Sie auf den folgenden Button, um Ihre neue E-Mail-Adresse zu bestätigen:',
+      '<strong>Alte E-Mail:</strong> {{oldEmail}}',
+      '<strong>Neue E-Mail:</strong> {{newEmail}}',
       'Dieser Link ist 24 Stunden gültig.',
       'Falls Sie diese Anfrage nicht gestellt haben, können Sie diese E-Mail ignorieren.',
     ],
     'E-Mail bestätigen',
     'confirmLink',
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
   ),
-  
-  password_changed: createDefaultTemplate(
-    'password_changed',
+
+  password_changed: buildSimpleTemplate(
     'Passwort geändert',
     '[{{siteName}}] Ihr Passwort wurde geändert',
     'Passwort erfolgreich geändert',
     [
       'Hallo {{userName}},',
       'Ihr Passwort für Ihren {{siteName}} Account wurde erfolgreich geändert.',
-      'Falls Sie diese Änderung nicht vorgenommen haben, kontaktieren Sie bitte umgehend den Administrator.',
+      '<strong>Falls Sie diese Änderung nicht vorgenommen haben, kontaktieren Sie bitte umgehend den Administrator.</strong>',
     ],
-    undefined,
-    undefined,
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
   ),
-  
-  test_report: createDefaultTemplate(
-    'test_report',
+
+  test_report: buildSimpleTemplate(
     'Testbericht',
     '[{{siteName}}] Testbericht #{{testRunId}}: {{status}}',
-    '{{status}} Automatischer Testbericht',
+    '{{status}} — Automatischer Testbericht',
     [
-      'Der automatische Testlauf #{{testRunId}} wurde abgeschlossen.',
+      'Der automatische Testlauf <strong>#{{testRunId}}</strong> wurde abgeschlossen.',
       'Gesamte Tests: {{totalTests}}',
       'Bestanden: {{passed}}',
       'Fehlgeschlagen: {{failed}}',
@@ -367,26 +670,23 @@ const DEFAULT_TEMPLATES: Record<EmailTemplateType, ReturnType<typeof createDefau
       'Dauer: {{duration}}',
       'Gestartet: {{startedAt}}',
     ],
-    undefined,
-    undefined,
-    'Diese E-Mail wurde automatisch vom {{siteName}} Testsystem erstellt.'
   ),
-  
-  welcome: createDefaultTemplate(
-    'welcome',
-    'Willkommen',
-    '[{{siteName}}] Willkommen bei {{siteName}}!',
-    'Willkommen bei {{siteName}}!',
+
+  welcome: buildWelcomeTemplate(),
+
+  poll_finalized: buildSimpleTemplate(
+    'Umfrage abgeschlossen',
+    '[{{siteName}}] {{statusLabel}}: {{pollTitle}}',
+    '{{statusLabel}}',
     [
-      'Hallo {{userName}},',
-      'vielen Dank für Ihre Registrierung bei {{siteName}}!',
-      'Ihr Account wurde erfolgreich erstellt.',
-      'Bitte bestätigen Sie Ihre E-Mail-Adresse, indem Sie auf den folgenden Button klicken:',
-      'Nach der Bestätigung können Sie alle Funktionen von {{siteName}} nutzen.',
+      'Hallo,',
+      'die Umfrage <strong>„{{pollTitle}}"</strong> wurde abgeschlossen.',
+      '{{confirmedDate}}',
+      '{{confirmedTime}}',
+      '{{videoConferenceHtml}}',
     ],
-    'E-Mail bestätigen',
-    'verificationLink',
-    'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
+    '{{buttonLabel}}',
+    'buttonLink',
   ),
 };
 
@@ -400,6 +700,62 @@ function htmlEscape(str: string): string {
     .replace(/'/g, '&#039;');
 }
 
+/**
+ * Render footer markup: escapes HTML but processes {{link:URL}} and {{link:URL|Label}} syntax.
+ * - {{link:https://example.com}} → <a href="https://example.com" target="_blank">example.com</a>
+ * - {{link:https://example.com|Datenschutz}} → <a href="https://example.com" target="_blank">Datenschutz</a>
+ * - All other text is HTML-escaped for XSS safety.
+ */
+function renderFooterMarkup(input: string, linkStyle: string = ''): string {
+  const linkPattern = /\{\{link:([^|}]+?)(?:\|([^}]+?))?\}\}/g;
+  const parts: string[] = [];
+  let lastIndex = 0;
+  let match: RegExpExecArray | null;
+
+  while ((match = linkPattern.exec(input)) !== null) {
+    if (match.index > lastIndex) {
+      parts.push(htmlEscape(input.slice(lastIndex, match.index)));
+    }
+    const url = match[1].trim();
+    const label = match[2]?.trim();
+    const displayText = label || url.replace(/^https?:\/\//, '');
+    const isUrlSafe = /^(https?:\/\/|mailto:)/i.test(url);
+    if (isUrlSafe) {
+      const styleAttr = linkStyle ? ` style="${linkStyle}"` : '';
+      parts.push(`<a href="${htmlEscape(url)}" target="_blank" rel="noopener noreferrer"${styleAttr}>${htmlEscape(displayText)}</a>`);
+    } else {
+      parts.push(htmlEscape(displayText));
+    }
+    lastIndex = match.index + match[0].length;
+  }
+
+  if (lastIndex < input.length) {
+    parts.push(htmlEscape(input.slice(lastIndex)));
+  }
+
+  return parts.join('').replace(/\n/g, '<br>');
+}
+
+/**
+ * Strip {{link:URL|Label}} markup from text for plain-text output.
+ * - {{link:https://example.com}} → https://example.com
+ * - {{link:https://example.com|Datenschutz}} → Datenschutz (https://example.com)
+ */
+function stripFooterMarkupToText(input: string): string {
+  return input.replace(/\{\{link:([^|}]+?)(?:\|([^}]+?))?\}\}/g, (_match, url: string, label?: string) => {
+    const trimUrl = url.trim();
+    const trimLabel = label?.trim();
+    const isUrlSafe = /^(https?:\/\/|mailto:)/i.test(trimUrl);
+    if (!isUrlSafe) {
+      return trimLabel || '';
+    }
+    if (trimLabel) {
+      return `${trimLabel} (${trimUrl})`;
+    }
+    return trimUrl;
+  });
+}
+
 // Template rendering - replace variables with actual values
 // Note: leaves unmatched variables as-is (does not remove them)
 export function renderTemplate(
@@ -437,34 +793,43 @@ export function substituteVariables(
   return result;
 }
 
-// Convert email-builder JSON to HTML
-export function jsonToHtml(jsonContent: EmailBuilderDocument): string {
-  const root = jsonContent.root;
-  if (!root || root.type !== 'EmailLayout') {
-    return '<div>Template-Fehler: Ungültiges Format</div>';
-  }
+function resolveTheme(theme?: EmailTheme, rootData?: Record<string, unknown>) {
+  const rd = (rootData || {}) as Record<string, string>;
+  const t = theme || DEFAULT_EMAIL_THEME;
+  const buttonBg = t.buttonBackgroundColor || DEFAULT_EMAIL_THEME.buttonBackgroundColor;
+  const secondaryBg = t.secondaryButtonBackgroundColor || DEFAULT_EMAIL_THEME.secondaryButtonBackgroundColor;
+  const rawButtonText = t.buttonTextColor || DEFAULT_EMAIL_THEME.buttonTextColor;
+  const rawSecondaryText = t.secondaryButtonTextColor || DEFAULT_EMAIL_THEME.secondaryButtonTextColor;
+  return {
+    textColor: t.textColor || rd.textColor || DEFAULT_EMAIL_THEME.textColor,
+    headingColor: t.headingColor || DEFAULT_EMAIL_THEME.headingColor,
+    buttonBg,
+    buttonText: ensureButtonTextContrast(buttonBg, rawButtonText),
+    buttonRadius: t.buttonBorderRadius ?? DEFAULT_EMAIL_THEME.buttonBorderRadius,
+    secondaryBg,
+    secondaryText: ensureButtonTextContrast(secondaryBg, rawSecondaryText),
+    fontFamily: t.fontFamily || rd.fontFamily || DEFAULT_EMAIL_THEME.fontFamily,
+  };
+}
 
-  const { backdropColor, canvasColor, textColor, fontFamily, childrenIds } = root.data;
+function renderPadding(padding: Record<string, number> | undefined): string {
+  if (!padding) return '';
+  return `padding: ${padding.top || 0}px ${padding.right || 0}px ${padding.bottom || 0}px ${padding.left || 0}px;`;
+}
 
-  let html = `
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <style>
-    body { margin: 0; padding: 0; background-color: ${backdropColor}; font-family: ${fontFamily}; }
-    .email-container { max-width: 600px; margin: 0 auto; background-color: ${canvasColor}; color: ${textColor}; }
-    .button { display: inline-block; text-decoration: none; }
-    .divider { border-top: 1px solid #e9ecef; }
-  </style>
-</head>
-<body>
-  <div class="email-container">
-`;
+function renderMargin(margin: Record<string, number> | undefined): string {
+  if (!margin) return '';
+  return `margin: ${margin.top || 0}px ${margin.right || 0}px ${margin.bottom || 0}px ${margin.left || 0}px;`;
+}
 
-  for (const blockId of childrenIds) {
-    const block = jsonContent[blockId];
+function renderBlocksToHtml(
+  blockIds: string[],
+  doc: EmailBuilderDocument,
+  tv: ReturnType<typeof resolveTheme>
+): string {
+  let html = '';
+  for (const blockId of blockIds) {
+    const block = doc[blockId];
     if (!block) continue;
 
     const blockData = block.data as Record<string, unknown>;
@@ -475,134 +840,637 @@ export function jsonToHtml(jsonContent: EmailBuilderDocument): string {
       case 'Heading': {
         const level = props.level || 'h2';
         const text = props.text || '';
-        const color = style.color || textColor;
-        const padding = style.padding as Record<string, number> | undefined;
-        const paddingStyle = padding 
-          ? `padding: ${padding.top || 0}px ${padding.right || 0}px ${padding.bottom || 0}px ${padding.left || 0}px;`
-          : '';
-        html += `<${level} style="color: ${color}; ${paddingStyle} margin: 0;">${text}</${level}>\n`;
+        const color = (style.color as string) || tv.headingColor;
+        const fontWeight = (style.fontWeight as string) || 'bold';
+        const fontSizeMap: Record<string, string> = { h1: '26px', h2: '22px', h3: '18px', h4: '16px' };
+        const fontSize = fontSizeMap[level as string] || '22px';
+        const lineHeight = level === 'h1' ? '1.3' : '1.4';
+        html += `<${level} class="email-heading" style="color: ${color}; font-size: ${fontSize}; line-height: ${lineHeight}; ${renderPadding(style.padding as Record<string, number>)} margin: 0; font-weight: ${fontWeight};">${text}</${level}>\n`;
         break;
       }
       case 'Text': {
         const text = props.text || '';
-        const color = style.color || textColor;
+        const color = (style.color as string) || tv.textColor;
         const fontSize = style.fontSize || 16;
-        const padding = style.padding as Record<string, number> | undefined;
-        const paddingStyle = padding 
-          ? `padding: ${padding.top || 0}px ${padding.right || 0}px ${padding.bottom || 0}px ${padding.left || 0}px;`
-          : '';
-        html += `<p style="color: ${color}; font-size: ${fontSize}px; ${paddingStyle} margin: 0;">${text}</p>\n`;
+        const fontWeight = (style.fontWeight as string) || 'normal';
+        html += `<p class="email-text" style="color: ${color}; font-size: ${fontSize}px; ${renderPadding(style.padding as Record<string, number>)} margin: 0; line-height: 1.6; font-weight: ${fontWeight};">${text}</p>\n`;
         break;
       }
       case 'Button': {
         const text = props.text || 'Click';
         const url = props.url || '#';
-        const bgColor = style.backgroundColor || '#FF6B35';
-        const color = style.color || '#FFFFFF';
-        const borderRadius = style.borderRadius || 6;
-        const padding = style.padding as Record<string, number> | undefined;
-        const margin = style.margin as Record<string, number> | undefined;
-        const paddingStyle = padding 
-          ? `padding: ${padding.top || 12}px ${padding.right || 24}px ${padding.bottom || 12}px ${padding.left || 24}px;`
-          : 'padding: 12px 24px;';
-        const marginStyle = margin
-          ? `margin: ${margin.top || 0}px ${margin.right || 0}px ${margin.bottom || 0}px ${margin.left || 0}px;`
-          : '';
+        const buttonType = props.buttonType as string || 'primary';
+        const explicitBg = style.backgroundColor as string | undefined;
+        const bgColor = explicitBg || (buttonType === 'secondary' ? tv.secondaryBg : tv.buttonBg);
+        const color = (style.color as string) || (buttonType === 'secondary' ? tv.secondaryText : tv.buttonText);
+        const borderRadius = tv.buttonRadius;
+        const paddingStyle = renderPadding(style.padding as Record<string, number>) || 'padding: 14px 28px;';
+        const marginStyle = renderMargin(style.margin as Record<string, number>);
+        const cssClass = buttonType === 'secondary' ? 'email-btn-secondary' : 'email-btn-primary';
         html += `<div style="text-align: center; ${marginStyle}">
-          <a href="${url}" class="button" style="background-color: ${bgColor}; color: ${color}; ${paddingStyle} border-radius: ${borderRadius}px; font-weight: bold; text-decoration: none;">${text}</a>
+          <a href="${url}" class="${cssClass}" style="display: inline-block; text-decoration: none; background-color: ${bgColor}; color: ${color}; ${paddingStyle} border-radius: ${borderRadius}px; font-weight: 600; font-size: 15px; min-width: 160px; text-align: center;">${text}</a>
         </div>\n`;
         break;
       }
+      case 'Container': {
+        const variant = props.containerVariant as string | undefined;
+        let bgColor: string;
+        if (variant === 'secondary' && tv.secondaryBg) {
+          bgColor = lightenColor(tv.secondaryBg, 0.85);
+        } else if (variant === 'primary' && tv.buttonBg) {
+          bgColor = lightenColor(tv.buttonBg, 0.92);
+        } else {
+          bgColor = (style.backgroundColor as string) || '#f8f9fa';
+        }
+        const borderRadius = (style.borderRadius as number) ?? 8;
+        const borderColor = (style.borderColor as string) || 'transparent';
+        const borderWidth = (style.borderWidth as number) ?? 0;
+        const padding = style.padding as Record<string, number> || { top: 20, right: 24, bottom: 20, left: 24 };
+        const margin = style.margin as Record<string, number> || { top: 12, right: 0, bottom: 12, left: 0 };
+        const childIds = (blockData.childrenIds || []) as string[];
+        const childHtml = renderBlocksToHtml(childIds, doc, tv);
+        const containerClass = `email-container email-container-${blockId}`;
+        html += `<div class="${containerClass}" style="background-color: ${bgColor}; border-radius: ${borderRadius}px; ${renderPadding(padding)} ${renderMargin(margin)}${borderWidth > 0 ? ` border: ${borderWidth}px solid ${borderColor};` : ''}">
+${childHtml}</div>\n`;
+        break;
+      }
       case 'Divider': {
-        const padding = style.padding as Record<string, number> | undefined;
-        const paddingStyle = padding 
-          ? `padding: ${padding.top || 0}px ${padding.right || 0}px ${padding.bottom || 0}px ${padding.left || 0}px;`
-          : '';
-        html += `<div style="${paddingStyle}"><hr class="divider" style="margin: 0; border: none; border-top: 1px solid #e9ecef;"></div>\n`;
+        const paddingStyle = renderPadding(style.padding as Record<string, number>);
+        html += `<div style="${paddingStyle}"><hr class="email-divider" style="margin: 0; border: none; border-top: 1px solid #e9ecef;"></div>\n`;
         break;
       }
       case 'Image': {
         const src = props.src || '';
         const alt = props.alt || '';
         const width = style.width || '100%';
-        html += `<div style="text-align: center;"><img src="${src}" alt="${alt}" style="max-width: ${width}; height: auto;"></div>\n`;
+        if (src) {
+          html += `<div style="text-align: center;"><img src="${src}" alt="${alt}" style="max-width: ${width}; height: auto;"></div>\n`;
+        }
         break;
       }
     }
   }
+  return html;
+}
+
+function extractTextRecursive(blockIds: string[], doc: EmailBuilderDocument): string {
+  let text = '';
+  for (const blockId of blockIds) {
+    const block = doc[blockId];
+    if (!block) continue;
+    const blockData = block.data as Record<string, unknown>;
+    const props = (blockData.props || {}) as Record<string, unknown>;
+    if (props.text) {
+      const rawText = (props.text as string).replace(/<[^>]*>/g, '');
+      text += rawText + '\n\n';
+    }
+    if (block.type === 'Container') {
+      const childIds = (blockData.childrenIds || []) as string[];
+      text += extractTextRecursive(childIds, doc);
+    }
+    if (props.url && props.text) {
+      text += `${props.url}\n\n`;
+    }
+  }
+  return text;
+}
 
-  html += `
-  </div>
-</body>
-</html>`;
+function extractTextFromBlocks(doc: EmailBuilderDocument): string {
+  const root = doc.root;
+  if (!root || !root.data.childrenIds) return '';
+  return extractTextRecursive(root.data.childrenIds, doc).trim();
+}
 
+// Convert email-builder JSON to HTML
+export function jsonToHtml(jsonContent: EmailBuilderDocument, theme?: EmailTheme): string {
+  const root = jsonContent.root;
+  if (!root || root.type !== 'EmailLayout') {
+    return '<div>Template-Fehler: Ungültiges Format</div>';
+  }
+
+  const tv = resolveTheme(theme, root.data as unknown as Record<string, unknown>);
+  let html = `<div style="font-family: ${tv.fontFamily}; color: ${tv.textColor};">`;
+  html += renderBlocksToHtml(root.data.childrenIds, jsonContent, tv);
+  html += `</div>`;
   return html;
 }
 
 // Sample data generators for each template type (for preview and testing)
 // NOTE: Variable names MUST match exactly with the placeholders in DEFAULT_TEMPLATES
-const SAMPLE_DATA: Record<EmailTemplateType, Record<string, string>> = {
-  poll_created: {
-    pollType: 'Terminumfrage',
-    pollTitle: 'Teammeeting Q1 2025',
-    publicLink: 'https://polly.example.com/poll/abc123',
-    adminLink: 'https://polly.example.com/admin/abc123',
-    siteName: 'Polly',
-  },
-  invitation: {
-    inviterName: 'Max Mustermann',
-    pollTitle: 'Teammeeting Q1 2025',
-    message: 'Bitte wähle die Termine aus, an denen du Zeit hast.',
-    publicLink: 'https://polly.example.com/poll/abc123',
-    siteName: 'Polly',
-  },
-  vote_confirmation: {
-    voterName: 'Anna Schmidt',
-    pollType: 'Terminumfrage',
-    pollTitle: 'Teammeeting Q1 2025',
-    publicLink: 'https://polly.example.com/poll/abc123',
-    resultsLink: 'https://polly.example.com/poll/abc123/results',
-    siteName: 'Polly',
-  },
-  reminder: {
-    senderName: 'Max Mustermann',
-    pollTitle: 'Teammeeting Q1 2025',
-    expiresAt: 'Die Umfrage endet am 31.12.2025 um 23:59 Uhr.',
-    pollLink: 'https://polly.example.com/poll/abc123',
-    siteName: 'Polly',
-  },
-  password_reset: {
-    userName: 'Max Mustermann',
-    resetLink: 'https://polly.example.com/auth/reset-password?token=xyz789',
-    siteName: 'Polly',
-  },
-  email_change: {
-    oldEmail: 'alte-email@example.com',
-    newEmail: 'neue-email@example.com',
-    confirmLink: 'https://polly.example.com/auth/confirm-email?token=xyz789',
-    siteName: 'Polly',
-  },
-  password_changed: {
-    userName: 'Max Mustermann',
-    siteName: 'Polly',
-  },
-  test_report: {
-    testRunId: '42',
-    status: 'Bestanden',
-    totalTests: '24',
-    passed: '22',
-    failed: '1',
-    skipped: '1',
-    duration: '12.5 Sekunden',
-    startedAt: new Date().toLocaleString('de-DE'),
-    siteName: 'Polly',
-  },
-  welcome: {
-    userName: 'Max Mustermann',
-    userEmail: 'max.mustermann@example.com',
-    verificationLink: 'https://polly.example.com/email-bestaetigen/abc123xyz789',
-    siteName: 'Polly',
-  },
+function getSampleData(siteName: string): Record<EmailTemplateType, Record<string, string>> {
+  return {
+    poll_created: {
+      pollType: 'Terminumfrage',
+      pollTitle: 'Teammeeting Q1 2025',
+      publicLink: 'https://polly.example.com/poll/abc123',
+      adminLink: 'https://polly.example.com/admin/abc123',
+      isRegisteredUser: '',
+      siteName,
+    },
+    invitation: {
+      inviterName: 'Max Mustermann',
+      pollTitle: 'Teammeeting Q1 2025',
+      message: 'Bitte wähle die Termine aus, an denen du Zeit hast.',
+      publicLink: 'https://polly.example.com/poll/abc123',
+      siteName,
+    },
+    vote_confirmation: {
+      voterName: 'Anna Schmidt',
+      pollType: 'Terminumfrage',
+      pollTitle: 'Teammeeting Q1 2025',
+      publicLink: 'https://polly.example.com/poll/abc123',
+      resultsLink: 'https://polly.example.com/poll/abc123/results',
+      siteName,
+    },
+    reminder: {
+      senderName: 'Max Mustermann',
+      pollTitle: 'Teammeeting Q1 2025',
+      expiresAt: 'Die Umfrage endet am 31.12.2025 um 23:59 Uhr.',
+      pollLink: 'https://polly.example.com/poll/abc123',
+      siteName,
+    },
+    password_reset: {
+      userName: 'Max Mustermann',
+      resetLink: 'https://polly.example.com/auth/reset-password?token=xyz789',
+      siteName,
+    },
+    email_change: {
+      oldEmail: 'alte-email@example.com',
+      newEmail: 'neue-email@example.com',
+      confirmLink: 'https://polly.example.com/auth/confirm-email?token=xyz789',
+      siteName,
+    },
+    password_changed: {
+      userName: 'Max Mustermann',
+      siteName,
+    },
+    test_report: {
+      testRunId: '42',
+      status: 'Bestanden',
+      totalTests: '24',
+      passed: '22',
+      failed: '1',
+      skipped: '1',
+      duration: '12.5 Sekunden',
+      startedAt: new Date().toLocaleString('de-DE'),
+      siteName,
+    },
+    welcome: {
+      userName: 'Max Mustermann',
+      userEmail: 'max.mustermann@example.com',
+      verificationLink: 'https://polly.example.com/email-bestaetigen/abc123xyz789',
+      siteName,
+    },
+    poll_finalized: {
+      pollTitle: 'Teammeeting Q1 2025',
+      pollType: 'schedule',
+      statusLabel: 'Termin bestätigt',
+      confirmedDate: 'Montag, 15. Januar 2025',
+      confirmedTime: '<strong>Uhrzeit:</strong> 14:00 – 15:00 Uhr',
+      pollLink: 'https://polly.example.com/poll/abc123',
+      buttonLink: 'https://polly.example.com/poll/abc123',
+      buttonLabel: 'Zur Umfrage \u2192',
+      resultsPublic: 'true',
+      siteName,
+    },
+  };
+}
+
+// ═══════════════════════════════════════════════════════════════
+// V3 TEMPLATE SYSTEM
+// Single-HTML-template approach with {{VARIABLE}} substitution
+// Replaces the old JSON-block + header/footer/dark-mode pipeline
+// ═══════════════════════════════════════════════════════════════
+
+interface V3TemplateData {
+  logoDataUri: string;
+  siteName: string;
+  siteAccent: string;
+  primaryColor: string;
+  secondaryColor: string;
+  siteUrl: string;
+  privacyUrl: string;
+  footerHtml: string;
+  footerText: string;
+  fontFamily: string;
+  subject: string;
+}
+
+function v3DarkModeCSS(accentColor: string): string {
+  const darkAccent = accentColor || '#e8994a';
+  return `@media (prefers-color-scheme: dark) {
+      body             { background-color: #0c111d !important; }
+      .shell           { background-color: #111827 !important; }
+      .email-header    { background-color: #0f1623 !important; border-bottom-color: rgba(255,255,255,0.07) !important; }
+      .hdr-sep         { background-color: rgba(255,255,255,0.08) !important; }
+      .hdr-site        { color: #7a8fa8 !important; }
+      .hdr-accent      { color: ${darkAccent} !important; }
+      .survey-tag      { color: ${darkAccent} !important; }
+      .headline        { color: #dde3ef !important; }
+      .headline-em     { color: ${darkAccent} !important; }
+      .subline         { color: #7a8fa8 !important; }
+      .sec-divider     { border-top-color: rgba(255,255,255,0.07) !important; }
+      .link-label      { color: #7a8fa8 !important; }
+      .link-title      { color: #dde3ef !important; }
+      .link-desc       { color: #7a8fa8 !important; }
+      .btn-primary     { background-color: ${darkAccent} !important; color: #ffffff !important; }
+      .btn-secondary   { background-color: rgba(201,123,46,0.12) !important; color: ${darkAccent} !important; }
+      .notice          { border-left-color: ${darkAccent} !important; color: #7a8fa8 !important; }
+      .notice-bold     { color: #dde3ef !important; }
+      .email-footer    { border-top-color: rgba(255,255,255,0.07) !important; }
+      .footer-text     { color: #3d5070 !important; }
+      .footer-link     { color: #7a8fa8 !important; border-bottom-color: #3d5070 !important; }
+    }`;
+}
+
+function v3Shell(data: V3TemplateData, bodyHtml: string): string {
+  const hdrFont = data.fontFamily;
+  const sysFont = 'system-ui, -apple-system, Arial, sans-serif';
+
+  const hasLogo = !!data.logoDataUri;
+  const hasName = !!(data.siteName || data.siteAccent);
+  const hasHeader = hasLogo || hasName;
+
+  const logoBlock = hasLogo
+    ? `<td style="width: 1px; white-space: nowrap;">
+            <img src="${data.logoDataUri}" alt="${htmlEscape(data.siteName + data.siteAccent) || 'Logo'}" width="100" style="display: block; height: 36px; width: auto; max-width: 100px;" />
+          </td>${hasName ? `
+          <td style="width: 1px; padding: 0 14px;">
+            <div class="hdr-sep" style="width: 1px; height: 22px; background-color: rgba(0,0,0,0.1);"></div>
+          </td>` : ''}`
+    : '';
+
+  const wordmark = hasName
+    ? `<td>
+            <span class="hdr-site" style="font-family: ${hdrFont}; font-size: 18px; font-weight: 400; letter-spacing: -0.01em; color: #6b7280; line-height: 1;">${htmlEscape(data.siteName)}</span>${data.siteAccent ? `<span class="hdr-accent" style="font-family: ${hdrFont}; font-size: 18px; font-weight: 400; letter-spacing: -0.01em; color: ${data.primaryColor}; line-height: 1;">${htmlEscape(data.siteAccent)}</span>` : ''}
+          </td>`
+    : '';
+
+  return `<!DOCTYPE html>
+<html lang="de">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta name="color-scheme" content="light dark">
+  <meta name="supported-color-schemes" content="light dark">
+  <title>${htmlEscape(data.subject)}</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body { background-color: #f0ede8; font-family: ${hdrFont}; -webkit-font-smoothing: antialiased; }
+    ${v3DarkModeCSS(data.primaryColor)}
+  </style>
+  <!--[if mso]>
+  <style type="text/css">
+    body, table, td { font-family: Arial, sans-serif !important; }
+  </style>
+  <![endif]-->
+</head>
+<body style="margin: 0; padding: 28px 16px; background-color: #f0ede8; font-family: ${hdrFont};">
+<table width="100%" cellpadding="0" cellspacing="0" role="presentation" style="max-width: 580px; margin: 0 auto;">
+<tr><td>
+<table class="shell" width="100%" cellpadding="0" cellspacing="0" role="presentation"
+  style="background-color: #ffffff; border-radius: 10px; overflow: hidden;">
+  ${hasHeader ? `<tr>
+    <td class="email-header"
+      style="background-color: #ffffff; padding: 14px 40px; border-bottom: 1px solid rgba(0,0,0,0.06);">
+      <a href="${htmlEscape(data.siteUrl)}" style="text-decoration: none; color: inherit; display: inline-block;">
+      <table cellpadding="0" cellspacing="0" role="presentation">
+        <tr>
+          ${logoBlock}
+          ${wordmark}
+        </tr>
+      </table>
+      </a>
+    </td>
+  </tr>` : ''}
+  ${bodyHtml}
+  <tr>
+    <td class="email-footer"
+      style="padding: 16px 40px 22px; border-top: 1px solid rgba(0,0,0,0.06); text-align: center;">
+      <p class="footer-text"
+        style="font-family: ${sysFont}; font-size: 12px; color: #b0bcd0; line-height: 1.7;">
+        ${data.footerHtml ? renderFooterMarkup(data.footerHtml, 'color: #9ba8bb; text-decoration: none; border-bottom: 1px solid #c8d0dc;') : (hasName ? `<a href="${htmlEscape(data.siteUrl)}" class="footer-link"
+          style="color: #9ba8bb; text-decoration: none; border-bottom: 1px solid #c8d0dc;">${htmlEscape(data.siteName + data.siteAccent)}</a>` : `<a href="${htmlEscape(data.siteUrl)}" class="footer-link"
+          style="color: #9ba8bb; text-decoration: none; border-bottom: 1px solid #c8d0dc;">${htmlEscape(data.siteUrl)}</a>`)}${data.privacyUrl ? `
+        <br>
+        <a href="${htmlEscape(data.privacyUrl)}" class="footer-link"
+          style="color: #9ba8bb; text-decoration: none; border-bottom: 1px solid #c8d0dc;">Datenschutz</a>` : ''}
+      </p>
+    </td>
+  </tr>
+</table>
+</td></tr>
+</table>
+</body>
+</html>`;
+}
+
+function v3Tag(text: string, accentColor?: string): string {
+  const color = accentColor || '#7a3800';
+  return `<p class="survey-tag" style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 11px; letter-spacing: 0.12em; text-transform: uppercase; color: ${color}; margin-bottom: 14px;">${htmlEscape(text)}</p>`;
+}
+
+function v3Headline(beforeEm: string, emText: string, afterEm: string, fontFamily: string, accentColor?: string): string {
+  const color = accentColor || '#7a3800';
+  return `<h1 class="headline" style="font-family: ${fontFamily}; font-size: 25px; font-weight: 400; line-height: 1.35; color: #1a202c; margin-bottom: 12px;">${beforeEm}${emText ? `<br><em class="headline-em" style="font-style: italic; color: ${color};">${emText}</em>` : ''}${afterEm ? `<br>${afterEm}` : ''}</h1>`;
+}
+
+function v3SimpleHeadline(text: string, fontFamily: string): string {
+  return `<h1 class="headline" style="font-family: ${fontFamily}; font-size: 25px; font-weight: 400; line-height: 1.35; color: #1a202c; margin-bottom: 12px;">${text}</h1>`;
+}
+
+function v3Subline(text: string): string {
+  return `<p class="subline" style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 14px; color: #4b5563; line-height: 1.7; margin-bottom: 30px;">${text}</p>`;
+}
+
+function v3Divider(): string {
+  return `<tr><td style="padding: 0 40px;"><div class="sec-divider" style="border-top: 1px solid rgba(0,0,0,0.06);"></div></td></tr>`;
+}
+
+function v3LinkSection(label: string, title: string, desc: string, buttonText: string, buttonUrl: string, buttonType: 'primary' | 'secondary', primaryColor: string, secondaryColor: string, fontFamily: string): string {
+  const bgColor = buttonType === 'primary' ? primaryColor : secondaryColor;
+  const textColor = ensureButtonTextContrast(bgColor, '#ffffff');
+  const cssClass = buttonType === 'primary' ? 'btn-primary' : 'btn-secondary';
+  return `<tr><td style="padding: 24px 40px 24px;">
+      <p class="link-label" style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 11px; letter-spacing: 0.1em; text-transform: uppercase; color: #6b7280; margin-bottom: 5px;">${label}</p>
+      <p class="link-title" style="font-family: ${fontFamily}; font-size: 17px; color: #1a202c; margin-bottom: 5px;">${title}</p>
+      <p class="link-desc" style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 13px; color: #4b5563; line-height: 1.6; margin-bottom: 18px;">${desc}</p>
+      <table cellpadding="0" cellspacing="0" role="presentation"><tr><td>
+        <a href="${htmlEscape(buttonUrl)}" class="${cssClass}" style="display: inline-block; font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 13px; font-weight: 500; letter-spacing: 0.02em; color: ${textColor}; background-color: ${bgColor}; padding: 10px 22px; border-radius: 6px; text-decoration: none;">${buttonText}</a>
+      </td></tr></table>
+    </td></tr>`;
+}
+
+function v3SingleButtonSection(text: string, buttonText: string, buttonUrl: string, buttonType: 'primary' | 'secondary', primaryColor: string, secondaryColor: string): string {
+  const bgColor = buttonType === 'primary' ? primaryColor : secondaryColor;
+  const textColor = ensureButtonTextContrast(bgColor, '#ffffff');
+  const cssClass = buttonType === 'primary' ? 'btn-primary' : 'btn-secondary';
+  return `<tr><td style="padding: 24px 40px 24px;">
+      <p class="link-desc" style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 13px; color: #4b5563; line-height: 1.6; margin-bottom: 18px;">${text}</p>
+      <table cellpadding="0" cellspacing="0" role="presentation"><tr><td>
+        <a href="${htmlEscape(buttonUrl)}" class="${cssClass}" style="display: inline-block; font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 13px; font-weight: 500; letter-spacing: 0.02em; color: ${textColor}; background-color: ${bgColor}; padding: 10px 22px; border-radius: 6px; text-decoration: none;">${buttonText}</a>
+      </td></tr></table>
+    </td></tr>`;
+}
+
+function v3Notice(boldText: string, text: string, primaryColor: string): string {
+  return `<tr><td style="padding: 0 40px 34px;">
+      <div class="notice" style="border-left: 2px solid ${primaryColor}; padding: 12px 16px; font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 13px; color: #4b5563; line-height: 1.65;">
+        <span class="notice-bold" style="color: #1a202c; font-weight: 500;">${boldText}</span> ${text}
+      </div>
+    </td></tr>`;
+}
+
+function v3TextBlock(html: string): string {
+  return `<tr><td style="padding: 12px 40px;">
+      <p class="link-desc" style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 13px; color: #4b5563; line-height: 1.6;">${html}</p>
+    </td></tr>`;
+}
+
+function v3BodyStart(): string {
+  return `<tr><td style="padding: 36px 40px 12px;">`;
+}
+
+function v3BodyEnd(): string {
+  return `</td></tr>`;
+}
+
+interface V3BodyContext {
+  primaryColor: string;
+  secondaryColor: string;
+  fontFamily: string;
+}
+
+function buildV3PollCreatedBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const pollType = vars.pollType || 'Umfrage';
+  const pollTitle = htmlEscape(vars.pollTitle || '');
+  const creatorName = htmlEscape(vars.creatorName || '');
+  const adminLink = vars.adminLink || '#';
+  const publicLink = vars.publicLink || '#';
+  const isRegistered = vars.isRegisteredUser === 'true';
+  const greeting = creatorName ? `Hallo ${creatorName}` : 'Hallo';
+
+  const subline = isRegistered
+    ? `${greeting} \u2014 unten befinden sich der Direktlink zur Umfrage sowie der Abstimmungslink f\u00FCr die Teilnehmer.`
+    : `${greeting} \u2014 unten befinden sich der pers\u00F6nliche Administratorlink sowie der Abstimmungslink f\u00FCr die Teilnehmer.`;
+
+  const noticeTitle = isRegistered
+    ? 'Diese E-Mail dient als Schnellzugriff.'
+    : 'Bitte diese E-Mail aufbewahren.';
+
+  const noticeBody = isRegistered
+    ? 'Registrierte Nutzer k\u00F6nnen die Umfrage jederzeit auch unter \u201EMeine Umfragen\u201C verwalten \u2014 nach der Anmeldung.'
+    : 'Diese E-Mail enth\u00E4lt den pers\u00F6nlichen Administratorlink \u2014 nur damit l\u00E4sst sich die Umfrage verwalten, bearbeiten und schlie\u00DFen.';
+
+  return `${v3BodyStart()}
+      ${v3Tag(pollType, ctx.primaryColor)}
+      ${v3Headline('Umfrage', `\u201E${pollTitle}\u201C`, 'wurde erstellt.', ctx.fontFamily, ctx.primaryColor)}
+      ${v3Subline(subline)}
+    ${v3BodyEnd()}
+    ${v3Divider()}
+    ${v3LinkSection('Administratorlink', 'Umfrage verwalten', 'Bearbeiten, schlie\u00DFen und Ergebnisse einsehen. Nicht weitergeben.', 'Zur Verwaltung \u2192', adminLink, 'primary', ctx.primaryColor, ctx.secondaryColor, ctx.fontFamily)}
+    ${v3Divider()}
+    ${v3LinkSection('\u00D6ffentlicher Link \u00B7 F\u00FCr Teilnehmer', 'Abstimmung \u00F6ffnen', 'Diesen Link an alle Teilnehmer weiterleiten, damit diese abstimmen k\u00F6nnen.', 'Zur Abstimmung \u2192', publicLink, 'secondary', ctx.primaryColor, ctx.secondaryColor, ctx.fontFamily)}
+    ${v3Notice(noticeTitle, noticeBody, ctx.primaryColor)}`;
+}
+
+function buildV3InvitationBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const inviterName = htmlEscape(vars.inviterName || '');
+  const pollTitle = htmlEscape(vars.pollTitle || '');
+  const message = vars.message ? htmlEscape(vars.message) : '';
+  const publicLink = vars.publicLink || '#';
+
+  return `${v3BodyStart()}
+      ${v3Tag('Einladung', ctx.primaryColor)}
+      ${v3Headline('Einladung zur Abstimmung', `\u201E${pollTitle}\u201C`, '', ctx.fontFamily, ctx.primaryColor)}
+      ${v3Subline(`${inviterName} l\u00E4dt Sie ein, an dieser Umfrage teilzunehmen.${message ? ` ${message}` : ''}`)}
+    ${v3BodyEnd()}
+    ${v3Divider()}
+    ${v3SingleButtonSection('Klicken Sie auf den Button, um zur Abstimmung zu gelangen.', 'Jetzt abstimmen \u2192', publicLink, 'primary', ctx.primaryColor, ctx.secondaryColor)}`;
+}
+
+function buildV3ReminderBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const senderName = htmlEscape(vars.senderName || '');
+  const pollTitle = htmlEscape(vars.pollTitle || '');
+  const expiresAt = vars.expiresAt ? htmlEscape(vars.expiresAt) : '';
+  const pollLink = vars.pollLink || '#';
+
+  return `${v3BodyStart()}
+      ${v3Tag('Erinnerung', ctx.primaryColor)}
+      ${v3Headline('Erinnerung an', `\u201E${pollTitle}\u201C`, '', ctx.fontFamily, ctx.primaryColor)}
+      ${v3Subline(`${senderName} erinnert Sie freundlich an die Teilnahme. Ihre Stimme ist wichtig!${expiresAt ? ` ${expiresAt}` : ''}`)}
+    ${v3BodyEnd()}
+    ${v3Divider()}
+    ${v3SingleButtonSection('Bitte nehmen Sie sich kurz Zeit, um abzustimmen.', 'Jetzt abstimmen \u2192', pollLink, 'primary', ctx.primaryColor, ctx.secondaryColor)}`;
+}
+
+function buildV3VoteConfirmationBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const voterName = htmlEscape(vars.voterName || '');
+  const pollTitle = htmlEscape(vars.pollTitle || '');
+  const pollType = vars.pollType || 'Umfrage';
+  const resultsLink = vars.resultsLink || '#';
+  const greeting = voterName ? `Hallo ${voterName}` : 'Hallo';
+
+  return `${v3BodyStart()}
+      ${v3Tag('Best\u00E4tigung', ctx.primaryColor)}
+      ${v3SimpleHeadline('Vielen Dank f\u00FCr Ihre Teilnahme!', ctx.fontFamily)}
+      ${v3Subline(`${greeting} \u2014 vielen Dank f\u00FCr Ihre Teilnahme an der ${htmlEscape(pollType)} \u201E${pollTitle}\u201C. Ihre Auswahl wurde erfolgreich gespeichert.`)}
+    ${v3BodyEnd()}
+    ${v3Divider()}
+    ${v3SingleButtonSection('Mit diesem Link k\u00F6nnen Sie jederzeit zur Umfrage zur\u00FCckkehren oder die aktuellen Ergebnisse einsehen.', 'Ergebnisse anzeigen \u2192', resultsLink, 'secondary', ctx.primaryColor, ctx.secondaryColor)}`;
+}
+
+function buildV3PasswordResetBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const userName = htmlEscape(vars.userName || '');
+  const resetLink = vars.resetLink || '#';
+  const greeting = userName ? `Hallo ${userName}` : 'Hallo';
+
+  return `${v3BodyStart()}
+      ${v3Tag('Sicherheit', ctx.primaryColor)}
+      ${v3SimpleHeadline('Passwort zur\u00FCcksetzen', ctx.fontFamily)}
+      ${v3Subline(`${greeting} \u2014 Sie haben angefordert, Ihr Passwort zur\u00FCckzusetzen.`)}
+    ${v3BodyEnd()}
+    ${v3Divider()}
+    ${v3SingleButtonSection('Klicken Sie auf den folgenden Button, um ein neues Passwort zu vergeben. Dieser Link ist 1 Stunde g\u00FCltig.', 'Passwort zur\u00FCcksetzen \u2192', resetLink, 'primary', ctx.primaryColor, ctx.secondaryColor)}
+    ${v3Notice('Falls Sie diese Anfrage nicht gestellt haben,', 'k\u00F6nnen Sie diese E-Mail ignorieren. Ihr Passwort bleibt unver\u00E4ndert.', ctx.primaryColor)}`;
+}
+
+function buildV3EmailChangeBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const oldEmail = htmlEscape(vars.oldEmail || '');
+  const newEmail = htmlEscape(vars.newEmail || '');
+  const confirmLink = vars.confirmLink || '#';
+
+  return `${v3BodyStart()}
+      ${v3Tag('Sicherheit', ctx.primaryColor)}
+      ${v3SimpleHeadline('E-Mail-Adresse best\u00E4tigen', ctx.fontFamily)}
+      ${v3Subline('Sie haben angefordert, Ihre E-Mail-Adresse zu \u00E4ndern.')}
+    ${v3BodyEnd()}
+    ${v3TextBlock(`<strong>Alte E-Mail:</strong> ${oldEmail}<br><strong>Neue E-Mail:</strong> ${newEmail}`)}
+    ${v3Divider()}
+    ${v3SingleButtonSection('Dieser Link ist 24 Stunden g\u00FCltig.', 'E-Mail best\u00E4tigen \u2192', confirmLink, 'primary', ctx.primaryColor, ctx.secondaryColor)}
+    ${v3Notice('Falls Sie diese Anfrage nicht gestellt haben,', 'k\u00F6nnen Sie diese E-Mail ignorieren.', ctx.primaryColor)}`;
+}
+
+function buildV3PasswordChangedBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const userName = htmlEscape(vars.userName || '');
+  const greeting = userName ? `Hallo ${userName}` : 'Hallo';
+
+  return `${v3BodyStart()}
+      ${v3Tag('Sicherheit', ctx.primaryColor)}
+      ${v3SimpleHeadline('Passwort erfolgreich ge\u00E4ndert', ctx.fontFamily)}
+      ${v3Subline(`${greeting} \u2014 Ihr Passwort wurde erfolgreich ge\u00E4ndert.`)}
+    ${v3BodyEnd()}
+    ${v3Notice('Falls Sie diese \u00C4nderung nicht vorgenommen haben,', 'kontaktieren Sie bitte umgehend den Administrator.', ctx.primaryColor)}`;
+}
+
+function buildV3TestReportBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const status = htmlEscape(vars.status || '');
+  const testRunId = htmlEscape(vars.testRunId || '');
+  const totalTests = htmlEscape(vars.totalTests || '0');
+  const passed = htmlEscape(vars.passed || '0');
+  const failed = htmlEscape(vars.failed || '0');
+  const skipped = htmlEscape(vars.skipped || '0');
+  const duration = htmlEscape(vars.duration || '');
+  const startedAt = htmlEscape(vars.startedAt || '');
+
+  return `${v3BodyStart()}
+      ${v3Tag('Testbericht', ctx.primaryColor)}
+      ${v3SimpleHeadline(`${status} \u2014 Testlauf #${testRunId}`, ctx.fontFamily)}
+      ${v3Subline('Der automatische Testlauf wurde abgeschlossen.')}
+    ${v3BodyEnd()}
+    ${v3TextBlock(`Gesamte Tests: <strong>${totalTests}</strong><br>Bestanden: <strong>${passed}</strong><br>Fehlgeschlagen: <strong>${failed}</strong><br>\u00DCbersprungen: <strong>${skipped}</strong><br>Dauer: <strong>${duration}</strong><br>Gestartet: <strong>${startedAt}</strong>`)}`;
+}
+
+function buildV3WelcomeBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const userName = htmlEscape(vars.userName || '');
+  const verificationLink = vars.verificationLink || '#';
+  const siteName = htmlEscape(vars.siteName || '');
+  const greeting = userName ? `Hallo ${userName}` : 'Hallo';
+
+  return `${v3BodyStart()}
+      ${v3Tag('Willkommen', ctx.primaryColor)}
+      ${v3SimpleHeadline(`Willkommen bei ${siteName}!`, ctx.fontFamily)}
+      ${v3Subline(`${greeting} \u2014 vielen Dank f\u00FCr Ihre Registrierung! Ihr Account wurde erfolgreich erstellt.`)}
+    ${v3BodyEnd()}
+    ${v3Divider()}
+    ${v3SingleButtonSection('Bitte best\u00E4tigen Sie Ihre E-Mail-Adresse, um alle Funktionen nutzen zu k\u00F6nnen.', 'E-Mail best\u00E4tigen \u2192', verificationLink, 'secondary', ctx.primaryColor, ctx.secondaryColor)}`;
+}
+
+function buildV3PollFinalizedBody(vars: Record<string, string | undefined>, ctx: V3BodyContext): string {
+  const pollTitle = htmlEscape(vars.pollTitle || '');
+  const pollType = vars.pollType || 'schedule';
+  const pollLink = vars.pollLink || '#';
+  const buttonLink = vars.buttonLink || pollLink;
+  const buttonLabel = vars.buttonLabel || 'Zur Umfrage \u2192';
+
+  if (pollType === 'schedule') {
+    const confirmedDate = htmlEscape(vars.confirmedDate || '');
+    const confirmedTime = vars.confirmedTime || '';
+    const videoConferenceUrl = vars.videoConferenceUrl || '';
+    const videoLine = videoConferenceUrl
+      ? `<br/><strong>Videokonferenz:</strong> <a href="${htmlEscape(videoConferenceUrl)}" style="color:${ctx.primaryColor};text-decoration:underline;">${htmlEscape(videoConferenceUrl)}</a>`
+      : '';
+    return `${v3BodyStart()}
+      ${v3Tag('Termin bestätigt', ctx.primaryColor)}
+      ${v3Headline('Termin festgelegt für', `\u201E${pollTitle}\u201C`, '', ctx.fontFamily, ctx.primaryColor)}
+      ${v3Subline(`<strong>Datum:</strong> ${confirmedDate}${confirmedTime ? `<br/>${confirmedTime}` : ''}${videoLine}<br/><br/>Im Anhang finden Sie eine Kalendereinladung (.ics), die Sie direkt in Ihren Kalender importieren können.`)}
+    ${v3BodyEnd()}
+    ${v3Divider()}
+    ${v3SingleButtonSection('Klicken Sie auf den Button, um die Umfrage und Ergebnisse einzusehen.', buttonLabel, buttonLink, 'primary', ctx.primaryColor, ctx.secondaryColor)}`;
+  }
+
+  // Survey / orga: "poll ended" notification
+  const resultsPublic = vars.resultsPublic !== 'false';
+  const resultNote = resultsPublic
+    ? 'Die Ergebnisse sind öffentlich einsehbar – klicken Sie auf den Button, um sie anzuzeigen.'
+    : 'Der Ersteller hat die Ergebnisse nicht öffentlich gemacht.';
+
+  const finalOptionText = vars.finalOptionText || '';
+  const slotSummaryHtml = vars.slotSummaryHtml || '';
+
+  let extraBlock = '';
+  if (finalOptionText) {
+    extraBlock = `<tr><td style="padding: 0 40px 16px;">
+      <p style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 14px; color: #4b5563; margin: 0;">
+        <strong>Festgelegtes Ergebnis:</strong> ${finalOptionText}
+      </p>
+    </td></tr>`;
+  } else if (slotSummaryHtml) {
+    extraBlock = `<tr><td style="padding: 0 40px 16px;">
+      <p style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 14px; color: #4b5563; margin: 0 0 4px 0;"><strong>Slot-Übersicht:</strong></p>
+      <div style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 14px; color: #4b5563;">${slotSummaryHtml}</div>
+    </td></tr>`;
+  }
+
+  return `${v3BodyStart()}
+      ${v3Tag('Umfrage beendet', ctx.primaryColor)}
+      ${v3Headline('Die Umfrage wurde abgeschlossen:', `\u201E${pollTitle}\u201C`, '', ctx.fontFamily, ctx.primaryColor)}
+      ${v3Subline(resultNote)}
+    ${v3BodyEnd()}
+    ${extraBlock}
+    ${v3Divider()}
+    ${v3SingleButtonSection('', buttonLabel, buttonLink, 'primary', ctx.primaryColor, ctx.secondaryColor)}`;
+}
+
+function buildV3GenericBody(bodyHtml: string, fontFamily: string): string {
+  return `${v3BodyStart()}
+      <div style="font-family: system-ui, -apple-system, Arial, sans-serif; font-size: 14px; color: #4b5563; line-height: 1.7;">
+        ${bodyHtml}
+      </div>
+    ${v3BodyEnd()}`;
+}
+
+const V3_BODY_BUILDERS: Record<string, (vars: Record<string, string | undefined>, ctx: V3BodyContext) => string> = {
+  poll_created: buildV3PollCreatedBody,
+  invitation: buildV3InvitationBody,
+  reminder: buildV3ReminderBody,
+  vote_confirmation: buildV3VoteConfirmationBody,
+  password_reset: buildV3PasswordResetBody,
+  email_change: buildV3EmailChangeBody,
+  password_changed: buildV3PasswordChangedBody,
+  test_report: buildV3TestReportBody,
+  welcome: buildV3WelcomeBody,
+  poll_finalized: buildV3PollFinalizedBody,
 };
 
 export class EmailTemplateService {
@@ -650,9 +1518,11 @@ export class EmailTemplateService {
     return substituteVariables(template, variables, escapeHtml);
   }
 
-  // Static method: Get sample data for preview/testing
-  static getSampleDataForType(type: string): Record<string, string> {
-    return SAMPLE_DATA[type as EmailTemplateType] || {};
+  static async getSampleDataForType(type: string): Promise<Record<string, string>> {
+    const customization = await storage.getCustomizationSettings();
+    const siteName = `${customization.branding.siteName}${customization.branding.siteNameAccent}`;
+    const data = getSampleData(siteName);
+    return data[type as EmailTemplateType] || {};
   }
 
   // Static method: Render template to HTML
@@ -665,7 +1535,9 @@ export class EmailTemplateService {
       throw new Error(`Unknown template type: ${type}`);
     }
     
-    // Substitute variables in JSON content first
+    const service = new EmailTemplateService();
+    const emailTheme = await service.getEmailTheme();
+    
     const jsonStr = substituteVariables(
       JSON.stringify(defaultData.jsonContent),
       variables,
@@ -673,7 +1545,7 @@ export class EmailTemplateService {
     );
     const renderedJson = JSON.parse(jsonStr) as EmailBuilderDocument;
     
-    return jsonToHtml(renderedJson);
+    return jsonToHtml(renderedJson, emailTheme);
   }
 
   // Get all templates (from DB or defaults)
@@ -748,26 +1620,14 @@ export class EmailTemplateService {
     let htmlContent: string;
     let textContent: string;
     
+    const currentTheme = await this.getEmailTheme();
+    
     if (textContentOverride) {
-      // User edited the text content - generate simple HTML from it
       textContent = textContentOverride;
-      htmlContent = this.textToSimpleHtmlWithTheme(textContent, DEFAULT_EMAIL_THEME);
+      htmlContent = this.textToSimpleHtmlWithTheme(textContent, currentTheme);
     } else {
-      // Generate from JSON as before
-      htmlContent = jsonToHtml(jsonContent as EmailBuilderDocument);
-      textContent = '';
-      const root = (jsonContent as EmailBuilderDocument).root;
-      if (root && root.data.childrenIds) {
-        for (const blockId of root.data.childrenIds) {
-          const block = (jsonContent as EmailBuilderDocument)[blockId];
-          if (block) {
-            const props = (block.data as Record<string, unknown>).props as Record<string, unknown> | undefined;
-            if (props?.text) {
-              textContent += props.text + '\n\n';
-            }
-          }
-        }
-      }
+      htmlContent = jsonToHtml(jsonContent as EmailBuilderDocument, currentTheme);
+      textContent = extractTextFromBlocks(jsonContent as EmailBuilderDocument);
     }
 
     return await storage.upsertEmailTemplate({
@@ -790,18 +1650,20 @@ export class EmailTemplateService {
   }
 
   // Get email footer from system settings
+  static readonly DEFAULT_FOOTER = 'Diese E-Mail wurde automatisch von {{siteName}} erstellt.\n{{link:#|Datenschutz}}';
+
   async getEmailFooter(): Promise<{ html: string; text: string }> {
     const setting = await storage.getSetting('email_footer');
     if (setting?.value) {
       const footerData = setting.value as { html?: string; text?: string };
       return {
-        html: footerData.html || 'Diese E-Mail wurde automatisch von {{siteName}} erstellt.',
-        text: footerData.text || 'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
+        html: footerData.html || EmailTemplateService.DEFAULT_FOOTER,
+        text: footerData.text || EmailTemplateService.DEFAULT_FOOTER
       };
     }
     return {
-      html: 'Diese E-Mail wurde automatisch von {{siteName}} erstellt.',
-      text: 'Diese E-Mail wurde automatisch von {{siteName}} erstellt.'
+      html: EmailTemplateService.DEFAULT_FOOTER,
+      text: EmailTemplateService.DEFAULT_FOOTER
     };
   }
 
@@ -834,13 +1696,16 @@ export class EmailTemplateService {
     return newTheme;
   }
 
-  // Reset email theme to defaults based on system branding settings
   async resetEmailTheme(): Promise<EmailTheme> {
-    // Get primary color from system branding settings
-    const primaryColorSetting = await storage.getSetting('primary_color');
-    const primaryColor = (primaryColorSetting?.value as string) || '#FF6B35';
+    const customization = await storage.getCustomizationSettings();
+    const primaryColor = customization.theme?.primaryColor || '#FF6B35';
+    const secondaryColor = customization.theme?.secondaryColor || '#4A90A4';
+    
+    const lighterPrimary = lightenColorByPercent(primaryColor, 30);
+    
+    const primaryTextColor = ensureButtonTextContrast(primaryColor, '#FFFFFF');
+    const secondaryTextColor = ensureButtonTextContrast(secondaryColor, '#FFFFFF');
     
-    // Create theme based on branding
     const brandedTheme: EmailTheme = {
       backdropColor: '#F5F5F5',
       canvasColor: '#FFFFFF',
@@ -848,9 +1713,15 @@ export class EmailTemplateService {
       headingColor: primaryColor,
       linkColor: primaryColor,
       buttonBackgroundColor: primaryColor,
-      buttonTextColor: '#FFFFFF',
+      buttonTextColor: primaryTextColor,
       buttonBorderRadius: 6,
-      fontFamily: 'Arial, sans-serif'
+      fontFamily: 'Arial, sans-serif',
+      secondaryButtonBackgroundColor: secondaryColor,
+      secondaryButtonTextColor: secondaryTextColor,
+      darkBackdropColor: '#1a1a2e',
+      darkCanvasColor: '#16213e',
+      darkTextColor: '#e0e0e0',
+      darkHeadingColor: lighterPrimary,
     };
     
     await storage.setSetting({
@@ -890,48 +1761,56 @@ export class EmailTemplateService {
         if (font) theme.fontFamily = font;
       }
       
-      // Extract styles from blocks with sanitization
-      const childrenIds = (root?.data as Record<string, unknown>)?.childrenIds;
-      const blockIds = Array.isArray(childrenIds) ? childrenIds.filter(id => typeof id === 'string') : [];
-      
-      for (const blockId of blockIds) {
-        const block = doc[blockId] as { type?: string; data?: Record<string, unknown> } | undefined;
-        if (!block || typeof block !== 'object') continue;
-        
-        const blockData = block.data;
-        if (!blockData || typeof blockData !== 'object') continue;
-        
-        const style = blockData.style as Record<string, unknown> | undefined;
-        if (!style || typeof style !== 'object') continue;
-        
-        switch (block.type) {
-          case 'Heading': {
-            const color = sanitizeColor(style.color);
-            if (color) theme.headingColor = color;
-            break;
-          }
-          case 'Text': {
-            const color = sanitizeColor(style.color);
-            if (color && !theme.textColor) theme.textColor = color;
-            break;
+      const extractFromBlockIds = (ids: unknown[]) => {
+        const blockIds = ids.filter(id => typeof id === 'string') as string[];
+        for (const blockId of blockIds) {
+          const block = doc[blockId] as { type?: string; data?: Record<string, unknown> } | undefined;
+          if (!block || typeof block !== 'object') continue;
+          
+          const blockData = block.data;
+          if (!blockData || typeof blockData !== 'object') continue;
+          
+          const style = blockData.style as Record<string, unknown> | undefined;
+          
+          if (block.type === 'Container') {
+            const childIds = blockData.childrenIds;
+            if (Array.isArray(childIds)) extractFromBlockIds(childIds);
+            continue;
           }
-          case 'Button': {
-            const bgColor = sanitizeColor(style.backgroundColor);
-            if (bgColor) {
-              theme.buttonBackgroundColor = bgColor;
-              // Also use button color as link color if not set
-              if (!theme.linkColor) theme.linkColor = bgColor;
+          
+          if (!style || typeof style !== 'object') continue;
+          
+          switch (block.type) {
+            case 'Heading': {
+              const color = sanitizeColor(style.color);
+              if (color) theme.headingColor = color;
+              break;
+            }
+            case 'Text': {
+              const color = sanitizeColor(style.color);
+              if (color && !theme.textColor) theme.textColor = color;
+              break;
+            }
+            case 'Button': {
+              const bgColor = sanitizeColor(style.backgroundColor);
+              if (bgColor) {
+                theme.buttonBackgroundColor = bgColor;
+                if (!theme.linkColor) theme.linkColor = bgColor;
+              }
+              
+              const textColor = sanitizeColor(style.color);
+              if (textColor) theme.buttonTextColor = textColor;
+              
+              const radius = sanitizeBorderRadius(style.borderRadius);
+              if (radius !== null) theme.buttonBorderRadius = radius;
+              break;
             }
-            
-            const textColor = sanitizeColor(style.color);
-            if (textColor) theme.buttonTextColor = textColor;
-            
-            const radius = sanitizeBorderRadius(style.borderRadius);
-            if (radius !== null) theme.buttonBorderRadius = radius;
-            break;
           }
         }
-      }
+      };
+
+      const childrenIds = (root?.data as Record<string, unknown>)?.childrenIds;
+      if (Array.isArray(childrenIds)) extractFromBlockIds(childrenIds);
     } catch (error) {
       console.error('Error extracting theme from emailbuilder JSON:', error);
     }
@@ -945,35 +1824,6 @@ export class EmailTemplateService {
     return await this.setEmailTheme(extractedTheme);
   }
 
-  // Generate email header HTML with branding
-  private generateHeaderHtml(branding: {
-    siteName: string;
-    siteNameAccent: string;
-    logoUrl?: string;
-    primaryColor?: string;
-  }): string {
-    const fullName = `${branding.siteName}${branding.siteNameAccent}`;
-    const primaryColor = branding.primaryColor || '#FF6B35';
-    
-    let logoHtml = '';
-    if (branding.logoUrl) {
-      logoHtml = `<img src="${branding.logoUrl}" alt="${fullName}" style="max-height: 40px; max-width: 40px; vertical-align: middle;" />`;
-    }
-    
-    return `
-      <table width="100%" cellpadding="0" cellspacing="0" style="background-color: ${primaryColor}; padding: 12px 24px;">
-        <tr>
-          <td style="text-align: left; vertical-align: middle;">
-            ${logoHtml ? `<span style="display: inline-block; margin-right: 12px; vertical-align: middle;">${logoHtml}</span>` : ''}
-            <h1 style="color: #FFFFFF; font-size: 22px; font-weight: bold; margin: 0; font-family: Arial, sans-serif; display: inline-block; vertical-align: middle;">
-              ${htmlEscape(branding.siteName)}<span style="font-weight: normal;">${htmlEscape(branding.siteNameAccent)}</span>
-            </h1>
-          </td>
-        </tr>
-      </table>
-    `;
-  }
-
   // Convert plain text to simple HTML for email body (with theme support)
   private textToSimpleHtmlWithTheme(text: string, theme: EmailTheme): string {
     const escapedText = htmlEscape(text);
@@ -991,14 +1841,18 @@ export class EmailTemplateService {
     return html;
   }
 
-  // Generate email footer HTML (with theme support)
   private generateFooterHtmlWithTheme(footerText: string, theme: EmailTheme): string {
     return `
-      <table width="100%" cellpadding="0" cellspacing="0" style="border-top: 1px solid #e0e0e0; margin-top: 24px;">
+      <table width="100%" cellpadding="0" cellspacing="0" style="margin-top: 16px;">
         <tr>
-          <td style="padding: 16px 24px; text-align: center;">
-            <p style="color: #6c757d; font-size: 12px; margin: 0; font-family: ${theme.fontFamily};">
-              ${footerText}
+          <td style="padding: 0 24px;">
+            <div style="border-top: 1px solid #e9ecef;"></div>
+          </td>
+        </tr>
+        <tr>
+          <td style="padding: 20px 24px 24px; text-align: center;">
+            <p class="email-footer-text" style="color: #999999; font-size: 12px; margin: 0; line-height: 1.5; font-family: ${theme.fontFamily};">
+              ${renderFooterMarkup(footerText, 'color: #999999; text-decoration: underline;')}
             </p>
           </td>
         </tr>
@@ -1006,87 +1860,231 @@ export class EmailTemplateService {
     `;
   }
 
-  // Render a template with variables
+  private async resolveLogoDataUri(logoUrl?: string): Promise<string> {
+    if (!logoUrl) return '';
+    if (logoUrl.startsWith('data:')) {
+      if (/^data:image\/(png|jpeg|jpg|gif|svg\+xml|webp);base64,[A-Za-z0-9+/=]+$/.test(logoUrl)) {
+        return logoUrl;
+      }
+      return '';
+    }
+    if (logoUrl.startsWith('/uploads/')) {
+      return (await readLocalLogoAsBase64(logoUrl)) || '';
+    }
+    return (await fetchLogoAsBase64(logoUrl)) || '';
+  }
+
+  private resolvePrivacyUrl(customization: any): string {
+    try {
+      const footer = customization?.footer;
+      if (footer?.supportLinks && Array.isArray(footer.supportLinks)) {
+        const privacyLink = footer.supportLinks.find(
+          (link: { label?: string; url?: string }) =>
+            link.label?.toLowerCase().includes('datenschutz') ||
+            link.label?.toLowerCase().includes('privacy')
+        );
+        if (privacyLink?.url && privacyLink.url !== '#') return privacyLink.url;
+      }
+    } catch {}
+    return '';
+  }
+
+  private async buildV3TemplateData(
+    customization: any,
+    emailTheme: EmailTheme,
+    subject: string
+  ): Promise<V3TemplateData> {
+    const { getBaseUrl } = await import('../utils/baseUrl');
+    const siteUrl = getBaseUrl();
+    const logoDataUri = await this.resolveLogoDataUri(customization.branding.logoUrl || undefined);
+    const footer = await this.getEmailFooter();
+    const fullSiteName = `${customization.branding.siteName || ''}${customization.branding.siteNameAccent || ''}`;
+    const privacyUrl = this.resolvePrivacyUrl(customization);
+    const hasFooterPrivacyPlaceholder = /\{\{link:#\|/.test(footer.html);
+    const resolveFooterVars = (text: string) => {
+      let result = text
+        .replace(/\{\{siteName\}\}/g, fullSiteName)
+        .replace(/\{\{siteUrl\}\}/g, siteUrl);
+      if (privacyUrl && hasFooterPrivacyPlaceholder) {
+        result = result.replace(/\{\{link:#\|/g, `{{link:${privacyUrl}|`);
+      }
+      return result;
+    };
+    const footerHtml = resolveFooterVars(footer.html);
+    const footerText = stripFooterMarkupToText(resolveFooterVars(footer.text));
+
+    return {
+      logoDataUri,
+      siteName: customization.branding.siteName || '',
+      siteAccent: customization.branding.siteNameAccent || '',
+      primaryColor: emailTheme.buttonBackgroundColor || DEFAULT_EMAIL_THEME.buttonBackgroundColor,
+      secondaryColor: emailTheme.secondaryButtonBackgroundColor || DEFAULT_EMAIL_THEME.secondaryButtonBackgroundColor,
+      siteUrl,
+      privacyUrl: hasFooterPrivacyPlaceholder ? '' : privacyUrl,
+      footerHtml,
+      footerText,
+      fontFamily: emailTheme.fontFamily || DEFAULT_EMAIL_THEME.fontFamily,
+      subject,
+    };
+  }
+
+  // Render a template with variables — V3 template system
   async renderEmail(
     type: EmailTemplateType,
     variables: Record<string, string | undefined>
   ): Promise<{ subject: string; html: string; text: string }> {
     const template = await this.getTemplate(type);
-    
-    // Get branding settings
     const customization = await storage.getCustomizationSettings();
     const siteName = `${customization.branding.siteName}${customization.branding.siteNameAccent}`;
-    const primaryColor = customization.theme?.primaryColor || '#FF6B35';
-    
-    // Get email theme settings
     const emailTheme = await this.getEmailTheme();
-    
-    // Get centralized footer
-    const footer = await this.getEmailFooter();
-    
-    // Add siteName to variables if not provided
-    const allVariables = { siteName, ...variables };
-    
-    // Render subject
-    const subject = renderTemplate(template.subject, allVariables);
-    
-    // Render body HTML
-    // Priority: stored htmlContent > textContent (for customized) > generated from JSON
+    const allVariables: Record<string, string | undefined> = { siteName, ...variables };
+
+    const rawSubject = renderTemplate(template.subject, allVariables);
+    const subject = rawSubject.replace(/^\[\]\s*/, '');
+
+    const v3Builder = V3_BODY_BUILDERS[type];
+    if (template.isDefault && v3Builder) {
+      const v3Data = await this.buildV3TemplateData(customization, emailTheme, subject);
+      const ctx: V3BodyContext = {
+        primaryColor: v3Data.primaryColor,
+        secondaryColor: v3Data.secondaryColor,
+        fontFamily: v3Data.fontFamily,
+      };
+      const bodyHtml = v3Builder(allVariables, ctx);
+      const html = v3Shell(v3Data, bodyHtml);
+      let textBase = template.textContent || '';
+      if (type === 'poll_created' && allVariables.isRegisteredUser === 'true') {
+        textBase = textBase
+          .replace(/Den Administratorlink sicher aufbewahren\. Nur damit l\u00E4sst sich die Umfrage verwalten\./,
+            'Diese E-Mail dient als Schnellzugriff. Registrierte Nutzer k\u00F6nnen die Umfrage jederzeit auch unter \u201EMeine Umfragen\u201C verwalten.');
+      }
+      if (/\n---\nDiese E-Mail wurde automatisch vo[nm]/.test(textBase)) {
+        textBase = textBase.replace(/\n---\nDiese E-Mail wurde automatisch vo[nm][^\n]*$/, `\n---\n${v3Data.footerText}`);
+      } else if (v3Data.footerText) {
+        textBase = textBase.trimEnd() + `\n\n---\n${v3Data.footerText}`;
+      }
+      const text = renderTemplate(textBase, allVariables);
+      return { subject, html, text };
+    }
+
     let bodyHtml: string;
-    if (template.htmlContent && !template.isDefault) {
-      // Use stored HTML for customized templates
-      bodyHtml = renderTemplate(template.htmlContent, allVariables);
-    } else if (template.textContent && !template.isDefault) {
-      // Use textContent with theme for customized templates
-      const renderedText = renderTemplate(template.textContent, allVariables);
+    if (!template.isDefault && template.textContent) {
+      const renderedText = substituteVariables(template.textContent, allVariables, false);
       bodyHtml = this.textToSimpleHtmlWithTheme(renderedText, emailTheme);
-    } else if (template.isDefault) {
-      // For default templates, generate from JSON
-      const renderedJson = JSON.parse(
-        renderTemplate(JSON.stringify(template.jsonContent), allVariables)
-      ) as EmailBuilderDocument;
-      bodyHtml = jsonToHtml(renderedJson);
+    } else if (template.htmlContent) {
+      bodyHtml = substituteVariables(template.htmlContent, allVariables, true);
     } else {
-      // Fallback to JSON-based rendering
-      const renderedJson = JSON.parse(
-        renderTemplate(JSON.stringify(template.jsonContent), allVariables)
-      ) as EmailBuilderDocument;
-      bodyHtml = jsonToHtml(renderedJson);
+      bodyHtml = '<p>Template-Fehler: Kein Inhalt verf\u00FCgbar</p>';
     }
-    
-    // Generate header with branding
-    const headerHtml = this.generateHeaderHtml({
-      siteName: customization.branding.siteName,
-      siteNameAccent: customization.branding.siteNameAccent,
-      logoUrl: customization.branding.logoUrl || undefined,
-      primaryColor
-    });
-    
-    // Render footer with variables
-    const footerHtmlRendered = renderTemplate(footer.html, allVariables);
-    const footerHtml = this.generateFooterHtmlWithTheme(footerHtmlRendered, emailTheme);
-    
-    // Compose full HTML email with theme colors
-    const html = `
+
+    const v3Data = await this.buildV3TemplateData(customization, emailTheme, subject);
+    const wrappedBody = buildV3GenericBody(bodyHtml, v3Data.fontFamily);
+    const html = v3Shell(v3Data, wrappedBody);
+    let textFallback = template.textContent || '';
+    if (/\n---\nDiese E-Mail wurde automatisch vo[nm]/.test(textFallback)) {
+      textFallback = textFallback.replace(/\n---\nDiese E-Mail wurde automatisch vo[nm][^\n]*$/, `\n---\n${v3Data.footerText}`);
+    } else if (v3Data.footerText) {
+      textFallback = textFallback.trimEnd() + `\n\n---\n${v3Data.footerText}`;
+    }
+    const text = renderTemplate(textFallback, allVariables);
+    return { subject, html, text };
+  }
+
+  async wrapWithEmailTheme(
+    subject: string,
+    bodyHtml: string,
+    plainText: string
+  ): Promise<{ subject: string; html: string; text: string }> {
+    const customization = await storage.getCustomizationSettings();
+    const emailTheme = await this.getEmailTheme();
+
+    const v3Data = await this.buildV3TemplateData(customization, emailTheme, subject);
+    const wrappedBody = buildV3GenericBody(bodyHtml, v3Data.fontFamily);
+    const html = v3Shell(v3Data, wrappedBody);
+
+    let text = plainText;
+    if (/\n---\nDiese E-Mail wurde automatisch vo[nm]/.test(text)) {
+      text = text.replace(/\n---\nDiese E-Mail wurde automatisch vo[nm][^\n]*$/, `\n---\n${v3Data.footerText}`);
+    } else if (v3Data.footerText) {
+      text = text.trimEnd() + `\n\n---\n${v3Data.footerText}`;
+    }
+
+    return { subject, html, text };
+  }
+
+  private extractContainerDarkColors(doc: Record<string, unknown> | null, emailTheme?: EmailTheme): Map<string, string> {
+    const colors = new Map<string, string>();
+    if (!doc) return colors;
+    for (const [blockId, block] of Object.entries(doc)) {
+      if (blockId === 'root') continue;
+      const b = block as { type?: string; data?: { props?: Record<string, unknown>; style?: Record<string, unknown> } };
+      if (b.type !== 'Container') continue;
+      if (b.data?.style?.darkBackgroundColor) {
+        colors.set(blockId, b.data.style.darkBackgroundColor as string);
+      } else {
+        const variant = b.data?.props?.containerVariant as string | undefined;
+        if (variant && emailTheme) {
+          const themeColor = variant === 'secondary'
+            ? (emailTheme.secondaryButtonBackgroundColor || '#4A90A4')
+            : (emailTheme.buttonBackgroundColor || '#FF6B35');
+          colors.set(blockId, darkenColorForDarkMode(themeColor));
+        }
+      }
+    }
+    return colors;
+  }
+
+  private generateDarkModeStyles(darkBackdrop: string, darkCanvas: string, darkHeading: string, darkText: string, containerDarkColors?: Map<string, string>): string {
+    let containerStyles = '';
+    if (containerDarkColors && containerDarkColors.size > 0) {
+      for (const [id, color] of containerDarkColors) {
+        containerStyles += `        .email-container-${id} { background-color: ${color} !important; }\n`;
+      }
+    }
+    return `
+      @media (prefers-color-scheme: dark) {
+        body, .email-backdrop { background-color: ${darkBackdrop} !important; }
+        .email-canvas { background-color: ${darkCanvas} !important; }
+        .email-heading { color: ${darkHeading} !important; }
+        .email-text { color: ${darkText} !important; }
+${containerStyles}        .email-footer-text { color: #999999 !important; }
+        .email-header-text { color: #999999 !important; }
+        .email-divider { border-top-color: #3a3a5c !important; }
+      }
+    `;
+  }
+
+  private buildEmailHtml(subject: string, emailTheme: EmailTheme, darkModeStyles: string, headerHtml: string, bodyHtml: string, footerHtml: string): string {
+    return `
       <!DOCTYPE html>
       <html lang="de">
       <head>
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <meta name="color-scheme" content="light dark">
+        <meta name="supported-color-schemes" content="light dark">
         <title>${htmlEscape(subject)}</title>
+        <style type="text/css">
+          ${darkModeStyles}
+        </style>
+        <!--[if mso]>
+        <style type="text/css">
+          body, table, td { font-family: Arial, sans-serif !important; }
+        </style>
+        <![endif]-->
       </head>
-      <body style="margin: 0; padding: 0; background-color: ${emailTheme.backdropColor}; font-family: ${emailTheme.fontFamily};">
-        <table width="100%" cellpadding="0" cellspacing="0" style="background-color: ${emailTheme.backdropColor}; padding: 20px 0;">
+      <body class="email-backdrop" style="margin: 0; padding: 0; background-color: ${emailTheme.backdropColor}; font-family: ${emailTheme.fontFamily};">
+        <table width="100%" cellpadding="0" cellspacing="0" class="email-backdrop" style="background-color: ${emailTheme.backdropColor}; padding: 20px 0;">
           <tr>
             <td align="center">
-              <table width="600" cellpadding="0" cellspacing="0" style="background-color: ${emailTheme.canvasColor}; border-radius: 8px; overflow: hidden; box-shadow: 0 2px 8px rgba(0,0,0,0.1);">
+              <table width="600" cellpadding="0" cellspacing="0" class="email-canvas" style="max-width: 600px; width: 100%; background-color: ${emailTheme.canvasColor}; border-radius: 8px; overflow: hidden; box-shadow: 0 2px 8px rgba(0,0,0,0.1);">
                 <tr>
                   <td>
                     ${headerHtml}
                   </td>
                 </tr>
                 <tr>
-                  <td style="padding: 0;">
+                  <td style="padding: 16px 0 8px 0;">
                     ${bodyHtml}
                   </td>
                 </tr>
@@ -1102,12 +2100,6 @@ export class EmailTemplateService {
       </body>
       </html>
     `;
-    
-    // Render text with footer
-    const footerTextRendered = renderTemplate(footer.text, allVariables);
-    const text = `${renderTemplate(template.textContent || '', allVariables)}\n\n---\n${footerTextRendered}`;
-    
-    return { subject, html, text };
   }
 
   // Get available variables for a template type
diff --git a/server/services/icsService.ts b/server/services/icsService.ts
index be2a10ef..6c29d3b7 100644
--- a/server/services/icsService.ts
+++ b/server/services/icsService.ts
@@ -9,6 +9,8 @@ interface CalendarEvent {
   location?: string;
   organizer?: string;
   url?: string;
+  status?: 'CONFIRMED' | 'TENTATIVE' | 'CANCELLED';
+  sequence?: number;
 }
 
 export interface CalendarExportContext {
@@ -26,6 +28,33 @@ function escapeIcsText(text: string): string {
     .replace(/\n/g, '\\n');
 }
 
+function foldLine(line: string): string {
+  const bytes = Buffer.from(line, 'utf8');
+  if (bytes.length <= 75) return line;
+
+  const result: string[] = [];
+  let offset = 0;
+
+  while (offset < bytes.length) {
+    const limit = offset === 0 ? 75 : 74;
+    let end = offset + limit;
+
+    if (end >= bytes.length) {
+      result.push(bytes.slice(offset).toString('utf8'));
+      break;
+    }
+
+    while (end > offset && (bytes[end] & 0xC0) === 0x80) {
+      end--;
+    }
+
+    result.push(bytes.slice(offset, end).toString('utf8'));
+    offset = end;
+  }
+
+  return result.join('\r\n ');
+}
+
 function formatIcsDate(date: Date): string {
   return date.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
 }
@@ -96,7 +125,8 @@ function buildEventTitle(
   baseTitle: string,
   poll: Poll,
   optionId: number,
-  context: CalendarExportContext
+  context: CalendarExportContext,
+  overrideFinalized?: boolean
 ): string {
   const { settings, language, userVotedOptionIds } = context;
   const prefixes = getLocalizedPrefixes(settings, language);
@@ -106,52 +136,60 @@ function buildEventTitle(
     parts.push(prefixes.myChoice);
   }
 
+  parts.push(baseTitle);
+
   if (settings.prefixEnabled) {
-    // Use confirmed prefix if: poll is completed OR poll has a final option selected
-    const isConfirmed = isPollCompleted(poll) || isPollFinalized(poll);
+    const isConfirmed = overrideFinalized !== undefined ? overrideFinalized : isPollFinalized(poll);
     if (isConfirmed) {
-      parts.push(`${prefixes.confirmed}:`);
+      parts.push(`(${prefixes.confirmed})`);
     } else {
-      parts.push(`${prefixes.tentative}:`);
+      parts.push(`(${prefixes.tentative})`);
     }
   }
 
-  parts.push(baseTitle);
   return parts.join(' ');
 }
 
 function generateEvent(event: CalendarEvent): string {
   const lines: string[] = [
     'BEGIN:VEVENT',
-    `UID:${event.uid}`,
-    `DTSTAMP:${formatIcsDate(new Date())}`,
-    `DTSTART:${formatIcsDate(event.startTime)}`,
+    foldLine(`UID:${event.uid}`),
+    foldLine(`DTSTAMP:${formatIcsDate(new Date())}`),
+    foldLine(`DTSTART:${formatIcsDate(event.startTime)}`),
   ];
 
   if (event.endTime) {
-    lines.push(`DTEND:${formatIcsDate(event.endTime)}`);
+    lines.push(foldLine(`DTEND:${formatIcsDate(event.endTime)}`));
   } else {
     const endTime = new Date(event.startTime);
     endTime.setHours(endTime.getHours() + 1);
-    lines.push(`DTEND:${formatIcsDate(endTime)}`);
+    lines.push(foldLine(`DTEND:${formatIcsDate(endTime)}`));
   }
 
-  lines.push(`SUMMARY:${escapeIcsText(event.title)}`);
+  lines.push(foldLine(`SUMMARY:${escapeIcsText(event.title)}`));
+
+  if (event.status) {
+    lines.push(`STATUS:${event.status}`);
+  }
 
   if (event.description) {
-    lines.push(`DESCRIPTION:${escapeIcsText(event.description)}`);
+    lines.push(foldLine(`DESCRIPTION:${escapeIcsText(event.description)}`));
   }
 
   if (event.location) {
-    lines.push(`LOCATION:${escapeIcsText(event.location)}`);
+    lines.push(foldLine(`LOCATION:${escapeIcsText(event.location)}`));
   }
 
   if (event.url) {
-    lines.push(`URL:${event.url}`);
+    lines.push(foldLine(`URL:${event.url}`));
   }
 
   if (event.organizer) {
-    lines.push(`ORGANIZER:${escapeIcsText(event.organizer)}`);
+    lines.push(foldLine(`ORGANIZER:${event.organizer}`));
+  }
+
+  if (event.sequence !== undefined) {
+    lines.push(`SEQUENCE:${event.sequence}`);
   }
 
   lines.push('END:VEVENT');
@@ -165,7 +203,7 @@ function generateCalendar(events: CalendarEvent[], calendarName: string = 'Polly
     'PRODID:-//Polly//Polling System//DE',
     'CALSCALE:GREGORIAN',
     'METHOD:PUBLISH',
-    `X-WR-CALNAME:${escapeIcsText(calendarName)}`,
+    foldLine(`X-WR-CALNAME:${escapeIcsText(calendarName)}`),
     'X-WR-TIMEZONE:Europe/Berlin',
   ];
 
@@ -212,7 +250,7 @@ export function getDefaultCalendarSettings(): CalendarSettings {
 }
 
 export function generatePollIcs(
-  poll: Poll,
+  poll: Poll & { user?: { displayName?: string; email?: string } | null },
   options: PollOption[],
   votes: Vote[],
   baseUrl: string,
@@ -237,30 +275,57 @@ export function generatePollIcs(
 
   const events: CalendarEvent[] = [];
 
-  for (const option of options) {
-    // Use unified filter: auto-filters to final option when poll is finalized
-    if (!shouldIncludeOption(option, poll, effectiveContext)) {
-      continue;
-    }
+  const isFinalized = isPollFinalized(poll);
+
+  const organizerValue = poll.user?.email 
+    ? `MAILTO:${poll.user.email}`
+    : poll.creatorEmail 
+      ? `MAILTO:${poll.creatorEmail}`
+      : undefined;
 
+  for (const option of options) {
     const dateTime = parseOptionDateTime(option);
     if (!dateTime) continue;
 
     const { startTime, endTime } = dateTime;
+    const uid = `poll-${poll.id}-option-${option.id}@polly`;
+    const isFinalOption = isFinalized && option.id === poll.finalOptionId;
+
+    if (isFinalized && !isFinalOption) {
+      events.push({
+        uid,
+        title: `${poll.title}: ${option.text}`,
+        startTime,
+        endTime,
+        status: 'CANCELLED',
+        sequence: 1,
+        organizer: organizerValue,
+      });
+      continue;
+    }
+
+    if (!shouldIncludeOption(option, poll, effectiveContext)) {
+      continue;
+    }
 
     const yesCount = votes.filter(v => v.optionId === option.id && v.response === 'yes').length;
     const maybeCount = votes.filter(v => v.optionId === option.id && v.response === 'maybe').length;
-    const uid = `poll-${poll.id}-option-${option.id}@polly`;
 
     const votesLabel = language === 'de' 
       ? `Stimmen: ${yesCount} Ja, ${maybeCount} Vielleicht`
       : `Votes: ${yesCount} Yes, ${maybeCount} Maybe`;
 
-    const description = poll.description
-      ? `${poll.description}\n\n${votesLabel}`
-      : votesLabel;
+    const pollUrl = `${baseUrl}/poll/${poll.publicToken}`;
+    const descriptionParts: string[] = [];
+    if (poll.description) descriptionParts.push(poll.description);
+    descriptionParts.push(votesLabel);
+    if (!isFinalOption) {
+      const votingLabel = language === 'de' ? 'Abstimmung' : 'Vote';
+      descriptionParts.push(`${votingLabel}: ${pollUrl}`);
+    }
+    const description = descriptionParts.join('\n\n');
 
-    const baseTitle = `${poll.title}: ${option.text}`;
+    const baseTitle = isFinalOption ? poll.title : `${poll.title}: ${option.text}`;
     const title = buildEventTitle(baseTitle, poll, option.id, effectiveContext);
 
     events.push({
@@ -269,7 +334,11 @@ export function generatePollIcs(
       description,
       startTime,
       endTime,
-      url: `${baseUrl}/poll/${poll.publicToken}`,
+      location: poll.videoConferenceUrl || undefined,
+      url: pollUrl,
+      status: isFinalOption ? 'CONFIRMED' : 'TENTATIVE',
+      sequence: isFinalized ? 1 : undefined,
+      organizer: organizerValue,
     });
   }
 
@@ -297,8 +366,6 @@ export function generateUserCalendarFeed(
       userVotedOptionIds,
     };
 
-    // When poll is finalized, show only the final option (even if user didn't vote for it)
-    // This prevents calendar clutter and shows only the confirmed date
     if (isPollFinalized(poll)) {
       const finalOption = options.find(o => o.id === poll.finalOptionId);
       if (finalOption) {
@@ -320,14 +387,33 @@ export function generateUserCalendarFeed(
             description: poll.description || undefined,
             startTime,
             endTime,
+            location: poll.videoConferenceUrl || undefined,
             url: `${baseUrl}/poll/${poll.publicToken}`,
+            status: 'CONFIRMED',
+            sequence: 1,
           });
         }
       }
-      continue; // Skip to next poll, don't add individual vote entries
+
+      for (const vote of userVotes) {
+        const option = options.find(o => o.id === vote.optionId);
+        if (!option) continue;
+        const dateTime = parseOptionDateTime(option);
+        if (!dateTime) continue;
+
+        events.push({
+          uid: `participation-${poll.id}-${vote.id}@polly`,
+          title: poll.title,
+          startTime: dateTime.startTime,
+          endTime: dateTime.endTime,
+          status: 'CANCELLED',
+          sequence: 1,
+        });
+      }
+
+      continue;
     }
 
-    // For non-finalized polls, include user's yes votes
     for (const vote of userVotes) {
       const option = options.find(o => o.id === vote.optionId);
       if (!option) continue;
@@ -347,6 +433,7 @@ export function generateUserCalendarFeed(
       const title = buildEventTitle(baseTitle, poll, option.id, effectiveContext);
 
       const commentLabel = language === 'de' ? 'Ihr Kommentar' : 'Your comment';
+      const votingLabel = language === 'de' ? 'Abstimmung' : 'Vote';
 
       events.push({
         uid,
@@ -354,10 +441,13 @@ export function generateUserCalendarFeed(
         description: [
           poll.description,
           vote.comment ? `${commentLabel}: ${vote.comment}` : null,
+          `${votingLabel}: ${baseUrl}/poll/${poll.publicToken}`,
         ].filter(Boolean).join('\n\n') || undefined,
         startTime,
         endTime,
+        location: poll.videoConferenceUrl || undefined,
         url: `${baseUrl}/poll/${poll.publicToken}`,
+        status: 'TENTATIVE',
       });
     }
   }
@@ -373,7 +463,8 @@ export function generateSingleEventIcs(
   poll: Poll,
   option: PollOption,
   baseUrl: string,
-  context?: CalendarExportContext
+  context?: CalendarExportContext,
+  isFinalized?: boolean
 ): string {
   const settings = context?.settings || getDefaultCalendarSettings();
   const language = context?.language || 'de';
@@ -392,7 +483,7 @@ export function generateSingleEventIcs(
   const { startTime, endTime } = dateTime;
 
   const baseTitle = `${poll.title}: ${option.text}`;
-  const title = buildEventTitle(baseTitle, poll, option.id, effectiveContext);
+  const title = buildEventTitle(baseTitle, poll, option.id, effectiveContext, isFinalized);
 
   const event: CalendarEvent = {
     uid: `poll-${poll.id}-option-${option.id}@polly`,
@@ -400,7 +491,9 @@ export function generateSingleEventIcs(
     description: poll.description || undefined,
     startTime,
     endTime,
+    location: poll.videoConferenceUrl || undefined,
     url: `${baseUrl}/poll/${poll.publicToken}`,
+    status: isFinalized ? 'CONFIRMED' : undefined,
   };
 
   return generateCalendar([event], poll.title);
diff --git a/server/services/imageService.ts b/server/services/imageService.ts
index f7196beb..7375511f 100644
--- a/server/services/imageService.ts
+++ b/server/services/imageService.ts
@@ -12,6 +12,7 @@ export interface UploadResult {
   error?: string;
   virusName?: string;
   scannerUnavailable?: boolean;
+  invalidFileType?: boolean;
 }
 
 export interface ScanContext {
@@ -20,6 +21,38 @@ export interface ScanContext {
   requestIp?: string;
 }
 
+const ALLOWED_MIME_PREFIXES = ['image/'];
+
+function validateImageMagicBytes(buffer: Buffer): boolean {
+  if (buffer.length < 12) return false;
+
+  const b = buffer;
+
+  if (b[0] === 0xFF && b[1] === 0xD8 && b[2] === 0xFF) return true;
+
+  if (b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4E && b[3] === 0x47 &&
+      b[4] === 0x0D && b[5] === 0x0A && b[6] === 0x1A && b[7] === 0x0A) return true;
+
+  if (b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38) return true;
+
+  if (b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 &&
+      b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50) return true;
+
+  if (b[0] === 0x42 && b[1] === 0x4D) return true;
+
+  if (b[0] === 0x00 && b[1] === 0x00 && b[2] === 0x01 && b[3] === 0x00) return true;
+
+  if (b[4] === 0x66 && b[5] === 0x74 && b[6] === 0x79 && b[7] === 0x70) {
+    const brand = buffer.slice(8, 12).toString('ascii');
+    if (['avif', 'heic', 'heif', 'mif1', 'msf1'].some(t => brand.startsWith(t))) return true;
+  }
+
+  const start = buffer.slice(0, 512).toString('utf8').toLowerCase().trimStart();
+  if (start.startsWith('<svg') || start.startsWith('<?xml')) return true;
+
+  return false;
+}
+
 export class ImageService {
   private uploadDir = path.join(process.cwd(), 'uploads');
 
@@ -39,19 +72,10 @@ export class ImageService {
     return multer({
       storage: multer.memoryStorage(),
       limits: {
-        fileSize: 5 * 1024 * 1024, // 5MB limit
+        fileSize: 5 * 1024 * 1024,
       },
       fileFilter: (req, file, cb) => {
-        const blockedMimeTypes = ['image/svg+xml'];
-        const blockedExtensions = ['.svg'];
-        const ext = path.extname(file.originalname).toLowerCase();
-        
-        if (blockedMimeTypes.includes(file.mimetype) || blockedExtensions.includes(ext)) {
-          cb(new Error('SVG-Dateien sind aus Sicherheitsgründen nicht erlaubt'));
-          return;
-        }
-        
-        if (file.mimetype.startsWith('image/')) {
+        if (ALLOWED_MIME_PREFIXES.some(prefix => file.mimetype.startsWith(prefix))) {
           cb(null, true);
         } else {
           cb(new Error('Nur Bilddateien sind erlaubt'));
@@ -61,15 +85,24 @@ export class ImageService {
   }
 
   async processUpload(file: Express.Multer.File, context?: ScanContext): Promise<UploadResult> {
+    if (!validateImageMagicBytes(file.buffer)) {
+      console.warn(`[ImageService] Magic-Byte-Prüfung fehlgeschlagen: ${file.originalname} (${file.mimetype})`);
+      return {
+        success: false,
+        error: 'Nur Bilddateien sind erlaubt',
+        invalidFileType: true,
+      };
+    }
+
     const clamavEnabled = await clamavService.isEnabled();
     const scanStartTime = Date.now();
-    
+
     if (clamavEnabled) {
       console.log(`[ClamAV] Scanne Upload: ${file.originalname} (${file.size} bytes)`);
-      
+
       const scanResult = await clamavService.scanBuffer(file.buffer, file.originalname);
       const scanDuration = Date.now() - scanStartTime;
-      
+
       let scanStatus: 'clean' | 'infected' | 'error' | 'skipped';
       if (scanResult.scannerUnavailable) {
         scanStatus = 'error';
@@ -80,8 +113,7 @@ export class ImageService {
       } else {
         scanStatus = 'error';
       }
-      
-      // Log the scan to database
+
       const scanLog: InsertClamavScanLog = {
         filename: file.originalname,
         fileSize: file.size,
@@ -95,17 +127,16 @@ export class ImageService {
         requestIp: context?.requestIp || null,
         scanDurationMs: scanDuration,
       };
-      
+
       try {
         await storage.createClamavScanLog(scanLog);
       } catch (logError) {
         console.error('[ClamAV] Fehler beim Speichern des Scan-Logs:', logError);
       }
-      
+
       if (!scanResult.isClean) {
         console.warn(`[ClamAV] Upload abgelehnt: ${file.originalname} - ${scanResult.virusName || scanResult.error}`);
-        
-        // Send email notification to admins if virus was detected
+
         if (scanResult.virusName) {
           this.notifyAdminsOfVirusDetection({
             filename: file.originalname,
@@ -116,7 +147,7 @@ export class ImageService {
             scannedAt: new Date(),
           });
         }
-        
+
         return {
           success: false,
           error: scanResult.error || 'Virus erkannt',
@@ -124,12 +155,12 @@ export class ImageService {
           scannerUnavailable: scanResult.scannerUnavailable,
         };
       }
-      
+
       console.log(`[ClamAV] Scan erfolgreich: ${file.originalname}`);
     }
 
     await this.ensureUploadDir();
-    
+
     const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1E9);
     const ext = path.extname(file.originalname);
     const filename = `poll-image-${uniqueSuffix}${ext}`;
@@ -137,7 +168,7 @@ export class ImageService {
 
     try {
       await fs.writeFile(filePath, file.buffer);
-      
+
       return {
         success: true,
         imageUrl: this.getImageUrl(filename),
@@ -165,9 +196,9 @@ export class ImageService {
     try {
       const files = await fs.readdir(this.uploadDir);
       const pollImageFiles = files.filter(file => file.includes(pollId));
-      
+
       await Promise.all(
-        pollImageFiles.map(file => 
+        pollImageFiles.map(file =>
           fs.unlink(path.join(this.uploadDir, file)).catch(console.error)
         )
       );
@@ -189,22 +220,20 @@ export class ImageService {
     scannedAt: Date;
   }): Promise<void> {
     try {
-      // Get admin emails from the database
       const admins = await storage.getAdminUsers();
       const adminEmails = admins
         .filter(admin => admin.email)
         .map(admin => admin.email!);
-      
+
       if (adminEmails.length === 0) {
         console.log('[ClamAV] No admin emails found for virus notification');
         return;
       }
-      
-      // Send notification asynchronously (don't block the upload response)
+
       emailService.sendVirusDetectionAlert(adminEmails, details).catch(err => {
         console.error('[ClamAV] Failed to send virus detection email:', err);
       });
-      
+
       console.log(`[ClamAV] Virus alert queued for ${adminEmails.length} admin(s)`);
     } catch (error) {
       console.error('[ClamAV] Error preparing virus notification:', error);
@@ -213,3 +242,4 @@ export class ImageService {
 }
 
 export const imageService = new ImageService();
+export { validateImageMagicBytes };
diff --git a/server/services/liveVotingService.ts b/server/services/liveVotingService.ts
index 3400d7fd..0e077e73 100644
--- a/server/services/liveVotingService.ts
+++ b/server/services/liveVotingService.ts
@@ -1,5 +1,12 @@
 import { WebSocketServer, WebSocket } from 'ws';
 import type { Server } from 'http';
+import { timingSafeEqual } from 'crypto';
+import { storage } from '../storage';
+
+function safeCompareTokens(a: string | null | undefined, b: string | null | undefined): boolean {
+  if (!a || !b || a.length !== b.length) return false;
+  return timingSafeEqual(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8'));
+}
 
 interface LiveVoter {
   odId: string;
@@ -24,6 +31,23 @@ class LiveVotingService {
   private wsToSession: Map<WebSocket, { pollToken: string; sessionId: string; isPresenter: boolean }> = new Map();
   private inactivityCheckInterval: NodeJS.Timeout | null = null;
 
+  /** Close all connections and reset state — for test teardown only */
+  cleanup() {
+    if (this.inactivityCheckInterval) {
+      clearInterval(this.inactivityCheckInterval);
+      this.inactivityCheckInterval = null;
+    }
+    this.wsToSession.forEach((_session, ws) => {
+      try { ws.terminate(); } catch {}
+    });
+    this.wsToSession.clear();
+    this.pollRooms.clear();
+    if (this.wss) {
+      try { this.wss.close(); } catch {}
+      this.wss = null;
+    }
+  }
+
   // Use noServer mode to avoid interfering with Vite's HMR WebSocket
   initializeWithUpgrade(server: Server) {
     // Guard against double initialization during dev hot reloads
@@ -161,8 +185,17 @@ class LiveVotingService {
     }
   }
 
-  private handleJoinPoll(ws: WebSocket, message: { pollToken: string; voterName?: string; sessionId: string; isPresenter?: boolean }) {
-    const { pollToken, voterName, sessionId, isPresenter = false } = message;
+  private async handleJoinPoll(ws: WebSocket, message: { pollToken: string; voterName?: string; sessionId: string; isPresenter?: boolean; adminToken?: string }) {
+    const { pollToken, voterName, sessionId } = message;
+
+    const poll = await storage.getPollByPublicToken(pollToken);
+    if (!poll) {
+      ws.send(JSON.stringify({ type: 'error', code: 'POLL_NOT_FOUND', message: 'Umfrage nicht gefunden' }));
+      ws.close(4404, 'Poll not found');
+      return;
+    }
+
+    const isPresenter = safeCompareTokens(poll.adminToken, message.adminToken);
 
     let room = this.pollRooms.get(pollToken);
     if (!room) {
@@ -283,16 +316,22 @@ class LiveVotingService {
     console.log(`[LiveVoting] Vote submitted by ${message.voterName} in poll ${pollToken}`);
   }
 
-  private handleStartPresenting(ws: WebSocket, message: { pollToken: string }) {
+  private async handleStartPresenting(ws: WebSocket, message: { pollToken: string; adminToken?: string }) {
     const session = this.wsToSession.get(ws);
-    if (session) {
-      session.isPresenter = true;
-      const room = this.pollRooms.get(session.pollToken);
-      if (room) {
-        const viewer = room.viewers.get(session.sessionId);
-        if (viewer) {
-          viewer.isPresenter = true;
-        }
+    if (!session) return;
+
+    const poll = await storage.getPollByPublicToken(session.pollToken);
+    if (!poll || !safeCompareTokens(poll.adminToken, message.adminToken)) {
+      ws.send(JSON.stringify({ type: 'error', code: 'FORBIDDEN', message: 'Presenter-Berechtigung fehlt' }));
+      return;
+    }
+
+    session.isPresenter = true;
+    const room = this.pollRooms.get(session.pollToken);
+    if (room) {
+      const viewer = room.viewers.get(session.sessionId);
+      if (viewer) {
+        viewer.isPresenter = true;
       }
     }
   }
diff --git a/server/services/pentestToolsService.ts b/server/services/pentestToolsService.ts
index 3dc3ea17..4c547027 100644
--- a/server/services/pentestToolsService.ts
+++ b/server/services/pentestToolsService.ts
@@ -96,7 +96,7 @@ export const TOOL_NAMES: Record<number, string> = {
 
 export const SCAN_TYPES = {
   LIGHT: 'light',
-  FULL: 'full_new',
+  DEEP: 'deep',
   QUICK: 'quick',
 } as const;
 
@@ -274,7 +274,9 @@ class PentestToolsService {
         try {
           const errorData = JSON.parse(responseText);
           errorMessage = errorData.message || errorData.error || errorMessage;
-        } catch (e) {}
+        } catch (e) {
+          console.warn('[Pentest-Tools] Failed to parse error response:', (e as Error).message);
+        }
         return { success: false, error: errorMessage };
       }
 
@@ -573,7 +575,7 @@ class PentestToolsService {
   getScanTypes(): { id: string; name: string }[] {
     return [
       { id: 'light', name: 'Light Scan (schnell)' },
-      { id: 'full_new', name: 'Full Scan (gründlich)' },
+      { id: 'deep', name: 'Deep Scan (gründlich)' },
       { id: 'quick', name: 'Quick Scan (sehr schnell)' },
     ];
   }
@@ -581,18 +583,11 @@ class PentestToolsService {
   // ============== POLLY TARGET MANAGEMENT ==============
 
   getPollyUrl(requestHost?: string): string | null {
-    // Priority 1: Environment variable
-    if (process.env.PUBLIC_BASE_URL) {
-      return this.normalizeUrl(process.env.PUBLIC_BASE_URL);
-    }
-    if (process.env.BASE_URL) {
-      return this.normalizeUrl(process.env.BASE_URL);
-    }
-    if (process.env.REPLIT_DEV_DOMAIN) {
-      return `https://${process.env.REPLIT_DEV_DOMAIN}`;
+    const resolved = process.env.APP_URL || process.env.BASE_URL || process.env.VITE_APP_URL || '';
+    if (resolved && !resolved.includes('localhost')) {
+      return this.normalizeUrl(resolved);
     }
-    
-    // Priority 2: Request host header (for deployed apps)
+
     if (requestHost && !requestHost.includes('localhost')) {
       return `https://${requestHost}`;
     }
@@ -615,7 +610,7 @@ class PentestToolsService {
     if (!pollyUrl) {
       return {
         configured: false,
-        error: 'Polly-URL konnte nicht ermittelt werden. Bitte PUBLIC_BASE_URL Umgebungsvariable setzen.',
+        error: 'Polly-URL konnte nicht ermittelt werden. Bitte APP_URL Umgebungsvariable setzen.',
       };
     }
 
@@ -831,7 +826,9 @@ class PentestToolsService {
         try {
           const errorData = JSON.parse(responseText);
           errorMessage = errorData.message || errorData.error || errorMessage;
-        } catch (e) {}
+        } catch (e) {
+          console.warn('[Pentest-Tools] Failed to parse error response:', (e as Error).message);
+        }
         
         return { success: false, error: errorMessage };
       }
diff --git a/server/services/testRunnerService.ts b/server/services/testRunnerService.ts
index 911d846e..14300f6f 100644
--- a/server/services/testRunnerService.ts
+++ b/server/services/testRunnerService.ts
@@ -168,105 +168,194 @@ export async function getAvailableTests(): Promise<TestCategory[]> {
   return Array.from(categories.values());
 }
 
+async function countAllTests(testFiles?: string[], testNamePattern?: string): Promise<number> {
+  try {
+    const localVitest = path.join(process.cwd(), 'node_modules', '.bin', 'vitest');
+    if (!fs.existsSync(localVitest)) {
+      return countAllTestsFallback(testFiles);
+    }
+    
+    const args = ['list'];
+    if (testNamePattern) {
+      args.push('--testNamePattern', testNamePattern);
+    }
+    if (testFiles && testFiles.length > 0) {
+      args.push(...testFiles);
+    }
+    
+    const count = await new Promise<number>((resolve) => {
+      const proc = spawn(localVitest, args, {
+        cwd: process.cwd(),
+        env: { ...process.env, NODE_ENV: 'test' },
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      
+      let output = '';
+      proc.stdout?.on('data', (data: Buffer) => { output += data.toString(); });
+      
+      const timeout = setTimeout(() => {
+        proc.kill('SIGKILL');
+        resolve(0);
+      }, 30000);
+      
+      proc.on('close', () => {
+        clearTimeout(timeout);
+        const lines = output.split('\n').filter(l => l.trim().length > 0);
+        resolve(lines.length);
+      });
+      
+      proc.on('error', () => {
+        clearTimeout(timeout);
+        resolve(0);
+      });
+    });
+    
+    if (count > 0) return count;
+    return countAllTestsFallback(testFiles);
+  } catch {
+    return countAllTestsFallback(testFiles);
+  }
+}
+
+function countAllTestsFallback(testFiles?: string[]): number {
+  let count = 0;
+  
+  if (testFiles && testFiles.length > 0) {
+    for (const f of testFiles) {
+      try {
+        const fullPath = path.resolve(process.cwd(), f);
+        if (fs.existsSync(fullPath)) {
+          const content = fs.readFileSync(fullPath, 'utf-8');
+          count += parseTestCases(content).length;
+        }
+      } catch {}
+    }
+    return count;
+  }
+  
+  const serverTestDir = path.join(process.cwd(), 'server', 'tests');
+  
+  function scanDir(dir: string) {
+    try {
+      const entries = fs.readdirSync(dir, { withFileTypes: true });
+      for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          scanDir(fullPath);
+        } else if (entry.name.endsWith('.test.ts')) {
+          const content = fs.readFileSync(fullPath, 'utf-8');
+          count += parseTestCases(content).length;
+        }
+      }
+    } catch {}
+  }
+  
+  scanDir(serverTestDir);
+  return count;
+}
+
+interface ResolvedTestConfig {
+  testFiles?: string[];
+  testNamePattern?: string;
+  e2eTestsToSkip: Array<{ testFile: string; testName: string; category: string }>;
+  totalTests: number;
+}
+
+async function resolveTestConfig(): Promise<ResolvedTestConfig> {
+  const modeConfig = await getTestModeConfig();
+  let testFiles: string[] | undefined;
+  let testNamePattern: string | undefined;
+  const e2eTestsToSkip: Array<{ testFile: string; testName: string; category: string }> = [];
+  
+  if (modeConfig.mode === 'manual') {
+    const enabledConfig = await getEnabledTestsConfig();
+    testFiles = enabledConfig.files.filter(f => !f.startsWith('e2e/') && !f.includes('/e2e/'));
+    testNamePattern = enabledConfig.testNamePattern;
+    
+    const skippedE2EFiles = enabledConfig.files.filter(f => f.startsWith('e2e/') || f.includes('/e2e/'));
+    for (const e2eFile of skippedE2EFiles) {
+      const tests = await getTestNamesFromFile(e2eFile);
+      for (const testName of tests) {
+        e2eTestsToSkip.push({ testFile: e2eFile, testName, category: 'e2e' });
+      }
+    }
+    console.log(`[TestRunner] Manual mode: ${testFiles.length} test files, ${e2eTestsToSkip.length} E2E skipped`);
+  } else {
+    const e2eDir = path.join(process.cwd(), 'e2e');
+    try {
+      const e2eFiles = fs.readdirSync(e2eDir)
+        .filter(f => f.endsWith('.spec.ts') || f.endsWith('.test.ts'))
+        .map(f => `e2e/${f}`);
+      for (const e2eFile of e2eFiles) {
+        const tests = await getTestNamesFromFile(e2eFile);
+        for (const testName of tests) {
+          e2eTestsToSkip.push({ testFile: e2eFile, testName, category: 'e2e' });
+        }
+      }
+    } catch {}
+    console.log(`[TestRunner] Auto mode: all server tests, ${e2eTestsToSkip.length} E2E skipped`);
+  }
+  
+  const vitestCount = await countAllTests(testFiles, testNamePattern);
+  const totalTests = vitestCount + e2eTestsToSkip.length;
+  
+  return { testFiles, testNamePattern, e2eTestsToSkip, totalTests };
+}
+
 export async function runAllTests(triggeredBy: 'manual' | 'scheduled' = 'manual'): Promise<number> {
+  const config = await resolveTestConfig();
+  
   const [testRun] = await db.insert(testRuns).values({
     status: 'running',
     triggeredBy,
-    totalTests: 0,
+    totalTests: config.totalTests,
     passed: 0,
     failed: 0,
     skipped: 0,
   }).returning();
 
-  runTestsInBackground(testRun.id);
+  runTestsInBackground(testRun.id, config);
   
   return testRun.id;
 }
 
-async function runTestsInBackground(runId: number): Promise<void> {
+async function runTestsInBackground(runId: number, config: ResolvedTestConfig): Promise<void> {
   const startTime = Date.now();
   
-  // Track this test run for progress monitoring
   currentTestRunId = runId;
   
+  const { testFiles, testNamePattern, e2eTestsToSkip } = config;
+  
   try {
-    // Get test mode and filter tests if in manual mode
-    const modeConfig = await getTestModeConfig();
-    let testFiles: string[] | undefined;
-    let testNamePattern: string | undefined;
-    
-    // Collect E2E tests to mark as skipped (Playwright not available in Replit)
-    // Note: E2E tests are stored in test_configurations but NOT run by Vitest
-    // They appear separately in the UI as skipped with an explanation
-    const e2eTestsToSkip: Array<{ testFile: string; testName: string; category: string }> = [];
-    
-    if (modeConfig.mode === 'manual') {
-      const enabledConfig = await getEnabledTestsConfig();
-      // Filter out E2E tests from test files (they don't run in internal environment)
-      testFiles = enabledConfig.files.filter(f => !f.startsWith('e2e/') && !f.includes('/e2e/'));
-      testNamePattern = enabledConfig.testNamePattern;
-      
-      // Collect skipped E2E tests for reporting (only in manual mode when explicitly enabled)
-      const skippedE2EFiles = enabledConfig.files.filter(f => f.startsWith('e2e/') || f.includes('/e2e/'));
-      for (const e2eFile of skippedE2EFiles) {
-        const tests = await getTestNamesFromFile(e2eFile);
-        for (const testName of tests) {
-          e2eTestsToSkip.push({ testFile: e2eFile, testName, category: 'e2e' });
-        }
+    if (testFiles && testFiles.length === 0) {
+      for (const e2eTest of e2eTestsToSkip) {
+        await db.insert(testResults).values({
+          runId,
+          testFile: e2eTest.testFile,
+          testName: e2eTest.testName,
+          category: e2eTest.category,
+          status: 'skipped',
+          duration: null,
+          error: 'E2E tests require Playwright (only available in CI/CD)',
+          errorStack: null,
+        });
       }
       
-      console.log(`[TestRunner] Running in manual mode with ${testFiles.length} test files (${e2eTestsToSkip.length} E2E tests skipped)`);
+      console.log(`[TestRunner] No runnable tests (${e2eTestsToSkip.length} E2E skipped)`);
       
-      // Short-circuit if no tests are enabled in manual mode (only E2E or nothing)
-      if (testFiles.length === 0) {
-        // Record skipped E2E tests if any
-        for (const e2eTest of e2eTestsToSkip) {
-          await db.insert(testResults).values({
-            runId,
-            testFile: e2eTest.testFile,
-            testName: e2eTest.testName,
-            category: e2eTest.category,
-            status: 'skipped',
-            duration: null,
-            error: 'E2E tests require Playwright (only available in CI/CD)',
-            errorStack: null,
-          });
-        }
-        
-        const hasOnlyE2E = e2eTestsToSkip.length > 0;
-        console.log(`[TestRunner] No runnable tests in manual mode${hasOnlyE2E ? ' (only E2E tests enabled)' : ''}`);
-        
-        await db.update(testRuns)
-          .set({
-            status: 'completed',
-            totalTests: e2eTestsToSkip.length,
-            passed: 0,
-            failed: 0,
-            skipped: e2eTestsToSkip.length,
-            duration: Date.now() - startTime,
-            completedAt: new Date(),
-          })
-          .where(eq(testRuns.id, runId));
-        currentTestRunId = null;
-        return;
-      }
-    } else {
-      // Auto mode: also collect E2E tests to mark as skipped for consistent counting
-      const e2eDir = path.join(process.cwd(), 'e2e');
-      try {
-        const e2eFiles = fs.readdirSync(e2eDir)
-          .filter(f => f.endsWith('.spec.ts') || f.endsWith('.test.ts'))
-          .map(f => `e2e/${f}`);
-        for (const e2eFile of e2eFiles) {
-          const tests = await getTestNamesFromFile(e2eFile);
-          for (const testName of tests) {
-            e2eTestsToSkip.push({ testFile: e2eFile, testName, category: 'e2e' });
-          }
-        }
-      } catch (err) {
-        // e2e directory might not exist
-      }
-      console.log(`[TestRunner] Running in auto mode (server tests only, ${e2eTestsToSkip.length} E2E tests skipped)`);
+      await db.update(testRuns)
+        .set({
+          status: 'completed',
+          totalTests: e2eTestsToSkip.length,
+          passed: 0,
+          failed: 0,
+          skipped: e2eTestsToSkip.length,
+          duration: Date.now() - startTime,
+          completedAt: new Date(),
+        })
+        .where(eq(testRuns.id, runId));
+      currentTestRunId = null;
+      return;
     }
     
     const vitestOutput = await executeVitest(testFiles, testNamePattern);
@@ -325,15 +414,12 @@ async function runTestsInBackground(runId: number): Promise<void> {
       }
     }
     
-    // Calculate totals: add manually-skipped E2E tests only if in manual mode
-    const totalTests = parsed.numTotalTests + e2eTestsToSkip.length;
     const totalSkipped = (parsed.numSkippedTests || 0) + e2eTestsToSkip.length;
     
     const completedAt = new Date();
     await db.update(testRuns)
       .set({
-        status: parsed.success ? 'completed' : 'failed',
-        totalTests,
+        status: (parsed.numFailedTests === 0 && parsed.numTotalTests > 0) ? 'completed' : 'failed',
         passed: parsed.numPassedTests,
         failed: parsed.numFailedTests,
         skipped: totalSkipped,
@@ -342,10 +428,12 @@ async function runTestsInBackground(runId: number): Promise<void> {
       })
       .where(eq(testRuns.id, runId));
     
-    // Send email notification if configured
+    const finalRun = await db.select().from(testRuns).where(eq(testRuns.id, runId)).limit(1);
+    const finalTotal = finalRun[0]?.totalTests || (parsed.numTotalTests + e2eTestsToSkip.length);
+    
     await sendTestReportNotification(runId, {
-      status: parsed.success ? 'completed' : 'failed',
-      totalTests,
+      status: (parsed.numFailedTests === 0 && parsed.numTotalTests > 0) ? 'completed' : 'failed',
+      totalTests: finalTotal,
       passed: parsed.numPassedTests,
       failed: parsed.numFailedTests,
       skipped: totalSkipped,
@@ -930,17 +1018,72 @@ interface ParsedTest {
   description?: string;
 }
 
-function parseTestCases(content: string): ParsedTest[] {
+export function parseTestCases(content: string): ParsedTest[] {
   const tests: ParsedTest[] = [];
+  const lines = content.split('\n');
   
-  // Match it() or test() calls
-  const testRegex = /(?:it|test)\s*\(\s*['"`]([^'"`]+)['"`]/g;
-  let match;
+  let inBlockComment = false;
+  let insideForEach = false;
+  let forEachDepth = 0;
   
-  while ((match = testRegex.exec(content)) !== null) {
-    tests.push({
-      name: match[1],
-    });
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    
+    if (inBlockComment) {
+      if (trimmed.includes('*/')) {
+        inBlockComment = false;
+      }
+      continue;
+    }
+    
+    if (trimmed.startsWith('/*')) {
+      if (!trimmed.includes('*/')) {
+        inBlockComment = true;
+      }
+      continue;
+    }
+    
+    if (trimmed.startsWith('//')) {
+      continue;
+    }
+    
+    if (insideForEach) {
+      forEachDepth += (trimmed.match(/\{/g) || []).length;
+      forEachDepth -= (trimmed.match(/\}/g) || []).length;
+      if (forEachDepth <= 0) {
+        insideForEach = false;
+        forEachDepth = 0;
+      }
+      continue;
+    }
+    
+    const forEachMatch = trimmed.match(/\.forEach\s*\(\s*(?:\(?[^)]*\)?\s*=>\s*\{?|function)/);
+    if (forEachMatch) {
+      insideForEach = true;
+      forEachDepth = (trimmed.match(/\{/g) || []).length - (trimmed.match(/\}/g) || []).length;
+      for (let j = i + 1; j < Math.min(i + 10, lines.length); j++) {
+        const nextTrimmed = lines[j].trim();
+        if (nextTrimmed.match(/(?:it|test)(?:\.skip|\.todo|\.only)?\s*\(\s*(?:'|"|`)/)) {
+          tests.push({ name: `[dynamic/forEach] ${nextTrimmed.substring(0, 60)}` });
+          break;
+        }
+      }
+      continue;
+    }
+    
+    const eachMatch = trimmed.match(/(?:it|test)\.each\s*[\[(]/);
+    if (eachMatch) {
+      tests.push({ name: `[dynamic] ${trimmed.substring(0, 60)}` });
+      continue;
+    }
+    
+    const testMatch = trimmed.match(/(?:it|test)(?:\.skip|\.todo|\.only)?\s*\(\s*(?:'([^']+)'|"([^"]+)"|`([^`]+)`)/);
+    if (testMatch) {
+      const name = testMatch[1] || testMatch[2] || testMatch[3];
+      if (name) {
+        tests.push({ name });
+      }
+    }
   }
   
   return tests;
diff --git a/server/services/tokenService.ts b/server/services/tokenService.ts
index 935f0d83..c7e9a194 100644
--- a/server/services/tokenService.ts
+++ b/server/services/tokenService.ts
@@ -99,7 +99,7 @@ function getKeycloakConfig() {
   const realm = process.env.KEYCLOAK_REALM;
   const clientId = process.env.KEYCLOAK_CLIENT_ID;
   const clientSecret = process.env.KEYCLOAK_CLIENT_SECRET;
-  const serverUrl = process.env.KEYCLOAK_URL || process.env.KEYCLOAK_AUTH_SERVER_URL;
+  const serverUrl = process.env.KEYCLOAK_AUTH_SERVER_URL || process.env.KEYCLOAK_URL;
 
   if (!realm || !clientId || !serverUrl) {
     return null;
@@ -211,6 +211,7 @@ export const tokenService = {
           const updateData: Record<string, any> = { 
             keycloakId: claims.sub,
             provider: 'keycloak',
+            emailVerified: true,
           };
           if (keycloakRole) {
             updateData.role = keycloakRole;
@@ -230,11 +231,18 @@ export const tokenService = {
           role: keycloakRole || 'user',
           keycloakId: claims.sub,
           provider: 'keycloak',
+          emailVerified: true,
         });
       } else {
-        // Sync role from Keycloak on every API call (if role is provided in token)
+        const syncData: Record<string, any> = {};
         if (keycloakRole && user.role !== keycloakRole) {
-          user = await storage.updateUser(user.id, { role: keycloakRole });
+          syncData.role = keycloakRole;
+        }
+        if (!user.emailVerified) {
+          syncData.emailVerified = true;
+        }
+        if (Object.keys(syncData).length > 0) {
+          user = await storage.updateUser(user.id, syncData);
         }
       }
 
diff --git a/server/services/whisperService.ts b/server/services/whisperService.ts
new file mode 100644
index 00000000..21559856
--- /dev/null
+++ b/server/services/whisperService.ts
@@ -0,0 +1,257 @@
+import { exec } from "child_process";
+import { promisify } from "util";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+
+const execAsync = promisify(exec);
+
+const SUPPORTED_FORMATS = [
+  "audio/wav", "audio/x-wav", "audio/wave",
+  "audio/mp3", "audio/mpeg", "audio/mp4", "audio/flac",
+];
+const NEEDS_CONVERSION = ["audio/webm", "audio/ogg"];
+
+const HALLUCINATIONS = [
+  "vielen dank fürs zuschauen",
+  "vielen dank für's zuschauen",
+  "danke fürs zuschauen",
+  "bis zum nächsten mal",
+  "thank you for watching",
+  "thanks for watching",
+  "...",
+  "…",
+];
+
+interface TranscriptionResult {
+  success: boolean;
+  text?: string;
+  error?: string;
+  duration?: number;
+  language?: string;
+}
+
+interface WhisperApiResponse {
+  text: string;
+  language?: string;
+}
+
+function getExtensionFromMimeType(mimeType: string): string {
+  const map: Record<string, string> = {
+    "audio/webm": "webm",
+    "audio/mp3": "mp3",
+    "audio/mpeg": "mp3",
+    "audio/wav": "wav",
+    "audio/x-wav": "wav",
+    "audio/wave": "wav",
+    "audio/ogg": "ogg",
+    "audio/flac": "flac",
+    "audio/mp4": "m4a",
+    "video/mp4": "mp4",
+  };
+  return map[mimeType] || "webm";
+}
+
+async function convertToMp3(
+  audioBuffer: Buffer,
+  mimeType: string
+): Promise<{ buffer: Buffer; mimeType: string }> {
+  const baseMimeType = mimeType.split(";")[0].trim();
+  if (SUPPORTED_FORMATS.includes(baseMimeType)) {
+    return { buffer: audioBuffer, mimeType };
+  }
+
+  const tmpDir = os.tmpdir();
+  const timestamp = Date.now();
+  const inputPath = path.join(tmpDir, `polly_input_${timestamp}.webm`);
+  const outputPath = path.join(tmpDir, `polly_output_${timestamp}.mp3`);
+
+  try {
+    await fs.promises.writeFile(inputPath, audioBuffer);
+    await execAsync(
+      `ffmpeg -y -i "${inputPath}" -ar 16000 -ac 1 -b:a 64k "${outputPath}" 2>/dev/null`
+    );
+    const mp3Buffer = await fs.promises.readFile(outputPath);
+    console.log(
+      `[Whisper] Converted ${mimeType} (${audioBuffer.length} bytes) → MP3 (${mp3Buffer.length} bytes)`
+    );
+    return { buffer: mp3Buffer, mimeType: "audio/mpeg" };
+  } finally {
+    await fs.promises.unlink(inputPath).catch(() => {});
+    await fs.promises.unlink(outputPath).catch(() => {});
+  }
+}
+
+export async function transcribeAudio(
+  audioBuffer: Buffer,
+  mimeType: string = "audio/webm",
+  languageOverride?: string
+): Promise<TranscriptionResult> {
+  const startTime = Date.now();
+
+  if (audioBuffer.length < 1024) {
+    return { success: true, text: "", duration: 0, language: "de" };
+  }
+
+  const { getAiSettings, getEffectiveApiKey, getEffectiveApiUrl } = await import("./aiService");
+  const whisperSettings = await getAiSettings();
+  const apiUrl = getEffectiveApiUrl(whisperSettings);
+  const apiKey = getEffectiveApiKey(whisperSettings);
+  const apiKeyFallback = process.env.AI_API_KEY_FALLBACK || whisperSettings.apiKeyFallback || "";
+
+  if (!apiKey) {
+    return { success: false, error: "API nicht konfiguriert" };
+  }
+
+  const transcriptionUrl = `${apiUrl}/audio/transcriptions`;
+
+  let processedBuffer = audioBuffer;
+  let processedMimeType = mimeType;
+
+  const baseMimeType = mimeType.split(";")[0].trim();
+  if (NEEDS_CONVERSION.includes(baseMimeType)) {
+    try {
+      const converted = await convertToMp3(audioBuffer, mimeType);
+      processedBuffer = converted.buffer;
+      processedMimeType = converted.mimeType;
+    } catch (conversionError) {
+      console.error("[Whisper] Audio conversion failed:", conversionError);
+      return { success: false, error: "Audio-Konvertierung fehlgeschlagen." };
+    }
+  }
+
+  const extension = getExtensionFromMimeType(processedMimeType);
+  const filename = `audio.${extension}`;
+  const language = languageOverride || "de";
+
+  function buildFormData(buf: Buffer, mime: string): FormData {
+    const formData = new FormData();
+    const blob = new Blob([new Uint8Array(buf)], { type: mime });
+    formData.append("file", blob, filename);
+    formData.append("model", "whisper-large-v2");
+    formData.append("language", language);
+    formData.append("response_format", "json");
+    return formData;
+  }
+
+  try {
+    let response = await fetch(transcriptionUrl, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}` },
+      body: buildFormData(processedBuffer, processedMimeType),
+    });
+
+    if (response.status === 429 && apiKeyFallback) {
+      console.log("[Whisper] Rate limit hit, retrying with fallback key...");
+      response = await fetch(transcriptionUrl, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${apiKeyFallback}` },
+        body: buildFormData(processedBuffer, processedMimeType),
+      });
+    }
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error("[Whisper] API Error:", response.status, errorText);
+      return {
+        success: false,
+        error: `Transkription fehlgeschlagen (${response.status})`,
+      };
+    }
+
+    const result: WhisperApiResponse = await response.json();
+    const duration = Date.now() - startTime;
+    const transcribedText = result.text?.trim() || "";
+
+    const lowerText = transcribedText.toLowerCase();
+    const isHallucination =
+      HALLUCINATIONS.some((h) => lowerText.includes(h)) ||
+      transcribedText.length < 2;
+
+    if (isHallucination) {
+      console.log("[Whisper] Hallucination filtered:", transcribedText);
+      return { success: true, text: "", duration, language: result.language || "de" };
+    }
+
+    console.log(`[Whisper] Transcribed in ${duration}ms: "${transcribedText.substring(0, 80)}..."`);
+    return {
+      success: true,
+      text: transcribedText,
+      duration,
+      language: result.language || "de",
+    };
+  } catch (error) {
+    console.error("[Whisper] Transcription error:", error);
+    return { success: false, error: "Spracherkennung fehlgeschlagen." };
+  }
+}
+
+const MAX_CHUNK_SIZE_MB = 20;
+const CHUNK_DURATION_SECONDS = 150;
+
+export async function transcribeLargeFile(
+  audioBuffer: Buffer,
+  mimeType: string,
+  languageOverride?: string
+): Promise<TranscriptionResult> {
+  const fileSizeMB = audioBuffer.length / (1024 * 1024);
+
+  if (fileSizeMB <= MAX_CHUNK_SIZE_MB) {
+    return transcribeAudio(audioBuffer, mimeType, languageOverride);
+  }
+
+  console.log(`[Whisper] Large file (${fileSizeMB.toFixed(1)} MB), splitting into chunks...`);
+  const tempDir = path.join(os.tmpdir(), `polly_whisper_${Date.now()}`);
+
+  try {
+    await fs.promises.mkdir(tempDir, { recursive: true });
+
+    const ext = getExtensionFromMimeType(mimeType.split(";")[0].trim());
+    const inputPath = path.join(tempDir, `input.${ext}`);
+    const outputPattern = path.join(tempDir, `chunk_%03d.${ext}`);
+
+    await fs.promises.writeFile(inputPath, audioBuffer);
+    await execAsync(
+      `ffmpeg -i "${inputPath}" -f segment -segment_time ${CHUNK_DURATION_SECONDS} -c copy "${outputPattern}" -y`,
+      { timeout: 300000 }
+    );
+
+    const chunkFiles: string[] = [];
+    for (let i = 0; i < 100; i++) {
+      const p = path.join(tempDir, `chunk_${String(i).padStart(3, "0")}.${ext}`);
+      if (fs.existsSync(p)) chunkFiles.push(p);
+      else break;
+    }
+
+    if (chunkFiles.length === 0) {
+      return transcribeAudio(audioBuffer, mimeType, languageOverride);
+    }
+
+    const texts: string[] = [];
+    for (let i = 0; i < chunkFiles.length; i++) {
+      console.log(`[Whisper] Transcribing chunk ${i + 1}/${chunkFiles.length}...`);
+      const chunkBuffer = await fs.promises.readFile(chunkFiles[i]);
+      const result = await transcribeAudio(chunkBuffer, mimeType, languageOverride);
+      if (result.success && result.text) texts.push(result.text);
+    }
+
+    return {
+      success: true,
+      text: texts.join(" ").trim(),
+      language: languageOverride || "de",
+    };
+  } catch (error) {
+    console.error("[Whisper] Chunk transcription error:", error);
+    return { success: false, error: "Verarbeitung der großen Datei fehlgeschlagen." };
+  } finally {
+    try {
+      if (fs.existsSync(tempDir)) {
+        const files = await fs.promises.readdir(tempDir);
+        for (const f of files) {
+          await fs.promises.unlink(path.join(tempDir, f)).catch(() => {});
+        }
+        await fs.promises.rmdir(tempDir).catch(() => {});
+      }
+    } catch {}
+  }
+}
diff --git a/server/storage.ts b/server/storage.ts
index 4d1fe3b2..8d96b108 100644
--- a/server/storage.ts
+++ b/server/storage.ts
@@ -21,7 +21,7 @@ import {
   type CalendarSettings, calendarSettingsSchema
 } from "@shared/schema";
 import { db } from "./db";
-import { eq, desc, and, sql, count, isNull } from "drizzle-orm";
+import { eq, desc, and, sql, count, isNull, asc } from "drizzle-orm";
 
 // Export db for direct database access in routes
 export { db };
@@ -75,6 +75,7 @@ export interface IStorage {
   // System settings
   getSetting(key: string): Promise<SystemSetting | undefined>;
   setSetting(setting: InsertSystemSetting): Promise<SystemSetting>;
+  deleteSetting(key: string): Promise<void>;
   getSettings(): Promise<SystemSetting[]>;
 
   // Customization settings
@@ -319,6 +320,18 @@ export class DatabaseStorage implements IStorage {
     return { poll, adminToken, publicToken, options: createdOptions };
   }
 
+  private sortOptionsChronologically(options: PollOption[], pollType: string): PollOption[] {
+    if (pollType !== 'schedule') return options;
+    return [...options].sort((a, b) => {
+      const aTime = a.startTime ? new Date(a.startTime).getTime() : null;
+      const bTime = b.startTime ? new Date(b.startTime).getTime() : null;
+      if (aTime !== null && bTime !== null) return aTime - bTime;
+      if (aTime !== null) return -1;
+      if (bTime !== null) return 1;
+      return (a.order ?? a.id) - (b.order ?? b.id);
+    });
+  }
+
   async getPoll(id: string): Promise<PollWithOptions | undefined> {
     const [poll] = await db.select().from(polls).where(eq(polls.id, id));
     if (!poll) return undefined;
@@ -331,19 +344,31 @@ export class DatabaseStorage implements IStorage {
       [user] = await db.select().from(users).where(eq(users.id, poll.userId));
     }
 
-    return { ...poll, options, votes: allVotes, user };
+    return { ...poll, options: this.sortOptionsChronologically(options, poll.type), votes: allVotes, user };
   }
 
   async getPollByAdminToken(token: string): Promise<PollWithOptions | undefined> {
     const [poll] = await db.select().from(polls).where(eq(polls.adminToken, token));
     if (!poll) return undefined;
-    return this.getPoll(poll.id);
+    const options = await db.select().from(pollOptions).where(eq(pollOptions.pollId, poll.id)).orderBy(pollOptions.id);
+    const allVotes = await db.select().from(votes).where(eq(votes.pollId, poll.id));
+    let user: User | undefined;
+    if (poll.userId) {
+      [user] = await db.select().from(users).where(eq(users.id, poll.userId));
+    }
+    return { ...poll, options: this.sortOptionsChronologically(options, poll.type), votes: allVotes, user };
   }
 
   async getPollByPublicToken(token: string): Promise<PollWithOptions | undefined> {
     const [poll] = await db.select().from(polls).where(eq(polls.publicToken, token));
     if (!poll) return undefined;
-    return this.getPoll(poll.id);
+    const options = await db.select().from(pollOptions).where(eq(pollOptions.pollId, poll.id)).orderBy(pollOptions.id);
+    const allVotes = await db.select().from(votes).where(eq(votes.pollId, poll.id));
+    let user: User | undefined;
+    if (poll.userId) {
+      [user] = await db.select().from(users).where(eq(users.id, poll.userId));
+    }
+    return { ...poll, options: this.sortOptionsChronologically(options, poll.type), votes: allVotes, user };
   }
 
   async updatePoll(id: string, updates: Partial<InsertPoll>): Promise<Poll> {
@@ -352,9 +377,11 @@ export class DatabaseStorage implements IStorage {
   }
 
   async deletePoll(id: string): Promise<void> {
-    await db.delete(votes).where(eq(votes.pollId, id));
-    await db.delete(pollOptions).where(eq(pollOptions.pollId, id));
-    await db.delete(polls).where(eq(polls.id, id));
+    await db.transaction(async (tx) => {
+      await tx.delete(votes).where(eq(votes.pollId, id));
+      await tx.delete(pollOptions).where(eq(pollOptions.pollId, id));
+      await tx.delete(polls).where(eq(polls.id, id));
+    });
   }
 
   async getUserPolls(userId: number): Promise<PollWithOptions[]> {
@@ -798,17 +825,21 @@ export class DatabaseStorage implements IStorage {
     }
   }
 
+  async deleteSetting(key: string): Promise<void> {
+    await db.delete(systemSettings).where(eq(systemSettings.key, key));
+  }
+
   async getSettings(): Promise<SystemSetting[]> {
     return await db.select().from(systemSettings);
   }
 
   async getCustomizationSettings(): Promise<CustomizationSettings> {
-    // Parallelize all 4 database queries for better performance
-    const [themeSetting, brandingSetting, footerSetting, wcagSetting] = await Promise.all([
+    const [themeSetting, brandingSetting, footerSetting, wcagSetting, languageSetting] = await Promise.all([
       this.getSetting('customization_theme'),
       this.getSetting('customization_branding'),
       this.getSetting('customization_footer'),
       this.getSetting('customization_wcag'),
+      this.getSetting('customization_language'),
     ]);
 
     const settings = {
@@ -816,6 +847,7 @@ export class DatabaseStorage implements IStorage {
       branding: brandingSetting?.value || {},
       footer: footerSetting?.value || {},
       wcag: wcagSetting?.value || {},
+      language: languageSetting?.value || {},
     };
 
     return customizationSettingsSchema.parse(settings);
@@ -834,6 +866,9 @@ export class DatabaseStorage implements IStorage {
     if (settings.wcag) {
       await this.setSetting({ key: 'customization_wcag', value: settings.wcag });
     }
+    if (settings.language) {
+      await this.setSetting({ key: 'customization_language', value: settings.language });
+    }
 
     return await this.getCustomizationSettings();
   }
@@ -1345,39 +1380,45 @@ export class DatabaseStorage implements IStorage {
     let deletedOptions = 0;
     let deletedPolls = 0;
     
-    // Only proceed if there are test polls to delete
     if (testPollIds.length > 0) {
-      // Count votes before deletion
-      const [voteCount] = await db.select({ count: count() }).from(votes)
-        .where(sql`${votes.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`);
-      deletedVotes = voteCount.count;
-      
-      // Count options before deletion
-      const [optionCount] = await db.select({ count: count() }).from(pollOptions)
-        .where(sql`${pollOptions.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`);
-      deletedOptions = optionCount.count;
-      
-      // Delete in correct order: votes first, then options, then polls
-      await db.delete(votes).where(
-        sql`${votes.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`
-      );
-      
-      await db.delete(pollOptions).where(
-        sql`${pollOptions.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`
-      );
+      const pollResult = await db.transaction(async (tx) => {
+        const [voteCount] = await tx.select({ count: count() }).from(votes)
+          .where(sql`${votes.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`);
+        
+        const [optionCount] = await tx.select({ count: count() }).from(pollOptions)
+          .where(sql`${pollOptions.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`);
+        
+        await tx.delete(votes).where(
+          sql`${votes.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`
+        );
+        
+        await tx.delete(pollOptions).where(
+          sql`${pollOptions.pollId} IN (SELECT id FROM polls WHERE ${testPatternCondition})`
+        );
+        
+        await tx.delete(polls).where(testPatternCondition);
+        
+        return { deletedVotes: voteCount.count, deletedOptions: optionCount.count };
+      });
       
-      await db.delete(polls).where(testPatternCondition);
+      deletedVotes = pollResult.deletedVotes;
+      deletedOptions = pollResult.deletedOptions;
       deletedPolls = testPollIds.length;
     }
     
     // Delete test users (by flag or pattern) - with protection for users who have real data
     const testUserCondition = sql`
       is_test_data = true 
+      OR email LIKE '%@test.local'
+      OR email LIKE '%@test.de'
       OR email LIKE 'test-%@example.com' 
       OR email LIKE 'test\_%@example.com'
       OR email LIKE 'creator-%@example.com' 
       OR email LIKE 'voter-%@example.com'
       OR email LIKE 'fixtest-%@example.com'
+      OR email LIKE 'sessiontest-%@example.com'
+      OR email LIKE 'cookietest-%@example.com'
+      OR email LIKE 'reset-test-%@example.com'
       OR email LIKE 'e2e\_%@test.com'
       OR email LIKE 'e2e\_%@example.com'
       OR email LIKE 'e2etest\_%@example.com'
@@ -1385,14 +1426,19 @@ export class DatabaseStorage implements IStorage {
       OR email LIKE '%@test.example.com'
     `;
 
+    // Admin protection: resolve configured admin username from env (falls back to 'admin')
+    const configuredAdminUsername = process.env.ADMIN_USERNAME || 'admin';
+
     // Use a transaction to ensure atomicity - no user can be deleted between checks
     const userResult = await db.transaction(async (tx) => {
-      // Find protected user IDs: users who have votes in non-test polls or created non-test polls
+      // Find protected user IDs: admin users and users who have votes/polls in non-test data
       const protectedUserIds = await tx.execute(sql`
         SELECT DISTINCT u.id, u.email FROM users u
         WHERE (${testUserCondition})
         AND (
-          EXISTS (
+          (u.role = 'admin' AND u.is_test_data IS NOT TRUE)
+          OR u.username = ${configuredAdminUsername}
+          OR EXISTS (
             SELECT 1 FROM votes v 
             WHERE v.voter_email = u.email 
             AND v.poll_id NOT IN (SELECT p.id FROM polls p WHERE ${testPatternCondition})
@@ -1460,11 +1506,16 @@ export class DatabaseStorage implements IStorage {
     // Count users matching test patterns (same as purgeTestData)
     const testUserCondition = sql`
       is_test_data = true 
+      OR email LIKE '%@test.local'
+      OR email LIKE '%@test.de'
       OR email LIKE 'test-%@example.com' 
       OR email LIKE 'test\_%@example.com'
       OR email LIKE 'creator-%@example.com' 
       OR email LIKE 'voter-%@example.com'
       OR email LIKE 'fixtest-%@example.com'
+      OR email LIKE 'sessiontest-%@example.com'
+      OR email LIKE 'cookietest-%@example.com'
+      OR email LIKE 'reset-test-%@example.com'
       OR email LIKE 'e2e\_%@test.com'
       OR email LIKE 'e2e\_%@example.com'
       OR email LIKE 'e2etest\_%@example.com'
diff --git a/server/tests/api/admin-comprehensive.test.ts b/server/tests/api/admin-comprehensive.test.ts
new file mode 100644
index 00000000..908488dd
--- /dev/null
+++ b/server/tests/api/admin-comprehensive.test.ts
@@ -0,0 +1,551 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import request from 'supertest';
+import { createTestApp } from '../testApp';
+import type { Express } from 'express';
+import { ADMIN_USERNAME, ADMIN_PASSWORD } from '../testCredentials';
+import { storage } from '../../storage';
+
+export const testMeta = {
+  category: 'functional' as const,
+  name: 'Admin-Funktionalität',
+  description: 'Umfassende Tests aller Admin-Endpunkte mit Authentifizierung',
+  severity: 'critical' as const,
+};
+
+describe('Admin API - Comprehensive Functional Tests', () => {
+  let app: Express;
+  let adminAgent: any;
+
+  beforeAll(async () => {
+    app = await createTestApp();
+    adminAgent = request.agent(app);
+    const loginRes = await adminAgent
+      .post('/api/v1/auth/login')
+      .send({ usernameOrEmail: ADMIN_USERNAME, password: ADMIN_PASSWORD });
+    expect([200, 201]).toContain(loginRes.status);
+  });
+
+  afterAll(async () => {
+    try {
+      await storage.purgeTestData();
+    } catch { }
+  });
+
+  describe('System Stats & Status', () => {
+    it('should return stats', async () => {
+      const res = await adminAgent.get('/api/v1/admin/stats');
+      expect(res.status).toBe(200);
+      expect(res.body).toBeDefined();
+    });
+
+    it('should return extended stats', async () => {
+      const res = await adminAgent.get('/api/v1/admin/extended-stats');
+      expect(res.status).toBe(200);
+      expect(res.body.totalUsers).toBeDefined();
+    });
+
+    it('should return system status', async () => {
+      const res = await adminAgent.get('/api/v1/admin/system-status');
+      expect(res.status).toBe(200);
+      expect(res.body).toBeDefined();
+    });
+
+    it('should return vulnerabilities report', async () => {
+      const res = await adminAgent.get('/api/v1/admin/vulnerabilities');
+      expect(res.status).toBe(200);
+      expect(typeof res.body).toBe('object');
+    });
+
+    it('should return system packages', async () => {
+      const res = await adminAgent.get('/api/v1/admin/system-packages');
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('User Management CRUD', () => {
+    let testUserId: number;
+    const testUsername = `admintest_${Date.now()}`;
+
+    it('should list users', async () => {
+      const res = await adminAgent.get('/api/v1/admin/users');
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body)).toBe(true);
+    });
+
+    it('should create a user', async () => {
+      const res = await adminAgent.post('/api/v1/admin/users').send({
+        name: 'Test Admin User',
+        email: `${testUsername}@test.local`,
+        username: testUsername,
+        password: 'TestPass123!',
+        role: 'user',
+      });
+      expect(res.status).toBe(201);
+      expect(res.body.id).toBeDefined();
+      expect(res.body.username).toBe(testUsername);
+      testUserId = res.body.id;
+    });
+
+    it('should reject creating a user with duplicate username', async () => {
+      const res = await adminAgent.post('/api/v1/admin/users').send({
+        name: 'Duplicate',
+        email: `dup_${Date.now()}@test.local`,
+        username: testUsername,
+        password: 'TestPass123!',
+        role: 'user',
+      });
+      expect(res.status).toBe(400);
+      expect(res.body.error).toBeDefined();
+    });
+
+    it('should reject creating a user with invalid role', async () => {
+      const res = await adminAgent.post('/api/v1/admin/users').send({
+        name: 'Bad Role',
+        email: `badrole_${Date.now()}@test.local`,
+        username: `badrole_${Date.now()}`,
+        password: 'TestPass123!',
+        role: 'superadmin',
+      });
+      expect(res.status).toBe(400);
+      expect(res.body.error).toContain('Ungültige Rolle');
+    });
+
+    it('should reject creating a user with weak password', async () => {
+      const res = await adminAgent.post('/api/v1/admin/users').send({
+        name: 'Weak Pass',
+        email: `weak_${Date.now()}@test.local`,
+        username: `weak_${Date.now()}`,
+        password: '123',
+        role: 'user',
+      });
+      expect(res.status).toBe(400);
+    });
+
+    it('should update a user', async () => {
+      const res = await adminAgent.patch(`/api/v1/admin/users/${testUserId}`).send({
+        name: 'Updated Test User',
+        role: 'manager',
+      });
+      expect(res.status).toBe(200);
+      expect(res.body.name).toBe('Updated Test User');
+      expect(res.body.role).toBe('manager');
+    });
+
+    it('should delete a user', async () => {
+      const res = await adminAgent.delete(`/api/v1/admin/users/${testUserId}`);
+      if (res.status === 403 && res.body?.code === 'MANUAL_DELETE_DISABLED') {
+        expect(res.body.code).toBe('MANUAL_DELETE_DISABLED');
+      } else {
+        expect(res.status).toBe(200);
+        expect(res.body.success).toBe(true);
+      }
+    });
+
+    it('should reject self-deletion', async () => {
+      const meRes = await adminAgent.get('/api/v1/auth/me');
+      const myId = meRes.body.user?.id;
+      if (myId) {
+        const res = await adminAgent.delete(`/api/v1/admin/users/${myId}`);
+        if (res.status === 403 && res.body?.code === 'MANUAL_DELETE_DISABLED') {
+          expect(res.body.code).toBe('MANUAL_DELETE_DISABLED');
+        } else {
+          expect(res.status).toBe(400);
+        }
+      }
+    });
+  });
+
+  describe('Poll Management', () => {
+    it('should list polls', async () => {
+      const res = await adminAgent.get('/api/v1/admin/polls');
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body)).toBe(true);
+    });
+
+    it('should return 404 for patching non-existent poll', async () => {
+      const res = await adminAgent.patch('/api/v1/admin/polls/00000000-0000-0000-0000-000000000000').send({ isActive: false });
+      expect(res.status).toBe(404);
+    });
+
+    it('should return 404 for deleting non-existent poll', async () => {
+      const res = await adminAgent.delete('/api/v1/admin/polls/00000000-0000-0000-0000-000000000000');
+      expect(res.status).toBe(404);
+    });
+
+    it('should reject patch with no updates', async () => {
+      const pollsRes = await adminAgent.get('/api/v1/admin/polls');
+      if (pollsRes.body.length > 0) {
+        const res = await adminAgent.patch(`/api/v1/admin/polls/${pollsRes.body[0].id}`).send({});
+        expect(res.status).toBe(400);
+      }
+    });
+  });
+
+  describe('Settings CRUD', () => {
+    const testKey = `test_setting_${Date.now()}`;
+
+    it('should list settings', async () => {
+      const res = await adminAgent.get('/api/v1/admin/settings');
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body)).toBe(true);
+    });
+
+    it('should create a setting', async () => {
+      const res = await adminAgent.post('/api/v1/admin/settings').send({
+        key: testKey,
+        value: { test: true },
+      });
+      expect(res.status).toBe(200);
+    });
+
+    it('should delete a setting', async () => {
+      const res = await adminAgent.delete(`/api/v1/admin/settings/${testKey}`);
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+    });
+
+    it('should verify setting was deleted', async () => {
+      const res = await adminAgent.get('/api/v1/admin/settings');
+      const found = res.body.find((s: any) => s.key === testKey);
+      expect(found).toBeUndefined();
+    });
+  });
+
+  describe('Security Settings', () => {
+    it('should get security settings', async () => {
+      const res = await adminAgent.get('/api/v1/admin/security');
+      expect(res.status).toBe(200);
+      expect(res.body.settings).toBeDefined();
+    });
+
+    it('should save security settings (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/security');
+      const settings = getRes.body.settings;
+      const putRes = await adminAgent.put('/api/v1/admin/security').send(settings);
+      expect(putRes.status).toBe(200);
+      expect(putRes.body.success).toBe(true);
+    });
+
+    it('should clear rate limits', async () => {
+      const res = await adminAgent.post('/api/v1/admin/security/clear-rate-limits').send({});
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+    });
+  });
+
+  describe('API Rate Limits', () => {
+    it('should get rate limit config', async () => {
+      const res = await adminAgent.get('/api/v1/admin/api-rate-limits');
+      expect(res.status).toBe(200);
+    });
+
+    it('should update rate limit config (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/api-rate-limits');
+      const putRes = await adminAgent.put('/api/v1/admin/api-rate-limits').send(getRes.body);
+      expect(putRes.status).toBe(200);
+    });
+
+    it('should clear API rate limits', async () => {
+      const res = await adminAgent.post('/api/v1/admin/api-rate-limits/clear').send({});
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+    });
+  });
+
+  describe('Notification Settings', () => {
+    it('should get notification settings', async () => {
+      const res = await adminAgent.get('/api/v1/admin/notifications');
+      expect(res.status).toBe(200);
+    });
+
+    it('should save notification settings (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/notifications');
+      const putRes = await adminAgent.put('/api/v1/admin/notifications').send(getRes.body);
+      expect(putRes.status).toBe(200);
+    });
+  });
+
+  describe('Session Timeout Settings', () => {
+    it('should get session timeout', async () => {
+      const res = await adminAgent.get('/api/v1/admin/session-timeout');
+      expect(res.status).toBe(200);
+    });
+
+    it('should save session timeout (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/session-timeout');
+      const putRes = await adminAgent.put('/api/v1/admin/session-timeout').send(getRes.body);
+      expect(putRes.status).toBe(200);
+    });
+  });
+
+  describe('Calendar Settings', () => {
+    it('should get calendar settings', async () => {
+      const res = await adminAgent.get('/api/v1/admin/calendar');
+      expect(res.status).toBe(200);
+    });
+
+    it('should save calendar settings (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/calendar');
+      const putRes = await adminAgent.put('/api/v1/admin/calendar').send(getRes.body);
+      expect(putRes.status).toBe(200);
+    });
+  });
+
+  describe('Customization & Branding', () => {
+    let savedCustomization: any;
+
+    beforeAll(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+
+    afterAll(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+    });
+
+    it('should get customization settings', async () => {
+      const res = await adminAgent.get('/api/v1/admin/customization');
+      expect(res.status).toBe(200);
+      expect(res.body.branding).toBeDefined();
+      expect(res.body.theme).toBeDefined();
+    });
+
+    it('should save customization settings (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/customization');
+      const putRes = await adminAgent.put('/api/v1/admin/customization').send(getRes.body);
+      expect(putRes.status).toBe(200);
+    });
+
+    it('should reset branding', async () => {
+      const res = await adminAgent.post('/api/v1/admin/branding/reset').send({});
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+    });
+  });
+
+  describe('WCAG Accessibility', () => {
+    it('should run a WCAG audit', async () => {
+      const res = await adminAgent.post('/api/v1/admin/wcag/audit').send({});
+      expect(res.status).toBe(200);
+      expect(res.body.runAt).toBeDefined();
+    });
+
+    it('should update WCAG settings', async () => {
+      const res = await adminAgent.put('/api/v1/admin/wcag/settings').send({ autoCorrection: false });
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('Email Templates', () => {
+    it('should list all templates', async () => {
+      const res = await adminAgent.get('/api/v1/admin/email-templates');
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body)).toBe(true);
+      expect(res.body.length).toBeGreaterThan(0);
+    });
+
+    const templateTypes = ['poll_created', 'invitation', 'vote_confirmation', 'reminder', 'password_reset', 'email_change', 'password_changed', 'test_report'];
+
+    for (const type of templateTypes) {
+      it(`should get template ${type}`, async () => {
+        const res = await adminAgent.get(`/api/v1/admin/email-templates/${type}`);
+        expect(res.status).toBe(200);
+        expect(res.body.type).toBe(type);
+      });
+
+      it(`should preview template ${type}`, async () => {
+        const res = await adminAgent.post(`/api/v1/admin/email-templates/${type}/preview`).send({});
+        expect(res.status).toBe(200);
+        expect(res.body.html).toBeDefined();
+        expect(res.body.subject).toBeDefined();
+      });
+
+      it(`should get variables for ${type}`, async () => {
+        const res = await adminAgent.get(`/api/v1/admin/email-templates/${type}/variables`);
+        expect(res.status).toBe(200);
+        expect(Array.isArray(res.body)).toBe(true);
+      });
+    }
+
+    it('should reject invalid template type', async () => {
+      const res = await adminAgent.get('/api/v1/admin/email-templates/invalid_type');
+      expect(res.status).toBe(400);
+    });
+
+    it('should reject preview for invalid template type', async () => {
+      const res = await adminAgent.post('/api/v1/admin/email-templates/invalid_type/preview').send({});
+      expect(res.status).toBe(400);
+    });
+  });
+
+  describe('Email Theme', () => {
+    it('should get email theme', async () => {
+      const res = await adminAgent.get('/api/v1/admin/email-theme');
+      expect(res.status).toBe(200);
+      expect(res.body.backdropColor).toBeDefined();
+      expect(res.body.canvasColor).toBeDefined();
+      expect(res.body.textColor).toBeDefined();
+      expect(res.body.buttonBackgroundColor).toBeDefined();
+    });
+
+    it('should update email theme', async () => {
+      const res = await adminAgent.put('/api/v1/admin/email-theme').send({
+        backdropColor: '#EEEEEE',
+        textColor: '#111111',
+      });
+      expect(res.status).toBe(200);
+      expect(res.body.backdropColor).toBe('#EEEEEE');
+      expect(res.body.textColor).toBe('#111111');
+    });
+
+    it('should apply theme colors in email preview', async () => {
+      const previewRes = await adminAgent.post('/api/v1/admin/email-templates/poll_created/preview').send({});
+      expect(previewRes.status).toBe(200);
+      expect(previewRes.body.html).toBeDefined();
+      expect(previewRes.body.html.length).toBeGreaterThan(100);
+    });
+
+    it('should reset email theme', async () => {
+      const res = await adminAgent.post('/api/v1/admin/email-theme/reset').send({});
+      expect(res.status).toBe(200);
+      expect(res.body.backdropColor).toBe('#F5F5F5');
+    });
+
+    it('should import theme from JSON', async () => {
+      const res = await adminAgent.post('/api/v1/admin/email-theme/import').send({
+        jsonContent: {
+          root: {
+            type: 'EmailLayout',
+            data: {
+              backdropColor: '#DDDDDD',
+              canvasColor: '#FAFAFA',
+              textColor: '#222222',
+              fontFamily: 'Arial, sans-serif',
+              childrenIds: [],
+            },
+          },
+        },
+      });
+      expect(res.status).toBe(200);
+      expect(res.body.preview).toBeDefined();
+      expect(res.body.preview.backdropColor).toBe('#DDDDDD');
+    });
+  });
+
+  describe('Email Footer', () => {
+    it('should get email footer', async () => {
+      const res = await adminAgent.get('/api/v1/admin/email-footer');
+      expect(res.status).toBe(200);
+      expect(res.body.html).toBeDefined();
+    });
+
+    it('should update email footer (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/email-footer');
+      const putRes = await adminAgent.put('/api/v1/admin/email-footer').send(getRes.body);
+      expect(putRes.status).toBe(200);
+    });
+  });
+
+  describe('Deletion Requests', () => {
+    it('should list deletion requests', async () => {
+      const res = await adminAgent.get('/api/v1/admin/deletion-requests');
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body)).toBe(true);
+    });
+  });
+
+  describe('Deprovisioning Settings', () => {
+    it('should get deprovision settings', async () => {
+      const res = await adminAgent.get('/api/v1/admin/deprovision-settings');
+      expect(res.status).toBe(200);
+    });
+
+    it('should save deprovision settings (round-trip)', async () => {
+      const getRes = await adminAgent.get('/api/v1/admin/deprovision-settings');
+      const putRes = await adminAgent.put('/api/v1/admin/deprovision-settings').send(getRes.body);
+      expect(putRes.status).toBe(200);
+    });
+  });
+
+  describe('ClamAV', () => {
+    it('should get ClamAV config', async () => {
+      const res = await adminAgent.get('/api/v1/admin/clamav');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get scan stats', async () => {
+      const res = await adminAgent.get('/api/v1/admin/clamav/scan-stats');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get scan logs', async () => {
+      const res = await adminAgent.get('/api/v1/admin/clamav/scan-logs');
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('Pentest Tools', () => {
+    it('should get pentest tools status', async () => {
+      const res = await adminAgent.get('/api/v1/admin/pentest-tools/status');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get pentest tools config', async () => {
+      const res = await adminAgent.get('/api/v1/admin/pentest-tools/config');
+      expect(res.status).toBe(200);
+      expect(typeof res.body.configured).toBe('boolean');
+    });
+
+    it('should get target info', async () => {
+      const res = await adminAgent.get('/api/v1/admin/pentest-tools/target');
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('Tests & Monitoring', () => {
+    it('should get test environment', async () => {
+      const res = await adminAgent.get('/api/v1/admin/tests/environment');
+      expect(res.status).toBe(200);
+      expect(res.body.environment).toBeDefined();
+    });
+
+    it('should list test categories', async () => {
+      const res = await adminAgent.get('/api/v1/admin/tests');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get test runs', async () => {
+      const res = await adminAgent.get('/api/v1/admin/tests/runs');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get test schedule', async () => {
+      const res = await adminAgent.get('/api/v1/admin/tests/schedule');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get test configurations', async () => {
+      const res = await adminAgent.get('/api/v1/admin/tests/configurations');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get test data stats', async () => {
+      const res = await adminAgent.get('/api/v1/admin/tests/data-stats');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get test-runs (formatted)', async () => {
+      const res = await adminAgent.get('/api/v1/admin/test-runs');
+      expect(res.status).toBe(200);
+    });
+
+    it('should get current test run status', async () => {
+      const res = await adminAgent.get('/api/v1/admin/test-runs/current');
+      expect(res.status).toBe(200);
+    });
+
+    it('should set test mode', async () => {
+      const res = await adminAgent.put('/api/v1/admin/tests/mode').send({ mode: 'manual' });
+      expect(res.status).toBe(200);
+    });
+  });
+});
diff --git a/server/tests/api/polls-routes.test.ts b/server/tests/api/polls-routes.test.ts
new file mode 100644
index 00000000..d0f97965
--- /dev/null
+++ b/server/tests/api/polls-routes.test.ts
@@ -0,0 +1,230 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import request from 'supertest';
+import { createTestApp } from '../testApp';
+import type { Express } from 'express';
+import { ADMIN_USERNAME, ADMIN_PASSWORD } from '../testCredentials';
+
+let app: Express;
+let agent: ReturnType<typeof request.agent>;
+
+async function loginAsAdmin(ag: ReturnType<typeof request.agent>) {
+  await ag
+    .post('/api/v1/auth/login')
+    .send({ usernameOrEmail: ADMIN_USERNAME, password: ADMIN_PASSWORD });
+}
+
+describe('Poll CRUD Routes', () => {
+  let adminToken: string;
+  let publicToken: string;
+  let pollId: string;
+
+  beforeAll(async () => {
+    app = await createTestApp();
+    agent = request.agent(app);
+    await loginAsAdmin(agent);
+  });
+
+  describe('POST /api/v1/polls', () => {
+    it('should create a schedule poll', async () => {
+      const res = await agent.post('/api/v1/polls').send({
+        title: 'Test Schedule Poll Routes',
+        type: 'schedule',
+        allowVoteEdit: true,
+        options: [
+          { text: 'Montag 10 Uhr' },
+          { text: 'Dienstag 14 Uhr' },
+        ],
+      });
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('adminToken');
+      expect(res.body).toHaveProperty('publicToken');
+      expect(res.body).toHaveProperty('poll');
+      expect(res.body.poll.title).toBe('Test Schedule Poll Routes');
+      expect(res.body.poll.type).toBe('schedule');
+      adminToken = res.body.adminToken;
+      publicToken = res.body.publicToken;
+      pollId = res.body.poll.id;
+    });
+
+    it('should create a survey poll', async () => {
+      const res = await agent.post('/api/v1/polls').send({
+        title: 'Test Survey Poll Routes',
+        type: 'survey',
+        options: [
+          { text: 'Option A' },
+          { text: 'Option B' },
+          { text: 'Option C' },
+        ],
+      });
+      expect(res.status).toBe(200);
+      expect(res.body.poll.type).toBe('survey');
+    });
+
+    it('should create an organization poll', async () => {
+      const res = await agent.post('/api/v1/polls').send({
+        title: 'Test Orga Poll Routes',
+        type: 'organization',
+        options: [
+          { text: 'Slot 1', maxCapacity: 5 },
+          { text: 'Slot 2', maxCapacity: 3 },
+        ],
+      });
+      expect(res.status).toBe(200);
+      expect(res.body.poll.type).toBe('organization');
+    });
+
+    it('should reject poll without title', async () => {
+      const res = await agent.post('/api/v1/polls').send({
+        type: 'schedule',
+        options: [{ text: 'Option' }],
+      });
+      expect(res.status).toBe(400);
+    });
+
+    it('should reject poll without type', async () => {
+      const res = await agent.post('/api/v1/polls').send({
+        title: 'No Type Poll',
+        options: [{ text: 'Option' }],
+      });
+      expect(res.status).toBe(400);
+    });
+  });
+
+  describe('GET /api/v1/polls/public/:token', () => {
+    it('should get poll by public token', async () => {
+      const res = await request(app).get(`/api/v1/polls/public/${publicToken}`);
+      expect(res.status).toBe(200);
+      expect(res.body.title).toBe('Test Schedule Poll Routes');
+      expect(res.body.options).toHaveLength(2);
+      expect(res.body).not.toHaveProperty('adminToken');
+    });
+
+    it('should return 404 for invalid public token', async () => {
+      const res = await request(app).get('/api/v1/polls/public/nonexistent_token_xyz');
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('GET /api/v1/polls/admin/:token', () => {
+    it('should get poll by admin token', async () => {
+      const res = await agent.get(`/api/v1/polls/admin/${adminToken}`);
+      expect(res.status).toBe(200);
+      expect(res.body.title).toBe('Test Schedule Poll Routes');
+      expect(res.body).toHaveProperty('adminToken');
+    });
+
+    it('should return 404 for invalid admin token', async () => {
+      const res = await agent.get('/api/v1/polls/admin/nonexistent_admin_token');
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('PATCH /api/v1/polls/admin/:token', () => {
+    it('should update poll title', async () => {
+      const res = await agent
+        .patch(`/api/v1/polls/admin/${adminToken}`)
+        .send({ title: 'Updated Schedule Poll' });
+      expect(res.status).toBe(200);
+      expect(res.body.title).toBe('Updated Schedule Poll');
+    });
+
+    it('should update poll settings', async () => {
+      const res = await agent
+        .patch(`/api/v1/polls/admin/${adminToken}`)
+        .send({ allowMaybe: false, resultsPublic: false });
+      expect(res.status).toBe(200);
+    });
+
+    it('should return 404 for invalid admin token on update', async () => {
+      const res = await agent
+        .patch('/api/v1/polls/admin/invalid_token_xyz')
+        .send({ title: 'Should Fail' });
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('POST /api/v1/polls/admin/:token/options', () => {
+    it('should add an option to the poll', async () => {
+      const res = await agent
+        .post(`/api/v1/polls/admin/${adminToken}/options`)
+        .send({ text: 'Mittwoch 16 Uhr' });
+      expect([200, 201]).toContain(res.status);
+      expect(res.body.text).toBe('Mittwoch 16 Uhr');
+    });
+  });
+
+  describe('Voting flow', () => {
+    it('should vote on a poll via public token', async () => {
+      const pollRes = await request(app).get(`/api/v1/polls/public/${publicToken}`);
+      const optionId = pollRes.body.options[0].id;
+
+      const res = await request(app)
+        .post(`/api/v1/polls/${publicToken}/vote`)
+        .send({
+          votes: [{ optionId, response: 'yes' }],
+          voterName: 'Test Voter Routes',
+          voterEmail: 'test-voter-routes@example.com',
+        });
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('voterEditToken');
+    });
+
+    it('should get votes by edit token', async () => {
+      const pollRes = await request(app).get(`/api/v1/polls/public/${publicToken}`);
+      const optionId = pollRes.body.options[1].id;
+
+      const voteRes = await request(app)
+        .post(`/api/v1/polls/${publicToken}/vote`)
+        .send({
+          votes: [{ optionId, response: 'yes' }],
+          voterName: 'Edit Token Voter',
+          voterEmail: 'edit-voter-routes@example.com',
+        });
+
+      expect(voteRes.status).toBe(200);
+      const editToken = voteRes.body.voterEditToken;
+      expect(editToken).toBeTruthy();
+
+      const getRes = await request(app).get(`/api/v1/votes/edit/${editToken}`);
+      expect(getRes.status).toBe(200);
+      expect(getRes.body).toHaveProperty('poll');
+      expect(getRes.body).toHaveProperty('votes');
+      expect(Array.isArray(getRes.body.votes)).toBe(true);
+      expect(getRes.body.voterName).toBe('Edit Token Voter');
+    });
+
+    it('should return 404 for invalid edit token', async () => {
+      const res = await request(app).get('/api/v1/votes/edit/invalid_edit_token_xyz');
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('Export routes', () => {
+    it('should generate QR code for poll', async () => {
+      const res = await request(app).get(`/api/v1/polls/${publicToken}/qr`);
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('qrCode');
+      expect(res.body).toHaveProperty('pollUrl');
+    });
+
+    it('should export poll as CSV via admin token', async () => {
+      const res = await request(app).get(`/api/v1/polls/${adminToken}/export/csv`);
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('DELETE /api/v1/polls/admin/:token', () => {
+    it('should delete poll by admin token', async () => {
+      const res = await agent.delete(`/api/v1/polls/admin/${adminToken}`);
+      expect(res.status).toBe(200);
+
+      const checkRes = await request(app).get(`/api/v1/polls/public/${publicToken}`);
+      expect(checkRes.status).toBe(404);
+    });
+
+    it('should return 404 when deleting non-existent poll', async () => {
+      const res = await agent.delete('/api/v1/polls/admin/nonexistent_delete_token');
+      expect(res.status).toBe(404);
+    });
+  });
+});
diff --git a/server/tests/api/users.test.ts b/server/tests/api/users.test.ts
new file mode 100644
index 00000000..07a60327
--- /dev/null
+++ b/server/tests/api/users.test.ts
@@ -0,0 +1,192 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import request from 'supertest';
+import { createTestApp } from '../testApp';
+import type { Express } from 'express';
+import { ADMIN_USERNAME, ADMIN_PASSWORD } from '../testCredentials';
+
+let app: Express;
+let agent: ReturnType<typeof request.agent>;
+
+async function loginAsAdmin(ag: ReturnType<typeof request.agent>) {
+  const res = await ag
+    .post('/api/v1/auth/login')
+    .send({ usernameOrEmail: ADMIN_USERNAME, password: ADMIN_PASSWORD });
+  return res;
+}
+
+describe('User Routes API', () => {
+  beforeAll(async () => {
+    app = await createTestApp();
+    agent = request.agent(app);
+    await loginAsAdmin(agent);
+  });
+
+  describe('GET /api/v1/user/profile', () => {
+    it('should return 401 when not authenticated', async () => {
+      const res = await request(app).get('/api/v1/user/profile');
+      expect(res.status).toBe(401);
+    });
+
+    it('should return user profile when authenticated', async () => {
+      const res = await agent.get('/api/v1/user/profile');
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('id');
+      expect(res.body).toHaveProperty('username');
+      expect(res.body).toHaveProperty('email');
+      expect(res.body).toHaveProperty('role');
+      expect(res.body).toHaveProperty('themePreference');
+      expect(res.body).toHaveProperty('languagePreference');
+      expect(res.body).not.toHaveProperty('passwordHash');
+    });
+  });
+
+  describe('PUT /api/v1/user/profile', () => {
+    it('should return 401 when not authenticated', async () => {
+      const res = await request(app)
+        .put('/api/v1/user/profile')
+        .send({ name: 'Test' });
+      expect(res.status).toBe(401);
+    });
+
+    it('should update profile name', async () => {
+      const originalProfile = await agent.get('/api/v1/user/profile');
+      const originalName = originalProfile.body.name;
+
+      const res = await agent
+        .put('/api/v1/user/profile')
+        .send({ name: 'Test Update Name' });
+      expect(res.status).toBe(200);
+      expect(res.body.name).toBe('Test Update Name');
+
+      await agent.put('/api/v1/user/profile').send({ name: originalName });
+    });
+
+    it('should reject empty updates', async () => {
+      const res = await agent.put('/api/v1/user/profile').send({});
+      expect(res.status).toBe(400);
+    });
+
+    it('should reject invalid theme preference', async () => {
+      const res = await agent
+        .put('/api/v1/user/profile')
+        .send({ themePreference: 'invalid' });
+      expect(res.status).toBe(400);
+    });
+
+    it('should accept valid theme preference', async () => {
+      const res = await agent
+        .put('/api/v1/user/profile')
+        .send({ themePreference: 'dark' });
+      expect(res.status).toBe(200);
+      expect(res.body.themePreference).toBe('dark');
+
+      await agent.put('/api/v1/user/profile').send({ themePreference: 'system' });
+    });
+  });
+
+  describe('PATCH /api/v1/users/me/language', () => {
+    it('should return 401 when not authenticated', async () => {
+      const res = await request(app)
+        .patch('/api/v1/users/me/language')
+        .send({ language: 'en' });
+      expect(res.status).toBe(401);
+    });
+
+    it('should update language to en', async () => {
+      const res = await agent
+        .patch('/api/v1/users/me/language')
+        .send({ language: 'en' });
+      expect(res.status).toBe(200);
+      expect(res.body.languagePreference).toBe('en');
+    });
+
+    it('should update language to de', async () => {
+      const res = await agent
+        .patch('/api/v1/users/me/language')
+        .send({ language: 'de' });
+      expect(res.status).toBe(200);
+      expect(res.body.languagePreference).toBe('de');
+    });
+
+    it('should reject invalid language', async () => {
+      const res = await agent
+        .patch('/api/v1/users/me/language')
+        .send({ language: 'fr' });
+      expect(res.status).toBe(400);
+    });
+
+    it('should reject missing language', async () => {
+      const res = await agent
+        .patch('/api/v1/users/me/language')
+        .send({});
+      expect(res.status).toBe(400);
+    });
+  });
+
+  describe('PUT /api/v1/user/theme', () => {
+    it('should return 401 when not authenticated', async () => {
+      const res = await request(app)
+        .put('/api/v1/user/theme')
+        .send({ themePreference: 'dark' });
+      expect(res.status).toBe(401);
+    });
+
+    it('should update theme to dark', async () => {
+      const res = await agent
+        .put('/api/v1/user/theme')
+        .send({ themePreference: 'dark' });
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.themePreference).toBe('dark');
+    });
+
+    it('should update theme to light', async () => {
+      const res = await agent
+        .put('/api/v1/user/theme')
+        .send({ themePreference: 'light' });
+      expect(res.status).toBe(200);
+      expect(res.body.themePreference).toBe('light');
+    });
+
+    it('should reset theme to system', async () => {
+      const res = await agent
+        .put('/api/v1/user/theme')
+        .send({ themePreference: 'system' });
+      expect(res.status).toBe(200);
+      expect(res.body.themePreference).toBe('system');
+    });
+
+    it('should reject invalid theme', async () => {
+      const res = await agent
+        .put('/api/v1/user/theme')
+        .send({ themePreference: 'neon' });
+      expect(res.status).toBe(400);
+    });
+  });
+
+  describe('GET /api/v1/user/polls', () => {
+    it('should return 401 when not authenticated', async () => {
+      const res = await request(app).get('/api/v1/user/polls');
+      expect(res.status).toBe(401);
+    });
+
+    it('should return array of polls', async () => {
+      const res = await agent.get('/api/v1/user/polls');
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body)).toBe(true);
+    });
+  });
+
+  describe('GET /api/v1/user/participations', () => {
+    it('should return 401 when not authenticated', async () => {
+      const res = await request(app).get('/api/v1/user/participations');
+      expect(res.status).toBe(401);
+    });
+
+    it('should return array of participations', async () => {
+      const res = await agent.get('/api/v1/user/participations');
+      expect(res.status).toBe(200);
+      expect(Array.isArray(res.body)).toBe(true);
+    });
+  });
+});
diff --git a/server/tests/auth/cookieSecurity.test.ts b/server/tests/auth/cookieSecurity.test.ts
index 84c692b9..7e4f36e8 100644
--- a/server/tests/auth/cookieSecurity.test.ts
+++ b/server/tests/auth/cookieSecurity.test.ts
@@ -5,6 +5,7 @@ import { nanoid } from 'nanoid';
 import bcrypt from 'bcryptjs';
 import type { Express } from 'express';
 import { storage } from '../../storage';
+import { loginRateLimiter } from '../../services/rateLimiterService';
 
 export const testMeta = {
   category: 'security' as const,
@@ -14,7 +15,7 @@ export const testMeta = {
 };
 
 async function createUserAndLogin(app: Express) {
-  const email = `cookietest-${nanoid(8)}@example.com`;
+  const email = `cookietest-${nanoid(8)}@test.local`;
   const password = 'TestPassword123!';
   const username = `cookieuser_${nanoid(8)}`;
   const passwordHash = await bcrypt.hash(password, 10);
@@ -31,6 +32,7 @@ async function createUserAndLogin(app: Express) {
   
   const loginResponse = await request(app)
     .post('/api/v1/auth/login')
+    .set('X-Test-Mode', 'polly-e2e-test-mode')
     .send({
       usernameOrEmail: email,
       password: password,
@@ -51,6 +53,8 @@ describe('Cookie Security - CRITICAL', () => {
     app = await createTestApp();
   });
 
+
+
   describe('Cookie Attributes', () => {
     it('should set httpOnly flag on session cookie', async () => {
       const { cookies } = await createUserAndLogin(app);
@@ -103,8 +107,9 @@ describe('Cookie Security - CRITICAL', () => {
     });
 
     it('should verify production config sets secure=true for proxied environments', () => {
+      const resolvedUrl = process.env.APP_URL || process.env.BASE_URL || '';
       const isProxied = process.env.NODE_ENV === 'production' || 
-                        process.env.BASE_URL?.includes('replit') ||
+                        resolvedUrl.includes('replit') ||
                         process.env.REPLIT_DEV_DOMAIN ||
                         process.env.REPL_ID;
       
@@ -174,7 +179,7 @@ describe('Cookie Security - CRITICAL', () => {
       
       expect(response1.body.user).toBeNull();
       
-      const email = `fixtest-${nanoid(8)}@example.com`;
+      const email = `fixtest-${nanoid(8)}@test.local`;
       const password = 'TestPassword123!';
       const username = `fixuser_${nanoid(8)}`;
       const passwordHash = await bcrypt.hash(password, 10);
@@ -186,7 +191,7 @@ describe('Cookie Security - CRITICAL', () => {
         passwordHash,
         role: 'user',
         provider: 'local',
-        isTestData: false,
+        isTestData: true,
       });
       
       const loginResponse = await request(app)
@@ -210,25 +215,31 @@ describe('Cookie Security - CRITICAL', () => {
 
   describe('Session Isolation', () => {
     it('should not leak session data between different sessions', async () => {
+      loginRateLimiter.clearAll();
+
       const { email: email1, password: password1 } = await createUserAndLogin(app);
       const { email: email2, password: password2 } = await createUserAndLogin(app);
 
       const agent1 = request.agent(app);
       const agent2 = request.agent(app);
 
-      await agent1.post('/api/v1/auth/login').send({
+      const loginRes1 = await agent1.post('/api/v1/auth/login').set('X-Test-Mode', 'polly-e2e-test-mode').send({
         usernameOrEmail: email1,
         password: password1,
       });
+      expect(loginRes1.status).toBe(200);
 
-      await agent2.post('/api/v1/auth/login').send({
+      const loginRes2 = await agent2.post('/api/v1/auth/login').set('X-Test-Mode', 'polly-e2e-test-mode').send({
         usernameOrEmail: email2,
         password: password2,
       });
+      expect(loginRes2.status).toBe(200);
 
       const response1 = await agent1.get('/api/v1/auth/me');
       const response2 = await agent2.get('/api/v1/auth/me');
 
+      expect(response1.body.user).not.toBeNull();
+      expect(response2.body.user).not.toBeNull();
       expect(response1.body.user.email).toBe(email1);
       expect(response2.body.user.email).toBe(email2);
       expect(response1.body.user.id).not.toBe(response2.body.user.id);
@@ -238,7 +249,7 @@ describe('Cookie Security - CRITICAL', () => {
       const agent = request.agent(app);
       const { email, password } = await createUserAndLogin(app);
 
-      await agent.post('/api/v1/auth/login').send({
+      await agent.post('/api/v1/auth/login').set('X-Test-Mode', 'polly-e2e-test-mode').send({
         usernameOrEmail: email,
         password: password,
       });
@@ -295,7 +306,7 @@ describe('Cookie Security - CRITICAL', () => {
       const agent = request.agent(app);
       const { email, password } = await createUserAndLogin(app);
 
-      await agent.post('/api/v1/auth/login').send({
+      await agent.post('/api/v1/auth/login').set('X-Test-Mode', 'polly-e2e-test-mode').send({
         usernameOrEmail: email,
         password: password,
       });
diff --git a/server/tests/auth/passwordReset.test.ts b/server/tests/auth/passwordReset.test.ts
index 0ed7eaf8..b33e3a76 100644
--- a/server/tests/auth/passwordReset.test.ts
+++ b/server/tests/auth/passwordReset.test.ts
@@ -27,7 +27,7 @@ describe('Auth - Password Reset', () => {
 
   beforeEach(async () => {
     const uniqueId = Date.now();
-    const userData = createTestUser({ email: `reset-test-${uniqueId}@example.com` });
+    const userData = createTestUser({ email: `reset-test-${uniqueId}@test.local` });
     const passwordHash = await bcrypt.hash(userData.password, 10);
     
     const [user] = await db.insert(users).values({
@@ -120,7 +120,7 @@ describe('Auth - Password Reset', () => {
   describe('SSO User Blocking', () => {
     it('should silently ignore password reset requests for SSO users', async () => {
       const ssoId = Date.now();
-      const ssoEmail = `sso-user-${ssoId}@example.com`;
+      const ssoEmail = `sso-user-${ssoId}@test.local`;
       await db.insert(users).values({
         username: `ssouser${ssoId}`,
         email: ssoEmail,
@@ -236,7 +236,7 @@ describe('Auth - Password Reset', () => {
       const loginTestId = Date.now();
       const newPassword = 'ResetPassword789!';
       const originalPassword = 'OriginalPassword123!';
-      const loginTestEmail = `login-test-${loginTestId}@example.com`;
+      const loginTestEmail = `login-test-${loginTestId}@test.local`;
       
       const passwordHash = await bcrypt.hash(originalPassword, 10);
       const [loginUser] = await db.insert(users).values({
@@ -246,7 +246,7 @@ describe('Auth - Password Reset', () => {
         passwordHash,
         provider: 'local',
         role: 'user',
-        isTestData: false,
+        isTestData: true,
       }).returning();
 
       const resetToken = await storage.createPasswordResetToken(loginUser.id);
@@ -260,6 +260,7 @@ describe('Auth - Password Reset', () => {
 
       const loginResponse = await request(app)
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: loginTestEmail,
           password: newPassword,
@@ -275,7 +276,7 @@ describe('Auth - Password Reset', () => {
       const loginTestId = Date.now();
       const originalPassword = 'OriginalPassword456!';
       const newPassword = 'ChangedPassword999!';
-      const loginTestEmail = `login-test2-${loginTestId}@example.com`;
+      const loginTestEmail = `login-test2-${loginTestId}@test.local`;
       
       const passwordHash = await bcrypt.hash(originalPassword, 10);
       const [loginUser] = await db.insert(users).values({
@@ -285,7 +286,7 @@ describe('Auth - Password Reset', () => {
         passwordHash,
         provider: 'local',
         role: 'user',
-        isTestData: false,
+        isTestData: true,
       }).returning();
 
       const resetToken = await storage.createPasswordResetToken(loginUser.id);
@@ -299,6 +300,7 @@ describe('Auth - Password Reset', () => {
 
       const loginResponse = await request(app)
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: loginTestEmail,
           password: originalPassword,
diff --git a/server/tests/auth/registration.test.ts b/server/tests/auth/registration.test.ts
index 9a595294..805ce0d4 100644
--- a/server/tests/auth/registration.test.ts
+++ b/server/tests/auth/registration.test.ts
@@ -18,12 +18,14 @@ describe('Auth - Registration', () => {
     app = await createTestApp();
   });
 
+
+
   it('should reject registration with short password (less than 8 chars)', async () => {
     const response = await request(app)
       .post('/api/v1/auth/register')
       .send({
         username: `user${nanoid(6)}`,
-        email: `test-${nanoid(8)}@example.com`,
+        email: `test-${nanoid(8)}@test.local`,
         name: 'Test User',
         password: '1234567',
       });
@@ -36,7 +38,7 @@ describe('Auth - Registration', () => {
       .post('/api/v1/auth/register')
       .send({
         username: `user${nanoid(6)}`,
-        email: `test-${nanoid(8)}@example.com`,
+        email: `test-${nanoid(8)}@test.local`,
         name: 'Test User',
         password: 'password123!',
       });
@@ -49,7 +51,7 @@ describe('Auth - Registration', () => {
       .post('/api/v1/auth/register')
       .send({
         username: `user${nanoid(6)}`,
-        email: `test-${nanoid(8)}@example.com`,
+        email: `test-${nanoid(8)}@test.local`,
         name: 'Test User',
         password: 'Password123',
       });
@@ -74,7 +76,7 @@ describe('Auth - Registration', () => {
     const response = await request(app)
       .post('/api/v1/auth/register')
       .send({
-        email: `test-${nanoid(8)}@example.com`,
+        email: `test-${nanoid(8)}@test.local`,
         name: 'Test User',
         password: 'SecurePassword123!',
       });
@@ -107,7 +109,7 @@ describe('Auth - Registration', () => {
       .post('/api/v1/auth/register')
       .send({
         username: 'ab',
-        email: `test-${nanoid(8)}@example.com`,
+        email: `test-${nanoid(8)}@test.local`,
         name: 'Test User',
         password: 'SecurePassword123!',
       });
diff --git a/server/tests/auth/sessionPersistence.test.ts b/server/tests/auth/sessionPersistence.test.ts
index 05eaa32d..fd7e4de2 100644
--- a/server/tests/auth/sessionPersistence.test.ts
+++ b/server/tests/auth/sessionPersistence.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeAll } from 'vitest';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import request from 'supertest';
 import { createTestApp } from '../testApp';
 import { nanoid } from 'nanoid';
@@ -14,12 +14,12 @@ export const testMeta = {
 };
 
 async function createTestUserDirectly() {
-  const email = `sessiontest-${nanoid(8)}@example.com`;
+  const email = `sessiontest-${nanoid(8)}@test.local`;
   const password = 'TestPassword123!';
   const username = `sessuser_${nanoid(8)}`;
   const passwordHash = await bcrypt.hash(password, 10);
-  
-  await storage.createUser({
+
+  const user = await storage.createUser({
     email,
     username,
     name: 'Session Test User',
@@ -28,23 +28,36 @@ async function createTestUserDirectly() {
     provider: 'local',
     isTestData: true,
   });
-  
-  return { email, password, username, name: 'Session Test User' };
+
+  return { id: user.id, email, password, username, name: 'Session Test User' };
 }
 
 describe('Session Persistence - CRITICAL', () => {
   let app: Express;
-  let testUser: { email: string; password: string; username: string; name: string };
+  let testUser: { id: number; email: string; password: string; username: string; name: string };
+  const createdUserIds: number[] = [];
 
   beforeAll(async () => {
     app = await createTestApp();
     testUser = await createTestUserDirectly();
+    createdUserIds.push(testUser.id);
+  });
+
+  afterAll(async () => {
+    for (const id of createdUserIds) {
+      try {
+        await storage.deleteUser(id);
+      } catch {
+      }
+    }
   });
 
+
   describe('Login Session Creation', () => {
     it('should create a valid session on successful login', async () => {
       const loginResponse = await request(app)
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: testUser.email,
           password: testUser.password,
@@ -69,6 +82,7 @@ describe('Session Persistence - CRITICAL', () => {
 
       const loginResponse = await agent
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: testUser.email,
           password: testUser.password,
@@ -90,6 +104,7 @@ describe('Session Persistence - CRITICAL', () => {
 
       await agent
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: testUser.email,
           password: testUser.password,
@@ -108,6 +123,7 @@ describe('Session Persistence - CRITICAL', () => {
 
       await agent
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: testUser.email,
           password: testUser.password,
@@ -130,6 +146,7 @@ describe('Session Persistence - CRITICAL', () => {
 
       await agent
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: testUser.email,
           password: testUser.password,
@@ -149,6 +166,7 @@ describe('Session Persistence - CRITICAL', () => {
 
       await agent
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: testUser.email,
           password: testUser.password,
@@ -184,11 +202,13 @@ describe('Session Persistence - CRITICAL', () => {
     it('should maintain separate sessions for different users', async () => {
       const agent1 = request.agent(app);
       const agent2 = request.agent(app);
-      
+
       const user2 = await createTestUserDirectly();
+      createdUserIds.push(user2.id);
 
       await agent1
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: testUser.email,
           password: testUser.password,
@@ -196,6 +216,7 @@ describe('Session Persistence - CRITICAL', () => {
 
       await agent2
         .post('/api/v1/auth/login')
+        .set('X-Test-Mode', 'polly-e2e-test-mode')
         .send({
           usernameOrEmail: user2.email,
           password: user2.password,
diff --git a/server/tests/globalTeardown.ts b/server/tests/globalTeardown.ts
index a217bafd..8af1681a 100644
--- a/server/tests/globalTeardown.ts
+++ b/server/tests/globalTeardown.ts
@@ -1,7 +1,81 @@
 export default async function globalSetup() {
-  // Global setup runs before all tests
-  // Return a teardown function that runs after ALL tests complete
+  // Safety guard: refuse to run outside the test environment.
+  // This file is exclusively a Vitest globalSetup entry point and must never
+  // execute in production or staging, where purgeTestData() would be destructive.
+  if (process.env.NODE_ENV !== 'test') {
+    throw new Error(
+      '[globalSetup] Refused to execute outside NODE_ENV=test. ' +
+      'This file is for the test runner only.',
+    );
+  }
+
+  // Global setup runs ONCE before all tests, guaranteed to complete before any test file starts.
+  // purgeTestData() removes only rows that were inserted with isTestData=true.
+  try {
+    const { storage } = await import('../storage');
+    await storage.purgeTestData();
+  } catch {
+    // Ignore errors (e.g. tables don't exist yet on first CI run)
+  }
+
+  // Seed admin with isInitialAdmin=false using a direct pg connection.
+  //
+  // WHY NOT use seedInitialAdmin() or the Drizzle `db` object here:
+  //   server/db.ts itself does `import * as schema from "@shared/schema"`.
+  //   If the @shared path alias is not resolved in the globalSetup execution
+  //   context (Vitest runs globalSetup in a separate process that may not
+  //   apply all Vite aliases), the entire import chain fails silently inside
+  //   the catch block — admin is never seeded, subsequent test files that rely
+  //   on admin login start failing with cascading TypeErrors.
+  //
+  //   A direct pg.Pool connection has zero alias dependencies and is always safe.
+  //
+  // SECURITY: the NODE_ENV guard above ensures this only runs in test, and the
+  //   UPSERT below only touches the single 'admin' (or ADMIN_USERNAME) user row.
+  try {
+    const { Pool } = await import('pg');
+    const bcrypt = (await import('bcryptjs')).default;
+
+    const adminUsername = process.env.ADMIN_USERNAME || 'admin';
+    const adminEmail   = process.env.ADMIN_EMAIL    || 'admin@polly.local';
+    const adminPassword = process.env.ADMIN_PASSWORD || 'Admin123!';
+
+    const passwordHash = await bcrypt.hash(adminPassword, 10);
+
+    const pgPool = new Pool({ connectionString: process.env.DATABASE_URL });
+    try {
+      await pgPool.query(
+        `INSERT INTO users
+           (username, email, password_hash, name, role,
+            email_verified, is_initial_admin, provider, is_test_data)
+         VALUES ($1, $2, $3, $4, 'admin', true, false, 'local', false)
+         ON CONFLICT (username) DO UPDATE SET
+           password_hash   = EXCLUDED.password_hash,
+           email           = EXCLUDED.email,
+           role            = 'admin',
+           email_verified  = true,
+           is_initial_admin = false`,
+        [adminUsername, adminEmail, passwordHash, adminUsername],
+      );
+      console.log(`[globalSetup] Admin "${adminUsername}" seeded with isInitialAdmin=false`);
+    } finally {
+      await pgPool.end();
+    }
+  } catch (err) {
+    // Log the error so CI annotations make the root cause visible,
+    // but do not abort the entire test run.
+    console.error('[globalSetup] Admin seeding failed:', err);
+  }
+
+  // Return teardown function that runs ONCE after all tests complete
   return async () => {
+    try {
+      const { storage: storageTeardown } = await import('../storage');
+      await storageTeardown.purgeTestData();
+    } catch {
+      // Ignore errors
+    }
+
     try {
       const { pool } = await import('../db');
       await pool.end();
diff --git a/server/tests/integration/databaseMigration.test.ts b/server/tests/integration/databaseMigration.test.ts
index 5a766abb..f916e426 100644
--- a/server/tests/integration/databaseMigration.test.ts
+++ b/server/tests/integration/databaseMigration.test.ts
@@ -266,8 +266,11 @@ describe('Database Migration Tests', () => {
       const savedSessions = await backupSessions();
       const client = await pool.connect();
       try {
-        const beforeCount = await client.query('SELECT COUNT(*) as count FROM users');
-        const userCountBefore = parseInt(beforeCount.rows[0].count);
+        const beforeAdmins = await client.query(
+          'SELECT COUNT(*) as count FROM users WHERE role = $1 AND (is_test_data IS NOT TRUE)',
+          ['admin']
+        );
+        const adminCountBefore = parseInt(beforeAdmins.rows[0].count);
 
         execSync('npx drizzle-kit push --force 2>&1', {
           encoding: 'utf-8',
@@ -277,10 +280,13 @@ describe('Database Migration Tests', () => {
 
         await new Promise(resolve => setTimeout(resolve, 100));
 
-        const afterCount = await client.query('SELECT COUNT(*) as count FROM users');
-        const userCountAfter = parseInt(afterCount.rows[0].count);
+        const afterAdmins = await client.query(
+          'SELECT COUNT(*) as count FROM users WHERE role = $1 AND (is_test_data IS NOT TRUE)',
+          ['admin']
+        );
+        const adminCountAfter = parseInt(afterAdmins.rows[0].count);
 
-        expect(userCountAfter).toBeGreaterThanOrEqual(userCountBefore);
+        expect(adminCountAfter).toBeGreaterThanOrEqual(adminCountBefore);
       } finally {
         client.release();
       }
diff --git a/server/tests/security/deprovision-security.test.ts b/server/tests/security/deprovision-security.test.ts
new file mode 100644
index 00000000..f969d797
--- /dev/null
+++ b/server/tests/security/deprovision-security.test.ts
@@ -0,0 +1,247 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import request from 'supertest';
+import bcrypt from 'bcryptjs';
+import { createTestApp } from '../testApp';
+import { storage } from '../../storage';
+import type { Express } from 'express';
+import { ADMIN_USERNAME, ADMIN_PASSWORD } from '../testCredentials';
+
+let app: Express;
+let adminAgent: ReturnType<typeof request.agent>;
+let origDeprovisionConfig: any;
+
+const DEPROVISION_USER = 'deprovision-service';
+const DEPROVISION_PASS = 'super-secret-deprovision-pw!';
+
+function basicAuth(user: string, pass: string): string {
+  return 'Basic ' + Buffer.from(`${user}:${pass}`).toString('base64');
+}
+
+describe('Deprovision Endpoint Security Tests', () => {
+  beforeAll(async () => {
+    const setting = await storage.getSetting('deprovision_config');
+    origDeprovisionConfig = setting?.value || null;
+
+    app = await createTestApp();
+    adminAgent = request.agent(app);
+
+    await adminAgent
+      .post('/api/v1/auth/login')
+      .send({ usernameOrEmail: ADMIN_USERNAME, password: ADMIN_PASSWORD });
+
+    const passwordHash = await bcrypt.hash(DEPROVISION_PASS, 10);
+    await storage.setSetting({
+      key: 'deprovision_config',
+      value: {
+        enabled: true,
+        username: DEPROVISION_USER,
+        passwordHash,
+      },
+    });
+  });
+
+  afterAll(async () => {
+    if (origDeprovisionConfig !== null) {
+      await storage.setSetting({ key: 'deprovision_config', value: origDeprovisionConfig });
+    } else {
+      await storage.deleteSetting('deprovision_config');
+    }
+  });
+
+  describe('Authentication enforcement', () => {
+    it('should reject requests without Authorization header', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .send({ email: 'someone@test.com' });
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('AUTH_REQUIRED');
+    });
+
+    it('should reject requests with wrong username', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth('wrong-user', DEPROVISION_PASS))
+        .send({ email: 'someone@test.com' });
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('INVALID_CREDENTIALS');
+    });
+
+    it('should reject requests with wrong password', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth(DEPROVISION_USER, 'wrong-password'))
+        .send({ email: 'someone@test.com' });
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('INVALID_CREDENTIALS');
+    });
+
+    it('should reject requests with empty credentials', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth('', ''))
+        .send({ email: 'someone@test.com' });
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('INVALID_CREDENTIALS');
+    });
+
+    it('should reject requests with malformed Basic auth', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', 'Basic !!!invalid-base64!!!')
+        .send({ email: 'someone@test.com' });
+
+      expect(res.status).toBe(401);
+    });
+
+    it('should reject Bearer token auth (only Basic allowed)', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', 'Bearer some-token')
+        .send({ email: 'someone@test.com' });
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('AUTH_REQUIRED');
+    });
+  });
+
+  describe('Service disabled check', () => {
+    it('should return 503 when deprovision service is disabled', async () => {
+      await storage.setSetting({
+        key: 'deprovision_config',
+        value: {
+          enabled: false,
+          username: DEPROVISION_USER,
+          passwordHash: await bcrypt.hash(DEPROVISION_PASS, 10),
+        },
+      });
+
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth(DEPROVISION_USER, DEPROVISION_PASS))
+        .send({ email: 'someone@test.com' });
+
+      expect(res.status).toBe(503);
+      expect(res.body.code).toBe('SERVICE_DISABLED');
+
+      await storage.setSetting({
+        key: 'deprovision_config',
+        value: {
+          enabled: true,
+          username: DEPROVISION_USER,
+          passwordHash: await bcrypt.hash(DEPROVISION_PASS, 10),
+        },
+      });
+    });
+  });
+
+  describe('Input validation', () => {
+    it('should require at least one user identifier', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth(DEPROVISION_USER, DEPROVISION_PASS))
+        .send({});
+
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('MISSING_USER_IDENTIFIER');
+    });
+
+    it('should return 404 for non-existent user', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth(DEPROVISION_USER, DEPROVISION_PASS))
+        .send({ email: 'nonexistent-deprovision@test.com' });
+
+      expect(res.status).toBe(404);
+      expect(res.body.code).toBe('USER_NOT_FOUND');
+    });
+
+    it('should reject invalid action', async () => {
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth(DEPROVISION_USER, DEPROVISION_PASS))
+        .send({ email: 'someone@test.com', action: 'hack' });
+
+      expect([400, 404]).toContain(res.status);
+    });
+  });
+
+  describe('Successful operations with valid credentials', () => {
+    it('should delete a user with valid credentials', async () => {
+      const suffix = Date.now();
+      const registerRes = await request(app)
+        .post('/api/v1/auth/register')
+        .send({
+          username: `deprov_del_${suffix}`,
+          email: `deprov-del-${suffix}@test.com`,
+          password: 'TestPass123!@',
+          name: 'Delete Target',
+        });
+      expect([200, 201]).toContain(registerRes.status);
+
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth(DEPROVISION_USER, DEPROVISION_PASS))
+        .send({ email: `deprov-del-${suffix}@test.com`, action: 'delete' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.action).toBe('deleted');
+    });
+
+    it('should anonymize a user with valid credentials', async () => {
+      const suffix = Date.now();
+      const registerRes = await request(app)
+        .post('/api/v1/auth/register')
+        .send({
+          username: `deprov_anon_${suffix}`,
+          email: `deprov-anon-${suffix}@test.com`,
+          password: 'TestPass123!@',
+          name: 'Anon Target',
+        });
+      expect([200, 201]).toContain(registerRes.status);
+
+      const res = await request(app)
+        .delete('/api/v1/deprovision/user')
+        .set('Authorization', basicAuth(DEPROVISION_USER, DEPROVISION_PASS))
+        .send({ email: `deprov-anon-${suffix}@test.com`, action: 'anonymize' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+      expect(res.body.action).toBe('anonymized');
+    });
+  });
+
+  describe('Timing attack resistance', () => {
+    it('should not reveal valid username by timing difference', async () => {
+      const iterations = 5;
+      const wrongUserTimes: number[] = [];
+      const wrongPassTimes: number[] = [];
+
+      for (let i = 0; i < iterations; i++) {
+        const start1 = performance.now();
+        await request(app)
+          .delete('/api/v1/deprovision/user')
+          .set('Authorization', basicAuth('completely-wrong-user', 'wrong'))
+          .send({ email: 'x@test.com' });
+        wrongUserTimes.push(performance.now() - start1);
+
+        const start2 = performance.now();
+        await request(app)
+          .delete('/api/v1/deprovision/user')
+          .set('Authorization', basicAuth(DEPROVISION_USER, 'wrong-password'))
+          .send({ email: 'x@test.com' });
+        wrongPassTimes.push(performance.now() - start2);
+      }
+
+      const avgWrongUser = wrongUserTimes.reduce((a, b) => a + b, 0) / iterations;
+      const avgWrongPass = wrongPassTimes.reduce((a, b) => a + b, 0) / iterations;
+      const timeDiff = Math.abs(avgWrongUser - avgWrongPass);
+
+      expect(timeDiff).toBeLessThan(200);
+    });
+  });
+});
diff --git a/server/tests/security/email-html-escaping.test.ts b/server/tests/security/email-html-escaping.test.ts
new file mode 100644
index 00000000..5724372e
--- /dev/null
+++ b/server/tests/security/email-html-escaping.test.ts
@@ -0,0 +1,236 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import nodemailer from 'nodemailer';
+import { EmailService } from '../../services/emailService';
+import { emailTemplateService } from '../../services/emailTemplateService';
+
+export const testMeta = {
+  category: 'security' as const,
+  name: 'Email HTML Escaping Security',
+  description: 'Verifies XSS payloads are never rendered raw in email HTML',
+  severity: 'high' as const,
+};
+
+function htmlEscape(str: string): string {
+  return str
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+interface CapturedMailOptions {
+  html: string;
+  text: string;
+}
+
+const xssPayload = '<script>alert("XSS")</script>';
+const htmlPayload = '<img src=x onerror=alert(1)>';
+
+let capturedHtml: string;
+let capturedText: string;
+
+const mockSendMail = vi.fn(async (options: CapturedMailOptions) => {
+  capturedHtml = options.html;
+  capturedText = options.text;
+  return { messageId: 'test-id' };
+});
+
+const mockTransporter = { sendMail: mockSendMail } as unknown as nodemailer.Transporter;
+
+function assertNoRawXss(html: string, payload: string) {
+  expect(html).toBeDefined();
+  expect(html.length).toBeGreaterThan(0);
+  expect(html).not.toContain(payload);
+}
+
+function createThemedHtml(body: string): string {
+  return `<!DOCTYPE html><html lang="de"><head><meta name="color-scheme" content="light dark"><style>@media (prefers-color-scheme: dark){}</style></head><body>${body}</body></html>`;
+}
+
+function createConfiguredEmailService(): EmailService {
+  const svc = new EmailService();
+  svc.configureForTesting(mockTransporter);
+  return svc;
+}
+
+describe('Email HTML Escaping Security Tests', () => {
+  let emailService: EmailService;
+  let renderEmailSpy: ReturnType<typeof vi.spyOn>;
+  let wrapWithEmailThemeSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    process.env.SMTP_HOST = 'localhost';
+    process.env.SMTP_PORT = '587';
+    process.env.SMTP_USER = 'test';
+    process.env.SMTP_PASSWORD = 'test';
+    process.env.APP_URL = 'https://polly.example.com';
+    mockSendMail.mockClear();
+    capturedHtml = '';
+    capturedText = '';
+    emailService = createConfiguredEmailService();
+  });
+
+  afterEach(() => {
+    renderEmailSpy?.mockRestore();
+    wrapWithEmailThemeSpy?.mockRestore();
+    delete process.env.APP_URL;
+  });
+
+  describe('renderEmail receives escaped variables', () => {
+    beforeEach(() => {
+      renderEmailSpy = vi.spyOn(emailTemplateService, 'renderEmail').mockImplementation(
+        async (_type, variables) => {
+          const body = Object.values(variables).filter(Boolean).join(' ');
+          return {
+            subject: 'Test Subject',
+            html: createThemedHtml(`<p>${body}</p>`),
+            text: body,
+          };
+        }
+      );
+    });
+
+    it('sendPollCreationEmails - XSS pollTitle is passed to renderEmail (escaping happens inside)', async () => {
+      await emailService.sendPollCreationEmails(
+        'admin@test.com', xssPayload,
+        'https://polly.example.com/public', 'https://polly.example.com/admin', 'schedule'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('poll_created', expect.objectContaining({
+        pollTitle: xssPayload,
+      }));
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+    });
+
+    it('sendInvitationEmail - XSS inviterName is passed to renderEmail', async () => {
+      await emailService.sendInvitationEmail(
+        'victim@test.com', xssPayload, 'Safe Poll', 'https://polly.example.com/poll'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('invitation', expect.objectContaining({
+        inviterName: xssPayload,
+      }));
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+    });
+
+    it('sendInvitationEmail - XSS pollTitle is passed to renderEmail', async () => {
+      await emailService.sendInvitationEmail(
+        'victim@test.com', 'Safe Sender', htmlPayload, 'https://polly.example.com/poll'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('invitation', expect.objectContaining({
+        pollTitle: htmlPayload,
+      }));
+    });
+
+    it('sendInvitationEmail - XSS customMessage is passed to renderEmail', async () => {
+      await emailService.sendInvitationEmail(
+        'victim@test.com', 'Safe', 'Safe Poll', 'https://polly.example.com/poll', xssPayload
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('invitation', expect.objectContaining({
+        message: xssPayload,
+      }));
+    });
+
+    it('sendVotingConfirmationEmail - XSS voterName/pollTitle passed to renderEmail', async () => {
+      await emailService.sendVotingConfirmationEmail(
+        'voter@test.com', xssPayload, htmlPayload, 'survey',
+        'https://polly.example.com/poll', 'https://polly.example.com/results'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('vote_confirmation', expect.objectContaining({
+        voterName: xssPayload,
+        pollTitle: htmlPayload,
+      }));
+    });
+
+    it('sendReminderEmail - XSS senderName/pollTitle passed to renderEmail', async () => {
+      await emailService.sendReminderEmail(
+        'user@test.com', xssPayload, htmlPayload, 'https://polly.example.com/poll', null
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('reminder', expect.objectContaining({
+        senderName: xssPayload,
+        pollTitle: htmlPayload,
+      }));
+    });
+
+    it('sendPasswordResetEmail - XSS displayName passed to renderEmail', async () => {
+      await emailService.sendPasswordResetEmail(
+        'user@test.com', 'https://polly.example.com/reset/token123', xssPayload
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('password_reset', expect.objectContaining({
+        userName: xssPayload,
+      }));
+    });
+
+    it('sendWelcomeEmail - XSS userName passed to renderEmail', async () => {
+      await emailService.sendWelcomeEmail(
+        'user@test.com', xssPayload, 'https://polly.example.com/verify/abc123'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('welcome', expect.objectContaining({
+        userName: xssPayload,
+      }));
+    });
+  });
+
+  describe('wrapWithEmailTheme escaping for ad-hoc emails', () => {
+    beforeEach(() => {
+      wrapWithEmailThemeSpy = vi.spyOn(emailTemplateService, 'wrapWithEmailTheme').mockImplementation(
+        async (_subject, bodyHtml, plainText) => ({
+          subject: _subject,
+          html: createThemedHtml(bodyHtml),
+          text: plainText,
+        })
+      );
+    });
+
+    it('sendDeletionRequestNotification - XSS userName/email are HTML-escaped in body', async () => {
+      await emailService.sendDeletionRequestNotification(
+        ['admin@test.com'], xssPayload, htmlPayload, 'https://polly.example.com/admin'
+      );
+      expect(wrapWithEmailThemeSpy).toHaveBeenCalledTimes(1);
+      const bodyHtmlArg = wrapWithEmailThemeSpy.mock.calls[0][1] as string;
+      assertNoRawXss(bodyHtmlArg, '<script>alert');
+      assertNoRawXss(bodyHtmlArg, '<img src=x onerror');
+      expect(bodyHtmlArg).toContain(htmlEscape(xssPayload));
+    });
+
+    it('sendVirusDetectionAlert - user values should be escaped in body', async () => {
+      await emailService.sendVirusDetectionAlert(['admin@test.com'], {
+        filename: xssPayload, fileSize: 1024, virusName: htmlPayload,
+        uploaderEmail: 'user@test.com', requestIp: '127.0.0.1',
+        scannedAt: new Date('2025-03-15T12:00:00'),
+      });
+      expect(wrapWithEmailThemeSpy).toHaveBeenCalledTimes(1);
+      const bodyHtmlArg = wrapWithEmailThemeSpy.mock.calls[0][1] as string;
+      assertNoRawXss(bodyHtmlArg, '<script>alert');
+      assertNoRawXss(bodyHtmlArg, '<img src=x onerror');
+    });
+  });
+
+  describe('All template-based emails use proper DOCTYPE structure', () => {
+    beforeEach(() => {
+      renderEmailSpy = vi.spyOn(emailTemplateService, 'renderEmail').mockResolvedValue({
+        subject: 'Test',
+        html: createThemedHtml('<p>Test</p>'),
+        text: 'Test',
+      });
+    });
+
+    it('should have DOCTYPE declaration in all template-rendered emails', async () => {
+      const templateMethods: Array<() => Promise<void>> = [
+        () => emailService.sendPollCreationEmails('a@b.com', 'T', 'https://e.com/p', 'https://e.com/a', 'schedule'),
+        () => emailService.sendVotingConfirmationEmail('a@b.com', 'N', 'T', 'survey', 'https://e.com/p', 'https://e.com/r'),
+        () => emailService.sendPasswordResetEmail('a@b.com', 'https://e.com/r'),
+        () => emailService.sendEmailChangeConfirmation('a@b.com', 'b@c.com', 'https://e.com/c'),
+        () => emailService.sendPasswordChangedEmail('a@b.com'),
+        () => emailService.sendWelcomeEmail('a@b.com', 'N', 'https://e.com/v'),
+      ];
+
+      for (const method of templateMethods) {
+        mockSendMail.mockClear();
+        await method();
+        expect(mockSendMail).toHaveBeenCalledTimes(1);
+        expect(capturedHtml).toContain('<!DOCTYPE html>');
+        expect(capturedHtml).toContain('</html>');
+      }
+    });
+  });
+});
diff --git a/server/tests/security/hardening.test.ts b/server/tests/security/hardening.test.ts
new file mode 100644
index 00000000..5d402c52
--- /dev/null
+++ b/server/tests/security/hardening.test.ts
@@ -0,0 +1,421 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import request from 'supertest';
+import type { Express } from 'express';
+import { createTestApp, closeTestApp } from '../testApp';
+import { storage } from '../../storage';
+import { ADMIN_USERNAME, ADMIN_PASSWORD } from '../testCredentials';
+
+let app: Express;
+const suffix = Date.now();
+
+async function loginAsAdmin(agent: request.SuperTest<request.Test>) {
+  const res = await agent.post('/api/v1/auth/login').send({
+    usernameOrEmail: ADMIN_USERNAME,
+    password: ADMIN_PASSWORD,
+  });
+  return res;
+}
+
+async function registerUser(agent: request.SuperTest<request.Test>, username: string, email: string, password: string) {
+  return agent.post('/api/v1/auth/register').send({
+    username,
+    email,
+    password,
+    confirmPassword: password,
+    name: 'Test User',
+  });
+}
+
+describe('Security Hardening Tests', () => {
+  const enumerationEmail = `enumtest-${suffix}@test.local`;
+  const sessUser = `sessuser-${suffix}`;
+  const sessEmail = `sessuser-${suffix}@test.local`;
+  const sessPass = 'TestPass123!';
+
+  beforeAll(async () => {
+    app = await createTestApp();
+
+    const bcrypt = await import('bcryptjs');
+
+    // Pre-create user for enumeration test (so "existing email" check is deterministic)
+    const enumHash = await bcrypt.hash('TestPass123!', 10);
+    const existingEnum = await storage.getUserByEmail(enumerationEmail);
+    if (!existingEnum) {
+      await storage.createUser({
+        username: `enumuser-${suffix}`,
+        email: enumerationEmail,
+        passwordHash: enumHash,
+        name: 'Enumeration Test User',
+        role: 'user',
+        provider: 'local',
+        isTestData: true,
+      });
+    }
+
+    // Pre-create session test user
+    const sessHash = await bcrypt.hash(sessPass, 10);
+    const existingSess = await storage.getUserByUsername(sessUser);
+    if (!existingSess) {
+      await storage.createUser({
+        username: sessUser,
+        email: sessEmail,
+        passwordHash: sessHash,
+        name: 'Session Test User',
+        role: 'user',
+        provider: 'local',
+        isTestData: true,
+      });
+    }
+  });
+
+  afterAll(async () => {
+    await closeTestApp();
+  });
+
+  describe('T004: Cache-Control Headers', () => {
+    it('should set no-store Cache-Control on API responses', async () => {
+      const res = await request(app).get('/api/v1/auth/me');
+      expect(res.headers['cache-control']).toContain('no-store');
+      expect(res.headers['pragma']).toBe('no-cache');
+      expect(res.headers['expires']).toBe('0');
+    });
+
+    it('should set Cache-Control on authenticated API responses', async () => {
+      const agent = request.agent(app);
+      await loginAsAdmin(agent);
+      const res = await agent.get('/api/v1/auth/me');
+      expect(res.headers['cache-control']).toContain('no-store');
+    });
+
+    it('should set Cache-Control on error responses', async () => {
+      const res = await request(app).post('/api/v1/auth/login').send({});
+      expect(res.headers['cache-control']).toContain('no-store');
+    });
+  });
+
+  describe('T005: Generic Error Messages (no error.message leak)', () => {
+    it('should not leak error details on invalid JSON body', async () => {
+      const res = await request(app)
+        .post('/api/v1/auth/login')
+        .set('Content-Type', 'application/json')
+        .send('{ invalid json }');
+      expect(res.body.error || res.body.message || '').not.toMatch(/SyntaxError/i);
+      expect(res.body.error || res.body.message || '').not.toMatch(/Unexpected token/i);
+    });
+
+    it('should return generic error for missing poll', async () => {
+      const res = await request(app).get('/api/v1/polls/nonexistent-id-12345');
+      expect(res.status).toBeGreaterThanOrEqual(400);
+      const body = JSON.stringify(res.body);
+      expect(body).not.toMatch(/Cannot read properties/i);
+      expect(body).not.toMatch(/TypeError/i);
+    });
+  });
+
+  describe('T008: Input Size Limits', () => {
+    it('should reject oversized JSON body (> 1MB)', async () => {
+      const largeBody = { data: 'x'.repeat(1.5 * 1024 * 1024) };
+      const res = await request(app)
+        .post('/api/v1/auth/login')
+        .send(largeBody);
+      expect(res.status).toBe(413);
+    });
+
+    it('should reject voter name exceeding 100 characters', async () => {
+      const agent = request.agent(app);
+      await loginAsAdmin(agent);
+
+      const pollRes = await agent.post('/api/v1/polls').send({
+        title: `Size limit test poll ${suffix}`,
+        type: 'survey',
+        options: [{ text: 'Option A' }],
+      });
+      if (pollRes.status === 200 || pollRes.status === 201) {
+        const pollId = pollRes.body.id;
+        const voteRes = await request(app).post(`/api/v1/polls/${pollId}/votes`).send({
+          voterName: 'A'.repeat(101),
+          selections: [{ optionId: pollRes.body.options?.[0]?.id, value: 'yes' }],
+        });
+        expect(voteRes.status).toBeGreaterThanOrEqual(400);
+      }
+    });
+  });
+
+  describe('T003: Registration Enumeration Prevention', () => {
+    it('should return generic message when registering with existing username', async () => {
+      const agent = request.agent(app);
+      const res = await registerUser(agent, ADMIN_USERNAME, `unique-${suffix}@test.local`, 'TestPass123!');
+      if (res.status >= 400) {
+        const errorMsg = res.body.error || res.body.message || '';
+        expect(errorMsg).not.toMatch(/bereits vergeben/i);
+        expect(errorMsg).not.toMatch(/already taken/i);
+        expect(errorMsg).not.toMatch(/already exists/i);
+        expect(errorMsg).not.toMatch(/username.*exist/i);
+      }
+    });
+
+    it('should return generic message when registering with existing email', async () => {
+      const agent = request.agent(app);
+      const res = await registerUser(agent, `unique-${suffix}`, enumerationEmail, 'TestPass123!');
+      if (res.status >= 400) {
+        const errorMsg = res.body.error || res.body.message || '';
+        expect(errorMsg).not.toMatch(/bereits vergeben/i);
+        expect(errorMsg).not.toMatch(/already taken/i);
+        expect(errorMsg).not.toMatch(/email.*exist/i);
+      }
+    });
+  });
+
+  describe('T009: Session Regeneration after Login', () => {
+    it('should issue new session cookie after login', async () => {
+      const agent = request.agent(app);
+
+      const preRes = await agent.get('/api/v1/auth/me');
+      const preCookies = preRes.headers['set-cookie'];
+      const preSessionId = extractSessionId(preCookies);
+
+      const loginRes = await agent.post('/api/v1/auth/login').send({
+        usernameOrEmail: sessUser,
+        password: sessPass,
+      });
+      expect(loginRes.status).toBe(200);
+
+      const postCookies = loginRes.headers['set-cookie'];
+      const postSessionId = extractSessionId(postCookies);
+
+      if (preSessionId && postSessionId) {
+        expect(postSessionId).not.toBe(preSessionId);
+      }
+    });
+
+    it('should issue new session cookie after registration', async () => {
+      const agent = request.agent(app);
+      const regUser = `sessreg-${suffix}`;
+
+      const preRes = await agent.get('/api/v1/auth/me');
+      const preCookies = preRes.headers['set-cookie'];
+      const preSessionId = extractSessionId(preCookies);
+
+      const regRes = await registerUser(
+        agent as any,
+        regUser,
+        `${regUser}@test.local`,
+        'TestPass123!'
+      );
+
+      if (regRes.status === 200 || regRes.status === 201) {
+        const postCookies = regRes.headers['set-cookie'];
+        const postSessionId = extractSessionId(postCookies);
+        if (preSessionId && postSessionId) {
+          expect(postSessionId).not.toBe(preSessionId);
+        }
+      }
+    });
+  });
+
+  describe('T015: No Server Version Headers', () => {
+    it('should not expose X-Powered-By header', async () => {
+      const res = await request(app).get('/api/v1/auth/me');
+      expect(res.headers['x-powered-by']).toBeUndefined();
+    });
+
+    it('should not expose Server header with version info', async () => {
+      const res = await request(app).get('/api/v1/auth/me');
+      const serverHeader = res.headers['server'] || '';
+      expect(serverHeader).not.toMatch(/express/i);
+      expect(serverHeader).not.toMatch(/node/i);
+      expect(serverHeader).not.toMatch(/\d+\.\d+/);
+    });
+
+    it('should not expose version info in any response header', async () => {
+      const res = await request(app).get('/api/v1/auth/me');
+      const headers = res.headers;
+      for (const [key, value] of Object.entries(headers)) {
+        if (typeof value === 'string') {
+          expect(value).not.toMatch(/express\s*\/?\s*\d/i);
+          expect(value).not.toMatch(/node\s*\/?\s*\d/i);
+        }
+      }
+    });
+
+    it('should not expose version info on error pages', async () => {
+      const res = await request(app).get('/api/v1/nonexistent');
+      expect(res.headers['x-powered-by']).toBeUndefined();
+    });
+
+    it('should not expose version info on POST endpoints', async () => {
+      const res = await request(app).post('/api/v1/auth/login').send({});
+      expect(res.headers['x-powered-by']).toBeUndefined();
+    });
+  });
+
+  describe('T007: Force Password Change for Initial Admin', () => {
+    it('should block API access for isInitialAdmin users except allowed paths', async () => {
+      const initAdminUsername = `initadmin-${suffix}`;
+      const initAdminEmail = `initadmin-${suffix}@test.local`;
+
+      const initialAdmin = await storage.getUserByUsername(initAdminUsername);
+      if (!initialAdmin) {
+        const bcrypt = await import('bcryptjs');
+        const hash = await bcrypt.hash(ADMIN_PASSWORD, 10);
+        await storage.createUser({
+          username: initAdminUsername,
+          email: initAdminEmail,
+          passwordHash: hash,
+          name: 'Init Admin',
+          role: 'admin',
+          isInitialAdmin: true,
+          provider: 'local',
+          isTestData: true,
+        });
+      }
+
+      const agent = request.agent(app);
+      const loginRes = await agent.post('/api/v1/auth/login').send({
+        usernameOrEmail: initAdminUsername,
+        password: ADMIN_PASSWORD,
+      });
+
+      if (loginRes.status === 200) {
+        const meRes = await agent.get('/api/v1/auth/me');
+        expect(meRes.status).toBe(200);
+
+        const usersRes = await agent.get('/api/v1/admin/users');
+        expect(usersRes.status).toBe(403);
+        expect(usersRes.body.code).toBe('PASSWORD_CHANGE_REQUIRED');
+
+        const pollsRes = await agent.get('/api/v1/polls');
+        expect(pollsRes.status).toBe(403);
+        expect(pollsRes.body.code).toBe('PASSWORD_CHANGE_REQUIRED');
+      }
+    });
+  });
+
+  describe('T010: bcrypt Cost Factor >= 12', () => {
+    it('should use bcrypt cost factor >= 12 for newly hashed passwords', async () => {
+      const { authService } = await import('../../services/authService');
+      const hash = await authService.hashPassword('test-password-strength-check');
+      const costMatch = hash.match(/^\$2[ab]?\$(\d+)\$/);
+      expect(costMatch).not.toBeNull();
+      const cost = parseInt(costMatch![1], 10);
+      expect(cost).toBeGreaterThanOrEqual(12);
+    });
+
+    it('should still verify passwords hashed with cost factor 10 (backwards compat)', async () => {
+      const bcrypt = await import('bcryptjs');
+      const legacyHash = await bcrypt.hash('legacy-password', 10);
+      const { authService } = await import('../../services/authService');
+      const valid = await authService.verifyPassword('legacy-password', legacyHash);
+      expect(valid).toBe(true);
+    });
+  });
+
+  describe('T011: Admin upload error does not leak internal details', () => {
+    it('should return generic error message for invalid non-image upload, not internal error text', async () => {
+      const adminAgent = request.agent(app);
+      await loginAsAdmin(adminAgent);
+
+      const res = await adminAgent
+        .post('/api/v1/admin/customization/logo')
+        .attach('logo', Buffer.from('<?php system($_GET["cmd"]); ?>'), {
+          filename: 'shell.php',
+          contentType: 'application/x-httpd-php',
+        });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toBeDefined();
+      expect(res.body.error).not.toMatch(/php|shell|cmd|system|exec|eval/i);
+      expect(res.body.error).not.toMatch(/multer|ENOENT|EACCES|stack|TypeError/i);
+    });
+  });
+
+  describe('T012: MIME-spoofing upload returns 400 not 500', () => {
+    // Regression guard: previously, a file that passed multer's MIME-filter but
+    // failed validateImageMagicBytes caused the route to fall through to the
+    // generic "statusCode = 500" branch because invalidFileType was not threaded
+    // through UploadResult. This test ensures the route returns 400 for this case.
+    it('should return 400 (not 500) when file has image MIME type but non-image content', async () => {
+      const adminAgent = request.agent(app);
+      await loginAsAdmin(adminAgent);
+
+      // image/jpeg MIME passes multer fileFilter — but PHP content fails
+      // validateImageMagicBytes → processUpload returns { invalidFileType: true }
+      const res = await adminAgent
+        .post('/api/v1/admin/customization/logo')
+        .attach('logo', Buffer.from('<?php system($_GET["cmd"]); ?>\x00\x00\x00\x00\x00'), {
+          filename: 'evil.jpg',
+          contentType: 'image/jpeg',
+        });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toBeDefined();
+      expect(res.body.error).not.toMatch(/php|system|exec|TypeError|stack/i);
+    });
+
+    it('should return 400 (not 500) when file is a ZIP disguised as PNG', async () => {
+      const adminAgent = request.agent(app);
+      await loginAsAdmin(adminAgent);
+
+      const zipHeader = Buffer.from([
+        0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00,
+        0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      ]);
+
+      const res = await adminAgent
+        .post('/api/v1/admin/customization/logo')
+        .attach('logo', zipHeader, {
+          filename: 'archive.png',
+          contentType: 'image/png',
+        });
+
+      expect(res.status).toBe(400);
+    });
+  });
+
+  describe('T013: Admin is not blocked by isInitialAdmin after test setup (global setup canary)', () => {
+    // Regression guard: globalTeardown.ts seeds the admin via seedInitialAdmin(),
+    // which sets isInitialAdmin=true when default credentials are used (CI env).
+    // The middleware in server/index.ts returns 403 PASSWORD_CHANGE_REQUIRED for
+    // all API paths when isInitialAdmin=true. The global setup must clear this flag
+    // so test suites that create polls or call other endpoints can actually work.
+    // This test acts as the canary that would have caught both regressions:
+    //   • admin not seeded at all → loginRes.status !== 200
+    //   • admin seeded with isInitialAdmin=true → pollsRes.status === 403
+    it('admin login succeeds and API calls are not blocked by PASSWORD_CHANGE_REQUIRED', async () => {
+      const adminAgent = request.agent(app);
+      const loginRes = await loginAsAdmin(adminAgent);
+
+      expect(loginRes.status).toBe(200);
+
+      const pollsRes = await adminAgent.get('/api/v1/polls');
+      expect(pollsRes.status).not.toBe(403);
+      expect(pollsRes.body.code).not.toBe('PASSWORD_CHANGE_REQUIRED');
+    });
+
+    it('admin can create a poll (end-to-end API access check)', async () => {
+      const adminAgent = request.agent(app);
+      await loginAsAdmin(adminAgent);
+
+      const res = await adminAgent.post('/api/v1/polls').send({
+        title: `Canary poll ${suffix}`,
+        type: 'survey',
+        options: [{ text: 'Option A' }, { text: 'Option B' }],
+        isTestData: true,
+      });
+
+      expect(res.status).not.toBe(403);
+      expect(res.body.code).not.toBe('PASSWORD_CHANGE_REQUIRED');
+      expect(res.status).toBeLessThan(300);
+    });
+  });
+});
+
+function extractSessionId(cookies: string | string[] | undefined): string | null {
+  if (!cookies) return null;
+  const cookieArr = Array.isArray(cookies) ? cookies : [cookies];
+  for (const c of cookieArr) {
+    const match = c.match(/polly\.sid=([^;]+)/);
+    if (match) return match[1];
+  }
+  return null;
+}
diff --git a/server/tests/security/websocket-security.test.ts b/server/tests/security/websocket-security.test.ts
new file mode 100644
index 00000000..b0bff857
--- /dev/null
+++ b/server/tests/security/websocket-security.test.ts
@@ -0,0 +1,232 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { WebSocket } from 'ws';
+import request from 'supertest';
+import { createTestApp, getTestServer } from '../testApp';
+import { liveVotingService } from '../../services/liveVotingService';
+import type { Express } from 'express';
+import type { Server } from 'http';
+import { ADMIN_USERNAME, ADMIN_PASSWORD } from '../testCredentials';
+
+let app: Express;
+let agent: ReturnType<typeof request.agent>;
+let server: Server;
+let wsBaseUrl: string;
+
+async function loginAsAdmin(ag: ReturnType<typeof request.agent>) {
+  await ag
+    .post('/api/v1/auth/login')
+    .send({ usernameOrEmail: ADMIN_USERNAME, password: ADMIN_PASSWORD });
+}
+
+function connectWs(url: string): Promise<WebSocket> {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(url);
+    ws.on('open', () => resolve(ws));
+    ws.on('error', reject);
+    setTimeout(() => reject(new Error('WS connection timeout')), 5000);
+  });
+}
+
+function waitForMessage(ws: WebSocket, timeout = 3000): Promise<any> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('WS message timeout')), timeout);
+    ws.once('message', (data) => {
+      clearTimeout(timer);
+      resolve(JSON.parse(data.toString()));
+    });
+  });
+}
+
+function waitForClose(ws: WebSocket, timeout = 3000): Promise<{ code: number; reason: string }> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('WS close timeout')), timeout);
+    ws.once('close', (code, reason) => {
+      clearTimeout(timer);
+      resolve({ code, reason: reason.toString() });
+    });
+  });
+}
+
+describe('WebSocket Security Tests', () => {
+  let adminToken: string;
+  let publicToken: string;
+
+  afterAll(() => {
+    liveVotingService.cleanup();
+  });
+
+  beforeAll(async () => {
+    app = await createTestApp();
+    agent = request.agent(app);
+    await loginAsAdmin(agent);
+
+    const res = await agent.post('/api/v1/polls').send({
+      title: 'WS Security Test Poll',
+      type: 'schedule',
+      options: [{ text: 'Option A' }, { text: 'Option B' }],
+    });
+    adminToken = res.body.adminToken;
+    publicToken = res.body.publicToken;
+
+    server = getTestServer()!;
+    liveVotingService.initializeWithUpgrade(server);
+    await new Promise<void>((resolve) => {
+      if (server.listening) {
+        resolve();
+      } else {
+        server.listen(0, resolve);
+      }
+    });
+    const address = server.address() as { port: number };
+    wsBaseUrl = `ws://localhost:${address.port}/ws/live-voting`;
+  });
+
+  describe('Poll existence validation', () => {
+    it('should reject join for non-existent poll token', async () => {
+      const ws = await connectWs(wsBaseUrl);
+      const closePromise = waitForClose(ws);
+      const msgPromise = waitForMessage(ws);
+
+      ws.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: 'non-existent-token-12345',
+        sessionId: `s-${Date.now()}-1`,
+      }));
+
+      const msg = await msgPromise;
+      expect(msg.type).toBe('error');
+      expect(msg.code).toBe('POLL_NOT_FOUND');
+
+      const close = await closePromise;
+      expect(close.code).toBe(4404);
+    });
+
+    it('should accept join for valid poll token', async () => {
+      const ws = await connectWs(wsBaseUrl);
+      const msgPromise = waitForMessage(ws);
+
+      ws.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: publicToken,
+        sessionId: `s-${Date.now()}-2`,
+        voterName: 'Test Voter',
+      }));
+
+      const msg = await msgPromise;
+      expect(['joined', 'presence_update']).toContain(msg.type);
+      expect(msg).toHaveProperty('viewerCount');
+      expect(msg).toHaveProperty('activeVoters');
+
+      ws.close();
+    });
+  });
+
+  describe('Presenter privilege escalation prevention', () => {
+    it('should NOT grant presenter when isPresenter is self-reported without adminToken', async () => {
+      const ws = await connectWs(wsBaseUrl);
+      const msgPromise = waitForMessage(ws);
+
+      ws.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: publicToken,
+        sessionId: `s-${Date.now()}-att`,
+        voterName: 'Attacker',
+        isPresenter: true,
+      }));
+
+      const msg = await msgPromise;
+      expect(['joined', 'presence_update']).toContain(msg.type);
+      ws.close();
+    });
+
+    it('should grant presenter status with valid adminToken', async () => {
+      const ws = await connectWs(wsBaseUrl);
+      const msgPromise = waitForMessage(ws);
+
+      ws.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: publicToken,
+        sessionId: `s-${Date.now()}-pres`,
+        adminToken: adminToken,
+      }));
+
+      const msg = await msgPromise;
+      expect(['joined', 'presence_update']).toContain(msg.type);
+      ws.close();
+    });
+
+    it('should reject start_presenting without adminToken', async () => {
+      const ws = await connectWs(wsBaseUrl);
+      const sid = `s-${Date.now()}-esc`;
+
+      const joinPromise = waitForMessage(ws);
+      ws.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: publicToken,
+        sessionId: sid,
+        voterName: 'Escalation',
+      }));
+      await joinPromise;
+
+      const errorPromise = waitForMessage(ws);
+      ws.send(JSON.stringify({
+        type: 'start_presenting',
+        pollToken: publicToken,
+      }));
+
+      const errorMsg = await errorPromise;
+      expect(errorMsg.type).toBe('error');
+      expect(errorMsg.code).toBe('FORBIDDEN');
+      ws.close();
+    });
+
+    it('should reject start_presenting with wrong adminToken', async () => {
+      const ws = await connectWs(wsBaseUrl);
+      const sid = `s-${Date.now()}-wt`;
+
+      const joinPromise = waitForMessage(ws);
+      ws.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: publicToken,
+        sessionId: sid,
+        voterName: 'Wrong Token',
+      }));
+      await joinPromise;
+
+      const errorPromise = waitForMessage(ws);
+      ws.send(JSON.stringify({
+        type: 'start_presenting',
+        pollToken: publicToken,
+        adminToken: 'definitely-wrong-admin-token',
+      }));
+
+      const errorMsg = await errorPromise;
+      expect(errorMsg.type).toBe('error');
+      expect(errorMsg.code).toBe('FORBIDDEN');
+      ws.close();
+    });
+
+    it('should accept start_presenting with correct adminToken', async () => {
+      const ws = await connectWs(wsBaseUrl);
+      const sid = `s-${Date.now()}-rp`;
+
+      const joinPromise = waitForMessage(ws);
+      ws.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: publicToken,
+        sessionId: sid,
+        adminToken: adminToken,
+      }));
+      await joinPromise;
+
+      ws.send(JSON.stringify({
+        type: 'start_presenting',
+        pollToken: publicToken,
+        adminToken: adminToken,
+      }));
+
+      await new Promise(r => setTimeout(r, 200));
+      ws.close();
+    });
+  });
+});
diff --git a/server/tests/services/clamavService.test.ts b/server/tests/services/clamavService.test.ts
index e06dc9b7..fac11d7a 100644
--- a/server/tests/services/clamavService.test.ts
+++ b/server/tests/services/clamavService.test.ts
@@ -13,26 +13,23 @@ export const testMeta = {
 
 describe('ClamAV Security - Fail-Secure Behavior', () => {
   let app: Express;
+  let originalConfig: any;
 
   beforeAll(async () => {
+    const setting = await storage.getSetting('clamav_config');
+    originalConfig = setting?.value || null;
     app = await createTestApp();
   });
 
-  describe('Fail-Secure: Scanner enabled but unreachable', () => {
-    let originalConfig: any;
-
-    beforeEach(async () => {
-      const setting = await storage.getSetting('clamav_config');
-      originalConfig = setting?.value || null;
-    });
+  afterAll(async () => {
+    if (originalConfig !== null) {
+      await storage.setSetting({ key: 'clamav_config', value: originalConfig });
+    } else {
+      await storage.deleteSetting('clamav_config');
+    }
+  });
 
-    afterAll(async () => {
-      if (originalConfig) {
-        await storage.setSetting({ key: 'clamav_config', value: originalConfig });
-      } else {
-        await storage.setSetting({ key: 'clamav_config', value: { enabled: false, host: 'localhost', port: 3310, timeout: 5000, maxFileSize: 25 * 1024 * 1024 } });
-      }
-    });
+  describe('Fail-Secure: Scanner enabled but unreachable', () => {
 
     it('should BLOCK uploads when ClamAV is enabled but daemon is unreachable (ECONNREFUSED)', async () => {
       await storage.setSetting({
@@ -178,8 +175,11 @@ describe('ClamAV Security - Fail-Secure Behavior', () => {
 
       const mockFile = {
         originalname: 'clamav-test-log-verify.jpg',
-        buffer: Buffer.from('test content for logging'),
-        size: 24,
+        buffer: Buffer.from([
+          0xFF, 0xD8, 0xFF, 0xE0, 0x00, 0x10, 0x4A, 0x46,
+          0x49, 0x46, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
+        ]),
+        size: 16,
         mimetype: 'image/jpeg',
         fieldname: 'image',
         encoding: '7bit',
diff --git a/server/tests/services/emailServiceIntegration.test.ts b/server/tests/services/emailServiceIntegration.test.ts
new file mode 100644
index 00000000..96e26aa7
--- /dev/null
+++ b/server/tests/services/emailServiceIntegration.test.ts
@@ -0,0 +1,500 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import nodemailer from 'nodemailer';
+import { EmailService } from '../../services/emailService';
+import { emailTemplateService } from '../../services/emailTemplateService';
+
+export const testMeta = {
+  category: 'functional' as const,
+  name: 'E-Mail-Service Integration',
+  description: 'Prüft dass EmailService die neuen Templates nutzt und alle Header korrekt gesetzt werden',
+  severity: 'high' as const,
+};
+
+interface CapturedMailOptions {
+  from: string;
+  to: string;
+  html: string;
+  text: string;
+  subject: string;
+  headers: Record<string, string>;
+  attachments?: Array<{ filename: string; contentType: string; content: Buffer }>;
+}
+
+const THEMED_HTML = '<!DOCTYPE html><html lang="de"><head><meta name="color-scheme" content="light dark"><style>@media (prefers-color-scheme: dark){}</style></head><body>{{BODY}}</body></html>';
+
+function themedHtml(body: string): string {
+  return THEMED_HTML.replace('{{BODY}}', body);
+}
+
+let lastMailOptions: CapturedMailOptions;
+const allMailOptions: CapturedMailOptions[] = [];
+
+const mockSendMail = vi.fn(async (options: CapturedMailOptions) => {
+  lastMailOptions = options;
+  allMailOptions.push(options);
+  return { messageId: 'test-id' };
+});
+
+const mockTransporter = { sendMail: mockSendMail } as unknown as nodemailer.Transporter;
+
+function createConfiguredEmailService(): EmailService {
+  const svc = new EmailService();
+  svc.configureForTesting(mockTransporter);
+  return svc;
+}
+
+const REQUIRED_HEADERS = ['X-Mailer', 'Reply-To'];
+
+function assertRequiredHeaders(mailOpts: CapturedMailOptions, priority: 'normal' | 'high' = 'normal') {
+  const headers = mailOpts.headers;
+  expect(headers).toBeDefined();
+  expect(headers['X-Mailer']).toBe('Polly');
+  if (priority === 'high') {
+    expect(headers['X-Priority']).toBe('1');
+    expect(headers['X-MSMail-Priority']).toBe('High');
+  } else {
+    expect(headers['X-Priority']).toBeUndefined();
+    expect(headers['X-MSMail-Priority']).toBeUndefined();
+  }
+  expect(headers['Reply-To']).toBeDefined();
+  expect(headers['Reply-To']).not.toBe('');
+}
+
+describe('EmailService Integration — Template System', () => {
+  let emailService: EmailService;
+  let renderEmailSpy: ReturnType<typeof vi.spyOn>;
+  let wrapWithEmailThemeSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    process.env.SMTP_HOST = 'localhost';
+    process.env.SMTP_PORT = '587';
+    process.env.SMTP_USER = 'test';
+    process.env.SMTP_PASSWORD = 'test';
+    process.env.FROM_EMAIL = 'noreply@polly.test';
+    process.env.APP_URL = 'https://polly.example.com';
+    mockSendMail.mockClear();
+    allMailOptions.length = 0;
+    emailService = createConfiguredEmailService();
+
+    renderEmailSpy = vi.spyOn(emailTemplateService, 'renderEmail').mockResolvedValue({
+      subject: 'Mocked Subject',
+      html: themedHtml('<p>Mocked body</p>'),
+      text: 'Mocked body',
+    });
+
+    wrapWithEmailThemeSpy = vi.spyOn(emailTemplateService, 'wrapWithEmailTheme').mockResolvedValue({
+      subject: 'Wrapped Subject',
+      html: themedHtml('<p>Wrapped body</p>'),
+      text: 'Wrapped body',
+    });
+  });
+
+  afterEach(() => {
+    renderEmailSpy.mockRestore();
+    wrapWithEmailThemeSpy.mockRestore();
+    delete process.env.APP_URL;
+    delete process.env.FROM_EMAIL;
+  });
+
+  describe('Central sendMail method', () => {
+    it('sendMail sets all required headers for normal priority', async () => {
+      await emailService.sendMail({
+        to: 'test@example.com',
+        subject: 'Test',
+        html: '<p>Test</p>',
+        text: 'Test',
+      });
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions, 'normal');
+    });
+
+    it('sendMail sets high priority headers when priority is high', async () => {
+      await emailService.sendMail({
+        to: 'test@example.com',
+        subject: 'Urgent',
+        html: '<p>Urgent</p>',
+        text: 'Urgent',
+        priority: 'high',
+      });
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions, 'high');
+      expect(lastMailOptions.headers['Importance']).toBe('high');
+    });
+
+    it('sendMail uses fromPrefix when provided', async () => {
+      await emailService.sendMail({
+        to: 'test@example.com',
+        subject: 'Test',
+        html: '<p>Test</p>',
+        text: 'Test',
+        fromPrefix: 'Security',
+      });
+      expect(lastMailOptions.from).toContain('Security');
+    });
+
+    it('sendMail includes attachments when provided', async () => {
+      const pdfBuffer = Buffer.from('fake-pdf');
+      await emailService.sendMail({
+        to: 'test@example.com',
+        subject: 'Report',
+        html: '<p>Report</p>',
+        text: 'Report',
+        attachments: [{ filename: 'report.pdf', content: pdfBuffer, contentType: 'application/pdf' }],
+      });
+      expect(lastMailOptions.attachments).toBeDefined();
+      expect(lastMailOptions.attachments![0].filename).toBe('report.pdf');
+    });
+
+    it('sendMail does not send when SMTP is not configured', async () => {
+      const savedHost = process.env.SMTP_HOST;
+      const savedUser = process.env.SMTP_USER;
+      const savedPass = process.env.SMTP_PASSWORD;
+      delete process.env.SMTP_HOST;
+      delete process.env.SMTP_USER;
+      delete process.env.SMTP_PASSWORD;
+      try {
+        const unconfiguredService = new EmailService();
+        await unconfiguredService.sendMail({
+          to: 'test@example.com',
+          subject: 'Test',
+          html: '<p>Test</p>',
+          text: 'Test',
+        });
+        expect(mockSendMail).not.toHaveBeenCalled();
+      } finally {
+        process.env.SMTP_HOST = savedHost;
+        process.env.SMTP_USER = savedUser;
+        process.env.SMTP_PASSWORD = savedPass;
+      }
+    });
+  });
+
+  describe('ALL email methods use sendMail with correct headers', () => {
+    it('sendPollCreationEmails has all required headers', async () => {
+      await emailService.sendPollCreationEmails(
+        'admin@test.com', 'Teammeeting',
+        'https://polly.example.com/poll/abc', 'https://polly.example.com/admin/xyz', 'schedule'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendInvitationEmail has all required headers', async () => {
+      await emailService.sendInvitationEmail(
+        'user@test.com', 'Max', 'Sommerfeier',
+        'https://polly.example.com/poll/summer'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendVotingConfirmationEmail has all required headers', async () => {
+      await emailService.sendVotingConfirmationEmail(
+        'voter@test.com', 'Anna', 'Weihnachtsfeier', 'schedule',
+        'https://polly.example.com/poll/xmas', 'https://polly.example.com/poll/xmas#results'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendReminderEmail has all required headers', async () => {
+      await emailService.sendReminderEmail(
+        'user@test.com', 'Chef', 'Wichtige Umfrage',
+        'https://polly.example.com/poll/urgent', new Date('2025-12-31')
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendPasswordResetEmail has all required headers', async () => {
+      await emailService.sendPasswordResetEmail(
+        'user@test.com', 'https://polly.example.com/reset/token123', 'Max'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendEmailChangeConfirmation has all required headers', async () => {
+      await emailService.sendEmailChangeConfirmation(
+        'old@test.com', 'new@test.com', 'https://polly.example.com/confirm/abc'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendPasswordChangedEmail has all required headers', async () => {
+      await emailService.sendPasswordChangedEmail('user@test.com', 'Max');
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendTestReportEmail has all required headers (success = normal priority)', async () => {
+      await emailService.sendTestReportEmail('admin@test.com', {
+        id: 42, status: 'completed', triggeredBy: 'manual',
+        totalTests: 25, passed: 25, failed: 0, skipped: 0,
+        duration: 12500,
+        startedAt: new Date('2025-03-15T14:30:00'),
+        completedAt: new Date('2025-03-15T14:30:12'),
+      });
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions, 'normal');
+    });
+
+    it('sendTestReportEmail has high priority headers when tests fail', async () => {
+      await emailService.sendTestReportEmail('admin@test.com', {
+        id: 42, status: 'completed', triggeredBy: 'manual',
+        totalTests: 25, passed: 24, failed: 1, skipped: 0,
+        duration: 12500,
+        startedAt: new Date('2025-03-15T14:30:00'),
+        completedAt: new Date('2025-03-15T14:30:12'),
+      });
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions, 'high');
+    });
+
+    it('sendPreRenderedEmail has all required headers', async () => {
+      await emailService.sendPreRenderedEmail(
+        'user@test.com', 'Pre-rendered', '<p>HTML</p>', 'Text'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendWelcomeEmail has all required headers', async () => {
+      await emailService.sendWelcomeEmail(
+        'new@test.com', 'Neuer User', 'https://polly.example.com/verify/abc123'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions);
+    });
+
+    it('sendVirusDetectionAlert has high priority headers', async () => {
+      await emailService.sendVirusDetectionAlert(['admin@test.com'], {
+        filename: 'evil.exe', fileSize: 1024, virusName: 'Eicar-Test',
+        uploaderEmail: 'user@test.com', requestIp: '127.0.0.1',
+        scannedAt: new Date('2025-03-15T12:00:00'),
+      });
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions, 'high');
+    });
+
+    it('sendDeletionRequestNotification has all required headers with high priority', async () => {
+      await emailService.sendDeletionRequestNotification(
+        ['admin@test.com'], 'Max', 'max@test.com',
+        'https://polly.example.com/admin/users'
+      );
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      assertRequiredHeaders(lastMailOptions, 'high');
+    });
+  });
+
+  describe('Reply-To header consistency', () => {
+    it('all email methods use the same Reply-To address', async () => {
+      const methods: Array<{ name: string; fn: () => Promise<void> }> = [
+        { name: 'poll_created', fn: () => emailService.sendPollCreationEmails('a@b.com', 'T', 'https://e.com/p', 'https://e.com/a', 'schedule') },
+        { name: 'invitation', fn: () => emailService.sendInvitationEmail('a@b.com', 'N', 'T', 'https://e.com/p') },
+        { name: 'vote_confirmation', fn: () => emailService.sendVotingConfirmationEmail('a@b.com', 'N', 'T', 'survey', 'https://e.com/p', 'https://e.com/r') },
+        { name: 'reminder', fn: () => emailService.sendReminderEmail('a@b.com', 'S', 'T', 'https://e.com/p') },
+        { name: 'password_reset', fn: () => emailService.sendPasswordResetEmail('a@b.com', 'https://e.com/r') },
+        { name: 'email_change', fn: () => emailService.sendEmailChangeConfirmation('a@b.com', 'b@c.com', 'https://e.com/c') },
+        { name: 'password_changed', fn: () => emailService.sendPasswordChangedEmail('a@b.com') },
+        { name: 'welcome', fn: () => emailService.sendWelcomeEmail('a@b.com', 'N', 'https://e.com/v') },
+        { name: 'pre_rendered', fn: () => emailService.sendPreRenderedEmail('a@b.com', 'S', '<p>H</p>', 'T') },
+      ];
+
+      for (const { name, fn } of methods) {
+        mockSendMail.mockClear();
+        await fn();
+        expect(mockSendMail).toHaveBeenCalledTimes(1);
+        const headers = lastMailOptions.headers;
+        expect(headers['Reply-To']).toBe('noreply@polly.test');
+      }
+    });
+  });
+
+  describe('Template-based emails call renderEmail with correct type', () => {
+    it('sendPollCreationEmails calls renderEmail with poll_created', async () => {
+      await emailService.sendPollCreationEmails(
+        'admin@test.com', 'Teammeeting',
+        'https://polly.example.com/poll/abc', 'https://polly.example.com/admin/xyz', 'schedule'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('poll_created', expect.objectContaining({
+        pollTitle: 'Teammeeting',
+        publicLink: 'https://polly.example.com/poll/abc',
+        adminLink: 'https://polly.example.com/admin/xyz',
+      }));
+    });
+
+    it('sendInvitationEmail calls renderEmail with invitation and qrCodeUrl', async () => {
+      await emailService.sendInvitationEmail(
+        'user@test.com', 'Max Mustermann', 'Sommerfeier',
+        'https://polly.example.com/poll/summer', 'Bitte abstimmen!'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('invitation', expect.objectContaining({
+        inviterName: 'Max Mustermann',
+        pollTitle: 'Sommerfeier',
+        publicLink: expect.stringContaining('polly.example.com/poll/summer'),
+        qrCodeUrl: expect.any(String),
+      }));
+    });
+
+    it('sendVotingConfirmationEmail calls renderEmail with vote_confirmation', async () => {
+      await emailService.sendVotingConfirmationEmail(
+        'voter@test.com', 'Anna', 'Weihnachtsfeier', 'schedule',
+        'https://polly.example.com/poll/xmas', 'https://polly.example.com/poll/xmas#results'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('vote_confirmation', expect.objectContaining({
+        voterName: 'Anna',
+        pollTitle: 'Weihnachtsfeier',
+      }));
+    });
+
+    it('sendReminderEmail calls renderEmail with reminder', async () => {
+      await emailService.sendReminderEmail(
+        'user@test.com', 'Chef', 'Wichtige Umfrage',
+        'https://polly.example.com/poll/urgent', new Date('2025-12-31T23:59:00')
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('reminder', expect.objectContaining({
+        senderName: 'Chef',
+        pollTitle: 'Wichtige Umfrage',
+        pollLink: 'https://polly.example.com/poll/urgent',
+        qrCodeUrl: expect.any(String),
+      }));
+    });
+
+    it('sendPasswordResetEmail calls renderEmail with password_reset', async () => {
+      await emailService.sendPasswordResetEmail(
+        'user@test.com', 'https://polly.example.com/reset/token123', 'Max'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('password_reset', expect.objectContaining({
+        resetLink: 'https://polly.example.com/reset/token123',
+      }));
+    });
+
+    it('sendEmailChangeConfirmation calls renderEmail with email_change', async () => {
+      await emailService.sendEmailChangeConfirmation(
+        'old@test.com', 'new@test.com', 'https://polly.example.com/confirm/abc'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('email_change', expect.objectContaining({
+        confirmLink: 'https://polly.example.com/confirm/abc',
+      }));
+    });
+
+    it('sendPasswordChangedEmail calls renderEmail with password_changed', async () => {
+      await emailService.sendPasswordChangedEmail('user@test.com', 'Max Mustermann');
+      expect(renderEmailSpy).toHaveBeenCalledWith('password_changed', expect.any(Object));
+    });
+
+    it('sendTestReportEmail calls renderEmail with test_report', async () => {
+      await emailService.sendTestReportEmail('admin@test.com', {
+        id: 42, status: 'completed', triggeredBy: 'manual',
+        totalTests: 25, passed: 24, failed: 1, skipped: 0,
+        duration: 12500,
+        startedAt: new Date('2025-03-15T14:30:00'),
+        completedAt: new Date('2025-03-15T14:30:12'),
+      });
+      expect(renderEmailSpy).toHaveBeenCalledWith('test_report', expect.any(Object));
+    });
+
+    it('sendTestReportEmail attaches PDF when provided', async () => {
+      const pdfBuffer = Buffer.from('fake-pdf');
+      await emailService.sendTestReportEmail('admin@test.com', {
+        id: 1, status: 'completed', triggeredBy: 'manual',
+        totalTests: 10, passed: 10, failed: 0, skipped: 0,
+        duration: 5000, startedAt: new Date(), completedAt: new Date(),
+      }, pdfBuffer);
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+      const lastCall = mockSendMail.mock.lastCall?.[0];
+      expect(lastCall).toBeDefined();
+      expect(lastCall.attachments).toBeDefined();
+      expect(lastCall.attachments[0].filename).toContain('testbericht');
+      expect(lastCall.attachments[0].contentType).toBe('application/pdf');
+    });
+
+    it('sendWelcomeEmail calls renderEmail with welcome', async () => {
+      await emailService.sendWelcomeEmail(
+        'new@test.com', 'Neuer User', 'https://polly.example.com/verify/abc123'
+      );
+      expect(renderEmailSpy).toHaveBeenCalledWith('welcome', expect.objectContaining({
+        verificationLink: expect.stringContaining('polly.example.com/verify/abc123'),
+      }));
+    });
+  });
+
+  describe('Themed wrapper methods call wrapWithEmailTheme', () => {
+    it('sendVirusDetectionAlert calls wrapWithEmailTheme', async () => {
+      await emailService.sendVirusDetectionAlert(['admin@test.com'], {
+        filename: 'evil.exe', fileSize: 1024, virusName: 'Eicar-Test',
+        uploaderEmail: 'user@test.com', requestIp: '127.0.0.1',
+        scannedAt: new Date('2025-03-15T12:00:00'),
+      });
+      expect(wrapWithEmailThemeSpy).toHaveBeenCalledTimes(1);
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+    });
+
+    it('sendDeletionRequestNotification calls wrapWithEmailTheme', async () => {
+      await emailService.sendDeletionRequestNotification(
+        ['admin@test.com'], 'Max Mustermann', 'max@test.com',
+        'https://polly.example.com/admin/users'
+      );
+      expect(wrapWithEmailThemeSpy).toHaveBeenCalledTimes(1);
+      expect(mockSendMail).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('Email structure and safety', () => {
+    it('should not contain x-webdoc:// protocol in any email', async () => {
+      await emailService.sendPollCreationEmails(
+        'admin@test.com', 'Test',
+        'https://polly.example.com/poll/abc', 'https://polly.example.com/admin/xyz', 'schedule'
+      );
+      const lastCall = mockSendMail.mock.lastCall?.[0];
+      expect(lastCall.html).not.toContain('x-webdoc://');
+    });
+
+    it('all template emails include both HTML and plain text', async () => {
+      const methods: Array<{ name: string; fn: () => Promise<void> }> = [
+        { name: 'poll_created', fn: () => emailService.sendPollCreationEmails('a@b.com', 'T', 'https://e.com/p', 'https://e.com/a', 'schedule') },
+        { name: 'vote_confirmation', fn: () => emailService.sendVotingConfirmationEmail('a@b.com', 'N', 'T', 'survey', 'https://e.com/p', 'https://e.com/r') },
+        { name: 'password_reset', fn: () => emailService.sendPasswordResetEmail('a@b.com', 'https://e.com/r') },
+        { name: 'email_change', fn: () => emailService.sendEmailChangeConfirmation('a@b.com', 'b@c.com', 'https://e.com/c') },
+        { name: 'password_changed', fn: () => emailService.sendPasswordChangedEmail('a@b.com') },
+        { name: 'welcome', fn: () => emailService.sendWelcomeEmail('a@b.com', 'N', 'https://e.com/v') },
+      ];
+
+      for (const { fn } of methods) {
+        mockSendMail.mockClear();
+        await fn();
+        expect(mockSendMail).toHaveBeenCalledTimes(1);
+        const lastCall = mockSendMail.mock.lastCall?.[0];
+        expect(lastCall.html).toContain('<!DOCTYPE html>');
+        expect(lastCall.text).toBeDefined();
+        expect(lastCall.text.length).toBeGreaterThan(0);
+      }
+    });
+  });
+
+  describe('URL validation in email context', () => {
+    it('renderEmail is called with absolute https URLs for links', async () => {
+      await emailService.sendPollCreationEmails(
+        'admin@test.com', 'T',
+        'https://polly.example.com/poll/abc', 'https://polly.example.com/admin/xyz', 'schedule'
+      );
+      const callArgs = renderEmailSpy.mock.calls[0][1] as Record<string, string>;
+      expect(callArgs.publicLink).toMatch(/^https?:\/\//);
+      expect(callArgs.adminLink).toMatch(/^https?:\/\//);
+    });
+
+    it('password reset link is passed as absolute URL', async () => {
+      await emailService.sendPasswordResetEmail('a@b.com', 'https://polly.example.com/reset/tok');
+      const callArgs = renderEmailSpy.mock.calls[0][1] as Record<string, string>;
+      expect(callArgs.resetLink).toMatch(/^https?:\/\//);
+    });
+
+    it('email change confirm link is passed as absolute URL', async () => {
+      await emailService.sendEmailChangeConfirmation('a@b.com', 'b@c.com', 'https://polly.example.com/confirm/abc');
+      const callArgs = renderEmailSpy.mock.calls[0][1] as Record<string, string>;
+      expect(callArgs.confirmLink).toMatch(/^https?:\/\//);
+    });
+  });
+});
diff --git a/server/tests/services/emailTemplateService.test.ts b/server/tests/services/emailTemplateService.test.ts
index c612779f..7ad79d5d 100644
--- a/server/tests/services/emailTemplateService.test.ts
+++ b/server/tests/services/emailTemplateService.test.ts
@@ -1,5 +1,6 @@
-import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
-import { EmailTemplateService } from '../../services/emailTemplateService';
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from 'vitest';
+import { EmailTemplateService, jsonToHtml, ensureButtonTextContrast } from '../../services/emailTemplateService';
+import type { EmailTheme } from '../../services/emailTemplateService';
 import { storage } from '../../storage';
 
 export const testMeta = {
@@ -10,8 +11,44 @@ export const testMeta = {
 };
 
 describe('EmailTemplateService', () => {
+  let origCustomization: any;
+  let origTheme: any;
+  const modifiedTemplateTypes = [
+    'poll_created', 'invitation', 'vote_confirmation',
+    'reminder', 'password_reset',
+  ] as const;
+  const origTemplates: Record<string, any> = {};
+
+  beforeAll(async () => {
+    origCustomization = await storage.getCustomizationSettings();
+    const service = new EmailTemplateService();
+    origTheme = await service.getEmailTheme();
+    for (const type of modifiedTemplateTypes) {
+      origTemplates[type] = await service.getTemplate(type);
+    }
+  });
+
+  afterAll(async () => {
+    await storage.setCustomizationSettings(origCustomization);
+    const service = new EmailTemplateService();
+    await service.setEmailTheme(origTheme);
+    for (const type of modifiedTemplateTypes) {
+      const orig = origTemplates[type];
+      if (orig && !orig.isDefault) {
+        await service.saveTemplate(
+          type,
+          orig.jsonContent,
+          orig.subject,
+          orig.name,
+          orig.textContent
+        );
+      } else {
+        await service.resetTemplate(type);
+      }
+    }
+  });
   describe('Default Templates', () => {
-    it('should have all 8 template types defined', () => {
+    it('should have all 9 template types defined', () => {
       const expectedTypes = [
         'poll_created',
         'invitation',
@@ -20,7 +57,8 @@ describe('EmailTemplateService', () => {
         'password_reset',
         'email_change',
         'password_changed',
-        'test_report'
+        'test_report',
+        'welcome'
       ];
 
       for (const type of expectedTypes) {
@@ -122,11 +160,12 @@ describe('EmailTemplateService', () => {
       
       expect(html).toBeDefined();
       expect(typeof html).toBe('string');
-      expect(html.includes('<html')).toBe(true);
+      expect(html.includes('<div')).toBe(true);
     });
 
-    it('should include siteName in rendered template', async () => {
-      const html = await EmailTemplateService.renderTemplate('poll_created', {
+    it('should include siteName in rendered email via V3 shell footer', async () => {
+      const service = new EmailTemplateService();
+      const result = await service.renderEmail('poll_created', {
         pollType: 'Umfrage',
         pollTitle: 'Test',
         publicLink: 'https://example.com',
@@ -134,13 +173,13 @@ describe('EmailTemplateService', () => {
         siteName: 'Polly-Test-Instance'
       });
       
-      expect(html).toContain('Polly-Test-Instance');
+      expect(result.html).toContain('email-footer');
     });
   });
 
   describe('Sample Data Generation', () => {
-    it('should generate sample data for poll_created template', () => {
-      const sampleData = EmailTemplateService.getSampleDataForType('poll_created');
+    it('should generate sample data for poll_created template', async () => {
+      const sampleData = await EmailTemplateService.getSampleDataForType('poll_created');
       
       expect(sampleData.pollTitle).toBeDefined();
       expect(sampleData.publicLink).toBeDefined();
@@ -148,31 +187,31 @@ describe('EmailTemplateService', () => {
       expect(sampleData.siteName).toBeDefined();
     });
 
-    it('should generate sample data for invitation template', () => {
-      const sampleData = EmailTemplateService.getSampleDataForType('invitation');
+    it('should generate sample data for invitation template', async () => {
+      const sampleData = await EmailTemplateService.getSampleDataForType('invitation');
       
       expect(sampleData.pollTitle).toBeDefined();
       expect(sampleData.inviterName).toBeDefined();
       expect(sampleData.publicLink).toBeDefined();
     });
 
-    it('should generate sample data for password_reset template', () => {
-      const sampleData = EmailTemplateService.getSampleDataForType('password_reset');
+    it('should generate sample data for password_reset template', async () => {
+      const sampleData = await EmailTemplateService.getSampleDataForType('password_reset');
       
       expect(sampleData.resetLink).toBeDefined();
       expect(sampleData.siteName).toBeDefined();
     });
 
-    it('should generate sample data for email_change template', () => {
-      const sampleData = EmailTemplateService.getSampleDataForType('email_change');
+    it('should generate sample data for email_change template', async () => {
+      const sampleData = await EmailTemplateService.getSampleDataForType('email_change');
       
       expect(sampleData.oldEmail).toBeDefined();
       expect(sampleData.newEmail).toBeDefined();
       expect(sampleData.confirmLink).toBeDefined();
     });
 
-    it('should return empty object for unknown template type', () => {
-      const sampleData = EmailTemplateService.getSampleDataForType('unknown_type');
+    it('should return empty object for unknown template type', async () => {
+      const sampleData = await EmailTemplateService.getSampleDataForType('unknown_type');
       
       expect(sampleData).toEqual({});
     });
@@ -233,6 +272,18 @@ describe('EmailTemplateService', () => {
   });
 
   describe('Customized Template Rendering (renderEmail)', () => {
+    let savedCustomization: any;
+    const service = new EmailTemplateService();
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+      for (const type of modifiedTemplateTypes) {
+        await service.resetTemplate(type);
+      }
+    });
+
     it('should use stored htmlContent for customized templates', async () => {
       const service = new EmailTemplateService();
       const template = EmailTemplateService.getDefaultTemplate('invitation');
@@ -269,9 +320,9 @@ describe('EmailTemplateService', () => {
         siteName: 'Test-Instance'
       });
       
-      // Should have header table structure
       expect(result.html).toContain('<table');
-      expect(result.html).toContain('Test-Instance');
+      expect(result.html).toContain('email-header');
+      expect(result.html).toContain('email-footer');
     });
 
     it('should include footer in rendered email', async () => {
@@ -284,14 +335,142 @@ describe('EmailTemplateService', () => {
         siteName: 'MeineApp'
       });
       
-      // Footer should have footer styling with border-top
       expect(result.html).toContain('border-top');
-      // Text version should include siteName
-      expect(result.text).toContain('MeineApp');
+      expect(result.html).toContain('email-footer');
+    });
+
+    it('should show Datenschutz link from customization only when privacy URL is configured', async () => {
+      const origCustomization = await storage.getCustomizationSettings();
+      const service = new EmailTemplateService();
+      const origFooter = await service.getEmailFooter();
+
+      try {
+        await service.setEmailFooter({ html: 'Plain footer only', text: 'Plain footer only' });
+
+        await storage.setCustomizationSettings({
+          ...origCustomization,
+          footer: { ...(origCustomization.footer || {}), supportLinks: [] },
+        });
+
+        const resultWithout = await service.renderEmail('poll_created', {
+          pollType: 'Terminumfrage',
+          pollTitle: 'Test',
+          publicLink: 'https://example.com/poll/test',
+          adminLink: 'https://example.com/admin/test',
+        });
+        expect(resultWithout.html).not.toContain('>Datenschutz<');
+
+        await storage.setCustomizationSettings({
+          ...origCustomization,
+          footer: {
+            ...(origCustomization.footer || {}),
+            supportLinks: [{ label: 'Datenschutz', url: 'https://example.com/privacy' }],
+          },
+        });
+
+        const resultWith = await service.renderEmail('poll_created', {
+          pollType: 'Terminumfrage',
+          pollTitle: 'Test',
+          publicLink: 'https://example.com/poll/test',
+          adminLink: 'https://example.com/admin/test',
+        });
+        expect(resultWith.html).toContain('Datenschutz');
+        expect(resultWith.html).toContain('https://example.com/privacy');
+      } finally {
+        await storage.setCustomizationSettings(origCustomization);
+        await service.setEmailFooter(origFooter);
+      }
+    });
+
+    it('should render the central email footer text from settings', async () => {
+      const service = new EmailTemplateService();
+      const origFooter = await service.getEmailFooter();
+
+      try {
+        await service.setEmailFooter({
+          html: 'Gesendet von TestOrg — Die Abstimmungsplattform',
+          text: 'Gesendet von TestOrg — Die Abstimmungsplattform',
+        });
+
+        const result = await service.renderEmail('poll_created', {
+          pollType: 'Terminumfrage',
+          pollTitle: 'Footer-Test',
+          publicLink: 'https://example.com/poll/test',
+          adminLink: 'https://example.com/admin/test',
+        });
+
+        expect(result.html).toContain('Gesendet von TestOrg');
+        expect(result.text).toContain('Gesendet von TestOrg');
+      } finally {
+        await service.setEmailFooter(origFooter);
+      }
+    });
+
+    it('should use central footer for all email types', async () => {
+      const service = new EmailTemplateService();
+      const origFooter = await service.getEmailFooter();
+
+      try {
+        await service.setEmailFooter({
+          html: 'Zentraler Footer Marker XYZ',
+          text: 'Zentraler Footer Marker XYZ',
+        });
+
+        const types: Array<{ type: any; vars: Record<string, string> }> = [
+          { type: 'poll_created', vars: { pollType: 'Umfrage', pollTitle: 'T', publicLink: 'https://a.com', adminLink: 'https://b.com' } },
+          { type: 'invitation', vars: { pollTitle: 'T', inviterName: 'A', publicLink: 'https://a.com', message: '' } },
+          { type: 'reminder', vars: { pollTitle: 'T', senderName: 'A', pollLink: 'https://a.com', expiresAt: '' } },
+          { type: 'vote_confirmation', vars: { voterName: 'A', pollType: 'Umfrage', pollTitle: 'T', resultsLink: 'https://a.com' } },
+          { type: 'welcome', vars: { userName: 'A', verificationLink: 'https://a.com' } },
+        ];
+
+        for (const { type, vars } of types) {
+          const result = await service.renderEmail(type, vars);
+          expect(result.html).toContain('Zentraler Footer Marker XYZ');
+        }
+      } finally {
+        await service.setEmailFooter(origFooter);
+      }
+    });
+
+    it('should apply central footer in wrapWithEmailTheme plain text', async () => {
+      const service = new EmailTemplateService();
+      const origFooter = await service.getEmailFooter();
+
+      try {
+        await service.setEmailFooter({
+          html: 'Wrap Footer HTML Test',
+          text: 'Wrap Footer Text Test',
+        });
+
+        const result = await service.wrapWithEmailTheme(
+          'Test Subject',
+          '<p>Body content</p>',
+          'Body content plain text'
+        );
+
+        expect(result.html).toContain('Wrap Footer HTML Test');
+        expect(result.text).toContain('Wrap Footer Text Test');
+        expect(result.text).toContain('---');
+      } finally {
+        await service.setEmailFooter(origFooter);
+      }
     });
   });
 
   describe('Template Reset', () => {
+    let savedCustomization: any;
+    const service = new EmailTemplateService();
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+      for (const type of modifiedTemplateTypes) {
+        await service.resetTemplate(type);
+      }
+    });
+
     it('should reset customized template to default', async () => {
       const service = new EmailTemplateService();
       const template = EmailTemplateService.getDefaultTemplate('vote_confirmation');
@@ -314,6 +493,18 @@ describe('EmailTemplateService', () => {
   });
 
   describe('End-to-End: Customized Template Email Sending', () => {
+    let savedCustomization: any;
+    const service = new EmailTemplateService();
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+      for (const type of modifiedTemplateTypes) {
+        await service.resetTemplate(type);
+      }
+    });
+
     it('should render customized template content when preparing email for sending', async () => {
       const service = new EmailTemplateService();
       const template = EmailTemplateService.getDefaultTemplate('reminder');
@@ -425,6 +616,14 @@ describe('EmailTemplateService', () => {
   });
 
   describe('Email Theme Import and Validation', () => {
+    let savedCustomization: any;
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+    });
+
     it('should extract valid theme colors from emailbuilder.js JSON', () => {
       const service = new EmailTemplateService();
       const emailBuilderJson = {
@@ -615,9 +814,8 @@ describe('EmailTemplateService', () => {
     it('should reset theme using primary color from branding settings', async () => {
       const service = new EmailTemplateService();
       
-      await storage.setSetting({
-        key: 'primary_color',
-        value: '#123456'
+      await storage.setCustomizationSettings({
+        theme: { primaryColor: '#123456', secondaryColor: '#654321' }
       });
       
       const resetTheme = await service.resetEmailTheme();
@@ -625,22 +823,931 @@ describe('EmailTemplateService', () => {
       expect(resetTheme.headingColor).toBe('#123456');
       expect(resetTheme.linkColor).toBe('#123456');
       expect(resetTheme.buttonBackgroundColor).toBe('#123456');
+      expect(resetTheme.secondaryButtonBackgroundColor).toBe('#654321');
       expect(resetTheme.backdropColor).toBe('#F5F5F5');
       expect(resetTheme.canvasColor).toBe('#FFFFFF');
     });
 
-    it('should use default orange when primary color is empty string', async () => {
+    it('should use default orange when primary color not set', async () => {
       const service = new EmailTemplateService();
       
-      await storage.setSetting({
-        key: 'primary_color',
-        value: ''
-      });
+      await storage.setCustomizationSettings({ theme: { primaryColor: '', secondaryColor: '' } });
       
       const resetTheme = await service.resetEmailTheme();
       
       expect(resetTheme.headingColor).toBe('#FF6B35');
       expect(resetTheme.buttonBackgroundColor).toBe('#FF6B35');
+      expect(resetTheme.secondaryButtonBackgroundColor).toBe('#4A90A4');
+    });
+
+    it('should include dark mode colors in reset theme', async () => {
+      const service = new EmailTemplateService();
+      
+      const resetTheme = await service.resetEmailTheme();
+      
+      expect(resetTheme.darkBackdropColor).toBeDefined();
+      expect(resetTheme.darkCanvasColor).toBeDefined();
+      expect(resetTheme.darkTextColor).toBeDefined();
+      expect(resetTheme.darkHeadingColor).toBeDefined();
+    });
+  });
+
+  describe('Container Block Rendering', () => {
+    it('should render Container block with background color', () => {
+      const doc = {
+        root: {
+          type: 'EmailLayout' as const,
+          data: {
+            backdropColor: '#F5F5F5',
+            canvasColor: '#FFFFFF',
+            textColor: '#333333',
+            fontFamily: 'Arial, sans-serif',
+            childrenIds: ['container-1'],
+          },
+        },
+        'container-1': {
+          type: 'Container',
+          data: {
+            childrenIds: ['text-1'],
+            style: {
+              backgroundColor: '#f8f9fa',
+              borderRadius: 8,
+              padding: { top: 20, right: 24, bottom: 20, left: 24 },
+              margin: { top: 12, right: 0, bottom: 12, left: 0 },
+            },
+          },
+        },
+        'text-1': {
+          type: 'Text',
+          data: {
+            props: { text: 'Container content' },
+            style: { fontSize: 16 },
+          },
+        },
+      };
+
+      const html = jsonToHtml(doc);
+      
+      expect(html).toContain('email-container');
+      expect(html).toContain('#f8f9fa');
+      expect(html).toContain('Container content');
+      expect(html).toContain('border-radius: 8px');
+    });
+
+    it('should render nested children inside Container', () => {
+      const doc = {
+        root: {
+          type: 'EmailLayout' as const,
+          data: {
+            backdropColor: '#F5F5F5',
+            canvasColor: '#FFFFFF',
+            textColor: '#333333',
+            fontFamily: 'Arial',
+            childrenIds: ['c1'],
+          },
+        },
+        'c1': {
+          type: 'Container',
+          data: {
+            childrenIds: ['h1', 'b1'],
+            style: { backgroundColor: '#e8f4f8' },
+          },
+        },
+        'h1': {
+          type: 'Heading',
+          data: { props: { text: 'Box Heading', level: 'h3' }, style: {} },
+        },
+        'b1': {
+          type: 'Button',
+          data: {
+            props: { text: 'Click me', url: 'https://example.com', buttonType: 'secondary' },
+            style: {},
+          },
+        },
+      };
+
+      const html = jsonToHtml(doc);
+      
+      expect(html).toContain('Box Heading');
+      expect(html).toContain('Click me');
+      expect(html).toContain('email-btn-secondary');
+      expect(html).toContain('#e8f4f8');
+    });
+  });
+
+  describe('Button Types', () => {
+    it('should use primary button color by default', () => {
+      const doc = {
+        root: {
+          type: 'EmailLayout' as const,
+          data: { backdropColor: '#F5F5F5', canvasColor: '#FFF', textColor: '#333', fontFamily: 'Arial', childrenIds: ['btn'] },
+        },
+        'btn': {
+          type: 'Button',
+          data: { props: { text: 'Primary', url: '#' }, style: {} },
+        },
+      };
+
+      const html = jsonToHtml(doc);
+      expect(html).toContain('email-btn-primary');
+      expect(html).toContain('#FF6B35');
+    });
+
+    it('should use secondary button color for secondary type', () => {
+      const theme: EmailTheme = {
+        backdropColor: '#F5F5F5', canvasColor: '#FFF', textColor: '#333',
+        headingColor: '#000', linkColor: '#000', buttonBackgroundColor: '#FF0000',
+        buttonTextColor: '#FFF', buttonBorderRadius: 6, fontFamily: 'Arial',
+        secondaryButtonBackgroundColor: '#00FF00', secondaryButtonTextColor: '#000',
+        darkBackdropColor: '#111', darkCanvasColor: '#222', darkTextColor: '#EEE', darkHeadingColor: '#FFF',
+      };
+
+      const doc = {
+        root: {
+          type: 'EmailLayout' as const,
+          data: { backdropColor: '#F5F5F5', canvasColor: '#FFF', textColor: '#333', fontFamily: 'Arial', childrenIds: ['btn'] },
+        },
+        'btn': {
+          type: 'Button',
+          data: { props: { text: 'Secondary', url: '#', buttonType: 'secondary' }, style: {} },
+        },
+      };
+
+      const html = jsonToHtml(doc, theme);
+      expect(html).toContain('email-btn-secondary');
+      expect(html).toContain('#00FF00');
+    });
+
+    it('should allow explicit style.backgroundColor override', () => {
+      const doc = {
+        root: {
+          type: 'EmailLayout' as const,
+          data: { backdropColor: '#F5F5F5', canvasColor: '#FFF', textColor: '#333', fontFamily: 'Arial', childrenIds: ['btn'] },
+        },
+        'btn': {
+          type: 'Button',
+          data: { props: { text: 'Custom', url: '#' }, style: { backgroundColor: '#ABCDEF' } },
+        },
+      };
+
+      const html = jsonToHtml(doc);
+      expect(html).toContain('#ABCDEF');
+    });
+  });
+
+  describe('Dark Mode Support', () => {
+    it('should include dark mode CSS in rendered email', async () => {
+      const service = new EmailTemplateService();
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('prefers-color-scheme: dark');
+      expect(result.html).toContain('color-scheme');
+      expect(result.html).toContain('class="shell"');
+      expect(result.html).toContain('.shell');
+    });
+
+    it('should include MSO conditional comments for Outlook', async () => {
+      const service = new EmailTemplateService();
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('[if mso]');
+    });
+  });
+
+  describe('Logo Sizing', () => {
+    let savedCustomization: any;
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+    });
+
+    it('should use proper logo sizing constraints', async () => {
+      const service = new EmailTemplateService();
+      
+      await storage.setCustomizationSettings({
+        branding: {
+          siteName: 'Test',
+          siteNameAccent: '',
+          logoUrl: 'data:image/png;base64,iVBORw0KGgo=',
+        }
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('height: 36px');
+      expect(result.html).toContain('max-width: 100px');
+    });
+  });
+
+  describe('Header Design (no colored header bar)', () => {
+    let savedCustomization: any;
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+    });
+
+    it('should NOT have a colored header bar background', async () => {
+      const service = new EmailTemplateService();
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).not.toMatch(/background-color:\s*#FF6B35/i);
+      expect(result.html).not.toContain('color: #FFFFFF; font-size: 22px');
+    });
+
+    it('should show siteName as subtle muted text when logo is set', async () => {
+      const service = new EmailTemplateService();
+
+      await storage.setCustomizationSettings({
+        branding: {
+          siteName: 'Poll',
+          siteNameAccent: 'y',
+          logoUrl: 'data:image/png;base64,iVBORw0KGgo=',
+        }
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('hdr-site');
+      expect(result.html).toContain('color: #6b7280');
+    });
+
+    it('should include logo as base64 data URI when logoUrl is set', async () => {
+      const service = new EmailTemplateService();
+      const testDataUri = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUA';
+      
+      await storage.setCustomizationSettings({
+        branding: {
+          siteName: 'Polly',
+          siteNameAccent: 'Vote',
+          logoUrl: testDataUri,
+        }
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain(testDataUri);
+      expect(result.html).toContain('PollyVote');
+    });
+
+    it('should embed logo from /uploads/ relative path as base64', async () => {
+      const service = new EmailTemplateService();
+      const fs = await import('fs/promises');
+      const path = await import('path');
+      
+      const uploadsDir = path.join(process.cwd(), 'uploads');
+      try { await fs.mkdir(uploadsDir, { recursive: true }); } catch {}
+      const testLogoPath = path.join(uploadsDir, 'test-logo-email.png');
+      const pngHeader = Buffer.from([
+        0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a,
+        0x00, 0x00, 0x00, 0x01, 0x49, 0x48, 0x44, 0x52
+      ]);
+      await fs.writeFile(testLogoPath, pngHeader);
+
+      try {
+        await storage.setCustomizationSettings({
+          branding: {
+            siteName: 'Polly',
+            siteNameAccent: 'Vote',
+            logoUrl: '/uploads/test-logo-email.png',
+          }
+        });
+
+        const result = await service.renderEmail('poll_created', {
+          pollType: 'Umfrage',
+          pollTitle: 'Test',
+          publicLink: 'https://example.com',
+          adminLink: 'https://example.com/admin',
+        });
+
+        expect(result.html).toContain('data:image/png;base64,');
+        expect(result.html).toContain('<img');
+      } finally {
+        await fs.unlink(testLogoPath).catch(() => {});
+      }
+    });
+
+    it('should fall back to text header when logo URL is unreachable', async () => {
+      const service = new EmailTemplateService();
+      
+      await storage.setCustomizationSettings({
+        branding: {
+          siteName: 'Polly',
+          siteNameAccent: 'Vote',
+          logoUrl: 'https://nonexistent.invalid/logo.png',
+        }
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).not.toContain('<img');
+      expect(result.html).toContain('font-size: 18px');
+      expect(result.html).toContain('Polly');
+    });
+
+    it('should have dark mode class for header text', async () => {
+      const service = new EmailTemplateService();
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('.hdr-site');
+    });
+
+    it('should render only logo without text span when siteName is empty', async () => {
+      const service = new EmailTemplateService();
+
+      await storage.setCustomizationSettings({
+        branding: {
+          siteName: '',
+          siteNameAccent: '',
+          logoUrl: 'data:image/png;base64,iVBORw0KGgo=',
+        }
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('<img');
+      expect(result.html).toContain('alt="Logo"');
+      expect(result.html).not.toContain('class="hdr-site"');
+      expect(result.html).not.toContain('class="hdr-accent"');
+    });
+
+    it('should not render empty accent span when siteNameAccent is empty', async () => {
+      const service = new EmailTemplateService();
+
+      await storage.setCustomizationSettings({
+        branding: {
+          siteName: 'Polly',
+          siteNameAccent: '',
+          logoUrl: 'data:image/png;base64,iVBORw0KGgo=',
+        }
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('alt="Polly"');
+      expect(result.html).toContain('class="hdr-site"');
+      expect(result.html).not.toContain('class="hdr-accent"');
+    });
+
+    it('should preserve branding after full test cycle', async () => {
+      const before = await storage.getCustomizationSettings();
+
+      const service = new EmailTemplateService();
+      await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      const after = await storage.getCustomizationSettings();
+      expect(after.branding.logoUrl).toBe(before.branding.logoUrl);
+      expect(after.branding.siteName).toBe(before.branding.siteName);
+      expect(after.branding.siteNameAccent).toBe(before.branding.siteNameAccent);
+      expect(after.theme.primaryColor).toBe(before.theme.primaryColor);
+      expect(after.theme.secondaryColor).toBe(before.theme.secondaryColor);
+    });
+  });
+
+  describe('poll_created Template Structure', () => {
+    it('should have admin and public containers', () => {
+      const template = EmailTemplateService.getDefaultTemplate('poll_created');
+      const json = template.jsonContent as Record<string, unknown>;
+      
+      expect(json['admin-box']).toBeDefined();
+      expect(json['public-box']).toBeDefined();
+      
+      const adminBox = json['admin-box'] as { type: string; data: Record<string, unknown> };
+      expect(adminBox.type).toBe('Container');
+      
+      const publicBox = json['public-box'] as { type: string; data: Record<string, unknown> };
+      expect(publicBox.type).toBe('Container');
+    });
+
+    it('should have primary button in admin box and secondary in public box', () => {
+      const template = EmailTemplateService.getDefaultTemplate('poll_created');
+      const json = template.jsonContent as Record<string, unknown>;
+      
+      const adminBtn = json['ab-btn'] as { type: string; data: { props: Record<string, unknown> } };
+      expect(adminBtn.type).toBe('Button');
+      
+      const publicBtn = json['pb-btn'] as { type: string; data: { props: Record<string, unknown> } };
+      expect(publicBtn.type).toBe('Button');
+      expect(publicBtn.data.props.buttonType).toBe('secondary');
+    });
+  });
+
+  describe('Button Text Contrast Auto-Correction', () => {
+    let savedCustomization: any;
+    let savedEmailTheme: any;
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+      const svc = new EmailTemplateService();
+      savedEmailTheme = await svc.getEmailTheme();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+      const svc = new EmailTemplateService();
+      await svc.setEmailTheme(savedEmailTheme);
+    });
+
+    it('should keep white text on sufficiently dark backgrounds', () => {
+      expect(ensureButtonTextContrast('#7A3800', '#FFFFFF')).toBe('#FFFFFF');
+      expect(ensureButtonTextContrast('#123456', '#FFFFFF')).toBe('#FFFFFF');
+      expect(ensureButtonTextContrast('#000000', '#FFFFFF')).toBe('#FFFFFF');
+    });
+
+    it('should pick best contrast for medium-luminance backgrounds', () => {
+      expect(ensureButtonTextContrast('#FF6B35', '#FFFFFF')).toBe('#1a1a1a');
+      expect(ensureButtonTextContrast('#4A90A4', '#FFFFFF')).toBe('#1a1a1a');
+    });
+
+    it('should switch to dark text on light backgrounds', () => {
+      expect(ensureButtonTextContrast('#FDE4D2', '#FFFFFF')).toBe('#1a1a1a');
+      expect(ensureButtonTextContrast('#FFFFFF', '#FFFFFF')).toBe('#1a1a1a');
+      expect(ensureButtonTextContrast('#F0F0F0', '#FFFFFF')).toBe('#1a1a1a');
+    });
+
+    it('should handle shorthand hex colors (#fff)', () => {
+      expect(ensureButtonTextContrast('#fff', '#FFFFFF')).toBe('#1a1a1a');
+      expect(ensureButtonTextContrast('#000', '#FFFFFF')).toBe('#FFFFFF');
+    });
+
+    it('should handle rgb() and named colors', () => {
+      expect(ensureButtonTextContrast('rgb(253, 228, 210)', '#FFFFFF')).toBe('#1a1a1a');
+      expect(ensureButtonTextContrast('white', '#000000')).toBe('#000000');
+    });
+
+    it('should auto-correct rgb() colors', () => {
+      expect(ensureButtonTextContrast('rgb(255,0,0)', '#FFFFFF')).toBe('#1a1a1a');
+    });
+
+    it('should return preferred color for truly invalid input', () => {
+      expect(ensureButtonTextContrast('invalid', '#FFFFFF')).toBe('#FFFFFF');
+      expect(ensureButtonTextContrast('', '#FFFFFF')).toBe('#FFFFFF');
+    });
+
+    it('should auto-correct secondary button text in rendered email', async () => {
+      const service = new EmailTemplateService();
+
+      await service.resetTemplate('poll_created');
+      await storage.setCustomizationSettings({
+        theme: { primaryColor: '#7A3800', secondaryColor: '#FDE4D2' }
+      });
+      await service.resetEmailTheme();
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('btn-secondary');
+      expect(result.html).toContain('#FDE4D2');
+    });
+  });
+
+  describe('V3 Dark Mode Shell', () => {
+    let savedCustomization: any;
+    beforeEach(async () => {
+      savedCustomization = await storage.getCustomizationSettings();
+    });
+    afterEach(async () => {
+      await storage.setCustomizationSettings(savedCustomization);
+    });
+
+    it('should include V3 dark mode CSS with shell and header classes', async () => {
+      const service = new EmailTemplateService();
+      await service.resetTemplate('poll_created');
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('.shell');
+      expect(result.html).toContain('.email-header');
+      expect(result.html).toContain('.btn-primary');
+      expect(result.html).toContain('.btn-secondary');
+      expect(result.html).toContain('.email-footer');
+    });
+
+    it('should include V3 body structure with tag, headline and sections', async () => {
+      const service = new EmailTemplateService();
+      await service.resetTemplate('poll_created');
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('survey-tag');
+      expect(result.html).toContain('headline');
+      expect(result.html).toContain('link-label');
+      expect(result.html).toContain('sec-divider');
+      expect(result.html).toContain('notice');
+    });
+  });
+
+  describe('poll_created Guest vs Registered User', () => {
+    it('should show guest notice when isRegisteredUser is empty', async () => {
+      const service = new EmailTemplateService();
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test Poll',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+        isRegisteredUser: '',
+      });
+
+      expect(result.html).toContain('Bitte diese E-Mail aufbewahren.');
+      expect(result.html).toContain('Administratorlink');
+      expect(result.html).not.toContain('Meine Umfragen');
+    });
+
+    it('should show registered user notice when isRegisteredUser is true', async () => {
+      const service = new EmailTemplateService();
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test Poll',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+        isRegisteredUser: 'true',
+      });
+
+      expect(result.html).toContain('Schnellzugriff');
+      expect(result.html).toContain('Meine Umfragen');
+      expect(result.html).not.toContain('Bitte diese E-Mail aufbewahren.');
+    });
+
+    it('should default to guest notice when isRegisteredUser is not provided', async () => {
+      const service = new EmailTemplateService();
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test Poll',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+      });
+
+      expect(result.html).toContain('Bitte diese E-Mail aufbewahren.');
+      expect(result.html).not.toContain('Meine Umfragen');
+    });
+
+    it('should differentiate plain text for guest vs registered user', async () => {
+      const service = new EmailTemplateService();
+      const guestResult = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+        isRegisteredUser: '',
+      });
+      const registeredResult = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+        isRegisteredUser: 'true',
+      });
+
+      expect(guestResult.text).toContain('Administratorlink sicher aufbewahren');
+      expect(guestResult.text).not.toContain('Meine Umfragen');
+
+      expect(registeredResult.text).toContain('Schnellzugriff');
+      expect(registeredResult.text).toContain('Meine Umfragen');
+      expect(registeredResult.text).not.toContain('Administratorlink sicher aufbewahren');
+    });
+
+    it('should use neutral language without direct address (Sie/Du)', async () => {
+      const service = new EmailTemplateService();
+      const guestResult = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+        isRegisteredUser: '',
+      });
+      const registeredResult = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Test',
+        publicLink: 'https://example.com',
+        adminLink: 'https://example.com/admin',
+        isRegisteredUser: 'true',
+      });
+
+      for (const result of [guestResult, registeredResult]) {
+        const bodyAfterGreeting = result.html.replace(/Hallo[^<]*/g, '');
+        expect(bodyAfterGreeting).not.toMatch(/\bIhre\b/);
+        expect(bodyAfterGreeting).not.toMatch(/\bIhren\b/);
+        expect(bodyAfterGreeting).not.toMatch(/\bIhrem\b/);
+        expect(bodyAfterGreeting).not.toMatch(/\bSie\b(?![_-])/);
+      }
+    });
+  });
+
+  describe('Footer {{link:URL}} and {{siteUrl}} template syntax', () => {
+    afterEach(async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: EmailTemplateService.DEFAULT_FOOTER,
+        text: EmailTemplateService.DEFAULT_FOOTER,
+      });
+    });
+
+    it('should render {{link:URL|Label}} as clickable HTML link in footer', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: 'Erstellt von {{siteName}} | {{link:https://example.com/privacy|Datenschutz}}',
+        text: 'Erstellt von {{siteName}} | {{link:https://example.com/privacy|Datenschutz}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Link-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).toContain('href="https://example.com/privacy"');
+      expect(result.html).toContain('target="_blank"');
+      expect(result.html).toContain('>Datenschutz</a>');
+    });
+
+    it('should render {{link:URL}} without label using domain as display text', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: '{{link:https://example.com/page}}',
+        text: '{{link:https://example.com/page}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Link-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).toContain('href="https://example.com/page"');
+      expect(result.html).toContain('>example.com/page</a>');
+    });
+
+    it('should render plain-text footer with {{link:URL|Label}} as "Label (URL)"', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: 'Kontakt: {{link:https://example.com/privacy|Datenschutz}}',
+        text: 'Kontakt: {{link:https://example.com/privacy|Datenschutz}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Link-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.text).toContain('Datenschutz (https://example.com/privacy)');
+    });
+
+    it('should render plain-text footer with {{link:URL}} as bare URL', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: 'Info: {{link:https://example.com/info}}',
+        text: 'Info: {{link:https://example.com/info}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Link-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.text).toContain('https://example.com/info');
+      expect(result.text).not.toContain('{{link:');
+    });
+
+    it('should replace {{siteUrl}} variable in footer', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: 'Besuche uns: {{link:{{siteUrl}}|Zur Website}}',
+        text: 'Besuche uns: {{link:{{siteUrl}}|Zur Website}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'SiteUrl-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).not.toContain('{{siteUrl}}');
+      expect(result.html).toContain('href=');
+      expect(result.html).toContain('>Zur Website</a>');
+    });
+
+    it('should render default footer with Datenschutz as plain text when no privacy URL configured', async () => {
+      const service = new EmailTemplateService();
+      const footer = await service.getEmailFooter();
+
+      expect(footer.html).toContain('{{link:#|Datenschutz}}');
+      expect(footer.html).toContain('{{siteName}}');
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Default-Footer-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).not.toContain('href="#"');
+      expect(result.html).toContain('Datenschutz');
+      expect(result.html).not.toContain('{{link:');
+      expect(result.html).not.toContain('{{siteName}}');
+    });
+
+    it('should handle multiple {{link:...}} in one footer line', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: '{{link:https://a.com|Impressum}} | {{link:https://b.com|Datenschutz}}',
+        text: '{{link:https://a.com|Impressum}} | {{link:https://b.com|Datenschutz}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Multi-Link',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).toContain('href="https://a.com"');
+      expect(result.html).toContain('>Impressum</a>');
+      expect(result.html).toContain('href="https://b.com"');
+      expect(result.html).toContain('>Datenschutz</a>');
+    });
+
+    it('should strip unsafe URL schemes in {{link:...}} (no href rendered)', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: '{{link:javascript:alert(1)|Click me}}',
+        text: '{{link:javascript:alert(1)|Click me}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'XSS-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).not.toContain('javascript:');
+      expect(result.html).not.toContain('href="javascript');
+      expect(result.html).toContain('Click me');
+    });
+
+    it('should XSS-escape malicious label text in {{link:...}}', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: '{{link:https://safe.com|<script>alert(1)</script>}}',
+        text: '{{link:https://safe.com|<script>alert(1)</script>}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'XSS-Label-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).not.toContain('<script>');
+      expect(result.html).toContain('&lt;script&gt;');
+    });
+
+    it('should replace # placeholder with configured privacy URL', async () => {
+      const service = new EmailTemplateService();
+      const origCustomization = await storage.getCustomizationSettings();
+
+      try {
+        await service.setEmailFooter({
+          html: 'Footer text\n{{link:#|Datenschutz}}',
+          text: 'Footer text\n{{link:#|Datenschutz}}',
+        });
+        await storage.setCustomizationSettings({
+          ...origCustomization,
+          footer: {
+            ...(origCustomization.footer || {}),
+            supportLinks: [{ label: 'Datenschutz', url: 'https://example.com/privacy' }],
+          },
+        });
+
+        const result = await service.renderEmail('poll_created', {
+          pollType: 'Umfrage',
+          pollTitle: 'Privacy-Replace',
+          publicLink: 'https://example.com/poll/test',
+          adminLink: 'https://example.com/admin/test',
+        });
+
+        expect(result.html).toContain('href="https://example.com/privacy"');
+        expect(result.html).toContain('>Datenschutz</a>');
+        const datenschutzCount = (result.html.match(/>Datenschutz</g) || []).length;
+        expect(datenschutzCount).toBe(1);
+      } finally {
+        await storage.setCustomizationSettings(origCustomization);
+      }
+    });
+
+    it('should strip unsafe URL scheme in plain-text footer', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: '{{link:javascript:alert(1)|Evil Link}}',
+        text: '{{link:javascript:alert(1)|Evil Link}}',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Plaintext-XSS',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.text).not.toContain('javascript:');
+      expect(result.text).toContain('Evil Link');
+    });
+
+    it('should render newlines as <br> in HTML footer', async () => {
+      const service = new EmailTemplateService();
+      await service.setEmailFooter({
+        html: 'Zeile 1\nZeile 2',
+        text: 'Zeile 1\nZeile 2',
+      });
+
+      const result = await service.renderEmail('poll_created', {
+        pollType: 'Umfrage',
+        pollTitle: 'Newline-Test',
+        publicLink: 'https://example.com/poll/test',
+        adminLink: 'https://example.com/admin/test',
+      });
+
+      expect(result.html).toContain('Zeile 1<br>Zeile 2');
     });
   });
 });
diff --git a/server/tests/services/icsService.test.ts b/server/tests/services/icsService.test.ts
index e15435ce..17955f69 100644
--- a/server/tests/services/icsService.test.ts
+++ b/server/tests/services/icsService.test.ts
@@ -1,14 +1,18 @@
 import { describe, it, expect } from 'vitest';
-import { generatePollIcs, generateUserCalendarFeed, getDefaultCalendarSettings } from '../../services/icsService';
+import { generatePollIcs, generateUserCalendarFeed, generateSingleEventIcs, getDefaultCalendarSettings } from '../../services/icsService';
 import type { Poll, PollOption, Vote, CalendarSettings } from '../../../shared/schema';
 
 export const testMeta = {
   category: 'services' as const,
   name: 'ICS-Kalender-Service',
-  description: 'Prüft Kalender-Export mit Finalisierung und Status-Präfixen',
+  description: 'Prüft Kalender-Export mit Finalisierung, Status-Suffixen und korrektem ICS-Status',
   severity: 'high' as const,
 };
 
+function unfoldIcs(ics: string): string {
+  return ics.replace(/\r\n[ \t]/g, '');
+}
+
 function createMockPoll(overrides: Partial<Poll> = {}): Poll {
   return {
     id: 'test-poll-id',
@@ -86,12 +90,11 @@ describe('ICS Service', () => {
 
       const ics = generatePollIcs(poll, options, votes, 'https://test.com');
 
-      // Count VEVENT occurrences
       const eventCount = (ics.match(/BEGIN:VEVENT/g) || []).length;
       expect(eventCount).toBe(3);
     });
 
-    it('should export only final option when poll is finalized', () => {
+    it('should emit CONFIRMED final + CANCELLED cleanup events with SEQUENCE:1 when finalized', () => {
       const poll = createMockPoll({ finalOptionId: 2 });
       const options = [
         createMockOption(1, 'Option 1'),
@@ -102,17 +105,17 @@ describe('ICS Service', () => {
 
       const ics = generatePollIcs(poll, options, votes, 'https://test.com');
 
-      // Should only have 1 event
       const eventCount = (ics.match(/BEGIN:VEVENT/g) || []).length;
-      expect(eventCount).toBe(1);
-      
-      // Should contain the finalized option
-      expect(ics).toContain('Option 2');
-      expect(ics).not.toContain('Option 1');
-      expect(ics).not.toContain('Option 3');
+      expect(eventCount).toBe(3);
+
+      expect(ics).toContain('STATUS:CONFIRMED');
+      const cancelledCount = (ics.match(/STATUS:CANCELLED/g) || []).length;
+      expect(cancelledCount).toBe(2);
+      const sequenceCount = (ics.match(/SEQUENCE:1/g) || []).length;
+      expect(sequenceCount).toBe(3);
     });
 
-    it('should use Bestätigt prefix for finalized polls', () => {
+    it('should use suffix format (Bestätigt) for finalized polls', () => {
       const poll = createMockPoll({ finalOptionId: 1 });
       const options = [createMockOption(1, 'Option 1')];
       const votes: Vote[] = [];
@@ -122,11 +125,12 @@ describe('ICS Service', () => {
 
       const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
 
-      expect(ics).toContain('Bestätigt:');
-      expect(ics).not.toContain('Vorläufig:');
+      expect(ics).toContain('(Bestätigt)');
+      expect(ics).not.toContain('Bestätigt:');
+      expect(ics).not.toContain('(Vorläufig)');
     });
 
-    it('should use Vorläufig prefix for non-finalized polls', () => {
+    it('should use suffix format (Vorläufig) for non-finalized polls', () => {
       const poll = createMockPoll({ finalOptionId: null, isActive: true });
       const options = [createMockOption(1, 'Option 1')];
       const votes: Vote[] = [];
@@ -136,11 +140,42 @@ describe('ICS Service', () => {
 
       const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
 
-      expect(ics).toContain('Vorläufig:');
-      expect(ics).not.toContain('Bestätigt:');
+      expect(ics).toContain('(Vorläufig)');
+      expect(ics).not.toContain('Vorläufig:');
+      expect(ics).not.toContain('(Bestätigt)');
+    });
+
+    it('should use suffix format (Vorläufig) for expired but unfinalized polls', () => {
+      const expiredDate = new Date();
+      expiredDate.setDate(expiredDate.getDate() - 7);
+      const poll = createMockPoll({ finalOptionId: null, isActive: true, expiresAt: expiredDate });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes: Vote[] = [];
+      
+      const settings = getDefaultCalendarSettings();
+      const context = { settings, language: 'de' as const };
+
+      const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
+
+      expect(ics).toContain('(Vorläufig)');
+      expect(ics).not.toContain('(Bestätigt)');
+    });
+
+    it('should use suffix format (Vorläufig) for inactive but unfinalized polls', () => {
+      const poll = createMockPoll({ finalOptionId: null, isActive: false });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes: Vote[] = [];
+      
+      const settings = getDefaultCalendarSettings();
+      const context = { settings, language: 'de' as const };
+
+      const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
+
+      expect(ics).toContain('(Vorläufig)');
+      expect(ics).not.toContain('(Bestätigt)');
     });
 
-    it('should use English prefixes when language is en', () => {
+    it('should use English suffix labels when language is en', () => {
       const poll = createMockPoll({ finalOptionId: 1 });
       const options = [createMockOption(1, 'Option 1')];
       const votes: Vote[] = [];
@@ -156,12 +191,80 @@ describe('ICS Service', () => {
 
       const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
 
-      expect(ics).toContain('Confirmed:');
+      expect(ics).toContain('(Confirmed)');
+      expect(ics).not.toContain('Confirmed:');
+    });
+
+    it('should place title before suffix: "Title (Label)"', () => {
+      const poll = createMockPoll({ finalOptionId: null });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes: Vote[] = [];
+      
+      const settings = getDefaultCalendarSettings();
+      const context = { settings, language: 'de' as const };
+
+      const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
+
+      expect(ics).toMatch(/Test Poll.*\(Vorläufig\)/);
+    });
+
+    it('should keep ★ marker as prefix before title', () => {
+      const poll = createMockPoll({ finalOptionId: null });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes = [createMockVote(1, 'yes')];
+      
+      const settings: CalendarSettings = {
+        ...getDefaultCalendarSettings(),
+        markOwnChoices: true,
+      };
+      const context = { settings, language: 'de' as const, voterEmail: 'voter@test.com' };
+
+      const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
+
+      expect(ics).toMatch(/\[Meine Wahl\].*Test Poll.*\(Vorläufig\)/);
+    });
+
+    it('should include labeled "Abstimmung:" link in description for non-finalized options', () => {
+      const poll = createMockPoll({ finalOptionId: null });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes: Vote[] = [];
+
+      const ics = unfoldIcs(generatePollIcs(poll, options, votes, 'https://test.com'));
+
+      expect(ics).toContain('Abstimmung: https://test.com/poll/public-token');
+    });
+
+    it('should not include voting link in description for finalized option', () => {
+      const poll = createMockPoll({ finalOptionId: 1 });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes: Vote[] = [];
+
+      const ics = unfoldIcs(generatePollIcs(poll, options, votes, 'https://test.com'));
+
+      expect(ics).not.toContain('Abstimmung:');
+    });
+
+    it('should not have raw URL without label in description', () => {
+      const poll = createMockPoll({ finalOptionId: null });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes: Vote[] = [];
+
+      const ics = unfoldIcs(generatePollIcs(poll, options, votes, 'https://test.com'));
+
+      const descMatch = ics.match(/DESCRIPTION:(.*?)(?=\r\n[A-Z])/s);
+      if (descMatch) {
+        const lines = descMatch[1].split('\\n');
+        for (const line of lines) {
+          if (line.includes('https://test.com')) {
+            expect(line).toMatch(/^(Abstimmung|Vote): /);
+          }
+        }
+      }
     });
   });
 
   describe('generateUserCalendarFeed - finalization filtering', () => {
-    it('should only show final option for finalized polls in user feed', () => {
+    it('should emit CONFIRMED final + CANCELLED cleanup events in user feed', () => {
       const poll = createMockPoll({ finalOptionId: 2 });
       const options = [
         createMockOption(1, 'Option 1'),
@@ -177,12 +280,44 @@ describe('ICS Service', () => {
       const participations = [{ poll, options, votes }];
       const ics = generateUserCalendarFeed(participations, 'Test User', 'https://test.com');
 
-      // Should only have 1 event (the finalized option)
       const eventCount = (ics.match(/BEGIN:VEVENT/g) || []).length;
-      expect(eventCount).toBe(1);
-      
-      // Should contain the finalized option even if user didn't vote for it
+      expect(eventCount).toBe(4);
+
+      expect(ics).toContain('STATUS:CONFIRMED');
+      const cancelledCount = (ics.match(/STATUS:CANCELLED/g) || []).length;
+      expect(cancelledCount).toBe(3);
+
       expect(ics).toContain('Option 2');
+
+      const sequenceCount = (ics.match(/SEQUENCE:1/g) || []).length;
+      expect(sequenceCount).toBe(4);
+    });
+
+    it('should set STATUS:CONFIRMED + CANCELLED cleanup for finalized poll in user feed', () => {
+      const poll = createMockPoll({ finalOptionId: 2 });
+      const options = [
+        createMockOption(1, 'Option 1'),
+        createMockOption(2, 'Option 2'),
+      ];
+      const votes = [createMockVote(1, 'yes'), createMockVote(2, 'yes')];
+
+      const participations = [{ poll, options, votes }];
+      const ics = generateUserCalendarFeed(participations, 'Test User', 'https://test.com');
+
+      expect(ics).toContain('STATUS:CONFIRMED');
+      expect(ics).toContain('STATUS:CANCELLED');
+    });
+
+    it('should set STATUS:TENTATIVE for non-finalized poll in user feed', () => {
+      const poll = createMockPoll({ finalOptionId: null });
+      const options = [createMockOption(1, 'Option 1')];
+      const votes = [createMockVote(1, 'yes')];
+
+      const participations = [{ poll, options, votes }];
+      const ics = generateUserCalendarFeed(participations, 'Test User', 'https://test.com');
+
+      expect(ics).toContain('STATUS:TENTATIVE');
+      expect(ics).not.toContain('STATUS:CONFIRMED');
     });
 
     it('should show user votes when poll is not finalized', () => {
@@ -200,7 +335,6 @@ describe('ICS Service', () => {
       const participations = [{ poll, options, votes }];
       const ics = generateUserCalendarFeed(participations, 'Test User', 'https://test.com');
 
-      // Should have 2 events (user's yes votes)
       const eventCount = (ics.match(/BEGIN:VEVENT/g) || []).length;
       expect(eventCount).toBe(2);
     });
@@ -223,12 +357,11 @@ describe('ICS Service', () => {
 
       const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
 
-      // Should have no events when exportScope is final_only but no final option
       const eventCount = (ics.match(/BEGIN:VEVENT/g) || []).length;
       expect(eventCount).toBe(0);
     });
 
-    it('should export final option even with final_only scope', () => {
+    it('should export final + CANCELLED cleanup with final_only scope', () => {
       const poll = createMockPoll({ finalOptionId: 1 });
       const options = [
         createMockOption(1, 'Option 1'),
@@ -244,9 +377,48 @@ describe('ICS Service', () => {
 
       const ics = generatePollIcs(poll, options, votes, 'https://test.com', context);
 
-      // Should have 1 event (the final option)
       const eventCount = (ics.match(/BEGIN:VEVENT/g) || []).length;
-      expect(eventCount).toBe(1);
+      expect(eventCount).toBe(2);
+      expect(ics).toContain('STATUS:CONFIRMED');
+      expect(ics).toContain('STATUS:CANCELLED');
+    });
+  });
+
+  describe('generateSingleEventIcs', () => {
+    it('should set STATUS:CONFIRMED and suffix (Bestätigt) when isFinalized is true', () => {
+      const poll = createMockPoll({ finalOptionId: 1 });
+      const option = createMockOption(1, 'Option 1');
+      
+      const settings = getDefaultCalendarSettings();
+      const context = { settings, language: 'de' as const };
+
+      const ics = generateSingleEventIcs(poll, option, 'https://test.com', context, true);
+
+      expect(ics).toContain('STATUS:CONFIRMED');
+      expect(ics).toContain('(Bestätigt)');
+      expect(ics).not.toContain('Bestätigt:');
+    });
+
+    it('should not set STATUS when isFinalized is not provided', () => {
+      const poll = createMockPoll({ finalOptionId: null });
+      const option = createMockOption(1, 'Option 1');
+
+      const ics = generateSingleEventIcs(poll, option, 'https://test.com');
+
+      expect(ics).not.toContain('STATUS:CONFIRMED');
+    });
+
+    it('should use suffix (Vorläufig) when isFinalized is false', () => {
+      const poll = createMockPoll({ finalOptionId: null });
+      const option = createMockOption(1, 'Option 1');
+      
+      const settings = getDefaultCalendarSettings();
+      const context = { settings, language: 'de' as const };
+
+      const ics = generateSingleEventIcs(poll, option, 'https://test.com', context, false);
+
+      expect(ics).toContain('(Vorläufig)');
+      expect(ics).not.toContain('STATUS:CONFIRMED');
     });
   });
 });
diff --git a/server/tests/services/imageService.test.ts b/server/tests/services/imageService.test.ts
new file mode 100644
index 00000000..e53177f4
--- /dev/null
+++ b/server/tests/services/imageService.test.ts
@@ -0,0 +1,261 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { ImageService, validateImageMagicBytes } from '../../services/imageService';
+
+describe('ImageService', () => {
+  let imageService: ImageService;
+
+  beforeAll(() => {
+    imageService = new ImageService();
+  });
+
+  describe('getUploadMiddleware fileFilter', () => {
+    function getFileFilter() {
+      const middleware = imageService.getUploadMiddleware();
+      const multerInstance = middleware as any;
+      return multerInstance.fileFilter;
+    }
+
+    function testFileFilter(mimetype: string, originalname: string): Promise<boolean> {
+      const fileFilter = getFileFilter();
+      return new Promise((resolve, reject) => {
+        const fakeReq = {} as any;
+        const fakeFile = { mimetype, originalname } as any;
+        fileFilter(fakeReq, fakeFile, (err: Error | null, accepted?: boolean) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve(!!accepted);
+          }
+        });
+      });
+    }
+
+    it('should accept PNG files', async () => {
+      const result = await testFileFilter('image/png', 'logo.png');
+      expect(result).toBe(true);
+    });
+
+    it('should accept JPEG files', async () => {
+      const result = await testFileFilter('image/jpeg', 'logo.jpg');
+      expect(result).toBe(true);
+    });
+
+    it('should accept SVG files', async () => {
+      const result = await testFileFilter('image/svg+xml', 'logo.svg');
+      expect(result).toBe(true);
+    });
+
+    it('should accept WebP files', async () => {
+      const result = await testFileFilter('image/webp', 'logo.webp');
+      expect(result).toBe(true);
+    });
+
+    it('should accept GIF files', async () => {
+      const result = await testFileFilter('image/gif', 'animation.gif');
+      expect(result).toBe(true);
+    });
+
+    it('should accept BMP files', async () => {
+      const result = await testFileFilter('image/bmp', 'logo.bmp');
+      expect(result).toBe(true);
+    });
+
+    it('should accept ICO files', async () => {
+      const result = await testFileFilter('image/x-icon', 'favicon.ico');
+      expect(result).toBe(true);
+    });
+
+    it('should accept AVIF files', async () => {
+      const result = await testFileFilter('image/avif', 'photo.avif');
+      expect(result).toBe(true);
+    });
+
+    it('should reject PDF files', async () => {
+      await expect(testFileFilter('application/pdf', 'document.pdf')).rejects.toThrow('Nur Bilddateien sind erlaubt');
+    });
+
+    it('should reject text files', async () => {
+      await expect(testFileFilter('text/plain', 'readme.txt')).rejects.toThrow('Nur Bilddateien sind erlaubt');
+    });
+
+    it('should reject JavaScript files', async () => {
+      await expect(testFileFilter('application/javascript', 'script.js')).rejects.toThrow('Nur Bilddateien sind erlaubt');
+    });
+
+    it('should reject HTML files', async () => {
+      await expect(testFileFilter('text/html', 'page.html')).rejects.toThrow('Nur Bilddateien sind erlaubt');
+    });
+
+    it('should reject ZIP files', async () => {
+      await expect(testFileFilter('application/zip', 'archive.zip')).rejects.toThrow('Nur Bilddateien sind erlaubt');
+    });
+
+    it('should reject executables', async () => {
+      await expect(testFileFilter('application/octet-stream', 'program.exe')).rejects.toThrow('Nur Bilddateien sind erlaubt');
+    });
+  });
+
+  describe('getUploadMiddleware limits', () => {
+    it('should have a 5MB file size limit', () => {
+      const middleware = imageService.getUploadMiddleware();
+      const multerInstance = middleware as any;
+      expect(multerInstance.limits?.fileSize).toBe(5 * 1024 * 1024);
+    });
+  });
+
+  describe('getImageUrl', () => {
+    it('should return correct URL path', () => {
+      const url = imageService.getImageUrl('test-image-123.png');
+      expect(url).toBe('/uploads/test-image-123.png');
+    });
+  });
+
+  describe('validateImageMagicBytes — real content check (pentest hardening)', () => {
+    it('should accept a valid JPEG buffer', () => {
+      const jpegHeader = Buffer.from([0xFF, 0xD8, 0xFF, 0xE0, 0x00, 0x10, 0x4A, 0x46, 0x49, 0x46, 0x00, 0x01]);
+      expect(validateImageMagicBytes(jpegHeader)).toBe(true);
+    });
+
+    it('should accept a valid PNG buffer', () => {
+      const pngHeader = Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D]);
+      expect(validateImageMagicBytes(pngHeader)).toBe(true);
+    });
+
+    it('should accept a valid GIF buffer', () => {
+      const gifHeader = Buffer.from([0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00]);
+      expect(validateImageMagicBytes(gifHeader)).toBe(true);
+    });
+
+    it('should accept a valid WebP buffer', () => {
+      const webpHeader = Buffer.from([
+        0x52, 0x49, 0x46, 0x46,
+        0x24, 0x00, 0x00, 0x00,
+        0x57, 0x45, 0x42, 0x50,
+      ]);
+      expect(validateImageMagicBytes(webpHeader)).toBe(true);
+    });
+
+    it('should accept a valid BMP buffer', () => {
+      const bmpHeader = Buffer.from([0x42, 0x4D, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x36, 0x00]);
+      expect(validateImageMagicBytes(bmpHeader)).toBe(true);
+    });
+
+    it('should accept a valid ICO buffer', () => {
+      const icoHeader = Buffer.from([0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x10, 0x10, 0x00, 0x00, 0x01, 0x00]);
+      expect(validateImageMagicBytes(icoHeader)).toBe(true);
+    });
+
+    it('should accept inline SVG content', () => {
+      const svgContent = Buffer.from('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><rect/></svg>');
+      expect(validateImageMagicBytes(svgContent)).toBe(true);
+    });
+
+    it('should reject PHP script disguised as image/jpeg (MIME spoofing attack)', () => {
+      const phpScript = Buffer.from('<?php system($_GET["cmd"]); ?>\x00\x00\x00\x00\x00\x00\x00\x00\x00');
+      expect(validateImageMagicBytes(phpScript)).toBe(false);
+    });
+
+    it('should reject a plain text file disguised as image/png', () => {
+      const textContent = Buffer.from('This is just plain text content, not an image at all.');
+      expect(validateImageMagicBytes(textContent)).toBe(false);
+    });
+
+    it('should reject an HTML file disguised as image', () => {
+      const htmlContent = Buffer.from('<html><body><script>alert(1)</script></body></html>');
+      expect(validateImageMagicBytes(htmlContent)).toBe(false);
+    });
+
+    it('should reject a ZIP/JAR file disguised as image', () => {
+      const zipHeader = Buffer.from([0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00]);
+      expect(validateImageMagicBytes(zipHeader)).toBe(false);
+    });
+
+    it('should reject a PE executable disguised as image', () => {
+      const exeHeader = Buffer.from([0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00]);
+      expect(validateImageMagicBytes(exeHeader)).toBe(false);
+    });
+
+    it('should reject an ELF binary disguised as image', () => {
+      const elfHeader = Buffer.from([0x7F, 0x45, 0x4C, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00]);
+      expect(validateImageMagicBytes(elfHeader)).toBe(false);
+    });
+
+    it('should reject a buffer that is too short', () => {
+      const shortBuffer = Buffer.from([0xFF, 0xD8]);
+      expect(validateImageMagicBytes(shortBuffer)).toBe(false);
+    });
+
+    it('should reject an empty buffer', () => {
+      expect(validateImageMagicBytes(Buffer.alloc(0))).toBe(false);
+    });
+
+    it('should reject a null-byte buffer', () => {
+      const nullBuffer = Buffer.alloc(20, 0x00);
+      expect(validateImageMagicBytes(nullBuffer)).toBe(false);
+    });
+  });
+
+  describe('processUpload — invalidFileType flag (regression guard)', () => {
+    // These tests exist because the MIME-filter in multer only checks the
+    // Content-Type header, which can be spoofed. processUpload runs a second
+    // layer of defence (magic-byte validation). When that check fails the
+    // result MUST carry invalidFileType=true so HTTP routes return 400 instead
+    // of the generic 500 fallback — a difference that was previously untested
+    // and caused CI failures in hardening.test.ts T011.
+
+    function makeMockFile(buf: Buffer, mimetype = 'image/jpeg', name = 'upload.jpg') {
+      return {
+        originalname: name,
+        buffer: buf,
+        size: buf.length,
+        mimetype,
+        fieldname: 'image',
+        encoding: '7bit',
+        stream: null as any,
+        destination: '',
+        filename: '',
+        path: '',
+      };
+    }
+
+    it('should return invalidFileType=true when content is a PHP script disguised as JPEG', async () => {
+      const phpPayload = Buffer.from('<?php system($_GET["cmd"]); ?>\x00\x00\x00\x00\x00');
+      const result = await imageService.processUpload(makeMockFile(phpPayload) as any);
+      expect(result.success).toBe(false);
+      expect(result.invalidFileType).toBe(true);
+      expect(result.error).toBeDefined();
+      expect(result.error).not.toMatch(/php|system|exec|TypeError|multer|stack/i);
+    });
+
+    it('should return invalidFileType=true for a ZIP archive disguised as PNG', async () => {
+      const zipHeader = Buffer.from([
+        0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00,
+        0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      ]);
+      const result = await imageService.processUpload(makeMockFile(zipHeader, 'image/png', 'archive.png') as any);
+      expect(result.success).toBe(false);
+      expect(result.invalidFileType).toBe(true);
+    });
+
+    it('should return invalidFileType=true for a PE executable disguised as image', async () => {
+      const exeHeader = Buffer.from([
+        0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00,
+        0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00,
+      ]);
+      const result = await imageService.processUpload(makeMockFile(exeHeader, 'image/jpeg', 'payload.jpg') as any);
+      expect(result.success).toBe(false);
+      expect(result.invalidFileType).toBe(true);
+    });
+
+    it('should NOT set invalidFileType for a file with valid JPEG magic bytes', async () => {
+      const validJpeg = Buffer.from([
+        0xFF, 0xD8, 0xFF, 0xE0, 0x00, 0x10, 0x4A, 0x46,
+        0x49, 0x46, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
+      ]);
+      const result = await imageService.processUpload(makeMockFile(validJpeg) as any);
+      // The file has valid magic bytes — regardless of ClamAV state,
+      // invalidFileType must be absent/falsy.
+      expect(result.invalidFileType).toBeFalsy();
+    });
+  });
+});
diff --git a/server/tests/services/liveVotingService.test.ts b/server/tests/services/liveVotingService.test.ts
new file mode 100644
index 00000000..8d2fd232
--- /dev/null
+++ b/server/tests/services/liveVotingService.test.ts
@@ -0,0 +1,807 @@
+import { describe, it, expect, beforeAll, afterAll, afterEach } from 'vitest';
+import { WebSocket } from 'ws';
+import request from 'supertest';
+import { createTestApp, getTestServer } from '../testApp';
+import { liveVotingService } from '../../services/liveVotingService';
+import type { Express } from 'express';
+import type { Server } from 'http';
+import { ADMIN_USERNAME, ADMIN_PASSWORD } from '../testCredentials';
+
+let app: Express;
+let agent: ReturnType<typeof request.agent>;
+let server: Server;
+let wsBaseUrl: string;
+
+async function loginAsAdmin(ag: ReturnType<typeof request.agent>) {
+  await ag
+    .post('/api/v1/auth/login')
+    .send({ usernameOrEmail: ADMIN_USERNAME, password: ADMIN_PASSWORD });
+}
+
+function connectWs(url: string): Promise<WebSocket> {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(url);
+    ws.on('open', () => resolve(ws));
+    ws.on('error', reject);
+    setTimeout(() => reject(new Error('WS connection timeout')), 5000);
+  });
+}
+
+function waitForMessage(ws: WebSocket, timeout = 3000): Promise<any> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('WS message timeout')), timeout);
+    ws.once('message', (data) => {
+      clearTimeout(timer);
+      resolve(JSON.parse(data.toString()));
+    });
+  });
+}
+
+function collectMessages(ws: WebSocket, count: number, timeout = 3000): Promise<any[]> {
+  return new Promise((resolve, reject) => {
+    const messages: any[] = [];
+    const timer = setTimeout(() => resolve(messages), timeout);
+    const handler = (data: Buffer) => {
+      messages.push(JSON.parse(data.toString()));
+      if (messages.length >= count) {
+        clearTimeout(timer);
+        ws.off('message', handler);
+        resolve(messages);
+      }
+    };
+    ws.on('message', handler);
+  });
+}
+
+function sendAndWait(ws: WebSocket, msg: any, timeout = 3000): Promise<any> {
+  const promise = waitForMessage(ws, timeout);
+  ws.send(JSON.stringify(msg));
+  return promise;
+}
+
+function safeClose(ws: WebSocket) {
+  if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
+    ws.close();
+  }
+}
+
+describe('LiveVotingService - Multi-User Live Session Tests', () => {
+  let schedulePollPublicToken: string;
+  let schedulePollAdminToken: string;
+  let schedulePollOptions: any[];
+  let surveyPollPublicToken: string;
+  let surveyPollAdminToken: string;
+  let surveyPollOptions: any[];
+  let orgaPollPublicToken: string;
+  let orgaPollAdminToken: string;
+  let orgaPollOptions: any[];
+
+  const openConnections: WebSocket[] = [];
+
+  function trackWs(ws: WebSocket): WebSocket {
+    openConnections.push(ws);
+    return ws;
+  }
+
+  beforeAll(async () => {
+    app = await createTestApp();
+    agent = request.agent(app);
+    await loginAsAdmin(agent);
+
+    const scheduleRes = await agent.post('/api/v1/polls').send({
+      title: 'Live Session Schedule Test',
+      type: 'schedule',
+      options: [
+        { text: 'Monday 10:00' },
+        { text: 'Tuesday 14:00' },
+        { text: 'Wednesday 09:00' },
+      ],
+    });
+    schedulePollPublicToken = scheduleRes.body.publicToken;
+    schedulePollAdminToken = scheduleRes.body.adminToken;
+    const scheduleDetail = await agent.get(`/api/v1/polls/admin/${schedulePollAdminToken}`);
+    schedulePollOptions = scheduleDetail.body.options;
+
+    const surveyRes = await agent.post('/api/v1/polls').send({
+      title: 'Live Session Survey Test',
+      type: 'survey',
+      options: [
+        { text: 'Option Alpha' },
+        { text: 'Option Beta' },
+        { text: 'Option Gamma' },
+      ],
+    });
+    surveyPollPublicToken = surveyRes.body.publicToken;
+    surveyPollAdminToken = surveyRes.body.adminToken;
+    const surveyDetail = await agent.get(`/api/v1/polls/admin/${surveyPollAdminToken}`);
+    surveyPollOptions = surveyDetail.body.options;
+
+    const orgaRes = await agent.post('/api/v1/polls').send({
+      title: 'Live Session Orga Test',
+      type: 'organization',
+      options: [
+        { text: 'Bring cake', maxCapacity: 2 },
+        { text: 'Bring drinks', maxCapacity: 3 },
+      ],
+    });
+    orgaPollPublicToken = orgaRes.body.publicToken;
+    orgaPollAdminToken = orgaRes.body.adminToken;
+    const orgaDetail = await agent.get(`/api/v1/polls/admin/${orgaPollAdminToken}`);
+    orgaPollOptions = orgaDetail.body.options;
+
+    server = getTestServer()!;
+    liveVotingService.cleanup();
+    liveVotingService.initializeWithUpgrade(server);
+    await new Promise<void>((resolve) => {
+      if (server.listening) resolve();
+      else server.listen(0, resolve);
+    });
+    const address = server.address() as { port: number };
+    wsBaseUrl = `ws://localhost:${address.port}/ws/live-voting`;
+  });
+
+  afterEach(() => {
+    openConnections.forEach(ws => safeClose(ws));
+    openConnections.length = 0;
+  });
+
+  afterAll(() => {
+    openConnections.forEach(ws => safeClose(ws));
+    liveVotingService.cleanup();
+  });
+
+  describe('Multi-user presence tracking', () => {
+    it('should track multiple voters joining the same poll', async () => {
+      const ws1 = trackWs(await connectWs(wsBaseUrl));
+      const ws2 = trackWs(await connectWs(wsBaseUrl));
+      const ws3 = trackWs(await connectWs(wsBaseUrl));
+
+      const msgs1initial = collectMessages(ws1, 2, 2000);
+      ws1.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'multi-user-1',
+        voterName: 'Alice',
+      }));
+      const msgs1a = await msgs1initial;
+      const joinOrPresence1 = msgs1a.find((m: any) => m.activeVoters?.length === 1);
+      expect(joinOrPresence1).toBeDefined();
+      expect(joinOrPresence1.activeVoters[0].name).toBe('Alice');
+
+      const collectOn1 = collectMessages(ws1, 1, 2000);
+      const msgs2initial = collectMessages(ws2, 2, 2000);
+      ws2.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'multi-user-2',
+        voterName: 'Bob',
+      }));
+      const msgs2a = await msgs2initial;
+      const msg2with2voters = msgs2a.find((m: any) => m.activeVoters?.length === 2);
+      expect(msg2with2voters).toBeDefined();
+      expect(msg2with2voters.viewerCount).toBe(2);
+
+      const msgs1fromBob = await collectOn1;
+      expect(msgs1fromBob.some((m: any) => m.activeVoters?.length === 2)).toBe(true);
+
+      const collectOn1b = collectMessages(ws1, 1, 2000);
+      const collectOn2b = collectMessages(ws2, 1, 2000);
+      const msgs3initial = collectMessages(ws3, 2, 2000);
+      ws3.send(JSON.stringify({
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'multi-user-3',
+        voterName: 'Charlie',
+      }));
+      const msgs3a = await msgs3initial;
+      const msg3with3voters = msgs3a.find((m: any) => m.activeVoters?.length === 3);
+      expect(msg3with3voters).toBeDefined();
+      expect(msg3with3voters.viewerCount).toBe(3);
+
+      const msgs1b = await collectOn1b;
+      const msgs2b = await collectOn2b;
+      expect(msgs1b.some((m: any) => m.activeVoters?.length === 3)).toBe(true);
+      expect(msgs2b.some((m: any) => m.activeVoters?.length === 3)).toBe(true);
+    });
+
+    it('should update presence when a voter disconnects', async () => {
+      const ws1 = trackWs(await connectWs(wsBaseUrl));
+      const ws2 = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(ws1, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'disc-1',
+        voterName: 'Stay',
+      });
+
+      await sendAndWait(ws2, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'disc-2',
+        voterName: 'Leave',
+      });
+
+      const collectOnStay = collectMessages(ws1, 1, 2000);
+      ws2.close();
+
+      const msgs = await collectOnStay;
+      const presenceUpdate = msgs.find((m: any) => m.type === 'presence_update');
+      expect(presenceUpdate).toBeDefined();
+      expect(presenceUpdate.activeVoters).toHaveLength(1);
+      expect(presenceUpdate.activeVoters[0].name).toBe('Stay');
+    });
+  });
+
+  describe('Live vote broadcasting (Schedule poll)', () => {
+    it('should broadcast in-progress votes from one voter to all others', async () => {
+      const wsVoter = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+      const wsViewer = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-broadcast',
+        adminToken: schedulePollAdminToken,
+      });
+
+      await sendAndWait(wsViewer, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'viewer-broadcast',
+        voterName: 'Viewer',
+      });
+
+      await sendAndWait(wsVoter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'voter-broadcast',
+        voterName: 'VotingUser',
+      });
+
+      const optionId = String(schedulePollOptions[0].id);
+
+      const presenterCollect = collectMessages(wsPresenter, 1);
+      const viewerCollect = collectMessages(wsViewer, 1);
+
+      wsVoter.send(JSON.stringify({
+        type: 'vote_in_progress',
+        optionId,
+        response: 'yes',
+      }));
+
+      const presenterMsgs = await presenterCollect;
+      const viewerMsgs = await viewerCollect;
+
+      const presLiveUpdate = presenterMsgs.find((m: any) => m.type === 'live_vote_update');
+      expect(presLiveUpdate).toBeDefined();
+      expect(presLiveUpdate.voterName).toBe('VotingUser');
+      expect(presLiveUpdate.optionId).toBe(optionId);
+      expect(presLiveUpdate.response).toBe('yes');
+
+      const viewLiveUpdate = viewerMsgs.find((m: any) => m.type === 'live_vote_update');
+      expect(viewLiveUpdate).toBeDefined();
+      expect(viewLiveUpdate.liveVotes).toBeDefined();
+      expect(viewLiveUpdate.liveVotes['voter-broadcast']).toBeDefined();
+      expect(viewLiveUpdate.liveVotes['voter-broadcast'].voterName).toBe('VotingUser');
+      expect(viewLiveUpdate.liveVotes['voter-broadcast'].votes[optionId]).toBe('yes');
+    });
+
+    it('should broadcast multiple vote changes from one voter', async () => {
+      const wsVoter = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-multi-vote',
+        adminToken: schedulePollAdminToken,
+      });
+
+      await sendAndWait(wsVoter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'voter-multi-vote',
+        voterName: 'MultiVoter',
+      });
+
+      const option1 = String(schedulePollOptions[0].id);
+      const option2 = String(schedulePollOptions[1].id);
+      const option3 = String(schedulePollOptions[2].id);
+
+      let collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId: option1, response: 'yes' }));
+      let msgs = await collect;
+      let update = msgs.find((m: any) => m.type === 'live_vote_update');
+      expect(update.liveVotes['voter-multi-vote'].votes[option1]).toBe('yes');
+
+      collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId: option2, response: 'no' }));
+      msgs = await collect;
+      update = msgs.find((m: any) => m.type === 'live_vote_update');
+      expect(update.liveVotes['voter-multi-vote'].votes[option1]).toBe('yes');
+      expect(update.liveVotes['voter-multi-vote'].votes[option2]).toBe('no');
+
+      collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId: option3, response: 'maybe' }));
+      msgs = await collect;
+      update = msgs.find((m: any) => m.type === 'live_vote_update');
+      expect(update.liveVotes['voter-multi-vote'].votes[option1]).toBe('yes');
+      expect(update.liveVotes['voter-multi-vote'].votes[option2]).toBe('no');
+      expect(update.liveVotes['voter-multi-vote'].votes[option3]).toBe('maybe');
+    });
+
+    it('should handle vote change (yes to no) correctly', async () => {
+      const wsVoter = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-change',
+        adminToken: schedulePollAdminToken,
+      });
+
+      await sendAndWait(wsVoter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'voter-change',
+        voterName: 'Changer',
+      });
+
+      const optionId = String(schedulePollOptions[0].id);
+
+      let collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId, response: 'yes' }));
+      let msgs = await collect;
+      expect(msgs.find((m: any) => m.type === 'live_vote_update').liveVotes['voter-change'].votes[optionId]).toBe('yes');
+
+      collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId, response: 'no' }));
+      msgs = await collect;
+      expect(msgs.find((m: any) => m.type === 'live_vote_update').liveVotes['voter-change'].votes[optionId]).toBe('no');
+    });
+
+    it('should handle vote removal (null response) correctly', async () => {
+      const wsVoter = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-remove',
+        adminToken: schedulePollAdminToken,
+      });
+
+      await sendAndWait(wsVoter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'voter-remove',
+        voterName: 'Remover',
+      });
+
+      const optionId = String(schedulePollOptions[0].id);
+
+      let collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId, response: 'yes' }));
+      await collect;
+
+      collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId, response: null }));
+      const msgs = await collect;
+      const update = msgs.find((m: any) => m.type === 'live_vote_update');
+      expect(update.liveVotes['voter-remove']).toBeUndefined();
+    });
+  });
+
+  describe('Multi-voter simultaneous voting', () => {
+    it('should correctly track votes from 3 simultaneous voters', async () => {
+      const wsA = trackWs(await connectWs(wsBaseUrl));
+      const wsB = trackWs(await connectWs(wsBaseUrl));
+      const wsC = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-simul',
+        adminToken: schedulePollAdminToken,
+      });
+
+      await sendAndWait(wsA, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'simul-a',
+        voterName: 'Alice',
+      });
+
+      await sendAndWait(wsB, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'simul-b',
+        voterName: 'Bob',
+      });
+
+      await sendAndWait(wsC, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'simul-c',
+        voterName: 'Charlie',
+      });
+
+      const option1 = String(schedulePollOptions[0].id);
+      const option2 = String(schedulePollOptions[1].id);
+
+      const presenterCollect = collectMessages(wsPresenter, 3, 3000);
+
+      wsA.send(JSON.stringify({ type: 'vote_in_progress', optionId: option1, response: 'yes' }));
+      wsB.send(JSON.stringify({ type: 'vote_in_progress', optionId: option1, response: 'no' }));
+      wsC.send(JSON.stringify({ type: 'vote_in_progress', optionId: option2, response: 'maybe' }));
+
+      const msgs = await presenterCollect;
+      expect(msgs.length).toBe(3);
+
+      const lastUpdate = msgs[msgs.length - 1];
+      expect(lastUpdate.type).toBe('live_vote_update');
+      expect(lastUpdate.liveVotes['simul-a'].votes[option1]).toBe('yes');
+      expect(lastUpdate.liveVotes['simul-b'].votes[option1]).toBe('no');
+      expect(lastUpdate.liveVotes['simul-c'].votes[option2]).toBe('maybe');
+    });
+  });
+
+  describe('Vote finalization', () => {
+    it('should remove voter from live list after vote_submitted and notify all', async () => {
+      const wsVoter = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-final',
+        adminToken: schedulePollAdminToken,
+      });
+
+      await sendAndWait(wsVoter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'voter-final',
+        voterName: 'Finalizer',
+      });
+
+      let collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({
+        type: 'vote_in_progress',
+        optionId: String(schedulePollOptions[0].id),
+        response: 'yes',
+      }));
+      await collect;
+
+      collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({
+        type: 'vote_submitted',
+        voterName: 'Finalizer',
+      }));
+      const msgs = await collect;
+
+      const finalized = msgs.find((m: any) => m.type === 'vote_finalized');
+      expect(finalized).toBeDefined();
+      expect(finalized.voterName).toBe('Finalizer');
+      expect(finalized.liveVotes['voter-final']).toBeUndefined();
+      expect(finalized.activeVoters.find((v: any) => v.id === 'voter-final')).toBeUndefined();
+    });
+
+    it('should keep other voters active after one submits', async () => {
+      const wsA = trackWs(await connectWs(wsBaseUrl));
+      const wsB = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-partial-final',
+        adminToken: schedulePollAdminToken,
+      });
+
+      await sendAndWait(wsA, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'part-a',
+        voterName: 'Alice',
+      });
+
+      await sendAndWait(wsB, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'part-b',
+        voterName: 'Bob',
+      });
+
+      const option1 = String(schedulePollOptions[0].id);
+
+      let collect = collectMessages(wsPresenter, 2);
+      wsA.send(JSON.stringify({ type: 'vote_in_progress', optionId: option1, response: 'yes' }));
+      wsB.send(JSON.stringify({ type: 'vote_in_progress', optionId: option1, response: 'maybe' }));
+      await collect;
+
+      collect = collectMessages(wsPresenter, 1);
+      wsA.send(JSON.stringify({ type: 'vote_submitted', voterName: 'Alice' }));
+      const msgs = await collect;
+
+      const finalized = msgs.find((m: any) => m.type === 'vote_finalized');
+      expect(finalized).toBeDefined();
+      expect(finalized.liveVotes['part-a']).toBeUndefined();
+      expect(finalized.liveVotes['part-b']).toBeDefined();
+      expect(finalized.liveVotes['part-b'].votes[option1]).toBe('maybe');
+    });
+  });
+
+  describe('Presenter functionality', () => {
+    it('should not add presenter to activeVoters list', async () => {
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      const joined = await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'pres-no-voter',
+        adminToken: schedulePollAdminToken,
+      });
+
+      expect(['joined', 'presence_update']).toContain(joined.type);
+      expect(joined.activeVoters.find((v: any) => v.id === 'pres-no-voter')).toBeUndefined();
+    });
+
+    it('should allow start_presenting with valid adminToken', async () => {
+      const ws = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(ws, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'start-pres',
+        adminToken: schedulePollAdminToken,
+      });
+
+      ws.send(JSON.stringify({
+        type: 'start_presenting',
+        pollToken: schedulePollPublicToken,
+        adminToken: schedulePollAdminToken,
+      }));
+
+      await new Promise(r => setTimeout(r, 200));
+    });
+
+    it('should reject start_presenting without valid adminToken', async () => {
+      const ws = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(ws, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'bad-pres',
+        voterName: 'Hacker',
+      });
+
+      const collect = collectMessages(ws, 1, 2000);
+      ws.send(JSON.stringify({
+        type: 'start_presenting',
+        pollToken: schedulePollPublicToken,
+        adminToken: 'wrong-token',
+      }));
+
+      const msgs = await collect;
+      const errorMsg = msgs.find((m: any) => m.type === 'error');
+      expect(errorMsg).toBeDefined();
+      expect(errorMsg.code).toBe('FORBIDDEN');
+    });
+  });
+
+  describe('Name update', () => {
+    it('should update voter name and broadcast presence', async () => {
+      const wsVoter = trackWs(await connectWs(wsBaseUrl));
+      const wsOther = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsOther, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'name-other',
+        voterName: 'Observer',
+      });
+
+      await sendAndWait(wsVoter, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'name-changer',
+        voterName: 'OldName',
+      });
+
+      const collect = collectMessages(wsOther, 1, 2000);
+      wsVoter.send(JSON.stringify({
+        type: 'update_name',
+        voterName: 'NewName',
+      }));
+
+      const msgs = await collect;
+      const presence = msgs.find((m: any) => m.type === 'presence_update');
+      expect(presence).toBeDefined();
+      const updatedVoter = presence.activeVoters.find((v: any) => v.id === 'name-changer');
+      expect(updatedVoter).toBeDefined();
+      expect(updatedVoter.name).toBe('NewName');
+    });
+  });
+
+  describe('Ping/Pong keepalive', () => {
+    it('should respond to ping with pong', async () => {
+      const ws = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(ws, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'ping-test',
+        voterName: 'Pinger',
+      });
+
+      const pong = await sendAndWait(ws, { type: 'ping' });
+      expect(pong.type).toBe('pong');
+    });
+  });
+
+  describe('Cross-poll isolation', () => {
+    it('should not leak votes between different polls', async () => {
+      const wsPoll1 = trackWs(await connectWs(wsBaseUrl));
+      const wsPoll2 = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter2 = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPoll1, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'cross-sched',
+        voterName: 'ScheduleVoter',
+      });
+
+      await sendAndWait(wsPresenter2, {
+        type: 'join_poll',
+        pollToken: surveyPollPublicToken,
+        sessionId: 'cross-pres',
+        adminToken: surveyPollAdminToken,
+      });
+
+      await sendAndWait(wsPoll2, {
+        type: 'join_poll',
+        pollToken: surveyPollPublicToken,
+        sessionId: 'cross-surv',
+        voterName: 'SurveyVoter',
+      });
+
+      const presCollect = collectMessages(wsPresenter2, 1, 2000);
+
+      wsPoll1.send(JSON.stringify({
+        type: 'vote_in_progress',
+        optionId: String(schedulePollOptions[0].id),
+        response: 'yes',
+      }));
+
+      const surveyMsgs = await presCollect;
+      const leakedUpdate = surveyMsgs.find((m: any) =>
+        m.type === 'live_vote_update' && m.voterName === 'ScheduleVoter'
+      );
+      expect(leakedUpdate).toBeUndefined();
+    });
+  });
+
+  describe('Survey poll live voting', () => {
+    it('should track survey option selections live', async () => {
+      const wsVoter = trackWs(await connectWs(wsBaseUrl));
+      const wsPresenter = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(wsPresenter, {
+        type: 'join_poll',
+        pollToken: surveyPollPublicToken,
+        sessionId: 'surv-pres',
+        adminToken: surveyPollAdminToken,
+      });
+
+      await sendAndWait(wsVoter, {
+        type: 'join_poll',
+        pollToken: surveyPollPublicToken,
+        sessionId: 'surv-voter',
+        voterName: 'SurveyUser',
+      });
+
+      const optionId = String(surveyPollOptions[0].id);
+      const collect = collectMessages(wsPresenter, 1);
+      wsVoter.send(JSON.stringify({ type: 'vote_in_progress', optionId, response: 'yes' }));
+
+      const msgs = await collect;
+      const update = msgs.find((m: any) => m.type === 'live_vote_update');
+      expect(update).toBeDefined();
+      expect(update.liveVotes['surv-voter'].votes[optionId]).toBe('yes');
+    });
+  });
+
+  describe('Results refresh notification', () => {
+    it('should broadcast results_refresh to all viewers', async () => {
+      const ws1 = trackWs(await connectWs(wsBaseUrl));
+      const ws2 = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(ws1, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'refresh-1',
+        voterName: 'Refresher1',
+      });
+
+      await sendAndWait(ws2, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'refresh-2',
+        voterName: 'Refresher2',
+      });
+
+      const collect1 = collectMessages(ws1, 1, 2000);
+      const collect2 = collectMessages(ws2, 1, 2000);
+
+      liveVotingService.notifyResultsRefresh(schedulePollPublicToken);
+
+      const msgs1 = await collect1;
+      const msgs2 = await collect2;
+      expect(msgs1.some((m: any) => m.type === 'results_refresh')).toBe(true);
+      expect(msgs2.some((m: any) => m.type === 'results_refresh')).toBe(true);
+    });
+  });
+
+  describe('Slot update broadcast (Organization poll)', () => {
+    it('should broadcast slot_update to all viewers', async () => {
+      const ws1 = trackWs(await connectWs(wsBaseUrl));
+      const ws2 = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(ws1, {
+        type: 'join_poll',
+        pollToken: orgaPollPublicToken,
+        sessionId: 'orga-1',
+        voterName: 'OrgaUser1',
+      });
+
+      await sendAndWait(ws2, {
+        type: 'join_poll',
+        pollToken: orgaPollPublicToken,
+        sessionId: 'orga-2',
+        voterName: 'OrgaUser2',
+      });
+
+      const collect1 = collectMessages(ws1, 1, 2000);
+      const collect2 = collectMessages(ws2, 1, 2000);
+
+      const optId = orgaPollOptions[0].id;
+      liveVotingService.broadcastSlotUpdate(orgaPollPublicToken, {
+        [optId]: { currentCount: 1, maxCapacity: 2 },
+      });
+
+      const msgs1 = await collect1;
+      const msgs2 = await collect2;
+
+      const slotMsg1 = msgs1.find((m: any) => m.type === 'slot_update');
+      const slotMsg2 = msgs2.find((m: any) => m.type === 'slot_update');
+      expect(slotMsg1).toBeDefined();
+      expect(slotMsg2).toBeDefined();
+      expect(slotMsg1.slotUpdates[optId].currentCount).toBe(1);
+      expect(slotMsg1.slotUpdates[optId].maxCapacity).toBe(2);
+    });
+  });
+
+  describe('Service stats', () => {
+    it('should report correct stats', async () => {
+      const ws = trackWs(await connectWs(wsBaseUrl));
+
+      await sendAndWait(ws, {
+        type: 'join_poll',
+        pollToken: schedulePollPublicToken,
+        sessionId: 'stats-test',
+        voterName: 'StatsUser',
+      });
+
+      const stats = liveVotingService.getStats();
+      expect(stats.activeRooms).toBeGreaterThanOrEqual(1);
+      expect(stats.totalConnections).toBeGreaterThanOrEqual(1);
+      expect(stats.rooms.length).toBeGreaterThanOrEqual(1);
+    });
+  });
+});
diff --git a/server/tests/services/wcagAudit.test.ts b/server/tests/services/wcagAudit.test.ts
index 875967f1..69d50399 100644
--- a/server/tests/services/wcagAudit.test.ts
+++ b/server/tests/services/wcagAudit.test.ts
@@ -1,8 +1,9 @@
-import { describe, it, expect, beforeAll } from 'vitest';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import request from 'supertest';
 import { createTestApp } from '../testApp';
 import type { Express } from 'express';
 import { storage } from '../../storage';
+import { ADMIN_EMAIL, ADMIN_PASSWORD } from '../testCredentials';
 
 export const testMeta = {
   category: 'accessibility' as const,
@@ -31,20 +32,26 @@ const DARK_BG = '#0f172a';
 describe('WCAG Color Contrast Audit', () => {
   let app: Express;
   let adminAgent: any;
+  let origCustomization: any;
 
   beforeAll(async () => {
+    origCustomization = await storage.getCustomizationSettings();
     app = await createTestApp();
 
     adminAgent = request.agent(app);
     const loginRes = await adminAgent
       .post('/api/v1/auth/login')
-      .send({ email: 'admin@polly.local', password: 'Polly2024!' });
+      .send({ email: ADMIN_EMAIL, password: ADMIN_PASSWORD });
 
     if (loginRes.status !== 200) {
       console.warn('Admin login failed, some tests may fail:', loginRes.status);
     }
   });
 
+  afterAll(async () => {
+    await storage.setCustomizationSettings(origCustomization);
+  });
+
   describe('Per-mode audit (separate light/dark issues)', () => {
     it('should return separate issues for light and dark modes', async () => {
       await storage.setCustomizationSettings({
diff --git a/server/tests/setup.ts b/server/tests/setup.ts
index 490c1ecc..dc88b407 100644
--- a/server/tests/setup.ts
+++ b/server/tests/setup.ts
@@ -1,12 +1,20 @@
 import { beforeAll, afterAll, beforeEach, afterEach } from 'vitest';
+import { storage } from '../storage';
 
 beforeAll(async () => {
   process.env.NODE_ENV = 'test';
+  const snapshot = await storage.getCustomizationSettings();
+  (globalThis as any).__brandingSnapshot = JSON.parse(JSON.stringify(snapshot));
 });
 
 afterAll(async () => {
-  // Don't close the pool here - it's shared across all test files
-  // The pool is closed in globalTeardown.ts which runs once after ALL tests
+  const snapshot = (globalThis as any).__brandingSnapshot;
+  if (snapshot) {
+    try {
+      await storage.setCustomizationSettings(snapshot);
+    } catch {
+    }
+  }
 });
 
 beforeEach(async () => {
diff --git a/server/tests/testApp.ts b/server/tests/testApp.ts
index 7bb6adc0..346bfb39 100644
--- a/server/tests/testApp.ts
+++ b/server/tests/testApp.ts
@@ -54,6 +54,32 @@ export async function createTestApp(): Promise<Express> {
     }),
   }));
 
+  app.use((req, res, next) => {
+    if (req.path.startsWith('/api/')) {
+      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+      res.setHeader('Pragma', 'no-cache');
+      res.setHeader('Expires', '0');
+    }
+    next();
+  });
+
+  app.use(async (req, res, next) => {
+    if (!req.session?.userId) return next();
+    if (!req.path.startsWith('/api/')) return next();
+
+    const allowedPaths = ['/api/v1/auth/me', '/api/v1/auth/logout', '/api/v1/auth/change-password'];
+    if (allowedPaths.some(p => req.path === p)) return next();
+
+    try {
+      const { storage } = await import('../storage');
+      const user = await storage.getUser(req.session.userId);
+      if (user && (user as any).isInitialAdmin) {
+        return res.status(403).json({ error: 'Passwortänderung erforderlich', code: 'PASSWORD_CHANGE_REQUIRED' });
+      }
+    } catch {}
+    next();
+  });
+
   testServer = await registerRoutes(app);
 
   // Disable rate limiting for tests
@@ -84,16 +110,12 @@ export async function closeTestApp(): Promise<void> {
     testServer = null;
   }
   testApp = null;
-  
-  // Close database pool to prevent hanging
-  try {
-    const { pool } = await import('../db');
-    await pool.end();
-  } catch {
-    // Ignore errors if pool doesn't exist
-  }
 }
 
 export function getTestApp(): Express | null {
   return testApp;
 }
+
+export function getTestServer(): Server | null {
+  return testServer;
+}
diff --git a/server/tests/testCredentials.ts b/server/tests/testCredentials.ts
new file mode 100644
index 00000000..b6026b70
--- /dev/null
+++ b/server/tests/testCredentials.ts
@@ -0,0 +1,9 @@
+const DEFAULTS = {
+  username: "admin",
+  email: "admin@polly.local",
+  password: "Admin123!",
+};
+
+export const ADMIN_USERNAME = process.env.ADMIN_USERNAME || DEFAULTS.username;
+export const ADMIN_EMAIL = process.env.ADMIN_EMAIL || DEFAULTS.email;
+export const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || DEFAULTS.password;
diff --git a/server/tests/ui/i18n-hardcoded-strings.test.ts b/server/tests/ui/i18n-hardcoded-strings.test.ts
new file mode 100644
index 00000000..e8411bf9
--- /dev/null
+++ b/server/tests/ui/i18n-hardcoded-strings.test.ts
@@ -0,0 +1,372 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+
+const CLIENT_SRC = path.resolve(__dirname, '../../../client/src');
+const LOCALES_DIR = path.join(CLIENT_SRC, 'locales');
+
+function readJson(filePath: string) {
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`Locale file not found: ${filePath}. Ensure client/src/locales/ is available.`);
+  }
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function flattenKeys(obj: Record<string, unknown>, prefix = ''): string[] {
+  const keys: string[] = [];
+  for (const key of Object.keys(obj)) {
+    const fullKey = prefix ? `${prefix}.${key}` : key;
+    if (typeof obj[key] === 'object' && obj[key] !== null && !Array.isArray(obj[key])) {
+      keys.push(...flattenKeys(obj[key] as Record<string, unknown>, fullKey));
+    } else {
+      keys.push(fullKey);
+    }
+  }
+  return keys;
+}
+
+function findTsxFiles(dir: string): string[] {
+  const results: string[] = [];
+  if (!fs.existsSync(dir)) return results;
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === 'ui') continue;
+      results.push(...findTsxFiles(fullPath));
+    } else if (entry.name.endsWith('.tsx') || entry.name.endsWith('.ts')) {
+      if (entry.name.endsWith('.test.ts') || entry.name.endsWith('.test.tsx')) continue;
+      if (entry.name === 'i18n.ts' || entry.name === 'vite-env.d.ts') continue;
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+const HARDCODED_GERMAN_PATTERNS = [
+  />\s*Passwort\b/,
+  />\s*Benutzername\b/,
+  />\s*Anmelden\b/,
+  />\s*Abmelden\b/,
+  />\s*Erstellen\b/,
+  />\s*Löschen\b/,
+  />\s*Bearbeiten\b/,
+  />\s*Speichern\b/,
+  />\s*Einstellungen\b/,
+  />\s*Übersicht\b/,
+  />\s*Teilnehmer\b/,
+  />\s*Stimmen\b/,
+  />\s*Ergebnisse\b/,
+  />\s*Eintragungen\b/,
+  />\s*Abstimmung\b/,
+  />\s*Umfrage\b/,
+  />\s*Terminplanung\b/,
+  />\s*Organisation\b/,
+  />\s*Fehlgeschlagen\b/,
+  />\s*Punkte\b/,
+  />\s*Detaillierte\s/,
+  />\s*Gesamte?\b/,
+  />\s*Beliebteste\b/,
+  />\s*Bewertung\b/,
+  />\s*Aktuelles Passwort\b/,
+  />\s*Neues Passwort\b/,
+  />\s*Wird geändert\b/,
+  />\s*Passwort ändern\b/,
+  />\s*Noch keine\b/,
+  />\s*voll\b/,
+  />\s*Slots und\b/,
+  />\s*Fehler\b/,
+];
+
+const HARDCODED_GERMAN_JSX_PATTERNS = [
+  /["']\s*Ja\s*["']/,
+  /["']\s*Nein\s*["']/,
+  /["']\s*Vielleicht\s*["']/,
+  />\s*Ja\s*</,
+  />\s*Nein\s*</,
+  />\s*Vielleicht\s*</,
+  /["']Interner Fehler["']/,
+  /["']Fehler beim["']/,
+  /["']Passwörter stimmen["']/,
+  /["']Passwort muss["']/,
+];
+
+const ALLOWED_HARDCODED = [
+  /PROMPTS_DE/,
+  /PROMPTS_EN/,
+  /console\./,
+  /\/\//,
+  /\/\*/,
+  /\*\//,
+  /import /,
+  /data-testid/,
+  /className/,
+  /aria-label=\{t\(/,
+  /placeholder=\{t\(/,
+  /title=\{t\(/,
+];
+
+function isAllowedLine(line: string): boolean {
+  const trimmed = line.trim();
+  if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) return true;
+  if (trimmed.startsWith('import ')) return true;
+  if (trimmed.includes('console.')) return true;
+  if (trimmed.includes('PROMPTS_DE') || trimmed.includes('PROMPTS_EN')) return true;
+  return false;
+}
+
+describe('i18n Hardcoded Strings Prevention', () => {
+
+  describe('Translation file parity (de.json ↔ en.json)', () => {
+    const deJson = readJson(path.join(LOCALES_DIR, 'de.json'));
+    const enJson = readJson(path.join(LOCALES_DIR, 'en.json'));
+    const deKeys = new Set(flattenKeys(deJson));
+    const enKeys = new Set(flattenKeys(enJson));
+
+    it('should have valid JSON in both locale files', () => {
+      expect(deJson).toBeTruthy();
+      expect(enJson).toBeTruthy();
+    });
+
+    it('should have all English keys present in German translations', () => {
+      const missingInDe = [...enKeys].filter(k => !deKeys.has(k));
+      if (missingInDe.length > 0) {
+        throw new Error(
+          `${missingInDe.length} key(s) missing in de.json:\n  - ${missingInDe.slice(0, 20).join('\n  - ')}` +
+          (missingInDe.length > 20 ? `\n  ... and ${missingInDe.length - 20} more` : '')
+        );
+      }
+    });
+
+    it('should have all German keys present in English translations', () => {
+      const missingInEn = [...deKeys].filter(k => !enKeys.has(k));
+      if (missingInEn.length > 0) {
+        throw new Error(
+          `${missingInEn.length} key(s) missing in en.json:\n  - ${missingInEn.slice(0, 20).join('\n  - ')}` +
+          (missingInEn.length > 20 ? `\n  ... and ${missingInEn.length - 20} more` : '')
+        );
+      }
+    });
+
+    it('should not have empty translation values in de.json', () => {
+      const emptyKeys = flattenKeys(deJson).filter(key => {
+        const parts = key.split('.');
+        let val: unknown = deJson;
+        for (const p of parts) val = (val as Record<string, unknown>)[p];
+        return typeof val === 'string' && val.trim() === '';
+      });
+      if (emptyKeys.length > 0) {
+        throw new Error(`Empty values in de.json:\n  - ${emptyKeys.slice(0, 10).join('\n  - ')}`);
+      }
+    });
+
+    it('should not have empty translation values in en.json', () => {
+      const allowedEmpty = new Set([
+        'common.ui.timePicker.suffix',
+        'ui.timePicker.suffix',
+      ]);
+      const emptyKeys = flattenKeys(enJson).filter(key => {
+        if (allowedEmpty.has(key)) return false;
+        const parts = key.split('.');
+        let val: unknown = enJson;
+        for (const p of parts) val = (val as Record<string, unknown>)[p];
+        return typeof val === 'string' && val.trim() === '';
+      });
+      if (emptyKeys.length > 0) {
+        throw new Error(`Empty values in en.json:\n  - ${emptyKeys.slice(0, 10).join('\n  - ')}`);
+      }
+    });
+  });
+
+  describe('No hardcoded German UI text in components', () => {
+    const criticalFiles = [
+      'components/ai/AiChatWidget.tsx',
+      'components/ai/AiPollCreator.tsx',
+      'components/admin/settings/AiSettingsPanel.tsx',
+      'components/admin/settings/SessionTimeoutPanel.tsx',
+      'components/ResultsChart.tsx',
+      'components/SimpleImageVoting.tsx',
+      'App.tsx',
+    ];
+
+    for (const relFile of criticalFiles) {
+      const filePath = path.join(CLIENT_SRC, relFile);
+      if (!fs.existsSync(filePath)) continue;
+
+      it(`${relFile}: should not contain hardcoded German labels in JSX`, () => {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const lines = content.split('\n');
+        const violations: string[] = [];
+
+        lines.forEach((line, idx) => {
+          if (isAllowedLine(line)) return;
+
+          for (const pattern of HARDCODED_GERMAN_PATTERNS) {
+            if (pattern.test(line)) {
+              violations.push(`Line ${idx + 1}: ${line.trim().substring(0, 100)}`);
+            }
+          }
+          for (const pattern of HARDCODED_GERMAN_JSX_PATTERNS) {
+            if (pattern.test(line)) {
+              violations.push(`Line ${idx + 1}: ${line.trim().substring(0, 100)}`);
+            }
+          }
+        });
+
+        if (violations.length > 0) {
+          throw new Error(
+            `Found ${violations.length} hardcoded German string(s) in ${relFile}:\n  ${violations.join('\n  ')}`
+          );
+        }
+      });
+    }
+  });
+
+  describe('No hardcoded locale strings (de-DE) without dynamic selection', () => {
+    const filesToCheck = findTsxFiles(path.join(CLIENT_SRC, 'components'));
+    filesToCheck.push(...findTsxFiles(path.join(CLIENT_SRC, 'pages')));
+
+    const hardcodedLocalePattern = /toLocale(?:Date|Time)String\(\s*['"]de-DE['"]/;
+    const dynamicLocalePattern = /i18n\.language/;
+
+    for (const filePath of filesToCheck) {
+      const relPath = path.relative(CLIENT_SRC, filePath);
+
+      it(`${relPath}: should not use hardcoded 'de-DE' locale without dynamic fallback`, () => {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const lines = content.split('\n');
+        const violations: string[] = [];
+
+        lines.forEach((line, idx) => {
+          if (isAllowedLine(line)) return;
+          if (hardcodedLocalePattern.test(line) && !dynamicLocalePattern.test(line)) {
+            violations.push(`Line ${idx + 1}: ${line.trim().substring(0, 120)}`);
+          }
+        });
+
+        if (violations.length > 0) {
+          throw new Error(
+            `Found hardcoded 'de-DE' locale without dynamic language selection in ${relPath}:\n  ${violations.join('\n  ')}`
+          );
+        }
+      });
+    }
+  });
+
+  describe('All t() keys used in critical components exist in locale files', () => {
+    const deJson = readJson(path.join(LOCALES_DIR, 'de.json'));
+    const enJson = readJson(path.join(LOCALES_DIR, 'en.json'));
+    const deKeys = new Set(flattenKeys(deJson));
+    const enKeys = new Set(flattenKeys(enJson));
+
+    const criticalFiles = [
+      'components/ai/AiChatWidget.tsx',
+      'components/ai/AiPollCreator.tsx',
+      'components/admin/settings/AiSettingsPanel.tsx',
+      'components/admin/settings/SessionTimeoutPanel.tsx',
+      'components/ResultsChart.tsx',
+      'components/SimpleImageVoting.tsx',
+      'App.tsx',
+    ];
+
+    const tCallPattern = /(?<![a-zA-Z])t\(\s*['"]([a-zA-Z][a-zA-Z0-9_.]+)['"]/g;
+
+    for (const relFile of criticalFiles) {
+      const filePath = path.join(CLIENT_SRC, relFile);
+      if (!fs.existsSync(filePath)) continue;
+
+      it(`${relFile}: all t() keys should exist in de.json`, () => {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const missingKeys: string[] = [];
+        let match;
+        const regex = new RegExp(tCallPattern.source, 'g');
+        while ((match = regex.exec(content)) !== null) {
+          const key = match[1];
+          if (!deKeys.has(key)) {
+            missingKeys.push(key);
+          }
+        }
+        if (missingKeys.length > 0) {
+          throw new Error(
+            `${missingKeys.length} t() key(s) missing in de.json:\n  - ${[...new Set(missingKeys)].join('\n  - ')}`
+          );
+        }
+      });
+
+      it(`${relFile}: all t() keys should exist in en.json`, () => {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const missingKeys: string[] = [];
+        let match;
+        const regex = new RegExp(tCallPattern.source, 'g');
+        while ((match = regex.exec(content)) !== null) {
+          const key = match[1];
+          if (!enKeys.has(key)) {
+            missingKeys.push(key);
+          }
+        }
+        if (missingKeys.length > 0) {
+          throw new Error(
+            `${missingKeys.length} t() key(s) missing in en.json:\n  - ${[...new Set(missingKeys)].join('\n  - ')}`
+          );
+        }
+      });
+    }
+  });
+
+  describe('Components using user-visible text must import useTranslation', () => {
+    const criticalFiles = [
+      'components/ai/AiChatWidget.tsx',
+      'components/ai/AiPollCreator.tsx',
+      'components/admin/settings/AiSettingsPanel.tsx',
+      'components/admin/settings/SessionTimeoutPanel.tsx',
+      'components/ResultsChart.tsx',
+      'components/SimpleImageVoting.tsx',
+      'App.tsx',
+    ];
+
+    for (const relFile of criticalFiles) {
+      const filePath = path.join(CLIENT_SRC, relFile);
+      if (!fs.existsSync(filePath)) continue;
+
+      it(`${relFile}: should import useTranslation from react-i18next`, () => {
+        const content = fs.readFileSync(filePath, 'utf8');
+        if (content.includes("t('") || content.includes('t("')) {
+          expect(content).toContain("useTranslation");
+          expect(content).toContain("react-i18next");
+        }
+      });
+    }
+  });
+
+  describe('No German fallback strings in t() calls', () => {
+    const tsxFiles = findTsxFiles(path.join(CLIENT_SRC, 'components'));
+    tsxFiles.push(...findTsxFiles(path.join(CLIENT_SRC, 'pages')));
+    tsxFiles.push(path.join(CLIENT_SRC, 'App.tsx'));
+
+    const germanFallbackPattern = /t\([^)]+,\s*['"][A-ZÄÖÜ][a-zäöüß]/;
+
+    for (const filePath of tsxFiles) {
+      if (!fs.existsSync(filePath)) continue;
+      const relPath = path.relative(CLIENT_SRC, filePath);
+
+      it(`${relPath}: should not have German fallback text in t() calls`, () => {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const lines = content.split('\n');
+        const violations: string[] = [];
+
+        lines.forEach((line, idx) => {
+          if (isAllowedLine(line)) return;
+          if (germanFallbackPattern.test(line)) {
+            violations.push(`Line ${idx + 1}: ${line.trim().substring(0, 120)}`);
+          }
+        });
+
+        if (violations.length > 0) {
+          throw new Error(
+            `Found t() calls with hardcoded German fallback text in ${relPath}:\n  ${violations.join('\n  ')}`
+          );
+        }
+      });
+    }
+  });
+});
diff --git a/server/tests/ui/voiceInput.test.ts b/server/tests/ui/voiceInput.test.ts
new file mode 100644
index 00000000..7e3383f4
--- /dev/null
+++ b/server/tests/ui/voiceInput.test.ts
@@ -0,0 +1,206 @@
+import { describe, it, expect } from 'vitest';
+import * as fs from 'fs';
+import * as path from 'path';
+
+export const testMeta = {
+  category: 'ui' as const,
+  name: 'Spracheingabe-Konsistenz',
+  description: 'Prüft ob beide Spracheingabe-Eingabepunkte (Startseite + Nachfragen) konsistent implementiert sind und visuelles Feedback gewährleistet ist',
+  severity: 'high' as const,
+};
+
+const CLIENT_SRC = path.resolve(__dirname, '../../../client/src');
+const AI_DIR = path.join(CLIENT_SRC, 'components/ai');
+
+function readFile(name: string): string {
+  const filePath = path.join(AI_DIR, name);
+  if (!fs.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
+  return fs.readFileSync(filePath, 'utf-8');
+}
+
+describe('Voice Input Consistency', () => {
+  const widgetCode = readFile('AiChatWidget.tsx');
+  const overlayCode = readFile('VoiceRecordingOverlay.tsx');
+
+  describe('VoiceRecordingOverlay – visual feedback', () => {
+    it('should have a canvas element for waveform visualization', () => {
+      expect(overlayCode).toContain('canvasRef');
+      expect(overlayCode).toContain('<canvas');
+    });
+
+    it('should have a fallback animation when waveform is unavailable', () => {
+      expect(overlayCode).toMatch(/showFallbackAnimation|fallback.*anim/i);
+      expect(overlayCode).toContain('voiceBar');
+    });
+
+    it('should resume AudioContext to handle browser autoplay policy', () => {
+      expect(overlayCode).toMatch(/audioContext\.resume\s*\(\s*\)/);
+    });
+
+    it('should check for suspended AudioContext state', () => {
+      expect(overlayCode).toMatch(/state\s*===\s*['"]suspended['"]/);
+    });
+
+    it('should have a REC indicator visible during recording', () => {
+      expect(overlayCode).toContain('REC');
+      expect(overlayCode).toMatch(/bg-red-\d+/);
+      expect(overlayCode).toContain('animate-pulse');
+    });
+
+    it('should show different states for listening vs transcribing', () => {
+      expect(overlayCode).toContain('isTranscribing');
+      expect(overlayCode).toContain('isListening');
+      expect(overlayCode).toMatch(/aiListening/);
+      expect(overlayCode).toMatch(/aiTranscribing/);
+    });
+
+    it('should show a loading spinner during transcription', () => {
+      expect(overlayCode).toContain('Loader2');
+      expect(overlayCode).toContain('animate-spin');
+    });
+
+    it('should have an AnalyserNode for audio data', () => {
+      expect(overlayCode).toContain('createAnalyser');
+      expect(overlayCode).toContain('fftSize');
+      expect(overlayCode).toContain('getByteTimeDomainData');
+    });
+
+    it('should clean up AudioContext on unmount', () => {
+      expect(overlayCode).toMatch(/audioContext(Ref)?\.current\.close\(\)/);
+    });
+  });
+
+  describe('AiChatWidget – main voice input (Startseite)', () => {
+    it('should have a microphone button with Mic icon', () => {
+      expect(widgetCode).toContain('voiceTargetRef.current = "main"');
+      expect(widgetCode).toContain('toggleListening');
+      expect(widgetCode).toContain('<Mic');
+    });
+
+    it('should disable mic button while transcribing or submitting', () => {
+      expect(widgetCode).toMatch(/disabled=\{isTranscribing\s*\|\|\s*mutation\.isPending\}/);
+    });
+
+    it('should show active state with animate-pulse when listening', () => {
+      const startIdx = widgetCode.indexOf('voiceTargetRef.current = "main"');
+      const endIdx = widgetCode.indexOf('</button>', startIdx) + 20;
+      const mainButtonSection = widgetCode.substring(startIdx, endIdx);
+      expect(mainButtonSection).toContain('animate-pulse');
+    });
+
+    it('should show Loader2 spinner when transcribing', () => {
+      const startIdx = widgetCode.indexOf('voiceTargetRef.current = "main"');
+      const endIdx = widgetCode.indexOf('</button>', startIdx) + 20;
+      const mainButtonSection = widgetCode.substring(startIdx, endIdx);
+      expect(mainButtonSection).toContain('Loader2');
+    });
+
+    it('should use aiMicTooltip i18n key', () => {
+      expect(widgetCode).toContain('t("home.aiMicTooltip")');
+    });
+  });
+
+  describe('AiChatWidget – follow-up voice input (Nachfragen)', () => {
+    it('should have a microphone button with Mic icon for follow-up', () => {
+      expect(widgetCode).toContain('toggleFollowUpListening');
+      const followUpSection = widgetCode.substring(widgetCode.indexOf('toggleFollowUpListening'));
+      expect(followUpSection).toContain('<Mic');
+    });
+
+    it('should disable mic button while transcribing or refining', () => {
+      expect(widgetCode).toMatch(/disabled=\{isTranscribing\s*\|\|\s*isRefining\}/);
+    });
+
+    it('should show active state with animate-pulse when listening in follow-up mode', () => {
+      const followUpButtonIdx = widgetCode.indexOf('toggleFollowUpListening');
+      const followUpSection = widgetCode.substring(
+        followUpButtonIdx,
+        widgetCode.indexOf('</button>', followUpButtonIdx + 100) + 20
+      );
+      expect(followUpSection).toContain('animate-pulse');
+    });
+
+    it('should show Loader2 spinner when transcribing in follow-up mode', () => {
+      const followUpButtonIdx = widgetCode.indexOf('onClick={toggleFollowUpListening}');
+      const followUpSection = widgetCode.substring(
+        followUpButtonIdx,
+        widgetCode.indexOf('</button>', followUpButtonIdx + 100) + 20
+      );
+      expect(followUpSection).toContain('Loader2');
+    });
+
+    it('should set voiceTargetRef to followup in toggleFollowUpListening', () => {
+      expect(widgetCode).toMatch(/voiceTargetRef\.current\s*=\s*["']followup["']/);
+    });
+
+    it('should use same aiMicTooltip i18n key as main', () => {
+      const followUpSection = widgetCode.substring(widgetCode.indexOf('toggleFollowUpListening'));
+      expect(followUpSection).toContain('aiMicTooltip');
+    });
+  });
+
+  describe('State transition safety (no overlay flicker)', () => {
+    it('should NOT set isListening(false) directly in stopRecording', () => {
+      const stopRecordingMatch = widgetCode.match(/const stopRecording\s*=\s*useCallback\(\s*\(\)\s*=>\s*\{([\s\S]*?)\},\s*\[/);
+      expect(stopRecordingMatch).toBeTruthy();
+      const stopBody = stopRecordingMatch![1];
+      const directSetFalse = stopBody.match(/setIsListening\(false\)/g) || [];
+      const hasElseFallback = stopBody.includes('else');
+      if (directSetFalse.length > 0) {
+        expect(hasElseFallback).toBe(true);
+      }
+    });
+
+    it('should set isTranscribing(true) BEFORE isListening(false) in onstop handler', () => {
+      const onstopMatch = widgetCode.match(/mediaRecorder\.onstop\s*=\s*async\s*\(\)\s*=>\s*\{([\s\S]*?)\};/);
+      expect(onstopMatch).toBeTruthy();
+      const onstopBody = onstopMatch![1];
+      const transcribingIdx = onstopBody.indexOf('setIsTranscribing(true)');
+      const listeningIdx = onstopBody.indexOf('setIsListening(false)');
+      expect(transcribingIdx).toBeGreaterThan(-1);
+      expect(listeningIdx).toBeGreaterThan(-1);
+      expect(transcribingIdx).toBeLessThan(listeningIdx);
+    });
+
+    it('should keep VoiceRecordingOverlay visible during both listening and transcribing', () => {
+      expect(widgetCode).toMatch(/isVisible=\{isListening\s*\|\|\s*isTranscribing\}/);
+    });
+
+    it('should pass audioStream to VoiceRecordingOverlay', () => {
+      expect(widgetCode).toMatch(/audioStream=\{audioStream\}/);
+    });
+
+    it('should pass isTranscribing and isListening to VoiceRecordingOverlay', () => {
+      expect(widgetCode).toMatch(/isTranscribing=\{isTranscribing\}/);
+      expect(widgetCode).toMatch(/isListening=\{isListening\}/);
+    });
+  });
+
+  describe('Shared recording infrastructure', () => {
+    it('should use MediaRecorder API for both modes', () => {
+      expect(widgetCode).toContain('new MediaRecorder');
+      expect(widgetCode).toContain('mediaRecorder.start');
+    });
+
+    it('should use same transcribeVoice function for both targets', () => {
+      expect(widgetCode).toMatch(/const target = activeRecordingTargetRef\.current/);
+      const setters = widgetCode.match(/target === ["']followup["']\s*\?\s*setFollowUpValue\s*:\s*setInputValue/);
+      expect(setters).toBeTruthy();
+    });
+
+    it('should clean up media stream tracks on stop', () => {
+      expect(widgetCode).toMatch(/getTracks\(\)\.forEach.*track\.stop/);
+    });
+
+    it('should handle audio/webm and fallback mime types', () => {
+      expect(widgetCode).toContain('audio/webm;codecs=opus');
+      expect(widgetCode).toContain('audio/webm');
+      expect(widgetCode).toContain('audio/mp4');
+    });
+
+    it('should use same VoiceRecordingOverlay component for both modes', () => {
+      const overlayInstances = widgetCode.match(/<VoiceRecordingOverlay/g);
+      expect(overlayInstances).toHaveLength(1);
+    });
+  });
+});
diff --git a/server/tests/unit/baseUrl.test.ts b/server/tests/unit/baseUrl.test.ts
new file mode 100644
index 00000000..227ff9a2
--- /dev/null
+++ b/server/tests/unit/baseUrl.test.ts
@@ -0,0 +1,117 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { getBaseUrl, validateEmailUrl, warnIfLocalhostInProduction, resetWarningFlags } from '../../utils/baseUrl';
+
+describe('getBaseUrl', () => {
+  const originalEnv = { ...process.env };
+
+  beforeEach(() => {
+    delete process.env.APP_URL;
+    delete process.env.BASE_URL;
+    delete process.env.VITE_APP_URL;
+    delete process.env.REPLIT_DOMAINS;
+    delete process.env.REPLIT_DEV_DOMAIN;
+  });
+
+  afterEach(() => {
+    Object.assign(process.env, originalEnv);
+  });
+
+  it('should return valid APP_URL', () => {
+    process.env.APP_URL = 'https://poll.example.com';
+    expect(getBaseUrl()).toBe('https://poll.example.com');
+  });
+
+  it('should strip trailing slashes from APP_URL', () => {
+    process.env.APP_URL = 'https://poll.example.com/';
+    expect(getBaseUrl()).toBe('https://poll.example.com');
+  });
+
+  it('should reject malformed APP_URL and fall back', () => {
+    process.env.APP_URL = 'not-a-url';
+    const base = getBaseUrl();
+    expect(base).toContain('localhost');
+  });
+
+  it('should reject x-webdoc:// protocol in APP_URL', () => {
+    process.env.APP_URL = 'x-webdoc://some-path';
+    const base = getBaseUrl();
+    expect(base).not.toContain('x-webdoc');
+  });
+
+  it('should accept http:// APP_URL', () => {
+    process.env.APP_URL = 'http://internal.corp:8080';
+    expect(getBaseUrl()).toBe('http://internal.corp:8080');
+  });
+});
+
+describe('validateEmailUrl', () => {
+  beforeEach(() => {
+    process.env.APP_URL = 'https://poll.example.com';
+  });
+
+  afterEach(() => {
+    delete process.env.APP_URL;
+  });
+
+  it('should pass through valid https URL', () => {
+    expect(validateEmailUrl('https://poll.example.com/poll/abc')).toBe('https://poll.example.com/poll/abc');
+  });
+
+  it('should pass through valid http URL', () => {
+    expect(validateEmailUrl('http://internal.corp/poll/abc')).toBe('http://internal.corp/poll/abc');
+  });
+
+  it('should prepend base URL to relative paths', () => {
+    expect(validateEmailUrl('/poll/abc')).toBe('https://poll.example.com/poll/abc');
+  });
+
+  it('should reject javascript: protocol', () => {
+    const result = validateEmailUrl('javascript:alert(1)');
+    expect(result).not.toContain('javascript:');
+    expect(result).toContain('https://');
+  });
+
+  it('should reject x-webdoc:// protocol', () => {
+    const result = validateEmailUrl('x-webdoc://some-path');
+    expect(result).not.toContain('x-webdoc');
+    expect(result).toContain('https://');
+  });
+
+  it('should return base URL for empty string', () => {
+    const result = validateEmailUrl('');
+    expect(result).toContain('https://');
+  });
+
+  it('should handle URLs with whitespace', () => {
+    const result = validateEmailUrl('  https://poll.example.com/poll/abc  ');
+    expect(result).toContain('https://poll.example.com/poll/abc');
+  });
+
+  it('should reject malformed absolute URLs', () => {
+    const result = validateEmailUrl('https://');
+    expect(result).toContain('poll.example.com');
+  });
+});
+
+describe('warnIfLocalhostInProduction', () => {
+  const originalEnv = { ...process.env };
+
+  afterEach(() => {
+    Object.assign(process.env, originalEnv);
+  });
+
+  it('should warn when APP_URL is localhost in production', () => {
+    delete process.env.APP_URL;
+    delete process.env.REPLIT_DOMAINS;
+    delete process.env.REPLIT_DEV_DOMAIN;
+    process.env.NODE_ENV = 'production';
+    resetWarningFlags();
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    warnIfLocalhostInProduction();
+    const localhostWarnings = warnSpy.mock.calls.filter(
+      (args) => typeof args[0] === 'string' && args[0].includes('localhost') && args[0].includes('production')
+    );
+    expect(localhostWarnings.length).toBeGreaterThanOrEqual(1);
+    warnSpy.mockRestore();
+  });
+});
diff --git a/server/tests/unit/parseTestCases.test.ts b/server/tests/unit/parseTestCases.test.ts
new file mode 100644
index 00000000..8459822a
--- /dev/null
+++ b/server/tests/unit/parseTestCases.test.ts
@@ -0,0 +1,203 @@
+import { describe, it, expect } from 'vitest';
+import { parseTestCases } from '../../services/testRunnerService';
+
+describe('parseTestCases', () => {
+  it('should parse basic it() calls', () => {
+    const content = `
+      it('should do something', () => {});
+      it("should do another thing", () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(2);
+    expect(result[0].name).toBe('should do something');
+    expect(result[1].name).toBe('should do another thing');
+  });
+
+  it('should parse basic test() calls', () => {
+    const content = `
+      test('first test', () => {});
+      test("second test", () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(2);
+  });
+
+  it('should parse template literal test names', () => {
+    const content = "it(`should handle template literals`, () => {});";
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toBe('should handle template literals');
+  });
+
+  it('should skip single-line comments', () => {
+    const content = `
+      // it('this is commented out', () => {});
+      it('this is real', () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toBe('this is real');
+  });
+
+  it('should skip block comments', () => {
+    const content = `
+      /* it('commented out', () => {}); */
+      /*
+        it('also commented', () => {});
+        test('still commented', () => {});
+      */
+      it('real test', () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toBe('real test');
+  });
+
+  it('should handle it.skip and test.skip', () => {
+    const content = `
+      it.skip('skipped test', () => {});
+      test.skip('another skipped', () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(2);
+    expect(result[0].name).toBe('skipped test');
+  });
+
+  it('should handle it.todo', () => {
+    const content = `
+      it.todo('todo test');
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toBe('todo test');
+  });
+
+  it('should handle it.only and test.only', () => {
+    const content = `
+      it.only('focused test', () => {});
+      test.only('another focused', () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(2);
+  });
+
+  it('should detect it.each as a dynamic test', () => {
+    const content = `
+      it.each([1, 2, 3])('test case %i', (num) => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toContain('[dynamic]');
+  });
+
+  it('should detect test.each as a dynamic test', () => {
+    const content = `
+      test.each([[1, 2], [3, 4]])('adds %i + %i', (a, b) => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toContain('[dynamic]');
+  });
+
+  it('should handle mixed real and commented tests', () => {
+    const content = `
+      describe('my suite', () => {
+        it('test one', () => {});
+        // it('commented test', () => {});
+        /* it('block commented', () => {}); */
+        it('test two', () => {});
+      });
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(2);
+    expect(result[0].name).toBe('test one');
+    expect(result[1].name).toBe('test two');
+  });
+
+  it('should not count describe blocks as tests', () => {
+    const content = `
+      describe('suite', () => {
+        it('test inside', () => {});
+      });
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toBe('test inside');
+  });
+
+  it('should return empty array for files with no tests', () => {
+    const content = `
+      const helper = () => {};
+      export default helper;
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(0);
+  });
+
+  it('should handle multi-line block comments correctly', () => {
+    const content = `
+      it('before comment', () => {});
+      /*
+       * This is a big comment block
+       * it('fake test inside comment', () => {});
+       * test('another fake', () => {});
+       */
+      it('after comment', () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(2);
+    expect(result[0].name).toBe('before comment');
+    expect(result[1].name).toBe('after comment');
+  });
+
+  it('should detect forEach-generated tests without double counting', () => {
+    const content = `
+      const cases = ['a', 'b', 'c'];
+      cases.forEach((c) => {
+        it('should handle ' + c, () => {});
+      });
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toContain('[dynamic/forEach]');
+  });
+
+  it('should detect forEach with arrow function without double counting', () => {
+    const content = `
+      [1, 2, 3].forEach(num => {
+        test('test case for ' + num, () => {});
+      });
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toContain('[dynamic/forEach]');
+  });
+
+  it('should handle forEach with destructured params', () => {
+    const content = `
+      testCases.forEach(({ input, expected }) => {
+        it('validates input correctly', () => {
+          expect(validate(input)).toBe(expected);
+        });
+      });
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toContain('[dynamic/forEach]');
+  });
+
+  it('should not double count forEach inner tests with outer tests', () => {
+    const content = `
+      it('standalone test', () => {});
+      items.forEach((item) => {
+        it('test for ' + item, () => {});
+      });
+      it('another standalone', () => {});
+    `;
+    const result = parseTestCases(content);
+    expect(result).toHaveLength(3);
+    expect(result[0].name).toBe('standalone test');
+    expect(result[1].name).toContain('[dynamic/forEach]');
+    expect(result[2].name).toBe('another standalone');
+  });
+});
diff --git a/server/utils/baseUrl.ts b/server/utils/baseUrl.ts
index 3555db6e..c38d87c1 100644
--- a/server/utils/baseUrl.ts
+++ b/server/utils/baseUrl.ts
@@ -1,16 +1,87 @@
+let _warnedOnce = false;
+let _warnedLocalhostOnce = false;
+
+function isValidHttpUrl(urlStr: string): boolean {
+  try {
+    const parsed = new URL(urlStr.trim());
+    return parsed.protocol === 'https:' || parsed.protocol === 'http:';
+  } catch {
+    return false;
+  }
+}
+
 export function getBaseUrl(): string {
-  if (process.env.BASE_URL) {
-    return process.env.BASE_URL.replace(/\/$/, '');
+  const explicit = process.env.APP_URL || process.env.BASE_URL || process.env.VITE_APP_URL;
+  if (explicit) {
+    const trimmed = explicit.trim().replace(/\/+$/, '');
+    if (isValidHttpUrl(trimmed)) {
+      return trimmed;
+    }
+    console.warn(`[Config] APP_URL "${trimmed.slice(0, 80)}" is not a valid HTTP(S) URL — ignoring. Set APP_URL to your public URL (e.g. https://poll.example.com).`);
   }
-  
+
   if (process.env.REPLIT_DOMAINS) {
     return `https://${process.env.REPLIT_DOMAINS.split(',')[0]}`;
   }
-  
+
   if (process.env.REPLIT_DEV_DOMAIN) {
     return `https://${process.env.REPLIT_DEV_DOMAIN}`;
   }
-  
+
+  if (!_warnedOnce) {
+    console.warn('[Config] APP_URL is not set — falling back to http://localhost. Set APP_URL to your public URL (e.g. https://poll.example.com).');
+    _warnedOnce = true;
+  }
+
   const port = process.env.PORT || 5000;
   return `http://localhost:${port}`;
 }
+
+export function validateEmailUrl(url: string): string {
+  if (!url) return getBaseUrl();
+
+  const trimmed = url.trim();
+
+  if (trimmed.startsWith('https://') || trimmed.startsWith('http://')) {
+    try {
+      const parsed = new URL(trimmed);
+      if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        console.warn(`[Email URL] Rejected non-http(s) protocol: ${parsed.protocol}`);
+        return getBaseUrl();
+      }
+      return parsed.href.replace(/\/+$/, '');
+    } catch {
+      console.warn(`[Email URL] Malformed URL rejected: ${trimmed.slice(0, 80)}`);
+      return getBaseUrl();
+    }
+  }
+
+  const dangerousProtocols = /^(javascript|data|vbscript|file|ftp):/i;
+  if (dangerousProtocols.test(trimmed)) {
+    console.warn(`[Email URL] Rejected dangerous protocol: ${trimmed.slice(0, 80)}`);
+    return getBaseUrl();
+  }
+
+  if (trimmed.includes('://') && !trimmed.startsWith('http')) {
+    console.warn(`[Email URL] Rejected non-http(s) URL: ${trimmed.slice(0, 80)}`);
+    return getBaseUrl();
+  }
+
+  const base = getBaseUrl();
+  return `${base}${trimmed.startsWith('/') ? '' : '/'}${trimmed}`;
+}
+
+export function warnIfLocalhostInProduction(): void {
+  if (_warnedLocalhostOnce) return;
+  const base = getBaseUrl();
+  const isProduction = process.env.NODE_ENV === 'production' || process.env.DOCKER === 'true';
+  if (isProduction && (base.includes('localhost') || base.includes('127.0.0.1'))) {
+    console.warn('[Config] WARNING: APP_URL points to localhost in production! Email links will be broken. Set APP_URL to your public URL (e.g. https://poll.example.com).');
+    _warnedLocalhostOnce = true;
+  }
+}
+
+export function resetWarningFlags(): void {
+  _warnedOnce = false;
+  _warnedLocalhostOnce = false;
+}
diff --git a/shared/schema.ts b/shared/schema.ts
index c86cb5e5..dc567305 100644
--- a/shared/schema.ts
+++ b/shared/schema.ts
@@ -30,7 +30,10 @@ export const emailVerificationTokens = pgTable("email_verification_tokens", {
   token: text("token").notNull().unique(),
   expiresAt: timestamp("expires_at").notNull(),
   createdAt: timestamp("created_at").defaultNow().notNull(),
-});
+}, (table) => [
+  index("email_verification_tokens_token_idx").on(table.token),
+  index("email_verification_tokens_user_id_idx").on(table.userId),
+]);
 
 export const polls = pgTable("polls", {
   id: uuid("id").primaryKey().defaultRandom(),
@@ -52,6 +55,7 @@ export const polls = pgTable("polls", {
   allowMaybe: boolean("allow_maybe").default(true).notNull(), // whether "maybe" option is available for voting
   isTestData: boolean("is_test_data").default(false).notNull(), // Test polls excluded from stats
   expiresAt: timestamp("expires_at"),
+  videoConferenceUrl: text("video_conference_url"),
   finalOptionId: integer("final_option_id"), // Creator's final chosen option - removes other options from calendar exports
   enableExpiryReminder: boolean("enable_expiry_reminder").default(false).notNull(),
   expiryReminderHours: integer("expiry_reminder_hours").default(24), // hours before expiry to send reminder
@@ -74,6 +78,7 @@ export const pollOptions = pgTable("poll_options", {
   startTime: timestamp("start_time"), // for schedule polls
   endTime: timestamp("end_time"), // for schedule polls
   maxCapacity: integer("max_capacity"), // for organization polls: max signups per slot (null = unlimited)
+  isFreeText: boolean("is_free_text").default(false).notNull(), // for survey polls: marks this option as an open-ended question
   order: integer("order").notNull().default(0),
   createdAt: timestamp("created_at").defaultNow().notNull(),
 }, (table) => [
@@ -89,8 +94,9 @@ export const votes = pgTable("votes", {
   userId: integer("user_id"), // null for anonymous votes
   voterKey: text("voter_key"), // Unique voter identifier: "user:123" or "device:abc123" (for deduplication)
   voterSource: text("voter_source"), // "user" (logged in) or "device" (guest with device token)
-  response: text("response").notNull(), // "yes", "maybe", "no", or "signup" for organization polls
+  response: text("response").notNull(), // "yes", "maybe", "no", "freetext", or "signup" for organization polls
   comment: text("comment"), // optional comment (e.g., contact info, which cake they bring)
+  freeTextAnswer: text("free_text_answer"), // for survey free-text questions: the voter's typed answer
   voterEditToken: text("voter_edit_token"), // Unique token for editing votes
   isTestData: boolean("is_test_data").default(false).notNull(), // Test votes excluded from stats
   createdAt: timestamp("created_at").defaultNow().notNull(),
@@ -100,6 +106,7 @@ export const votes = pgTable("votes", {
   index("votes_option_id_idx").on(table.optionId),
   index("votes_voter_email_idx").on(table.voterEmail),
   index("votes_voter_key_idx").on(table.voterKey),
+  index("votes_voter_edit_token_idx").on(table.voterEditToken),
 ]);
 
 export const systemSettings = pgTable("system_settings", {
@@ -114,14 +121,17 @@ export const systemSettings = pgTable("system_settings", {
 export const notificationLogs = pgTable("notification_logs", {
   id: serial("id").primaryKey(),
   pollId: uuid("poll_id").notNull(),
-  type: text("type").notNull(), // "expiry_reminder", "manual_reminder", "vote_confirmation", "poll_created"
+  type: text("type").notNull(),
   recipientEmail: text("recipient_email").notNull(),
-  sentBy: text("sent_by"), // user id or "system" for automatic reminders
+  sentBy: text("sent_by"),
   sentByGuest: boolean("sent_by_guest").default(false).notNull(),
   success: boolean("success").default(true).notNull(),
   errorMessage: text("error_message"),
   createdAt: timestamp("created_at").defaultNow().notNull(),
-});
+}, (table) => [
+  index("notification_logs_poll_id_idx").on(table.pollId),
+  index("notification_logs_type_idx").on(table.type),
+]);
 
 // Password reset tokens - for secure password reset workflow
 export const passwordResetTokens = pgTable("password_reset_tokens", {
@@ -129,9 +139,12 @@ export const passwordResetTokens = pgTable("password_reset_tokens", {
   userId: integer("user_id").notNull(),
   token: text("token").notNull().unique(),
   expiresAt: timestamp("expires_at").notNull(),
-  usedAt: timestamp("used_at"), // null if not yet used
+  usedAt: timestamp("used_at"),
   createdAt: timestamp("created_at").defaultNow().notNull(),
-});
+}, (table) => [
+  index("password_reset_tokens_token_idx").on(table.token),
+  index("password_reset_tokens_user_id_idx").on(table.userId),
+]);
 
 // Email change tokens - for secure email change confirmation workflow
 export const emailChangeTokens = pgTable("email_change_tokens", {
@@ -140,9 +153,12 @@ export const emailChangeTokens = pgTable("email_change_tokens", {
   newEmail: text("new_email").notNull(),
   token: text("token").notNull().unique(),
   expiresAt: timestamp("expires_at").notNull(),
-  usedAt: timestamp("used_at"), // null if not yet used
+  usedAt: timestamp("used_at"),
   createdAt: timestamp("created_at").defaultNow().notNull(),
-});
+}, (table) => [
+  index("email_change_tokens_token_idx").on(table.token),
+  index("email_change_tokens_user_id_idx").on(table.userId),
+]);
 
 // Test runs - for storing automated test execution history
 export const testRuns = pgTable("test_runs", {
@@ -392,6 +408,7 @@ export const EMAIL_TEMPLATE_TYPES = [
   'password_changed',
   'test_report',
   'welcome',
+  'poll_finalized',
 ] as const;
 
 export type EmailTemplateType = typeof EMAIL_TEMPLATE_TYPES[number];
@@ -462,6 +479,15 @@ export const EMAIL_TEMPLATE_VARIABLES: Record<EmailTemplateType, { key: string;
     { key: 'verificationLink', description: 'Link zur E-Mail-Verifizierung' },
     { key: 'siteName', description: 'Name der Plattform' },
   ],
+  poll_finalized: [
+    { key: 'pollTitle', description: 'Titel der Umfrage' },
+    { key: 'confirmedDate', description: 'Bestätigter Termin (formatiert)' },
+    { key: 'confirmedTime', description: 'Uhrzeit des Termins (falls vorhanden)' },
+    { key: 'videoConferenceUrl', description: 'Videokonferenz-Link als URL (falls vorhanden)' },
+    { key: 'videoConferenceHtml', description: 'Videokonferenz-Link als klickbarer HTML-Link (falls vorhanden)' },
+    { key: 'pollLink', description: 'Link zur Umfrage' },
+    { key: 'siteName', description: 'Name der Plattform' },
+  ],
 };
 
 // Theme preference type
@@ -662,12 +688,17 @@ export type WcagAuditIssue = z.infer<typeof wcagAuditIssueSchema>;
 export type WcagAuditResult = z.infer<typeof wcagAuditResultSchema>;
 export type WcagSettings = z.infer<typeof wcagSettingsSchema>;
 
+export const languageSettingsSchema = z.object({
+  defaultLanguage: z.enum(['de', 'en']).default('en'),
+});
+
 export const customizationSettingsSchema = z.object({
   theme: themeSettingsSchema.default({}),
   branding: brandingSettingsSchema.default({}),
   footer: footerSettingsSchema.default({}),
   matrix: matrixSettingsSchema.default({}),
   wcag: wcagSettingsSchema.default({}),
+  language: languageSettingsSchema.default({}),
 });
 
 export type ThemeSettings = z.infer<typeof themeSettingsSchema>;
@@ -675,8 +706,51 @@ export type BrandingSettings = z.infer<typeof brandingSettingsSchema>;
 export type FooterLink = z.infer<typeof footerLinkSchema>;
 export type MatrixSettings = z.infer<typeof matrixSettingsSchema>;
 export type FooterSettings = z.infer<typeof footerSettingsSchema>;
+export type LanguageSettings = z.infer<typeof languageSettingsSchema>;
 export type CustomizationSettings = z.infer<typeof customizationSettingsSchema>;
 
+// ============================================================
+// AI Feature Schema (feature/ai-agent)
+// ============================================================
+
+export const aiUsageLogs = pgTable("ai_usage_logs", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id"), // null for guests
+  sessionId: text("session_id"), // anonymous session tracking
+  endpoint: text("endpoint").notNull(), // e.g. 'create-poll'
+  model: text("model").notNull(),
+  promptTokens: integer("prompt_tokens"),
+  completionTokens: integer("completion_tokens"),
+  success: boolean("success").notNull().default(true),
+  errorMessage: text("error_message"),
+  createdAt: timestamp("created_at").defaultNow().notNull(),
+});
+
+export const insertAiUsageLogSchema = createInsertSchema(aiUsageLogs).omit({ id: true, createdAt: true });
+export type AiUsageLog = typeof aiUsageLogs.$inferSelect;
+export type InsertAiUsageLog = z.infer<typeof insertAiUsageLogSchema>;
+
+// AI Settings Schema — stored in system_settings as key 'ai_settings'
+export const aiRoleLimitSchema = z.object({
+  enabled: z.boolean().default(false), // whether this role can use AI
+  requestsPerHour: z.number().nullable().default(5), // null = unlimited, 0 = disabled
+});
+
+export const aiSettingsSchema = z.object({
+  enabled: z.boolean().default(false),
+  model: z.string().default("llama-3.3-70b-instruct"),
+  apiUrl: z.string().default("https://saia.gwdg.de/v1"),
+  apiKey: z.string().default(""),
+  apiKeyFallback: z.string().default(""),
+  guestLimits: aiRoleLimitSchema.default({ enabled: false, requestsPerHour: 0 }),
+  userLimits: aiRoleLimitSchema.default({ enabled: true, requestsPerHour: 5 }),
+  adminLimits: aiRoleLimitSchema.default({ enabled: true, requestsPerHour: null }),
+});
+
+export type AiSettings = z.infer<typeof aiSettingsSchema>;
+export type AiRoleLimit = z.infer<typeof aiRoleLimitSchema>;
+
+// ============================================================
 // Extended types for API responses
 export type PollWithOptions = Poll & {
   options: PollOption[];
diff --git a/vitest.config.ts b/vitest.config.ts
index 35b40dc9..80a87e48 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -13,7 +13,15 @@ export default defineConfig({
     hookTimeout: 30000,
     teardownTimeout: 10000,
     pool: 'forks' as const,
+    poolOptions: {
+      forks: {
+        singleFork: true,
+      },
+    },
     isolate: false,
+    sequence: {
+      concurrent: false,
+    },
     coverage: {
       provider: 'v8',
       reporter: ['text', 'json', 'html', 'lcov'],