feat: public platform, admin console, templates, landing docs

Projects become publicly browsable after admin approval; management and
secret-adjacent reads (logs, variables, exec, connection URLs) require
owner/member/admin auth, and platform controls sit behind RequireAdmin.

- Backend: OptionalAuth middleware, read/authed/admin route groups,
  projects.is_approved + service_templates.owner_id migration,
  visibility-aware sqlc queries, admin overview/users/approval endpoints,
  EnsureAdminAccount bootstrap (ADMIN_* env), 30 seeded templates with
  owner CRUD, managed-database connection URLs gated owner+admin, fix
  DB.Stats() infinite recursion.
- Frontend: expandable persisted sidebar + clickable user menu, public
  landing page with searchable docs browser (GitHub sync, bundled
  snapshot + localStorage fallback), DocsBrowser shared with /docs,
  template create/edit/JSON-upload for owned templates, database create
  dialog, admin console (stats, approvals, project edit/delete, user
  admin toggles), HA/Security/Usage polish with dead CSS tokens mapped
  to real theme vars, anonymous-safe gating on every mutation control.
- Tests: safe window.localStorage access fixes happy-dom crashes in
  PlatformShell and canvas storage.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/features/admin/pages/AdminPage.tsx

@@ -0,0 +1,369 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useState } from 'react';
+import { Link } from 'react-router-dom';
+import {
+  CheckCircle2,
+  Clock,
+  FolderKanban,
+  Pencil,
+  ShieldCheck,
+  Trash2,
+  Users,
+  XCircle,
+} from 'lucide-react';
+import {
+  deleteProject,
+  getAdminOverview,
+  listAdminUsers,
+  listProjects,
+  setProjectApproval,
+  setUserAdmin,
+  updateProject,
+  type AdminUser,
+  type ProjectEntity,
+} from '@/lib/api-client';
+import { useAuthSession } from '@/lib/use-auth-session';
+import { LoadingState, useToast } from '@/shared/components';
+
+const statLabels: Record<string, string> = {
+  users: 'Users',
+  projects: 'Projects',
+  pending_projects: 'Pending approval',
+  services: 'Services',
+  running_services: 'Running',
+  databases: 'Databases',
+  agents: 'Agents',
+  templates: 'Templates',
+  user_templates: 'User templates',
+  cron_jobs: 'Cron jobs',
+  deployments_total: 'Deployments',
+};
+
+export function AdminPage() {
+  const queryClient = useQueryClient();
+  const { showToast } = useToast();
+  const sessionQuery = useAuthSession();
+  const myId = sessionQuery.data?.user.id;
+
+  const overviewQuery = useQuery({ queryKey: ['admin-overview'], queryFn: getAdminOverview });
+  const usersQuery = useQuery({ queryKey: ['admin-users'], queryFn: listAdminUsers });
+  const projectsQuery = useQuery({ queryKey: ['admin-projects'], queryFn: () => listProjects({ limit: 100 }) });
+  const [editingProject, setEditingProject] = useState<ProjectEntity | null>(null);
+  const [editForm, setEditForm] = useState({ name: '', description: '' });
+
+  const invalidate = () => {
+    queryClient.invalidateQueries({ queryKey: ['admin-overview'] });
+    queryClient.invalidateQueries({ queryKey: ['admin-users'] });
+    queryClient.invalidateQueries({ queryKey: ['admin-projects'] });
+    queryClient.invalidateQueries({ queryKey: ['projects'] });
+  };
+
+  const approvalMutation = useMutation({
+    mutationFn: ({ id, approved }: { id: string; approved: boolean }) => setProjectApproval(id, approved),
+    onSuccess: (_, vars) => {
+      showToast('success', vars.approved ? 'Project approved' : 'Project unapproved');
+      invalidate();
+    },
+    onError: (error) => showToast('error', 'Update failed', error instanceof Error ? error.message : undefined),
+  });
+
+  const adminMutation = useMutation({
+    mutationFn: ({ id, isAdmin }: { id: string; isAdmin: boolean }) => setUserAdmin(id, isAdmin),
+    onSuccess: (_, vars) => {
+      showToast('success', vars.isAdmin ? 'Admin granted' : 'Admin revoked');
+      invalidate();
+    },
+    onError: (error) => showToast('error', 'Update failed', error instanceof Error ? error.message : undefined),
+  });
+
+  const editMutation = useMutation({
+    mutationFn: () =>
+      updateProject(editingProject!.id, {
+        name: editForm.name.trim(),
+        description: editForm.description.trim(),
+      }),
+    onSuccess: () => {
+      showToast('success', 'Project updated');
+      setEditingProject(null);
+      invalidate();
+    },
+    onError: (error) => showToast('error', 'Update failed', error instanceof Error ? error.message : undefined),
+  });
+
+  const deleteMutation = useMutation({
+    mutationFn: (id: string) => deleteProject(id),
+    onSuccess: () => {
+      showToast('success', 'Project deleted');
+      invalidate();
+    },
+    onError: (error) => showToast('error', 'Delete failed', error instanceof Error ? error.message : undefined),
+  });
+
+  if (overviewQuery.isPending) {
+    return <LoadingState message="Loading admin console…" className="py-24" />;
+  }
+
+  if (overviewQuery.isError) {
+    return (
+      <div className="mx-auto max-w-xl px-5 py-24 text-center">
+        <ShieldCheck size={28} className="mx-auto text-[var(--error)]" />
+        <h1 className="mt-4 text-lg font-semibold text-[var(--text-primary)]">Admin access required</h1>
+        <p className="mt-2 text-sm text-[var(--text-secondary)]">
+          This area is restricted to platform administrators.
+        </p>
+      </div>
+    );
+  }
+
+  const overview = overviewQuery.data;
+  const stats = overview?.stats ?? {};
+  const pending = overview?.pending_projects ?? [];
+  const users = usersQuery.data ?? [];
+  const allProjects = projectsQuery.data ?? [];
+
+  return (
+    <div className="mx-auto max-w-6xl px-5 py-8">
+      <div className="mb-8">
+        <h1 className="text-[24px] font-bold tracking-tight text-[var(--text-primary)]">Admin console</h1>
+        <p className="mt-1 text-sm text-[var(--text-secondary)]">
+          Platform overview, project approvals, and user management.
+        </p>
+      </div>
+
+      <div className="grid grid-cols-4 gap-3 max-lg:grid-cols-3 max-sm:grid-cols-2">
+        {Object.entries(statLabels).map(([key, label]) => (
+          <div
+            key={key}
+            className="rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)] px-4 py-3.5"
+          >
+            <p className="text-[20px] font-bold tabular-nums text-[var(--text-primary)]">{stats[key] ?? 0}</p>
+            <p className="mt-0.5 text-[10.5px] uppercase tracking-wider text-[var(--text-tertiary)]">{label}</p>
+          </div>
+        ))}
+      </div>
+
+      <section className="mt-8">
+        <div className="mb-3 flex items-center gap-2">
+          <Clock size={15} className="text-[var(--warning)]" />
+          <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">Pending approvals</h2>
+          {pending.length > 0 ? (
+            <span className="rounded-full bg-[var(--warning-soft)] px-2 py-0.5 text-[10.5px] font-semibold text-[var(--warning)]">
+              {pending.length}
+            </span>
+          ) : null}
+        </div>
+        {pending.length > 0 ? (
+          <div className="overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)]">
+            {pending.map((project) => (
+              <div
+                key={project.id}
+                className="flex items-center gap-4 border-b border-[var(--border-subtle)] px-4 py-3 last:border-b-0"
+              >
+                <FolderKanban size={15} className="shrink-0 text-[var(--text-tertiary)]" />
+                <div className="min-w-0 flex-1">
+                  <Link to={`/projects/${project.id}`} className="text-[13.5px] font-medium text-[var(--text-primary)] hover:underline">
+                    {project.name}
+                  </Link>
+                  <p className="truncate text-[11.5px] text-[var(--text-tertiary)]">{project.description || 'No description'}</p>
+                </div>
+                <button
+                  type="button"
+                  onClick={() => approvalMutation.mutate({ id: project.id, approved: true })}
+                  disabled={approvalMutation.isPending}
+                  className="inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-3 py-1.5 text-[12px] font-semibold text-[var(--accent-on)] disabled:opacity-50"
+                >
+                  <CheckCircle2 size={13} /> Approve
+                </button>
+              </div>
+            ))}
+          </div>
+        ) : (
+          <div className="rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)] px-4 py-6 text-center text-[13px] text-[var(--text-tertiary)]">
+            Nothing waiting for approval.
+          </div>
+        )}
+      </section>
+
+      <section className="mt-8">
+        <div className="mb-3 flex items-center gap-2">
+          <FolderKanban size={15} className="text-[var(--accent-primary)]" />
+          <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">All projects</h2>
+        </div>
+        <div className="overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)]">
+          {allProjects.map((project) => (
+            <div
+              key={project.id}
+              className="flex items-center gap-4 border-b border-[var(--border-subtle)] px-4 py-3 last:border-b-0"
+            >
+              <div className="min-w-0 flex-1">
+                <Link to={`/projects/${project.id}`} className="text-[13.5px] font-medium text-[var(--text-primary)] hover:underline">
+                  {project.name}
+                </Link>
+                <p className="truncate text-[11.5px] text-[var(--text-tertiary)]">
+                  {project.stats?.service_count ?? 0} services · {project.stats?.deployment_count ?? 0} deploys
+                </p>
+              </div>
+              <span
+                className={`rounded-full px-2.5 py-0.5 text-[10.5px] font-semibold ${
+                  project.isApproved
+                    ? 'bg-[var(--success-soft)] text-[var(--success)]'
+                    : 'bg-[var(--warning-soft)] text-[var(--warning)]'
+                }`}
+              >
+                {project.isApproved ? 'public' : 'pending'}
+              </span>
+              <button
+                type="button"
+                onClick={() => {
+                  setEditingProject(project);
+                  setEditForm({ name: project.name, description: project.description ?? '' });
+                }}
+                className="inline-flex items-center gap-1 rounded-[var(--radius-md)] border border-[var(--border-default)] px-2.5 py-1.5 text-[12px] font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+                title="Edit project"
+              >
+                <Pencil size={12} />
+              </button>
+              <button
+                type="button"
+                onClick={() => {
+                  if (window.confirm(`Delete project "${project.name}"? This removes its services and deployments.`)) {
+                    deleteMutation.mutate(project.id);
+                  }
+                }}
+                disabled={deleteMutation.isPending}
+                className="inline-flex items-center gap-1 rounded-[var(--radius-md)] border border-[var(--error)] px-2.5 py-1.5 text-[12px] font-medium text-[var(--error)] hover:bg-[var(--error-soft)] disabled:opacity-50"
+                title="Delete project"
+              >
+                <Trash2 size={12} />
+              </button>
+              <button
+                type="button"
+                onClick={() => approvalMutation.mutate({ id: project.id, approved: !project.isApproved })}
+                disabled={approvalMutation.isPending}
+                className="rounded-[var(--radius-md)] border border-[var(--border-default)] px-3 py-1.5 text-[12px] font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)] disabled:opacity-50"
+              >
+                {project.isApproved ? 'Unapprove' : 'Approve'}
+              </button>
+            </div>
+          ))}
+          {allProjects.length === 0 ? (
+            <p className="px-4 py-6 text-center text-[13px] text-[var(--text-tertiary)]">No projects yet.</p>
+          ) : null}
+        </div>
+      </section>
+
+      <section className="mt-8 pb-10">
+        <div className="mb-3 flex items-center gap-2">
+          <Users size={15} className="text-[var(--accent-tertiary)]" />
+          <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">Users</h2>
+        </div>
+        <div className="overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)]">
+          {users.map((user) => (
+            <UserRow
+              key={user.id}
+              user={user}
+              isSelf={user.id === myId}
+              pending={adminMutation.isPending}
+              onToggle={(isAdmin) => adminMutation.mutate({ id: user.id, isAdmin })}
+            />
+          ))}
+          {users.length === 0 ? (
+            <p className="px-4 py-6 text-center text-[13px] text-[var(--text-tertiary)]">No users.</p>
+          ) : null}
+        </div>
+      </section>
+
+      {editingProject ? (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+          <div className="w-full max-w-md overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--bg-base)] shadow-2xl">
+            <div className="border-b border-[var(--border-subtle)] px-5 py-4">
+              <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">Edit project</h2>
+              <p className="text-xs text-[var(--text-tertiary)]">Admin edit — changes apply immediately.</p>
+            </div>
+            <div className="space-y-4 px-5 py-4">
+              <div>
+                <label className="mb-1.5 block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Name</label>
+                <input
+                  value={editForm.name}
+                  onChange={(e) => setEditForm((f) => ({ ...f, name: e.target.value }))}
+                  className="h-10 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-3 text-sm focus:border-[var(--accent-primary)]"
+                />
+              </div>
+              <div>
+                <label className="mb-1.5 block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Description</label>
+                <textarea
+                  value={editForm.description}
+                  onChange={(e) => setEditForm((f) => ({ ...f, description: e.target.value }))}
+                  rows={3}
+                  className="w-full resize-none rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-3 py-2 text-sm focus:border-[var(--accent-primary)]"
+                />
+              </div>
+            </div>
+            <div className="flex items-center justify-end gap-2 border-t border-[var(--border-subtle)] px-5 py-3.5">
+              <button
+                type="button"
+                onClick={() => setEditingProject(null)}
+                className="rounded-[var(--radius-md)] px-3.5 py-2 text-xs font-medium text-[var(--text-secondary)] hover:bg-[var(--surface-muted)]"
+              >
+                Cancel
+              </button>
+              <button
+                type="button"
+                onClick={() => editMutation.mutate()}
+                disabled={editMutation.isPending || editForm.name.trim().length < 2}
+                className="rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-xs font-semibold text-[var(--accent-on)] disabled:opacity-50"
+              >
+                {editMutation.isPending ? 'Saving…' : 'Save'}
+              </button>
+            </div>
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+function UserRow({
+  user,
+  isSelf,
+  pending,
+  onToggle,
+}: {
+  user: AdminUser;
+  isSelf: boolean;
+  pending: boolean;
+  onToggle: (isAdmin: boolean) => void;
+}) {
+  return (
+    <div className="flex items-center gap-4 border-b border-[var(--border-subtle)] px-4 py-3 last:border-b-0">
+      <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-[var(--surface-muted)] text-[11px] font-bold text-[var(--text-secondary)]">
+        {user.name.split(' ').map((p) => p[0]).join('').slice(0, 2).toUpperCase()}
+      </div>
+      <div className="min-w-0 flex-1">
+        <p className="truncate text-[13.5px] font-medium text-[var(--text-primary)]">
+          {user.name}
+          {isSelf ? <span className="ml-2 text-[10.5px] text-[var(--text-tertiary)]">(you)</span> : null}
+        </p>
+        <p className="truncate text-[11.5px] text-[var(--text-tertiary)]">{user.email}</p>
+      </div>
+      {user.is_admin ? (
+        <span className="inline-flex items-center gap-1 rounded-full bg-[var(--accent-primary-soft)] px-2.5 py-0.5 text-[10.5px] font-semibold text-[var(--accent-primary)]">
+          <ShieldCheck size={11} /> admin
+        </span>
+      ) : null}
+      <button
+        type="button"
+        onClick={() => onToggle(!user.is_admin)}
+        disabled={pending || isSelf}
+        title={isSelf ? 'You cannot change your own admin flag' : undefined}
+        className="rounded-[var(--radius-md)] border border-[var(--border-default)] px-3 py-1.5 text-[12px] font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)] disabled:cursor-not-allowed disabled:opacity-40"
+      >
+        {user.is_admin ? (
+          <span className="inline-flex items-center gap-1"><XCircle size={12} /> Revoke</span>
+        ) : (
+          'Make admin'
+        )}
+      </button>
+    </div>
+  );
+}

app/frontend/src/features/docs/DocsBrowser.tsx

@@ -0,0 +1,197 @@
+import { useEffect, useMemo, useState } from 'react';
+import { marked } from 'marked';
+import DOMPurify from 'dompurify';
+import { BookOpen, CloudOff, FileText, Search } from 'lucide-react';
+import { initialDocs, syncDocs, type DocEntry, type DocsState } from './docs-store';
+
+marked.setOptions({ gfm: true, breaks: false });
+
+function renderMarkdown(markdown: string): string {
+  const html = marked.parse(markdown, { async: false });
+  return DOMPurify.sanitize(typeof html === 'string' ? html : '', {
+    USE_PROFILES: { html: true },
+  });
+}
+
+function excerpt(markdown: string, length = 140): string {
+  const text = markdown
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/[#>*`\-[\]()]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  return text.length > length ? `${text.slice(0, length)}…` : text;
+}
+
+export function DocsBrowser() {
+  const [state, setState] = useState<DocsState>(() => initialDocs());
+  const [query, setQuery] = useState('');
+  const [selectedPath, setSelectedPath] = useState<string | null>(null);
+
+  useEffect(() => {
+    syncDocs(setState);
+  }, []);
+
+  const docs = state.docs;
+
+  const sections = useMemo(() => {
+    const grouped = new Map<string, DocEntry[]>();
+    for (const doc of docs) {
+      const list = grouped.get(doc.section) ?? [];
+      list.push(doc);
+      grouped.set(doc.section, list);
+    }
+    return [...grouped.entries()].sort(([a], [b]) => a.localeCompare(b));
+  }, [docs]);
+
+  const filtered = useMemo(() => {
+    const q = query.trim().toLowerCase();
+    if (!q) return null;
+    return docs.filter(
+      (doc) =>
+        doc.title.toLowerCase().includes(q) ||
+        doc.path.toLowerCase().includes(q) ||
+        doc.markdown.toLowerCase().includes(q),
+    );
+  }, [docs, query]);
+
+  const selected = useMemo(
+    () => docs.find((doc) => doc.path === selectedPath) ?? null,
+    [docs, selectedPath],
+  );
+
+  const selectedHtml = useMemo(
+    () => (selected ? renderMarkdown(selected.markdown) : ''),
+    [selected],
+  );
+
+  const sourceBadge =
+    state.source === 'github'
+      ? { label: 'live · github', cls: 'text-[var(--success)]' }
+      : state.source === 'cache'
+        ? { label: `cached · ${state.syncedAt ? new Date(state.syncedAt).toLocaleDateString() : 'offline'}`, cls: 'text-[var(--warning)]' }
+        : { label: 'bundled copy', cls: 'text-[var(--text-tertiary)]' };
+
+  return (
+    <div className="flex min-h-[480px] overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)]">
+      <div className="flex w-[300px] shrink-0 flex-col border-r border-[var(--border-subtle)] max-md:w-full">
+        <div className="border-b border-[var(--border-subtle)] p-3">
+          <div className="flex items-center gap-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-2.5 py-1.5">
+            <Search size={13} className="shrink-0 text-[var(--text-tertiary)]" />
+            <input
+              type="text"
+              value={query}
+              onChange={(e) => setQuery(e.target.value)}
+              placeholder="Search docs…"
+              className="w-full bg-transparent text-[13px] text-[var(--text-primary)] outline-none placeholder:text-[var(--text-tertiary)]"
+            />
+          </div>
+          <div className="mt-2 flex items-center justify-between px-0.5">
+            <span className={`text-[10.5px] font-medium uppercase tracking-wider ${sourceBadge.cls}`}>
+              {sourceBadge.label}
+            </span>
+            <span className="text-[10.5px] text-[var(--text-tertiary)]">{docs.length} docs</span>
+          </div>
+        </div>
+
+        <div className="flex-1 overflow-y-auto p-2">
+          {filtered ? (
+            filtered.length > 0 ? (
+              filtered.map((doc) => (
+                <DocListItem key={doc.path} doc={doc} active={doc.path === selectedPath} onSelect={setSelectedPath} showSection />
+              ))
+            ) : (
+              <p className="px-2 py-6 text-center text-xs text-[var(--text-tertiary)]">No docs match “{query}”.</p>
+            )
+          ) : (
+            sections.map(([section, entries]) => (
+              <div key={section} className="mb-3">
+                <p className="mb-1 px-2 text-[10px] font-semibold uppercase tracking-[0.14em] text-[var(--text-tertiary)]">
+                  {section}
+                </p>
+                {entries.map((doc) => (
+                  <DocListItem key={doc.path} doc={doc} active={doc.path === selectedPath} onSelect={setSelectedPath} />
+                ))}
+              </div>
+            ))
+          )}
+        </div>
+      </div>
+
+      <div className="min-w-0 flex-1 overflow-y-auto max-md:hidden">
+        {selected ? (
+          <article className="docs-article px-8 py-6">
+            <p className="mb-1 text-[11px] font-medium uppercase tracking-wider text-[var(--text-tertiary)]">
+              {selected.section} / {selected.path}
+            </p>
+            <div dangerouslySetInnerHTML={{ __html: selectedHtml }} />
+          </article>
+        ) : (
+          <div className="flex h-full flex-col items-center justify-center gap-3 p-8 text-center">
+            <BookOpen size={28} className="text-[var(--text-tertiary)]" />
+            <p className="text-sm font-medium text-[var(--text-secondary)]">Select a document</p>
+            <p className="max-w-sm text-xs leading-relaxed text-[var(--text-tertiary)]">
+              Documentation is bundled with the app and refreshes from GitHub in the background.
+              {!state.syncedAt ? ' Currently showing the bundled copy.' : ''}
+            </p>
+            {state.source !== 'github' ? (
+              <p className="flex items-center gap-1.5 text-[11px] text-[var(--text-tertiary)]">
+                <CloudOff size={12} /> Offline-safe — updates apply automatically when a connection is available.
+              </p>
+            ) : null}
+          </div>
+        )}
+      </div>
+
+      {/* Mobile: tapping a doc replaces the list */}
+      {selected ? (
+        <div className="fixed inset-0 z-50 flex flex-col bg-[var(--bg-base)] md:hidden">
+          <div className="flex items-center gap-2 border-b border-[var(--border-subtle)] p-3">
+            <button
+              type="button"
+              onClick={() => setSelectedPath(null)}
+              className="rounded-[var(--radius-md)] px-2.5 py-1.5 text-xs font-medium text-[var(--text-secondary)] hover:bg-[var(--surface-muted)]"
+            >
+              ← Back
+            </button>
+            <span className="truncate text-xs text-[var(--text-tertiary)]">{selected.title}</span>
+          </div>
+          <article className="docs-article flex-1 overflow-y-auto px-5 py-4">
+            <div dangerouslySetInnerHTML={{ __html: selectedHtml }} />
+          </article>
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+function DocListItem({
+  doc,
+  active,
+  onSelect,
+  showSection = false,
+}: {
+  doc: DocEntry;
+  active: boolean;
+  onSelect: (path: string) => void;
+  showSection?: boolean;
+}) {
+  return (
+    <button
+      type="button"
+      onClick={() => onSelect(doc.path)}
+      className={`mb-0.5 w-full rounded-[var(--radius-md)] px-2.5 py-2 text-left transition-colors ${
+        active
+          ? 'bg-[var(--accent-primary-soft)] text-[var(--accent-primary)]'
+          : 'text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)]'
+      }`}
+    >
+      <span className="flex items-center gap-2">
+        <FileText size={13} className="shrink-0 opacity-60" />
+        <span className="truncate text-[13px] font-medium">{doc.title}</span>
+      </span>
+      <span className="mt-0.5 block truncate pl-5 text-[11px] text-[var(--text-tertiary)]">
+        {showSection ? `${doc.section} · ` : ''}{excerpt(doc.markdown, 80)}
+      </span>
+    </button>
+  );
+}

app/frontend/src/features/docs/docs-store.ts

@@ -0,0 +1,121 @@
+import { bundledDocs, type BundledDoc } from '@/generated/docs-snapshot';
+
+export type DocEntry = BundledDoc;
+
+export type DocsState = {
+  docs: DocEntry[];
+  source: 'bundled' | 'cache' | 'github';
+  syncedAt: string | null;
+};
+
+const CACHE_KEY = 'containr.docs.v1';
+const REPO = 'Dvorinka/Containr';
+const BRANCH = 'main';
+const SKIP_DIRS = new Set(['archive', 'design', 'superpowers']);
+
+type CachePayload = { syncedAt: string; docs: DocEntry[] };
+
+function readCache(): CachePayload | null {
+  try {
+    const raw = localStorage.getItem(CACHE_KEY);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw) as CachePayload;
+    if (!Array.isArray(parsed.docs) || typeof parsed.syncedAt !== 'string') return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function writeCache(payload: CachePayload) {
+  try {
+    localStorage.setItem(CACHE_KEY, JSON.stringify(payload));
+  } catch {
+    // Storage full or unavailable — bundled docs still cover us.
+  }
+}
+
+function titleOf(markdown: string, fallback: string): string {
+  const match = markdown.match(/^#\s+(.+)$/m);
+  if (match) return match[1].replace(/[#*`]/g, '').trim();
+  return fallback
+    .replace(/\.md$/i, '')
+    .replace(/[-_]+/g, ' ')
+    .replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+type GitHubTreeEntry = { path?: string; type?: string };
+
+async function fetchGitHubDocs(signal: AbortSignal): Promise<DocEntry[]> {
+  const treeRes = await fetch(
+    `https://api.github.com/repos/${REPO}/git/trees/${BRANCH}?recursive=1`,
+    { signal, headers: { Accept: 'application/vnd.github+json' } },
+  );
+  if (!treeRes.ok) throw new Error(`tree fetch failed: ${treeRes.status}`);
+  const tree = (await treeRes.json()) as { tree?: GitHubTreeEntry[]; truncated?: boolean };
+
+  const paths = (tree.tree ?? [])
+    .filter(
+      (e) =>
+        e.type === 'blob' &&
+        typeof e.path === 'string' &&
+        e.path.startsWith('docs/') &&
+        e.path.toLowerCase().endsWith('.md') &&
+        !e.path.split('/').some((seg, i) => i > 0 && SKIP_DIRS.has(seg)),
+    )
+    .map((e) => e.path as string);
+
+  const docs = await Promise.all(
+    paths.map(async (path) => {
+      const res = await fetch(
+        `https://raw.githubusercontent.com/${REPO}/${BRANCH}/${path}`,
+        { signal },
+      );
+      if (!res.ok) throw new Error(`doc fetch failed: ${path}`);
+      const markdown = await res.text();
+      const rel = path.slice('docs/'.length);
+      return {
+        path: rel,
+        section: rel.includes('/') ? rel.split('/')[0] : 'docs',
+        title: titleOf(markdown, rel.split('/').pop() ?? rel),
+        markdown,
+      };
+    }),
+  );
+  return docs;
+}
+
+/**
+ * Synchronous initial state — cache wins over the bundled snapshot so a
+ * previously synced copy survives offline reloads.
+ */
+export function initialDocs(): DocsState {
+  const cached = readCache();
+  return cached
+    ? { docs: cached.docs, source: 'cache', syncedAt: cached.syncedAt }
+    : { docs: bundledDocs, source: 'bundled', syncedAt: null };
+}
+
+/**
+ * Background GitHub sync. `onUpdate` fires when fresh content lands so the
+ * UI can re-render without a reload; failures keep the current copy.
+ */
+export function syncDocs(onUpdate: (state: DocsState) => void): void {
+  if (typeof navigator !== 'undefined' && !navigator.onLine) {
+    return;
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 15_000);
+
+  fetchGitHubDocs(controller.signal)
+    .then((docs) => {
+      const syncedAt = new Date().toISOString();
+      writeCache({ syncedAt, docs });
+      onUpdate({ docs, source: 'github', syncedAt });
+    })
+    .catch(() => {
+      // Offline or rate-limited — bundled/cache copy already displayed.
+    })
+    .finally(() => clearTimeout(timeout));
+}

app/frontend/src/features/landing/LandingPage.tsx

@@ -0,0 +1,232 @@
+import { Link } from 'react-router-dom';
+import { useQuery } from '@tanstack/react-query';
+import {
+  ArrowRight,
+  BookOpen,
+  Container,
+  Database,
+  GitBranch,
+  LayoutTemplate,
+  Rocket,
+  ShieldCheck,
+  Zap,
+} from 'lucide-react';
+import { listProjects, listTemplates } from '@/lib/api-client';
+import { DocsBrowser } from '@/features/docs/DocsBrowser';
+import { useAuthSession } from '@/lib/use-auth-session';
+
+const features = [
+  { icon: Rocket, title: 'Git-push deploys', text: 'Connect a repository and ship. Builds, rollouts, and rollbacks are handled for you.' },
+  { icon: Database, title: 'Managed databases', text: 'Provision PostgreSQL, MySQL, Redis and more — with backups and connection management.' },
+  { icon: ShieldCheck, title: 'High availability', text: 'Failover policies, health checks, and alerting keep services alive across nodes.' },
+  { icon: GitBranch, title: 'Preview environments', text: 'Every branch gets an isolated environment with its own URL.' },
+  { icon: LayoutTemplate, title: 'Template catalog', text: 'One-click deploys for popular self-hosted apps and community templates.' },
+  { icon: Zap, title: 'Autoscaling', text: 'Metric-driven scaling policies adapt replicas to real load.' },
+];
+
+export function LandingPage() {
+  const sessionQuery = useAuthSession();
+  const signedIn = Boolean(sessionQuery.data);
+
+  const projectsQuery = useQuery({ queryKey: ['landing-projects'], queryFn: listProjects, staleTime: 60_000 });
+  const templatesQuery = useQuery({ queryKey: ['landing-templates'], queryFn: () => listTemplates(), staleTime: 60_000 });
+
+  const projects = projectsQuery.data ?? [];
+  const templates = (templatesQuery.data ?? []).slice(0, 12);
+
+  return (
+    <div className="min-h-screen bg-[var(--bg-void)] text-[var(--text-secondary)]">
+      <div className="ambient-glow" />
+
+      <header className="sticky top-0 z-40 border-b border-[var(--border-subtle)] bg-[var(--bg-base)]/80 backdrop-blur-xl">
+        <div className="mx-auto flex h-14 max-w-6xl items-center justify-between px-5">
+          <Link to="/" className="flex items-center gap-2.5">
+            <img src="/containr.svg" alt="Containr" className="h-7 w-7 rounded-lg" />
+            <span className="text-[15px] font-extrabold tracking-tight text-[var(--text-primary)]">
+              contain<span style={{ color: 'var(--accent-primary)' }}>r</span>
+            </span>
+          </Link>
+          <nav className="flex items-center gap-1 text-[13px]">
+            <a href="#features" className="rounded-[var(--radius-md)] px-3 py-1.5 text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)] max-sm:hidden">Features</a>
+            <a href="#templates" className="rounded-[var(--radius-md)] px-3 py-1.5 text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)] max-sm:hidden">Templates</a>
+            <a href="#docs" className="rounded-[var(--radius-md)] px-3 py-1.5 text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)] max-sm:hidden">Docs</a>
+            <Link
+              to="/projects"
+              className="rounded-[var(--radius-md)] px-3 py-1.5 font-medium text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)]"
+            >
+              Browse
+            </Link>
+            {signedIn ? (
+              <Link
+                to="/projects"
+                className="ml-1 inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-3.5 py-1.5 font-semibold text-[var(--accent-on)]"
+              >
+                Console <ArrowRight size={13} />
+              </Link>
+            ) : (
+              <Link
+                to="/auth/sign-in"
+                className="ml-1 inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-3.5 py-1.5 font-semibold text-[var(--accent-on)]"
+              >
+                Sign in <ArrowRight size={13} />
+              </Link>
+            )}
+          </nav>
+        </div>
+      </header>
+
+      <main className="relative">
+        <section className="mx-auto max-w-6xl px-5 pb-16 pt-20 text-center">
+          <p className="mx-auto mb-5 inline-flex items-center gap-2 rounded-full border border-[var(--border-subtle)] bg-[var(--surface-card)] px-3.5 py-1 text-[11px] font-medium uppercase tracking-[0.16em] text-[var(--text-tertiary)]">
+            <Container size={12} className="text-[var(--accent-primary)]" />
+            self-hosted PaaS
+          </p>
+          <h1 className="mx-auto max-w-3xl text-[42px] font-extrabold leading-[1.08] tracking-[-0.03em] text-[var(--text-primary)] max-sm:text-[32px]">
+            Deploy containers like it's{' '}
+            <span style={{ color: 'var(--accent-primary)' }}>your own cloud</span>
+          </h1>
+          <p className="mx-auto mt-5 max-w-xl text-[15px] leading-relaxed text-[var(--text-secondary)]">
+            Containr turns any Docker host into a full deployment platform — git-push builds,
+            managed databases, preview environments, HA failover, and a searchable knowledge base.
+          </p>
+          <div className="mt-8 flex items-center justify-center gap-3">
+            <Link
+              to="/projects"
+              className="inline-flex items-center gap-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-5 py-2.5 text-sm font-semibold text-[var(--accent-on)] transition-transform hover:scale-[1.02]"
+            >
+              Browse projects <ArrowRight size={15} />
+            </Link>
+            <a
+              href="#docs"
+              className="inline-flex items-center gap-2 rounded-[var(--radius-md)] border border-[var(--border-default)] px-5 py-2.5 text-sm font-medium text-[var(--text-secondary)] hover:border-[var(--border-strong)] hover:text-[var(--text-primary)]"
+            >
+              <BookOpen size={15} /> Read the docs
+            </a>
+          </div>
+
+          {projects.length > 0 ? (
+            <div className="mx-auto mt-12 grid max-w-3xl grid-cols-3 gap-3 text-left max-sm:grid-cols-1">
+              <Stat label="Public projects" value={projects.length} />
+              <Stat
+                label="Running services"
+                value={projects.reduce((sum, p) => sum + (p.stats?.running_services ?? 0), 0)}
+              />
+              <Stat
+                label="Deployments"
+                value={projects.reduce((sum, p) => sum + (p.stats?.deployment_count ?? 0), 0)}
+              />
+            </div>
+          ) : null}
+        </section>
+
+        <section id="features" className="border-t border-[var(--border-subtle)] bg-[var(--bg-base)]/60">
+          <div className="mx-auto max-w-6xl px-5 py-16">
+            <h2 className="text-center text-[26px] font-bold tracking-tight text-[var(--text-primary)]">
+              Everything a deployment platform needs
+            </h2>
+            <p className="mx-auto mt-2 max-w-lg text-center text-sm text-[var(--text-secondary)]">
+              One install, one dashboard, full control over your own infrastructure.
+            </p>
+            <div className="mt-10 grid grid-cols-3 gap-4 max-md:grid-cols-2 max-sm:grid-cols-1">
+              {features.map((feature) => (
+                <div
+                  key={feature.title}
+                  className="rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)] p-5 transition-colors hover:border-[var(--border-default)]"
+                >
+                  <feature.icon size={18} className="text-[var(--accent-primary)]" />
+                  <h3 className="mt-3 text-[14.5px] font-semibold text-[var(--text-primary)]">{feature.title}</h3>
+                  <p className="mt-1.5 text-[12.5px] leading-relaxed text-[var(--text-tertiary)]">{feature.text}</p>
+                </div>
+              ))}
+            </div>
+          </div>
+        </section>
+
+        <section id="templates" className="border-t border-[var(--border-subtle)]">
+          <div className="mx-auto max-w-6xl px-5 py-16">
+            <div className="flex items-end justify-between">
+              <div>
+                <h2 className="text-[26px] font-bold tracking-tight text-[var(--text-primary)]">Template catalog</h2>
+                <p className="mt-1 text-sm text-[var(--text-secondary)]">
+                  Production-ready presets — deploy in one click from the console.
+                </p>
+              </div>
+              <Link
+                to="/templates"
+                className="inline-flex items-center gap-1.5 text-[13px] font-medium text-[var(--accent-primary)] hover:underline"
+              >
+                Browse all <ArrowRight size={13} />
+              </Link>
+            </div>
+            <div className="mt-8 grid grid-cols-4 gap-3 max-lg:grid-cols-3 max-sm:grid-cols-2">
+              {templates.map((template) => (
+                <Link
+                  key={template.id}
+                  to="/templates"
+                  className="group rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)] p-4 transition-colors hover:border-[var(--border-strong)]"
+                >
+                  <div className="flex items-center gap-2.5">
+                    {template.logo ? (
+                      <img src={template.logo} alt="" className="h-7 w-7 rounded-md" />
+                    ) : (
+                      <span className="flex h-7 w-7 items-center justify-center rounded-md bg-[var(--surface-muted)] text-[var(--accent-primary)]">
+                        <LayoutTemplate size={14} />
+                      </span>
+                    )}
+                    <span className="truncate text-[13px] font-semibold text-[var(--text-primary)]">{template.name}</span>
+                  </div>
+                  <p className="mt-2 line-clamp-2 text-[11.5px] leading-relaxed text-[var(--text-tertiary)]">
+                    {template.description}
+                  </p>
+                  <span className="mt-2 inline-block rounded-full bg-[var(--surface-muted)] px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide text-[var(--text-tertiary)]">
+                    {template.category || 'app'}
+                  </span>
+                </Link>
+              ))}
+              {templates.length === 0 && !templatesQuery.isPending ? (
+                <p className="col-span-full py-8 text-center text-sm text-[var(--text-tertiary)]">
+                  Template catalog is empty — sign in to add your own.
+                </p>
+              ) : null}
+            </div>
+          </div>
+        </section>
+
+        <section id="docs" className="border-t border-[var(--border-subtle)] bg-[var(--bg-base)]/60">
+          <div className="mx-auto max-w-6xl px-5 py-16">
+            <h2 className="text-[26px] font-bold tracking-tight text-[var(--text-primary)]">Documentation</h2>
+            <p className="mt-1 text-sm text-[var(--text-secondary)]">
+              Guides and references — synced from GitHub, cached locally, always available.
+            </p>
+            <div className="mt-8">
+              <DocsBrowser />
+            </div>
+          </div>
+        </section>
+      </main>
+
+      <footer className="border-t border-[var(--border-subtle)]">
+        <div className="mx-auto flex max-w-6xl items-center justify-between px-5 py-6 text-[12px] text-[var(--text-tertiary)]">
+          <span className="flex items-center gap-2">
+            <img src="/containr.svg" alt="" className="h-4 w-4 rounded" />
+            Containr — self-hosted container platform
+          </span>
+          <div className="flex items-center gap-4">
+            <Link to="/projects" className="hover:text-[var(--text-secondary)]">Projects</Link>
+            <Link to="/templates" className="hover:text-[var(--text-secondary)]">Templates</Link>
+            <Link to="/admin" className="hover:text-[var(--text-secondary)]">Admin</Link>
+          </div>
+        </div>
+      </footer>
+    </div>
+  );
+}
+
+function Stat({ label, value }: { label: string; value: number }) {
+  return (
+    <div className="rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--surface-card)] px-4 py-3.5">
+      <p className="text-[22px] font-bold tabular-nums text-[var(--text-primary)]">{value}</p>
+      <p className="mt-0.5 text-[11px] uppercase tracking-wider text-[var(--text-tertiary)]">{label}</p>
+    </div>
+  );
+}

app/frontend/src/features/projects/pages/ProjectsPage.tsx

@@ -14,12 +14,14 @@ import {
   FolderOpen,
   X,
 } from 'lucide-react';
+import { useAuthSession } from '@/lib/use-auth-session';
 
 const demoProjects: ProjectEntity[] = [
   {
     id: 'project-demo',
     name: 'core-services',
     description: 'Sample project with mock services for UI preview.',
+    isApproved: true,
     createdAt: new Date(Date.now() - 14 * 86_400_000).toISOString(),
     updatedAt: new Date().toISOString(),
     stats: { service_count: 5, deployment_count: 12, running_services: 5, last_deployment: null },
@@ -28,6 +30,7 @@ const demoProjects: ProjectEntity[] = [
     id: 'project-staging',
     name: 'ml-pipeline',
     description: 'Pre-production environment for testing new releases.',
+    isApproved: true,
     createdAt: new Date(Date.now() - 7 * 86_400_000).toISOString(),
     updatedAt: new Date(Date.now() - 2 * 86_400_000).toISOString(),
     stats: { service_count: 2, deployment_count: 5, running_services: 1, last_deployment: null },
@@ -141,6 +144,15 @@ export function ProjectsPage() {
   const [search, setSearch] = useState('');
   const [isCreateOpen, setCreateOpen] = useState(false);
   const [form, setForm] = useState({ name: '', description: '' });
+  const sessionQuery = useAuthSession({ enabled: !isDemoMode });
+  const signedIn = isDemoMode || Boolean(sessionQuery.data);
+  const openCreate = () => {
+    if (!signedIn) {
+      navigate('/auth/sign-in');
+      return;
+    }
+    setCreateOpen(true);
+  };
 
   const projectHref = (projectId: string) =>
     isDemoMode ? `/projects/${projectId}?demo=1` : `/projects/${projectId}`;
@@ -238,7 +250,7 @@ export function ProjectsPage() {
                 style={{ fontSize: 11.5 }}
               />
             </div>
-            <button onClick={() => setCreateOpen(true)} className="v-btn">
+            <button onClick={openCreate} className="v-btn">
               + new project
             </button>
           </div>
@@ -310,10 +322,12 @@ export function ProjectsPage() {
             </div>
             <p className="text-xl font-semibold text-[var(--text-primary)]">No projects yet</p>
             <p className="mx-auto mt-2 max-w-md text-[var(--text-secondary)]">
-              Create your first project to start deploying services with visual topology management.
+              {signedIn
+                ? 'Create your first project to start deploying services with visual topology management.'
+                : 'No public projects yet. Sign in to create one — an admin approves it before it goes public.'}
             </p>
-            <button onClick={() => setCreateOpen(true)} className="v-btn mt-6">
-              + create project
+            <button onClick={openCreate} className="v-btn mt-6">
+              {signedIn ? '+ create project' : 'sign in to create'}
             </button>
           </div>
         ) : null}
@@ -357,6 +371,9 @@ export function ProjectsPage() {
             <p className="mt-1 text-sm text-[var(--text-secondary)]">
               Projects organize your services and provide a visual canvas for topology management.
             </p>
+            <p className="mt-2 rounded-[var(--radius-md)] bg-[var(--warning-soft)] px-3 py-2 text-xs text-[var(--warning)]">
+              New projects stay private until a platform admin approves them for public listing.
+            </p>
 
             <div className="mt-6 space-y-4">
               <div>

app/frontend/src/features/secondary/pages.tsx

@@ -14,7 +14,6 @@ import {
   listBuilds,
   listGitProviders,
   listProjects,
-  listTemplates,
   createAgentToken,
   listAgentTokens,
   revokeAgentToken,
@@ -23,6 +22,7 @@ import {
   updateDatabaseBackupSchedule,
   createDatabaseBackup,
   restoreDatabaseBackup,
+  createManagedDatabase,
   listServicesByProject,
   listServiceVariables,
   updateServiceVariables,
@@ -46,10 +46,13 @@ import {
   updateVulnerability,
   getSecurityMetrics,
   type AgentAuthTokenCreated,
+  type CreateDatabaseInput,
   type DatabaseEntity,
   type FailoverPolicy,
 } from '@/lib/api-client';
 import { demoDatabases } from '@/lib/demo-data';
+import { DocsBrowser } from '@/features/docs/DocsBrowser';
+import { useAuthSession } from '@/lib/use-auth-session';
 import { formatRelative } from '@/lib/time';
 import { getAuthBaseUrl, signOutAuthSession } from '@/lib/auth-client';
 import { useBuildUpdates } from '@/lib/use-build-updates';
@@ -72,9 +75,6 @@ import {
   Check,
   AlertCircle,
   Loader2,
-  BookOpen,
-  Folder,
-  Box,
   Terminal,
   Radio,
   Server,
@@ -149,13 +149,19 @@ type LocalStorageSummary = {
 };
 
 function getLocalStorageSummary(): LocalStorageSummary {
-  if (typeof window === 'undefined') {
+  let storage: Storage | null = null;
+  try {
+    storage = typeof window === 'undefined' ? null : window.localStorage;
+  } catch {
+    storage = null;
+  }
+  if (!storage) {
     return { canvasKeys: [], totalKeys: 0 };
   }
 
   const canvasKeys: string[] = [];
-  for (let index = 0; index < localStorage.length; index += 1) {
-    const key = localStorage.key(index);
+  for (let index = 0; index < storage.length; index += 1) {
+    const key = storage.key(index);
     if (key && key.startsWith('containr.canvas.v1.')) {
       canvasKeys.push(key);
     }
@@ -165,23 +171,10 @@ function getLocalStorageSummary(): LocalStorageSummary {
 
   return {
     canvasKeys,
-    totalKeys: localStorage.length,
+    totalKeys: storage.length,
   };
 }
 
-function endpointStateBadge(isLoading: boolean, isError: boolean): {
-  label: string;
-  toneClass: string;
-} {
-  if (isLoading) {
-    return { label: 'Loading', toneClass: 'text-[var(--warn)]' };
-  }
-  if (isError) {
-    return { label: 'Unavailable', toneClass: 'text-[var(--bad)]' };
-  }
-  return { label: 'Available', toneClass: 'text-[var(--ok)]' };
-}
-
 function formatBytes(value: number): string {
   if (!Number.isFinite(value) || value <= 0) {
     return '0 B';
@@ -210,9 +203,20 @@ function formatUptime(seconds: number): string {
 
 export function UsagePage() {
   const queryClient = useQueryClient();
+  const sessionQuery = useAuthSession();
+  const profileQuery = useQuery({
+    queryKey: ['user-profile'],
+    queryFn: getCurrentUserProfile,
+    enabled: Boolean(sessionQuery.data),
+    retry: false,
+  });
+  const signedIn = Boolean(sessionQuery.data);
+  const isAdmin = Boolean(profileQuery.data?.isAdmin);
   const buildsQuery = useQuery({
     queryKey: ['usage-builds'],
     queryFn: () => listBuilds({ page: 1, limit: 100 }),
+    enabled: signedIn,
+    retry: false,
   });
   const hostQuery = useQuery({
     queryKey: ['usage-host-monitoring'],
@@ -223,10 +227,14 @@ export function UsagePage() {
     queryKey: ['usage-agents'],
     queryFn: listAgents,
     refetchInterval: 15_000,
+    enabled: isAdmin,
+    retry: false,
   });
   const agentTokensQuery = useQuery({
     queryKey: ['agent-tokens'],
     queryFn: listAgentTokens,
+    enabled: isAdmin,
+    retry: false,
   });
   const [tokenLabel, setTokenLabel] = useState('');
   const [issuedToken, setIssuedToken] = useState<AgentAuthTokenCreated | null>(null);
@@ -386,6 +394,10 @@ containr-agent`;
             </div>
             <p className="text-sm text-[var(--error)]">Failed to load usage data</p>
           </div>
+        ) : !signedIn ? (
+          <div className="panel p-8 text-center">
+            <p className="text-sm text-[var(--text-secondary)]">Sign in to view build activity and capacity.</p>
+          </div>
         ) : (
           <div className="space-y-6">
             <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
@@ -456,7 +468,7 @@ containr-agent`;
                     status={hostStatus(hostLoadPercent)}
                     statusText={host ? { good: 'Good', average: 'Average', warning: 'High' }[hostStatus(hostLoadPercent)] : ''}
                     subtitle={host ? `${host.cpu.cores} cores · 5m ${host.load.load5m.toFixed(2)} · 15m ${host.load.load15m.toFixed(2)}` : 'Loading CPU telemetry.'}
-                    chart={<LineAreaChart data={loadHistory.length > 0 ? loadHistory : [0]} color="#b4e34a" height={72} />}
+                    chart={<LineAreaChart data={loadHistory.length > 0 ? loadHistory : [0]} color="var(--accent-primary)" height={72} />}
                   />
                   <EnhancedMetricCard
                     title="Memory"
@@ -467,10 +479,10 @@ containr-agent`;
                     subtitle={host ? `${formatBytes(host.memory.available)} free` : 'Loading memory telemetry.'}
                     chart={
                       <div className="relative mx-auto" style={{ width: 150 }}>
-                        <DonutChart percentage={host?.memory.usagePercent ?? 0} color="#f2c94c" size={150} thickness={14} />
+                        <DonutChart percentage={host?.memory.usagePercent ?? 0} color="var(--warning)" size={150} thickness={14} />
                         <div className="absolute inset-x-0 bottom-0 text-center">
-                          <div className="text-[10px] uppercase tracking-wide text-[#6b6e7d]">Used</div>
-                          <div className="text-sm font-bold text-[#e8e9f0]">
+                          <div className="text-[10px] uppercase tracking-wide text-[var(--text-tertiary)]">Used</div>
+                          <div className="text-sm font-bold text-[var(--text-primary)]">
                             {host ? `${formatBytes(host.memory.used)} / ${formatBytes(host.memory.total)}` : '—'}
                           </div>
                         </div>
@@ -488,14 +500,14 @@ containr-agent`;
                       <div>
                         <SegmentedBar
                           segments={[
-                            { width: host?.storage.usagePercent ?? 0, color: '#ff8a5c' },
-                            { width: Math.max(2, 100 - (host?.storage.usagePercent ?? 0)), color: 'rgba(255,255,255,0.07)' },
+                            { width: host?.storage.usagePercent ?? 0, color: 'var(--info)' },
+                            { width: Math.max(2, 100 - (host?.storage.usagePercent ?? 0)), color: 'var(--surface-muted)' },
                           ]}
                           height={18}
                         />
-                        <div className="mt-3 flex items-center gap-4 text-xs text-[#6b6e7d]">
-                          <span><span className="mr-1.5 inline-block h-2 w-2 rounded-full" style={{ background: '#ff8a5c' }} />{host ? `${formatBytes(host.storage.used)} used` : '—'}</span>
-                          <span><span className="mr-1.5 inline-block h-2 w-2 rounded-full bg-white/10" />{host ? `${formatBytes(host.storage.available)} free` : '—'}</span>
+                        <div className="mt-3 flex items-center gap-4 text-xs text-[var(--text-tertiary)]">
+                          <span><span className="mr-1.5 inline-block h-2 w-2 rounded-full" style={{ background: 'var(--info)' }} />{host ? `${formatBytes(host.storage.used)} used` : '—'}</span>
+                          <span><span className="mr-1.5 inline-block h-2 w-2 rounded-full" style={{ background: 'var(--surface-muted)' }} />{host ? `${formatBytes(host.storage.available)} free` : '—'}</span>
                         </div>
                       </div>
                     }
@@ -569,6 +581,8 @@ containr-agent`;
                     <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Connect Node</span>
                   </div>
 
+                  {isAdmin ? (
+                  <>
                   <div className="mb-3 flex gap-2">
                     <input
                       value={tokenLabel}
@@ -640,6 +654,12 @@ containr-agent`;
                       </div>
                     </div>
                   )}
+                  </>
+                  ) : (
+                    <p className="text-xs text-[var(--text-tertiary)]">
+                      Node registration and token issuance are admin operations. {signedIn ? 'Your account does not have admin rights.' : 'Sign in as an admin to manage nodes.'}
+                    </p>
+                  )}
                 </div>
               </div>
             </section>
@@ -1266,8 +1286,12 @@ export function SettingsPage() {
   };
 
   const clearCanvasCache = () => {
-    for (const key of storageSummary.canvasKeys) {
-      localStorage.removeItem(key);
+    try {
+      for (const key of storageSummary.canvasKeys) {
+        window.localStorage.removeItem(key);
+      }
+    } catch {
+      // Storage unavailable — nothing to clear.
     }
     refreshStorage();
   };
@@ -1509,161 +1533,14 @@ export function SettingsPage() {
 }
 
 export function DocsPage() {
-  const profileQuery = useQuery({
-    queryKey: ['docs-profile'],
-    queryFn: getCurrentUserProfile,
-  });
-  const projectsQuery = useQuery({
-    queryKey: ['docs-projects'],
-    queryFn: listProjects,
-  });
-  const templatesQuery = useQuery({
-    queryKey: ['docs-templates'],
-    queryFn: () => listTemplates(),
-  });
-  const buildsQuery = useQuery({
-    queryKey: ['docs-builds'],
-    queryFn: () => listBuilds({ page: 1, limit: 1 }),
-  });
-
-  const profileStatus = endpointStateBadge(profileQuery.isLoading, profileQuery.isError);
-  const projectStatus = endpointStateBadge(projectsQuery.isLoading, projectsQuery.isError);
-  const templateStatus = endpointStateBadge(templatesQuery.isLoading, templatesQuery.isError);
-  const buildStatus = endpointStateBadge(buildsQuery.isLoading, buildsQuery.isError);
-
   return (
     <div className="min-h-screen">
       <SecondaryPageHeader
         title="Docs"
-        description="Operational references and API documentation"
+        description="Guides and references — synced from GitHub, cached offline"
       />
       <div className="w-full px-8 py-6">
-        {/* API Status Grid */}
-        <div className="grid grid-cols-2 lg:grid-cols-4 gap-4 mb-6">
-          <div className="panel p-4">
-            <div className="flex items-center gap-2 mb-2">
-              <User size={14} className={profileStatus.toneClass} />
-              <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Profile</span>
-            </div>
-            <p className={`text-sm font-semibold ${profileStatus.toneClass}`}>{profileStatus.label}</p>
-            <p className="text-xs text-[var(--text-tertiary)] mt-1">
-              {profileQuery.data ? `${profileQuery.data.name} authenticated` : 'GET /user/profile'}
-            </p>
-          </div>
-          <div className="panel p-4">
-            <div className="flex items-center gap-2 mb-2">
-              <Folder size={14} className={projectStatus.toneClass} />
-              <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Projects</span>
-            </div>
-            <p className={`text-sm font-semibold ${projectStatus.toneClass}`}>{projectStatus.label}</p>
-            <p className="text-xs text-[var(--text-tertiary)] mt-1">
-              {projectsQuery.data ? `${projectsQuery.data.length} projects` : 'GET /projects'}
-            </p>
-          </div>
-          <div className="panel p-4">
-            <div className="flex items-center gap-2 mb-2">
-              <Box size={14} className={templateStatus.toneClass} />
-              <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Templates</span>
-            </div>
-            <p className={`text-sm font-semibold ${templateStatus.toneClass}`}>{templateStatus.label}</p>
-            <p className="text-xs text-[var(--text-tertiary)] mt-1">
-              {templatesQuery.data ? `${templatesQuery.data.length} templates` : 'GET /templates'}
-            </p>
-          </div>
-          <div className="panel p-4">
-            <div className="flex items-center gap-2 mb-2">
-              <Activity size={14} className={buildStatus.toneClass} />
-              <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Builds</span>
-            </div>
-            <p className={`text-sm font-semibold ${buildStatus.toneClass}`}>{buildStatus.label}</p>
-            <p className="text-xs text-[var(--text-tertiary)] mt-1">
-              {buildsQuery.data ? `${buildsQuery.data.total} builds` : 'GET /builds'}
-            </p>
-          </div>
-        </div>
-
-        <div className="grid grid-cols-1 xl:grid-cols-2 gap-6">
-          {/* Repository Paths */}
-          <section className="panel p-6">
-            <div className="flex items-center gap-3 mb-4">
-              <div className="w-10 h-10 rounded-[var(--radius-md)] bg-[var(--accent-primary-soft)] flex items-center justify-center">
-                <BookOpen size={18} className="text-[var(--accent-primary)]" />
-              </div>
-              <div>
-                <h2 className="text-lg font-semibold text-[var(--text-primary)]">Repository Paths</h2>
-                <p className="text-xs text-[var(--text-tertiary)]">Source files and documentation</p>
-              </div>
-            </div>
-
-            <div className="space-y-3">
-              <div className="p-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)]">
-                <div className="flex items-center gap-2 mb-1">
-                  <FileText size={14} className="text-[var(--text-tertiary)]" />
-                  <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">API Contract</span>
-                </div>
-                <p className="mono text-xs text-[var(--text-primary)]">docs/api/openapi.yaml</p>
-              </div>
-              <div className="p-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)]">
-                <div className="flex items-center gap-2 mb-1">
-                  <FileText size={14} className="text-[var(--text-tertiary)]" />
-                  <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Generated Types</span>
-                </div>
-                <p className="mono text-xs text-[var(--text-primary)]">app/frontend/src/generated/api-types.ts</p>
-              </div>
-              <div className="p-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)]">
-                <div className="flex items-center gap-2 mb-1">
-                  <BookOpen size={14} className="text-[var(--text-tertiary)]" />
-                  <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Primary Guides</span>
-                </div>
-                <p className="mono text-xs text-[var(--text-primary)]">README.md • DOCKER_SETUP.md • docs/guides/</p>
-              </div>
-              <div className="p-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)]">
-                <div className="flex items-center gap-2 mb-1">
-                  <FileText size={14} className="text-[var(--text-tertiary)]" />
-                  <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">UI References</span>
-                </div>
-                <p className="mono text-xs text-[var(--text-primary)]">docs/references/dashboard.png • projects.png</p>
-              </div>
-            </div>
-          </section>
-
-          {/* Common Commands */}
-          <section className="panel p-6">
-            <div className="flex items-center gap-3 mb-4">
-              <div className="w-10 h-10 rounded-[var(--radius-md)] bg-[var(--surface-muted)] flex items-center justify-center">
-                <Terminal size={18} className="text-[var(--text-tertiary)]" />
-              </div>
-              <div>
-                <h2 className="text-lg font-semibold text-[var(--text-primary)]">Common Commands</h2>
-                <p className="text-xs text-[var(--text-tertiary)]">Development and build scripts</p>
-              </div>
-            </div>
-
-            <div className="p-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-void)]">
-              <pre className="mono text-xs text-[var(--text-secondary)] whitespace-pre-wrap">
-{`# Regenerate frontend API types
-npm --prefix app/frontend run generate:api
-
-# Frontend type-check + build
-npm --prefix app/frontend run build:check
-
-# Backend API tests
-cd app/backend && go test ./internal/api/...
-
-# Build remote node agent
-cd app/backend && go build -o bin/containr-agent ./cmd/agent`}
-              </pre>
-            </div>
-
-            <div className="mt-4 p-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)]">
-              <div className="flex items-center gap-2 mb-1">
-                <Radio size={14} className="text-[var(--text-tertiary)]" />
-                <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Active API Base</span>
-              </div>
-              <p className="mono text-xs text-[var(--text-primary)] break-all">{getApiBaseUrl()}</p>
-            </div>
-          </section>
-        </div>
+        <DocsBrowser />
       </div>
     </div>
   );
@@ -1679,12 +1556,20 @@ const dbStatusClass: Record<string, string> = {
   error: 'bg-[var(--error-soft)] text-[var(--error)]',
 };
 
+const DATABASE_TYPES = ['postgresql', 'mysql', 'mariadb', 'mongodb', 'redis', 'dragonfly', 'clickhouse'] as const;
+const DATABASE_PLANS = ['hobby', 'starter', 'standard', 'business'] as const;
+
 export function DatabasesPage() {
   const queryClient = useQueryClient();
   const [searchParams] = useSearchParams();
   const isDemoMode = searchParams.get('demo') === '1';
+  const sessionQuery = useAuthSession({ enabled: !isDemoMode });
+  const signedIn = isDemoMode || Boolean(sessionQuery.data);
   const [expandedId, setExpandedId] = useState<string | null>(null);
   const [bindDb, setBindDb] = useState<DatabaseEntity | null>(null);
+  const [createOpen, setCreateOpen] = useState(false);
+  const [createForm, setCreateForm] = useState({ name: '', type: 'postgresql', plan: 'hobby', region: 'local' });
+  const [createError, setCreateError] = useState<string | null>(null);
   const databasesQuery = useQuery({
     queryKey: ['databases'],
     queryFn: listDatabases,
@@ -1693,6 +1578,24 @@ export function DatabasesPage() {
   });
 
   const invalidate = () => queryClient.invalidateQueries({ queryKey: ['databases'] });
+  const createMutation = useMutation({
+    mutationFn: () =>
+      createManagedDatabase({
+        name: createForm.name.trim(),
+        type: createForm.type as CreateDatabaseInput['type'],
+        plan: createForm.plan as CreateDatabaseInput['plan'],
+        region: createForm.region.trim() || 'local',
+      }),
+    onSuccess: () => {
+      setCreateOpen(false);
+      setCreateForm({ name: '', type: 'postgresql', plan: 'hobby', region: 'local' });
+      setCreateError(null);
+      invalidate();
+    },
+    onError: (error) => {
+      setCreateError(error instanceof Error ? error.message : 'Failed to create database');
+    },
+  });
   const actionMutation = useMutation({
     mutationFn: ({ id, action }: { id: string; action: 'start' | 'stop' | 'restart' }) =>
       databaseAction(id, action),
@@ -1717,6 +1620,20 @@ export function DatabasesPage() {
         description="Managed database services — connection info, runtime actions and backups"
       />
       <div className="w-full px-8 py-6">
+        <div className="mb-5 flex items-center justify-between">
+          <p className="text-xs text-[var(--text-tertiary)]">
+            {databases.length} {databases.length === 1 ? 'database' : 'databases'}
+          </p>
+          {signedIn && !isDemoMode ? (
+            <button
+              type="button"
+              onClick={() => setCreateOpen(true)}
+              className="inline-flex h-9 items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 text-[12.5px] font-semibold text-[var(--accent-on)]"
+            >
+              <Database size={13} /> New database
+            </button>
+          ) : null}
+        </div>
         {databasesQuery.isLoading ? (
           <div className="flex items-center justify-center py-16 text-[var(--text-muted)]">
             <Loader2 size={20} className="animate-spin" />
@@ -1725,9 +1642,19 @@ export function DatabasesPage() {
           <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] p-10 text-center">
             <Database size={28} className="mx-auto text-[var(--text-muted)]" />
             <p className="mt-3 text-sm text-[var(--text-secondary)]">No managed databases yet.</p>
-            <p className="mt-1 text-xs text-[var(--text-muted)]">
-              Create one via Add Service &rarr; Database in a project workspace.
-            </p>
+            {signedIn ? (
+              <button
+                type="button"
+                onClick={() => setCreateOpen(true)}
+                className="mt-4 inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-[12.5px] font-semibold text-[var(--accent-on)]"
+              >
+                <Database size={13} /> Create your first database
+              </button>
+            ) : (
+              <p className="mt-1 text-xs text-[var(--text-muted)]">
+                Sign in to provision a managed database.
+              </p>
+            )}
           </div>
         ) : (
           <div className="space-y-3">
@@ -1775,6 +1702,8 @@ export function DatabasesPage() {
                       </div>
 
                       <div className="flex flex-wrap items-center gap-2">
+                        {signedIn ? (
+                          <>
                         <span className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)] mr-1">Actions</span>
                         <button
                           onClick={() => actionMutation.mutate({ id: db.id ?? '', action: 'start' })}
@@ -1810,6 +1739,10 @@ export function DatabasesPage() {
                             {actionMutation.error instanceof Error ? actionMutation.error.message : 'Action failed'}
                           </span>
                         )}
+                          </>
+                        ) : (
+                          <span className="text-xs text-[var(--text-tertiary)]">Sign in to manage this database.</span>
+                        )}
                       </div>
 
                       {bindDb?.id === db.id && db.connection_url && (
@@ -1838,6 +1771,7 @@ export function DatabasesPage() {
                       <div>
                         <div className="mb-2 flex items-center justify-between">
                           <p className="text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Backups</p>
+                          {signedIn ? (
                           <button
                             onClick={() => backupMutation.mutate(db.id ?? '')}
                             disabled={!running || backupMutation.isPending}
@@ -1847,6 +1781,7 @@ export function DatabasesPage() {
                             <Archive size={11} />
                             {backupMutation.isPending ? 'Starting…' : 'New backup'}
                           </button>
+                          ) : null}
                         </div>
                         <BackupScheduleRow
                           databaseId={db.id ?? ''}
@@ -1897,6 +1832,84 @@ export function DatabasesPage() {
           </div>
         )}
       </div>
+
+      {createOpen ? (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+          <div className="w-full max-w-md overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--bg-base)] shadow-2xl">
+            <div className="border-b border-[var(--border-subtle)] px-5 py-4">
+              <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">New database</h2>
+              <p className="text-xs text-[var(--text-tertiary)]">Provision a managed database service.</p>
+            </div>
+            <div className="space-y-4 px-5 py-4">
+              <div>
+                <label className="mb-1.5 block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Name</label>
+                <input
+                  value={createForm.name}
+                  onChange={(e) => setCreateForm((f) => ({ ...f, name: e.target.value }))}
+                  placeholder="my-postgres"
+                  className="h-10 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-3 text-sm focus:border-[var(--accent-primary)]"
+                />
+              </div>
+              <div className="grid grid-cols-3 gap-3">
+                <div>
+                  <label className="mb-1.5 block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Type</label>
+                  <select
+                    value={createForm.type}
+                    onChange={(e) => setCreateForm((f) => ({ ...f, type: e.target.value }))}
+                    className="h-10 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-2 text-sm focus:border-[var(--accent-primary)]"
+                  >
+                    {DATABASE_TYPES.map((t) => (
+                      <option key={t} value={t}>{t}</option>
+                    ))}
+                  </select>
+                </div>
+                <div>
+                  <label className="mb-1.5 block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Plan</label>
+                  <select
+                    value={createForm.plan}
+                    onChange={(e) => setCreateForm((f) => ({ ...f, plan: e.target.value }))}
+                    className="h-10 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-2 text-sm focus:border-[var(--accent-primary)]"
+                  >
+                    {DATABASE_PLANS.map((p) => (
+                      <option key={p} value={p}>{p}</option>
+                    ))}
+                  </select>
+                </div>
+                <div>
+                  <label className="mb-1.5 block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)]">Region</label>
+                  <input
+                    value={createForm.region}
+                    onChange={(e) => setCreateForm((f) => ({ ...f, region: e.target.value }))}
+                    placeholder="local"
+                    className="h-10 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-3 text-sm focus:border-[var(--accent-primary)]"
+                  />
+                </div>
+              </div>
+              {createError ? (
+                <div className="rounded-[var(--radius-md)] bg-[var(--error-soft)] px-3.5 py-2.5 text-xs text-[var(--error)]">{createError}</div>
+              ) : null}
+            </div>
+            <div className="flex items-center justify-end gap-2 border-t border-[var(--border-subtle)] px-5 py-3.5">
+              <button
+                type="button"
+                onClick={() => setCreateOpen(false)}
+                className="rounded-[var(--radius-md)] px-3.5 py-2 text-xs font-medium text-[var(--text-secondary)] hover:bg-[var(--surface-muted)]"
+              >
+                Cancel
+              </button>
+              <button
+                type="button"
+                onClick={() => createMutation.mutate()}
+                disabled={createMutation.isPending || createForm.name.trim().length === 0}
+                className="inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-xs font-semibold text-[var(--accent-on)] disabled:opacity-50"
+              >
+                {createMutation.isPending ? <Loader2 size={13} className="animate-spin" /> : null}
+                Create database
+              </button>
+            </div>
+          </div>
+        </div>
+      ) : null}
     </div>
   );
 }
@@ -1935,7 +1948,7 @@ function BindDatabasePanel({
   const services = servicesQuery.data ?? [];
 
   return (
-    <div className="rounded-[var(--radius-md)] border border-[var(--border-default)] bg-[var(--surface-raised)] p-4 space-y-3">
+    <div className="rounded-[var(--radius-md)] border border-[var(--border-default)] bg-[var(--surface-card)] p-4 space-y-3">
       <div className="flex items-center justify-between">
         <p className="text-xs font-medium text-[var(--text-primary)]">Bind to service</p>
         <button onClick={onClose} className="text-xs text-[var(--text-muted)] hover:text-[var(--text-primary)]">Close</button>
@@ -1982,7 +1995,7 @@ function BindDatabasePanel({
         <button
           onClick={() => bindMutation.mutate()}
           disabled={!serviceId || !varKey.trim() || bindMutation.isPending}
-          className="flex items-center gap-1.5 px-3 py-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-xs font-medium disabled:opacity-40"
+          className="flex items-center gap-1.5 px-3 py-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-xs font-medium disabled:opacity-40"
         >
           {bindMutation.isPending ? <Loader2 size={11} className="animate-spin" /> : <Link2 size={11} />} Bind
         </button>
@@ -2061,6 +2074,14 @@ const failoverStrategies = [
 
 export function HighAvailabilityPage() {
   const queryClient = useQueryClient();
+  const sessionQuery = useAuthSession();
+  const profileQuery = useQuery({
+    queryKey: ['user-profile'],
+    queryFn: getCurrentUserProfile,
+    enabled: Boolean(sessionQuery.data),
+    retry: false,
+  });
+  const isAdmin = Boolean(profileQuery.data?.isAdmin);
   const [failoverReason, setFailoverReason] = useState('');
   const [policyForm, setPolicyForm] = useState<{
     serviceId: string;
@@ -2134,6 +2155,13 @@ export function HighAvailabilityPage() {
         description="Failover manager, policies, and active alerts"
       />
       <div className="p-8 space-y-8">
+        <div className="flex items-center gap-2 text-xs text-[var(--text-tertiary)]">
+          <ShieldCheck size={13} className="text-[var(--accent-primary)]" />
+          <span>HA state feeds the platform security posture.</span>
+          <Link to="/security" className="font-medium text-[var(--accent-primary)] hover:underline">
+            Open Security →
+          </Link>
+        </div>
         {pageError && (
           <div className="rounded-[var(--radius-md)] border border-[var(--error)] bg-[var(--error)]/10 px-4 py-3 text-sm text-[var(--error)]">
             {pageError instanceof Error ? pageError.message : 'Request failed'}
@@ -2171,6 +2199,7 @@ export function HighAvailabilityPage() {
           />
         </div>
 
+        {isAdmin ? (
         <div className="panel p-6">
           <div className="flex items-center gap-3 mb-4">
             <Zap size={18} className="text-[var(--accent-primary)]" />
@@ -2181,7 +2210,7 @@ export function HighAvailabilityPage() {
               type="button"
               disabled={toggleMutation.isPending || statusQuery.isLoading}
               onClick={() => toggleMutation.mutate(!status?.enabled)}
-              className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-sm font-medium disabled:opacity-50"
+              className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-sm font-medium disabled:opacity-50"
             >
               {status?.enabled ? 'Disable HA manager' : 'Enable HA manager'}
             </button>
@@ -2192,7 +2221,7 @@ export function HighAvailabilityPage() {
                   value={failoverReason}
                   onChange={(e) => setFailoverReason(e.target.value)}
                   placeholder="Manual failover"
-                  className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)] w-56"
+                  className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)] w-56"
                 />
               </div>
               <button
@@ -2210,6 +2239,7 @@ export function HighAvailabilityPage() {
             </div>
           </div>
         </div>
+        ) : null}
 
         <div className="panel p-6">
           <div className="flex items-center gap-3 mb-4">
@@ -2225,7 +2255,7 @@ export function HighAvailabilityPage() {
               {(alertsQuery.data ?? []).map((alert) => (
                 <div
                   key={alert.id}
-                  className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-primary)] px-4 py-3"
+                  className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-subtle)] px-4 py-3"
                 >
                   <div className="min-w-0">
                     <p className="text-sm text-[var(--text-primary)] truncate">{alert.message ?? alert.id}</p>
@@ -2233,14 +2263,16 @@ export function HighAvailabilityPage() {
                       {alert.severity ?? 'info'} · since {alert.starts_at ? formatRelative(alert.starts_at) : '—'}
                     </p>
                   </div>
+                  {isAdmin ? (
                   <button
                     type="button"
                     disabled={resolveMutation.isPending}
                     onClick={() => alert.id && resolveMutation.mutate(alert.id)}
-                    className="ml-4 shrink-0 px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-primary)] text-xs text-[var(--text-primary)] disabled:opacity-50"
+                    className="ml-4 shrink-0 px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs text-[var(--text-primary)] disabled:opacity-50"
                   >
                     Resolve
                   </button>
+                  ) : null}
                 </div>
               ))}
             </div>
@@ -2253,11 +2285,11 @@ export function HighAvailabilityPage() {
               <ShieldCheck size={18} className="text-[var(--accent-primary)]" />
               <h2 className="text-base font-semibold text-[var(--text-primary)]">Failover policies</h2>
             </div>
-            {policyForm === null && (
+            {policyForm === null && isAdmin && (
               <button
                 type="button"
                 onClick={() => setPolicyForm({ serviceId: '', strategy: 'active_passive', minHealthyNodes: '1', maxFailures: '3', enabled: true, editing: false })}
-                className="px-3 py-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-xs font-medium"
+                className="px-3 py-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-xs font-medium"
               >
                 New policy
               </button>
@@ -2265,12 +2297,12 @@ export function HighAvailabilityPage() {
           </div>
 
           {policyForm !== null && (
-            <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-4 mb-4 space-y-4">
+            <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-4 mb-4 space-y-4">
               <div className="grid gap-3 sm:grid-cols-2">
                 {policyForm.editing ? (
                   <div>
                     <label className="block text-xs text-[var(--text-tertiary)] mb-1">Service</label>
-                    <p className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)] font-mono">
+                    <p className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)] font-mono">
                       {policyForm.serviceId}
                     </p>
                   </div>
@@ -2281,7 +2313,7 @@ export function HighAvailabilityPage() {
                       <select
                         value={policyProjectId}
                         onChange={(e) => { setPolicyProjectId(e.target.value); setPolicyForm({ ...policyForm, serviceId: '' }); }}
-                        className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                        className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                       >
                         <option value="">Select project…</option>
                         {(projectsQuery.data ?? []).map((p) => (
@@ -2295,7 +2327,7 @@ export function HighAvailabilityPage() {
                         value={policyForm.serviceId}
                         onChange={(e) => setPolicyForm({ ...policyForm, serviceId: e.target.value })}
                         disabled={!policyProjectId}
-                        className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)] disabled:opacity-50"
+                        className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)] disabled:opacity-50"
                       >
                         <option value="">Select service…</option>
                         {(servicesQuery.data ?? []).map((s) => (
@@ -2310,7 +2342,7 @@ export function HighAvailabilityPage() {
                   <select
                     value={policyForm.strategy}
                     onChange={(e) => setPolicyForm({ ...policyForm, strategy: e.target.value })}
-                    className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                    className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                   >
                     {failoverStrategies.map((s) => (
                       <option key={s.value} value={s.value}>{s.label}</option>
@@ -2324,7 +2356,7 @@ export function HighAvailabilityPage() {
                       type="number" min={1}
                       value={policyForm.minHealthyNodes}
                       onChange={(e) => setPolicyForm({ ...policyForm, minHealthyNodes: e.target.value })}
-                      className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                      className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                     />
                   </div>
                   <div>
@@ -2333,7 +2365,7 @@ export function HighAvailabilityPage() {
                       type="number" min={1}
                       value={policyForm.maxFailures}
                       onChange={(e) => setPolicyForm({ ...policyForm, maxFailures: e.target.value })}
-                      className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                      className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                     />
                   </div>
                 </div>
@@ -2351,14 +2383,14 @@ export function HighAvailabilityPage() {
                   type="button"
                   disabled={savePolicyMutation.isPending || !policyForm.serviceId}
                   onClick={() => savePolicyMutation.mutate()}
-                  className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-sm font-medium disabled:opacity-50"
+                  className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-sm font-medium disabled:opacity-50"
                 >
                   {savePolicyMutation.isPending ? 'Saving…' : 'Save policy'}
                 </button>
                 <button
                   type="button"
                   onClick={() => setPolicyForm(null)}
-                  className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                  className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                 >
                   Cancel
                 </button>
@@ -2375,7 +2407,7 @@ export function HighAvailabilityPage() {
               {(policiesQuery.data ?? []).map((policy: FailoverPolicy) => (
                 <div
                   key={policy.service_id}
-                  className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-primary)] px-4 py-3"
+                  className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-subtle)] px-4 py-3"
                 >
                   <div className="min-w-0">
                     <p className="text-sm font-medium text-[var(--text-primary)] font-mono truncate">{policy.service_id}</p>
@@ -2385,6 +2417,8 @@ export function HighAvailabilityPage() {
                     </p>
                   </div>
                   <div className="ml-4 flex items-center gap-2 shrink-0">
+                    {isAdmin ? (
+                    <>
                     <button
                       type="button"
                       onClick={() => setPolicyForm({
@@ -2395,7 +2429,7 @@ export function HighAvailabilityPage() {
                         enabled: policy.enabled ?? true,
                         editing: true,
                       })}
-                      className="px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-primary)] text-xs text-[var(--text-primary)]"
+                      className="px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs text-[var(--text-primary)]"
                     >
                       Edit
                     </button>
@@ -2413,6 +2447,8 @@ export function HighAvailabilityPage() {
                         Disable
                       </button>
                     )}
+                    </>
+                    ) : null}
                   </div>
                 </div>
               ))}
@@ -2434,7 +2470,7 @@ export function HighAvailabilityPage() {
               {(healthQuery.data ?? []).slice(0, 20).map((result, i) => (
                 <div
                   key={`${result.check_id}-${i}`}
-                  className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-primary)] px-4 py-3"
+                  className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-subtle)] px-4 py-3"
                 >
                   <div className="min-w-0">
                     <p className="text-sm text-[var(--text-primary)] font-mono truncate">{result.check_id}</p>
@@ -2473,6 +2509,8 @@ const severityColor: Record<string, string> = {
 
 export function SecurityPage() {
   const queryClient = useQueryClient();
+  const sessionQuery = useAuthSession();
+  const signedIn = Boolean(sessionQuery.data);
   const [projectId, setProjectId] = useState('');
   const [scanType, setScanType] = useState<string>('comprehensive');
   const [scanServiceId, setScanServiceId] = useState('');
@@ -2534,6 +2572,13 @@ export function SecurityPage() {
         description="Scan findings, security posture, and compliance status"
       />
       <div className="p-8 space-y-8">
+        <div className="flex items-center gap-2 text-xs text-[var(--text-tertiary)]">
+          <HeartPulse size={13} className="text-[var(--accent-primary)]" />
+          <span>Platform availability and failover live under High availability.</span>
+          <Link to="/ha" className="font-medium text-[var(--accent-primary)] hover:underline">
+            Open HA →
+          </Link>
+        </div>
         {pageError && (
           <div className="rounded-[var(--radius-md)] border border-[var(--error)] bg-[var(--error)]/10 px-4 py-3 text-sm text-[var(--error)]">
             {pageError instanceof Error ? pageError.message : 'Request failed'}
@@ -2546,7 +2591,7 @@ export function SecurityPage() {
             <select
               value={projectId}
               onChange={(e) => { setProjectId(e.target.value); setScanServiceId(''); }}
-              className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)] w-56"
+              className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)] w-56"
             >
               <option value="">Select project…</option>
               {(projectsQuery.data ?? []).map((p) => (
@@ -2561,7 +2606,7 @@ export function SecurityPage() {
                 <select
                   value={scanType}
                   onChange={(e) => setScanType(e.target.value)}
-                  className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                  className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                 >
                   {scanTypes.map((t) => (
                     <option key={t.value} value={t.value}>{t.label}</option>
@@ -2573,7 +2618,7 @@ export function SecurityPage() {
                 <select
                   value={scanServiceId}
                   onChange={(e) => setScanServiceId(e.target.value)}
-                  className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                  className="px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                 >
                   <option value="">All services</option>
                   {(servicesQuery.data ?? []).map((s) => (
@@ -2581,14 +2626,18 @@ export function SecurityPage() {
                   ))}
                 </select>
               </div>
+              {signedIn ? (
               <button
                 type="button"
                 disabled={scanMutation.isPending}
                 onClick={() => scanMutation.mutate()}
-                className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-sm font-medium disabled:opacity-50"
+                className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-sm font-medium disabled:opacity-50"
               >
                 {scanMutation.isPending ? 'Starting…' : 'Run scan'}
               </button>
+              ) : (
+                <span className="self-end pb-2 text-xs text-[var(--text-tertiary)]">Sign in to run scans.</span>
+              )}
             </>
           )}
         </div>
@@ -2639,7 +2688,7 @@ export function SecurityPage() {
                 {vulns.map((v) => (
                   <div
                     key={v.id}
-                    className="flex items-start justify-between rounded-[var(--radius-md)] border border-[var(--border-primary)] px-4 py-3"
+                    className="flex items-start justify-between rounded-[var(--radius-md)] border border-[var(--border-subtle)] px-4 py-3"
                   >
                     <div className="min-w-0">
                       <div className="flex items-center gap-2">
@@ -2653,7 +2702,7 @@ export function SecurityPage() {
                         {v.type} · {v.status} · found {v.found_at ? formatRelative(v.found_at) : '—'}
                       </p>
                     </div>
-                    {v.status === 'open' && v.id && (
+                    {v.status === 'open' && v.id && signedIn && (
                       <div className="ml-4 flex items-center gap-2 shrink-0">
                         <button
                           type="button"
@@ -2667,7 +2716,7 @@ export function SecurityPage() {
                           type="button"
                           disabled={vulnMutation.isPending}
                           onClick={() => vulnMutation.mutate({ id: v.id!, status: 'ignored' })}
-                          className="px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-primary)] text-xs text-[var(--text-secondary)] disabled:opacity-50"
+                          className="px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs text-[var(--text-secondary)] disabled:opacity-50"
                         >
                           Ignore
                         </button>
@@ -2695,7 +2744,7 @@ export function SecurityPage() {
                 {(historyQuery.data ?? []).map((scan) => (
                   <div
                     key={scan.id}
-                    className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-primary)] px-4 py-3"
+                    className="flex items-center justify-between rounded-[var(--radius-md)] border border-[var(--border-subtle)] px-4 py-3"
                   >
                     <div>
                       <p className="text-sm text-[var(--text-primary)]">

app/frontend/src/features/service/pages/ServiceDetailPage.tsx

@@ -36,6 +36,8 @@ import {
   type CronJobEntity,
 } from '@/lib/api-client';
 import { getDemoProjectById, getDemoServiceById, getDemoCronJobsByService } from '@/lib/demo-data';
+import { useAuthSession } from '@/lib/use-auth-session';
+import { getCurrentUserProfile } from '@/lib/api-client';
 import { parseDotenv, validateVariableRows, type VariableDraft } from '../variable-utils';
 import { formatBytes, formatDate, formatRelative, seededMetric } from '@/lib/time';
 import { EnhancedMetricCard, LineAreaChart, DonutChart } from '@/shared/components';
@@ -70,16 +72,18 @@ import {
 
 type ServiceSection = 'metrics' | 'logs' | 'config' | 'variables' | 'cron' | 'previews' | 'scaling' | 'console' | 'settings';
 
-const sectionItems: Array<{ key: ServiceSection; label: string; icon: typeof Activity }> = [
+// Sections marked manageOnly are hidden from anonymous visitors — they
+// expose authenticated or owner-scoped data (logs, variables, exec).
+const sectionItems: Array<{ key: ServiceSection; label: string; icon: typeof Activity; manageOnly?: boolean }> = [
   { key: 'metrics', label: 'Metrics', icon: Activity },
-  { key: 'logs', label: 'Logs', icon: FileText },
+  { key: 'logs', label: 'Logs', icon: FileText, manageOnly: true },
   { key: 'config', label: 'Config', icon: Sliders },
-  { key: 'variables', label: 'Variables', icon: KeyRound },
+  { key: 'variables', label: 'Variables', icon: KeyRound, manageOnly: true },
   { key: 'cron', label: 'Cron', icon: Clock },
   { key: 'previews', label: 'Previews', icon: GitPullRequest },
   { key: 'scaling', label: 'Scaling', icon: Layers },
-  { key: 'console', label: 'Console', icon: Terminal },
-  { key: 'settings', label: 'Settings', icon: Settings },
+  { key: 'console', label: 'Console', icon: Terminal, manageOnly: true },
+  { key: 'settings', label: 'Settings', icon: Settings, manageOnly: true },
 ];
 
 function metricStatus(percent: number): 'good' | 'average' | 'warning' {
@@ -120,6 +124,15 @@ export function ServiceDetailPage() {
   const navigate = useNavigate();
   const queryClient = useQueryClient();
   const isDemoMode = searchParams.get('demo') === '1';
+  const sessionQuery = useAuthSession({ enabled: !isDemoMode });
+  const signedIn = isDemoMode || Boolean(sessionQuery.data);
+  const profileQuery = useQuery({
+    queryKey: ['user-profile'],
+    queryFn: getCurrentUserProfile,
+    enabled: signedIn && !isDemoMode,
+    retry: false,
+  });
+  const isAdmin = Boolean(profileQuery.data?.isAdmin);
 
   const [activeSection, setActiveSection] = useState<ServiceSection>('metrics');
   const [logTail, setLogTail] = useState('100');
@@ -557,22 +570,22 @@ export function ServiceDetailPage() {
         style={{ 
           gap: '6px', 
           padding: '14px 24px 10px',
-          color: '#6b6e7d',
+          color: 'var(--text-tertiary)',
           fontSize: '13px'
         }}
       >
-        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="#6b6e7d" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
+        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="var(--text-tertiary)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
           <polyline points="15 18 9 12 15 6"/>
         </svg>
         <button 
           onClick={() => navigate(isDemoMode ? `/projects/${project.id}?demo=1` : `/projects/${project.id}`)}
-          style={{ color: '#6b6e7d', textDecoration: 'none' }}
-          className="hover:text-[#9295a4] transition-colors"
+          style={{ color: 'var(--text-tertiary)', textDecoration: 'none' }}
+          className="hover:text-[var(--text-secondary)] transition-colors"
         >
           Servers
         </button>
         <span style={{ opacity: 0.4 }}>/</span>
-        <span style={{ color: '#9295a4' }}>{service.name}</span>
+        <span style={{ color: 'var(--text-secondary)' }}>{service.name}</span>
       </div>
 
       {/* Project Header - self.html exact match */}
@@ -592,7 +605,7 @@ export function ServiceDetailPage() {
         </div>
         <div>
           <div className="flex items-center" style={{ gap: '10px' }}>
-            <span style={{ fontSize: '20px', fontWeight: 800, letterSpacing: '-0.5px', color: '#e8e9f0' }}>{service.name}</span>
+            <span style={{ fontSize: '20px', fontWeight: 800, letterSpacing: '-0.5px', color: 'var(--text-primary)' }}>{service.name}</span>
             <span
               className={`badge-${service.status === 'running' ? 'active' : service.status === 'degraded' ? 'degraded' : 'stopped'}`}
             >
@@ -606,8 +619,8 @@ export function ServiceDetailPage() {
                 href={service.publicUrl ?? `https://${service.domain}`}
                 target="_blank"
                 rel="noopener noreferrer"
-                className="flex items-center hover:text-[#9295a4] transition-colors"
-                style={{ color: '#6b6e7d', fontSize: '12.5px', textDecoration: 'none', gap: '4px' }}
+                className="flex items-center hover:text-[var(--text-secondary)] transition-colors"
+                style={{ color: 'var(--text-tertiary)', fontSize: '12.5px', textDecoration: 'none', gap: '4px' }}
               >
                 {service.publicUrl ?? `https://${service.domain}`}
                 <svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round">
@@ -619,8 +632,8 @@ export function ServiceDetailPage() {
             )}
             <button 
               onClick={() => navigate(isDemoMode ? `/projects/${project.id}?demo=1` : `/projects/${project.id}`)}
-              className="flex items-center hover:text-[#9295a4] transition-colors"
-              style={{ color: '#6b6e7d', fontSize: '12.5px', textDecoration: 'none', gap: '4px' }}
+              className="flex items-center hover:text-[var(--text-secondary)] transition-colors"
+              style={{ color: 'var(--text-tertiary)', fontSize: '12.5px', textDecoration: 'none', gap: '4px' }}
             >
               Project Information
               <svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round">
@@ -630,7 +643,7 @@ export function ServiceDetailPage() {
           </div>
         </div>
         <div className="ml-auto flex" style={{ gap: '10px' }}>
-          {!isDemoMode && (
+          {!isDemoMode && signedIn && (
             <>
               <button
                 onClick={() => stopMutation.mutate()}
@@ -697,7 +710,7 @@ export function ServiceDetailPage() {
                 data={isDemoMode
                   ? Array.from({ length: 24 }, (_, i) => seededMetric(`${service.id}:cpu:${i}`, 8, 80))
                   : metricHistory.cpu.length > 0 ? metricHistory.cpu : [0]}
-                color="#b4e34a"
+                color="var(--accent-primary)"
                 height={72}
               />
             }
@@ -711,10 +724,10 @@ export function ServiceDetailPage() {
             subtitle={isDemoMode ? 'Container footprint' : hasLiveTelemetry ? `${formatBytes(liveMetrics!.memory_usage_bytes)} used` : 'No running containers'}
             chart={
               <div className="relative mx-auto" style={{ width: 150 }}>
-                <DonutChart percentage={isDemoMode ? metricSet?.memory ?? 0 : memoryPercent} color="#f2c94c" size={150} thickness={14} />
+                <DonutChart percentage={isDemoMode ? metricSet?.memory ?? 0 : memoryPercent} color="var(--warning)" size={150} thickness={14} />
                 <div className="absolute inset-x-0 bottom-0 text-center">
-                  <div className="text-[10px] uppercase tracking-wide text-[#6b6e7d]">Used</div>
-                  <div className="text-sm font-bold text-[#e8e9f0]">
+                  <div className="text-[10px] uppercase tracking-wide text-[var(--text-tertiary)]">Used</div>
+                  <div className="text-sm font-bold text-[var(--text-primary)]">
                     {isDemoMode
                       ? `${((8 * (metricSet?.memory ?? 0)) / 100).toFixed(1)} GB / 8 GB`
                       : hasLiveTelemetry
@@ -737,7 +750,7 @@ export function ServiceDetailPage() {
                 data={isDemoMode
                   ? Array.from({ length: 24 }, (_, i) => seededMetric(`${service.id}:net:${i}`, 15, 70))
                   : metricHistory.net.length > 0 ? metricHistory.net : [0]}
-                color="#7ab8ff"
+                color="var(--info)"
                 height={72}
               />
             }
@@ -785,12 +798,12 @@ export function ServiceDetailPage() {
       <div 
         className="flex"
         style={{ 
-          borderBottom: '1px solid rgba(255,255,255,0.07)',
+          borderBottom: '1px solid var(--border-subtle)',
           marginBottom: '18px',
           padding: '0 24px'
         }}
       >
-        {sectionItems.map((item) => {
+        {sectionItems.filter((item) => signedIn || !item.manageOnly).map((item) => {
           const active = activeSection === item.key;
           const Icon = item.icon;
           return (
@@ -847,8 +860,8 @@ export function ServiceDetailPage() {
                         return (
                           <div
                             key={i}
-                            className="flex-1 rounded-[var(--radius-xs)] transition-all hover:opacity-80 cursor-pointer"
-                            style={{ height: `${value}%`, background: '#b4e34a' }}
+                            className="flex-1 rounded-[var(--radius-sm)] transition-all hover:opacity-80 cursor-pointer"
+                            style={{ height: `${value}%`, background: 'var(--accent-primary)' }}
                             title={`${value}%`}
                           />
                         );
@@ -856,8 +869,8 @@ export function ServiceDetailPage() {
                     : metricHistory.cpu.map((value, i) => (
                         <div
                           key={i}
-                          className="flex-1 rounded-[var(--radius-xs)] transition-all hover:opacity-80"
-                          style={{ height: `${Math.max(3, value)}%`, background: '#b4e34a' }}
+                          className="flex-1 rounded-[var(--radius-sm)] transition-all hover:opacity-80"
+                          style={{ height: `${Math.max(3, value)}%`, background: 'var(--accent-primary)' }}
                           title={`${value.toFixed(1)}%`}
                         />
                       ))}
@@ -888,8 +901,8 @@ export function ServiceDetailPage() {
                         return (
                           <div
                             key={i}
-                            className="flex-1 rounded-[var(--radius-xs)] transition-all hover:opacity-80 cursor-pointer"
-                            style={{ height: `${value}%`, background: '#5ee6a0' }}
+                            className="flex-1 rounded-[var(--radius-sm)] transition-all hover:opacity-80 cursor-pointer"
+                            style={{ height: `${value}%`, background: 'var(--success)' }}
                             title={`${value}%`}
                           />
                         );
@@ -897,8 +910,8 @@ export function ServiceDetailPage() {
                     : metricHistory.memory.map((value, i) => (
                         <div
                           key={i}
-                          className="flex-1 rounded-[var(--radius-xs)] transition-all hover:opacity-80"
-                          style={{ height: `${Math.max(3, value)}%`, background: '#5ee6a0' }}
+                          className="flex-1 rounded-[var(--radius-sm)] transition-all hover:opacity-80"
+                          style={{ height: `${Math.max(3, value)}%`, background: 'var(--success)' }}
                           title={`${value.toFixed(1)}%`}
                         />
                       ))}
@@ -1288,6 +1301,7 @@ export function ServiceDetailPage() {
                   <p className="text-sm text-[var(--text-secondary)]">Scheduled commands executed inside the service container</p>
                 </div>
               </div>
+              {signedIn ? (
               <button
                 onClick={() => { setEditingCronId(null); setCronForm({ name: '', schedule: '', command: '', timezone: 'UTC', enabled: true, retention: 30 }); }}
                 className="flex items-center gap-2 px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs font-medium text-[var(--text-secondary)] hover:border-[var(--border-default)] transition-colors"
@@ -1295,6 +1309,7 @@ export function ServiceDetailPage() {
                 <Plus size={12} />
                 New job
               </button>
+              ) : null}
             </div>
 
             {cronForm && (
@@ -1378,9 +1393,10 @@ export function ServiceDetailPage() {
                   <div key={job.id} className="panel-soft p-3">
                     <div className="flex items-center gap-3">
                       <button
-                        onClick={() => toggleCronMutation.mutate(job)}
+                        onClick={() => signedIn && toggleCronMutation.mutate(job)}
                         title={job.enabled ? 'Disable' : 'Enable'}
-                        className={`w-8 h-5 rounded-full relative transition-colors shrink-0 ${job.enabled ? 'bg-[var(--accent-primary)]' : 'bg-[var(--border-default)]'}`}
+                        disabled={!signedIn}
+                        className={`w-8 h-5 rounded-full relative transition-colors shrink-0 ${job.enabled ? 'bg-[var(--accent-primary)]' : 'bg-[var(--border-default)]'} disabled:opacity-60 disabled:cursor-not-allowed`}
                       >
                         <span className={`absolute top-0.5 w-4 h-4 rounded-full bg-white transition-all ${job.enabled ? 'left-3.5' : 'left-0.5'}`} />
                       </button>
@@ -1396,15 +1412,19 @@ export function ServiceDetailPage() {
                         </p>
                       </div>
                       <div className="flex items-center gap-1 shrink-0">
-                        <button onClick={() => triggerCronMutation.mutate(job.id as string)} title="Run now"
-                          disabled={triggerCronMutation.isPending}
-                          className="p-1.5 rounded-[var(--radius-md)] text-[var(--text-secondary)] hover:text-[var(--accent-primary)] hover:bg-[var(--accent-primary-soft)] transition-colors disabled:opacity-50">
-                          <Play size={13} />
-                        </button>
+                        {signedIn ? (
+                          <button onClick={() => triggerCronMutation.mutate(job.id as string)} title="Run now"
+                            disabled={triggerCronMutation.isPending}
+                            className="p-1.5 rounded-[var(--radius-md)] text-[var(--text-secondary)] hover:text-[var(--accent-primary)] hover:bg-[var(--accent-primary-soft)] transition-colors disabled:opacity-50">
+                            <Play size={13} />
+                          </button>
+                        ) : null}
                         <button onClick={() => setHistoryCronId(historyCronId === job.id ? null : (job.id as string))} title="History"
                           className="p-1.5 rounded-[var(--radius-md)] text-[var(--text-secondary)] hover:text-[var(--accent-primary)] hover:bg-[var(--accent-primary-soft)] transition-colors">
                           <ChevronDown size={13} className={historyCronId === job.id ? 'rotate-180 transition-transform' : 'transition-transform'} />
                         </button>
+                        {signedIn ? (
+                          <>
                         <button
                           onClick={() => { setEditingCronId(job.id as string); setCronForm({ name: job.name ?? '', schedule: job.schedule ?? '', command: job.command ?? '', timezone: job.timezone ?? 'UTC', enabled: job.enabled ?? true, retention: job.retention ?? 30 }); }}
                           title="Edit"
@@ -1417,6 +1437,8 @@ export function ServiceDetailPage() {
                           className="p-1.5 rounded-[var(--radius-md)] text-[var(--text-secondary)] hover:text-[var(--error)] hover:bg-[var(--error-soft)] transition-colors">
                           <Trash2 size={13} />
                         </button>
+                          </>
+                        ) : null}
                       </div>
                     </div>
                     {historyCronId === job.id && (
@@ -1462,12 +1484,14 @@ export function ServiceDetailPage() {
                   <p className="text-sm text-[var(--text-secondary)]">Ephemeral per-branch deployments of this service</p>
                 </div>
               </div>
+              {signedIn ? (
               <button
                 onClick={() => setPreviewForm({ branch: '', prNumber: '', ttlHours: '72' })}
                 className="flex items-center gap-2 px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs font-medium text-[var(--text-secondary)] hover:border-[var(--border-default)] transition-colors"
               >
                 <Plus size={12} /> New preview
               </button>
+              ) : null}
             </div>
 
             {previewForm && (
@@ -1479,7 +1503,7 @@ export function ServiceDetailPage() {
                       value={previewForm.branch}
                       onChange={(e) => setPreviewForm({ ...previewForm, branch: e.target.value })}
                       placeholder="feature/my-branch"
-                      className="w-52 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-raised)] px-2 py-1.5 text-xs text-[var(--text-primary)]"
+                      className="w-52 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-card)] px-2 py-1.5 text-xs text-[var(--text-primary)]"
                     />
                   </label>
                   <label className="flex flex-col gap-1 text-xs text-[var(--text-muted)]">
@@ -1488,7 +1512,7 @@ export function ServiceDetailPage() {
                       value={previewForm.prNumber}
                       onChange={(e) => setPreviewForm({ ...previewForm, prNumber: e.target.value })}
                       placeholder="123"
-                      className="w-24 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-raised)] px-2 py-1.5 text-xs text-[var(--text-primary)]"
+                      className="w-24 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-card)] px-2 py-1.5 text-xs text-[var(--text-primary)]"
                     />
                   </label>
                   <label className="flex flex-col gap-1 text-xs text-[var(--text-muted)]">
@@ -1497,7 +1521,7 @@ export function ServiceDetailPage() {
                       value={previewForm.ttlHours}
                       onChange={(e) => setPreviewForm({ ...previewForm, ttlHours: e.target.value })}
                       placeholder="72"
-                      className="w-24 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-raised)] px-2 py-1.5 text-xs text-[var(--text-primary)]"
+                      className="w-24 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-card)] px-2 py-1.5 text-xs text-[var(--text-primary)]"
                     />
                   </label>
                   <button
@@ -1551,7 +1575,7 @@ export function ServiceDetailPage() {
                         <ExternalLink size={11} /> Open
                       </a>
                     )}
-                    {env.status === 'running' && (
+                    {env.status === 'running' && signedIn && (
                       <button
                         onClick={() => { if (window.confirm('Promote this preview to production?')) promotePreviewMutation.mutate(env.id ?? ''); }}
                         disabled={promotePreviewMutation.isPending}
@@ -1560,6 +1584,7 @@ export function ServiceDetailPage() {
                         Promote
                       </button>
                     )}
+                    {signedIn ? (
                     <button
                       onClick={() => { if (window.confirm(`Delete preview ${env.environment}?`)) deletePreviewMutation.mutate(env.id ?? ''); }}
                       disabled={deletePreviewMutation.isPending}
@@ -1567,6 +1592,7 @@ export function ServiceDetailPage() {
                     >
                       Delete
                     </button>
+                    ) : null}
                   </div>
                 ))}
               </div>
@@ -1598,7 +1624,7 @@ export function ServiceDetailPage() {
             ) : (
               <>
                 <div className="grid grid-cols-2 sm:grid-cols-4 gap-3 mb-6">
-                  <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                  <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                     <p className="text-xs text-[var(--text-tertiary)] uppercase tracking-wide">Replicas</p>
                     <p className="text-xl font-semibold text-[var(--text-primary)]">
                       {scalingStateQuery.data?.CurrentReplicas ??
@@ -1609,19 +1635,19 @@ export function ServiceDetailPage() {
                       </span>
                     </p>
                   </div>
-                  <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                  <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                     <p className="text-xs text-[var(--text-tertiary)] uppercase tracking-wide">Policy</p>
                     <p className="text-xl font-semibold text-[var(--text-primary)]">
                       {scalingPolicyQuery.data ? `${scalingPolicyQuery.data.min_replicas}–${scalingPolicyQuery.data.max_replicas}` : 'None'}
                     </p>
                   </div>
-                  <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                  <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                     <p className="text-xs text-[var(--text-tertiary)] uppercase tracking-wide">Autoscaling</p>
                     <p className="text-xl font-semibold text-[var(--text-primary)]">
                       {scalingPolicyQuery.data?.enabled ? 'On' : 'Off'}
                     </p>
                   </div>
-                  <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                  <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                     <p className="text-xs text-[var(--text-tertiary)] uppercase tracking-wide">Last action</p>
                     <p className="text-sm font-medium text-[var(--text-primary)] truncate">
                       {scalingStateQuery.data?.LastScaleDirection ?? '—'}
@@ -1639,15 +1665,17 @@ export function ServiceDetailPage() {
                         max={20}
                         value={scaleReplicas}
                         onChange={(e) => setScaleReplicas(e.target.value)}
-                        className="w-28 px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                        className="w-28 px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                         placeholder="e.g. 3"
                       />
                     </div>
+                    {isAdmin ? (
+                    <>
                     <button
                       type="button"
                       disabled={manualScaleMutation.isPending || !scaleReplicas}
                       onClick={() => manualScaleMutation.mutate(Number(scaleReplicas))}
-                      className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-sm font-medium disabled:opacity-50"
+                      className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-sm font-medium disabled:opacity-50"
                     >
                       {manualScaleMutation.isPending ? 'Scaling…' : 'Scale'}
                     </button>
@@ -1660,7 +1688,7 @@ export function ServiceDetailPage() {
                         targetMemory: String(scalingPolicyQuery.data?.target_memory ?? 80),
                         enabled: scalingPolicyQuery.data?.enabled ?? true,
                       })}
-                      className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                      className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                     >
                       {scalingPolicyQuery.data ? 'Edit policy' : 'Create policy'}
                     </button>
@@ -1674,9 +1702,13 @@ export function ServiceDetailPage() {
                         Disable policy
                       </button>
                     )}
+                    </>
+                    ) : (
+                      <span className="self-center text-xs text-[var(--text-tertiary)]">Scaling policy changes are admin-only.</span>
+                    )}
                   </div>
                 ) : (
-                  <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-4 space-y-4">
+                  <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-4 space-y-4">
                     <div className="grid grid-cols-2 sm:grid-cols-4 gap-3">
                       {([
                         ['Min replicas', 'min'],
@@ -1691,7 +1723,7 @@ export function ServiceDetailPage() {
                             min={field === 'min' || field === 'max' ? 1 : 0}
                             value={scalingForm[field]}
                             onChange={(e) => setScalingForm({ ...scalingForm, [field]: e.target.value })}
-                            className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                            className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                           />
                         </div>
                       ))}
@@ -1709,14 +1741,14 @@ export function ServiceDetailPage() {
                         type="button"
                         disabled={saveScalingMutation.isPending}
                         onClick={() => saveScalingMutation.mutate()}
-                        className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-sm font-medium disabled:opacity-50"
+                        className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-sm font-medium disabled:opacity-50"
                       >
                         {saveScalingMutation.isPending ? 'Saving…' : 'Save policy'}
                       </button>
                       <button
                         type="button"
                         onClick={() => setScalingForm(null)}
-                        className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                        className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                       >
                         Cancel
                       </button>
@@ -1765,12 +1797,12 @@ export function ServiceDetailPage() {
                 onChange={(e) => setConsoleInput(e.target.value)}
                 placeholder="e.g. env | sort | head -20"
                 disabled={execMutation.isPending}
-                className="flex-1 px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm font-mono text-[var(--text-primary)] disabled:opacity-50"
+                className="flex-1 px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm font-mono text-[var(--text-primary)] disabled:opacity-50"
               />
               <button
                 type="submit"
                 disabled={execMutation.isPending || !consoleInput.trim()}
-                className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-sm font-medium disabled:opacity-50"
+                className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-sm font-medium disabled:opacity-50"
               >
                 {execMutation.isPending ? 'Running…' : 'Run'}
               </button>
@@ -1789,7 +1821,7 @@ export function ServiceDetailPage() {
             ) : (
               <div className="space-y-3">
                 {consoleHistory.map((entry, i) => (
-                  <div key={i} className="rounded-[var(--radius-md)] border border-[var(--border-primary)] bg-[var(--bg-secondary)] p-3">
+                  <div key={i} className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] p-3">
                     <div className="flex items-center justify-between mb-1">
                       <p className="text-xs font-mono text-[var(--text-primary)]">$ {entry.command}</p>
                       <span className={`text-xs font-mono ${entry.exitCode === 0 && !entry.error ? 'text-[var(--success)]' : 'text-[var(--error)]'}`}>
@@ -1878,25 +1910,25 @@ export function ServiceDetailPage() {
 
                 {networkForm === null ? (
                   <div className="grid grid-cols-2 sm:grid-cols-4 gap-3 text-xs">
-                    <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                       <p className="text-[var(--text-tertiary)] uppercase tracking-wide">Port</p>
                       <p className="mt-1 text-sm font-medium text-[var(--text-primary)]">{service.port || '—'}</p>
                     </div>
-                    <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                       <p className="text-[var(--text-tertiary)] uppercase tracking-wide">Domain</p>
                       <p className="mt-1 text-sm font-medium text-[var(--text-primary)] truncate">{service.domain || '—'}</p>
                     </div>
-                    <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                       <p className="text-[var(--text-tertiary)] uppercase tracking-wide">Replicas</p>
                       <p className="mt-1 text-sm font-medium text-[var(--text-primary)]">{service.replicas ?? 1}</p>
                     </div>
-                    <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-3">
+                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
                       <p className="text-[var(--text-tertiary)] uppercase tracking-wide">Restart</p>
                       <p className="mt-1 text-sm font-medium text-[var(--text-primary)]">{service.restartPolicy || 'unless-stopped'}</p>
                     </div>
                   </div>
                 ) : (
-                  <div className="rounded-[var(--radius-md)] border border-[var(--border-primary)] p-4 space-y-4">
+                  <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-4 space-y-4">
                     <div className="grid grid-cols-2 sm:grid-cols-3 gap-3">
                       <div>
                         <label className="block text-xs text-[var(--text-tertiary)] mb-1">Container port</label>
@@ -1907,7 +1939,7 @@ export function ServiceDetailPage() {
                           value={networkForm.port}
                           onChange={(e) => setNetworkForm({ ...networkForm, port: e.target.value })}
                           placeholder="e.g. 3000"
-                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                         />
                         <p className="mt-1 text-[10px] text-[var(--text-tertiary)]">Published on the host; routed via Traefik when a domain is set</p>
                       </div>
@@ -1917,7 +1949,7 @@ export function ServiceDetailPage() {
                           value={networkForm.domain}
                           onChange={(e) => setNetworkForm({ ...networkForm, domain: e.target.value })}
                           placeholder="app.example.com"
-                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                         />
                       </div>
                       <div>
@@ -1926,7 +1958,7 @@ export function ServiceDetailPage() {
                           value={networkForm.healthcheckPath}
                           onChange={(e) => setNetworkForm({ ...networkForm, healthcheckPath: e.target.value })}
                           placeholder="/health"
-                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                         />
                       </div>
                       <div>
@@ -1937,7 +1969,7 @@ export function ServiceDetailPage() {
                           max={20}
                           value={networkForm.replicas}
                           onChange={(e) => setNetworkForm({ ...networkForm, replicas: e.target.value })}
-                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                         />
                       </div>
                       <div>
@@ -1945,7 +1977,7 @@ export function ServiceDetailPage() {
                         <select
                           value={networkForm.restartPolicy}
                           onChange={(e) => setNetworkForm({ ...networkForm, restartPolicy: e.target.value })}
-                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--bg-secondary)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                          className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                         >
                           <option value="unless-stopped">unless-stopped</option>
                           <option value="always">always</option>
@@ -1967,14 +1999,14 @@ export function ServiceDetailPage() {
                             replicas: Math.max(1, Math.min(20, Number(networkForm.replicas) || 1)),
                           })
                         }
-                        className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-contrast)] text-sm font-medium disabled:opacity-50"
+                        className="px-4 py-2 rounded-[var(--radius-md)] bg-[var(--accent-primary)] text-[var(--accent-on)] text-sm font-medium disabled:opacity-50"
                       >
                         {updateServiceMutation.isPending ? 'Saving…' : 'Save'}
                       </button>
                       <button
                         type="button"
                         onClick={() => setNetworkForm(null)}
-                        className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-primary)] text-sm text-[var(--text-primary)]"
+                        className="px-4 py-2 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)]"
                       >
                         Cancel
                       </button>

app/frontend/src/features/templates/pages/TemplatesPage.tsx

@@ -2,13 +2,19 @@ import { useMemo, useState } from 'react';
 import { Link, useSearchParams } from 'react-router-dom';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import {
+  createTemplate,
+  deleteTemplate,
   deployTemplate,
+  getCurrentUserProfile,
   getTemplateById,
   listProjects,
   listTemplates,
+  updateTemplate,
   type TemplateDetailEntity,
   type TemplateEntity,
+  type TemplateWriteInput,
 } from '@/lib/api-client';
+import { useAuthSession } from '@/lib/use-auth-session';
 import {
   Search,
   Filter,
@@ -24,6 +30,11 @@ import {
   Play,
   ArrowRight,
   Star,
+  Plus,
+  Pencil,
+  Trash2,
+  Upload,
+  X,
 } from 'lucide-react';
 
 const demoTemplates: TemplateEntity[] = [
@@ -36,6 +47,7 @@ const demoTemplates: TemplateEntity[] = [
     configRaw: '{"runtime":"node"}',
     variablesRaw: '[]',
     isOfficial: true,
+    ownerId: null,
   },
   {
     id: 'tpl-go',
@@ -46,6 +58,7 @@ const demoTemplates: TemplateEntity[] = [
     configRaw: '{"runtime":"go"}',
     variablesRaw: '[]',
     isOfficial: true,
+    ownerId: null,
   },
   {
     id: 'tpl-postgres',
@@ -56,6 +69,7 @@ const demoTemplates: TemplateEntity[] = [
     configRaw: '{"runtime":"postgres"}',
     variablesRaw: '[]',
     isOfficial: true,
+    ownerId: null,
   },
   {
     id: 'tpl-mysql',
@@ -66,6 +80,7 @@ const demoTemplates: TemplateEntity[] = [
     configRaw: '{"runtime":"mysql"}',
     variablesRaw: '[]',
     isOfficial: true,
+    ownerId: null,
   },
   {
     id: 'tpl-mariadb',
@@ -76,6 +91,7 @@ const demoTemplates: TemplateEntity[] = [
     configRaw: '{"runtime":"mariadb"}',
     variablesRaw: '[]',
     isOfficial: true,
+    ownerId: null,
   },
   {
     id: 'tpl-clickhouse',
@@ -86,6 +102,7 @@ const demoTemplates: TemplateEntity[] = [
     configRaw: '{"runtime":"clickhouse"}',
     variablesRaw: '[]',
     isOfficial: true,
+    ownerId: null,
   },
   {
     id: 'tpl-dragonfly',
@@ -96,6 +113,7 @@ const demoTemplates: TemplateEntity[] = [
     configRaw: '{"runtime":"dragonfly"}',
     variablesRaw: '[]',
     isOfficial: true,
+    ownerId: null,
   },
 ];
 
@@ -354,6 +372,15 @@ function categoryLabel(category: string): string {
   return category ? category[0].toUpperCase() + category.slice(1) : 'Uncategorized';
 }
 
+function safeTemplateRuntime(configRaw: string): string {
+  try {
+    const parsed = JSON.parse(configRaw || '{}') as { runtime?: string };
+    return parsed.runtime || 'n/a';
+  } catch {
+    return 'n/a';
+  }
+}
+
 function categoryIcon(category: string): typeof Box {
   switch (category) {
     case 'frontend':
@@ -369,11 +396,57 @@ function categoryIcon(category: string): typeof Box {
   }
 }
 
+const EMPTY_TEMPLATE_JSON = JSON.stringify(
+  {
+    name: 'my-template',
+    description: 'What this template deploys.',
+    category: 'app',
+    logo: '',
+    config: {
+      type: 'web',
+      runtime: 'node',
+      build_command: '',
+      start_command: '',
+      port: 3000,
+      health_check: '/health',
+      environment: {},
+    },
+    variables: [
+      {
+        key: 'EXAMPLE_VAR',
+        label: 'Example variable',
+        default: '',
+        required: false,
+        secret: false,
+        description: 'Shown at deploy time',
+      },
+    ],
+  },
+  null,
+  2,
+);
+
 export function TemplatesPage() {
   const queryClient = useQueryClient();
   const [searchParams] = useSearchParams();
   const isDemoMode = searchParams.get('demo') === '1';
 
+  const sessionQuery = useAuthSession({ enabled: !isDemoMode });
+  const signedIn = isDemoMode || Boolean(sessionQuery.data);
+  const profileQuery = useQuery({
+    queryKey: ['current-profile'],
+    queryFn: getCurrentUserProfile,
+    enabled: !isDemoMode && Boolean(sessionQuery.data),
+    retry: false,
+  });
+  const myUserId = profileQuery.data?.id ?? '';
+  const isAdmin = Boolean(profileQuery.data?.isAdmin);
+
+  const [editorOpen, setEditorOpen] = useState(false);
+  const [editorJson, setEditorJson] = useState(EMPTY_TEMPLATE_JSON);
+  const [editingTemplate, setEditingTemplate] = useState<TemplateEntity | null>(null);
+  const [editorError, setEditorError] = useState<string | null>(null);
+
   const [categoryFilter, setCategoryFilter] = useState('');
   const [searchFilter, setSearchFilter] = useState('');
   const [selectedTemplateIdState, setSelectedTemplateId] = useState<string | null>(null);
@@ -553,6 +626,109 @@ export function TemplatesPage() {
     missingRequiredVariables.length > 0 ||
     deployMutation.isPending;
 
+  const canManageTemplate = (template: TemplateEntity) =>
+    !template.isOfficial && Boolean(template.ownerId) && (template.ownerId === myUserId || isAdmin);
+
+  const saveTemplateMutation = useMutation({
+    mutationFn: (input: TemplateWriteInput) =>
+      editingTemplate ? updateTemplate(editingTemplate.id, input) : createTemplate(input),
+    onSuccess: (template) => {
+      queryClient.invalidateQueries({ queryKey: ['templates-page'] });
+      setEditorOpen(false);
+      setEditingTemplate(null);
+      setEditorError(null);
+      setSelectedTemplateId(template.id);
+    },
+    onError: (error) => {
+      setEditorError(error instanceof Error ? error.message : 'Failed to save template');
+    },
+  });
+
+  const deleteMutation = useMutation({
+    mutationFn: (id: string) => deleteTemplate(id),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['templates-page'] });
+      setSelectedTemplateId(null);
+    },
+  });
+
+  const openCreateEditor = () => {
+    setEditingTemplate(null);
+    setEditorJson(EMPTY_TEMPLATE_JSON);
+    setEditorError(null);
+    setEditorOpen(true);
+  };
+
+  const openEditEditor = (template: TemplateEntity) => {
+    let config: unknown = {};
+    let variables: unknown = [];
+    try {
+      config = JSON.parse(template.configRaw || '{}');
+    } catch {
+      /* keep {} */
+    }
+    try {
+      variables = JSON.parse(template.variablesRaw || '[]');
+    } catch {
+      /* keep [] */
+    }
+    setEditingTemplate(template);
+    setEditorJson(
+      JSON.stringify(
+        {
+          name: template.name,
+          description: template.description,
+          category: template.category,
+          logo: template.logo,
+          config,
+          variables,
+        },
+        null,
+        2,
+      ),
+    );
+    setEditorError(null);
+    setEditorOpen(true);
+  };
+
+  const submitEditor = () => {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(editorJson);
+    } catch (err) {
+      setEditorError(`Invalid JSON: ${err instanceof Error ? err.message : 'parse error'}`);
+      return;
+    }
+    const body = parsed as Partial<TemplateWriteInput>;
+    if (!body || typeof body !== 'object' || !body.name || typeof body.config !== 'object' || body.config === null) {
+      setEditorError('Template JSON needs at least "name" and a "config" object.');
+      return;
+    }
+    saveTemplateMutation.mutate({
+      name: String(body.name),
+      description: body.description ?? '',
+      category: body.category ?? 'other',
+      logo: body.logo ?? '',
+      config: body.config as Record<string, unknown>,
+      variables: Array.isArray(body.variables) ? body.variables : [],
+    });
+  };
+
+  const uploadJsonFile = (file: File) => {
+    if (!file.name.toLowerCase().endsWith('.json') && file.type !== 'application/json') {
+      setEditorError('Only .json files are accepted.');
+      return;
+    }
+    file
+      .text()
+      .then((text) => {
+        JSON.parse(text);
+        setEditorJson(text);
+        setEditorError(null);
+      })
+      .catch(() => setEditorError('File is not valid JSON.'));
+  };
+
   return (
     <div className="min-h-screen">
       {/* Header */}
@@ -563,9 +739,18 @@ export function TemplatesPage() {
               <h1 className="v-title">Template Catalog<span className="v-cursor">_</span></h1>
               <p className="text-sm text-[var(--text-secondary)]">Deploy services from pre-configured templates</p>
             </div>
-            <div className="flex items-center gap-2 text-sm text-[var(--text-tertiary)]">
+            <div className="flex items-center gap-3 text-sm text-[var(--text-tertiary)]">
               <Layers size={16} />
               <span>{filteredTemplates.length} templates</span>
+              {signedIn && !isDemoMode ? (
+                <button
+                  type="button"
+                  onClick={openCreateEditor}
+                  className="inline-flex h-9 items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-3.5 text-[12.5px] font-semibold text-[var(--accent-on)]"
+                >
+                  <Plus size={14} /> New template
+                </button>
+              ) : null}
             </div>
           </div>
         </div>
@@ -685,12 +870,16 @@ export function TemplatesPage() {
                               <p className={`text-sm font-semibold tracking-tight ${selected ? 'text-[var(--accent-primary)]' : 'text-[var(--text-primary)]'}`}>
                                 {template.name}
                               </p>
-                              {template.isOfficial && (
+                              {template.isOfficial ? (
                                 <span className="flex items-center gap-1 px-1.5 py-0.5 rounded bg-[var(--warning-soft)] text-[var(--warning)] text-[10px] font-semibold">
                                   <Star size={8} className="fill-[var(--warning)]" />
                                   Official
                                 </span>
-                              )}
+                              ) : template.ownerId === myUserId ? (
+                                <span className="px-1.5 py-0.5 rounded bg-[var(--accent-primary-soft)] text-[var(--accent-primary)] text-[10px] font-semibold">
+                                  Mine
+                                </span>
+                              ) : null}
                             </div>
                             <div className="flex items-center gap-2 mt-1">
                               <span 
@@ -700,7 +889,7 @@ export function TemplatesPage() {
                                 {categoryLabel(template.category)}
                               </span>
                               <span className="text-[10px] text-[var(--text-tertiary)]">•</span>
-                              <span className="text-[10px] text-[var(--text-tertiary)]">{template.configRaw ? JSON.parse(template.configRaw).runtime : 'n/a'}</span>
+                              <span className="text-[10px] text-[var(--text-tertiary)]">{safeTemplateRuntime(template.configRaw)}</span>
                             </div>
                             <p className="text-xs text-[var(--text-tertiary)] mt-2 line-clamp-2 group-hover:text-[var(--text-secondary)] transition-colors">{template.description}</p>
                           </div>
@@ -777,6 +966,25 @@ export function TemplatesPage() {
                     <span className="px-3 py-1 rounded-full border border-[var(--border-subtle)] text-xs text-[var(--text-tertiary)]">
                       {selectedDetail.config.runtime || 'n/a'}
                     </span>
+                    {canManageTemplate(selectedDetail.template) ? (
+                      <>
+                        <button
+                          type="button"
+                          onClick={() => openEditEditor(selectedDetail.template)}
+                          className="inline-flex items-center gap-1 rounded-[var(--radius-md)] border border-[var(--border-subtle)] px-2.5 py-1 text-xs text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+                        >
+                          <Pencil size={11} /> Edit
+                        </button>
+                        <button
+                          type="button"
+                          onClick={() => deleteMutation.mutate(selectedDetail.template.id)}
+                          disabled={deleteMutation.isPending}
+                          className="inline-flex items-center gap-1 rounded-[var(--radius-md)] border border-[var(--border-subtle)] px-2.5 py-1 text-xs text-[var(--error)] hover:bg-[var(--error-soft)] disabled:opacity-50"
+                        >
+                          <Trash2 size={11} /> Delete
+                        </button>
+                      </>
+                    ) : null}
                   </div>
                 </div>
 
@@ -824,6 +1032,20 @@ export function TemplatesPage() {
                     </div>
                   </div>
 
+                  {!signedIn ? (
+                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-4 py-5 text-center">
+                      <p className="text-sm text-[var(--text-secondary)]">
+                        Sign in to deploy this template into one of your projects.
+                      </p>
+                      <Link
+                        to="/auth/sign-in"
+                        className="mt-3 inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-[12.5px] font-semibold text-[var(--accent-on)]"
+                      >
+                        Sign in <ArrowRight size={13} />
+                      </Link>
+                    </div>
+                  ) : (
+                  <>
                   <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
                     <div>
                       <label className="block text-xs font-medium uppercase tracking-wider text-[var(--text-muted)] mb-2">
@@ -951,12 +1173,88 @@ export function TemplatesPage() {
                       )}
                     </button>
                   </div>
+                  </>
+                  )}
                 </div>
               </>
             ) : null}
           </section>
         </div>
       </div>
+
+      {/* Template editor — JSON only */}
+      {editorOpen ? (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+          <div className="flex max-h-[90vh] w-full max-w-2xl flex-col overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--bg-base)] shadow-2xl">
+            <div className="flex items-center justify-between border-b border-[var(--border-subtle)] px-5 py-4">
+              <div>
+                <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">
+                  {editingTemplate ? `Edit ${editingTemplate.name}` : 'New template'}
+                </h2>
+                <p className="text-xs text-[var(--text-tertiary)]">
+                  JSON definition — name, category, config and variables.
+                </p>
+              </div>
+              <div className="flex items-center gap-2">
+                <label className="inline-flex cursor-pointer items-center gap-1.5 rounded-[var(--radius-md)] border border-[var(--border-default)] px-3 py-1.5 text-xs font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)]">
+                  <Upload size={12} /> Upload .json
+                  <input
+                    type="file"
+                    accept=".json,application/json"
+                    className="hidden"
+                    onChange={(e) => {
+                      const file = e.target.files?.[0];
+                      if (file) uploadJsonFile(file);
+                      e.target.value = '';
+                    }}
+                  />
+                </label>
+                <button
+                  type="button"
+                  onClick={() => setEditorOpen(false)}
+                  className="flex h-8 w-8 items-center justify-center rounded-[var(--radius-md)] text-[var(--text-tertiary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)]"
+                >
+                  <X size={15} />
+                </button>
+              </div>
+            </div>
+            <textarea
+              value={editorJson}
+              onChange={(e) => setEditorJson(e.target.value)}
+              spellCheck={false}
+              className="mono min-h-[380px] flex-1 resize-none bg-[var(--bg-void)] p-4 text-[12.5px] leading-relaxed text-[var(--text-secondary)] outline-none"
+            />
+            {editorError ? (
+              <div className="border-t border-[var(--border-subtle)] bg-[var(--error-soft)] px-5 py-2.5 text-xs text-[var(--error)]">
+                {editorError}
+              </div>
+            ) : null}
+            <div className="flex items-center justify-between border-t border-[var(--border-subtle)] px-5 py-3.5">
+              <p className="text-[11px] text-[var(--text-tertiary)]">
+                Saved as a user template — only you (and admins) can edit or delete it.
+              </p>
+              <div className="flex items-center gap-2">
+                <button
+                  type="button"
+                  onClick={() => setEditorOpen(false)}
+                  className="rounded-[var(--radius-md)] px-3.5 py-2 text-xs font-medium text-[var(--text-secondary)] hover:bg-[var(--surface-muted)]"
+                >
+                  Cancel
+                </button>
+                <button
+                  type="button"
+                  onClick={submitEditor}
+                  disabled={saveTemplateMutation.isPending}
+                  className="inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-xs font-semibold text-[var(--accent-on)] disabled:opacity-50"
+                >
+                  {saveTemplateMutation.isPending ? <Loader2 size={13} className="animate-spin" /> : null}
+                  {editingTemplate ? 'Save changes' : 'Create template'}
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
+      ) : null}
     </div>
   );
 }

app/frontend/src/features/workspace/canvas/ProjectCanvas.tsx

@@ -28,7 +28,7 @@ import {
   type CanvasNodeLayout,
   type ProjectCanvasMetadata,
 } from '../model';
-import { canvasStorageKey, loadCanvasMetadata, saveCanvasMetadata } from '../storage';
+import { hasCanvasMetadata, loadCanvasMetadata, saveCanvasMetadata } from '../storage';
 import { GroupNode, ServiceNode, type GroupNodeData, type ServiceNodeData } from './nodes';
 import {
   Plus,
@@ -287,7 +287,7 @@ function CanvasInner({ projectId, services, variablesByService, onAddService, on
     deleteMutation.isPending;
 
   useEffect(() => {
-    const hasStoredViewport = localStorage.getItem(canvasStorageKey(projectId)) !== null;
+    const hasStoredViewport = hasCanvasMetadata(projectId);
     const metadata = loadCanvasMetadata(projectId, services);
     const nextNodes = toFlowNodes(metadata, services, onOpenService);
 

app/frontend/src/features/workspace/pages/ProjectWorkspacePage.tsx

@@ -19,6 +19,7 @@ import {
   type CreateServiceInput,
 } from '@/lib/api-client';
 import { getDemoProjectById, getDemoServicesByProject, getDemoVariablesByProject } from '@/lib/demo-data';
+import { useAuthSession } from '@/lib/use-auth-session';
 import { formatDate, formatRelative } from '@/lib/time';
 import type { ServiceVariable } from '../auto-connections';
 import { ProjectCanvas } from '../canvas/ProjectCanvas';
@@ -46,10 +47,10 @@ import {
 
 type WorkspaceView = 'canvas' | 'observability' | 'logs' | 'settings';
 
-const viewItems: Array<{ key: WorkspaceView; label: string; icon: typeof LayoutGrid }> = [
+const viewItems: Array<{ key: WorkspaceView; label: string; icon: typeof LayoutGrid; authOnly?: boolean }> = [
   { key: 'canvas', label: 'Canvas', icon: LayoutGrid },
   { key: 'observability', label: 'Observability', icon: Activity },
-  { key: 'logs', label: 'Logs', icon: FileText },
+  { key: 'logs', label: 'Logs', icon: FileText, authOnly: true },
   { key: 'settings', label: 'Settings', icon: Settings },
 ];
 
@@ -345,7 +346,7 @@ function ServiceCreateDialog(props: {
                           className={`w-full flex items-center justify-between px-3 py-2 rounded-[var(--radius-sm)] text-left text-sm transition-colors ${
                             repoFullName === repo.full_name
                               ? 'bg-[var(--accent-primary-soft)] text-[var(--text-primary)]'
-                              : 'text-[var(--text-secondary)] hover:bg-[var(--surface-hover)]'
+                              : 'text-[var(--text-secondary)] hover:bg-[var(--surface-card-hover)]'
                           }`}
                         >
                           <span className="mono text-xs truncate">{repo.full_name}</span>
@@ -466,9 +467,19 @@ export function ProjectWorkspacePage() {
 
   const activeView = (searchParams.get('view') as WorkspaceView | null) ?? 'canvas';
   const isDemoMode = searchParams.get('demo') === '1';
+  const sessionQuery = useAuthSession({ enabled: !isDemoMode });
+  const signedIn = isDemoMode || Boolean(sessionQuery.data);
   const [createOpen, setCreateOpen] = useState(false);
   const [commandPaletteOpen, setCommandPaletteOpen] = useState(false);
 
+  const openAddService = () => {
+    if (!signedIn) {
+      navigate('/auth/sign-in');
+      return;
+    }
+    setCreateOpen(true);
+  };
+
   useEffect(() => {
     const down = (e: KeyboardEvent) => {
       if (e.key === 'k' && (e.metaKey || e.ctrlKey)) {
@@ -569,7 +580,8 @@ export function ProjectWorkspacePage() {
 
       return Object.fromEntries(entries) as Record<string, ServiceVariable[]>;
     },
-    enabled: !isDemoMode && services.length > 0,
+    enabled: !isDemoMode && signedIn && services.length > 0,
+    retry: false,
   });
 
   const variablesByService = isDemoMode ? getDemoVariablesByProject(projectId) : variablesQuery.data ?? {};
@@ -599,7 +611,8 @@ export function ProjectWorkspacePage() {
         })
         .slice(0, 200);
     },
-    enabled: !isDemoMode && activeView === 'logs' && services.length > 0,
+    enabled: !isDemoMode && signedIn && activeView === 'logs' && services.length > 0,
+    retry: false,
   });
 
   const runningServices = useMemo(() => services.filter((service) => service.status === 'running').length, [services]);
@@ -695,7 +708,7 @@ export function ProjectWorkspacePage() {
               {/* Add Service Button */}
               {!isDemoMode && (
                 <button
-                  onClick={() => setCreateOpen(true)}
+                  onClick={openAddService}
                   className="flex items-center gap-2 h-9 px-4 rounded-[var(--radius-md)] text-[var(--accent-on)] text-sm font-medium shadow-lg hover:shadow-xl transition-all"
                   style={{ background: 'var(--accent-primary)' }}
                 >
@@ -726,7 +739,7 @@ export function ProjectWorkspacePage() {
           {/* Sidebar Navigation */}
           <aside className="lg:sticky lg:top-6 lg:h-fit">
             <nav className="flex lg:flex-col gap-1 overflow-x-auto lg:overflow-visible pb-2 lg:pb-0">
-              {viewItems.map((item) => {
+              {viewItems.filter((item) => signedIn || !item.authOnly).map((item) => {
                 const active = activeView === item.key;
                 const Icon = item.icon;
                 return (
@@ -761,7 +774,7 @@ export function ProjectWorkspacePage() {
                 projectId={project.id}
                 services={services}
                 variablesByService={variablesByService}
-                onAddService={() => setCreateOpen(true)}
+                onAddService={openAddService}
                 onOpenService={(serviceId) => navigate(serviceHref(serviceId))}
               />
             )}
@@ -973,6 +986,10 @@ export function ProjectWorkspacePage() {
         open={commandPaletteOpen}
         onClose={() => setCommandPaletteOpen(false)}
         onAddService={(type) => {
+          if (!signedIn) {
+            navigate('/auth/sign-in');
+            return;
+          }
           setCreateOpen(true);
           toast.showToast(`Creating ${type} service...`, 'info');
         }}

app/frontend/src/features/workspace/storage.ts

@@ -151,12 +151,24 @@ export function canvasStorageKey(projectId: string): string {
   return `containr.canvas.v1.${projectId}`;
 }
 
+function canvasStorage(): Storage | null {
+  try {
+    return typeof window === 'undefined' ? null : window.localStorage;
+  } catch {
+    return null;
+  }
+}
+
+export function hasCanvasMetadata(projectId: string): boolean {
+  return canvasStorage()?.getItem(canvasStorageKey(projectId)) != null;
+}
+
 export function clearCanvasMetadata(projectId: string): void {
-  localStorage.removeItem(canvasStorageKey(projectId));
+  canvasStorage()?.removeItem(canvasStorageKey(projectId));
 }
 
 export function saveCanvasMetadata(projectId: string, metadata: ProjectCanvasMetadata): void {
-  localStorage.setItem(canvasStorageKey(projectId), JSON.stringify(metadata));
+  canvasStorage()?.setItem(canvasStorageKey(projectId), JSON.stringify(metadata));
 }
 
 export function loadCanvasMetadata(projectId: string, services: ServiceEntity[]): ProjectCanvasMetadata {
@@ -164,7 +176,7 @@ export function loadCanvasMetadata(projectId: string, services: ServiceEntity[])
   const fallback = createDefaultCanvasMetadata(services);
   const serviceIds = new Set(services.map((service) => service.id));
 
-  const raw = localStorage.getItem(key);
+  const raw = canvasStorage()?.getItem(key);
   if (!raw) {
     saveCanvasMetadata(projectId, fallback);
     return fallback;