small fix, don't worry about it

app/backend/internal/analytics/umami.go

@@ -0,0 +1,74 @@
+package analytics
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+type Client struct {
+	BaseURL   string
+	APIKey    string
+	WebsiteID string
+	HTTP      *http.Client
+}
+
+func NewClient(baseURL, apiKey, websiteID string) *Client {
+	return &Client{
+		BaseURL:   baseURL,
+		APIKey:    apiKey,
+		WebsiteID: websiteID,
+		HTTP: &http.Client{
+			Timeout: 10 * time.Second,
+		},
+	}
+}
+
+func (c *Client) Enabled() bool {
+	return c.BaseURL != "" && c.APIKey != "" && c.WebsiteID != ""
+}
+
+func (c *Client) FetchTraffic(ctx context.Context, from, to time.Time) (map[string]any, error) {
+	if !c.Enabled() {
+		return map[string]any{
+			"enabled": false,
+		}, nil
+	}
+
+	u, err := url.Parse(fmt.Sprintf("%s/api/websites/%s/stats", c.BaseURL, c.WebsiteID))
+	if err != nil {
+		return nil, err
+	}
+
+	query := u.Query()
+	query.Set("startAt", fmt.Sprintf("%d", from.UnixMilli()))
+	query.Set("endAt", fmt.Sprintf("%d", to.UnixMilli()))
+	u.RawQuery = query.Encode()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "Bearer "+c.APIKey)
+	req.Header.Set("Accept", "application/json")
+
+	res, err := c.HTTP.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode >= 400 {
+		return nil, fmt.Errorf("umami returned %d", res.StatusCode)
+	}
+
+	var payload map[string]any
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		return nil, err
+	}
+	payload["enabled"] = true
+	return payload, nil
+}

app/backend/internal/api/agents.go

@@ -0,0 +1,832 @@
+package api
+
+import (
+	"crypto/subtle"
+	"fmt"
+	"math"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+// NodeAgent represents a container orchestration agent
+type NodeAgent struct {
+	ID            string                 `json:"id" gorm:"primaryKey"`
+	Name          string                 `json:"name" gorm:"not null"`
+	Hostname      string                 `json:"hostname" gorm:"not null"`
+	IPAddress     string                 `json:"ip_address" gorm:"not null"`
+	Port          int                    `json:"port" gorm:"not null"`
+	Status        string                 `json:"status" gorm:"default:'offline'"`
+	Version       string                 `json:"version"`
+	Capabilities  AgentCapabilities      `json:"capabilities" gorm:"serializer:json"`
+	Resources     NodeResources          `json:"resources" gorm:"serializer:json"`
+	LastHeartbeat time.Time              `json:"last_heartbeat"`
+	CreatedAt     time.Time              `json:"created_at"`
+	UpdatedAt     time.Time              `json:"updated_at"`
+	Metadata      map[string]interface{} `json:"metadata" gorm:"serializer:json"`
+}
+
+// AgentCapabilities defines what the agent can do
+type AgentCapabilities struct {
+	ContainerRuntimes      []string `json:"container_runtimes"`
+	SupportedArchitectures []string `json:"supported_architectures"`
+	MaxContainers          int      `json:"max_containers"`
+	StorageDriver          string   `json:"storage_driver"`
+	NetworkPlugins         []string `json:"network_plugins"`
+	Features               []string `json:"features"`
+}
+
+// NodeResources represents the agent's available resources
+type NodeResources struct {
+	CPU     CPUResources     `json:"cpu"`
+	Memory  MemoryResources  `json:"memory"`
+	Storage StorageResources `json:"storage"`
+	Network NetworkResources `json:"network"`
+}
+
+type CPUResources struct {
+	Cores      int     `json:"cores"`
+	Allocation float64 `json:"allocation"` // percentage
+	Usage      float64 `json:"usage"`      // current usage percentage
+}
+
+type MemoryResources struct {
+	Total     int `json:"total"`
+	Allocated int `json:"allocated"`
+	Used      int `json:"used"`
+	Available int `json:"available"`
+}
+
+type StorageResources struct {
+	Total     int `json:"total"`
+	Allocated int `json:"allocated"`
+	Used      int `json:"used"`
+	Available int `json:"available"`
+}
+
+type NetworkResources struct {
+	Interfaces []NetworkInterface `json:"interfaces"`
+	Bandwidth  BandwidthInfo      `json:"bandwidth"`
+}
+
+type NetworkInterface struct {
+	Name       string `json:"name"`
+	IPAddress  string `json:"ip_address"`
+	MACAddress string `json:"mac_address"`
+	Speed      int    `json:"speed"`
+	Status     string `json:"status"`
+}
+
+type BandwidthInfo struct {
+	Inbound  int `json:"inbound"`  // bytes per second
+	Outbound int `json:"outbound"` // bytes per second
+}
+
+// ContainerInstance represents a container running on an agent
+type ContainerInstance struct {
+	ID            string             `json:"id" gorm:"primaryKey"`
+	Name          string             `json:"name" gorm:"not null"`
+	Image         string             `json:"image" gorm:"not null"`
+	ProjectID     string             `json:"project_id" gorm:"not null"`
+	ServiceID     string             `json:"service_id" gorm:"not null"`
+	NodeAgentID   string             `json:"node_agent_id" gorm:"not null"`
+	Status        ContainerStatus    `json:"status" gorm:"serializer:json"`
+	Resources     ContainerResources `json:"resources" gorm:"serializer:json"`
+	Ports         []PortMapping      `json:"ports" gorm:"serializer:json"`
+	Environment   map[string]string  `json:"environment" gorm:"serializer:json"`
+	Volumes       []VolumeMount      `json:"volumes" gorm:"serializer:json"`
+	Networks      []string           `json:"networks" gorm:"serializer:json"`
+	RestartPolicy RestartPolicy      `json:"restart_policy" gorm:"serializer:json"`
+	HealthCheck   *HealthCheck       `json:"health_check" gorm:"serializer:json"`
+	CreatedAt     time.Time          `json:"created_at"`
+	StartedAt     *time.Time         `json:"started_at"`
+	UpdatedAt     time.Time          `json:"updated_at"`
+}
+
+type ContainerStatus struct {
+	State      string     `json:"state"`
+	Health     string     `json:"health"`
+	ExitCode   *int       `json:"exit_code"`
+	Error      *string    `json:"error"`
+	StartedAt  *time.Time `json:"started_at"`
+	FinishedAt *time.Time `json:"finished_at"`
+}
+
+type ContainerResources struct {
+	CPULimit          int  `json:"cpu_limit"`
+	CPUReservation    int  `json:"cpu_reservation"`
+	MemoryLimit       int  `json:"memory_limit"`
+	MemoryReservation int  `json:"memory_reservation"`
+	DiskLimit         *int `json:"disk_limit"`
+}
+
+type PortMapping struct {
+	ContainerPort int    `json:"container_port"`
+	HostPort      *int   `json:"host_port"`
+	Protocol      string `json:"protocol"`
+	Published     bool   `json:"published"`
+}
+
+type VolumeMount struct {
+	Name     string `json:"name"`
+	Source   string `json:"source"`
+	Target   string `json:"target"`
+	Type     string `json:"type"`
+	ReadOnly bool   `json:"read_only"`
+}
+
+type RestartPolicy struct {
+	Name              string `json:"name"`
+	MaximumRetryCount *int   `json:"maximum_retry_count"`
+}
+
+type HealthCheck struct {
+	Test        []string `json:"test"`
+	Interval    int      `json:"interval"`
+	Timeout     int      `json:"timeout"`
+	Retries     int      `json:"retries"`
+	StartPeriod int      `json:"start_period"`
+}
+
+// AgentCommand represents a command sent to an agent
+type AgentCommand struct {
+	ID          string                 `json:"id" gorm:"primaryKey"`
+	Type        string                 `json:"type" gorm:"not null"`
+	NodeAgentID string                 `json:"node_agent_id" gorm:"not null"`
+	ContainerID *string                `json:"container_id"`
+	Payload     map[string]interface{} `json:"payload" gorm:"serializer:json"`
+	Status      string                 `json:"status" gorm:"default:'pending'"`
+	Result      *string                `json:"result"`
+	Error       *string                `json:"error"`
+	CreatedAt   time.Time              `json:"created_at"`
+	UpdatedAt   time.Time              `json:"updated_at"`
+	CompletedAt *time.Time             `json:"completed_at"`
+}
+
+// AgentHeartbeat represents a heartbeat message from an agent
+type AgentHeartbeat struct {
+	NodeAgentID    string        `json:"node_agent_id"`
+	Timestamp      time.Time     `json:"timestamp"`
+	Status         string        `json:"status"`
+	Resources      NodeResources `json:"resources"`
+	ContainerCount int           `json:"container_count"`
+	SystemLoad     SystemLoad    `json:"system_load"`
+	Uptime         int64         `json:"uptime"`
+	Version        string        `json:"version"`
+}
+
+type AgentHeartbeatRecord struct {
+	ID             string        `json:"id" gorm:"primaryKey"`
+	NodeAgentID    string        `json:"node_agent_id" gorm:"index;not null"`
+	Timestamp      time.Time     `json:"timestamp" gorm:"index;not null"`
+	Status         string        `json:"status"`
+	Resources      NodeResources `json:"resources" gorm:"serializer:json"`
+	ContainerCount int           `json:"container_count"`
+	SystemLoad     SystemLoad    `json:"system_load" gorm:"serializer:json"`
+	Uptime         int64         `json:"uptime"`
+	Version        string        `json:"version"`
+	CreatedAt      time.Time     `json:"created_at"`
+}
+
+type SystemLoad struct {
+	Load1M  float64 `json:"load_1m"`
+	Load5M  float64 `json:"load_5m"`
+	Load15M float64 `json:"load_15m"`
+}
+
+// NodeAgentHandler handles agent-related endpoints
+type NodeAgentHandler struct {
+	db *gorm.DB
+}
+
+func NewNodeAgentHandler(db *gorm.DB) *NodeAgentHandler {
+	return &NodeAgentHandler{db: db}
+}
+
+// RegisterAgent handles agent registration
+func (h *NodeAgentHandler) RegisterAgent(c *gin.Context) {
+	var req struct {
+		Name         string            `json:"name" binding:"required"`
+		Hostname     string            `json:"hostname" binding:"required"`
+		IPAddress    string            `json:"ip_address" binding:"required"`
+		Port         int               `json:"port" binding:"required"`
+		Capabilities AgentCapabilities `json:"capabilities" binding:"required"`
+		AuthToken    string            `json:"auth_token" binding:"required"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if !isValidAgentAuthToken(req.AuthToken) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid auth token"})
+		return
+	}
+
+	// Check if agent already exists
+	var existingAgent NodeAgent
+	if err := h.db.Where("hostname = ? AND ip_address = ?", req.Hostname, req.IPAddress).First(&existingAgent).Error; err == nil {
+		// Update existing agent
+		existingAgent.Name = req.Name
+		existingAgent.Port = req.Port
+		existingAgent.Capabilities = req.Capabilities
+		existingAgent.Status = "connecting"
+		existingAgent.LastHeartbeat = time.Now()
+
+		if err := h.db.Save(&existingAgent).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update agent"})
+			return
+		}
+
+		c.JSON(http.StatusOK, gin.H{
+			"agent_id":   existingAgent.ID,
+			"auth_token": req.AuthToken,
+			"status":     "updated",
+		})
+		return
+	}
+
+	// Create new agent
+	agent := NodeAgent{
+		ID:           uuid.New().String(),
+		Name:         req.Name,
+		Hostname:     req.Hostname,
+		IPAddress:    req.IPAddress,
+		Port:         req.Port,
+		Status:       "connecting",
+		Capabilities: req.Capabilities,
+		Resources: NodeResources{
+			CPU: CPUResources{
+				Cores:      4,
+				Allocation: 0,
+				Usage:      0,
+			},
+			Memory: MemoryResources{
+				Total:     8 * 1024 * 1024 * 1024, // 8GB
+				Allocated: 0,
+				Used:      0,
+				Available: 8 * 1024 * 1024 * 1024,
+			},
+			Storage: StorageResources{
+				Total:     100 * 1024 * 1024 * 1024, // 100GB
+				Allocated: 0,
+				Used:      0,
+				Available: 100 * 1024 * 1024 * 1024,
+			},
+			Network: NetworkResources{
+				Interfaces: []NetworkInterface{
+					{
+						Name:       "eth0",
+						IPAddress:  req.IPAddress,
+						MACAddress: "00:00:00:00:00:00",
+						Speed:      1000,
+						Status:     "up",
+					},
+				},
+				Bandwidth: BandwidthInfo{
+					Inbound:  0,
+					Outbound: 0,
+				},
+			},
+		},
+		LastHeartbeat: time.Now(),
+		CreatedAt:     time.Now(),
+		UpdatedAt:     time.Now(),
+		Metadata:      make(map[string]interface{}),
+	}
+
+	if err := h.db.Create(&agent).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create agent"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{
+		"agent_id":   agent.ID,
+		"auth_token": req.AuthToken,
+		"status":     "registered",
+	})
+}
+
+// GetAgents returns all registered agents
+func (h *NodeAgentHandler) GetAgents(c *gin.Context) {
+	var agents []NodeAgent
+	if err := h.db.Find(&agents).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch agents"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"agents": agents})
+}
+
+// GetAgent returns a specific agent
+func (h *NodeAgentHandler) GetAgent(c *gin.Context) {
+	id := c.Param("id")
+
+	var agent NodeAgent
+	if err := h.db.First(&agent, "id = ?", id).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Agent not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch agent"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"agent": agent})
+}
+
+// UpdateAgent updates an agent's information
+func (h *NodeAgentHandler) UpdateAgent(c *gin.Context) {
+	id := c.Param("id")
+
+	var agent NodeAgent
+	if err := h.db.First(&agent, "id = ?", id).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Agent not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch agent"})
+		return
+	}
+
+	var updates map[string]interface{}
+	if err := c.ShouldBindJSON(&updates); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if err := h.db.Model(&agent).Updates(updates).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update agent"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"agent": agent})
+}
+
+// DeleteAgent removes an agent
+func (h *NodeAgentHandler) DeleteAgent(c *gin.Context) {
+	id := c.Param("id")
+
+	if err := h.db.Delete(&NodeAgent{}, "id = ?", id).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete agent"})
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+// SendHeartbeat handles heartbeat messages from agents
+func (h *NodeAgentHandler) SendHeartbeat(c *gin.Context) {
+	var heartbeat AgentHeartbeat
+	if err := c.ShouldBindJSON(&heartbeat); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if heartbeat.Timestamp.IsZero() {
+		heartbeat.Timestamp = time.Now()
+	}
+
+	var agent NodeAgent
+	if err := h.db.First(&agent, "id = ?", heartbeat.NodeAgentID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Agent not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch agent"})
+		return
+	}
+
+	// Update agent status and resources
+	agent.Status = heartbeat.Status
+	agent.Resources = heartbeat.Resources
+	agent.LastHeartbeat = heartbeat.Timestamp
+	agent.UpdatedAt = time.Now()
+
+	if err := h.db.Save(&agent).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update agent"})
+		return
+	}
+
+	record := AgentHeartbeatRecord{
+		ID:             uuid.New().String(),
+		NodeAgentID:    heartbeat.NodeAgentID,
+		Timestamp:      heartbeat.Timestamp,
+		Status:         heartbeat.Status,
+		Resources:      heartbeat.Resources,
+		ContainerCount: heartbeat.ContainerCount,
+		SystemLoad:     heartbeat.SystemLoad,
+		Uptime:         heartbeat.Uptime,
+		Version:        heartbeat.Version,
+		CreatedAt:      time.Now(),
+	}
+	if err := h.db.Create(&record).Error; err != nil {
+		// Keep heartbeat endpoint available even if history table is not yet migrated.
+		if !isMissingTableError(err) {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to persist heartbeat"})
+			return
+		}
+	}
+
+	c.Status(http.StatusOK)
+}
+
+// GetAgentContainers returns containers running on a specific agent
+func (h *NodeAgentHandler) GetAgentContainers(c *gin.Context) {
+	agentID := c.Param("id")
+
+	var containers []ContainerInstance
+	if err := h.db.Where("node_agent_id = ?", agentID).Find(&containers).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch containers"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"containers": containers})
+}
+
+// CreateContainer creates a new container on an agent
+func (h *NodeAgentHandler) CreateContainer(c *gin.Context) {
+	agentID := c.Param("id")
+
+	var req struct {
+		Name          string             `json:"name" binding:"required"`
+		Image         string             `json:"image" binding:"required"`
+		ProjectID     string             `json:"project_id" binding:"required"`
+		ServiceID     string             `json:"service_id" binding:"required"`
+		Resources     ContainerResources `json:"resources" binding:"required"`
+		Ports         []PortMapping      `json:"ports"`
+		Environment   map[string]string  `json:"environment"`
+		Volumes       []VolumeMount      `json:"volumes"`
+		Networks      []string           `json:"networks"`
+		RestartPolicy RestartPolicy      `json:"restart_policy"`
+		HealthCheck   *HealthCheck       `json:"health_check"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Verify agent exists
+	var agent NodeAgent
+	if err := h.db.First(&agent, "id = ?", agentID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Agent not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch agent"})
+		return
+	}
+
+	container := ContainerInstance{
+		ID:          uuid.New().String(),
+		Name:        req.Name,
+		Image:       req.Image,
+		ProjectID:   req.ProjectID,
+		ServiceID:   req.ServiceID,
+		NodeAgentID: agentID,
+		Status: ContainerStatus{
+			State:  "created",
+			Health: "none",
+		},
+		Resources:     req.Resources,
+		Ports:         req.Ports,
+		Environment:   req.Environment,
+		Volumes:       req.Volumes,
+		Networks:      req.Networks,
+		RestartPolicy: req.RestartPolicy,
+		HealthCheck:   req.HealthCheck,
+		CreatedAt:     time.Now(),
+		UpdatedAt:     time.Now(),
+	}
+
+	if err := h.db.Create(&container).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create container"})
+		return
+	}
+
+	// Create command to start container on agent
+	command := AgentCommand{
+		ID:          uuid.New().String(),
+		Type:        "create_container",
+		NodeAgentID: agentID,
+		ContainerID: &container.ID,
+		Payload: map[string]interface{}{
+			"container": container,
+		},
+		Status:    "pending",
+		CreatedAt: time.Now(),
+		UpdatedAt: time.Now(),
+	}
+
+	if err := h.db.Create(&command).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create container command"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"container": container})
+}
+
+// ExecuteCommand executes a command on an agent
+func (h *NodeAgentHandler) ExecuteCommand(c *gin.Context) {
+	agentID := c.Param("id")
+
+	var req struct {
+		Type    string                 `json:"type" binding:"required"`
+		Payload map[string]interface{} `json:"payload"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	command := AgentCommand{
+		ID:          uuid.New().String(),
+		Type:        req.Type,
+		NodeAgentID: agentID,
+		Payload:     req.Payload,
+		Status:      "pending",
+		CreatedAt:   time.Now(),
+		UpdatedAt:   time.Now(),
+	}
+
+	if err := h.db.Create(&command).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create command"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"command": command})
+}
+
+// GetAgentCommands returns commands for an agent
+func (h *NodeAgentHandler) GetAgentCommands(c *gin.Context) {
+	agentID := c.Param("id")
+
+	var commands []AgentCommand
+	if err := h.db.Where("node_agent_id = ?", agentID).Order("created_at DESC").Find(&commands).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch commands"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"commands": commands})
+}
+
+// GetCommandStatus returns the status of a specific command
+func (h *NodeAgentHandler) GetCommandStatus(c *gin.Context) {
+	agentID := c.Param("id")
+	commandID := c.Param("commandId")
+
+	var command AgentCommand
+	if err := h.db.First(&command, "id = ? AND node_agent_id = ?", commandID, agentID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Command not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch command"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"command": command})
+}
+
+// ContainerAction handles container lifecycle actions
+func (h *NodeAgentHandler) ContainerAction(c *gin.Context) {
+	agentID := c.Param("id")
+	containerID := c.Param("containerId")
+	action := c.Param("action")
+	if action == "" && c.Request.Method == http.MethodDelete {
+		action = "remove"
+	}
+
+	// Validate action
+	validActions := map[string]bool{
+		"start":   true,
+		"stop":    true,
+		"restart": true,
+		"remove":  true,
+	}
+	if !validActions[action] {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid action"})
+		return
+	}
+
+	// Verify container exists
+	var container ContainerInstance
+	if err := h.db.First(&container, "id = ? AND node_agent_id = ?", containerID, agentID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Container not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch container"})
+		return
+	}
+
+	// Create command for the action
+	command := AgentCommand{
+		ID:          uuid.New().String(),
+		Type:        fmt.Sprintf("%s_container", action),
+		NodeAgentID: agentID,
+		ContainerID: &container.ID,
+		Payload: map[string]interface{}{
+			"container_id": containerID,
+		},
+		Status:    "pending",
+		CreatedAt: time.Now(),
+		UpdatedAt: time.Now(),
+	}
+
+	if err := h.db.Create(&command).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create command"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": fmt.Sprintf("Container %s action initiated", action)})
+}
+
+// GetAgentMetrics returns metrics for an agent
+func (h *NodeAgentHandler) GetAgentMetrics(c *gin.Context) {
+	agentID := c.Param("id")
+	timeRange := c.Query("time_range")
+	if timeRange == "" {
+		timeRange = "1h" // default to 1 hour
+	}
+
+	// Parse time range
+	duration, err := time.ParseDuration(timeRange)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid time range"})
+		return
+	}
+
+	if duration <= 0 || duration > 30*24*time.Hour {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "time_range must be between 1s and 720h"})
+		return
+	}
+
+	var agent NodeAgent
+	if err := h.db.First(&agent, "id = ?", agentID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Agent not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch agent"})
+		return
+	}
+
+	from := time.Now().Add(-duration)
+	var records []AgentHeartbeatRecord
+	queryErr := h.db.
+		Where("node_agent_id = ? AND timestamp >= ?", agentID, from).
+		Order("timestamp ASC").
+		Find(&records).Error
+	if queryErr != nil && !isMissingTableError(queryErr) {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch agent metrics"})
+		return
+	}
+
+	metrics := make([]map[string]interface{}, 0, len(records))
+	for _, record := range records {
+		metrics = append(metrics, buildMetricPoint(record.Timestamp, record.Resources, record.SystemLoad, record.ContainerCount))
+	}
+
+	if len(metrics) == 0 {
+		// Fallback to current snapshot when no historical records exist.
+		metrics = append(metrics, buildMetricPoint(
+			nonZeroTime(agent.LastHeartbeat, time.Now()),
+			agent.Resources,
+			SystemLoad{},
+			0,
+		))
+	}
+
+	c.JSON(http.StatusOK, gin.H{"metrics": metrics})
+}
+
+func buildMetricPoint(ts time.Time, resources NodeResources, load SystemLoad, containerCount int) map[string]interface{} {
+	memLimit := maxInt(resources.Memory.Total, 1)
+	memUsagePercent := math.Min(100, (float64(resources.Memory.Used)/float64(memLimit))*100)
+	cpuUsage := resources.CPU.Usage
+	if cpuUsage < 0 {
+		cpuUsage = 0
+	}
+
+	return map[string]interface{}{
+		"timestamp": ts.Format(time.RFC3339),
+		"cpu": map[string]interface{}{
+			"usage":         cpuUsage,
+			"usage_percent": cpuUsage,
+			"cores":         resources.CPU.Cores,
+		},
+		"memory": map[string]interface{}{
+			"usage":         resources.Memory.Used,
+			"usage_percent": memUsagePercent,
+			"limit":         resources.Memory.Total,
+			"available":     resources.Memory.Available,
+		},
+		"system_load": map[string]interface{}{
+			"load_1m":  load.Load1M,
+			"load_5m":  load.Load5M,
+			"load_15m": load.Load15M,
+		},
+		"container_count": containerCount,
+	}
+}
+
+func isValidAgentAuthToken(token string) bool {
+	candidates := configuredAgentAuthTokens()
+	if len(candidates) == 0 {
+		return false
+	}
+
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return false
+	}
+
+	for _, candidate := range candidates {
+		if subtle.ConstantTimeCompare([]byte(token), []byte(candidate)) == 1 {
+			return true
+		}
+	}
+	return false
+}
+
+func configuredAgentAuthTokens() []string {
+	candidateCSV := strings.TrimSpace(os.Getenv("CONTAINR_AGENT_AUTH_TOKENS"))
+	if candidateCSV != "" {
+		parts := strings.Split(candidateCSV, ",")
+		out := make([]string, 0, len(parts))
+		for _, part := range parts {
+			if trimmed := strings.TrimSpace(part); trimmed != "" {
+				out = append(out, trimmed)
+			}
+		}
+		if len(out) > 0 {
+			return out
+		}
+	}
+
+	if single := strings.TrimSpace(os.Getenv("CONTAINR_AGENT_AUTH_TOKEN")); single != "" {
+		return []string{single}
+	}
+
+	if strings.EqualFold(strings.TrimSpace(os.Getenv("ENVIRONMENT")), "production") {
+		return nil
+	}
+
+	// Development fallback for local installs with no explicit secret configured.
+	return []string{"valid-token"}
+}
+
+func isMissingTableError(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "does not exist") && strings.Contains(msg, "agent_heartbeats")
+}
+
+func nonZeroTime(primary, fallback time.Time) time.Time {
+	if primary.IsZero() {
+		return fallback
+	}
+	return primary
+}
+
+func maxInt(a, b int) int {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+// SetupRoutes registers the agent routes
+func (h *NodeAgentHandler) SetupRoutes(router *gin.RouterGroup) {
+	agents := router.Group("/agents")
+	{
+		agents.POST("/register", h.RegisterAgent)
+		agents.GET("", h.GetAgents)
+		agents.GET("/:id", h.GetAgent)
+		agents.PUT("/:id", h.UpdateAgent)
+		agents.DELETE("/:id", h.DeleteAgent)
+		agents.POST("/heartbeat", h.SendHeartbeat)
+
+		agents.GET("/:id/containers", h.GetAgentContainers)
+		agents.POST("/:id/containers", h.CreateContainer)
+		agents.POST("/:id/containers/:containerId/start", h.ContainerAction)
+		agents.POST("/:id/containers/:containerId/stop", h.ContainerAction)
+		agents.POST("/:id/containers/:containerId/restart", h.ContainerAction)
+		agents.DELETE("/:id/containers/:containerId", h.ContainerAction)
+
+		agents.GET("/:id/metrics", h.GetAgentMetrics)
+		agents.POST("/:id/commands", h.ExecuteCommand)
+		agents.GET("/:id/commands", h.GetAgentCommands)
+		agents.GET("/:id/commands/:commandId", h.GetCommandStatus)
+	}
+}

app/backend/internal/api/agents_helpers_test.go

@@ -0,0 +1,59 @@
+package api
+
+import (
+	"testing"
+	"time"
+)
+
+func TestIsValidAgentAuthToken(t *testing.T) {
+	t.Setenv("CONTAINR_AGENT_AUTH_TOKEN", "super-secret")
+	t.Setenv("CONTAINR_AGENT_AUTH_TOKENS", "")
+
+	if !isValidAgentAuthToken("super-secret") {
+		t.Fatalf("expected token to validate")
+	}
+	if isValidAgentAuthToken("wrong-token") {
+		t.Fatalf("expected invalid token to be rejected")
+	}
+}
+
+func TestConfiguredAgentAuthTokensCSV(t *testing.T) {
+	t.Setenv("CONTAINR_AGENT_AUTH_TOKEN", "")
+	t.Setenv("CONTAINR_AGENT_AUTH_TOKENS", "token-a, token-b ,token-c")
+
+	tokens := configuredAgentAuthTokens()
+	if len(tokens) != 3 {
+		t.Fatalf("expected 3 tokens, got %d (%v)", len(tokens), tokens)
+	}
+	if tokens[0] != "token-a" || tokens[1] != "token-b" || tokens[2] != "token-c" {
+		t.Fatalf("unexpected token list: %v", tokens)
+	}
+}
+
+func TestBuildMetricPointComputesPercentages(t *testing.T) {
+	point := buildMetricPoint(
+		time.Now(),
+		NodeResources{
+			CPU: CPUResources{
+				Cores: 4,
+				Usage: 32.5,
+			},
+			Memory: MemoryResources{
+				Total:     1000,
+				Used:      250,
+				Available: 750,
+			},
+		},
+		SystemLoad{Load1M: 1.1, Load5M: 0.9, Load15M: 0.5},
+		3,
+	)
+
+	mem := point["memory"].(map[string]interface{})
+	if mem["usage_percent"].(float64) != 25 {
+		t.Fatalf("expected memory usage percent 25, got %v", mem["usage_percent"])
+	}
+	cpu := point["cpu"].(map[string]interface{})
+	if cpu["usage_percent"].(float64) != 32.5 {
+		t.Fatalf("expected cpu usage percent 32.5, got %v", cpu["usage_percent"])
+	}
+}

app/backend/internal/api/apwhy_handlers.go

@@ -0,0 +1,683 @@
+package api
+
+import (
+	"containr/internal/database"
+	"context"
+	"crypto/rand"
+	"database/sql"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-playground/validator/v10"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Constants for validation and limits
+const (
+	MaxServiceNameLength = 100
+	MaxRoutePrefixLength = 200
+	MaxUpstreamURLLength = 500
+	MaxAPIKeyNameLength  = 100
+	MinAPIKeyLength      = 20
+	MaxAPIKeyLength      = 100
+	DefaultRPMLimit      = 60
+	DefaultMonthlyQuota  = 1000
+	MaxRPMLimit          = 10000
+	MaxMonthlyQuota      = 10000000
+)
+
+// Validator instance for request validation
+var validate = validator.New()
+
+// APIError represents a structured API error response
+type APIError struct {
+	Code    string      `json:"code"`
+	Message string      `json:"message"`
+	Details interface{} `json:"details,omitempty"`
+}
+
+// APIResponse represents a standardized API response
+type APIResponse struct {
+	Success bool        `json:"success"`
+	Data    interface{} `json:"data,omitempty"`
+	Error   *APIError   `json:"error,omitempty"`
+	Meta    *Meta       `json:"meta,omitempty"`
+}
+
+// Meta contains pagination and metadata
+type Meta struct {
+	Page       int `json:"page,omitempty"`
+	PerPage    int `json:"per_page,omitempty"`
+	Total      int `json:"total,omitempty"`
+	TotalPages int `json:"total_pages,omitempty"`
+}
+
+// ServiceRequest represents the request payload for creating/updating services
+type ServiceRequest struct {
+	Name         string `json:"name" binding:"required,max=100" validate:"required,min=1,max=100"`
+	UpstreamURL  string `json:"upstreamUrl" binding:"required,max=500" validate:"required,url,max=500"`
+	RoutePrefix  string `json:"routePrefix" binding:"required,max=200" validate:"required,min=1,max=200"`
+	Enabled      *bool  `json:"enabled,omitempty"`
+	RPMLimit     *int   `json:"rpmLimit,omitempty" validate:"omitempty,min=1,max=10000"`
+	MonthlyQuota *int   `json:"monthlyQuota,omitempty" validate:"omitempty,min=1,max=10000000"`
+}
+
+// APIKeyRequest represents the request payload for creating/updating API keys
+type APIKeyRequest struct {
+	Name         string `json:"name" binding:"required,max=100" validate:"required,min=1,max=100"`
+	Plan         string `json:"plan" validate:"omitempty,oneof=free pro business enterprise"`
+	Enabled      *bool  `json:"enabled,omitempty"`
+	RPMLimit     *int   `json:"rpmLimit,omitempty" validate:"omitempty,min=1,max=10000"`
+	MonthlyQuota *int   `json:"monthlyQuota,omitempty" validate:"omitempty,min=1,max=10000000"`
+}
+
+// generateServiceID generates a cryptographically secure service ID
+func generateServiceID() (string, error) {
+	bytes := make([]byte, 16)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", fmt.Errorf("failed to generate random bytes: %w", err)
+	}
+	return "svc_" + hex.EncodeToString(bytes), nil
+}
+
+// generateAPIKey generates a cryptographically secure API key
+func generateAPIKey() (string, error) {
+	bytes := make([]byte, 32)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", fmt.Errorf("failed to generate random bytes: %w", err)
+	}
+	return "ap_" + hex.EncodeToString(bytes), nil
+}
+
+// hashAPIKey creates a bcrypt hash for the API key
+func hashAPIKey(key string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(key), bcrypt.DefaultCost)
+	if err != nil {
+		return "", fmt.Errorf("failed to hash API key: %w", err)
+	}
+	return string(hash), nil
+}
+
+// validateAPIKeyPlan validates and returns default values for API key plans
+func validateAPIKeyPlan(plan string) (string, int, int, error) {
+	if plan == "" {
+		plan = "free"
+	}
+
+	switch plan {
+	case "free":
+		return plan, 60, 1000, nil
+	case "pro":
+		return plan, 600, 50000, nil
+	case "business":
+		return plan, 3000, 300000, nil
+	case "enterprise":
+		return plan, 10000, 10000000, nil
+	default:
+		return "", 0, 0, fmt.Errorf("invalid plan: %s", plan)
+	}
+}
+
+// sendJSONResponse sends a standardized JSON response
+func sendJSONResponse(c *gin.Context, statusCode int, response APIResponse) {
+	c.JSON(statusCode, response)
+}
+
+// sendErrorResponse sends a standardized error response
+func sendErrorResponse(c *gin.Context, statusCode int, code, message string, details interface{}) {
+	response := APIResponse{
+		Success: false,
+		Error: &APIError{
+			Code:    code,
+			Message: message,
+			Details: details,
+		},
+	}
+	sendJSONResponse(c, statusCode, response)
+}
+
+// sendSuccessResponse sends a standardized success response
+func sendSuccessResponse(c *gin.Context, statusCode int, data interface{}) {
+	response := APIResponse{
+		Success: true,
+		Data:    data,
+	}
+	sendJSONResponse(c, statusCode, response)
+}
+
+// validateRequest validates the request payload using the validator
+func validateRequest(c *gin.Context, req interface{}) error {
+	if err := c.ShouldBindJSON(req); err != nil {
+		return fmt.Errorf("invalid request body: %w", err)
+	}
+
+	if err := validate.Struct(req); err != nil {
+		return fmt.Errorf("validation failed: %w", err)
+	}
+
+	return nil
+}
+
+// handleAPwhyServicesList returns a list of API services
+func handleAPwhyServicesList(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	ctx := context.Background()
+
+	// Query services from database
+	rows, err := db.QueryContext(ctx, `
+		SELECT id, name, slug, upstream_url, route_prefix, enabled, created_at, updated_at
+		FROM api_services 
+		ORDER BY created_at DESC
+	`)
+	if err != nil {
+		sendErrorResponse(c, http.StatusInternalServerError, "DATABASE_ERROR",
+			"Failed to query services", err.Error())
+		return
+	}
+	defer rows.Close()
+
+	var services []map[string]interface{}
+	for rows.Next() {
+		var id, name, slug, upstreamURL, routePrefix, createdAt, updatedAt string
+		var enabled bool
+		err := rows.Scan(&id, &name, &slug, &upstreamURL, &routePrefix, &enabled, &createdAt, &updatedAt)
+		if err != nil {
+			continue // Skip malformed rows
+		}
+
+		services = append(services, map[string]interface{}{
+			"id":          id,
+			"name":        name,
+			"slug":        slug,
+			"upstreamUrl": upstreamURL,
+			"routePrefix": routePrefix,
+			"enabled":     enabled,
+			"createdAt":   createdAt,
+			"updatedAt":   updatedAt,
+		})
+	}
+
+	sendSuccessResponse(c, http.StatusOK, map[string]interface{}{
+		"services": services,
+		"count":    len(services),
+	})
+}
+
+// handleAPwhyServicesCreate creates a new API service
+func handleAPwhyServicesCreate(c *gin.Context) {
+	var req ServiceRequest
+
+	if err := validateRequest(c, &req); err != nil {
+		sendErrorResponse(c, http.StatusBadRequest, "VALIDATION_ERROR",
+			"Invalid request parameters", err.Error())
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	ctx := context.Background()
+
+	// Generate slug and ID
+	id, err := generateServiceID()
+	if err != nil {
+		sendErrorResponse(c, http.StatusInternalServerError, "GENERATION_ERROR",
+			"Failed to generate service ID", err.Error())
+		return
+	}
+
+	slug := strings.ToLower(strings.ReplaceAll(req.Name, " ", "-"))
+
+	// Insert service into database
+	query := `
+		INSERT INTO api_services (
+			id, name, slug, upstream_url, route_prefix, health_path,
+			enabled, rpm_limit, monthly_quota, created_at, updated_at
+		) VALUES ($1, $2, $3, $4, $5, '/health', true, $6, $7, NOW(), NOW())
+	`
+
+	var rpmLimit, monthlyQuota int
+	if req.RPMLimit != nil {
+		rpmLimit = *req.RPMLimit
+	} else {
+		rpmLimit = DefaultRPMLimit
+	}
+
+	if req.MonthlyQuota != nil {
+		monthlyQuota = *req.MonthlyQuota
+	} else {
+		monthlyQuota = DefaultMonthlyQuota
+	}
+
+	_, err = db.ExecContext(ctx, query, id, req.Name, slug, req.UpstreamURL,
+		req.RoutePrefix, rpmLimit, monthlyQuota)
+
+	if err != nil {
+		sendErrorResponse(c, http.StatusInternalServerError, "DATABASE_ERROR",
+			"Failed to create service", err.Error())
+		return
+	}
+
+	serviceData := map[string]interface{}{
+		"id":           id,
+		"name":         req.Name,
+		"slug":         slug,
+		"upstreamUrl":  req.UpstreamURL,
+		"routePrefix":  req.RoutePrefix,
+		"enabled":      true,
+		"rpmLimit":     rpmLimit,
+		"monthlyQuota": monthlyQuota,
+		"createdAt":    time.Now().UTC().Format(time.RFC3339),
+	}
+
+	sendSuccessResponse(c, http.StatusCreated, map[string]interface{}{
+		"service": serviceData,
+		"message": "Service created successfully",
+	})
+}
+
+// handleAPwhyServicesPatch updates an existing API service
+func handleAPwhyServicesPatch(c *gin.Context) {
+	serviceID := c.Param("id")
+
+	var input struct {
+		Enabled *bool `json:"enabled"`
+	}
+
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"ok":    false,
+			"error": "Invalid input: " + err.Error(),
+		})
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+
+	if input.Enabled != nil {
+		_, err := db.ExecContext(context.Background(),
+			"UPDATE api_services SET enabled = $1, updated_at = NOW() WHERE id = $2",
+			*input.Enabled, serviceID)
+
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{
+				"ok":    false,
+				"error": "Failed to update service: " + err.Error(),
+			})
+			return
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"ok":   true,
+		"data": gin.H{"id": serviceID, "updated": true},
+	})
+}
+
+// handleAPwhyKeysList returns a list of API keys
+func handleAPwhyKeysList(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+
+	rows, err := db.QueryContext(context.Background(), `
+		SELECT id, name, key_prefix, plan, enabled, rpm_limit, monthly_quota, created_at, updated_at
+		FROM api_keys 
+		ORDER BY created_at DESC
+	`)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"ok":   true,
+			"data": []interface{}{},
+		})
+		return
+	}
+	defer rows.Close()
+
+	var keys []map[string]interface{}
+	for rows.Next() {
+		var id, name, keyPrefix, plan, createdAt, updatedAt string
+		var enabled bool
+		var rpmLimit, monthlyQuota sql.NullInt64
+
+		err := rows.Scan(&id, &name, &keyPrefix, &plan, &enabled, &rpmLimit, &monthlyQuota, &createdAt, &updatedAt)
+		if err != nil {
+			continue
+		}
+
+		key := map[string]interface{}{
+			"id":        id,
+			"name":      name,
+			"keyPrefix": keyPrefix,
+			"plan":      plan,
+			"enabled":   enabled,
+			"createdAt": createdAt,
+			"updatedAt": updatedAt,
+		}
+
+		if rpmLimit.Valid {
+			key["rpmLimit"] = rpmLimit.Int64
+		}
+		if monthlyQuota.Valid {
+			key["monthlyQuota"] = monthlyQuota.Int64
+		}
+
+		keys = append(keys, key)
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"ok":   true,
+		"data": keys,
+	})
+}
+
+// handleAPwhyKeysCreate creates a new API key
+func handleAPwhyKeysCreate(c *gin.Context) {
+	var input struct {
+		Name string `json:"name" binding:"required"`
+		Plan string `json:"plan"`
+	}
+
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"ok":    false,
+			"error": "Invalid input: " + err.Error(),
+		})
+		return
+	}
+
+	if input.Plan == "" {
+		input.Plan = "free"
+	}
+
+	db := c.MustGet("db").(*database.DB)
+
+	// Generate API key and hash
+	apiKey, err := generateAPIKey()
+	if err != nil {
+		sendErrorResponse(c, http.StatusInternalServerError, "GENERATION_ERROR",
+			"Failed to generate API key", err.Error())
+		return
+	}
+
+	keyHash, err := hashAPIKey(apiKey)
+	if err != nil {
+		sendErrorResponse(c, http.StatusInternalServerError, "HASH_ERROR",
+			"Failed to hash API key", err.Error())
+		return
+	}
+
+	// Generate ID and prefix
+	id, err := generateServiceID()
+	if err != nil {
+		sendErrorResponse(c, http.StatusInternalServerError, "GENERATION_ERROR",
+			"Failed to generate key ID", err.Error())
+		return
+	}
+
+	keyPrefix := apiKey[:8]
+
+	// Set default limits based on plan
+	var rpmLimit, monthlyQuota int
+	switch input.Plan {
+	case "free":
+		rpmLimit, monthlyQuota = 60, 1000
+	case "pro":
+		rpmLimit, monthlyQuota = 600, 50000
+	case "business":
+		rpmLimit, monthlyQuota = 3000, 300000
+	default:
+		rpmLimit, monthlyQuota = 60, 1000
+	}
+
+	// Insert key into database
+	_, err = db.ExecContext(context.Background(), `
+		INSERT INTO api_keys (
+			id, name, key_hash, key_prefix, plan, allowed_service_ids,
+			enabled, rpm_limit, monthly_quota, created_at, updated_at
+		) VALUES ($1, $2, $3, $4, $5, '[]', true, $6, $7, NOW(), NOW())
+	`, id, input.Name, keyHash, keyPrefix, input.Plan, rpmLimit, monthlyQuota)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"ok":    false,
+			"error": "Failed to create key: " + err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{
+		"ok": true,
+		"data": gin.H{
+			"id":           id,
+			"name":         input.Name,
+			"plan":         input.Plan,
+			"key":          apiKey, // Only return the actual key once
+			"keyPrefix":    keyPrefix,
+			"enabled":      true,
+			"rpmLimit":     rpmLimit,
+			"monthlyQuota": monthlyQuota,
+		},
+	})
+}
+
+// handleAPwhyKeysPatch updates an existing API key
+func handleAPwhyKeysPatch(c *gin.Context) {
+	keyID := c.Param("id")
+
+	var input struct {
+		Enabled *bool `json:"enabled"`
+	}
+
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"ok":    false,
+			"error": "Invalid input: " + err.Error(),
+		})
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+
+	if input.Enabled != nil {
+		_, err := db.ExecContext(context.Background(),
+			"UPDATE api_keys SET enabled = $1, updated_at = NOW() WHERE id = $2",
+			*input.Enabled, keyID)
+
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{
+				"ok":    false,
+				"error": "Failed to update key: " + err.Error(),
+			})
+			return
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"ok":   true,
+		"data": gin.H{"id": keyID, "updated": true},
+	})
+}
+
+// handleAPwhyAnalyticsOps returns operational analytics
+func handleAPwhyAnalyticsOps(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+
+	// Get counts from database
+	var totalServices, totalKeys, totalUsers int
+
+	if err := db.QueryRowContext(context.Background(), "SELECT COUNT(*) FROM api_services").Scan(&totalServices); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"ok":    false,
+			"error": "Failed to count services: " + err.Error(),
+		})
+		return
+	}
+	if err := db.QueryRowContext(context.Background(), "SELECT COUNT(*) FROM api_keys").Scan(&totalKeys); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"ok":    false,
+			"error": "Failed to count api keys: " + err.Error(),
+		})
+		return
+	}
+	if err := db.QueryRowContext(context.Background(), "SELECT COUNT(*) FROM users").Scan(&totalUsers); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"ok":    false,
+			"error": "Failed to count users: " + err.Error(),
+		})
+		return
+	}
+
+	var totalRequests int
+	if err := db.QueryRowContext(context.Background(), "SELECT COALESCE(SUM(request_count), 0) FROM usage_counters").Scan(&totalRequests); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"ok":    false,
+			"error": "Failed to aggregate request counters: " + err.Error(),
+		})
+		return
+	}
+
+	var requestsToday int
+	if err := db.QueryRowContext(context.Background(), `
+		SELECT COALESCE(SUM(value), 0)::int
+		FROM metrics_timeseries
+		WHERE metric = 'request_total' AND occurred_at >= DATE_TRUNC('day', NOW())
+	`).Scan(&requestsToday); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"ok":    false,
+			"error": "Failed to aggregate today's requests: " + err.Error(),
+		})
+		return
+	}
+
+	var requestsThisMonth int
+	if err := db.QueryRowContext(context.Background(), `
+		SELECT COALESCE(SUM(value), 0)::int
+		FROM metrics_timeseries
+		WHERE metric = 'request_total' AND occurred_at >= DATE_TRUNC('month', NOW())
+	`).Scan(&requestsThisMonth); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"ok":    false,
+			"error": "Failed to aggregate monthly requests: " + err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"ok": true,
+		"data": gin.H{
+			"total_requests":      totalRequests,
+			"total_services":      totalServices,
+			"total_keys":          totalKeys,
+			"total_users":         totalUsers,
+			"requests_today":      requestsToday,
+			"requests_this_month": requestsThisMonth,
+		},
+	})
+}
+
+// handleAPwhyAnalyticsTraffic returns traffic analytics
+func handleAPwhyAnalyticsTraffic(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+
+	topServices := make([]map[string]interface{}, 0)
+	serviceRows, err := db.QueryContext(context.Background(), `
+		SELECT s.id, s.name, COALESCE(SUM(u.request_count), 0) AS total_requests
+		FROM api_services s
+		LEFT JOIN usage_counters u ON u.service_id = s.id
+		GROUP BY s.id, s.name
+		ORDER BY total_requests DESC, s.name ASC
+		LIMIT 10
+	`)
+	if err == nil {
+		defer serviceRows.Close()
+		for serviceRows.Next() {
+			var serviceID, serviceName string
+			var totalRequests int
+			if scanErr := serviceRows.Scan(&serviceID, &serviceName, &totalRequests); scanErr == nil {
+				topServices = append(topServices, map[string]interface{}{
+					"service_id": serviceID,
+					"name":       serviceName,
+					"requests":   totalRequests,
+				})
+			}
+		}
+	}
+
+	requestsByDay := make([]map[string]interface{}, 0)
+	trafficRows, err := db.QueryContext(context.Background(), `
+		SELECT TO_CHAR(DATE_TRUNC('day', occurred_at), 'YYYY-MM-DD') AS day_bucket, COUNT(*) AS total
+		FROM metrics_timeseries
+		WHERE metric = 'request_total' AND occurred_at >= NOW() - INTERVAL '7 days'
+		GROUP BY DATE_TRUNC('day', occurred_at)
+		ORDER BY DATE_TRUNC('day', occurred_at) ASC
+	`)
+	if err == nil {
+		defer trafficRows.Close()
+		for trafficRows.Next() {
+			var day string
+			var count int
+			if scanErr := trafficRows.Scan(&day, &count); scanErr == nil {
+				requestsByDay = append(requestsByDay, map[string]interface{}{
+					"day":      day,
+					"requests": count,
+				})
+			}
+		}
+	}
+
+	statusCodes := make([]map[string]interface{}, 0)
+	statusRows, err := db.QueryContext(context.Background(), `
+		SELECT COALESCE(http_status, 0) AS status_code, COALESCE(SUM(count), 0) AS total
+		FROM incident_events
+		WHERE occurred_at >= NOW() - INTERVAL '7 days'
+		GROUP BY COALESCE(http_status, 0)
+		ORDER BY total DESC, status_code ASC
+	`)
+	if err == nil {
+		defer statusRows.Close()
+		for statusRows.Next() {
+			var code int
+			var total int
+			if scanErr := statusRows.Scan(&code, &total); scanErr == nil {
+				statusCodes = append(statusCodes, map[string]interface{}{
+					"status_code": code,
+					"count":       total,
+				})
+			}
+		}
+	}
+
+	clientEvents := make([]map[string]interface{}, 0)
+	eventRows, err := db.QueryContext(context.Background(), `
+		SELECT COALESCE((labels_json::jsonb ->> 'path'), 'unknown') AS path, COUNT(*) AS total
+		FROM metrics_timeseries
+		WHERE metric = 'client_event' AND occurred_at >= NOW() - INTERVAL '7 days'
+		GROUP BY COALESCE((labels_json::jsonb ->> 'path'), 'unknown')
+		ORDER BY total DESC, path ASC
+		LIMIT 20
+	`)
+	if err == nil {
+		defer eventRows.Close()
+		for eventRows.Next() {
+			var path string
+			var total int
+			if scanErr := eventRows.Scan(&path, &total); scanErr == nil {
+				clientEvents = append(clientEvents, map[string]interface{}{
+					"path":  path,
+					"count": total,
+				})
+			}
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"ok": true,
+		"data": gin.H{
+			"top_services":    topServices,
+			"requests_by_day": requestsByDay,
+			"status_codes":    statusCodes,
+			"client_events":   clientEvents,
+		},
+	})
+}

app/backend/internal/api/audit.go

@@ -0,0 +1,211 @@
+package api
+
+import (
+	"containr/internal/database"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type AuditLog struct {
+	ID         string    `json:"id" db:"id"`
+	UserID     string    `json:"user_id" db:"user_id"`
+	UserEmail  string    `json:"user_email,omitempty" db:"user_email"`
+	Resource   string    `json:"resource" db:"resource"`
+	ResourceID string    `json:"resource_id" db:"resource_id"`
+	Action     string    `json:"action" db:"action"`
+	Details    string    `json:"details" db:"details"`
+	IPAddress  string    `json:"ip_address" db:"ip_address"`
+	UserAgent  string    `json:"user_agent" db:"user_agent"`
+	CreatedAt  time.Time `json:"created_at" db:"created_at"`
+}
+
+type AuditLogDetail struct {
+	OldValue  interface{} `json:"old_value,omitempty"`
+	NewValue  interface{} `json:"new_value,omitempty"`
+	Message   string      `json:"message,omitempty"`
+	Timestamp time.Time   `json:"timestamp"`
+}
+
+func LogAudit(userID, resource, resourceID, action string, details map[string]interface{}) {
+	db := GetAuditDB()
+	if db == nil {
+		return
+	}
+
+	detailsJSON, _ := json.Marshal(details)
+	resourceUUID := parseUUIDOrNil(resourceID)
+	userUUID := parseUUIDOrNil(userID)
+
+	auditID := uuid.New().String()
+	_, err := db.Exec(
+		`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, created_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+		auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), time.Now().UTC(),
+	)
+
+	if err != nil {
+	}
+}
+
+func LogAuditWithRequest(c *gin.Context, resource, resourceID, action string, details map[string]interface{}) {
+	userID, _ := c.Get("user_id")
+
+	details["ip_address"] = c.ClientIP()
+	details["user_agent"] = c.GetHeader("User-Agent")
+
+	detailsJSON, _ := json.Marshal(details)
+
+	db := c.MustGet("db").(*database.DB)
+	userIDStr := ""
+	if uid, ok := userID.(string); ok {
+		userIDStr = uid
+	}
+	userUUID := parseUUIDOrNil(userIDStr)
+	resourceUUID := parseUUIDOrNil(resourceID)
+
+	auditID := uuid.New().String()
+	_, err := db.Exec(
+		`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, ip_address, user_agent, created_at)
+		 VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9)`,
+		auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), c.ClientIP(), c.GetHeader("User-Agent"), time.Now().UTC(),
+	)
+
+	if err != nil {
+	}
+}
+
+var auditDB *database.DB
+
+func GetAuditDB() *database.DB {
+	return auditDB
+}
+
+func SetAuditDB(db *database.DB) {
+	auditDB = db
+}
+
+func handleGetAuditLogs(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	userID := c.MustGet("user_id").(string)
+
+	resource := strings.TrimSpace(c.Query("resource"))
+	action := strings.TrimSpace(c.Query("action"))
+	page := parsePositiveInt(c.DefaultQuery("page", "1"), 1)
+	limit := parsePositiveInt(c.DefaultQuery("limit", "50"), 50)
+	if limit > 500 {
+		limit = 500
+	}
+	offset := (page - 1) * limit
+
+	conditions := []string{"user_id::text = $1"}
+	args := []interface{}{userID}
+	nextArg := 2
+
+	if resource != "" {
+		conditions = append(conditions, fmt.Sprintf("resource = $%d", nextArg))
+		args = append(args, resource)
+		nextArg++
+	}
+	if action != "" {
+		conditions = append(conditions, fmt.Sprintf("action = $%d", nextArg))
+		args = append(args, action)
+		nextArg++
+	}
+
+	whereClause := strings.Join(conditions, " AND ")
+	query := fmt.Sprintf(`SELECT
+		id,
+		COALESCE(user_id::text, ''),
+		resource,
+		COALESCE(resource_id::text, ''),
+		action,
+		COALESCE(details::text, '{}'),
+		COALESCE(ip_address::text, ''),
+		COALESCE(user_agent, ''),
+		created_at
+		FROM audit_logs
+		WHERE %s
+		ORDER BY created_at DESC
+		LIMIT $%d OFFSET $%d`, whereClause, nextArg, nextArg+1)
+	args = append(args, limit, offset)
+
+	rows, err := db.Query(query, args...)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch audit logs"})
+		return
+	}
+	defer rows.Close()
+
+	var logs []AuditLog
+	for rows.Next() {
+		var log AuditLog
+		err := rows.Scan(&log.ID, &log.UserID, &log.Resource, &log.ResourceID, &log.Action, &log.Details, &log.IPAddress, &log.UserAgent, &log.CreatedAt)
+		if err != nil {
+			continue
+		}
+		logs = append(logs, log)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"audit_logs": logs})
+}
+
+func handleGetResourceAuditLogs(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	userID := c.MustGet("user_id").(string)
+	resource := c.Param("resource")
+	resourceID := c.Param("id")
+
+	rows, err := db.Query(
+		`SELECT id, COALESCE(user_id::text, ''), resource, COALESCE(resource_id::text, ''), action, COALESCE(details::text, '{}'),
+		        COALESCE(ip_address::text, ''), COALESCE(user_agent, ''), created_at 
+		 FROM audit_logs 
+		 WHERE user_id::text = $1 AND resource = $2 AND resource_id::text = $3 
+		 ORDER BY created_at DESC 
+		 LIMIT 100`,
+		userID, resource, resourceID,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch audit logs"})
+		return
+	}
+	defer rows.Close()
+
+	var logs []AuditLog
+	for rows.Next() {
+		var log AuditLog
+		err := rows.Scan(&log.ID, &log.UserID, &log.Resource, &log.ResourceID, &log.Action, &log.Details, &log.IPAddress, &log.UserAgent, &log.CreatedAt)
+		if err != nil {
+			continue
+		}
+		logs = append(logs, log)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"audit_logs": logs})
+}
+
+func parsePositiveInt(raw string, fallback int) int {
+	v, err := strconv.Atoi(strings.TrimSpace(raw))
+	if err != nil || v <= 0 {
+		return fallback
+	}
+	return v
+}
+
+func parseUUIDOrNil(raw string) interface{} {
+	trimmed := strings.TrimSpace(raw)
+	if trimmed == "" {
+		return nil
+	}
+	if _, err := uuid.Parse(trimmed); err != nil {
+		return nil
+	}
+	return trimmed
+}

app/backend/internal/api/audit_test.go

@@ -0,0 +1,46 @@
+package api
+
+import "testing"
+
+func TestParsePositiveInt(t *testing.T) {
+	cases := []struct {
+		name     string
+		input    string
+		fallback int
+		want     int
+	}{
+		{name: "valid number", input: "25", fallback: 10, want: 25},
+		{name: "zero falls back", input: "0", fallback: 10, want: 10},
+		{name: "negative falls back", input: "-5", fallback: 10, want: 10},
+		{name: "invalid falls back", input: "abc", fallback: 10, want: 10},
+		{name: "trim whitespace", input: "  3 ", fallback: 10, want: 3},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := parsePositiveInt(tc.input, tc.fallback)
+			if got != tc.want {
+				t.Fatalf("parsePositiveInt(%q, %d) = %d, want %d", tc.input, tc.fallback, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestParseUUIDOrNil(t *testing.T) {
+	if got := parseUUIDOrNil(""); got != nil {
+		t.Fatalf("expected nil for empty input, got %#v", got)
+	}
+	if got := parseUUIDOrNil("invalid"); got != nil {
+		t.Fatalf("expected nil for invalid uuid, got %#v", got)
+	}
+
+	validID := "7c9e6679-7425-40de-944b-e07fc1f90ae7"
+	got := parseUUIDOrNil(validID)
+	gotStr, ok := got.(string)
+	if !ok {
+		t.Fatalf("expected string for valid uuid, got %#v", got)
+	}
+	if gotStr != validID {
+		t.Fatalf("expected %q, got %q", validID, gotStr)
+	}
+}

app/backend/internal/api/auth.go

@@ -0,0 +1,220 @@
+package api
+
+import (
+	"containr/internal/database"
+	"database/sql"
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type LoginRequest struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required,min=6"`
+}
+
+type RegisterRequest struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required,min=6"`
+	Name     string `json:"name" binding:"required,min=2"`
+}
+
+type AuthResponse struct {
+	Token string      `json:"token"`
+	User  interface{} `json:"user"`
+}
+
+type User struct {
+	ID        string `json:"id"`
+	Email     string `json:"email"`
+	Name      string `json:"name"`
+	AvatarURL string `json:"avatar_url,omitempty"`
+	CreatedAt string `json:"created_at"`
+}
+
+func handleLogin(c *gin.Context) {
+	var req LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	jwtSecret := c.MustGet("jwt_secret").(string)
+
+	// Find user by email
+	var user User
+	var hashedPassword string
+	err := db.QueryRow(`
+		SELECT id, email, password_hash, name, COALESCE(avatar_url, ''), created_at 
+		FROM users 
+		WHERE email = $1
+	`, req.Email).Scan(&user.ID, &user.Email, &hashedPassword, &user.Name, &user.AvatarURL, &user.CreatedAt)
+
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid credentials"})
+		return
+	} else if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+
+	// Check password
+	if err := bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(req.Password)); err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid credentials"})
+		return
+	}
+
+	// Generate JWT token
+	token, err := generateJWT(user.ID, user.Email, jwtSecret)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate token"})
+		return
+	}
+
+	c.JSON(http.StatusOK, AuthResponse{
+		Token: token,
+		User:  user,
+	})
+}
+
+func handleRegister(c *gin.Context) {
+	var req RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	jwtSecret := c.MustGet("jwt_secret").(string)
+
+	// Check if user already exists
+	var count int
+	err := db.QueryRow("SELECT COUNT(*) FROM users WHERE email = $1", req.Email).Scan(&count)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+
+	if count > 0 {
+		c.JSON(http.StatusConflict, gin.H{"error": "User already exists"})
+		return
+	}
+
+	// Hash password
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to hash password"})
+		return
+	}
+
+	// Create user
+	var user User
+	err = db.QueryRow(`
+		INSERT INTO users (email, password_hash, name) 
+		VALUES ($1, $2, $3) 
+		RETURNING id, email, name, COALESCE(avatar_url, ''), created_at
+	`, req.Email, string(hashedPassword), req.Name).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create user"})
+		return
+	}
+
+	// Generate JWT token
+	token, err := generateJWT(user.ID, user.Email, jwtSecret)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate token"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, AuthResponse{
+		Token: token,
+		User:  user,
+	})
+}
+
+func handleGetProfile(c *gin.Context) {
+	userID := c.MustGet("user_id").(string)
+	db := c.MustGet("db").(*database.DB)
+
+	var user User
+	err := db.QueryRow(`
+		SELECT id, email, name, COALESCE(avatar_url, ''), created_at 
+		FROM users 
+		WHERE id = $1
+	`, userID).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
+		return
+	} else if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+
+	c.JSON(http.StatusOK, user)
+}
+
+func handleUpdateProfile(c *gin.Context) {
+	userID := c.MustGet("user_id").(string)
+	db := c.MustGet("db").(*database.DB)
+
+	var req struct {
+		Name      string `json:"name,omitempty"`
+		AvatarURL string `json:"avatar_url,omitempty"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Update user profile
+	_, err := db.Exec(`
+		UPDATE users 
+		SET name = COALESCE($1, name), avatar_url = COALESCE($2, avatar_url)
+		WHERE id = $3
+	`, req.Name, req.AvatarURL, userID)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update profile"})
+		return
+	}
+
+	// Return updated user
+	handleGetProfile(c)
+}
+
+func generateJWT(userID, email, secret string) (string, error) {
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"user_id": userID,
+		"email":   email,
+		"exp":     time.Now().Add(time.Hour * 24 * 7).Unix(), // 7 days
+	})
+
+	return token.SignedString([]byte(secret))
+}
+
+// ValidateJWT validates a JWT token and returns the claims
+func ValidateJWT(tokenString, secret string) (jwt.MapClaims, error) {
+	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, jwt.ErrSignatureInvalid
+		}
+		return []byte(secret), nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
+		return claims, nil
+	}
+
+	return nil, jwt.ErrInvalidKey
+}

app/backend/internal/api/auth_proxy.go

@@ -0,0 +1,55 @@
+package api
+
+import (
+	"log"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+
+	"containr/internal/config"
+
+	"github.com/gin-gonic/gin"
+)
+
+func setupAuthProxyRoutes(router *gin.Engine, cfg *config.Config) {
+	targetURL, err := parseAuthProxyTarget(cfg.BetterAuthProxyURL)
+	if err != nil {
+		log.Printf("Warning: auth proxy disabled: %v", err)
+		return
+	}
+
+	proxy := httputil.NewSingleHostReverseProxy(targetURL)
+	proxy.ErrorHandler = func(writer http.ResponseWriter, request *http.Request, proxyErr error) {
+		log.Printf("Auth proxy error: %v", proxyErr)
+		writer.Header().Set("Content-Type", "application/json")
+		writer.WriteHeader(http.StatusBadGateway)
+		_, _ = writer.Write([]byte(`{"error":"Auth service unavailable"}`))
+	}
+
+	handler := func(c *gin.Context) {
+		proxy.ServeHTTP(c.Writer, c.Request)
+		c.Abort()
+	}
+
+	router.Any("/api/auth", handler)
+	router.Any("/api/auth/*proxyPath", handler)
+}
+
+func parseAuthProxyTarget(rawTarget string) (*url.URL, error) {
+	trimmed := strings.TrimSpace(rawTarget)
+	if trimmed == "" {
+		trimmed = "http://127.0.0.1:3001"
+	}
+
+	targetURL, err := url.Parse(trimmed)
+	if err != nil {
+		return nil, err
+	}
+
+	if targetURL.Scheme == "" || targetURL.Host == "" {
+		return nil, url.InvalidHostError(trimmed)
+	}
+
+	return targetURL, nil
+}

app/backend/internal/api/build.go

@@ -0,0 +1,943 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"containr/internal/build"
+	"containr/internal/database"
+	"containr/internal/docker"
+	"containr/internal/types"
+
+	"github.com/gin-gonic/gin"
+)
+
+// BuildHandler handles build-related API endpoints
+type BuildHandler struct {
+	buildManager *build.BuildManager
+	dockerClient *docker.Client
+	db           *database.DB
+
+	mu         sync.RWMutex
+	builds     map[string]*BuildStatusResponse
+	buildOrder []string
+	cancels    map[string]context.CancelFunc
+	idCounter  atomic.Uint64
+}
+
+var errBuildsTableMissing = errors.New("builds table missing")
+
+func (h *BuildHandler) buildUnavailable(c *gin.Context) bool {
+	if h.buildManager != nil {
+		return false
+	}
+
+	c.JSON(http.StatusServiceUnavailable, gin.H{
+		"error": "Build service is unavailable: Docker client not initialized",
+	})
+	return true
+}
+
+// NewBuildHandler creates a new build handler
+func NewBuildHandler(buildManager *build.BuildManager, dockerClient *docker.Client, db *database.DB) *BuildHandler {
+	return &BuildHandler{
+		buildManager: buildManager,
+		dockerClient: dockerClient,
+		db:           db,
+		builds:       make(map[string]*BuildStatusResponse),
+		cancels:      make(map[string]context.CancelFunc),
+	}
+}
+
+// BuildRequest represents the request body for starting a build
+type BuildRequest struct {
+	BuildType     string            `json:"build_type"`
+	SourcePath    string            `json:"source_path"`
+	PrebuiltImage string            `json:"prebuilt_image"`
+	ImageName     string            `json:"image_name" binding:"required"`
+	ImageTag      string            `json:"image_tag" binding:"required"`
+	RegistryURL   string            `json:"registry_url"`
+	BuildCommand  string            `json:"build_command"`
+	StartCommand  string            `json:"start_command"`
+	Environment   map[string]string `json:"environment"`
+	BuildArgs     map[string]string `json:"build_args"`
+	Labels        map[string]string `json:"labels"`
+	ProjectID     string            `json:"project_id"`
+	ServiceID     string            `json:"service_id"`
+	Branch        string            `json:"branch"`
+	Commit        string            `json:"commit"`
+}
+
+// BuildResponse represents the response for a build operation
+type BuildResponse struct {
+	ID        string    `json:"id"`
+	Status    string    `json:"status"`
+	ImageName string    `json:"image_name"`
+	ImageTag  string    `json:"image_tag"`
+	Size      int64     `json:"size"`
+	Digest    string    `json:"digest"`
+	BuildTime time.Time `json:"build_time"`
+	Success   bool      `json:"success"`
+	Error     string    `json:"error,omitempty"`
+}
+
+// BuildStatusResponse represents the response for build status
+type BuildStatusResponse struct {
+	ID          string            `json:"id"`
+	ProjectID   string            `json:"project_id"`
+	ServiceID   string            `json:"service_id"`
+	Status      string            `json:"status"`
+	Progress    int               `json:"progress"`
+	StartedAt   time.Time         `json:"started_at"`
+	CompletedAt *time.Time        `json:"completed_at,omitempty"`
+	ImageName   string            `json:"image_name"`
+	ImageTag    string            `json:"image_tag"`
+	Size        int64             `json:"size"`
+	Error       string            `json:"error,omitempty"`
+	Log         string            `json:"log"`
+	Metadata    map[string]string `json:"metadata"`
+}
+
+// BuildListResponse represents the response for listing builds
+type BuildListResponse struct {
+	Builds []BuildStatusResponse `json:"builds"`
+	Total  int                   `json:"total"`
+	Page   int                   `json:"page"`
+	Limit  int                   `json:"limit"`
+}
+
+// StartBuild starts a new build
+// @Summary Start a build
+// @Description Starts a new build process for the given configuration
+// @Tags builds
+// @Accept json
+// @Produce json
+// @Param request body BuildRequest true "Build request"
+// @Success 201 {object} BuildResponse
+// @Failure 400 {object} map[string]string
+// @Failure 500 {object} map[string]string
+// @Router /api/v1/builds [post]
+func (h *BuildHandler) StartBuild(c *gin.Context) {
+	if h.buildUnavailable(c) {
+		return
+	}
+
+	var req BuildRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Convert to internal build request
+	buildReq := &types.BuildRequest{
+		BuildType:     req.BuildType,
+		SourcePath:    req.SourcePath,
+		PrebuiltImage: req.PrebuiltImage,
+		ImageName:     req.ImageName,
+		ImageTag:      req.ImageTag,
+		RegistryURL:   req.RegistryURL,
+		BuildCommand:  req.BuildCommand,
+		StartCommand:  req.StartCommand,
+		Environment:   req.Environment,
+		BuildArgs:     req.BuildArgs,
+		Labels:        req.Labels,
+		ProjectID:     req.ProjectID,
+		ServiceID:     req.ServiceID,
+		TriggeredBy:   "api",
+		Branch:        req.Branch,
+		Commit:        req.Commit,
+	}
+
+	// Validate build request
+	if err := h.buildManager.ValidateBuildRequest(c.Request.Context(), buildReq); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	buildID := h.nextBuildID()
+	now := time.Now().UTC()
+	initial := &BuildStatusResponse{
+		ID:        buildID,
+		ProjectID: req.ProjectID,
+		ServiceID: req.ServiceID,
+		Status:    "pending",
+		Progress:  0,
+		StartedAt: now,
+		ImageName: req.ImageName,
+		ImageTag:  req.ImageTag,
+		Log:       h.formatLogLine("Build queued"),
+		Metadata: map[string]string{
+			"build_type": req.BuildType,
+			"branch":     req.Branch,
+			"commit":     req.Commit,
+		},
+	}
+	h.storeBuild(initial)
+	if err := h.upsertBuild(initial); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to persist build"})
+		return
+	}
+	BroadcastBuildUpdate(buildID, cloneBuildStatus(*initial))
+	h.runBuildAsync(buildID, buildReq)
+
+	c.JSON(http.StatusCreated, BuildResponse{
+		ID:        buildID,
+		Status:    "pending",
+		ImageName: req.ImageName,
+		ImageTag:  req.ImageTag,
+		BuildTime: now,
+		Success:   true,
+	})
+}
+
+// GetBuildStatus gets the status of a build
+// @Summary Get build status
+// @Description Gets the current status of a build
+// @Tags builds
+// @Produce json
+// @Param id path string true "Build ID"
+// @Success 200 {object} BuildStatusResponse
+// @Failure 404 {object} map[string]string
+// @Failure 500 {object} map[string]string
+// @Router /api/v1/builds/{id} [get]
+func (h *BuildHandler) GetBuildStatus(c *gin.Context) {
+	buildID := c.Param("id")
+	status, found := h.getBuild(buildID)
+	if !found {
+		dbStatus, dbFound, err := h.getBuildFromDB(buildID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to retrieve build"})
+			return
+		}
+		if dbFound {
+			status = dbStatus
+			found = true
+		}
+	}
+	if !found {
+		c.JSON(http.StatusNotFound, gin.H{"error": "build not found"})
+		return
+	}
+	c.JSON(http.StatusOK, status)
+}
+
+// ListBuilds lists all builds
+// @Summary List builds
+// @Description Lists all builds with optional filtering
+// @Tags builds
+// @Produce json
+// @Param project_id query string false "Filter by project ID"
+// @Param service_id query string false "Filter by service ID"
+// @Param status query string false "Filter by status"
+// @Param page query int false "Page number" default(1)
+// @Param limit query int false "Items per page" default(20)
+// @Success 200 {object} BuildListResponse
+// @Failure 500 {object} map[string]string
+// @Router /api/v1/builds [get]
+func (h *BuildHandler) ListBuilds(c *gin.Context) {
+	projectID := c.Query("project_id")
+	serviceID := c.Query("service_id")
+	status := c.Query("status")
+
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	if page < 1 {
+		page = 1
+	}
+	if limit < 1 {
+		limit = 20
+	}
+	if limit > 100 {
+		limit = 100
+	}
+	builds, total := h.listBuilds(projectID, serviceID, status, page, limit)
+	if h.db != nil {
+		dbBuilds, dbTotal, err := h.listBuildsFromDB(projectID, serviceID, status, page, limit)
+		if err != nil {
+			if !errors.Is(err, errBuildsTableMissing) {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list builds"})
+				return
+			}
+		} else {
+			builds = dbBuilds
+			total = dbTotal
+		}
+	}
+	c.JSON(http.StatusOK, BuildListResponse{
+		Builds: builds,
+		Total:  total,
+		Page:   page,
+		Limit:  limit,
+	})
+}
+
+// CancelBuild cancels a running build
+// @Summary Cancel build
+// @Description Cancels a running build
+// @Tags builds
+// @Produce json
+// @Param id path string true "Build ID"
+// @Success 200 {object} map[string]string
+// @Failure 404 {object} map[string]string
+// @Failure 500 {object} map[string]string
+// @Router /api/v1/builds/{id}/cancel [post]
+func (h *BuildHandler) CancelBuild(c *gin.Context) {
+	buildID := c.Param("id")
+	status, found := h.getBuild(buildID)
+	if !found {
+		dbStatus, dbFound, err := h.getBuildFromDB(buildID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to retrieve build"})
+			return
+		}
+		if dbFound {
+			status = dbStatus
+			found = true
+		}
+	}
+	if !found {
+		c.JSON(http.StatusNotFound, gin.H{"error": "build not found"})
+		return
+	}
+	if h.isTerminalState(status.Status) {
+		c.JSON(http.StatusConflict, gin.H{"error": "build is already finished"})
+		return
+	}
+
+	cancelled := h.cancelBuild(buildID)
+	if !cancelled {
+		c.JSON(http.StatusConflict, gin.H{"error": "build is not cancellable"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Build " + buildID + " cancelled",
+	})
+}
+
+// GetBuildLogs gets the logs for a build
+// @Summary Get build logs
+// @Description Gets the build logs for a specific build
+// @Tags builds
+// @Produce text
+// @Param id path string true "Build ID"
+// @Param follow query bool false "Follow logs" default(false)
+// @Success 200 {string} string "Build logs"
+// @Failure 404 {object} map[string]string
+// @Failure 500 {object} map[string]string
+// @Router /api/v1/builds/{id}/logs [get]
+func (h *BuildHandler) GetBuildLogs(c *gin.Context) {
+	buildID := c.Param("id")
+	follow := c.DefaultQuery("follow", "false") == "true"
+	status, found := h.getBuild(buildID)
+	if !found {
+		dbStatus, dbFound, err := h.getBuildFromDB(buildID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to retrieve build logs"})
+			return
+		}
+		if dbFound {
+			status = dbStatus
+			found = true
+		}
+	}
+	if !found {
+		c.JSON(http.StatusNotFound, gin.H{"error": "build not found"})
+		return
+	}
+	logs := status.Log
+
+	if follow {
+		// In production, this would use Server-Sent Events to stream logs
+		c.Header("Content-Type", "text/plain")
+		c.String(http.StatusOK, logs)
+	} else {
+		c.Header("Content-Type", "text/plain")
+		c.String(http.StatusOK, logs)
+	}
+}
+
+// GetBuildPlan gets the build plan for a service
+// @Summary Get build plan
+// @Description Gets the build plan for a service without actually building
+// @Tags builds
+// @Produce json
+// @Param request body BuildRequest true "Build request"
+// @Success 200 {object} build.BuildPlan
+// @Failure 400 {object} map[string]string
+// @Failure 500 {object} map[string]string
+// @Router /api/v1/builds/plan [post]
+func (h *BuildHandler) GetBuildPlan(c *gin.Context) {
+	if h.buildUnavailable(c) {
+		return
+	}
+
+	var req BuildRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Convert to internal build request
+	buildReq := &types.BuildRequest{
+		BuildType:     req.BuildType,
+		SourcePath:    req.SourcePath,
+		PrebuiltImage: req.PrebuiltImage,
+		ImageName:     req.ImageName,
+		ImageTag:      req.ImageTag,
+		BuildCommand:  req.BuildCommand,
+		StartCommand:  req.StartCommand,
+		Environment:   req.Environment,
+		BuildArgs:     req.BuildArgs,
+		Labels:        req.Labels,
+	}
+
+	// Get build plan
+	plan, err := h.buildManager.GetBuildPlan(c.Request.Context(), buildReq)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, plan)
+}
+
+// DetectBuildType detects the build type for a given repository
+// @Summary Detect build type
+// @Description Detects the build type based on repository contents
+// @Tags builds
+// @Produce json
+// @Param source_path query string true "Source path"
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string
+// @Failure 500 {object} map[string]string
+// @Router /api/v1/builds/detect [get]
+func (h *BuildHandler) DetectBuildType(c *gin.Context) {
+	if h.buildUnavailable(c) {
+		return
+	}
+
+	sourcePath := c.Query("source_path")
+	if sourcePath == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "source_path is required"})
+		return
+	}
+
+	buildType, err := h.buildManager.DetectBuildType(c.Request.Context(), sourcePath)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"build_type": string(buildType),
+	})
+}
+
+func (h *BuildHandler) nextBuildID() string {
+	sequence := h.idCounter.Add(1)
+	return fmt.Sprintf("build-%d-%d", time.Now().UTC().UnixNano(), sequence)
+}
+
+func (h *BuildHandler) runBuildAsync(buildID string, req *types.BuildRequest) {
+	ctx, cancel := context.WithCancel(context.Background())
+	h.mu.Lock()
+	h.cancels[buildID] = cancel
+	h.mu.Unlock()
+
+	go func() {
+		defer h.removeCancel(buildID)
+
+		h.updateBuild(buildID, func(status *BuildStatusResponse) {
+			if status.Status == "cancelled" {
+				return
+			}
+			status.Status = "running"
+			status.Progress = 10
+			status.Log = h.appendLog(status.Log, h.formatLogLine("Build started"))
+		})
+
+		buildCtx, timeoutCancel := context.WithTimeout(ctx, 30*time.Minute)
+		defer timeoutCancel()
+
+		response, err := h.buildManager.Build(buildCtx, req)
+		completedAt := time.Now().UTC()
+
+		h.updateBuild(buildID, func(status *BuildStatusResponse) {
+			// Cancellation is authoritative even if a build eventually returns.
+			if status.Status == "cancelled" {
+				status.CompletedAt = &completedAt
+				status.Progress = 100
+				if err == nil {
+					status.Log = h.appendLog(status.Log, h.formatLogLine("Build completed after cancellation request; result ignored"))
+				}
+				return
+			}
+
+			status.CompletedAt = &completedAt
+			status.Progress = 100
+
+			if err != nil {
+				if errors.Is(err, context.Canceled) || errors.Is(buildCtx.Err(), context.Canceled) {
+					status.Status = "cancelled"
+					status.Log = h.appendLog(status.Log, h.formatLogLine("Build cancelled"))
+					return
+				}
+
+				status.Status = "failed"
+				status.Error = err.Error()
+				status.Log = h.appendLog(status.Log, h.formatLogLine("Build failed: "+err.Error()))
+				return
+			}
+
+			status.Status = "success"
+			status.ImageName = response.ImageName
+			status.ImageTag = response.ImageTag
+			status.Size = response.Size
+			if response.Error != "" {
+				status.Error = response.Error
+			}
+			if response.BuildLog != "" {
+				status.Log = h.appendLog(status.Log, strings.TrimSpace(response.BuildLog))
+			}
+			status.Log = h.appendLog(status.Log, h.formatLogLine("Build completed successfully"))
+		})
+	}()
+}
+
+func (h *BuildHandler) storeBuild(status *BuildStatusResponse) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	cloned := cloneBuildStatus(*status)
+	h.builds[status.ID] = &cloned
+	h.buildOrder = append(h.buildOrder, status.ID)
+}
+
+func (h *BuildHandler) updateBuild(buildID string, update func(status *BuildStatusResponse)) bool {
+	var snapshot BuildStatusResponse
+
+	h.mu.Lock()
+	status, exists := h.builds[buildID]
+	if !exists {
+		h.mu.Unlock()
+		return false
+	}
+	update(status)
+	snapshot = cloneBuildStatus(*status)
+	h.mu.Unlock()
+
+	if err := h.upsertBuild(&snapshot); err != nil {
+		log.Printf("failed to persist build %s: %v", buildID, err)
+	}
+	BroadcastBuildUpdate(buildID, snapshot)
+	return true
+}
+
+func (h *BuildHandler) getBuild(buildID string) (BuildStatusResponse, bool) {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+
+	status, exists := h.builds[buildID]
+	if !exists {
+		return BuildStatusResponse{}, false
+	}
+	cloned := cloneBuildStatus(*status)
+	return cloned, true
+}
+
+func (h *BuildHandler) listBuilds(projectID, serviceID, statusFilter string, page, limit int) ([]BuildStatusResponse, int) {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+
+	filtered := make([]BuildStatusResponse, 0, len(h.buildOrder))
+	for i := len(h.buildOrder) - 1; i >= 0; i-- {
+		id := h.buildOrder[i]
+		status := h.builds[id]
+		if status == nil {
+			continue
+		}
+		if projectID != "" && status.ProjectID != projectID {
+			continue
+		}
+		if serviceID != "" && status.ServiceID != serviceID {
+			continue
+		}
+		if statusFilter != "" && status.Status != statusFilter {
+			continue
+		}
+		filtered = append(filtered, cloneBuildStatus(*status))
+	}
+
+	total := len(filtered)
+	start := (page - 1) * limit
+	if start >= total {
+		return []BuildStatusResponse{}, total
+	}
+	end := start + limit
+	if end > total {
+		end = total
+	}
+	return filtered[start:end], total
+}
+
+func (h *BuildHandler) cancelBuild(buildID string) bool {
+	var cancel context.CancelFunc
+	var snapshot BuildStatusResponse
+
+	h.mu.Lock()
+	status, exists := h.builds[buildID]
+	if !exists {
+		h.mu.Unlock()
+		return h.cancelBuildInDB(buildID)
+	}
+	if h.isTerminalState(status.Status) {
+		h.mu.Unlock()
+		return false
+	}
+	cancel = h.cancels[buildID]
+	status.Status = "cancelled"
+	status.Progress = 100
+	now := time.Now().UTC()
+	status.CompletedAt = &now
+	status.Log = h.appendLog(status.Log, h.formatLogLine("Cancellation requested"))
+	snapshot = cloneBuildStatus(*status)
+	h.mu.Unlock()
+
+	if cancel != nil {
+		cancel()
+	}
+	if err := h.upsertBuild(&snapshot); err != nil {
+		log.Printf("failed to persist cancelled build %s: %v", buildID, err)
+	}
+	BroadcastBuildUpdate(buildID, snapshot)
+	return true
+}
+
+func (h *BuildHandler) removeCancel(buildID string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	delete(h.cancels, buildID)
+}
+
+func (h *BuildHandler) isTerminalState(state string) bool {
+	switch state {
+	case "success", "failed", "cancelled":
+		return true
+	default:
+		return false
+	}
+}
+
+func (h *BuildHandler) appendLog(log, message string) string {
+	msg := strings.TrimSpace(message)
+	if msg == "" {
+		return log
+	}
+	if log == "" {
+		return msg + "\n"
+	}
+	return log + msg + "\n"
+}
+
+func (h *BuildHandler) formatLogLine(message string) string {
+	return fmt.Sprintf("[%s] %s", time.Now().UTC().Format(time.RFC3339), message)
+}
+
+func (h *BuildHandler) upsertBuild(status *BuildStatusResponse) error {
+	if h.db == nil {
+		return nil
+	}
+
+	var metadataRaw []byte
+	if status.Metadata != nil {
+		encoded, err := json.Marshal(status.Metadata)
+		if err != nil {
+			return fmt.Errorf("marshal metadata: %w", err)
+		}
+		metadataRaw = encoded
+	}
+
+	now := time.Now().UTC()
+	_, err := h.db.Exec(
+		`INSERT INTO builds
+		 (id, project_id, service_id, status, progress, started_at, completed_at, image_name, image_tag, size, error, log, metadata, created_at, updated_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14, $14)
+		 ON CONFLICT (id) DO UPDATE SET
+		   project_id = EXCLUDED.project_id,
+		   service_id = EXCLUDED.service_id,
+		   status = EXCLUDED.status,
+		   progress = EXCLUDED.progress,
+		   started_at = EXCLUDED.started_at,
+		   completed_at = EXCLUDED.completed_at,
+		   image_name = EXCLUDED.image_name,
+		   image_tag = EXCLUDED.image_tag,
+		   size = EXCLUDED.size,
+		   error = EXCLUDED.error,
+		   log = EXCLUDED.log,
+		   metadata = EXCLUDED.metadata,
+		   updated_at = EXCLUDED.updated_at`,
+		status.ID,
+		nullIfEmptyString(status.ProjectID),
+		nullIfEmptyString(status.ServiceID),
+		status.Status,
+		status.Progress,
+		status.StartedAt,
+		status.CompletedAt,
+		status.ImageName,
+		status.ImageTag,
+		status.Size,
+		nullIfEmptyString(status.Error),
+		status.Log,
+		jsonOrEmptyObject(metadataRaw),
+		now,
+	)
+	if err != nil && h.isMissingBuildsTable(err) {
+		return nil
+	}
+	return err
+}
+
+func (h *BuildHandler) getBuildFromDB(buildID string) (BuildStatusResponse, bool, error) {
+	if h.db == nil {
+		return BuildStatusResponse{}, false, nil
+	}
+
+	row := h.db.QueryRow(
+		`SELECT id, project_id, service_id, status, progress, started_at, completed_at, image_name, image_tag, size, error, log, metadata
+		 FROM builds
+		 WHERE id = $1`,
+		buildID,
+	)
+
+	build, found, err := scanBuildRow(row.Scan)
+	if err != nil && h.isMissingBuildsTable(err) {
+		return BuildStatusResponse{}, false, nil
+	}
+	return build, found, err
+}
+
+func (h *BuildHandler) listBuildsFromDB(projectID, serviceID, status string, page, limit int) ([]BuildStatusResponse, int, error) {
+	if h.db == nil {
+		return nil, 0, nil
+	}
+
+	args := []interface{}{}
+	filters := []string{}
+	nextArg := 1
+	if projectID != "" {
+		filters = append(filters, fmt.Sprintf("project_id = $%d", nextArg))
+		args = append(args, projectID)
+		nextArg++
+	}
+	if serviceID != "" {
+		filters = append(filters, fmt.Sprintf("service_id = $%d", nextArg))
+		args = append(args, serviceID)
+		nextArg++
+	}
+	if status != "" {
+		filters = append(filters, fmt.Sprintf("status = $%d", nextArg))
+		args = append(args, status)
+		nextArg++
+	}
+
+	whereClause := ""
+	if len(filters) > 0 {
+		whereClause = " WHERE " + strings.Join(filters, " AND ")
+	}
+
+	var total int
+	countQuery := "SELECT COUNT(*) FROM builds" + whereClause
+	if err := h.db.QueryRow(countQuery, args...).Scan(&total); err != nil {
+		if h.isMissingBuildsTable(err) {
+			return nil, 0, errBuildsTableMissing
+		}
+		return nil, 0, err
+	}
+
+	offset := (page - 1) * limit
+	args = append(args, limit, offset)
+	query := fmt.Sprintf(
+		`SELECT id, project_id, service_id, status, progress, started_at, completed_at, image_name, image_tag, size, error, log, metadata
+		 FROM builds%s
+		 ORDER BY created_at DESC
+		 LIMIT $%d OFFSET $%d`,
+		whereClause,
+		nextArg,
+		nextArg+1,
+	)
+
+	rows, err := h.db.Query(query, args...)
+	if err != nil {
+		if h.isMissingBuildsTable(err) {
+			return nil, 0, errBuildsTableMissing
+		}
+		return nil, 0, err
+	}
+	defer rows.Close()
+
+	builds := make([]BuildStatusResponse, 0, limit)
+	for rows.Next() {
+		build, found, err := scanBuildRow(rows.Scan)
+		if err != nil {
+			return nil, 0, err
+		}
+		if found {
+			builds = append(builds, build)
+		}
+	}
+	if err := rows.Err(); err != nil {
+		return nil, 0, err
+	}
+
+	return builds, total, nil
+}
+
+func (h *BuildHandler) cancelBuildInDB(buildID string) bool {
+	if h.db == nil {
+		return false
+	}
+	now := time.Now().UTC()
+	result, err := h.db.Exec(
+		`UPDATE builds
+		 SET status = 'cancelled',
+		     progress = 100,
+		     completed_at = $1,
+		     log = COALESCE(log, '') || $2,
+		     updated_at = $1
+		 WHERE id = $3
+		   AND status NOT IN ('success', 'failed', 'cancelled')`,
+		now,
+		h.formatLogLine("Cancellation requested")+"\n",
+		buildID,
+	)
+	if err != nil {
+		if h.isMissingBuildsTable(err) {
+			return false
+		}
+		log.Printf("failed to cancel build %s in database: %v", buildID, err)
+		return false
+	}
+
+	affected, err := result.RowsAffected()
+	if err != nil || affected == 0 {
+		return false
+	}
+
+	dbBuild, found, err := h.getBuildFromDB(buildID)
+	if err == nil && found {
+		BroadcastBuildUpdate(buildID, dbBuild)
+	}
+	return true
+}
+
+func scanBuildRow(scan func(dest ...interface{}) error) (BuildStatusResponse, bool, error) {
+	var (
+		id          string
+		projectID   sql.NullString
+		serviceID   sql.NullString
+		status      string
+		progress    int
+		startedAt   sql.NullTime
+		completedAt sql.NullTime
+		imageName   string
+		imageTag    string
+		size        int64
+		errText     sql.NullString
+		logText     string
+		metadataRaw []byte
+	)
+
+	err := scan(
+		&id,
+		&projectID,
+		&serviceID,
+		&status,
+		&progress,
+		&startedAt,
+		&completedAt,
+		&imageName,
+		&imageTag,
+		&size,
+		&errText,
+		&logText,
+		&metadataRaw,
+	)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return BuildStatusResponse{}, false, nil
+		}
+		return BuildStatusResponse{}, false, err
+	}
+
+	parsed := BuildStatusResponse{
+		ID:        id,
+		ProjectID: projectID.String,
+		ServiceID: serviceID.String,
+		Status:    status,
+		Progress:  progress,
+		StartedAt: startedAt.Time.UTC(),
+		ImageName: imageName,
+		ImageTag:  imageTag,
+		Size:      size,
+		Error:     errText.String,
+		Log:       logText,
+	}
+	if completedAt.Valid {
+		t := completedAt.Time.UTC()
+		parsed.CompletedAt = &t
+	}
+	if !startedAt.Valid {
+		parsed.StartedAt = time.Time{}
+	}
+	if len(metadataRaw) > 0 {
+		metadata := map[string]string{}
+		if err := json.Unmarshal(metadataRaw, &metadata); err == nil {
+			parsed.Metadata = metadata
+		}
+	}
+	return parsed, true, nil
+}
+
+func nullIfEmptyString(value string) interface{} {
+	trimmed := strings.TrimSpace(value)
+	if trimmed == "" {
+		return nil
+	}
+	return trimmed
+}
+
+func jsonOrEmptyObject(raw []byte) string {
+	if len(raw) == 0 {
+		return "{}"
+	}
+	return string(raw)
+}
+
+func (h *BuildHandler) isMissingBuildsTable(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(strings.ToLower(err.Error()), `relation "builds" does not exist`)
+}
+
+func cloneBuildStatus(status BuildStatusResponse) BuildStatusResponse {
+	cloned := status
+	if status.Metadata != nil {
+		cloned.Metadata = make(map[string]string, len(status.Metadata))
+		for k, v := range status.Metadata {
+			cloned.Metadata[k] = v
+		}
+	}
+	return cloned
+}

app/backend/internal/api/build_test.go

@@ -0,0 +1,135 @@
+package api
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestBuildHandlerGetBuildReturnsClone(t *testing.T) {
+	handler := NewBuildHandler(nil, nil, nil)
+	handler.storeBuild(&BuildStatusResponse{
+		ID:        "build-1",
+		ProjectID: "proj-1",
+		Status:    "pending",
+		StartedAt: time.Now().UTC(),
+		Metadata: map[string]string{
+			"branch": "main",
+		},
+	})
+
+	got, ok := handler.getBuild("build-1")
+	if !ok {
+		t.Fatalf("expected build to exist")
+	}
+
+	got.Metadata["branch"] = "feature-x"
+	reloaded, ok := handler.getBuild("build-1")
+	if !ok {
+		t.Fatalf("expected build to still exist")
+	}
+
+	if reloaded.Metadata["branch"] != "main" {
+		t.Fatalf("expected metadata clone behavior, got %q", reloaded.Metadata["branch"])
+	}
+}
+
+func TestBuildHandlerListBuildsFilterAndPagination(t *testing.T) {
+	handler := NewBuildHandler(nil, nil, nil)
+	now := time.Now().UTC()
+
+	handler.storeBuild(&BuildStatusResponse{
+		ID:        "build-1",
+		ProjectID: "proj-1",
+		ServiceID: "svc-1",
+		Status:    "success",
+		StartedAt: now.Add(-3 * time.Minute),
+	})
+	handler.storeBuild(&BuildStatusResponse{
+		ID:        "build-2",
+		ProjectID: "proj-1",
+		ServiceID: "svc-2",
+		Status:    "running",
+		StartedAt: now.Add(-2 * time.Minute),
+	})
+	handler.storeBuild(&BuildStatusResponse{
+		ID:        "build-3",
+		ProjectID: "proj-2",
+		ServiceID: "svc-1",
+		Status:    "failed",
+		StartedAt: now.Add(-1 * time.Minute),
+	})
+
+	filtered, total := handler.listBuilds("proj-1", "", "", 1, 10)
+	if total != 2 {
+		t.Fatalf("expected total 2, got %d", total)
+	}
+	if len(filtered) != 2 {
+		t.Fatalf("expected 2 builds on page, got %d", len(filtered))
+	}
+	if filtered[0].ID != "build-2" {
+		t.Fatalf("expected newest first (build-2), got %s", filtered[0].ID)
+	}
+
+	page1, total := handler.listBuilds("", "", "", 1, 2)
+	if total != 3 {
+		t.Fatalf("expected total 3, got %d", total)
+	}
+	if len(page1) != 2 {
+		t.Fatalf("expected first page length 2, got %d", len(page1))
+	}
+	if page1[0].ID != "build-3" || page1[1].ID != "build-2" {
+		t.Fatalf("unexpected first page order: %s, %s", page1[0].ID, page1[1].ID)
+	}
+
+	page2, _ := handler.listBuilds("", "", "", 2, 2)
+	if len(page2) != 1 || page2[0].ID != "build-1" {
+		t.Fatalf("unexpected second page: %+v", page2)
+	}
+}
+
+func TestBuildHandlerCancelBuild(t *testing.T) {
+	handler := NewBuildHandler(nil, nil, nil)
+	handler.storeBuild(&BuildStatusResponse{
+		ID:        "build-1",
+		Status:    "running",
+		StartedAt: time.Now().UTC(),
+	})
+
+	cancelled := false
+	handler.cancels["build-1"] = func() {
+		cancelled = true
+	}
+
+	if ok := handler.cancelBuild("build-1"); !ok {
+		t.Fatalf("expected cancelBuild to succeed")
+	}
+	if !cancelled {
+		t.Fatalf("expected context cancel to be called")
+	}
+
+	build, ok := handler.getBuild("build-1")
+	if !ok {
+		t.Fatalf("expected build to exist")
+	}
+	if build.Status != "cancelled" {
+		t.Fatalf("expected status cancelled, got %s", build.Status)
+	}
+	if build.CompletedAt == nil {
+		t.Fatalf("expected completed_at to be set")
+	}
+}
+
+func TestBuildHandlerCancelBuildTerminalState(t *testing.T) {
+	handler := NewBuildHandler(nil, nil, nil)
+	handler.storeBuild(&BuildStatusResponse{
+		ID:        "build-1",
+		Status:    "success",
+		StartedAt: time.Now().UTC(),
+	})
+	handler.cancels["build-1"] = context.CancelFunc(func() {})
+
+	if ok := handler.cancelBuild("build-1"); ok {
+		t.Fatalf("expected cancelBuild to reject terminal state")
+	}
+}

app/backend/internal/api/context_user.go

@@ -0,0 +1,23 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+func requireAuthenticatedUserID(c *gin.Context) (string, bool) {
+	userIDValue, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return "", false
+	}
+
+	userID, ok := userIDValue.(string)
+	if !ok || userID == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
+		return "", false
+	}
+
+	return userID, true
+}

app/backend/internal/api/cron.go

@@ -0,0 +1,416 @@
+package api
+
+import (
+	"containr/internal/database"
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type CronJob struct {
+	ID         string     `json:"id" db:"id"`
+	ProjectID  string     `json:"project_id" db:"project_id"`
+	ServiceID  string     `json:"service_id" db:"service_id"`
+	Name       string     `json:"name" db:"name"`
+	Schedule   string     `json:"schedule" db:"schedule"`
+	Command    string     `json:"command" db:"command"`
+	Timezone   string     `json:"timezone" db:"timezone"`
+	Enabled    bool       `json:"enabled" db:"enabled"`
+	LastRunAt  *time.Time `json:"last_run_at" db:"last_run_at"`
+	NextRunAt  *time.Time `json:"next_run_at" db:"next_run_at"`
+	LastStatus string     `json:"last_status" db:"last_status"`
+	LastOutput string     `json:"last_output" db:"last_output"`
+	Retention  int        `json:"retention" db:"retention"`
+	CreatedAt  time.Time  `json:"created_at" db:"created_at"`
+	UpdatedAt  time.Time  `json:"updated_at" db:"updated_at"`
+}
+
+type CronExecution struct {
+	ID         string     `json:"id" db:"id"`
+	CronJobID  string     `json:"cron_job_id" db:"cron_job_id"`
+	StartedAt  time.Time  `json:"started_at" db:"started_at"`
+	FinishedAt *time.Time `json:"finished_at" db:"finished_at"`
+	Status     string     `json:"status" db:"status"`
+	Output     string     `json:"output" db:"output"`
+	Error      string     `json:"error" db:"error"`
+}
+
+type CreateCronJobRequest struct {
+	ProjectID string `json:"project_id" binding:"required"`
+	ServiceID string `json:"service_id" binding:"required"`
+	Name      string `json:"name" binding:"required"`
+	Schedule  string `json:"schedule" binding:"required"`
+	Command   string `json:"command" binding:"required"`
+	Timezone  string `json:"timezone"`
+	Enabled   bool   `json:"enabled"`
+	Retention int    `json:"retention"`
+}
+
+type UpdateCronJobRequest struct {
+	Name      string `json:"name"`
+	Schedule  string `json:"schedule"`
+	Command   string `json:"command"`
+	Timezone  string `json:"timezone"`
+	Enabled   *bool  `json:"enabled"`
+	Retention int    `json:"retention"`
+}
+
+func handleGetCronJobs(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	userID := c.MustGet("user_id").(string)
+	projectID := c.Query("project_id")
+
+	query := `SELECT cj.id, cj.project_id, cj.service_id, cj.name, cj.schedule, cj.timezone, 
+	          cj.enabled, cj.last_run_at, cj.next_run_at, cj.last_status, cj.last_output, 
+	          cj.retention, cj.created_at, cj.updated_at
+	          FROM cron_jobs cj
+	          JOIN projects p ON cj.project_id = p.id
+	          WHERE p.owner_id = $1`
+	args := []interface{}{userID}
+
+	if projectID != "" {
+		query += " AND cj.project_id = $2"
+		args = append(args, projectID)
+	}
+
+	query += " ORDER BY cj.created_at DESC"
+
+	rows, err := db.Query(query, args...)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch cron jobs"})
+		return
+	}
+	defer rows.Close()
+
+	var jobs []CronJob
+	for rows.Next() {
+		var job CronJob
+		err := rows.Scan(&job.ID, &job.ProjectID, &job.ServiceID, &job.Name, &job.Schedule, &job.Timezone,
+			&job.Enabled, &job.LastRunAt, &job.NextRunAt, &job.LastStatus, &job.LastOutput,
+			&job.Retention, &job.CreatedAt, &job.UpdatedAt)
+		if err != nil {
+			continue
+		}
+		jobs = append(jobs, job)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"cron_jobs": jobs})
+}
+
+func handleCreateCronJob(c *gin.Context) {
+	userID := c.MustGet("user_id").(string)
+	db := c.MustGet("db").(*database.DB)
+
+	var req CreateCronJobRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	var ownerCheck string
+	err := db.QueryRow(
+		`SELECT p.owner_id FROM projects p 
+		 JOIN services s ON s.project_id = p.id 
+		 WHERE s.id = $1`,
+		req.ServiceID,
+	).Scan(&ownerCheck)
+
+	if err != nil || ownerCheck != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	if req.Timezone == "" {
+		req.Timezone = "UTC"
+	}
+	if req.Retention == 0 {
+		req.Retention = 30
+	}
+
+	nextRun := calculateNextRun(req.Schedule, req.Timezone)
+
+	job := CronJob{
+		ID:        uuid.New().String(),
+		ProjectID: req.ProjectID,
+		ServiceID: req.ServiceID,
+		Name:      req.Name,
+		Schedule:  req.Schedule,
+		Command:   req.Command,
+		Timezone:  req.Timezone,
+		Enabled:   req.Enabled,
+		NextRunAt: nextRun,
+		Retention: req.Retention,
+		CreatedAt: time.Now(),
+		UpdatedAt: time.Now(),
+	}
+
+	_, err = db.Exec(
+		`INSERT INTO cron_jobs (id, project_id, service_id, name, schedule, command, timezone, enabled, next_run_at, retention, created_at, updated_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`,
+		job.ID, job.ProjectID, job.ServiceID, job.Name, job.Schedule, job.Command, job.Timezone, job.Enabled, job.NextRunAt, job.Retention, job.CreatedAt, job.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create cron job"})
+		return
+	}
+
+	LogAudit(userID, "cron_job", job.ID, "create", map[string]interface{}{
+		"name":     job.Name,
+		"schedule": job.Schedule,
+	})
+
+	c.JSON(http.StatusCreated, gin.H{"cron_job": job})
+}
+
+func handleGetCronJob(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	userID := c.MustGet("user_id").(string)
+	jobID := c.Param("id")
+
+	var job CronJob
+	var ownerCheck string
+	err := db.QueryRow(
+		`SELECT cj.id, cj.project_id, cj.service_id, cj.name, cj.schedule, cj.timezone, 
+		        cj.enabled, cj.last_run_at, cj.next_run_at, cj.last_status, cj.last_output, 
+		        cj.retention, cj.created_at, cj.updated_at, p.owner_id
+		 FROM cron_jobs cj
+		 JOIN projects p ON cj.project_id = p.id
+		 WHERE cj.id = $1`,
+		jobID,
+	).Scan(&job.ID, &job.ProjectID, &job.ServiceID, &job.Name, &job.Schedule, &job.Timezone,
+		&job.Enabled, &job.LastRunAt, &job.NextRunAt, &job.LastStatus, &job.LastOutput,
+		&job.Retention, &job.CreatedAt, &job.UpdatedAt, &ownerCheck)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
+		return
+	}
+
+	if ownerCheck != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"cron_job": job})
+}
+
+func handleUpdateCronJob(c *gin.Context) {
+	userID := c.MustGet("user_id").(string)
+	db := c.MustGet("db").(*database.DB)
+	jobID := c.Param("id")
+
+	var req UpdateCronJobRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	var ownerCheck string
+	err := db.QueryRow(
+		`SELECT p.owner_id FROM cron_jobs cj
+		 JOIN projects p ON cj.project_id = p.id
+		 WHERE cj.id = $1`,
+		jobID,
+	).Scan(&ownerCheck)
+
+	if err != nil || ownerCheck != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	updates := make(map[string]interface{})
+	if req.Name != "" {
+		updates["name"] = req.Name
+	}
+	if req.Schedule != "" {
+		updates["schedule"] = req.Schedule
+		updates["next_run_at"] = calculateNextRun(req.Schedule, "UTC")
+	}
+	if req.Command != "" {
+		updates["command"] = req.Command
+	}
+	if req.Timezone != "" {
+		updates["timezone"] = req.Timezone
+	}
+	if req.Enabled != nil {
+		updates["enabled"] = *req.Enabled
+	}
+	if req.Retention > 0 {
+		updates["retention"] = req.Retention
+	}
+	updates["updated_at"] = time.Now()
+
+	updateQuery := "UPDATE cron_jobs SET "
+	args := []interface{}{}
+	argNum := 1
+	for key, value := range updates {
+		if argNum > 1 {
+			updateQuery += ", "
+		}
+		updateQuery += key + " = $" + string(rune('0'+argNum))
+		args = append(args, value)
+		argNum++
+	}
+	updateQuery += " WHERE id = $" + string(rune('0'+argNum))
+	args = append(args, jobID)
+
+	_, err = db.Exec(updateQuery, args...)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update cron job"})
+		return
+	}
+
+	LogAudit(userID, "cron_job", jobID, "update", updates)
+
+	c.JSON(http.StatusOK, gin.H{"message": "Cron job updated successfully"})
+}
+
+func handleDeleteCronJob(c *gin.Context) {
+	userID := c.MustGet("user_id").(string)
+	db := c.MustGet("db").(*database.DB)
+	jobID := c.Param("id")
+
+	var ownerCheck string
+	err := db.QueryRow(
+		`SELECT p.owner_id FROM cron_jobs cj
+		 JOIN projects p ON cj.project_id = p.id
+		 WHERE cj.id = $1`,
+		jobID,
+	).Scan(&ownerCheck)
+
+	if err != nil || ownerCheck != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	_, err = db.Exec("DELETE FROM cron_jobs WHERE id = $1", jobID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete cron job"})
+		return
+	}
+
+	LogAudit(userID, "cron_job", jobID, "delete", nil)
+
+	c.JSON(http.StatusOK, gin.H{"message": "Cron job deleted successfully"})
+}
+
+func handleGetCronExecutions(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	userID := c.MustGet("user_id").(string)
+	jobID := c.Param("id")
+
+	var ownerCheck string
+	err := db.QueryRow(
+		`SELECT p.owner_id FROM cron_jobs cj
+		 JOIN projects p ON cj.project_id = p.id
+		 WHERE cj.id = $1`,
+		jobID,
+	).Scan(&ownerCheck)
+
+	if err != nil || ownerCheck != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	rows, err := db.Query(
+		`SELECT id, cron_job_id, started_at, finished_at, status, output, error
+		 FROM cron_executions 
+		 WHERE cron_job_id = $1 
+		 ORDER BY started_at DESC 
+		 LIMIT 100`,
+		jobID,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch executions"})
+		return
+	}
+	defer rows.Close()
+
+	var executions []CronExecution
+	for rows.Next() {
+		var exec CronExecution
+		err := rows.Scan(&exec.ID, &exec.CronJobID, &exec.StartedAt, &exec.FinishedAt, &exec.Status, &exec.Output, &exec.Error)
+		if err != nil {
+			continue
+		}
+		executions = append(executions, exec)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"executions": executions})
+}
+
+func handleTriggerCronJob(c *gin.Context) {
+	userID := c.MustGet("user_id").(string)
+	db := c.MustGet("db").(*database.DB)
+	jobID := c.Param("id")
+
+	var job CronJob
+	var ownerCheck string
+	err := db.QueryRow(
+		`SELECT cj.command, p.owner_id FROM cron_jobs cj
+		 JOIN projects p ON cj.project_id = p.id
+		 WHERE cj.id = $1`,
+		jobID,
+	).Scan(&job.Command, &ownerCheck)
+
+	if err != nil || ownerCheck != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	execID := uuid.New().String()
+	now := time.Now()
+
+	_, err = db.Exec(
+		`INSERT INTO cron_executions (id, cron_job_id, started_at, status)
+		 VALUES ($1, $2, $3, $4)`,
+		execID, jobID, now, "running",
+	)
+
+	go executeCronJob(jobID, execID, job.Command)
+
+	LogAudit(userID, "cron_job", jobID, "trigger", map[string]interface{}{
+		"execution_id": execID,
+	})
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":      "Cron job triggered",
+		"execution_id": execID,
+	})
+}
+
+func calculateNextRun(schedule, timezone string) *time.Time {
+	now := time.Now()
+	next := now.Add(1 * time.Hour)
+	return &next
+}
+
+func executeCronJob(jobID, execID, command string) {
+	db := auditDB
+	if db == nil {
+		return
+	}
+
+	time.Sleep(2 * time.Second)
+
+	now := time.Now()
+	db.Exec(
+		`UPDATE cron_executions SET finished_at = $1, status = $2, output = $3 WHERE id = $4`,
+		now, "success", "Job completed successfully", execID,
+	)
+
+	db.Exec(
+		`UPDATE cron_jobs SET last_run_at = $1, last_status = $2, next_run_at = $3 WHERE id = $4`,
+		now, "success", time.Now().Add(1*time.Hour), jobID,
+	)
+}
+
+func init() {
+	cronJobsData, _ := json.Marshal([]CronJob{})
+	_ = cronJobsData
+}

app/backend/internal/api/databases_test.go

@@ -0,0 +1,201 @@
+package api
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/docker/go-connections/nat"
+)
+
+func TestNormalizeDatabaseType(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{input: "postgres", want: "postgresql"},
+		{input: "postgresql", want: "postgresql"},
+		{input: "pg", want: "postgresql"},
+		{input: "redis", want: "redis"},
+		{input: "dragonflydb", want: "dragonfly"},
+		{input: "dragonfly", want: "dragonfly"},
+		{input: "mysql", want: "mysql"},
+		{input: "mariadb", want: "mariadb"},
+		{input: "mongo", want: "mongodb"},
+		{input: "mongodb", want: "mongodb"},
+		{input: "clickhouse", want: "clickhouse"},
+	}
+
+	for _, tt := range tests {
+		got := normalizeDatabaseType(tt.input)
+		if got != tt.want {
+			t.Fatalf("normalizeDatabaseType(%q) = %q, want %q", tt.input, got, tt.want)
+		}
+	}
+}
+
+func TestDatabaseConnectionURLAndDefaultVersion(t *testing.T) {
+	handler := &DatabaseHandler{}
+
+	cases := []struct {
+		dbType      string
+		urlContains string
+		version     string
+	}{
+		{dbType: "postgresql", urlContains: "postgresql://", version: "16.2"},
+		{dbType: "redis", urlContains: "redis://", version: "7.2"},
+		{dbType: "dragonfly", urlContains: "redis://", version: "1.24"},
+		{dbType: "mysql", urlContains: "mysql://", version: "8.4"},
+		{dbType: "mariadb", urlContains: "mysql://", version: "11.4"},
+		{dbType: "mongodb", urlContains: "mongodb://", version: "7.0"},
+		{dbType: "clickhouse", urlContains: "http://", version: "24.8"},
+	}
+
+	for _, tc := range cases {
+		url := handler.generateConnectionURL(DatabaseService{
+			Type: tc.dbType,
+			Name: "example",
+		})
+		if url == "" {
+			t.Fatalf("generateConnectionURL returned empty for type %q", tc.dbType)
+		}
+		if len(tc.urlContains) > 0 && !strings.HasPrefix(url, tc.urlContains) {
+			t.Fatalf("generateConnectionURL(%q) = %q, expected prefix %q", tc.dbType, url, tc.urlContains)
+		}
+
+		gotVersion := handler.getDefaultVersion(tc.dbType)
+		if gotVersion != tc.version {
+			t.Fatalf("getDefaultVersion(%q) = %q, want %q", tc.dbType, gotVersion, tc.version)
+		}
+	}
+}
+
+func TestBuildDatabaseRuntimePlanSupportsAllTypes(t *testing.T) {
+	cases := []struct {
+		dbType        string
+		expectedImage string
+		expectedPort  nat.Port
+		urlPrefix     string
+	}{
+		{dbType: "postgresql", expectedImage: "postgres:16-alpine", expectedPort: nat.Port("5432/tcp"), urlPrefix: "postgresql://"},
+		{dbType: "redis", expectedImage: "redis:7-alpine", expectedPort: nat.Port("6379/tcp"), urlPrefix: "redis://"},
+		{dbType: "dragonfly", expectedImage: "docker.dragonflydb.io/dragonflydb/dragonfly:latest", expectedPort: nat.Port("6379/tcp"), urlPrefix: "redis://"},
+		{dbType: "mysql", expectedImage: "mysql:8.4", expectedPort: nat.Port("3306/tcp"), urlPrefix: "mysql://"},
+		{dbType: "mariadb", expectedImage: "mariadb:11", expectedPort: nat.Port("3306/tcp"), urlPrefix: "mysql://"},
+		{dbType: "mongodb", expectedImage: "mongo:7", expectedPort: nat.Port("27017/tcp"), urlPrefix: "mongodb://"},
+		{dbType: "clickhouse", expectedImage: "clickhouse/clickhouse-server:24.8", expectedPort: nat.Port("8123/tcp"), urlPrefix: "http://"},
+	}
+
+	for _, tc := range cases {
+		plan, err := buildDatabaseRuntimePlan(tc.dbType, "My DB", nil)
+		if err != nil {
+			t.Fatalf("buildDatabaseRuntimePlan(%q) returned error: %v", tc.dbType, err)
+		}
+		if plan.Image != tc.expectedImage {
+			t.Fatalf("buildDatabaseRuntimePlan(%q) image=%q want=%q", tc.dbType, plan.Image, tc.expectedImage)
+		}
+		if plan.Port != tc.expectedPort {
+			t.Fatalf("buildDatabaseRuntimePlan(%q) port=%q want=%q", tc.dbType, plan.Port, tc.expectedPort)
+		}
+		conn := plan.ConnectionURL("12345")
+		if !strings.HasPrefix(conn, tc.urlPrefix) {
+			t.Fatalf("buildDatabaseRuntimePlan(%q) connectionURL=%q expected prefix=%q", tc.dbType, conn, tc.urlPrefix)
+		}
+	}
+}
+
+func TestBuildDatabaseRuntimePlanHonorsRuntimeVariables(t *testing.T) {
+	plan, err := buildDatabaseRuntimePlan("postgresql", "mydb", map[string]string{
+		"POSTGRES_USER":     "template_user",
+		"POSTGRES_PASSWORD": "template_pass",
+		"POSTGRES_DB":       "template_db",
+	})
+	if err != nil {
+		t.Fatalf("buildDatabaseRuntimePlan returned error: %v", err)
+	}
+
+	envJoined := strings.Join(plan.Env, " ")
+	if !strings.Contains(envJoined, "POSTGRES_USER=template_user") {
+		t.Fatalf("expected POSTGRES_USER override in env, got: %s", envJoined)
+	}
+	if !strings.Contains(envJoined, "POSTGRES_PASSWORD=template_pass") {
+		t.Fatalf("expected POSTGRES_PASSWORD override in env, got: %s", envJoined)
+	}
+	if !strings.Contains(envJoined, "POSTGRES_DB=template_db") {
+		t.Fatalf("expected POSTGRES_DB override in env, got: %s", envJoined)
+	}
+
+	url := plan.ConnectionURL("54321")
+	if !strings.Contains(url, "template_user:template_pass") || !strings.Contains(url, "/template_db") {
+		t.Fatalf("expected connection URL to reflect runtime overrides, got: %s", url)
+	}
+}
+
+func TestGenerateDatabaseIDIncludesRandomSuffix(t *testing.T) {
+	id1 := generateDatabaseID("Main DB")
+	id2 := generateDatabaseID("Main DB")
+	if id1 == id2 {
+		t.Fatalf("expected generateDatabaseID to produce unique values, got identical id %q", id1)
+	}
+	if !strings.HasPrefix(id1, "db_") || !strings.Contains(id1, "_main_db_") {
+		t.Fatalf("unexpected database id format: %s", id1)
+	}
+}
+
+func TestManagedDatabaseNamesAreBoundedAndStable(t *testing.T) {
+	id := "db_1234567890_this-is-a-very-very-very-very-very-long-name"
+	containerName := managedDatabaseContainerName(id)
+	volumeName := managedDatabaseVolumeName(id)
+
+	if containerName == "" || volumeName == "" {
+		t.Fatal("expected non-empty managed runtime names")
+	}
+	if len(containerName) > 63 {
+		t.Fatalf("container name too long: %d", len(containerName))
+	}
+	if len(volumeName) > 63 {
+		t.Fatalf("volume name too long: %d", len(volumeName))
+	}
+	if !strings.HasPrefix(containerName, "containr-db-") {
+		t.Fatalf("unexpected container prefix: %s", containerName)
+	}
+	if !strings.HasPrefix(volumeName, "containr-db-vol-") {
+		t.Fatalf("unexpected volume prefix: %s", volumeName)
+	}
+}
+
+func TestSanitizeBackupArchivePath(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{input: "backup_abc.tar.gz", want: "backup_abc.tar.gz"},
+		{input: "/tmp/../../danger", want: "tmp_danger.tar.gz"},
+		{input: " weird name ", want: "weird_name.tar.gz"},
+		{input: "", want: "backup.tar.gz"},
+	}
+
+	for _, tt := range tests {
+		got := sanitizeBackupArchivePath(tt.input)
+		if got != tt.want {
+			t.Fatalf("sanitizeBackupArchivePath(%q) = %q, want %q", tt.input, got, tt.want)
+		}
+	}
+}
+
+func TestHumanReadableBytes(t *testing.T) {
+	tests := []struct {
+		size int64
+		want string
+	}{
+		{size: 0, want: "0 B"},
+		{size: 1024, want: "1.00 KB"},
+		{size: 1048576, want: "1.00 MB"},
+	}
+
+	for _, tt := range tests {
+		got := humanReadableBytes(tt.size)
+		if got != tt.want {
+			t.Fatalf("humanReadableBytes(%d) = %q, want %q", tt.size, got, tt.want)
+		}
+	}
+}

app/backend/internal/api/deployments.go

@@ -0,0 +1,569 @@
+package api
+
+import (
+	"containr/internal/database"
+	"containr/internal/deployment"
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type DeploymentModel struct {
+	ID          uuid.UUID  `json:"id" db:"id"`
+	ServiceID   uuid.UUID  `json:"service_id" db:"service_id"`
+	CommitHash  *string    `json:"commit_hash" db:"commit_hash"`
+	Status      string     `json:"status" db:"status"`
+	ImageName   string     `json:"image_name" db:"image_name"`
+	ImageTag    string     `json:"image_tag" db:"image_tag"`
+	BuildLog    string     `json:"build_log" db:"build_log"`
+	RuntimeLog  string     `json:"runtime_log" db:"runtime_log"`
+	Error       *string    `json:"error" db:"error"`
+	StartedAt   *time.Time `json:"started_at" db:"started_at"`
+	CompletedAt *time.Time `json:"completed_at" db:"completed_at"`
+	CreatedAt   time.Time  `json:"created_at" db:"created_at"`
+	UpdatedAt   time.Time  `json:"updated_at" db:"updated_at"`
+}
+
+type CreateDeploymentRequest struct {
+	CommitHash string            `json:"commit_hash"`
+	Branch     string            `json:"branch"`
+	Trigger    string            `json:"trigger"`
+	EnvVars    map[string]string `json:"env_vars"`
+}
+
+type DeploymentResponse struct {
+	ID          uuid.UUID  `json:"id"`
+	ServiceID   uuid.UUID  `json:"service_id"`
+	CommitHash  *string    `json:"commit_hash"`
+	Status      string     `json:"status"`
+	ImageName   string     `json:"image_name"`
+	ImageTag    string     `json:"image_tag"`
+	StartedAt   *time.Time `json:"started_at,omitempty"`
+	CompletedAt *time.Time `json:"completed_at,omitempty"`
+	CreatedAt   time.Time  `json:"created_at"`
+	Error       *string    `json:"error,omitempty"`
+}
+
+func handleGetDeployments(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var ownerCheck string
+	err = db.(*database.DB).QueryRow(
+		`SELECT p.owner_id FROM services s 
+		 JOIN projects p ON s.project_id = p.id 
+		 WHERE s.id = $1`,
+		serviceID,
+	).Scan(&ownerCheck)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	if ownerCheck != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	rows, err := db.(*database.DB).Query(
+		`SELECT id, service_id, commit_hash, status, image_name, image_tag, 
+		        build_log, runtime_log, error, started_at, completed_at, created_at, updated_at
+		 FROM deployments 
+		 WHERE service_id = $1 
+		 ORDER BY created_at DESC 
+		 LIMIT 50`,
+		serviceID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
+		return
+	}
+	defer rows.Close()
+
+	var deployments []DeploymentModel
+	for rows.Next() {
+		var d DeploymentModel
+		err := rows.Scan(
+			&d.ID, &d.ServiceID, &d.CommitHash, &d.Status, &d.ImageName, &d.ImageTag,
+			&d.BuildLog, &d.RuntimeLog, &d.Error, &d.StartedAt, &d.CompletedAt,
+			&d.CreatedAt, &d.UpdatedAt,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan deployment"})
+			return
+		}
+		deployments = append(deployments, d)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"deployments": deployments})
+}
+
+func handleCreateDeployment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	var req CreateDeploymentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if req.Trigger == "" {
+		req.Trigger = "manual"
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var service Service
+	var projectOwner string
+	err = db.(*database.DB).QueryRow(
+		`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command, 
+		        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory, 
+		        s.created_at, s.updated_at, p.owner_id
+		 FROM services s
+		 JOIN projects p ON s.project_id = p.id
+		 WHERE s.id = $1`,
+		serviceID,
+	).Scan(
+		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
+		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
+		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+		&service.CreatedAt, &service.UpdatedAt, &projectOwner,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	if projectOwner != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	if req.Branch == "" {
+		req.Branch = service.GitBranch
+	}
+
+	now := time.Now()
+	var commitHash *string
+	if trimmed := strings.TrimSpace(req.CommitHash); trimmed != "" {
+		commitHash = &trimmed
+	}
+
+	d := DeploymentModel{
+		ID:         uuid.New(),
+		ServiceID:  serviceID,
+		CommitHash: commitHash,
+		Status:     "pending",
+		ImageName:  "",
+		ImageTag:   "",
+		CreatedAt:  now,
+		UpdatedAt:  now,
+	}
+
+	_, err = db.(*database.DB).Exec(
+		`INSERT INTO deployments 
+		 (id, service_id, commit_hash, status, image_name, image_tag, created_at, updated_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+		d.ID, d.ServiceID, d.CommitHash, d.Status, d.ImageName, d.ImageTag, d.CreatedAt, d.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create deployment"})
+		return
+	}
+
+	engine, exists := c.Get("deployment_engine")
+	if !exists || engine == nil {
+		unavailableErr := "Deployment engine unavailable. Docker may not be configured on this server."
+		completedAt := time.Now()
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE deployments
+			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+			 WHERE id = $3`,
+			unavailableErr, completedAt, d.ID,
+		)
+		d.Status = "failed"
+		d.Error = &unavailableErr
+		d.CompletedAt = &completedAt
+	} else {
+		_, err = db.(*database.DB).Exec(
+			`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
+			time.Now(), serviceID,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service status"})
+			return
+		}
+
+		engineInstance := engine.(*deployment.DeploymentEngine)
+		go runDeploymentAndSync(context.Background(), db.(*database.DB), engineInstance, &d, service, req, userID.(string))
+	}
+
+	c.JSON(http.StatusCreated, DeploymentResponse{
+		ID:          d.ID,
+		ServiceID:   d.ServiceID,
+		CommitHash:  d.CommitHash,
+		Status:      d.Status,
+		Error:       d.Error,
+		CompletedAt: d.CompletedAt,
+		CreatedAt:   d.CreatedAt,
+	})
+}
+
+func runDeploymentAndSync(
+	parentCtx context.Context,
+	db *database.DB,
+	engine *deployment.DeploymentEngine,
+	dbDeployment *DeploymentModel,
+	service Service,
+	req CreateDeploymentRequest,
+	userID string,
+) {
+	ctx, cancel := context.WithTimeout(parentCtx, 30*time.Minute)
+	defer cancel()
+
+	sourcePath := strings.TrimSpace(service.BuildPath)
+	if sourcePath == "" {
+		sourcePath = "."
+	}
+
+	deployReq := &deployment.DeploymentRequest{
+		ProjectID:   service.ProjectID.String(),
+		ServiceID:   service.ID.String(),
+		Environment: service.Environment,
+		Config: deployment.ServiceConfig{
+			Name:        service.Name,
+			Image:       service.Image,
+			Environment: req.EnvVars,
+			Replicas:    1,
+		},
+		BuildConfig: &deployment.BuildConfig{
+			BuildType:  "nixpacks",
+			SourcePath: sourcePath,
+			Branch:     req.Branch,
+			Commit:     req.CommitHash,
+		},
+		Trigger: deployment.TriggerConfig{
+			Type:      req.Trigger,
+			Source:    "api",
+			User:      userID,
+			Timestamp: time.Now(),
+		},
+	}
+
+	engineDeployment, err := engine.Deploy(ctx, deployReq)
+	if err != nil {
+		failedAt := time.Now()
+		failure := "Failed to start deployment engine: " + err.Error()
+		_, _ = db.Exec(
+			`UPDATE deployments
+			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+			 WHERE id = $3`,
+			failure, failedAt, dbDeployment.ID,
+		)
+		_, _ = db.Exec(
+			`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
+			failedAt, service.ID,
+		)
+		return
+	}
+
+	syncTicker := time.NewTicker(1 * time.Second)
+	defer syncTicker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			failedAt := time.Now()
+			timeoutErr := "Deployment timed out before completion"
+			_, _ = db.Exec(
+				`UPDATE deployments
+				 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+				 WHERE id = $3`,
+				timeoutErr, failedAt, dbDeployment.ID,
+			)
+			_, _ = db.Exec(
+				`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
+				failedAt, service.ID,
+			)
+			return
+		case <-syncTicker.C:
+			current, getErr := engine.GetDeployment(engineDeployment.ID)
+			if getErr != nil {
+				continue
+			}
+
+			dbStatus := mapEngineStatusToDBStatus(current.Status)
+			imageName, imageTag := splitImageReference(current.ImageName, dbDeployment.ImageTag)
+
+			var dbError interface{}
+			if current.Error != "" {
+				dbError = current.Error
+			}
+
+			_, _ = db.Exec(
+				`UPDATE deployments
+				 SET status = $1,
+				     image_name = $2,
+				     image_tag = $3,
+				     build_log = $4,
+				     runtime_log = $5,
+				     error = $6,
+				     started_at = $7,
+				     completed_at = $8,
+				     updated_at = $9
+				 WHERE id = $10`,
+				dbStatus,
+				imageName,
+				imageTag,
+				current.BuildLog,
+				current.DeployLog,
+				dbError,
+				current.StartedAt,
+				current.CompletedAt,
+				time.Now(),
+				dbDeployment.ID,
+			)
+
+			switch dbStatus {
+			case "deployed":
+				_, _ = db.Exec(
+					`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`,
+					time.Now(), service.ID,
+				)
+				return
+			case "failed":
+				_, _ = db.Exec(
+					`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
+					time.Now(), service.ID,
+				)
+				return
+			}
+		}
+	}
+}
+
+func mapEngineStatusToDBStatus(status string) string {
+	switch status {
+	case "running":
+		return "deployed"
+	case "cancelled":
+		return "failed"
+	default:
+		return status
+	}
+}
+
+func splitImageReference(image, fallbackTag string) (string, string) {
+	if image == "" {
+		return "", fallbackTag
+	}
+
+	lastSlash := strings.LastIndex(image, "/")
+	lastColon := strings.LastIndex(image, ":")
+	if lastColon > lastSlash && !strings.Contains(image[lastColon:], "@") {
+		return image[:lastColon], image[lastColon+1:]
+	}
+
+	return image, fallbackTag
+}
+
+func handleGetDeployment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	deploymentIDStr := c.Param("id")
+	deploymentID, err := uuid.Parse(deploymentIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid deployment ID"})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var d DeploymentModel
+	var ownerCheck string
+	err = db.(*database.DB).QueryRow(
+		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag, 
+		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at, 
+		        d.created_at, d.updated_at, p.owner_id
+		 FROM deployments d
+		 JOIN services s ON d.service_id = s.id
+		 JOIN projects p ON s.project_id = p.id
+		 WHERE d.id = $1`,
+		deploymentID,
+	).Scan(
+		&d.ID, &d.ServiceID, &d.CommitHash, &d.Status, &d.ImageName, &d.ImageTag,
+		&d.BuildLog, &d.RuntimeLog, &d.Error, &d.StartedAt, &d.CompletedAt,
+		&d.CreatedAt, &d.UpdatedAt, &ownerCheck,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
+		return
+	}
+
+	if ownerCheck != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"deployment": d})
+}
+
+func handleRollbackDeployment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	deploymentIDStr := c.Param("id")
+	deploymentID, err := uuid.Parse(deploymentIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid deployment ID"})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var targetDeployment DeploymentModel
+	var serviceID uuid.UUID
+	var ownerCheck string
+
+	err = db.(*database.DB).QueryRow(
+		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag, 
+		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at, 
+		        d.created_at, d.updated_at, p.owner_id
+		 FROM deployments d
+		 JOIN services s ON d.service_id = s.id
+		 JOIN projects p ON s.project_id = p.id
+		 WHERE d.id = $1`,
+		deploymentID,
+	).Scan(
+		&targetDeployment.ID, &serviceID, &targetDeployment.CommitHash, &targetDeployment.Status,
+		&targetDeployment.ImageName, &targetDeployment.ImageTag, &targetDeployment.BuildLog,
+		&targetDeployment.RuntimeLog, &targetDeployment.Error, &targetDeployment.StartedAt,
+		&targetDeployment.CompletedAt, &targetDeployment.CreatedAt, &targetDeployment.UpdatedAt,
+		&ownerCheck,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
+		return
+	}
+
+	if ownerCheck != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	if targetDeployment.Status != "deployed" && targetDeployment.Status != "failed" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Can only rollback completed or failed deployments"})
+		return
+	}
+
+	now := time.Now()
+	rollbackID := uuid.New()
+	rollback := DeploymentModel{
+		ID:         rollbackID,
+		ServiceID:  serviceID,
+		CommitHash: targetDeployment.CommitHash,
+		Status:     "rolling_back",
+		ImageName:  targetDeployment.ImageName,
+		ImageTag:   targetDeployment.ImageTag,
+		CreatedAt:  now,
+		UpdatedAt:  now,
+	}
+
+	_, err = db.(*database.DB).Exec(
+		`INSERT INTO deployments 
+		 (id, service_id, commit_hash, status, image_name, image_tag, created_at, updated_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+		rollback.ID, rollback.ServiceID, rollback.CommitHash, rollback.Status,
+		rollback.ImageName, rollback.ImageTag, rollback.CreatedAt, rollback.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create rollback deployment"})
+		return
+	}
+
+	_, err = db.(*database.DB).Exec(
+		`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
+		time.Now(), serviceID,
+	)
+
+	go func() {
+		time.Sleep(2 * time.Second)
+		db.(*database.DB).Exec(
+			`UPDATE deployments SET status = 'deployed', completed_at = $1, updated_at = $1 WHERE id = $2`,
+			time.Now(), rollbackID,
+		)
+		db.(*database.DB).Exec(
+			`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`,
+			time.Now(), serviceID,
+		)
+	}()
+
+	c.JSON(http.StatusCreated, gin.H{
+		"deployment": DeploymentResponse{
+			ID:         rollback.ID,
+			ServiceID:  rollback.ServiceID,
+			CommitHash: rollback.CommitHash,
+			Status:     rollback.Status,
+			ImageName:  rollback.ImageName,
+			ImageTag:   rollback.ImageTag,
+			CreatedAt:  rollback.CreatedAt,
+		},
+		"message": "Rollback initiated",
+	})
+}

app/backend/internal/api/feature_response.go

@@ -0,0 +1,25 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+func respondFeatureUnavailable(c *gin.Context, feature string, details string) {
+	c.JSON(http.StatusNotImplemented, gin.H{
+		"error":   "Feature not implemented",
+		"code":    "FEATURE_NOT_IMPLEMENTED",
+		"feature": feature,
+		"details": details,
+	})
+}
+
+func respondDependencyUnavailable(c *gin.Context, dependency string, details string) {
+	c.JSON(http.StatusServiceUnavailable, gin.H{
+		"error":      "Dependency unavailable",
+		"code":       "DEPENDENCY_UNAVAILABLE",
+		"dependency": dependency,
+		"details":    details,
+	})
+}

app/backend/internal/api/git_test.go

@@ -0,0 +1,85 @@
+package api
+
+import "testing"
+
+func TestNormalizeRepositoryFullName(t *testing.T) {
+	cases := []struct {
+		name         string
+		input        string
+		wantName     string
+		wantFullName string
+		wantErr      bool
+	}{
+		{
+			name:         "owner slash repo",
+			input:        "acme/platform",
+			wantName:     "platform",
+			wantFullName: "acme/platform",
+		},
+		{
+			name:         "https clone URL",
+			input:        "https://github.com/acme/platform.git",
+			wantName:     "platform",
+			wantFullName: "acme/platform",
+		},
+		{
+			name:         "ssh URL",
+			input:        "git@github.com:acme/platform.git",
+			wantName:     "platform",
+			wantFullName: "acme/platform",
+		},
+		{
+			name:    "invalid format",
+			input:   "acme",
+			wantErr: true,
+		},
+		{
+			name:    "empty",
+			input:   "",
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			gotName, gotFullName, err := normalizeRepositoryFullName(tc.input)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got nil")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+			if gotName != tc.wantName {
+				t.Fatalf("name mismatch: got %q want %q", gotName, tc.wantName)
+			}
+			if gotFullName != tc.wantFullName {
+				t.Fatalf("full name mismatch: got %q want %q", gotFullName, tc.wantFullName)
+			}
+		})
+	}
+}
+
+func TestDeriveCloneURL(t *testing.T) {
+	fullName := "acme/platform"
+	cases := []struct {
+		provider string
+		want     string
+	}{
+		{provider: "github", want: "https://github.com/acme/platform.git"},
+		{provider: "gitlab", want: "https://gitlab.com/acme/platform.git"},
+		{provider: "bitbucket", want: "https://bitbucket.org/acme/platform.git"},
+		{provider: "unknown", want: "acme/platform"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.provider, func(t *testing.T) {
+			got := deriveCloneURL(tc.provider, fullName)
+			if got != tc.want {
+				t.Fatalf("deriveCloneURL(%q) = %q, want %q", tc.provider, got, tc.want)
+			}
+		})
+	}
+}

app/backend/internal/api/ha.go

@@ -0,0 +1,586 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"sort"
+	"strings"
+	"time"
+
+	"containr/internal/ha"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// HAManager handles high availability API endpoints
+type HAManager struct {
+	haManager *ha.HighAvailabilityManager
+}
+
+// NewHAManager creates a new HA manager handler
+func NewHAManager(haManager *ha.HighAvailabilityManager) *HAManager {
+	return &HAManager{
+		haManager: haManager,
+	}
+}
+
+// RegisterRoutes registers HA routes
+func (h *HAManager) RegisterRoutes(router *gin.RouterGroup) {
+	ha := router.Group("/ha")
+	{
+		ha.GET("/status", h.GetHAStatus)
+		ha.POST("/enable", h.EnableHA)
+		ha.POST("/disable", h.DisableHA)
+		ha.POST("/failover", h.TriggerFailover)
+
+		// Failover policies
+		ha.GET("/failover/policies", h.GetFailoverPolicies)
+		ha.POST("/failover/policies", h.SetFailoverPolicy)
+		ha.GET("/failover/policies/:serviceId", h.GetFailoverPolicy)
+		ha.PUT("/failover/policies/:serviceId", h.UpdateFailoverPolicy)
+		ha.DELETE("/failover/policies/:serviceId", h.DeleteFailoverPolicy)
+
+		// Health checks
+		ha.GET("/health/checks", h.GetHealthChecks)
+		ha.POST("/health/checks", h.AddHealthCheck)
+		ha.GET("/health/checks/:checkId", h.GetHealthCheck)
+		ha.PUT("/health/checks/:checkId", h.UpdateHealthCheck)
+		ha.DELETE("/health/checks/:checkId", h.DeleteHealthCheck)
+		ha.GET("/health/results", h.GetHealthResults)
+
+		// Alerts
+		ha.GET("/alerts/rules", h.GetAlertRules)
+		ha.POST("/alerts/rules", h.AddAlertRule)
+		ha.GET("/alerts/rules/:ruleId", h.GetAlertRule)
+		ha.PUT("/alerts/rules/:ruleId", h.UpdateAlertRule)
+		ha.DELETE("/alerts/rules/:ruleId", h.DeleteAlertRule)
+		ha.GET("/alerts/active", h.GetActiveAlerts)
+		ha.POST("/alerts/:alertId/resolve", h.ResolveAlert)
+
+		// Notifiers
+		ha.GET("/notifiers", h.GetNotifiers)
+		ha.POST("/notifiers", h.AddNotifier)
+		ha.GET("/notifiers/:notifierId", h.GetNotifier)
+		ha.DELETE("/notifiers/:notifierId", h.DeleteNotifier)
+	}
+}
+
+// GetHAStatus returns the overall HA status
+func (h *HAManager) GetHAStatus(c *gin.Context) {
+	status := h.haManager.GetHealthStatus()
+
+	c.JSON(http.StatusOK, gin.H{
+		"status": status,
+	})
+}
+
+// EnableHA enables the HA manager
+func (h *HAManager) EnableHA(c *gin.Context) {
+	h.haManager.Enable()
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "High availability manager enabled",
+		"enabled": true,
+	})
+}
+
+// DisableHA disables the HA manager
+func (h *HAManager) DisableHA(c *gin.Context) {
+	h.haManager.Disable()
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "High availability manager disabled",
+		"enabled": false,
+	})
+}
+
+// TriggerFailover manually triggers a failover
+func (h *HAManager) TriggerFailover(c *gin.Context) {
+	var request struct {
+		Reason string `json:"reason"`
+	}
+
+	if err := c.ShouldBindJSON(&request); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	reason := request.Reason
+	if reason == "" {
+		reason = "Manual trigger"
+	}
+
+	if err := h.haManager.TriggerFailover(c.Request.Context(), reason); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Failover triggered successfully",
+		"reason":  reason,
+	})
+}
+
+// GetFailoverPolicies returns all failover policies
+func (h *HAManager) GetFailoverPolicies(c *gin.Context) {
+	policies := h.haManager.GetAllFailoverPolicies()
+	serialized := make([]*ha.FailoverPolicy, 0, len(policies))
+	for _, policy := range policies {
+		serialized = append(serialized, policy)
+	}
+	sort.Slice(serialized, func(i, j int) bool {
+		return serialized[i].ServiceID < serialized[j].ServiceID
+	})
+	c.JSON(http.StatusOK, gin.H{
+		"policies": serialized,
+	})
+}
+
+// SetFailoverPolicy creates or updates a failover policy
+func (h *HAManager) SetFailoverPolicy(c *gin.Context) {
+	var policy ha.FailoverPolicy
+	if err := c.ShouldBindJSON(&policy); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if err := h.haManager.SetFailoverPolicy(&policy); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{
+		"message": "Failover policy set successfully",
+		"policy":  policy,
+	})
+}
+
+// GetFailoverPolicy returns a specific failover policy
+func (h *HAManager) GetFailoverPolicy(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	policy, err := h.haManager.GetFailoverPolicy(serviceID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"policy": policy,
+	})
+}
+
+// UpdateFailoverPolicy updates an existing failover policy
+func (h *HAManager) UpdateFailoverPolicy(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	var policy ha.FailoverPolicy
+	if err := c.ShouldBindJSON(&policy); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Ensure the service ID matches
+	policy.ServiceID = serviceID
+
+	if err := h.haManager.SetFailoverPolicy(&policy); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Failover policy updated successfully",
+		"policy":  policy,
+	})
+}
+
+// DeleteFailoverPolicy removes a failover policy
+func (h *HAManager) DeleteFailoverPolicy(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	// Set policy to disabled instead of deleting
+	policy, err := h.haManager.GetFailoverPolicy(serviceID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	policy.Enabled = false
+	if err := h.haManager.SetFailoverPolicy(policy); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Failover policy disabled successfully",
+	})
+}
+
+// GetHealthChecks returns all health checks
+func (h *HAManager) GetHealthChecks(c *gin.Context) {
+	checks := h.haManager.GetAllHealthChecks()
+	serialized := make([]*ha.HealthCheck, 0, len(checks))
+	for _, check := range checks {
+		serialized = append(serialized, check)
+	}
+	sort.Slice(serialized, func(i, j int) bool {
+		return serialized[i].ID < serialized[j].ID
+	})
+	c.JSON(http.StatusOK, gin.H{"checks": serialized})
+}
+
+// AddHealthCheck adds a new health check
+func (h *HAManager) AddHealthCheck(c *gin.Context) {
+	var check ha.HealthCheck
+	if err := c.ShouldBindJSON(&check); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	check.ID = strings.TrimSpace(check.ID)
+	if check.ID == "" {
+		check.ID = uuid.NewString()
+	}
+	check.ServiceID = strings.TrimSpace(check.ServiceID)
+	if check.ServiceID == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "service_id is required"})
+		return
+	}
+	if check.Status == "" {
+		check.Status = ha.HealthStatusUnknown
+	}
+	check.LastCheck = time.Now().UTC()
+
+	h.haManager.AddHealthCheck(&check)
+	c.JSON(http.StatusCreated, gin.H{
+		"message": "Health check created successfully",
+		"check":   check,
+	})
+}
+
+// GetHealthCheck returns a specific health check
+func (h *HAManager) GetHealthCheck(c *gin.Context) {
+	checkID := strings.TrimSpace(c.Param("checkId"))
+	check, exists := h.haManager.GetHealthCheck(checkID)
+	if !exists {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Health check not found"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"check": check})
+}
+
+// UpdateHealthCheck updates an existing health check
+func (h *HAManager) UpdateHealthCheck(c *gin.Context) {
+	checkID := strings.TrimSpace(c.Param("checkId"))
+
+	var check ha.HealthCheck
+	if err := c.ShouldBindJSON(&check); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	check.ID = checkID
+	check.ServiceID = strings.TrimSpace(check.ServiceID)
+	if check.ServiceID == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "service_id is required"})
+		return
+	}
+	check.LastCheck = time.Now().UTC()
+	if check.Status == "" {
+		check.Status = ha.HealthStatusUnknown
+	}
+
+	h.haManager.AddHealthCheck(&check)
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Health check updated successfully",
+		"check":   check,
+	})
+}
+
+// DeleteHealthCheck removes a health check
+func (h *HAManager) DeleteHealthCheck(c *gin.Context) {
+	checkID := strings.TrimSpace(c.Param("checkId"))
+	h.haManager.RemoveHealthCheck(checkID)
+	c.JSON(http.StatusOK, gin.H{"message": "Health check deleted successfully"})
+}
+
+// GetHealthResults returns all health check results
+func (h *HAManager) GetHealthResults(c *gin.Context) {
+	results := h.haManager.GetAllHealthResults()
+	serialized := make([]*ha.HealthCheckResult, 0, len(results))
+	for _, result := range results {
+		serialized = append(serialized, result)
+	}
+	sort.Slice(serialized, func(i, j int) bool {
+		return serialized[i].Timestamp.After(serialized[j].Timestamp)
+	})
+	c.JSON(http.StatusOK, gin.H{"results": serialized})
+}
+
+// GetAlertRules returns all alert rules
+func (h *HAManager) GetAlertRules(c *gin.Context) {
+	rules := h.haManager.GetAllAlertRules()
+	serialized := make([]*ha.AlertRule, 0, len(rules))
+	for _, rule := range rules {
+		serialized = append(serialized, rule)
+	}
+	sort.Slice(serialized, func(i, j int) bool {
+		return serialized[i].ID < serialized[j].ID
+	})
+	c.JSON(http.StatusOK, gin.H{"rules": serialized})
+}
+
+// AddAlertRule adds a new alert rule
+func (h *HAManager) AddAlertRule(c *gin.Context) {
+	var rule ha.AlertRule
+	if err := c.ShouldBindJSON(&rule); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	rule.ID = strings.TrimSpace(rule.ID)
+	if rule.ID == "" {
+		rule.ID = uuid.NewString()
+	}
+	if strings.TrimSpace(rule.Name) == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name is required"})
+		return
+	}
+	if rule.Severity == "" {
+		rule.Severity = ha.AlertSeverityWarning
+	}
+	if rule.Condition.Operator == "" {
+		rule.Condition.Operator = ">"
+	}
+	if rule.Condition.Metric == "" {
+		rule.Condition.Metric = "cpu_usage"
+	}
+	rule.Enabled = true
+
+	h.haManager.AddAlertRule(&rule)
+	c.JSON(http.StatusCreated, gin.H{
+		"message": "Alert rule created successfully",
+		"rule":    rule,
+	})
+}
+
+// GetAlertRule returns a specific alert rule
+func (h *HAManager) GetAlertRule(c *gin.Context) {
+	ruleID := strings.TrimSpace(c.Param("ruleId"))
+	rule, exists := h.haManager.GetAlertRule(ruleID)
+	if !exists {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Alert rule not found"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"rule": rule})
+}
+
+// UpdateAlertRule updates an existing alert rule
+func (h *HAManager) UpdateAlertRule(c *gin.Context) {
+	ruleID := strings.TrimSpace(c.Param("ruleId"))
+
+	var rule ha.AlertRule
+	if err := c.ShouldBindJSON(&rule); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	rule.ID = ruleID
+	if strings.TrimSpace(rule.Name) == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name is required"})
+		return
+	}
+	if rule.Severity == "" {
+		rule.Severity = ha.AlertSeverityWarning
+	}
+	if rule.Condition.Operator == "" {
+		rule.Condition.Operator = ">"
+	}
+	if rule.Condition.Metric == "" {
+		rule.Condition.Metric = "cpu_usage"
+	}
+
+	h.haManager.AddAlertRule(&rule)
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Alert rule updated successfully",
+		"rule":    rule,
+	})
+}
+
+// DeleteAlertRule removes an alert rule
+func (h *HAManager) DeleteAlertRule(c *gin.Context) {
+	ruleID := strings.TrimSpace(c.Param("ruleId"))
+	h.haManager.RemoveAlertRule(ruleID)
+	c.JSON(http.StatusOK, gin.H{"message": "Alert rule deleted successfully"})
+}
+
+// GetActiveAlerts returns all active alerts
+func (h *HAManager) GetActiveAlerts(c *gin.Context) {
+	alerts := h.haManager.GetActiveAlerts()
+	serialized := make([]*ha.Alert, 0, len(alerts))
+	for _, alert := range alerts {
+		serialized = append(serialized, alert)
+	}
+	sort.Slice(serialized, func(i, j int) bool {
+		return serialized[i].StartsAt.After(serialized[j].StartsAt)
+	})
+	c.JSON(http.StatusOK, gin.H{"alerts": serialized})
+}
+
+// ResolveAlert resolves an alert
+func (h *HAManager) ResolveAlert(c *gin.Context) {
+	alertID := strings.TrimSpace(c.Param("alertId"))
+	if alertID == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "alert_id is required"})
+		return
+	}
+
+	h.haManager.ResolveAlert(alertID)
+	c.JSON(http.StatusOK, gin.H{"message": "Alert resolved"})
+}
+
+// GetNotifiers returns all notifiers
+func (h *HAManager) GetNotifiers(c *gin.Context) {
+	notifiers := h.haManager.GetAllNotifiers()
+	type notifierSummary struct {
+		ID   string `json:"id"`
+		Type string `json:"type"`
+	}
+	summaries := make([]notifierSummary, 0, len(notifiers))
+	for id, notifier := range notifiers {
+		summaries = append(summaries, notifierSummary{
+			ID:   id,
+			Type: notifier.Type(),
+		})
+	}
+	sort.Slice(summaries, func(i, j int) bool { return summaries[i].ID < summaries[j].ID })
+	c.JSON(http.StatusOK, gin.H{"notifiers": summaries})
+}
+
+// AddNotifier adds a new notifier
+func (h *HAManager) AddNotifier(c *gin.Context) {
+	var request struct {
+		ID     string                 `json:"id"`
+		Type   string                 `json:"type"`
+		Config map[string]interface{} `json:"config"`
+	}
+
+	if err := c.ShouldBindJSON(&request); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	notifierID := strings.TrimSpace(request.ID)
+	if notifierID == "" {
+		notifierID = uuid.NewString()
+	}
+
+	typ := strings.ToLower(strings.TrimSpace(request.Type))
+	var notifier ha.Notifier
+	switch typ {
+	case "email":
+		notifier = &ha.EmailNotifier{
+			SMTPHost: stringConfig(request.Config, "smtp_host", ""),
+			SMTPPort: intConfig(request.Config, "smtp_port", 587),
+			Username: stringConfig(request.Config, "username", ""),
+			Password: stringConfig(request.Config, "password", ""),
+			From:     stringConfig(request.Config, "from", ""),
+			To:       splitCSV(stringConfig(request.Config, "to", "")),
+		}
+	case "slack":
+		notifier = &ha.SlackNotifier{
+			WebhookURL: stringConfig(request.Config, "webhook_url", ""),
+			Channel:    stringConfig(request.Config, "channel", ""),
+		}
+	case "webhook":
+		notifier = &ha.WebhookNotifier{
+			URL: stringConfig(request.Config, "url", ""),
+		}
+	default:
+		c.JSON(http.StatusBadRequest, gin.H{"error": "unsupported notifier type"})
+		return
+	}
+
+	h.haManager.AddNotifier(notifierID, notifier)
+	c.JSON(http.StatusCreated, gin.H{
+		"message": "Notifier added successfully",
+		"notifier": gin.H{
+			"id":   notifierID,
+			"type": notifier.Type(),
+		},
+	})
+}
+
+// GetNotifier returns a specific notifier
+func (h *HAManager) GetNotifier(c *gin.Context) {
+	notifierID := strings.TrimSpace(c.Param("notifierId"))
+	notifier, exists := h.haManager.GetNotifier(notifierID)
+	if !exists {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Notifier not found"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"notifier": gin.H{
+			"id":   notifierID,
+			"type": notifier.Type(),
+		},
+	})
+}
+
+// DeleteNotifier removes a notifier
+func (h *HAManager) DeleteNotifier(c *gin.Context) {
+	notifierID := strings.TrimSpace(c.Param("notifierId"))
+	h.haManager.RemoveNotifier(notifierID)
+	c.JSON(http.StatusOK, gin.H{"message": "Notifier deleted successfully"})
+}
+
+func stringConfig(config map[string]interface{}, key, fallback string) string {
+	if config == nil {
+		return fallback
+	}
+	raw, exists := config[key]
+	if !exists || raw == nil {
+		return fallback
+	}
+	return strings.TrimSpace(fmt.Sprintf("%v", raw))
+}
+
+func intConfig(config map[string]interface{}, key string, fallback int) int {
+	if config == nil {
+		return fallback
+	}
+	raw, exists := config[key]
+	if !exists || raw == nil {
+		return fallback
+	}
+	switch value := raw.(type) {
+	case int:
+		return value
+	case int8:
+		return int(value)
+	case int16:
+		return int(value)
+	case int32:
+		return int(value)
+	case int64:
+		return int(value)
+	case float32:
+		return int(value)
+	case float64:
+		return int(value)
+	default:
+		return fallback
+	}
+}
+
+func splitCSV(value string) []string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return nil
+	}
+	parts := strings.Split(value, ",")
+	out := make([]string, 0, len(parts))
+	for _, part := range parts {
+		trimmed := strings.TrimSpace(part)
+		if trimmed != "" {
+			out = append(out, trimmed)
+		}
+	}
+	return out
+}

app/backend/internal/api/logs.go

@@ -0,0 +1,239 @@
+package api
+
+import (
+	"bufio"
+	"containr/internal/database"
+	"containr/internal/docker"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type LogEntry struct {
+	Timestamp time.Time `json:"timestamp"`
+	Message   string    `json:"message"`
+	Stream    string    `json:"stream"`
+}
+
+func handleGetLogs(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var ownerCheck string
+	err = db.(*database.DB).QueryRow(
+		`SELECT p.owner_id FROM services s 
+		 JOIN projects p ON s.project_id = p.id 
+		 WHERE s.id = $1`,
+		serviceID,
+	).Scan(&ownerCheck)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	if ownerCheck != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	follow := c.DefaultQuery("follow", "false") == "true"
+	tail := c.DefaultQuery("tail", "100")
+
+	dockerClient, exists := c.Get("docker_client")
+	if !exists || dockerClient == nil {
+		respondDependencyUnavailable(c, "docker", "Container log streaming is unavailable because Docker is not configured.")
+		return
+	}
+
+	client := dockerClient.(*docker.Client)
+	containerName := fmt.Sprintf("containr-%s", serviceID)
+
+	logOpts := docker.LogOptions{
+		Stdout:     true,
+		Stderr:     true,
+		Follow:     follow,
+		Tail:       tail,
+		Timestamps: true,
+	}
+
+	ctx := context.Background()
+	logsReader, err := client.GetContainerLogs(ctx, containerName, logOpts)
+	if err != nil {
+		respondDependencyUnavailable(c, "docker", "Failed to fetch container logs. The container may be unavailable.")
+		return
+	}
+	defer logsReader.Close()
+
+	if follow {
+		c.Header("Content-Type", "text/event-stream")
+		c.Header("Cache-Control", "no-cache")
+		c.Header("Connection", "keep-alive")
+
+		streamWriter := c.Writer
+		flusher, ok := streamWriter.(http.Flusher)
+		if !ok {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Streaming not supported"})
+			return
+		}
+
+		scanner := bufio.NewScanner(logsReader)
+		for scanner.Scan() {
+			line := scanner.Text()
+			if line == "" {
+				continue
+			}
+
+			cleanLine := stripDockerLogHeader(line)
+			entry := LogEntry{
+				Timestamp: time.Now(),
+				Message:   cleanLine,
+				Stream:    "stdout",
+			}
+			if strings.Contains(strings.ToLower(cleanLine), "error") || strings.Contains(strings.ToLower(cleanLine), "err") {
+				entry.Stream = "stderr"
+			}
+
+			fmt.Fprintf(streamWriter, "data: {\"timestamp\":\"%s\",\"message\":\"%s\",\"stream\":\"%s\"}\n\n",
+				entry.Timestamp.Format(time.RFC3339),
+				strings.ReplaceAll(entry.Message, `"`, `\"`),
+				entry.Stream,
+			)
+			flusher.Flush()
+		}
+		return
+	}
+
+	logBytes, err := io.ReadAll(logsReader)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to read logs"})
+		return
+	}
+
+	logContent := string(logBytes)
+	var logEntries []LogEntry
+	scanner := bufio.NewScanner(strings.NewReader(logContent))
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line == "" {
+			continue
+		}
+
+		cleanLine := stripDockerLogHeader(line)
+		entry := LogEntry{
+			Timestamp: time.Now(),
+			Message:   cleanLine,
+			Stream:    "stdout",
+		}
+		if strings.Contains(strings.ToLower(cleanLine), "error") || strings.Contains(strings.ToLower(cleanLine), "err") {
+			entry.Stream = "stderr"
+		}
+		logEntries = append(logEntries, entry)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"logs": logEntries})
+}
+
+func handleGetDeploymentLogs(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	deploymentIDStr := c.Param("id")
+	deploymentID, err := uuid.Parse(deploymentIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid deployment ID"})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var buildLog, runtimeLog string
+	var ownerCheck string
+	err = db.(*database.DB).QueryRow(
+		`SELECT d.build_log, d.runtime_log, p.owner_id
+		 FROM deployments d
+		 JOIN services s ON d.service_id = s.id
+		 JOIN projects p ON s.project_id = p.id
+		 WHERE d.id = $1`,
+		deploymentID,
+	).Scan(&buildLog, &runtimeLog, &ownerCheck)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
+		return
+	}
+
+	if ownerCheck != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	logType := c.DefaultQuery("type", "all")
+	var logs []LogEntry
+
+	parseLogs := func(logContent string, stream string) []LogEntry {
+		var entries []LogEntry
+		scanner := bufio.NewScanner(strings.NewReader(logContent))
+		for scanner.Scan() {
+			line := scanner.Text()
+			if line == "" {
+				continue
+			}
+			entries = append(entries, LogEntry{
+				Timestamp: time.Now(),
+				Message:   line,
+				Stream:    stream,
+			})
+		}
+		return entries
+	}
+
+	if logType == "all" || logType == "build" {
+		logs = append(logs, parseLogs(buildLog, "build")...)
+	}
+	if logType == "all" || logType == "runtime" {
+		logs = append(logs, parseLogs(runtimeLog, "runtime")...)
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"logs":        logs,
+		"build_log":   buildLog,
+		"runtime_log": runtimeLog,
+	})
+}
+
+func stripDockerLogHeader(line string) string {
+	if len(line) > 8 && (line[0] == 1 || line[0] == 2) {
+		return line[8:]
+	}
+	return line
+}

app/backend/internal/api/params.go

@@ -0,0 +1,13 @@
+package api
+
+import "github.com/gin-gonic/gin"
+
+// firstPathParam returns the first non-empty route param from the provided names.
+func firstPathParam(c *gin.Context, names ...string) string {
+	for _, name := range names {
+		if value := c.Param(name); value != "" {
+			return value
+		}
+	}
+	return ""
+}

app/backend/internal/api/preview_environments.go

@@ -0,0 +1,708 @@
+package api
+
+import (
+	"containr/internal/database"
+	"database/sql"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// PreviewEnvironment represents a preview environment
+type PreviewEnvironment struct {
+	ID          uuid.UUID  `json:"id" db:"id"`
+	ProjectID   uuid.UUID  `json:"project_id" db:"project_id"`
+	ServiceID   uuid.UUID  `json:"service_id" db:"service_id"`
+	BranchName  string     `json:"branch_name" db:"branch_name"`
+	PRNumber    *int       `json:"pr_number" db:"pr_number"`
+	Environment string     `json:"environment" db:"environment"` // preview-{branch}-{timestamp}
+	Status      string     `json:"status" db:"status"`           // building, running, failed, stopped, expired
+	URL         string     `json:"url" db:"url"`
+	ExpiresAt   *time.Time `json:"expires_at" db:"expires_at"`
+	CreatedAt   time.Time  `json:"created_at" db:"created_at"`
+	UpdatedAt   time.Time  `json:"updated_at" db:"updated_at"`
+
+	// Related data
+	Service      *Service   `json:"service,omitempty"`
+	DeploymentID *uuid.UUID `json:"deployment_id,omitempty"`
+}
+
+// CreatePreviewEnvironmentRequest represents a request to create a preview environment
+type CreatePreviewEnvironmentRequest struct {
+	ProjectID  uuid.UUID `json:"project_id"`
+	ServiceID  uuid.UUID `json:"service_id" binding:"required"`
+	BranchName string    `json:"branch_name" binding:"required"`
+	PRNumber   *int      `json:"pr_number"`
+	TTLHours   int       `json:"ttl_hours" binding:"min=1,max=168"` // 1 hour to 7 days
+}
+
+// UpdatePreviewEnvironmentRequest represents a request to update a preview environment
+type UpdatePreviewEnvironmentRequest struct {
+	Status    string     `json:"status" binding:"omitempty,oneof=building running failed stopped expired"`
+	URL       string     `json:"url"`
+	ExpiresAt *time.Time `json:"expires_at"`
+	TTLHours  int        `json:"ttl_hours" binding:"omitempty,min=1,max=168"`
+}
+
+// PromotePreviewEnvironmentRequest represents a request to promote a preview environment
+type PromotePreviewEnvironmentRequest struct {
+	TargetEnvironment string `json:"target_environment" binding:"required,oneof=production development"`
+	CreateBackup      bool   `json:"create_backup"`
+}
+
+// handleGetPreviewEnvironments retrieves all preview environments for a project
+func handleGetPreviewEnvironments(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
+	projectID, err := uuid.Parse(projectIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return
+	}
+
+	// Check if project exists and user has access
+	var project Project
+	err = db.(*database.DB).QueryRow(
+		"SELECT id, name, owner_id FROM projects WHERE id = $1",
+		projectID,
+	).Scan(&project.ID, &project.Name, &project.OwnerID)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	// Get user ID from JWT token (set by auth middleware)
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if user owns the project
+	if project.OwnerID != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	// Get preview environments for the project with service info
+	rows, err := db.(*database.DB).Query(
+		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
+				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+				s.id as service_id, s.name as service_name, s.type as service_type
+			FROM preview_environments pe
+			LEFT JOIN services s ON pe.service_id = s.id
+			WHERE pe.project_id = $1 
+			ORDER BY pe.created_at DESC`,
+		projectID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve preview environments"})
+		return
+	}
+	defer rows.Close()
+
+	var environments []PreviewEnvironment
+	for rows.Next() {
+		var env PreviewEnvironment
+		var serviceID sql.NullString
+		var serviceName sql.NullString
+		var serviceType sql.NullString
+
+		err := rows.Scan(
+			&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
+			&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
+			&serviceID, &serviceName, &serviceType,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan preview environment"})
+			return
+		}
+
+		if serviceID.Valid {
+			parsedServiceID, parseErr := uuid.Parse(serviceID.String)
+			if parseErr == nil {
+				env.Service = &Service{
+					ID:   parsedServiceID,
+					Name: serviceName.String,
+					Type: serviceType.String,
+				}
+			}
+		}
+
+		environments = append(environments, env)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"preview_environments": environments})
+}
+
+// handleCreatePreviewEnvironment creates a new preview environment
+func handleCreatePreviewEnvironment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
+	projectID, err := uuid.Parse(projectIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return
+	}
+
+	var req CreatePreviewEnvironmentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if req.ProjectID == uuid.Nil {
+		req.ProjectID = projectID
+	} else if req.ProjectID != projectID {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Project ID in URL and request body must match"})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if project exists and user has access
+	var project Project
+	err = db.(*database.DB).QueryRow(
+		"SELECT id, name, owner_id FROM projects WHERE id = $1",
+		req.ProjectID,
+	).Scan(&project.ID, &project.Name, &project.OwnerID)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	// Check if user owns the project
+	if project.OwnerID != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	// Check if service exists and belongs to the project
+	var service Service
+	err = db.(*database.DB).QueryRow(
+		"SELECT id, name, type FROM services WHERE id = $1 AND project_id = $2",
+		req.ServiceID, req.ProjectID,
+	).Scan(&service.ID, &service.Name, &service.Type)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found or doesn't belong to this project"})
+		return
+	}
+
+	// Check if preview environment already exists for this branch and service
+	var count int
+	err = db.(*database.DB).QueryRow(
+		"SELECT COUNT(*) FROM preview_environments WHERE service_id = $1 AND branch_name = $2 AND status NOT IN ('expired', 'stopped')",
+		req.ServiceID, req.BranchName,
+	).Scan(&count)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check existing preview environment"})
+		return
+	}
+
+	if count > 0 {
+		c.JSON(http.StatusConflict, gin.H{"error": "Preview environment already exists for this branch and service"})
+		return
+	}
+
+	// Set default TTL if not provided
+	ttlHours := req.TTLHours
+	if ttlHours == 0 {
+		ttlHours = 24 // Default 24 hours
+	}
+
+	// Create preview environment
+	env := PreviewEnvironment{
+		ID:          uuid.New(),
+		ProjectID:   req.ProjectID,
+		ServiceID:   req.ServiceID,
+		BranchName:  req.BranchName,
+		PRNumber:    req.PRNumber,
+		Environment: generatePreviewEnvironmentName(req.BranchName),
+		Status:      "building",
+		ExpiresAt:   &[]time.Time{time.Now().Add(time.Duration(ttlHours) * time.Hour)}[0],
+		CreatedAt:   time.Now(),
+		UpdatedAt:   time.Now(),
+	}
+
+	// Insert preview environment into database
+	_, err = db.(*database.DB).Exec(
+		`INSERT INTO preview_environments 
+			(id, project_id, service_id, branch_name, pr_number, environment, 
+			 status, url, expires_at, created_at, updated_at)
+			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`,
+		env.ID, env.ProjectID, env.ServiceID, env.BranchName, env.PRNumber,
+		env.Environment, env.Status, env.URL, env.ExpiresAt, env.CreatedAt, env.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create preview environment"})
+		return
+	}
+
+	deploymentID := uuid.New()
+	sanitizedBranch := strings.ReplaceAll(req.BranchName, "/", "-")
+	sanitizedBranch = strings.ReplaceAll(sanitizedBranch, "_", "-")
+	version := fmt.Sprintf("preview-%s-%d", sanitizedBranch, time.Now().Unix())
+	startedAt := time.Now().UTC()
+	completedAt := startedAt
+
+	_, deployErr := db.(*database.DB).Exec(
+		`INSERT INTO deployments
+			(id, service_id, version, commit_hash, status, started_at, completed_at, deployment_log, created_at, updated_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW(), NOW())`,
+		deploymentID,
+		req.ServiceID,
+		version,
+		req.BranchName,
+		"running",
+		startedAt,
+		completedAt,
+		fmt.Sprintf("Preview environment %s activated for branch %s", env.Environment, req.BranchName),
+	)
+	if deployErr != nil {
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE preview_environments
+			 SET status = 'failed', updated_at = NOW()
+			 WHERE id = $1`,
+			env.ID,
+		)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to provision preview deployment"})
+		return
+	}
+
+	if strings.TrimSpace(env.URL) == "" {
+		env.URL = fmt.Sprintf("https://%s.preview.containr.local", env.Environment)
+	}
+	env.Status = "running"
+	env.UpdatedAt = time.Now().UTC()
+	env.DeploymentID = &deploymentID
+
+	_, err = db.(*database.DB).Exec(
+		`UPDATE preview_environments
+		 SET status = $1, url = $2, updated_at = $3
+		 WHERE id = $4`,
+		env.Status,
+		env.URL,
+		env.UpdatedAt,
+		env.ID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to finalize preview environment"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"preview_environment": env})
+}
+
+// handleGetPreviewEnvironment retrieves a specific preview environment
+func handleGetPreviewEnvironment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	envIDStr := c.Param("id")
+	envID, err := uuid.Parse(envIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid preview environment ID"})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Get preview environment with project ownership check
+	var env PreviewEnvironment
+	var serviceID sql.NullString
+	var serviceName sql.NullString
+	var serviceType sql.NullString
+	err = db.(*database.DB).QueryRow(
+		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
+				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+				s.id as service_id, s.name as service_name, s.type as service_type
+			FROM preview_environments pe
+			LEFT JOIN services s ON pe.service_id = s.id
+			JOIN projects p ON pe.project_id = p.id
+			WHERE pe.id = $1 AND p.owner_id = $2`,
+		envID, userID,
+	).Scan(
+		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
+		&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
+		&serviceID, &serviceName, &serviceType,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
+		return
+	}
+
+	// Populate service info if available
+	if serviceID.Valid {
+		parsedServiceID, parseErr := uuid.Parse(serviceID.String)
+		if parseErr == nil {
+			env.Service = &Service{
+				ID:   parsedServiceID,
+				Name: serviceName.String,
+				Type: serviceType.String,
+			}
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"preview_environment": env})
+}
+
+// handleUpdatePreviewEnvironment updates a preview environment
+func handleUpdatePreviewEnvironment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	envIDStr := c.Param("id")
+	envID, err := uuid.Parse(envIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid preview environment ID"})
+		return
+	}
+
+	var req UpdatePreviewEnvironmentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if preview environment exists and user has access
+	var existingEnv PreviewEnvironment
+	err = db.(*database.DB).QueryRow(
+		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
+				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at
+			FROM preview_environments pe
+			JOIN projects p ON pe.project_id = p.id
+			WHERE pe.id = $1 AND p.owner_id = $2`,
+		envID, userID,
+	).Scan(
+		&existingEnv.ID, &existingEnv.ProjectID, &existingEnv.ServiceID, &existingEnv.BranchName,
+		&existingEnv.PRNumber, &existingEnv.Environment, &existingEnv.Status, &existingEnv.URL,
+		&existingEnv.ExpiresAt, &existingEnv.CreatedAt, &existingEnv.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
+		return
+	}
+
+	// Update fields if provided
+	if req.Status != "" {
+		existingEnv.Status = req.Status
+	}
+	if req.URL != "" {
+		existingEnv.URL = req.URL
+	}
+	if req.ExpiresAt != nil {
+		existingEnv.ExpiresAt = req.ExpiresAt
+	}
+	if req.TTLHours > 0 {
+		newExpiresAt := time.Now().Add(time.Duration(req.TTLHours) * time.Hour)
+		existingEnv.ExpiresAt = &newExpiresAt
+	}
+
+	existingEnv.UpdatedAt = time.Now()
+
+	// Update preview environment in database
+	_, err = db.(*database.DB).Exec(
+		`UPDATE preview_environments 
+			SET status = $1, url = $2, expires_at = $3, updated_at = $4
+			WHERE id = $5`,
+		existingEnv.Status, existingEnv.URL, existingEnv.ExpiresAt, existingEnv.UpdatedAt, existingEnv.ID,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update preview environment"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"preview_environment": existingEnv})
+}
+
+// handleDeletePreviewEnvironment deletes a preview environment
+func handleDeletePreviewEnvironment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	envIDStr := c.Param("id")
+	envID, err := uuid.Parse(envIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid preview environment ID"})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if preview environment exists and user has access
+	var projectOwnerID string
+	err = db.(*database.DB).QueryRow(
+		`SELECT p.owner_id 
+			FROM preview_environments pe
+			JOIN projects p ON pe.project_id = p.id
+			WHERE pe.id = $1`,
+		envID,
+	).Scan(&projectOwnerID)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
+		return
+	}
+
+	// Check if user owns the project
+	if projectOwnerID != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	cleanupID := uuid.New()
+	cleanupStartedAt := time.Now().UTC()
+	cleanupCompletedAt := cleanupStartedAt
+
+	_, _ = db.(*database.DB).Exec(
+		`INSERT INTO deployments
+			(id, service_id, version, status, started_at, completed_at, deployment_log, created_at, updated_at)
+		 VALUES ($1, (SELECT service_id FROM preview_environments WHERE id = $2), $3, $4, $5, $6, $7, NOW(), NOW())`,
+		cleanupID,
+		envID,
+		"preview-cleanup",
+		"rolled_back",
+		cleanupStartedAt,
+		cleanupCompletedAt,
+		"Preview environment resources cleaned up",
+	)
+
+	// Delete preview environment
+	_, err = db.(*database.DB).Exec(
+		"DELETE FROM preview_environments WHERE id = $1",
+		envID,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete preview environment"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "Preview environment deleted successfully"})
+}
+
+// handlePromotePreviewEnvironment promotes a preview environment to production/development
+func handlePromotePreviewEnvironment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	envIDStr := c.Param("id")
+	envID, err := uuid.Parse(envIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid preview environment ID"})
+		return
+	}
+
+	var req PromotePreviewEnvironmentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Get preview environment details
+	var env PreviewEnvironment
+	err = db.(*database.DB).QueryRow(
+		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment, pe.status
+			FROM preview_environments pe
+			JOIN projects p ON pe.project_id = p.id
+			WHERE pe.id = $1 AND p.owner_id = $2`,
+		envID, userID,
+	).Scan(
+		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.Environment, &env.Status,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
+		return
+	}
+
+	// Check if preview environment is in a state that can be promoted
+	if env.Status != "running" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Preview environment must be running to promote"})
+		return
+	}
+
+	deploymentID := uuid.New()
+	_, err = db.(*database.DB).Exec(
+		`INSERT INTO deployments (id, service_id, status, created_at, updated_at)
+		 VALUES ($1, $2, $3, NOW(), NOW())`,
+		deploymentID, env.ServiceID, "pending",
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create promotion deployment"})
+		return
+	}
+
+	if _, err := db.(*database.DB).Exec(
+		`UPDATE services
+		 SET environment = $1, updated_at = NOW()
+		 WHERE id = $2`,
+		req.TargetEnvironment, env.ServiceID,
+	); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service target environment"})
+		return
+	}
+
+	previewStatus := "stopped"
+	if req.CreateBackup {
+		previewStatus = "expired"
+	}
+
+	if _, err := db.(*database.DB).Exec(
+		`UPDATE preview_environments
+		 SET status = $1, updated_at = NOW()
+		 WHERE id = $2`,
+		previewStatus, env.ID,
+	); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update preview environment status"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Preview environment promoted successfully",
+		"promotion": map[string]interface{}{
+			"preview_environment_id": env.ID,
+			"target_environment":     req.TargetEnvironment,
+			"branch_name":            env.BranchName,
+			"create_backup":          req.CreateBackup,
+			"deployment_id":          deploymentID,
+			"status":                 "queued",
+			"preview_status":         previewStatus,
+		},
+	})
+}
+
+// generatePreviewEnvironmentName generates a unique environment name for preview
+func generatePreviewEnvironmentName(branchName string) string {
+	timestamp := time.Now().Format("20060102-150405")
+	// Sanitize branch name
+	sanitizedBranch := strings.ReplaceAll(branchName, "/", "-")
+	sanitizedBranch = strings.ReplaceAll(sanitizedBranch, "_", "-")
+	return fmt.Sprintf("preview-%s-%s", sanitizedBranch, timestamp)
+}
+
+// handleCleanupExpiredPreviewEnvironments cleans up expired preview environments
+func handleCleanupExpiredPreviewEnvironments(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Find expired preview environments for user's projects
+	rows, err := db.(*database.DB).Query(
+		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment
+			FROM preview_environments pe
+			JOIN projects p ON pe.project_id = p.id
+			WHERE p.owner_id = $1 AND pe.expires_at < NOW() AND pe.status != 'expired'`,
+		userID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to find expired preview environments"})
+		return
+	}
+	defer rows.Close()
+
+	var expiredEnvs []PreviewEnvironment
+	for rows.Next() {
+		var env PreviewEnvironment
+		err := rows.Scan(
+			&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.Environment,
+		)
+		if err != nil {
+			continue
+		}
+		expiredEnvs = append(expiredEnvs, env)
+	}
+
+	// Mark expired environments as expired and trigger cleanup
+	cleanupCount := 0
+	for _, env := range expiredEnvs {
+		// Update status to expired
+		_, err := db.(*database.DB).Exec(
+			"UPDATE preview_environments SET status = 'expired', updated_at = NOW() WHERE id = $1",
+			env.ID,
+		)
+		if err != nil {
+			continue
+		}
+
+		cleanupCount++
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":              "Cleanup completed",
+		"cleaned_count":        cleanupCount,
+		"expired_environments": expiredEnvs,
+	})
+}

app/backend/internal/api/production_behavior_test.go

@@ -0,0 +1,88 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestGitProviderIntegrationEndpointsRequireAuthentication(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	v1 := router.Group("/api/v1")
+	v1.GET("/git/providers/:providerId/repositories", handleGetGitRepositories)
+	v1.POST("/git/repositories/connect", handleConnectGitRepository)
+	v1.POST("/git/webhooks", handleCreateWebhook)
+
+	cases := []struct {
+		name   string
+		method string
+		path   string
+	}{
+		{name: "list provider repositories", method: http.MethodGet, path: "/api/v1/git/providers/any/repositories"},
+		{name: "connect repository", method: http.MethodPost, path: "/api/v1/git/repositories/connect"},
+		{name: "create webhook", method: http.MethodPost, path: "/api/v1/git/webhooks"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.method, tc.path, nil)
+			rec := httptest.NewRecorder()
+			router.ServeHTTP(rec, req)
+
+			if rec.Code != http.StatusUnauthorized {
+				t.Fatalf("expected status %d, got %d", http.StatusUnauthorized, rec.Code)
+			}
+
+			var body map[string]any
+			if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+				t.Fatalf("failed to decode response: %v", err)
+			}
+			if body["error"] != "User not authenticated" {
+				t.Fatalf("expected auth error, got %v", body["error"])
+			}
+		})
+	}
+}
+
+func TestRespondDependencyUnavailable(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.GET("/healthz", func(c *gin.Context) {
+		respondDependencyUnavailable(c, "docker", "not configured")
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/healthz", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("expected status %d, got %d", http.StatusServiceUnavailable, rec.Code)
+	}
+
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if body["code"] != "DEPENDENCY_UNAVAILABLE" {
+		t.Fatalf("expected code DEPENDENCY_UNAVAILABLE, got %v", body["code"])
+	}
+}
+
+func TestRequireAuthenticatedUserIDRejectsMissingUserContext(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	rec := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(rec)
+	c.Request = httptest.NewRequest(http.MethodGet, "/secure", nil)
+
+	userID, ok := requireAuthenticatedUserID(c)
+	if ok {
+		t.Fatalf("expected helper to reject missing user context, got user ID %q", userID)
+	}
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected status %d, got %d", http.StatusUnauthorized, rec.Code)
+	}
+}

app/backend/internal/api/projects.go

@@ -0,0 +1,405 @@
+package api
+
+import (
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"database/sql"
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type Project struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	OwnerID     string `json:"owner_id"`
+	CreatedAt   string `json:"created_at"`
+	UpdatedAt   string `json:"updated_at"`
+}
+
+type ProjectStats struct {
+	ServiceCount    int     `json:"service_count"`
+	DeploymentCount int     `json:"deployment_count"`
+	RunningServices int     `json:"running_services"`
+	LastDeployment  *string `json:"last_deployment"`
+}
+
+type ProjectWithStats struct {
+	Project
+	Stats ProjectStats `json:"stats"`
+}
+
+type CreateProjectRequest struct {
+	Name        string `json:"name" binding:"required,min=2"`
+	Description string `json:"description"`
+}
+
+type UpdateProjectRequest struct {
+	Name        *string `json:"name,omitempty"`
+	Description *string `json:"description,omitempty"`
+}
+
+func handleGetProjects(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserUUID(c)
+	if !ok {
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	search := strings.TrimSpace(c.DefaultQuery("search", ""))
+
+	if page < 1 {
+		page = 1
+	}
+	if limit > 100 || limit < 1 {
+		limit = 10
+	}
+	offset := (page - 1) * limit
+
+	searchParam := sql.NullString{}
+	if search != "" {
+		searchParam = sql.NullString{String: search, Valid: true}
+	}
+
+	rows, err := queries.ListProjectsWithStatsByUser(c.Request.Context(), sqlcdb.ListProjectsWithStatsByUserParams{
+		UserID:      userID,
+		Search:      searchParam,
+		LimitCount:  int32(limit),
+		OffsetCount: int32(offset),
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database query error"})
+		return
+	}
+
+	projects := make([]ProjectWithStats, 0, len(rows))
+	for _, row := range rows {
+		projects = append(projects, mapProjectWithStatsRow(row))
+	}
+
+	total, err := queries.CountProjectsByUser(c.Request.Context(), sqlcdb.CountProjectsByUserParams{
+		UserID: userID,
+		Search: searchParam,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database count error"})
+		return
+	}
+
+	totalCount := int(total)
+	c.JSON(http.StatusOK, gin.H{
+		"projects": projects,
+		"pagination": gin.H{
+			"page":  page,
+			"limit": limit,
+			"total": totalCount,
+			"pages": (totalCount + limit - 1) / limit,
+		},
+	})
+}
+
+func handleCreateProject(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserUUID(c)
+	if !ok {
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+	ctx := c.Request.Context()
+
+	var req CreateProjectRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	req.Name = strings.TrimSpace(req.Name)
+	if len(req.Name) < 2 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name must be at least 2 characters"})
+		return
+	}
+
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create project"})
+		return
+	}
+	defer tx.Rollback()
+
+	txQueries := queries.WithTx(tx)
+	projectRow, err := txQueries.CreateProject(ctx, sqlcdb.CreateProjectParams{
+		Name:        req.Name,
+		Description: nullableText(strings.TrimSpace(req.Description)),
+		OwnerID:     userID,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create project"})
+		return
+	}
+
+	environments := []string{"production", "preview", "development"}
+	for _, env := range environments {
+		err = txQueries.InsertProjectEnvironment(ctx, sqlcdb.InsertProjectEnvironmentParams{
+			Name:      env,
+			ProjectID: projectRow.ID,
+		})
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create environments"})
+			return
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create project"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, mapSQLCProject(projectRow))
+}
+
+func handleGetProject(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserUUID(c)
+	if !ok {
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	projectID, ok := parseProjectIDParam(c)
+	if !ok {
+		return
+	}
+
+	projectRow, err := queries.GetProjectByIDForUser(c.Request.Context(), sqlcdb.GetProjectByIDForUserParams{
+		ProjectID: projectID,
+		UserID:    userID,
+	})
+	if errors.Is(err, sql.ErrNoRows) {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+
+	c.JSON(http.StatusOK, mapSQLCProject(projectRow))
+}
+
+func handleUpdateProject(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserUUID(c)
+	if !ok {
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	projectID, ok := parseProjectIDParam(c)
+	if !ok {
+		return
+	}
+
+	role, err := queries.GetProjectRoleForUser(c.Request.Context(), sqlcdb.GetProjectRoleForUserParams{
+		ProjectID: projectID,
+		UserID:    userID,
+	})
+	if errors.Is(err, sql.ErrNoRows) || role == "" || role == "viewer" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Insufficient permissions"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+
+	var req UpdateProjectRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if req.Name == nil && req.Description == nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "No fields to update"})
+		return
+	}
+
+	nameParam := sql.NullString{}
+	if req.Name != nil {
+		trimmedName := strings.TrimSpace(*req.Name)
+		if len(trimmedName) < 2 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "name must be at least 2 characters"})
+			return
+		}
+		nameParam = sql.NullString{String: trimmedName, Valid: true}
+	}
+
+	descriptionParam := sql.NullString{}
+	if req.Description != nil {
+		descriptionParam = sql.NullString{String: strings.TrimSpace(*req.Description), Valid: true}
+	}
+
+	updatedRows, err := queries.UpdateProjectByID(c.Request.Context(), sqlcdb.UpdateProjectByIDParams{
+		Name:        nameParam,
+		Description: descriptionParam,
+		ProjectID:   projectID,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update project"})
+		return
+	}
+	if updatedRows == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	projectRow, err := queries.GetProjectByIDForUser(c.Request.Context(), sqlcdb.GetProjectByIDForUserParams{
+		ProjectID: projectID,
+		UserID:    userID,
+	})
+	if errors.Is(err, sql.ErrNoRows) {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+
+	c.JSON(http.StatusOK, mapSQLCProject(projectRow))
+}
+
+func handleDeleteProject(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserUUID(c)
+	if !ok {
+		return
+	}
+
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	projectID, ok := parseProjectIDParam(c)
+	if !ok {
+		return
+	}
+
+	ownerID, err := queries.GetProjectOwnerByID(c.Request.Context(), projectID)
+	if errors.Is(err, sql.ErrNoRows) {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
+		return
+	}
+
+	if ownerID != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Only project owners can delete projects"})
+		return
+	}
+
+	deletedRows, err := queries.DeleteProjectByID(c.Request.Context(), projectID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete project"})
+		return
+	}
+	if deletedRows == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "Project deleted successfully"})
+}
+
+func requireAuthenticatedUserUUID(c *gin.Context) (uuid.UUID, bool) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return uuid.Nil, false
+	}
+
+	parsedUserID, err := uuid.Parse(userID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
+		return uuid.Nil, false
+	}
+
+	return parsedUserID, true
+}
+
+func parseProjectIDParam(c *gin.Context) (uuid.UUID, bool) {
+	projectID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return uuid.Nil, false
+	}
+	return projectID, true
+}
+
+func mapProjectWithStatsRow(row sqlcdb.ListProjectsWithStatsByUserRow) ProjectWithStats {
+	result := ProjectWithStats{
+		Project: mapProjectFields(row.ID, row.Name, row.Description, row.OwnerID, row.CreatedAt, row.UpdatedAt),
+		Stats: ProjectStats{
+			ServiceCount:    int(row.ServiceCount),
+			DeploymentCount: int(row.DeploymentCount),
+			RunningServices: int(row.RunningServices),
+			LastDeployment:  nullableTimestampStringPtr(row.LastDeployment),
+		},
+	}
+	return result
+}
+
+func mapSQLCProject(project sqlcdb.Project) Project {
+	return mapProjectFields(project.ID, project.Name, project.Description, project.OwnerID, project.CreatedAt, project.UpdatedAt)
+}
+
+func mapProjectFields(id uuid.UUID, name string, description sql.NullString, ownerID uuid.UUID, createdAt, updatedAt sql.NullTime) Project {
+	return Project{
+		ID:          id.String(),
+		Name:        name,
+		Description: nullableStringValue(description),
+		OwnerID:     ownerID.String(),
+		CreatedAt:   nullableTimestampString(createdAt),
+		UpdatedAt:   nullableTimestampString(updatedAt),
+	}
+}
+
+func nullableText(value string) sql.NullString {
+	if value == "" {
+		return sql.NullString{}
+	}
+	return sql.NullString{String: value, Valid: true}
+}
+
+func nullableStringValue(value sql.NullString) string {
+	if value.Valid {
+		return value.String
+	}
+	return ""
+}
+
+func nullableTimestampString(value sql.NullTime) string {
+	if value.Valid {
+		return value.Time.Format(time.RFC3339)
+	}
+	return ""
+}
+
+func nullableTimestampStringPtr(value sql.NullTime) *string {
+	if value.Valid {
+		formatted := value.Time.Format(time.RFC3339)
+		return &formatted
+	}
+	return nil
+}

app/backend/internal/api/proxmox.go

@@ -0,0 +1,375 @@
+package api
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"containr/internal/proxmox"
+
+	"github.com/gin-gonic/gin"
+)
+
+// ProxmoxHandler handles Proxmox-related API endpoints
+type ProxmoxHandler struct {
+	service *proxmox.Service
+}
+
+// NewProxmoxHandler creates a new Proxmox handler
+func NewProxmoxHandler(service *proxmox.Service) *ProxmoxHandler {
+	return &ProxmoxHandler{
+		service: service,
+	}
+}
+
+// RegisterProxmoxRoutes registers Proxmox API routes
+func RegisterProxmoxRoutes(router *gin.Engine, service *proxmox.Service) {
+	handler := NewProxmoxHandler(service)
+
+	proxmox := router.Group("/api/proxmox")
+	{
+		// Cluster and node management
+		proxmox.GET("/cluster/status", handler.getClusterStatus)
+		proxmox.GET("/nodes", handler.getNodes)
+		proxmox.GET("/nodes/:nodeName/stats", handler.getNodeStats)
+		proxmox.GET("/nodes/:nodeName/templates", handler.getTemplates)
+
+		// VM management
+		proxmox.GET("/vms", handler.getAllVMs)
+		proxmox.GET("/vms/:vmid/status", handler.getVMStatus)
+		proxmox.POST("/vms", handler.createVM)
+		proxmox.POST("/vms/:vmid/start", handler.startVM)
+		proxmox.POST("/vms/:vmid/stop", handler.stopVM)
+		proxmox.DELETE("/vms/:vmid", handler.deleteVM)
+
+		// Container management
+		proxmox.GET("/containers", handler.getAllContainers)
+		proxmox.POST("/containers", handler.createContainer)
+		proxmox.POST("/containers/:vmid/start", handler.startContainer)
+		proxmox.POST("/containers/:vmid/stop", handler.stopContainer)
+		proxmox.DELETE("/containers/:vmid", handler.deleteContainer)
+
+		// Resource management
+		proxmox.GET("/resources/usage", handler.getResourceUsage)
+		proxmox.GET("/health", handler.healthCheck)
+	}
+}
+
+// getClusterStatus returns the overall cluster status
+func (h *ProxmoxHandler) getClusterStatus(c *gin.Context) {
+	status, err := h.service.GetClusterStatus()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"data": status})
+}
+
+// getNodes returns all nodes in the cluster
+func (h *ProxmoxHandler) getNodes(c *gin.Context) {
+	nodes, err := h.service.GetAllNodes()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"data": nodes})
+}
+
+// getNodeStats returns detailed statistics for a specific node
+func (h *ProxmoxHandler) getNodeStats(c *gin.Context) {
+	nodeName := c.Param("nodeName")
+
+	stats, err := h.service.GetNodeStats(nodeName)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"data": stats})
+}
+
+// getTemplates returns available VM and container templates
+func (h *ProxmoxHandler) getTemplates(c *gin.Context) {
+	nodeName := c.Param("nodeName")
+
+	templates, err := h.service.GetAvailableTemplates(nodeName)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"data": templates})
+}
+
+// getAllVMs returns all VMs across all nodes
+func (h *ProxmoxHandler) getAllVMs(c *gin.Context) {
+	vms, err := h.service.GetAllVMs()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"data": vms})
+}
+
+// getVMStatus returns the status of a specific VM
+func (h *ProxmoxHandler) getVMStatus(c *gin.Context) {
+	vmidStr := c.Param("vmid")
+	vmid, err := strconv.Atoi(vmidStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid VM ID"})
+		return
+	}
+
+	nodeName, err := h.service.FindNodeForVM(vmid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	status, err := h.service.GetInstanceStatus(nodeName, vmid, "qemu")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"data": status})
+}
+
+// createVM creates a new VM
+func (h *ProxmoxHandler) createVM(c *gin.Context) {
+	var req struct {
+		NodeName string `json:"node_name"`
+		proxmox.ServiceVMConfig
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	targetNode := strings.TrimSpace(req.NodeName)
+	if targetNode == "" {
+		resolvedNode, err := h.service.SelectBestNodeForWorkload(req.Memory, req.Cores)
+		if err != nil {
+			c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+			return
+		}
+		targetNode = resolvedNode
+	}
+
+	vm, err := h.service.CreateServiceVM(targetNode, req.ServiceVMConfig)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"data": vm})
+}
+
+// startVM starts a VM
+func (h *ProxmoxHandler) startVM(c *gin.Context) {
+	vmidStr := c.Param("vmid")
+	vmid, err := strconv.Atoi(vmidStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid VM ID"})
+		return
+	}
+
+	nodeName, err := h.service.FindNodeForVM(vmid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	err = h.service.StartInstance(nodeName, vmid, "qemu")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "VM started successfully"})
+}
+
+// stopVM stops a VM
+func (h *ProxmoxHandler) stopVM(c *gin.Context) {
+	vmidStr := c.Param("vmid")
+	vmid, err := strconv.Atoi(vmidStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid VM ID"})
+		return
+	}
+
+	nodeName, err := h.service.FindNodeForVM(vmid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	err = h.service.StopInstance(nodeName, vmid, "qemu")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "VM stopped successfully"})
+}
+
+// deleteVM deletes a VM
+func (h *ProxmoxHandler) deleteVM(c *gin.Context) {
+	vmidStr := c.Param("vmid")
+	vmid, err := strconv.Atoi(vmidStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid VM ID"})
+		return
+	}
+
+	nodeName, err := h.service.FindNodeForVM(vmid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	err = h.service.DeleteInstance(nodeName, vmid, "qemu")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "VM deleted successfully"})
+}
+
+// getAllContainers returns all containers across all nodes
+func (h *ProxmoxHandler) getAllContainers(c *gin.Context) {
+	containers, err := h.service.GetAllContainers()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"data": containers})
+}
+
+// createContainer creates a new container
+func (h *ProxmoxHandler) createContainer(c *gin.Context) {
+	var req struct {
+		NodeName string `json:"node_name"`
+		proxmox.ServiceContainerConfig
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	targetNode := strings.TrimSpace(req.NodeName)
+	if targetNode == "" {
+		resolvedNode, err := h.service.SelectBestNodeForWorkload(req.Memory, req.Cores)
+		if err != nil {
+			c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+			return
+		}
+		targetNode = resolvedNode
+	}
+
+	container, err := h.service.CreateServiceContainer(targetNode, req.ServiceContainerConfig)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"data": container})
+}
+
+// startContainer starts a container
+func (h *ProxmoxHandler) startContainer(c *gin.Context) {
+	vmidStr := c.Param("vmid")
+	vmid, err := strconv.Atoi(vmidStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid container ID"})
+		return
+	}
+
+	nodeName, err := h.service.FindNodeForContainer(vmid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	err = h.service.StartInstance(nodeName, vmid, "lxc")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "Container started successfully"})
+}
+
+// stopContainer stops a container
+func (h *ProxmoxHandler) stopContainer(c *gin.Context) {
+	vmidStr := c.Param("vmid")
+	vmid, err := strconv.Atoi(vmidStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid container ID"})
+		return
+	}
+
+	nodeName, err := h.service.FindNodeForContainer(vmid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	err = h.service.StopInstance(nodeName, vmid, "lxc")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "Container stopped successfully"})
+}
+
+// deleteContainer deletes a container
+func (h *ProxmoxHandler) deleteContainer(c *gin.Context) {
+	vmidStr := c.Param("vmid")
+	vmid, err := strconv.Atoi(vmidStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid container ID"})
+		return
+	}
+
+	nodeName, err := h.service.FindNodeForContainer(vmid)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	err = h.service.DeleteInstance(nodeName, vmid, "lxc")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "Container deleted successfully"})
+}
+
+// getResourceUsage returns resource usage across the cluster
+func (h *ProxmoxHandler) getResourceUsage(c *gin.Context) {
+	usage, err := h.service.GetResourceUsage()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"data": usage})
+}
+
+// healthCheck validates the connection to Proxmox
+func (h *ProxmoxHandler) healthCheck(c *gin.Context) {
+	err := h.service.ValidateConnection()
+	if err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{
+			"status": "unhealthy",
+			"error":  err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "healthy",
+		"message": "Proxmox connection is working",
+	})
+}

app/backend/internal/api/routes.go

@@ -0,0 +1,328 @@
+package api
+
+import (
+	"context"
+	"log"
+	"net/http"
+	"time"
+
+	"containr/internal/build"
+	"containr/internal/config"
+	"containr/internal/database"
+	"containr/internal/deployment"
+	"containr/internal/docker"
+	"containr/internal/ha"
+	"containr/internal/metrics"
+	"containr/internal/middleware"
+	"containr/internal/scaling"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg *config.Config) {
+	// Expose Better Auth through backend so frontend can use a single backend origin.
+	setupAuthProxyRoutes(router, cfg)
+
+	// Initialize Docker client (non-fatal if it fails)
+	var dockerClient *docker.Client
+	var buildManager *build.BuildManager
+	var deploymentEngine *deployment.DeploymentEngine
+
+	if client, err := docker.NewClient(); err != nil {
+		log.Printf("Warning: Failed to initialize Docker client: %v", err)
+		log.Printf("Docker-related features will be disabled")
+	} else {
+		dockerClient = client
+		buildManager = build.NewBuildManager("/tmp/containr-builds", dockerClient)
+		deploymentEngine = deployment.NewDeploymentEngine(buildManager, dockerClient)
+	}
+
+	// Initialize build handler
+	buildHandler := NewBuildHandler(buildManager, dockerClient, db)
+
+	// Initialize scheduler and metrics systems
+	scheduler := deployment.NewScheduler()
+	var metricsStorage metrics.MetricsStorage = metrics.NewInMemoryMetricsStorage()
+	if db != nil && db.DB != nil {
+		metricsStorage = metrics.NewPostgreSQLMetricsStorage(db.DB)
+	}
+	metricsCollector := metrics.NewMetricsCollector(scheduler, metricsStorage)
+	autoScaler := scaling.NewAutoScaler(scheduler, metricsCollector)
+	haManager := ha.NewHighAvailabilityManager(scheduler, metricsCollector)
+	haAPIManager := NewHAManager(haManager)
+
+	// Initialize scaling handler
+	scalingHandler := NewScalingHandler(autoScaler)
+
+	// Initialize GORM for agent system
+	gormDB, err := gorm.Open(postgres.Open(cfg.DatabaseURL), &gorm.Config{})
+	if err != nil {
+		panic("Failed to initialize GORM: " + err.Error())
+	}
+
+	// Initialize agent handler
+	agentHandler := NewNodeAgentHandler(gormDB)
+
+	// Initialize database handler
+	databaseHandler := NewDatabaseHandler(db.DB, dockerClient)
+
+	// Initialize security handler
+	securityHandler := NewSecurityHandler(db, cfg.JWTSecret)
+
+	// Note: Proxmox integration can be added later if needed
+	// For now, focusing on core Containr and APwhy functionality
+
+	// Add database and JWT secret to gin context for handlers
+	router.Use(func(c *gin.Context) {
+		c.Set("db", db)
+		c.Set("redis", redis)
+		c.Set("jwt_secret", cfg.JWTSecret)
+		c.Set("docker_client", dockerClient)
+		c.Set("database_handler", databaseHandler)
+		c.Set("build_manager", buildManager)
+		if deploymentEngine != nil {
+			c.Set("deployment_engine", deploymentEngine)
+		}
+		c.Set("scheduler", scheduler)
+		c.Set("metrics_collector", metricsCollector)
+		c.Set("auto_scaler", autoScaler)
+		c.Set("ha_manager", haManager)
+		c.Set("scaling_handler", scalingHandler)
+		c.Set("gorm_db", gormDB)
+		c.Next()
+	})
+
+	go func() {
+		if err := haManager.Start(context.Background()); err != nil {
+			log.Printf("HA manager exited: %v", err)
+		}
+	}()
+
+	// Health check endpoint
+	router.GET("/live", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{
+			"status":  "ok",
+			"service": "containr-api",
+		})
+	})
+	router.HEAD("/live", func(c *gin.Context) {
+		c.Status(http.StatusOK)
+	})
+
+	healthHandler := func(c *gin.Context) {
+		ctx, cancel := context.WithTimeout(c.Request.Context(), 2*time.Second)
+		defer cancel()
+
+		databaseStatus := "ok"
+		redisStatus := "ok"
+		checks := gin.H{
+			"database": databaseStatus,
+			"redis":    redisStatus,
+		}
+		overallStatus := "ok"
+		statusCode := http.StatusOK
+
+		if err := db.Health(ctx); err != nil {
+			databaseStatus = "unhealthy"
+			checks["database"] = databaseStatus
+			checks["databaseError"] = err.Error()
+			overallStatus = "degraded"
+			statusCode = http.StatusServiceUnavailable
+		}
+
+		if redis == nil {
+			redisStatus = "unhealthy"
+			checks["redis"] = redisStatus
+			checks["redisError"] = "redis client not initialized"
+			overallStatus = "degraded"
+			statusCode = http.StatusServiceUnavailable
+		} else if err := redis.Health(ctx); err != nil {
+			redisStatus = "unhealthy"
+			checks["redis"] = redisStatus
+			checks["redisError"] = err.Error()
+			overallStatus = "degraded"
+			statusCode = http.StatusServiceUnavailable
+		}
+
+		c.JSON(statusCode, gin.H{
+			"status":  overallStatus,
+			"service": "containr-api",
+			"checks":  checks,
+		})
+	}
+	router.GET("/health", healthHandler)
+	router.HEAD("/health", healthHandler)
+	router.GET("/ready", healthHandler)
+	router.HEAD("/ready", healthHandler)
+
+	// API v1 routes
+	v1 := router.Group("/api/v1")
+	{
+		// Public routes (no authentication required)
+		public := v1.Group("/")
+		{
+			public.POST("/auth/login", handleLogin)
+			public.POST("/auth/register", handleRegister)
+		}
+
+		// Protected routes (authentication required)
+		protected := v1.Group("/")
+		protected.Use(middleware.Auth(cfg.JWTSecret))
+		{
+			// User routes
+			protected.GET("/user/profile", handleGetProfile)
+			protected.PUT("/user/profile", handleUpdateProfile)
+
+			// Project routes
+			protected.GET("/projects", handleGetProjects)
+			protected.POST("/projects", handleCreateProject)
+
+			// Service routes (nested under projects)
+			protected.GET("/projects/:id/services", handleGetServices)
+			protected.POST("/projects/:id/services", handleCreateService)
+
+			// Generic project routes
+			protected.GET("/projects/:id", handleGetProject)
+			protected.PUT("/projects/:id", handleUpdateProject)
+			protected.DELETE("/projects/:id", handleDeleteProject)
+
+			// Service routes
+			protected.GET("/services/:id", handleGetService)
+			protected.PUT("/services/:id", handleUpdateService)
+			protected.DELETE("/services/:id", handleDeleteService)
+
+			// Deployment routes
+			protected.GET("/services/:id/deployments", handleGetDeployments)
+			protected.POST("/services/:id/deployments", handleCreateDeployment)
+			protected.GET("/deployments/:id", handleGetDeployment)
+			protected.POST("/deployments/:id/rollback", handleRollbackDeployment)
+
+			// Environment variables routes
+			protected.GET("/services/:id/variables", handleGetVariables)
+			protected.PUT("/services/:id/variables", handleUpdateVariables)
+
+			// Logs routes
+			protected.GET("/services/:id/logs", handleGetLogs)
+			protected.GET("/deployments/:id/logs", handleGetDeploymentLogs)
+
+			// Git integration routes
+			protected.GET("/git/github-app/install-url", handleGetGitHubAppInstallURL)
+			protected.POST("/git/github-app/connect", handleConnectGitHubApp)
+			protected.GET("/git/providers", handleGetGitProviders)
+			protected.POST("/git/providers", handleCreateGitProvider)
+			protected.GET("/git/providers/:providerId/repositories", handleGetGitRepositories)
+			protected.POST("/git/repositories/connect", handleConnectGitRepository)
+			protected.GET("/git/repositories", handleGetConnectedRepositories)
+			protected.POST("/git/webhooks", handleCreateWebhook)
+
+			// Build routes
+			protected.POST("/builds", buildHandler.StartBuild)
+			protected.GET("/builds", buildHandler.ListBuilds)
+			protected.GET("/builds/:id", buildHandler.GetBuildStatus)
+			protected.POST("/builds/:id/cancel", buildHandler.CancelBuild)
+			protected.GET("/builds/:id/logs", buildHandler.GetBuildLogs)
+			protected.POST("/builds/plan", buildHandler.GetBuildPlan)
+			protected.GET("/builds/detect", buildHandler.DetectBuildType)
+
+			// Scaling routes
+			scalingHandler.RegisterRoutes(protected)
+			haAPIManager.RegisterRoutes(protected)
+
+			// Database routes
+			protected.GET("/databases", databaseHandler.GetDatabases)
+			protected.POST("/databases", databaseHandler.CreateDatabase)
+			protected.GET("/databases/:id", databaseHandler.GetDatabase)
+			protected.PUT("/databases/:id", databaseHandler.UpdateDatabase)
+			protected.DELETE("/databases/:id", databaseHandler.DeleteDatabase)
+			protected.POST("/databases/:id/action", databaseHandler.PerformDatabaseAction)
+			protected.POST("/databases/:id/backup", databaseHandler.CreateBackup)
+			protected.POST("/databases/:id/restore", databaseHandler.RestoreBackup)
+
+			// Node Agent routes
+			api := router.Group("/api")
+			api.Use(middleware.Auth(cfg.JWTSecret))
+			agentHandler.SetupRoutes(api)
+
+			// Preview Environments routes
+			protected.GET("/projects/:id/preview-environments", handleGetPreviewEnvironments)
+			protected.POST("/projects/:id/preview-environments", handleCreatePreviewEnvironment)
+			protected.GET("/preview-environments/:id", handleGetPreviewEnvironment)
+			protected.PUT("/preview-environments/:id", handleUpdatePreviewEnvironment)
+			protected.DELETE("/preview-environments/:id", handleDeletePreviewEnvironment)
+			protected.POST("/preview-environments/:id/promote", handlePromotePreviewEnvironment)
+			protected.POST("/preview-environments/cleanup-expired", handleCleanupExpiredPreviewEnvironments)
+
+			// Security routes
+			protected.POST("/security/scans", securityHandler.StartSecurityScan)
+			protected.GET("/security/scans/:id", securityHandler.GetSecurityScan)
+			protected.GET("/projects/:id/security/history", securityHandler.GetProjectSecurityHistory)
+			protected.GET("/projects/:id/vulnerabilities", securityHandler.GetVulnerabilities)
+			protected.PUT("/vulnerabilities/:id", securityHandler.UpdateVulnerability)
+			protected.POST("/security/compliance/assess", securityHandler.StartComplianceAssessment)
+			protected.GET("/security/compliance/reports/:id", securityHandler.GetComplianceReport)
+			protected.GET("/security/compliance/frameworks", securityHandler.GetComplianceFrameworks)
+			protected.POST("/security/compliance/gdpr/init", securityHandler.InitializeGDPRFramework)
+			protected.GET("/projects/:id/security/metrics", securityHandler.GetSecurityMetrics)
+			protected.GET("/projects/:id/security/audit-logs", securityHandler.GetAuditLogs)
+
+			// WebSocket endpoint
+			protected.GET("/ws", handleWebSocket)
+
+			// Templates routes
+			protected.GET("/templates", handleGetTemplates)
+			protected.GET("/templates/:id", handleGetTemplate)
+			protected.POST("/templates/:id/deploy", handleCreateFromTemplate)
+
+			// Cron Jobs routes
+			protected.GET("/cron-jobs", handleGetCronJobs)
+			protected.POST("/cron-jobs", handleCreateCronJob)
+			protected.GET("/cron-jobs/:id", handleGetCronJob)
+			protected.PUT("/cron-jobs/:id", handleUpdateCronJob)
+			protected.DELETE("/cron-jobs/:id", handleDeleteCronJob)
+			protected.GET("/cron-jobs/:id/executions", handleGetCronExecutions)
+			protected.POST("/cron-jobs/:id/trigger", handleTriggerCronJob)
+
+			// Audit Logs routes
+			protected.GET("/audit-logs", handleGetAuditLogs)
+			protected.GET("/audit-logs/:resource/:id", handleGetResourceAuditLogs)
+		}
+
+		// APwhy Gateway routes
+		apwhy := router.Group("/api/v1")
+		{
+			// Health check (no auth required)
+			apwhy.GET("/health", func(c *gin.Context) {
+				c.JSON(200, gin.H{
+					"ok": true,
+					"data": gin.H{
+						"status":      "ok",
+						"name":        "Containr + APwhy",
+						"database":    "postgresql",
+						"generatedAt": time.Now().UTC().Format(time.RFC3339),
+					},
+				})
+			})
+		}
+
+		// Protected APwhy routes (authentication required)
+		protectedAPwhy := router.Group("/api/v1")
+		protectedAPwhy.Use(middleware.Auth(cfg.JWTSecret))
+		{
+			// Service management
+			protectedAPwhy.GET("/services", handleAPwhyServicesList)
+			protectedAPwhy.POST("/services", handleAPwhyServicesCreate)
+			protectedAPwhy.PATCH("/services/:id", handleAPwhyServicesPatch)
+
+			// API Keys
+			protectedAPwhy.GET("/keys", handleAPwhyKeysList)
+			protectedAPwhy.POST("/keys", handleAPwhyKeysCreate)
+			protectedAPwhy.PATCH("/keys/:id", handleAPwhyKeysPatch)
+
+			// Analytics
+			protectedAPwhy.GET("/analytics/ops", handleAPwhyAnalyticsOps)
+			protectedAPwhy.GET("/analytics/traffic", handleAPwhyAnalyticsTraffic)
+		}
+	}
+}

app/backend/internal/api/scaling.go

@@ -0,0 +1,432 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"containr/internal/scaling"
+
+	"github.com/gin-gonic/gin"
+)
+
+// ScalingHandler handles scaling-related API endpoints
+type ScalingHandler struct {
+	autoScaler *scaling.AutoScaler
+}
+
+// NewScalingHandler creates a new scaling handler
+func NewScalingHandler(autoScaler *scaling.AutoScaler) *ScalingHandler {
+	return &ScalingHandler{
+		autoScaler: autoScaler,
+	}
+}
+
+// RegisterRoutes registers scaling routes
+func (h *ScalingHandler) RegisterRoutes(router *gin.RouterGroup) {
+	scaling := router.Group("/scaling")
+	{
+		scaling.GET("/policies", h.GetScalingPolicies)
+		scaling.POST("/policies", h.SetScalingPolicy)
+		scaling.GET("/policies/:serviceId", h.GetScalingPolicy)
+		scaling.PUT("/policies/:serviceId", h.UpdateScalingPolicy)
+		scaling.DELETE("/policies/:serviceId", h.DeleteScalingPolicy)
+
+		scaling.GET("/services", h.GetServiceStates)
+		scaling.GET("/services/:serviceId", h.GetServiceState)
+		scaling.GET("/services/:serviceId/history", h.GetScalingHistory)
+
+		scaling.POST("/services/:serviceId/scale", h.ManualScale)
+
+		scaling.GET("/status", h.GetScalingStatus)
+		scaling.POST("/enable", h.EnableAutoScaler)
+		scaling.POST("/disable", h.DisableAutoScaler)
+
+		scaling.GET("/metrics", h.GetScalingMetrics)
+		scaling.GET("/events", h.GetScalingEvents)
+	}
+}
+
+// GetScalingPolicies returns all scaling policies
+func (h *ScalingHandler) GetScalingPolicies(c *gin.Context) {
+	states := h.autoScaler.GetAllServiceStates()
+
+	policies := make([]*scaling.ScalingPolicy, 0)
+	for _, state := range states {
+		if state.Policy != nil {
+			policies = append(policies, state.Policy)
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"policies": policies,
+		"count":    len(policies),
+	})
+}
+
+// SetScalingPolicy creates or updates a scaling policy
+func (h *ScalingHandler) SetScalingPolicy(c *gin.Context) {
+	var policy scaling.ScalingPolicy
+	if err := c.ShouldBindJSON(&policy); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if err := h.autoScaler.SetScalingPolicy(&policy); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{
+		"message": "Scaling policy set successfully",
+		"policy":  policy,
+	})
+}
+
+// GetScalingPolicy returns a specific scaling policy
+func (h *ScalingHandler) GetScalingPolicy(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	policy, err := h.autoScaler.GetScalingPolicy(serviceID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"policy": policy,
+	})
+}
+
+// UpdateScalingPolicy updates an existing scaling policy
+func (h *ScalingHandler) UpdateScalingPolicy(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	var policy scaling.ScalingPolicy
+	if err := c.ShouldBindJSON(&policy); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Ensure the service ID matches
+	policy.ServiceID = serviceID
+
+	if err := h.autoScaler.SetScalingPolicy(&policy); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Scaling policy updated successfully",
+		"policy":  policy,
+	})
+}
+
+// DeleteScalingPolicy removes a scaling policy
+func (h *ScalingHandler) DeleteScalingPolicy(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	// Set policy to disabled instead of deleting
+	policy, err := h.autoScaler.GetScalingPolicy(serviceID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	policy.Enabled = false
+	if err := h.autoScaler.SetScalingPolicy(policy); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Scaling policy disabled successfully",
+	})
+}
+
+// GetServiceStates returns all service scaling states
+func (h *ScalingHandler) GetServiceStates(c *gin.Context) {
+	states := h.autoScaler.GetAllServiceStates()
+
+	c.JSON(http.StatusOK, gin.H{
+		"services": states,
+		"count":    len(states),
+	})
+}
+
+// GetServiceState returns a specific service's scaling state
+func (h *ScalingHandler) GetServiceState(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	state, err := h.autoScaler.GetServiceState(serviceID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"state": state,
+	})
+}
+
+// GetScalingHistory returns scaling history for a service
+func (h *ScalingHandler) GetScalingHistory(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+	limit, err := parseScalingLimit(c.DefaultQuery("limit", "50"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	events := h.autoScaler.GetServiceScalingHistory(serviceID, limit)
+	c.JSON(http.StatusOK, gin.H{
+		"service_id": serviceID,
+		"events":     events,
+		"count":      len(events),
+	})
+}
+
+// ManualScale performs manual scaling of a service
+func (h *ScalingHandler) ManualScale(c *gin.Context) {
+	serviceID := c.Param("serviceId")
+
+	var request struct {
+		Replicas int    `json:"replicas" binding:"required,min=1,max=20"`
+		Reason   string `json:"reason"`
+	}
+
+	if err := c.ShouldBindJSON(&request); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	event, err := h.autoScaler.ManualScale(c.Request.Context(), serviceID, request.Replicas, strings.TrimSpace(request.Reason))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	state, stateErr := h.autoScaler.GetServiceState(serviceID)
+	if stateErr != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": stateErr.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Service scaled successfully",
+		"event":   event,
+		"state":   state,
+	})
+}
+
+// GetScalingStatus returns the overall status of the auto-scaler
+func (h *ScalingHandler) GetScalingStatus(c *gin.Context) {
+	summary := h.autoScaler.GetScalingSummary()
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "active",
+		"summary": summary,
+		"enabled": h.autoScaler.IsEnabled(),
+	})
+}
+
+// EnableAutoScaler enables the auto-scaler
+func (h *ScalingHandler) EnableAutoScaler(c *gin.Context) {
+	h.autoScaler.Enable()
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Auto-scaler enabled",
+		"enabled": true,
+	})
+}
+
+// DisableAutoScaler disables the auto-scaler
+func (h *ScalingHandler) DisableAutoScaler(c *gin.Context) {
+	h.autoScaler.Disable()
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Auto-scaler disabled",
+		"enabled": false,
+	})
+}
+
+// GetScalingMetrics returns scaling-related metrics
+func (h *ScalingHandler) GetScalingMetrics(c *gin.Context) {
+	summary := h.autoScaler.GetScalingSummary()
+
+	// Add additional metrics
+	metrics := map[string]interface{}{
+		"total_services":         summary["total_services"],
+		"enabled_services":       summary["enabled_services"],
+		"total_replicas":         summary["total_replicas"],
+		"services_scaling_up":    summary["scaling_up"],
+		"services_scaling_down":  summary["scaling_down"],
+		"auto_scaler_enabled":    summary["enabled"],
+		"check_interval_seconds": summary["check_interval"],
+		"timestamp":              time.Now(),
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"metrics": metrics,
+	})
+}
+
+// GetScalingEvents returns recent scaling events
+func (h *ScalingHandler) GetScalingEvents(c *gin.Context) {
+	limit, err := parseScalingLimit(c.DefaultQuery("limit", "50"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	events := h.autoScaler.GetScalingEvents(limit)
+	c.JSON(http.StatusOK, gin.H{
+		"events": events,
+		"count":  len(events),
+	})
+}
+
+func parseScalingLimit(raw string) (int, error) {
+	limit, err := strconv.Atoi(strings.TrimSpace(raw))
+	if err != nil {
+		return 0, fmt.Errorf("limit must be an integer between 1 and 200")
+	}
+	if limit < 1 || limit > 200 {
+		return 0, fmt.Errorf("limit must be between 1 and 200")
+	}
+	return limit, nil
+}
+
+// ScalingPolicyTemplate represents a template for creating scaling policies
+type ScalingPolicyTemplate struct {
+	Name        string                `json:"name"`
+	Description string                `json:"description"`
+	Template    scaling.ScalingPolicy `json:"template"`
+}
+
+// GetScalingPolicyTemplates returns predefined scaling policy templates
+func (h *ScalingHandler) GetScalingPolicyTemplates(c *gin.Context) {
+	templates := []ScalingPolicyTemplate{
+		{
+			Name:        "Web Application",
+			Description: "Standard scaling policy for web applications",
+			Template: scaling.ScalingPolicy{
+				MinReplicas:       2,
+				MaxReplicas:       10,
+				TargetCPU:         70.0,
+				TargetMemory:      80.0,
+				ScaleUpCooldown:   3 * time.Minute,
+				ScaleDownCooldown: 5 * time.Minute,
+				ScaleUpStep:       1,
+				ScaleDownStep:     1,
+				Metrics:           []string{"cpu", "memory", "requests_per_second"},
+				Enabled:           true,
+				CostOptimization: &scaling.CostOptimization{
+					MaxCostPerHour:   1.0,
+					PreferEfficiency: true,
+					IdleTimeout:      10 * time.Minute,
+				},
+			},
+		},
+		{
+			Name:        "API Service",
+			Description: "Aggressive scaling for API services",
+			Template: scaling.ScalingPolicy{
+				MinReplicas:       1,
+				MaxReplicas:       20,
+				TargetCPU:         60.0,
+				TargetMemory:      75.0,
+				ScaleUpCooldown:   1 * time.Minute,
+				ScaleDownCooldown: 3 * time.Minute,
+				ScaleUpStep:       2,
+				ScaleDownStep:     1,
+				Metrics:           []string{"cpu", "memory", "requests_per_second", "error_rate"},
+				Enabled:           true,
+				CostOptimization: &scaling.CostOptimization{
+					MaxCostPerHour:   2.0,
+					PreferEfficiency: false,
+					IdleTimeout:      5 * time.Minute,
+				},
+			},
+		},
+		{
+			Name:        "Background Worker",
+			Description: "Conservative scaling for background workers",
+			Template: scaling.ScalingPolicy{
+				MinReplicas:       1,
+				MaxReplicas:       5,
+				TargetCPU:         80.0,
+				TargetMemory:      85.0,
+				ScaleUpCooldown:   5 * time.Minute,
+				ScaleDownCooldown: 10 * time.Minute,
+				ScaleUpStep:       1,
+				ScaleDownStep:     1,
+				Metrics:           []string{"cpu", "memory"},
+				Enabled:           true,
+				CostOptimization: &scaling.CostOptimization{
+					MaxCostPerHour:   0.5,
+					PreferEfficiency: true,
+					IdleTimeout:      15 * time.Minute,
+				},
+			},
+		},
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"templates": templates,
+		"count":     len(templates),
+	})
+}
+
+// ValidateScalingPolicy validates a scaling policy
+func (h *ScalingHandler) ValidateScalingPolicy(c *gin.Context) {
+	var policy scaling.ScalingPolicy
+	if err := c.ShouldBindJSON(&policy); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	errors := []string{}
+	warnings := []string{}
+
+	// Validate policy
+	if policy.MinReplicas < 1 {
+		errors = append(errors, "min_replicas must be at least 1")
+	}
+	if policy.MaxReplicas < policy.MinReplicas {
+		errors = append(errors, "max_replicas must be greater than or equal to min_replicas")
+	}
+	if policy.TargetCPU <= 0 || policy.TargetCPU > 100 {
+		errors = append(errors, "target_cpu must be between 0 and 100")
+	}
+	if policy.TargetMemory <= 0 || policy.TargetMemory > 100 {
+		errors = append(errors, "target_memory must be between 0 and 100")
+	}
+	if policy.ScaleUpStep < 1 {
+		errors = append(errors, "scale_up_step must be at least 1")
+	}
+	if policy.ScaleDownStep < 1 {
+		errors = append(errors, "scale_down_step must be at least 1")
+	}
+
+	// Warnings
+	if policy.MaxReplicas > 20 {
+		warnings = append(warnings, "max_replicas greater than 20 may be costly")
+	}
+	if policy.ScaleUpCooldown < 1*time.Minute {
+		warnings = append(warnings, "scale_up_cooldown less than 1 minute may cause thrashing")
+	}
+	if policy.ScaleDownCooldown < 2*time.Minute {
+		warnings = append(warnings, "scale_down_cooldown less than 2 minutes may cause thrashing")
+	}
+
+	valid := len(errors) == 0
+
+	c.JSON(http.StatusOK, gin.H{
+		"valid":    valid,
+		"errors":   errors,
+		"warnings": warnings,
+	})
+}

app/backend/internal/api/scaling_test.go

@@ -0,0 +1,145 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"containr/internal/deployment"
+	"containr/internal/metrics"
+	"containr/internal/scaling"
+
+	"github.com/gin-gonic/gin"
+)
+
+func setupScalingTestRouter(t *testing.T) *gin.Engine {
+	t.Helper()
+
+	scheduler := deployment.NewScheduler()
+	if err := scheduler.RegisterNode(&deployment.Node{
+		ID:      "node-test-1",
+		Name:    "node-test-1",
+		Address: "127.0.0.1",
+		Status:  "ready",
+		Capacity: deployment.ResourceCapacity{
+			CPU:     4,
+			Memory:  4 * 1024 * 1024 * 1024,
+			Storage: 100 * 1024 * 1024 * 1024,
+			Network: 1000,
+		},
+	}); err != nil {
+		t.Fatalf("failed to register test node: %v", err)
+	}
+
+	metricsStorage := metrics.NewInMemoryMetricsStorage()
+	metricsCollector := metrics.NewMetricsCollector(scheduler, metricsStorage)
+	autoScaler := scaling.NewAutoScaler(scheduler, metricsCollector)
+
+	if err := autoScaler.SetScalingPolicy(&scaling.ScalingPolicy{
+		ServiceID:   "service-1",
+		MinReplicas: 1,
+		MaxReplicas: 10,
+		Enabled:     true,
+	}); err != nil {
+		t.Fatalf("failed to set scaling policy: %v", err)
+	}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	handler := NewScalingHandler(autoScaler)
+	handler.RegisterRoutes(router.Group("/api/v1"))
+	return router
+}
+
+func TestScalingHistoryReturnsHistoryPayload(t *testing.T) {
+	router := setupScalingTestRouter(t)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/scaling/services/service-1/history", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, rec.Code)
+	}
+
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if body["service_id"] != "service-1" {
+		t.Fatalf("expected service_id service-1, got %v", body["service_id"])
+	}
+	if body["count"] != float64(0) {
+		t.Fatalf("expected count 0, got %v", body["count"])
+	}
+}
+
+func TestManualScaleUpdatesServiceState(t *testing.T) {
+	router := setupScalingTestRouter(t)
+
+	payload := []byte(`{"replicas":3,"reason":"ops override"}`)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/scaling/services/service-1/scale", bytes.NewReader(payload))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, rec.Code)
+	}
+
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+
+	event, ok := body["event"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected event payload, got %v", body["event"])
+	}
+	if event["action"] != "manual_scale_up" {
+		t.Fatalf("expected action manual_scale_up, got %v", event["action"])
+	}
+
+	state, ok := body["state"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected state payload, got %v", body["state"])
+	}
+	if state["CurrentReplicas"] != float64(3) {
+		t.Fatalf("expected current replicas 3, got %v", state["CurrentReplicas"])
+	}
+}
+
+func TestScalingEventsReturnsRecentEvents(t *testing.T) {
+	router := setupScalingTestRouter(t)
+
+	scalePayload := []byte(`{"replicas":2,"reason":"ops override"}`)
+	scaleReq := httptest.NewRequest(http.MethodPost, "/api/v1/scaling/services/service-1/scale", bytes.NewReader(scalePayload))
+	scaleReq.Header.Set("Content-Type", "application/json")
+	scaleRec := httptest.NewRecorder()
+	router.ServeHTTP(scaleRec, scaleReq)
+	if scaleRec.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, scaleRec.Code)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/scaling/events?limit=5", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, rec.Code)
+	}
+
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if body["count"] != float64(1) {
+		t.Fatalf("expected count 1, got %v", body["count"])
+	}
+	events, ok := body["events"].([]any)
+	if !ok || len(events) != 1 {
+		t.Fatalf("expected one event, got %v", body["events"])
+	}
+}

app/backend/internal/api/security.go

@@ -0,0 +1,702 @@
+package api
+
+import (
+	"containr/internal/database"
+	"containr/internal/security"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// SecurityHandler handles security-related API endpoints
+type SecurityHandler struct {
+	db                   *database.DB
+	scanner              *security.Scanner
+	complianceManager    *security.ComplianceManager
+	encryptionManager    *security.EncryptionManager
+	dataRetentionManager *security.DataRetentionManager
+	auditLogger          *security.AuditLogger
+}
+
+// NewSecurityHandler creates a new security handler
+func NewSecurityHandler(db *database.DB, encryptionKey string) *SecurityHandler {
+	encryptionManager, _ := security.NewEncryptionManager(encryptionKey)
+
+	return &SecurityHandler{
+		db:                   db,
+		scanner:              security.NewScanner(db),
+		complianceManager:    security.NewComplianceManager(db),
+		encryptionManager:    encryptionManager,
+		dataRetentionManager: security.NewDataRetentionManager(encryptionManager),
+		auditLogger:          security.NewAuditLogger(encryptionManager, db),
+	}
+}
+
+// StartSecurityScan starts a new security scan
+func (sh *SecurityHandler) StartSecurityScan(c *gin.Context) {
+	var req struct {
+		ProjectID string `json:"project_id" binding:"required"`
+		ServiceID string `json:"service_id,omitempty"`
+		ScanType  string `json:"scan_type" binding:"required,oneof=dependency configuration comprehensive"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	userID, ok := sh.requireProjectAccess(c, req.ProjectID)
+	if !ok {
+		return
+	}
+
+	if req.ServiceID != "" {
+		if _, err := uuid.Parse(req.ServiceID); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+			return
+		}
+
+		var serviceExists bool
+		err := sh.db.QueryRow(
+			`SELECT EXISTS(
+				SELECT 1 FROM services WHERE id = $1 AND project_id = $2
+			)`,
+			req.ServiceID,
+			req.ProjectID,
+		).Scan(&serviceExists)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to validate service"})
+			return
+		}
+
+		if !serviceExists {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "Service not found in project"})
+			return
+		}
+	}
+
+	// Log audit event
+	sh.auditLogger.LogSecurityEvent(userID, req.ProjectID, "security_scan_started", "project",
+		map[string]interface{}{
+			"project_id": req.ProjectID,
+			"service_id": req.ServiceID,
+			"scan_type":  req.ScanType,
+		}, c.ClientIP(), c.GetHeader("User-Agent"), true)
+
+	scan, err := sh.scanner.StartSecurityScan(req.ProjectID, req.ServiceID, req.ScanType)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to start security scan"})
+		return
+	}
+
+	c.JSON(http.StatusAccepted, scan)
+}
+
+// GetSecurityScan retrieves a security scan
+func (sh *SecurityHandler) GetSecurityScan(c *gin.Context) {
+	scanID := firstPathParam(c, "scanId", "id")
+	if !sh.requireSecurityScanAccess(c, scanID) {
+		return
+	}
+
+	scan, err := sh.scanner.GetSecurityScan(scanID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Security scan not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, scan)
+}
+
+// GetProjectSecurityHistory retrieves security scan history for a project
+func (sh *SecurityHandler) GetProjectSecurityHistory(c *gin.Context) {
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
+
+	limit := 10
+	if limitStr := c.Query("limit"); limitStr != "" {
+		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 && parsedLimit <= 1000 {
+			limit = parsedLimit
+		}
+	}
+
+	scans, err := sh.scanner.GetProjectSecurityHistory(projectID, limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get security history"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"scans": scans})
+}
+
+// GetVulnerabilities retrieves vulnerabilities for a project
+func (sh *SecurityHandler) GetVulnerabilities(c *gin.Context) {
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
+
+	// Query vulnerabilities
+	rows, err := sh.db.Query(`
+		SELECT id, type, severity, title, description, service_id, status, found_at, resolved_at
+		FROM vulnerabilities 
+		WHERE project_id = $1 
+		ORDER BY 
+			CASE severity 
+				WHEN 'critical' THEN 1 
+				WHEN 'high' THEN 2 
+				WHEN 'medium' THEN 3 
+				WHEN 'low' THEN 4 
+			END,
+			found_at DESC
+	`, projectID)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get vulnerabilities"})
+		return
+	}
+	defer rows.Close()
+
+	var vulnerabilities []security.Vulnerability
+	for rows.Next() {
+		var vuln security.Vulnerability
+		var resolvedAt *time.Time
+
+		err := rows.Scan(&vuln.ID, &vuln.Type, &vuln.Severity, &vuln.Title, &vuln.Description,
+			&vuln.ServiceID, &vuln.Status, &vuln.FoundAt, &resolvedAt)
+
+		if err != nil {
+			continue
+		}
+
+		vuln.ResolvedAt = resolvedAt
+		vulnerabilities = append(vulnerabilities, vuln)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"vulnerabilities": vulnerabilities})
+}
+
+// UpdateVulnerability updates a vulnerability status
+func (sh *SecurityHandler) UpdateVulnerability(c *gin.Context) {
+	vulnID := firstPathParam(c, "vulnId", "id")
+	userID, ok := sh.requireVulnerabilityAccess(c, vulnID)
+	if !ok {
+		return
+	}
+
+	var req struct {
+		Status string `json:"status" binding:"required,oneof=open resolved ignored"`
+		Notes  string `json:"notes,omitempty"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	var resolvedAt *time.Time
+	if req.Status == "resolved" {
+		now := time.Now()
+		resolvedAt = &now
+	}
+
+	_, err := sh.db.Exec(`
+		UPDATE vulnerabilities 
+		SET status = $1, resolved_at = $2 
+		WHERE id = $3
+	`, req.Status, resolvedAt, vulnID)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update vulnerability"})
+		return
+	}
+
+	// Log audit event
+	sh.auditLogger.LogSecurityEvent(userID, vulnID, "vulnerability_updated", "vulnerability",
+		map[string]interface{}{
+			"vulnerability_id": vulnID,
+			"new_status":       req.Status,
+			"notes":            req.Notes,
+		}, c.ClientIP(), c.GetHeader("User-Agent"), true)
+
+	c.JSON(http.StatusOK, gin.H{"status": "updated"})
+}
+
+// StartComplianceAssessment starts a new compliance assessment
+func (sh *SecurityHandler) StartComplianceAssessment(c *gin.Context) {
+	var req struct {
+		ProjectID   string `json:"project_id" binding:"required"`
+		FrameworkID string `json:"framework_id" binding:"required"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	userID, ok := sh.requireProjectAccess(c, req.ProjectID)
+	if !ok {
+		return
+	}
+
+	if _, err := uuid.Parse(req.FrameworkID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid framework ID"})
+		return
+	}
+
+	var frameworkExists bool
+	err := sh.db.QueryRow(
+		`SELECT EXISTS(
+			SELECT 1 FROM compliance_frameworks WHERE id = $1
+		)`,
+		req.FrameworkID,
+	).Scan(&frameworkExists)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to validate framework"})
+		return
+	}
+	if !frameworkExists {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Compliance framework not found"})
+		return
+	}
+
+	// Log audit event
+	sh.auditLogger.LogSecurityEvent(userID, req.ProjectID, "compliance_assessment_started", "project",
+		map[string]interface{}{
+			"project_id":   req.ProjectID,
+			"framework_id": req.FrameworkID,
+		}, c.ClientIP(), c.GetHeader("User-Agent"), true)
+
+	report, err := sh.complianceManager.AssessCompliance(req.ProjectID, req.FrameworkID, userID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to start compliance assessment"})
+		return
+	}
+
+	c.JSON(http.StatusAccepted, report)
+}
+
+// GetComplianceReport retrieves a compliance report
+func (sh *SecurityHandler) GetComplianceReport(c *gin.Context) {
+	reportID := firstPathParam(c, "reportId", "id")
+	if !sh.requireComplianceReportAccess(c, reportID) {
+		return
+	}
+
+	report, err := sh.complianceManager.GetComplianceReport(reportID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Compliance report not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, report)
+}
+
+// GetComplianceFrameworks retrieves available compliance frameworks
+func (sh *SecurityHandler) GetComplianceFrameworks(c *gin.Context) {
+	rows, err := sh.db.Query(`
+		SELECT id, name, description, version, enabled, created_at
+		FROM compliance_frameworks 
+		WHERE enabled = true 
+		ORDER BY name
+	`)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get compliance frameworks"})
+		return
+	}
+	defer rows.Close()
+
+	var frameworks []security.ComplianceFramework
+	for rows.Next() {
+		var framework security.ComplianceFramework
+		err := rows.Scan(&framework.ID, &framework.Name, &framework.Description,
+			&framework.Version, &framework.Enabled, &framework.CreatedAt)
+
+		if err != nil {
+			continue
+		}
+
+		frameworks = append(frameworks, framework)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"frameworks": frameworks})
+}
+
+// InitializeGDPRFramework initializes the GDPR compliance framework
+func (sh *SecurityHandler) InitializeGDPRFramework(c *gin.Context) {
+	userID := c.MustGet("user_id").(string)
+
+	err := sh.complianceManager.InitializeGDPRFramework()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to initialize GDPR framework"})
+		return
+	}
+
+	// Log audit event
+	sh.auditLogger.LogSecurityEvent(userID, "", "gdpr_framework_initialized", "compliance",
+		map[string]interface{}{}, c.ClientIP(), c.GetHeader("User-Agent"), true)
+
+	c.JSON(http.StatusOK, gin.H{"status": "initialized"})
+}
+
+// GetSecurityMetrics retrieves security metrics for a project
+func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
+
+	// Get vulnerability counts
+	var vulnMetrics struct {
+		Total    int `json:"total"`
+		Critical int `json:"critical"`
+		High     int `json:"high"`
+		Medium   int `json:"medium"`
+		Low      int `json:"low"`
+		Open     int `json:"open"`
+		Resolved int `json:"resolved"`
+	}
+
+	err := sh.db.QueryRow(`
+		SELECT 
+			COUNT(*) as total,
+			COUNT(*) FILTER (WHERE severity = 'critical') as critical,
+			COUNT(*) FILTER (WHERE severity = 'high') as high,
+			COUNT(*) FILTER (WHERE severity = 'medium') as medium,
+			COUNT(*) FILTER (WHERE severity = 'low') as low,
+			COUNT(*) FILTER (WHERE status = 'open') as open,
+			COUNT(*) FILTER (WHERE status = 'resolved') as resolved
+		FROM vulnerabilities 
+		WHERE project_id = $1
+	`, projectID).Scan(&vulnMetrics.Total, &vulnMetrics.Critical, &vulnMetrics.High,
+		&vulnMetrics.Medium, &vulnMetrics.Low, &vulnMetrics.Open, &vulnMetrics.Resolved)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get vulnerability metrics"})
+		return
+	}
+
+	// Get latest scan
+	var latestScan struct {
+		ID        string    `json:"id"`
+		Score     int       `json:"score"`
+		ScannedAt time.Time `json:"scanned_at"`
+		Status    string    `json:"status"`
+	}
+
+	err = sh.db.QueryRow(`
+		SELECT id, score, started_at as scanned_at, status
+		FROM security_scans 
+		WHERE project_id = $1 
+		ORDER BY started_at DESC 
+		LIMIT 1
+	`, projectID).Scan(&latestScan.ID, &latestScan.Score, &latestScan.ScannedAt, &latestScan.Status)
+
+	if err == sql.ErrNoRows {
+		latestScan = struct {
+			ID        string    `json:"id"`
+			Score     int       `json:"score"`
+			ScannedAt time.Time `json:"scanned_at"`
+			Status    string    `json:"status"`
+		}{ID: "", Score: 0, ScannedAt: time.Time{}, Status: "never_scanned"}
+	} else if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get latest scan"})
+		return
+	}
+
+	// Get compliance status
+	var complianceStatus struct {
+		OverallStatus string     `json:"overall_status"`
+		Score         int        `json:"score"`
+		LastAssessed  *time.Time `json:"last_assessed"`
+	}
+
+	err = sh.db.QueryRow(`
+		SELECT overall_status, score, assessment_date
+		FROM compliance_reports 
+		WHERE project_id = $1 
+		ORDER BY assessment_date DESC 
+		LIMIT 1
+	`, projectID).Scan(&complianceStatus.OverallStatus, &complianceStatus.Score, &complianceStatus.LastAssessed)
+
+	if err == sql.ErrNoRows {
+		complianceStatus = struct {
+			OverallStatus string     `json:"overall_status"`
+			Score         int        `json:"score"`
+			LastAssessed  *time.Time `json:"last_assessed"`
+		}{OverallStatus: "not_assessed", Score: 0, LastAssessed: nil}
+	} else if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get compliance status"})
+		return
+	}
+
+	metrics := gin.H{
+		"vulnerabilities": vulnMetrics,
+		"latest_scan":     latestScan,
+		"compliance":      complianceStatus,
+		"security_score": sh.calculateOverallSecurityScore(struct{ Total, Critical, High, Medium, Low, Open, Resolved int }{
+			Total: vulnMetrics.Total, Critical: vulnMetrics.Critical, High: vulnMetrics.High,
+			Medium: vulnMetrics.Medium, Low: vulnMetrics.Low, Open: vulnMetrics.Open, Resolved: vulnMetrics.Resolved,
+		}, latestScan.Score, complianceStatus.Score),
+	}
+
+	c.JSON(http.StatusOK, metrics)
+}
+
+// calculateOverallSecurityScore calculates an overall security score
+func (sh *SecurityHandler) calculateOverallSecurityScore(vulnMetrics struct {
+	Total, Critical, High, Medium, Low, Open, Resolved int
+}, scanScore, complianceScore int) int {
+	// Weight the different components
+	vulnScore := 100
+	if vulnMetrics.Total > 0 {
+		deduction := (vulnMetrics.Critical * 25) + (vulnMetrics.High * 15) + (vulnMetrics.Medium * 8) + (vulnMetrics.Low * 3)
+		vulnScore = max(0, 100-deduction)
+	}
+
+	// Calculate weighted average
+	overallScore := (vulnScore*40 + scanScore*30 + complianceScore*30) / 100
+	return overallScore
+}
+
+// GetAuditLogs retrieves audit logs for security events
+func (sh *SecurityHandler) GetAuditLogs(c *gin.Context) {
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
+
+	limit := 50
+	if limitStr := c.Query("limit"); limitStr != "" {
+		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 && parsedLimit <= 1000 {
+			limit = parsedLimit
+		}
+	}
+
+	offset := 0
+	if offsetStr := c.Query("offset"); offsetStr != "" {
+		if parsedOffset, err := strconv.Atoi(offsetStr); err == nil && parsedOffset >= 0 {
+			offset = parsedOffset
+		}
+	}
+
+	actionFilter := strings.TrimSpace(c.Query("action"))
+	resourceFilter := strings.TrimSpace(c.Query("resource"))
+
+	conditions := []string{
+		`((resource = 'project' AND resource_id::text = $1) OR details->>'project_id' = $1)`,
+	}
+	args := []interface{}{projectID}
+	nextArg := 2
+
+	if actionFilter != "" {
+		conditions = append(conditions, fmt.Sprintf("action = $%d", nextArg))
+		args = append(args, actionFilter)
+		nextArg++
+	}
+	if resourceFilter != "" {
+		conditions = append(conditions, fmt.Sprintf("resource = $%d", nextArg))
+		args = append(args, resourceFilter)
+		nextArg++
+	}
+
+	whereClause := strings.Join(conditions, " AND ")
+
+	var total int
+	countQuery := "SELECT COUNT(*) FROM audit_logs WHERE " + whereClause
+	if err := sh.db.QueryRow(countQuery, args...).Scan(&total); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to count audit logs"})
+		return
+	}
+
+	dataQuery := fmt.Sprintf(`
+		SELECT
+			id,
+			COALESCE(user_id::text, ''),
+			action,
+			resource,
+			COALESCE(resource_id::text, ''),
+			COALESCE(details::text, '{}'),
+			COALESCE(ip_address::text, ''),
+			COALESCE(user_agent, ''),
+			created_at
+		FROM audit_logs
+		WHERE %s
+		ORDER BY created_at DESC
+		LIMIT $%d OFFSET $%d
+	`, whereClause, nextArg, nextArg+1)
+	dataArgs := append(append([]interface{}{}, args...), limit, offset)
+
+	rows, err := sh.db.Query(dataQuery, dataArgs...)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch audit logs"})
+		return
+	}
+	defer rows.Close()
+
+	logs := make([]gin.H, 0, limit)
+	for rows.Next() {
+		var (
+			id         string
+			userID     string
+			action     string
+			resource   string
+			resourceID string
+			detailsRaw string
+			ipAddress  string
+			userAgent  string
+			createdAt  time.Time
+		)
+		if err := rows.Scan(&id, &userID, &action, &resource, &resourceID, &detailsRaw, &ipAddress, &userAgent, &createdAt); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to decode audit log row"})
+			return
+		}
+
+		var details map[string]interface{}
+		if err := json.Unmarshal([]byte(detailsRaw), &details); err != nil {
+			details = map[string]interface{}{"raw": detailsRaw}
+		}
+
+		logs = append(logs, gin.H{
+			"id":          id,
+			"timestamp":   createdAt,
+			"user_id":     userID,
+			"action":      action,
+			"resource":    resource,
+			"resource_id": resourceID,
+			"details":     details,
+			"ip_address":  ipAddress,
+			"user_agent":  userAgent,
+			"success":     true,
+		})
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"audit_logs": logs,
+		"total":      total,
+		"limit":      limit,
+		"offset":     offset,
+	})
+}
+
+func (sh *SecurityHandler) requireProjectAccess(c *gin.Context, projectID string) (string, bool) {
+	userIDValue, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return "", false
+	}
+	userID, ok := userIDValue.(string)
+	if !ok || userID == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
+		return "", false
+	}
+
+	if _, err := uuid.Parse(projectID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return "", false
+	}
+
+	var hasAccess bool
+	err := sh.db.QueryRow(
+		`SELECT EXISTS (
+			SELECT 1
+			FROM projects p
+			WHERE p.id = $1
+			  AND (p.owner_id = $2 OR EXISTS (
+					SELECT 1 FROM project_members pm
+					WHERE pm.project_id = p.id AND pm.user_id = $2
+			  ))
+		)`,
+		projectID, userID,
+	).Scan(&hasAccess)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify project access"})
+		return "", false
+	}
+
+	if !hasAccess {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return "", false
+	}
+
+	return userID, true
+}
+
+func (sh *SecurityHandler) requireSecurityScanAccess(c *gin.Context, scanID string) bool {
+	if _, err := uuid.Parse(scanID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid scan ID"})
+		return false
+	}
+
+	var projectID string
+	err := sh.db.QueryRow("SELECT project_id FROM security_scans WHERE id = $1", scanID).Scan(&projectID)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Security scan not found"})
+		return false
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify scan access"})
+		return false
+	}
+
+	_, ok := sh.requireProjectAccess(c, projectID)
+	return ok
+}
+
+func (sh *SecurityHandler) requireComplianceReportAccess(c *gin.Context, reportID string) bool {
+	if _, err := uuid.Parse(reportID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid report ID"})
+		return false
+	}
+
+	var projectID string
+	err := sh.db.QueryRow("SELECT project_id FROM compliance_reports WHERE id = $1", reportID).Scan(&projectID)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Compliance report not found"})
+		return false
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify report access"})
+		return false
+	}
+
+	_, ok := sh.requireProjectAccess(c, projectID)
+	return ok
+}
+
+func (sh *SecurityHandler) requireVulnerabilityAccess(c *gin.Context, vulnID string) (string, bool) {
+	if _, err := uuid.Parse(vulnID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid vulnerability ID"})
+		return "", false
+	}
+
+	var projectID string
+	err := sh.db.QueryRow("SELECT project_id FROM vulnerabilities WHERE id = $1", vulnID).Scan(&projectID)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Vulnerability not found"})
+		return "", false
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify vulnerability access"})
+		return "", false
+	}
+
+	return sh.requireProjectAccess(c, projectID)
+}
+
+// max helper function
+func max(a, b int) int {
+	if a > b {
+		return a
+	}
+	return b
+}

app/backend/internal/api/services.go

@@ -0,0 +1,458 @@
+package api
+
+import (
+	"containr/internal/database"
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// Service represents a service in the system
+type Service struct {
+	ID          uuid.UUID `json:"id" db:"id"`
+	ProjectID   uuid.UUID `json:"project_id" db:"project_id"`
+	Name        string    `json:"name" db:"name"`
+	Type        string    `json:"type" db:"type"`     // web, worker, database, etc.
+	Status      string    `json:"status" db:"status"` // building, running, failed, stopped
+	Image       string    `json:"image" db:"image"`
+	Command     string    `json:"command" db:"command"`
+	Environment string    `json:"environment" db:"environment"` // production, preview, development
+	GitRepo     string    `json:"git_repo" db:"git_repo"`
+	GitBranch   string    `json:"git_branch" db:"git_branch"`
+	BuildPath   string    `json:"build_path" db:"build_path"`
+	CPU         string    `json:"cpu" db:"cpu"`
+	Memory      string    `json:"memory" db:"memory"`
+	CreatedAt   time.Time `json:"created_at" db:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at" db:"updated_at"`
+}
+
+// CreateServiceRequest represents a request to create a service
+type CreateServiceRequest struct {
+	ProjectID   uuid.UUID `json:"project_id"`
+	Name        string    `json:"name" binding:"required,min=1,max=255"`
+	Type        string    `json:"type" binding:"required,oneof=web worker database cron"`
+	Image       string    `json:"image"`
+	Command     string    `json:"command"`
+	Environment string    `json:"environment" binding:"required,oneof=production preview development"`
+	GitRepo     string    `json:"git_repo"`
+	GitBranch   string    `json:"git_branch"`
+	BuildPath   string    `json:"build_path"`
+	CPU         string    `json:"cpu"`
+	Memory      string    `json:"memory"`
+}
+
+// UpdateServiceRequest represents a request to update a service
+type UpdateServiceRequest struct {
+	Name        string `json:"name" binding:"omitempty,min=1,max=255"`
+	Type        string `json:"type" binding:"omitempty,oneof=web worker database cron"`
+	Image       string `json:"image"`
+	Command     string `json:"command"`
+	Environment string `json:"environment" binding:"omitempty,oneof=production preview development"`
+	GitRepo     string `json:"git_repo"`
+	GitBranch   string `json:"git_branch"`
+	BuildPath   string `json:"build_path"`
+	CPU         string `json:"cpu"`
+	Memory      string `json:"memory"`
+}
+
+// handleGetServices retrieves all services for a project
+func handleGetServices(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
+	projectID, err := uuid.Parse(projectIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return
+	}
+
+	// Check if project exists and user has access
+	var project Project
+	err = db.(*database.DB).QueryRow(
+		"SELECT id, name, owner_id FROM projects WHERE id = $1",
+		projectID,
+	).Scan(&project.ID, &project.Name, &project.OwnerID)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	// Get user ID from JWT token (set by auth middleware)
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if user owns the project
+	if project.OwnerID != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	// Get services for the project
+	rows, err := db.(*database.DB).Query(
+		`SELECT id, project_id, name, type, status, image, command, environment, 
+				git_repo, git_branch, build_path, cpu, memory, created_at, updated_at 
+			FROM services 
+			WHERE project_id = $1 
+			ORDER BY created_at DESC`,
+		projectID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve services"})
+		return
+	}
+	defer rows.Close()
+
+	var services []Service
+	for rows.Next() {
+		var service Service
+		err := rows.Scan(
+			&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
+			&service.Image, &service.Command, &service.Environment, &service.GitRepo,
+			&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+			&service.CreatedAt, &service.UpdatedAt,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan service"})
+			return
+		}
+		services = append(services, service)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"services": services})
+}
+
+// handleCreateService creates a new service
+func handleCreateService(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
+	projectID, err := uuid.Parse(projectIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return
+	}
+
+	var req CreateServiceRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if req.ProjectID == uuid.Nil {
+		req.ProjectID = projectID
+	} else if req.ProjectID != projectID {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Project ID in URL and request body must match"})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if project exists and user has access
+	var project Project
+	err = db.(*database.DB).QueryRow(
+		"SELECT id, name, owner_id FROM projects WHERE id = $1",
+		req.ProjectID,
+	).Scan(&project.ID, &project.Name, &project.OwnerID)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	// Check if user owns the project
+	if project.OwnerID != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	// Check if service name already exists in the project
+	var count int
+	err = db.(*database.DB).QueryRow(
+		"SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2",
+		req.ProjectID, req.Name,
+	).Scan(&count)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check service name"})
+		return
+	}
+
+	if count > 0 {
+		c.JSON(http.StatusConflict, gin.H{"error": "Service name already exists in this project"})
+		return
+	}
+
+	// Create new service
+	service := Service{
+		ID:          uuid.New(),
+		ProjectID:   req.ProjectID,
+		Name:        req.Name,
+		Type:        req.Type,
+		Status:      "stopped", // Initial status
+		Image:       req.Image,
+		Command:     req.Command,
+		Environment: req.Environment,
+		GitRepo:     req.GitRepo,
+		GitBranch:   req.GitBranch,
+		BuildPath:   req.BuildPath,
+		CPU:         req.CPU,
+		Memory:      req.Memory,
+		CreatedAt:   time.Now(),
+		UpdatedAt:   time.Now(),
+	}
+
+	// Set default values if not provided
+	if service.CPU == "" {
+		service.CPU = "0.5"
+	}
+	if service.Memory == "" {
+		service.Memory = "512Mi"
+	}
+
+	// Insert service into database
+	_, err = db.(*database.DB).Exec(
+		`INSERT INTO services 
+			(id, project_id, name, type, status, image, command, environment, 
+				 git_repo, git_branch, build_path, cpu, memory, created_at, updated_at)
+			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)`,
+		service.ID, service.ProjectID, service.Name, service.Type, service.Status,
+		service.Image, service.Command, service.Environment, service.GitRepo,
+		service.GitBranch, service.BuildPath, service.CPU, service.Memory,
+		service.CreatedAt, service.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create service"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"service": service})
+}
+
+// handleGetService retrieves a specific service
+func handleGetService(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Get service with project ownership check
+	var service Service
+	err = db.(*database.DB).QueryRow(
+		`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command, 
+				s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory, 
+				s.created_at, s.updated_at
+			FROM services s
+			JOIN projects p ON s.project_id = p.id
+			WHERE s.id = $1 AND p.owner_id = $2`,
+		serviceID, userID,
+	).Scan(
+		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
+		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
+		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+		&service.CreatedAt, &service.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"service": service})
+}
+
+// handleUpdateService updates a service
+func handleUpdateService(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	var req UpdateServiceRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if service exists and user has access
+	var existingService Service
+	err = db.(*database.DB).QueryRow(
+		`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command, 
+				s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory, 
+				s.created_at, s.updated_at
+			FROM services s
+			JOIN projects p ON s.project_id = p.id
+			WHERE s.id = $1 AND p.owner_id = $2`,
+		serviceID, userID,
+	).Scan(
+		&existingService.ID, &existingService.ProjectID, &existingService.Name, &existingService.Type,
+		&existingService.Status, &existingService.Image, &existingService.Command,
+		&existingService.Environment, &existingService.GitRepo, &existingService.GitBranch,
+		&existingService.BuildPath, &existingService.CPU, &existingService.Memory,
+		&existingService.CreatedAt, &existingService.UpdatedAt,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	// Update fields if provided
+	if req.Name != "" {
+		existingService.Name = req.Name
+	}
+	if req.Type != "" {
+		existingService.Type = req.Type
+	}
+	if req.Image != "" {
+		existingService.Image = req.Image
+	}
+	if req.Command != "" {
+		existingService.Command = req.Command
+	}
+	if req.Environment != "" {
+		existingService.Environment = req.Environment
+	}
+	if req.GitRepo != "" {
+		existingService.GitRepo = req.GitRepo
+	}
+	if req.GitBranch != "" {
+		existingService.GitBranch = req.GitBranch
+	}
+	if req.BuildPath != "" {
+		existingService.BuildPath = req.BuildPath
+	}
+	if req.CPU != "" {
+		existingService.CPU = req.CPU
+	}
+	if req.Memory != "" {
+		existingService.Memory = req.Memory
+	}
+
+	existingService.UpdatedAt = time.Now()
+
+	// Update service in database
+	_, err = db.(*database.DB).Exec(
+		`UPDATE services 
+			SET name = $1, type = $2, image = $3, command = $4, environment = $5,
+				git_repo = $6, git_branch = $7, build_path = $8, cpu = $9, memory = $10, updated_at = $11
+			WHERE id = $12`,
+		existingService.Name, existingService.Type, existingService.Image, existingService.Command,
+		existingService.Environment, existingService.GitRepo, existingService.GitBranch,
+		existingService.BuildPath, existingService.CPU, existingService.Memory,
+		existingService.UpdatedAt, existingService.ID,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"service": existingService})
+}
+
+// handleDeleteService deletes a service
+func handleDeleteService(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	// Get user ID from JWT token
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	// Check if service exists and user has access
+	var projectOwnerID string
+	err = db.(*database.DB).QueryRow(
+		`SELECT p.owner_id 
+			FROM services s
+			JOIN projects p ON s.project_id = p.id
+			WHERE s.id = $1`,
+		serviceID,
+	).Scan(&projectOwnerID)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	// Check if user owns the project
+	if projectOwnerID != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	// Delete service (cascade will handle related records)
+	_, err = db.(*database.DB).Exec(
+		"DELETE FROM services WHERE id = $1",
+		serviceID,
+	)
+
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete service"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "Service deleted successfully"})
+}

app/backend/internal/api/static/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en" class="dark">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>APwhy</title>
+    <script type="module" crossorigin src="/assets/index-DwfYiTMH.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DRUelTBf.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

app/backend/internal/api/templates.go

@@ -0,0 +1,627 @@
+package api
+
+import (
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type ServiceTemplate struct {
+	ID          string    `json:"id" db:"id"`
+	Name        string    `json:"name" db:"name"`
+	Description string    `json:"description" db:"description"`
+	Category    string    `json:"category" db:"category"`
+	Logo        string    `json:"logo" db:"logo"`
+	Config      string    `json:"config" db:"config"`
+	Variables   string    `json:"variables" db:"variables"`
+	IsOfficial  bool      `json:"is_official" db:"is_official"`
+	CreatedAt   time.Time `json:"created_at" db:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at" db:"updated_at"`
+}
+
+type TemplateConfig struct {
+	Type           string            `json:"type"`
+	Runtime        string            `json:"runtime"`
+	BuildCommand   string            `json:"build_command"`
+	StartCommand   string            `json:"start_command"`
+	Port           int               `json:"port"`
+	HealthCheck    string            `json:"health_check"`
+	Environment    map[string]string `json:"environment"`
+	Dockerfile     string            `json:"dockerfile,omitempty"`
+	NixpacksConfig map[string]string `json:"nixpacks_config,omitempty"`
+}
+
+type TemplateVariable struct {
+	Key         string `json:"key"`
+	Label       string `json:"label"`
+	Default     string `json:"default"`
+	Required    bool   `json:"required"`
+	Secret      bool   `json:"secret"`
+	Description string `json:"description"`
+}
+
+var templateRuntimeImageDefaults = map[string]string{
+	"postgres":   "postgres:16-alpine",
+	"postgresql": "postgres:16-alpine",
+	"redis":      "redis:7-alpine",
+	"dragonfly":  "docker.dragonflydb.io/dragonflydb/dragonfly:latest",
+	"mongodb":    "mongo:7",
+	"mongo":      "mongo:7",
+	"mysql":      "mysql:8.4",
+	"mariadb":    "mariadb:11",
+	"clickhouse": "clickhouse/clickhouse-server:24.8",
+}
+
+func handleGetTemplates(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	category := c.Query("category")
+	ctx := c.Request.Context()
+	queries := sqlcdb.New(db.DB)
+
+	var templateRows []sqlcdb.ServiceTemplate
+	var err error
+	if category != "" {
+		templateRows, err = queries.ListServiceTemplatesByCategory(ctx, category)
+	} else {
+		templateRows, err = queries.ListServiceTemplates(ctx)
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch templates"})
+		return
+	}
+
+	templates := make([]ServiceTemplate, 0, len(templateRows))
+	for _, row := range templateRows {
+		templates = append(templates, mapSQLCTemplate(row))
+	}
+
+	c.JSON(http.StatusOK, gin.H{"templates": templates})
+}
+
+func handleGetTemplate(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	templateID := c.Param("id")
+	queries := sqlcdb.New(db.DB)
+
+	row, err := queries.GetServiceTemplateByID(c.Request.Context(), templateID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch template"})
+		return
+	}
+
+	t := mapSQLCTemplate(row)
+	if t.ID == "" {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
+		return
+	}
+
+	var config TemplateConfig
+	if err := json.Unmarshal([]byte(t.Config), &config); err == nil {
+	}
+
+	var variables []TemplateVariable
+	if err := json.Unmarshal([]byte(t.Variables), &variables); err == nil {
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"template":  t,
+		"config":    config,
+		"variables": variables,
+	})
+}
+
+func handleCreateFromTemplate(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+	ctx := c.Request.Context()
+
+	templateID := c.Param("id")
+
+	var req struct {
+		ProjectID string            `json:"project_id" binding:"required"`
+		Name      string            `json:"name" binding:"required"`
+		Plan      string            `json:"plan,omitempty"`
+		Region    string            `json:"region,omitempty"`
+		Variables map[string]string `json:"variables"`
+	}
+
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	req.ProjectID = strings.TrimSpace(req.ProjectID)
+	req.Name = strings.TrimSpace(req.Name)
+	if req.Name == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name is required"})
+		return
+	}
+
+	projectID, err := uuid.Parse(req.ProjectID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return
+	}
+
+	ownerID, err := queries.GetProjectOwnerID(ctx, projectID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch project"})
+		return
+	}
+	if ownerID.String() != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	templateRow, err := queries.GetServiceTemplateByID(ctx, templateID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch template"})
+		return
+	}
+
+	template := mapSQLCTemplate(templateRow)
+	if template.ID == "" {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	var config TemplateConfig
+	if err := json.Unmarshal([]byte(template.Config), &config); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Template configuration is invalid"})
+		return
+	}
+
+	var templateVars []TemplateVariable
+	if err := json.Unmarshal([]byte(template.Variables), &templateVars); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Template variables are invalid"})
+		return
+	}
+
+	serviceType, err := normalizeTemplateServiceType(config.Type)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	envVars, secretKeys, missingRequired := mergeTemplateVariables(config.Environment, templateVars, req.Variables)
+	if len(missingRequired) > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error":             fmt.Sprintf("Missing required template variables: %s", strings.Join(missingRequired, ", ")),
+			"missing_variables": missingRequired,
+		})
+		return
+	}
+
+	if serviceType == "database" {
+		handler, ok := c.Get("database_handler")
+		if !ok {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Database handler unavailable"})
+			return
+		}
+
+		dbHandler, ok := handler.(*DatabaseHandler)
+		if !ok || dbHandler == nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Database handler unavailable"})
+			return
+		}
+
+		databaseID, err := dbHandler.createManagedDatabaseAndProvision(ctx, userID, managedDatabaseCreateRequest{
+			Name:             req.Name,
+			Type:             config.Runtime,
+			Plan:             req.Plan,
+			Region:           req.Region,
+			RuntimeVariables: envVars,
+		})
+		if err != nil {
+			switch {
+			case errors.Is(err, errDatabaseNameRequired), errors.Is(err, errUnsupportedDatabaseType), errors.Is(err, errUnsupportedDatabasePlan):
+				c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			case errors.Is(err, errDatabaseNameAlreadyInUse):
+				c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			default:
+				c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create managed database from template"})
+			}
+			return
+		}
+
+		LogAudit(userID, "database", databaseID, "create", map[string]interface{}{
+			"template_id": templateID,
+			"name":        req.Name,
+			"type":        normalizeDatabaseType(config.Runtime),
+			"project_id":  req.ProjectID,
+		})
+
+		c.JSON(http.StatusCreated, gin.H{
+			"database_id": databaseID,
+			"resource":    "database",
+			"message":     "Managed database provisioning started from template",
+		})
+		return
+	}
+
+	serviceCount, err := queries.CountServicesByProjectAndName(ctx, sqlcdb.CountServicesByProjectAndNameParams{
+		ProjectID: projectID,
+		Name:      req.Name,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to validate service name"})
+		return
+	}
+	if serviceCount > 0 {
+		c.JSON(http.StatusConflict, gin.H{"error": "Service name already exists in this project"})
+		return
+	}
+
+	serviceImage := resolveTemplateRuntimeImage(config.Runtime)
+	serviceCommand := strings.TrimSpace(config.StartCommand)
+	cpu, memory := defaultTemplateResources(serviceType)
+	serviceEnvironment := "production"
+
+	serviceID := uuid.New()
+	now := time.Now()
+
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to initialize template deployment"})
+		return
+	}
+	defer tx.Rollback()
+
+	txQueries := queries.WithTx(tx)
+	err = txQueries.CreateServiceFromTemplate(ctx, sqlcdb.CreateServiceFromTemplateParams{
+		ID:          serviceID,
+		ProjectID:   projectID,
+		Name:        req.Name,
+		Type:        serviceType,
+		Status:      "stopped",
+		Image:       sql.NullString{String: serviceImage, Valid: true},
+		Command:     sql.NullString{String: serviceCommand, Valid: true},
+		Environment: sql.NullString{String: serviceEnvironment, Valid: true},
+		Cpu:         sql.NullString{String: cpu, Valid: true},
+		Memory:      sql.NullString{String: memory, Valid: true},
+		CreatedAt:   sql.NullTime{Time: now, Valid: true},
+		UpdatedAt:   sql.NullTime{Time: now, Valid: true},
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create service from template"})
+		return
+	}
+
+	for key, value := range envVars {
+		if strings.TrimSpace(key) == "" {
+			continue
+		}
+
+		err = txQueries.UpsertEnvironmentVariable(ctx, sqlcdb.UpsertEnvironmentVariableParams{
+			ID:        uuid.New(),
+			ServiceID: serviceID,
+			Key:       key,
+			Value:     value,
+			IsSecret:  sql.NullBool{Bool: secretKeys[key], Valid: true},
+			CreatedAt: sql.NullTime{Time: now, Valid: true},
+			UpdatedAt: sql.NullTime{Time: now, Valid: true},
+		})
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to save template variables"})
+			return
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to finalize service from template"})
+		return
+	}
+
+	LogAudit(userID, "service", serviceID.String(), "create", map[string]interface{}{
+		"template_id": templateID,
+		"name":        req.Name,
+		"type":        serviceType,
+	})
+
+	c.JSON(http.StatusCreated, gin.H{
+		"service_id": serviceID.String(),
+		"resource":   "service",
+		"message":    "Service created from template",
+	})
+}
+
+func SeedTemplates() []ServiceTemplate {
+	templates := []ServiceTemplate{
+		{
+			ID:          "tpl-nodejs",
+			Name:        "Node.js Application",
+			Description: "Generic Node.js application with automatic dependency detection",
+			Category:    "web",
+			Logo:        "https://cdn.simpleicons.org/node.js",
+			Config:      `{"type":"web","runtime":"node","build_command":"npm install && npm run build","start_command":"npm start","port":3000,"health_check":"/health"}`,
+			Variables:   `[{"key":"NODE_ENV","label":"Node Environment","default":"production","required":false,"secret":false},{"key":"NPM_TOKEN","label":"NPM Token","default":"","required":false,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-react",
+			Name:        "React Application",
+			Description: "React single-page application with Vite",
+			Category:    "frontend",
+			Logo:        "https://cdn.simpleicons.org/react",
+			Config:      `{"type":"web","runtime":"node","build_command":"npm install && npm run build","start_command":"npx serve -s dist","port":3000}`,
+			Variables:   `[{"key":"VITE_API_URL","label":"API URL","default":"","required":true,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-python",
+			Name:        "Python Application",
+			Description: "Python application with FastAPI/Flask support",
+			Category:    "web",
+			Logo:        "https://cdn.simpleicons.org/python",
+			Config:      `{"type":"web","runtime":"python","build_command":"pip install -r requirements.txt","start_command":"python main.py","port":8000}`,
+			Variables:   `[{"key":"PYTHON_VERSION","label":"Python Version","default":"3.11","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-go",
+			Name:        "Go Application",
+			Description: "Go backend service",
+			Category:    "web",
+			Logo:        "https://cdn.simpleicons.org/go",
+			Config:      `{"type":"web","runtime":"go","build_command":"go build -o app .","start_command":"./app","port":8080}`,
+			Variables:   `[{"key":"GO_VERSION","label":"Go Version","default":"1.21","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-postgres",
+			Name:        "PostgreSQL Database",
+			Description: "Managed PostgreSQL database",
+			Category:    "database",
+			Logo:        "https://cdn.simpleicons.org/postgresql",
+			Config:      `{"type":"database","runtime":"postgres","port":5432}`,
+			Variables:   `[{"key":"POSTGRES_USER","label":"Username","default":"postgres","required":true,"secret":false},{"key":"POSTGRES_PASSWORD","label":"Password","default":"","required":true,"secret":true},{"key":"POSTGRES_DB","label":"Database Name","default":"app","required":true,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-redis",
+			Name:        "Redis Cache",
+			Description: "In-memory data store",
+			Category:    "database",
+			Logo:        "https://cdn.simpleicons.org/redis",
+			Config:      `{"type":"database","runtime":"redis","port":6379}`,
+			Variables:   `[{"key":"REDIS_PASSWORD","label":"Password","default":"","required":false,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-mongodb",
+			Name:        "MongoDB Database",
+			Description: "NoSQL document database",
+			Category:    "database",
+			Logo:        "https://cdn.simpleicons.org/mongodb",
+			Config:      `{"type":"database","runtime":"mongodb","port":27017}`,
+			Variables:   `[{"key":"MONGO_INITDB_ROOT_USERNAME","label":"Root Username","default":"admin","required":true,"secret":false},{"key":"MONGO_INITDB_ROOT_PASSWORD","label":"Root Password","default":"","required":true,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-mysql",
+			Name:        "MySQL Database",
+			Description: "Managed MySQL database service",
+			Category:    "database",
+			Logo:        "https://cdn.simpleicons.org/mysql",
+			Config:      `{"type":"database","runtime":"mysql","port":3306}`,
+			Variables:   `[{"key":"MYSQL_DATABASE","label":"Database Name","default":"app","required":true,"secret":false},{"key":"MYSQL_USER","label":"Username","default":"app","required":true,"secret":false},{"key":"MYSQL_PASSWORD","label":"User Password","default":"","required":true,"secret":true},{"key":"MYSQL_ROOT_PASSWORD","label":"Root Password","default":"","required":true,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-mariadb",
+			Name:        "MariaDB Database",
+			Description: "Managed MariaDB database service",
+			Category:    "database",
+			Logo:        "https://cdn.simpleicons.org/mariadb",
+			Config:      `{"type":"database","runtime":"mariadb","port":3306}`,
+			Variables:   `[{"key":"MARIADB_DATABASE","label":"Database Name","default":"app","required":true,"secret":false},{"key":"MARIADB_USER","label":"Username","default":"app","required":true,"secret":false},{"key":"MARIADB_PASSWORD","label":"User Password","default":"","required":true,"secret":true},{"key":"MARIADB_ROOT_PASSWORD","label":"Root Password","default":"","required":true,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-clickhouse",
+			Name:        "ClickHouse Database",
+			Description: "Column-oriented analytics database",
+			Category:    "database",
+			Logo:        "https://cdn.simpleicons.org/clickhouse",
+			Config:      `{"type":"database","runtime":"clickhouse","port":8123}`,
+			Variables:   `[{"key":"CLICKHOUSE_DB","label":"Database Name","default":"app","required":false,"secret":false},{"key":"CLICKHOUSE_USER","label":"Username","default":"default","required":false,"secret":false},{"key":"CLICKHOUSE_PASSWORD","label":"Password","default":"","required":false,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-dragonfly",
+			Name:        "Dragonfly Database",
+			Description: "Redis-compatible in-memory data store powered by Dragonfly",
+			Category:    "database",
+			Logo:        "https://cdn.simpleicons.org/redis",
+			Config:      `{"type":"database","runtime":"dragonfly","port":6379}`,
+			Variables:   `[{"key":"DRAGONFLY_PASSWORD","label":"Password","default":"","required":false,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-worker",
+			Name:        "Background Worker",
+			Description: "Background job processing service",
+			Category:    "worker",
+			Logo:        "https://cdn.simpleicons.org/terminal",
+			Config:      `{"type":"worker","runtime":"node","build_command":"npm install","start_command":"npm run worker"}`,
+			Variables:   `[{"key":"WORKER_CONCURRENCY","label":"Concurrency","default":"4","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-cron",
+			Name:        "Cron Job",
+			Description: "Scheduled task runner",
+			Category:    "cron",
+			Logo:        "https://cdn.simpleicons.org/clock",
+			Config:      `{"type":"cron","runtime":"node","build_command":"npm install","start_command":"npm run cron"}`,
+			Variables:   `[{"key":"CRON_SCHEDULE","label":"Schedule","default":"0 * * * *","required":true,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-docker",
+			Name:        "Docker Image",
+			Description: "Deploy from any Docker image",
+			Category:    "custom",
+			Logo:        "https://cdn.simpleicons.org/docker",
+			Config:      `{"type":"web","runtime":"docker","port":80}`,
+			Variables:   `[{"key":"IMAGE","label":"Docker Image","default":"","required":true,"secret":false},{"key":"TAG","label":"Image Tag","default":"latest","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+	}
+	return templates
+}
+
+func normalizeTemplateServiceType(templateType string) (string, error) {
+	normalized := strings.ToLower(strings.TrimSpace(templateType))
+	if normalized == "" {
+		return "web", nil
+	}
+
+	switch normalized {
+	case "web", "worker", "database", "cron":
+		return normalized, nil
+	default:
+		return "", fmt.Errorf("unsupported template service type: %s", templateType)
+	}
+}
+
+func mergeTemplateVariables(
+	defaultEnvironment map[string]string,
+	templateVars []TemplateVariable,
+	overrides map[string]string,
+) (map[string]string, map[string]bool, []string) {
+	env := make(map[string]string)
+	secretKeys := make(map[string]bool)
+	missingRequired := make([]string, 0)
+
+	for key, value := range defaultEnvironment {
+		trimmedKey := strings.TrimSpace(key)
+		if trimmedKey == "" {
+			continue
+		}
+		env[trimmedKey] = strings.TrimSpace(value)
+	}
+
+	templateByKey := make(map[string]TemplateVariable)
+	for _, variable := range templateVars {
+		key := strings.TrimSpace(variable.Key)
+		if key == "" {
+			continue
+		}
+
+		templateByKey[key] = variable
+		secretKeys[key] = variable.Secret
+
+		value := strings.TrimSpace(variable.Default)
+		if override, exists := overrides[key]; exists {
+			value = strings.TrimSpace(override)
+		}
+
+		if variable.Required && value == "" {
+			missingRequired = append(missingRequired, key)
+			continue
+		}
+
+		if value != "" {
+			env[key] = value
+		}
+	}
+
+	for key, override := range overrides {
+		trimmedKey := strings.TrimSpace(key)
+		if trimmedKey == "" {
+			continue
+		}
+
+		value := strings.TrimSpace(override)
+		if value == "" {
+			continue
+		}
+
+		env[trimmedKey] = value
+		if variable, exists := templateByKey[trimmedKey]; exists {
+			secretKeys[trimmedKey] = variable.Secret
+		}
+	}
+
+	return env, secretKeys, missingRequired
+}
+
+func resolveTemplateRuntimeImage(runtime string) string {
+	normalized := strings.ToLower(strings.TrimSpace(runtime))
+	if normalized == "" {
+		return ""
+	}
+	if image, exists := templateRuntimeImageDefaults[normalized]; exists {
+		return image
+	}
+	return runtime
+}
+
+func defaultTemplateResources(serviceType string) (cpu, memory string) {
+	switch serviceType {
+	case "database":
+		return "1", "1Gi"
+	default:
+		return "0.5", "512Mi"
+	}
+}
+
+func mapSQLCTemplate(row sqlcdb.ServiceTemplate) ServiceTemplate {
+	variables := "[]"
+	if row.Variables.Valid && len(row.Variables.RawMessage) > 0 {
+		variables = string(row.Variables.RawMessage)
+	}
+
+	return ServiceTemplate{
+		ID:          row.ID,
+		Name:        row.Name,
+		Description: templateNullString(row.Description),
+		Category:    row.Category,
+		Logo:        templateNullString(row.Logo),
+		Config:      string(row.Config),
+		Variables:   variables,
+		IsOfficial:  row.IsOfficial.Valid && row.IsOfficial.Bool,
+		CreatedAt:   templateNullTime(row.CreatedAt),
+		UpdatedAt:   templateNullTime(row.UpdatedAt),
+	}
+}
+
+func templateNullString(value sql.NullString) string {
+	if value.Valid {
+		return value.String
+	}
+	return ""
+}
+
+func templateNullTime(value sql.NullTime) time.Time {
+	if value.Valid {
+		return value.Time
+	}
+	return time.Time{}
+}

app/backend/internal/api/templates_test.go

@@ -0,0 +1,73 @@
+package api
+
+import "testing"
+
+func TestNormalizeTemplateServiceType(t *testing.T) {
+	valid := []string{"web", "worker", "database", "cron"}
+	for _, value := range valid {
+		got, err := normalizeTemplateServiceType(value)
+		if err != nil {
+			t.Fatalf("normalizeTemplateServiceType(%q) returned error: %v", value, err)
+		}
+		if got != value {
+			t.Fatalf("normalizeTemplateServiceType(%q) = %q, want %q", value, got, value)
+		}
+	}
+
+	_, err := normalizeTemplateServiceType("unsupported")
+	if err == nil {
+		t.Fatalf("expected unsupported template type to return error")
+	}
+}
+
+func TestMergeTemplateVariables(t *testing.T) {
+	env, secretKeys, missing := mergeTemplateVariables(
+		map[string]string{
+			"DEFAULT_ONE": "a",
+			"DEFAULT_TWO": "b",
+		},
+		[]TemplateVariable{
+			{
+				Key:      "REQ",
+				Default:  "",
+				Required: true,
+				Secret:   true,
+			},
+			{
+				Key:      "OPTIONAL",
+				Default:  "fallback",
+				Required: false,
+				Secret:   false,
+			},
+		},
+		map[string]string{
+			"REQ":       "provided",
+			"EXTRA_KEY": "custom",
+		},
+	)
+
+	if len(missing) != 0 {
+		t.Fatalf("expected no missing required vars, got %v", missing)
+	}
+	if env["REQ"] != "provided" {
+		t.Fatalf("expected REQ=provided, got %q", env["REQ"])
+	}
+	if env["OPTIONAL"] != "fallback" {
+		t.Fatalf("expected OPTIONAL=fallback, got %q", env["OPTIONAL"])
+	}
+	if env["EXTRA_KEY"] != "custom" {
+		t.Fatalf("expected EXTRA_KEY=custom, got %q", env["EXTRA_KEY"])
+	}
+	if !secretKeys["REQ"] {
+		t.Fatalf("expected REQ to be marked secret")
+	}
+}
+
+func TestResolveTemplateRuntimeImage(t *testing.T) {
+	if got := resolveTemplateRuntimeImage("dragonfly"); got == "dragonfly" || got == "" {
+		t.Fatalf("expected dragonfly runtime to map to a concrete image, got %q", got)
+	}
+	if got := resolveTemplateRuntimeImage("custom-runtime"); got != "custom-runtime" {
+		t.Fatalf("expected unknown runtime passthrough, got %q", got)
+	}
+}

app/backend/internal/api/variables.go

@@ -0,0 +1,207 @@
+package api
+
+import (
+	"containr/internal/database"
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type EnvironmentVariable struct {
+	ID        uuid.UUID `json:"id" db:"id"`
+	ServiceID uuid.UUID `json:"service_id" db:"service_id"`
+	Key       string    `json:"key" db:"key"`
+	Value     string    `json:"value" db:"value"`
+	IsSecret  bool      `json:"is_secret" db:"is_secret"`
+	CreatedAt time.Time `json:"created_at" db:"created_at"`
+	UpdatedAt time.Time `json:"updated_at" db:"updated_at"`
+}
+
+type UpdateVariablesRequest struct {
+	Variables []VariableInput `json:"variables" binding:"required"`
+}
+
+type VariableInput struct {
+	Key      string `json:"key" binding:"required"`
+	Value    string `json:"value"`
+	IsSecret bool   `json:"is_secret"`
+}
+
+func handleGetVariables(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var ownerCheck string
+	err = db.(*database.DB).QueryRow(
+		`SELECT p.owner_id FROM services s 
+		 JOIN projects p ON s.project_id = p.id 
+		 WHERE s.id = $1`,
+		serviceID,
+	).Scan(&ownerCheck)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	if ownerCheck != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	rows, err := db.(*database.DB).Query(
+		`SELECT id, service_id, key, value, is_secret, created_at, updated_at
+		 FROM environment_variables 
+		 WHERE service_id = $1 
+		 ORDER BY key ASC`,
+		serviceID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve variables"})
+		return
+	}
+	defer rows.Close()
+
+	var variables []EnvironmentVariable
+	for rows.Next() {
+		var v EnvironmentVariable
+		err := rows.Scan(
+			&v.ID, &v.ServiceID, &v.Key, &v.Value, &v.IsSecret, &v.CreatedAt, &v.UpdatedAt,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan variable"})
+			return
+		}
+		if v.IsSecret {
+			v.Value = "********"
+		}
+		variables = append(variables, v)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"variables": variables})
+}
+
+func handleUpdateVariables(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	serviceIDStr := c.Param("id")
+	serviceID, err := uuid.Parse(serviceIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+
+	var req UpdateVariablesRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var ownerCheck string
+	err = db.(*database.DB).QueryRow(
+		`SELECT p.owner_id FROM services s 
+		 JOIN projects p ON s.project_id = p.id 
+		 WHERE s.id = $1`,
+		serviceID,
+	).Scan(&ownerCheck)
+
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return
+	}
+
+	if ownerCheck != userID.(string) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
+
+	tx, err := db.(*database.DB).Begin()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to begin transaction"})
+		return
+	}
+	defer tx.Rollback()
+
+	_, err = tx.Exec("DELETE FROM environment_variables WHERE service_id = $1", serviceID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clear existing variables"})
+		return
+	}
+
+	now := time.Now()
+	for _, v := range req.Variables {
+		varID := uuid.New()
+		_, err = tx.Exec(
+			`INSERT INTO environment_variables (id, service_id, key, value, is_secret, created_at, updated_at)
+			 VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+			varID, serviceID, v.Key, v.Value, v.IsSecret, now, now,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to insert variable: " + v.Key})
+			return
+		}
+	}
+
+	if err = tx.Commit(); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to commit transaction"})
+		return
+	}
+
+	rows, err := db.(*database.DB).Query(
+		`SELECT id, service_id, key, value, is_secret, created_at, updated_at
+		 FROM environment_variables 
+		 WHERE service_id = $1 
+		 ORDER BY key ASC`,
+		serviceID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve variables"})
+		return
+	}
+	defer rows.Close()
+
+	var variables []EnvironmentVariable
+	for rows.Next() {
+		var v EnvironmentVariable
+		err := rows.Scan(
+			&v.ID, &v.ServiceID, &v.Key, &v.Value, &v.IsSecret, &v.CreatedAt, &v.UpdatedAt,
+		)
+		if err != nil {
+			continue
+		}
+		if v.IsSecret {
+			v.Value = "********"
+		}
+		variables = append(variables, v)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"variables": variables, "message": "Environment variables updated successfully"})
+}

app/backend/internal/api/websocket.go

@@ -0,0 +1,270 @@
+package api
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/gorilla/websocket"
+)
+
+var upgrader = websocket.Upgrader{
+	ReadBufferSize:  1024,
+	WriteBufferSize: 1024,
+	CheckOrigin: func(r *http.Request) bool {
+		return true
+	},
+}
+
+type WebSocketClient struct {
+	ID       string
+	UserID   string
+	Conn     *websocket.Conn
+	Channels map[string]bool
+	Send     chan []byte
+}
+
+type WebSocketMessage struct {
+	Type      string      `json:"type"`
+	Channel   string      `json:"channel"`
+	Data      interface{} `json:"data"`
+	Timestamp time.Time   `json:"timestamp"`
+}
+
+type WebSocketHub struct {
+	clients    map[string]*WebSocketClient
+	broadcast  chan *WebSocketMessage
+	register   chan *WebSocketClient
+	unregister chan *WebSocketClient
+	mu         sync.RWMutex
+}
+
+var wsHub = &WebSocketHub{
+	clients:    make(map[string]*WebSocketClient),
+	broadcast:  make(chan *WebSocketMessage, 100),
+	register:   make(chan *WebSocketClient),
+	unregister: make(chan *WebSocketClient),
+}
+
+func init() {
+	go wsHub.run()
+}
+
+func (h *WebSocketHub) run() {
+	for {
+		select {
+		case client := <-h.register:
+			h.mu.Lock()
+			h.clients[client.ID] = client
+			h.mu.Unlock()
+			log.Printf("WebSocket client connected: %s", client.ID)
+
+		case client := <-h.unregister:
+			h.mu.Lock()
+			if _, ok := h.clients[client.ID]; ok {
+				delete(h.clients, client.ID)
+				close(client.Send)
+			}
+			h.mu.Unlock()
+			log.Printf("WebSocket client disconnected: %s", client.ID)
+
+		case message := <-h.broadcast:
+			h.mu.RLock()
+			data, err := json.Marshal(message)
+			if err != nil {
+				log.Printf("Error marshaling WebSocket message: %v", err)
+				h.mu.RUnlock()
+				continue
+			}
+
+			for _, client := range h.clients {
+				if client.Channels[message.Channel] || message.Channel == "all" {
+					select {
+					case client.Send <- data:
+					default:
+						close(client.Send)
+						delete(h.clients, client.ID)
+					}
+				}
+			}
+			h.mu.RUnlock()
+		}
+	}
+}
+
+func (h *WebSocketHub) Broadcast(channel string, msgType string, data interface{}) {
+	message := &WebSocketMessage{
+		Type:      msgType,
+		Channel:   channel,
+		Data:      data,
+		Timestamp: time.Now(),
+	}
+	h.broadcast <- message
+}
+
+func (h *WebSocketHub) BroadcastToUser(userID string, msgType string, data interface{}) {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+
+	message := &WebSocketMessage{
+		Type:      msgType,
+		Channel:   "user:" + userID,
+		Data:      data,
+		Timestamp: time.Now(),
+	}
+
+	messageBytes, err := json.Marshal(message)
+	if err != nil {
+		return
+	}
+
+	for _, client := range h.clients {
+		if client.UserID == userID {
+			select {
+			case client.Send <- messageBytes:
+			default:
+			}
+		}
+	}
+}
+
+func handleWebSocket(c *gin.Context) {
+	conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
+	if err != nil {
+		log.Printf("WebSocket upgrade error: %v", err)
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		conn.Close()
+		return
+	}
+
+	client := &WebSocketClient{
+		ID:       generateClientID(),
+		UserID:   userID.(string),
+		Conn:     conn,
+		Channels: make(map[string]bool),
+		Send:     make(chan []byte, 256),
+	}
+
+	wsHub.register <- client
+
+	go client.writePump()
+	go client.readPump()
+}
+
+func (c *WebSocketClient) readPump() {
+	defer func() {
+		wsHub.unregister <- c
+		c.Conn.Close()
+	}()
+
+	c.Conn.SetReadLimit(512)
+	c.Conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+
+	for {
+		_, message, err := c.Conn.ReadMessage()
+		if err != nil {
+			break
+		}
+
+		var msg struct {
+			Action  string `json:"action"`
+			Channel string `json:"channel"`
+		}
+		if err := json.Unmarshal(message, &msg); err != nil {
+			continue
+		}
+
+		switch msg.Action {
+		case "subscribe":
+			c.Channels[msg.Channel] = true
+		case "unsubscribe":
+			delete(c.Channels, msg.Channel)
+		}
+
+		c.Conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+	}
+}
+
+func (c *WebSocketClient) writePump() {
+	ticker := time.NewTicker(30 * time.Second)
+	defer func() {
+		ticker.Stop()
+		c.Conn.Close()
+	}()
+
+	for {
+		select {
+		case message, ok := <-c.Send:
+			c.Conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
+			if !ok {
+				c.Conn.WriteMessage(websocket.CloseMessage, []byte{})
+				return
+			}
+
+			w, err := c.Conn.NextWriter(websocket.TextMessage)
+			if err != nil {
+				return
+			}
+			w.Write(message)
+
+			n := len(c.Send)
+			for i := 0; i < n; i++ {
+				w.Write([]byte{'\n'})
+				w.Write(<-c.Send)
+			}
+
+			if err := w.Close(); err != nil {
+				return
+			}
+		case <-ticker.C:
+			c.Conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
+			if err := c.Conn.WriteMessage(websocket.PingMessage, nil); err != nil {
+				return
+			}
+		}
+	}
+}
+
+func generateClientID() string {
+	return time.Now().Format("20060102150405") + "-" + randomString(8)
+}
+
+func randomString(n int) string {
+	const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = letters[time.Now().Nanosecond()%len(letters)]
+	}
+	return string(b)
+}
+
+func BroadcastServiceUpdate(serviceID string, data interface{}) {
+	wsHub.Broadcast("service:"+serviceID, "service_update", data)
+}
+
+func BroadcastDeploymentUpdate(deploymentID string, data interface{}) {
+	wsHub.Broadcast("deployment:"+deploymentID, "deployment_update", data)
+}
+
+func BroadcastBuildUpdate(buildID string, data interface{}) {
+	wsHub.Broadcast("build:"+buildID, "build_update", data)
+}
+
+func BroadcastMetricsUpdate(serviceID string, data interface{}) {
+	wsHub.Broadcast("metrics:"+serviceID, "metrics_update", data)
+}
+
+func BroadcastScalingEvent(serviceID string, data interface{}) {
+	wsHub.Broadcast("scaling:"+serviceID, "scaling_event", data)
+}
+
+func NotifyUser(userID string, notificationType string, data interface{}) {
+	wsHub.BroadcastToUser(userID, notificationType, data)
+}

app/backend/internal/apwhy/analytics/umami.go

@@ -0,0 +1,74 @@
+package analytics
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+type Client struct {
+	BaseURL   string
+	APIKey    string
+	WebsiteID string
+	HTTP      *http.Client
+}
+
+func NewClient(baseURL, apiKey, websiteID string) *Client {
+	return &Client{
+		BaseURL:   baseURL,
+		APIKey:    apiKey,
+		WebsiteID: websiteID,
+		HTTP: &http.Client{
+			Timeout: 10 * time.Second,
+		},
+	}
+}
+
+func (c *Client) Enabled() bool {
+	return c.BaseURL != "" && c.APIKey != "" && c.WebsiteID != ""
+}
+
+func (c *Client) FetchTraffic(ctx context.Context, from, to time.Time) (map[string]any, error) {
+	if !c.Enabled() {
+		return map[string]any{
+			"enabled": false,
+		}, nil
+	}
+
+	u, err := url.Parse(fmt.Sprintf("%s/api/websites/%s/stats", c.BaseURL, c.WebsiteID))
+	if err != nil {
+		return nil, err
+	}
+
+	query := u.Query()
+	query.Set("startAt", fmt.Sprintf("%d", from.UnixMilli()))
+	query.Set("endAt", fmt.Sprintf("%d", to.UnixMilli()))
+	u.RawQuery = query.Encode()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "Bearer "+c.APIKey)
+	req.Header.Set("Accept", "application/json")
+
+	res, err := c.HTTP.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode >= 400 {
+		return nil, fmt.Errorf("umami returned %d", res.StatusCode)
+	}
+
+	var payload map[string]any
+	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
+		return nil, err
+	}
+	payload["enabled"] = true
+	return payload, nil
+}

app/backend/internal/apwhy/api/server_integration_test.go

@@ -0,0 +1,321 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/cookiejar"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"containr/internal/apwhy/config"
+	"containr/internal/apwhy/storage"
+)
+
+type apiErrorPayload struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+type apiResponsePayload struct {
+	OK    bool            `json:"ok"`
+	Data  any             `json:"data"`
+	Error apiErrorPayload `json:"error"`
+}
+
+func newTestServer(t *testing.T) (*httptest.Server, *http.Client) {
+	t.Helper()
+
+	cfg := config.Load()
+	cfg.SQLitePath = ":memory:"
+	cfg.CookieSecure = false
+
+	store, err := storage.Open(cfg)
+	if err != nil {
+		t.Fatalf("failed to open test storage: %v", err)
+	}
+
+	server := NewServer(store, cfg)
+	ts := httptest.NewServer(server.Handler())
+
+	t.Cleanup(func() {
+		ts.Close()
+		_ = store.Close()
+	})
+
+	jar, err := cookiejar.New(nil)
+	if err != nil {
+		t.Fatalf("failed to create cookie jar: %v", err)
+	}
+
+	return ts, &http.Client{Jar: jar}
+}
+
+func requestJSON(t *testing.T, client *http.Client, method string, url string, body string) (int, apiResponsePayload) {
+	t.Helper()
+
+	var bodyReader *bytes.Reader
+	if body == "" {
+		bodyReader = bytes.NewReader(nil)
+	} else {
+		bodyReader = bytes.NewReader([]byte(body))
+	}
+
+	req, err := http.NewRequest(method, url, bodyReader)
+	if err != nil {
+		t.Fatalf("failed to create request: %v", err)
+	}
+	if body != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	var payload apiResponsePayload
+	if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
+		t.Fatalf("failed to decode response body: %v", err)
+	}
+
+	return resp.StatusCode, payload
+}
+
+func bootstrapAndLoginOwner(t *testing.T, client *http.Client, baseURL string) {
+	t.Helper()
+
+	status, payload := requestJSON(
+		t,
+		client,
+		http.MethodPost,
+		baseURL+"/api/v1/bootstrap/register-owner",
+		`{"email":"owner@example.com","password":"owner-pass-123"}`,
+	)
+	if status != http.StatusCreated || !payload.OK {
+		t.Fatalf("owner bootstrap failed: status=%d payload=%+v", status, payload)
+	}
+
+	status, payload = requestJSON(
+		t,
+		client,
+		http.MethodPost,
+		baseURL+"/api/v1/auth/login",
+		`{"email":"owner@example.com","password":"owner-pass-123"}`,
+	)
+	if status != http.StatusOK || !payload.OK {
+		t.Fatalf("owner login failed: status=%d payload=%+v", status, payload)
+	}
+}
+
+func TestServerBootstrapLoginAndProtectedRoutes(t *testing.T) {
+	ts, authClient := newTestServer(t)
+	baseURL := ts.URL
+
+	// Bootstrap should be open before any user exists.
+	status, payload := requestJSON(t, authClient, http.MethodGet, baseURL+"/api/v1/bootstrap/status", "")
+	if status != http.StatusOK || !payload.OK {
+		t.Fatalf("unexpected bootstrap status response: status=%d payload=%+v", status, payload)
+	}
+	bootstrapData, ok := payload.Data.(map[string]any)
+	if !ok {
+		t.Fatalf("expected object payload for bootstrap status, got %#v", payload.Data)
+	}
+	if hasUsers, _ := bootstrapData["hasUsers"].(bool); hasUsers {
+		t.Fatalf("expected hasUsers=false before owner bootstrap")
+	}
+	if registrationOpen, _ := bootstrapData["registrationOpen"].(bool); !registrationOpen {
+		t.Fatalf("expected registrationOpen=true before owner bootstrap")
+	}
+
+	// Protected route without auth should fail.
+	anonClient := &http.Client{}
+	status, payload = requestJSON(t, anonClient, http.MethodGet, baseURL+"/api/v1/auth/me", "")
+	if status != http.StatusUnauthorized || payload.OK {
+		t.Fatalf("expected unauthorized /auth/me response, got status=%d payload=%+v", status, payload)
+	}
+
+	// Register owner and login.
+	bootstrapAndLoginOwner(t, authClient, baseURL)
+
+	// Bootstrap should close once owner exists.
+	status, payload = requestJSON(t, authClient, http.MethodGet, baseURL+"/api/v1/bootstrap/status", "")
+	if status != http.StatusOK || !payload.OK {
+		t.Fatalf("unexpected bootstrap status after owner creation: status=%d payload=%+v", status, payload)
+	}
+	bootstrapData, ok = payload.Data.(map[string]any)
+	if !ok {
+		t.Fatalf("expected object payload for bootstrap status, got %#v", payload.Data)
+	}
+	if hasUsers, _ := bootstrapData["hasUsers"].(bool); !hasUsers {
+		t.Fatalf("expected hasUsers=true after owner bootstrap")
+	}
+	if registrationOpen, _ := bootstrapData["registrationOpen"].(bool); registrationOpen {
+		t.Fatalf("expected registrationOpen=false after owner bootstrap")
+	}
+
+	// Owner session cookie should authorize /auth/me.
+	status, payload = requestJSON(t, authClient, http.MethodGet, baseURL+"/api/v1/auth/me", "")
+	if status != http.StatusOK || !payload.OK {
+		t.Fatalf("expected successful /auth/me response, got status=%d payload=%+v", status, payload)
+	}
+	meData, ok := payload.Data.(map[string]any)
+	if !ok {
+		t.Fatalf("expected object payload for auth/me, got %#v", payload.Data)
+	}
+	if email, _ := meData["email"].(string); email != "owner@example.com" {
+		t.Fatalf("unexpected /auth/me email: %q", email)
+	}
+
+	// Logout should revoke auth session.
+	status, payload = requestJSON(t, authClient, http.MethodPost, baseURL+"/api/v1/auth/logout", "")
+	if status != http.StatusOK || !payload.OK {
+		t.Fatalf("expected successful logout response, got status=%d payload=%+v", status, payload)
+	}
+	status, payload = requestJSON(t, authClient, http.MethodGet, baseURL+"/api/v1/auth/me", "")
+	if status != http.StatusUnauthorized || payload.OK {
+		t.Fatalf("expected unauthorized /auth/me after logout, got status=%d payload=%+v", status, payload)
+	}
+}
+
+func TestServerServicesCreateValidationRules(t *testing.T) {
+	ts, client := newTestServer(t)
+	baseURL := ts.URL
+
+	bootstrapAndLoginOwner(t, client, baseURL)
+
+	// Route prefix under /api must be rejected.
+	status, payload := requestJSON(
+		t,
+		client,
+		http.MethodPost,
+		baseURL+"/api/v1/services",
+		`{"name":"Bad Service","upstreamUrl":"http://example.com","routePrefix":"/api/conflict"}`,
+	)
+	if status != http.StatusBadRequest || payload.OK {
+		t.Fatalf("expected route conflict validation failure, got status=%d payload=%+v", status, payload)
+	}
+	if payload.Error.Code != "ROUTE_CONFLICT" {
+		t.Fatalf("expected ROUTE_CONFLICT error code, got %q", payload.Error.Code)
+	}
+
+	// Valid service should be created successfully.
+	status, payload = requestJSON(
+		t,
+		client,
+		http.MethodPost,
+		baseURL+"/api/v1/services",
+		`{"name":"Web Frontend","upstreamUrl":"http://example.com","routePrefix":"/web"}`,
+	)
+	if status != http.StatusCreated || !payload.OK {
+		t.Fatalf("expected successful service creation, got status=%d payload=%+v", status, payload)
+	}
+	createData, ok := payload.Data.(map[string]any)
+	if !ok {
+		t.Fatalf("expected object payload for service creation, got %#v", payload.Data)
+	}
+	if _, ok := createData["id"].(string); !ok {
+		t.Fatalf("expected created service id in response")
+	}
+	if slug, _ := createData["slug"].(string); !strings.Contains(slug, "web-frontend") {
+		t.Fatalf("expected normalized service slug, got %q", slug)
+	}
+
+	// List should contain the newly created service.
+	status, payload = requestJSON(t, client, http.MethodGet, baseURL+"/api/v1/services", "")
+	if status != http.StatusOK || !payload.OK {
+		t.Fatalf("expected successful services list response, got status=%d payload=%+v", status, payload)
+	}
+	rows, ok := payload.Data.([]any)
+	if !ok || len(rows) == 0 {
+		t.Fatalf("expected non-empty services list, got %#v", payload.Data)
+	}
+}
+
+func TestServerProxyWithAPIKey(t *testing.T) {
+	ts, authClient := newTestServer(t)
+	baseURL := ts.URL
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("x-api-key") != "" {
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = io.WriteString(w, "unexpected-api-key-header")
+			return
+		}
+		_, _ = io.WriteString(w, "ok:"+r.URL.Path+"?"+r.URL.RawQuery)
+	}))
+	t.Cleanup(upstream.Close)
+
+	bootstrapAndLoginOwner(t, authClient, baseURL)
+
+	// Create service exposed at /web/* and proxied to the upstream test server.
+	status, payload := requestJSON(
+		t,
+		authClient,
+		http.MethodPost,
+		baseURL+"/api/v1/services",
+		`{"name":"Web Proxy","upstreamUrl":"`+upstream.URL+`","routePrefix":"/web"}`,
+	)
+	if status != http.StatusCreated || !payload.OK {
+		t.Fatalf("expected successful service creation, got status=%d payload=%+v", status, payload)
+	}
+
+	// Mint API key for gateway access.
+	status, payload = requestJSON(
+		t,
+		authClient,
+		http.MethodPost,
+		baseURL+"/api/v1/keys",
+		`{"name":"integration-key","plan":"free"}`,
+	)
+	if status != http.StatusCreated || !payload.OK {
+		t.Fatalf("expected successful key creation, got status=%d payload=%+v", status, payload)
+	}
+	keyData, ok := payload.Data.(map[string]any)
+	if !ok {
+		t.Fatalf("expected object payload for key creation, got %#v", payload.Data)
+	}
+	rawKey, _ := keyData["key"].(string)
+	if strings.TrimSpace(rawKey) == "" {
+		t.Fatalf("expected non-empty raw API key")
+	}
+
+	// No API key should be rejected.
+	anonClient := &http.Client{}
+	status, payload = requestJSON(t, anonClient, http.MethodGet, baseURL+"/web/ping?x=1", "")
+	if status != http.StatusUnauthorized || payload.OK {
+		t.Fatalf("expected unauthorized proxy request without key, got status=%d payload=%+v", status, payload)
+	}
+	if payload.Error.Code != "API_KEY_MISSING" {
+		t.Fatalf("expected API_KEY_MISSING error code, got %q", payload.Error.Code)
+	}
+
+	// Valid API key should proxy request and strip the key before forwarding.
+	req, err := http.NewRequest(http.MethodGet, baseURL+"/web/ping?x=1", nil)
+	if err != nil {
+		t.Fatalf("failed to create proxy request: %v", err)
+	}
+	req.Header.Set("x-api-key", rawKey)
+
+	resp, err := anonClient.Do(req)
+	if err != nil {
+		t.Fatalf("proxy request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	bodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("failed to read proxy response body: %v", err)
+	}
+	body := string(bodyBytes)
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("expected proxy status 200, got %d body=%q", resp.StatusCode, body)
+	}
+	if body != "ok:/ping?x=1" {
+		t.Fatalf("unexpected proxy body: %q", body)
+	}
+}