Merge pull request #8 from ShukeBta/feat/port-vue-ui-features

feat(web): port AI Assistant, STRM management, and admin tools pages from Vue UI

internal/handler/assistant.go

@@ -0,0 +1,147 @@
+// Package handler — multi-turn AI assistant chat endpoints.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func listAssistantSessionsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		role, _ := c.Get(middleware.CtxUserRole)
+		rows, err := svc.Assistant.ListSessions(
+			c.Request.Context(), toString(uid), role == "admin",
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, rows)
+	}
+}
+
+type createSessionReq struct {
+	Title string `json:"title"`
+}
+
+func createAssistantSessionHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req createSessionReq
+		_ = c.ShouldBindJSON(&req)
+		uid, _ := c.Get(middleware.CtxUserID)
+		sess, err := svc.Assistant.CreateSession(c.Request.Context(), toString(uid), req.Title)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, sess)
+	}
+}
+
+func getAssistantSessionHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		role, _ := c.Get(middleware.CtxUserRole)
+		view, err := svc.Assistant.GetSession(
+			c.Request.Context(), c.Param("id"), toString(uid), role == "admin",
+		)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, view)
+	}
+}
+
+func deleteAssistantSessionHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		role, _ := c.Get(middleware.CtxUserRole)
+		if err := svc.Assistant.DeleteSession(
+			c.Request.Context(), c.Param("id"), toString(uid), role == "admin",
+		); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+type chatReq struct {
+	SessionID string `json:"session_id" binding:"required"`
+	Message   string `json:"message" binding:"required"`
+}
+
+func assistantChatHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req chatReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		uid, _ := c.Get(middleware.CtxUserID)
+		role, _ := c.Get(middleware.CtxUserRole)
+		view, err := svc.Assistant.Chat(
+			c.Request.Context(), req.SessionID, toString(uid), req.Message, role == "admin",
+		)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, view)
+	}
+}
+
+type executeReq struct {
+	SessionID string                 `json:"session_id" binding:"required"`
+	Action    map[string]interface{} `json:"action" binding:"required"`
+}
+
+func assistantExecuteHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req executeReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		uid, _ := c.Get(middleware.CtxUserID)
+		opID, err := svc.Assistant.Execute(
+			c.Request.Context(), req.SessionID, toString(uid), req.Action,
+		)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"op_id": opID})
+	}
+}
+
+func assistantUndoHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.Assistant.Undo(c.Request.Context(), c.Param("op_id")); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+func assistantHistoryHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		role, _ := c.Get(middleware.CtxUserRole)
+		rows, err := svc.Assistant.History(
+			c.Request.Context(), toString(uid), role == "admin",
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"items": rows})
+	}
+}

internal/handler/auth_extra.go

@@ -0,0 +1,44 @@
+// Package handler — auth surface beyond /login + /register:
+//
+//	POST /auth/refresh   — issue a fresh JWT for the current user
+//	POST /auth/logout    — best-effort no-op (kept for parity)
+//	PATCH /auth/profile  — alias for /me
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// refreshHandler returns a fresh token signed for the current user.
+// Because we don't track refresh tokens server-side, the caller's
+// existing access token is sufficient — it must already pass the
+// AuthRequired middleware.
+func refreshHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		u, err := svc.Repo.User.FindByID(c.Request.Context(), toString(uid))
+		if err != nil || u == nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid session"})
+			return
+		}
+		token, err := svc.Auth.IssueToken(u)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"token": token, "user": u})
+	}
+}
+
+// logoutHandler is a deliberate no-op (we use stateless JWT). It exists
+// so the Vue frontend's logout button gets a 200 instead of 404.
+func logoutHandler(_ *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Status(http.StatusNoContent)
+	}
+}

internal/handler/discover_extra.go

@@ -0,0 +1,79 @@
+// Package handler — multi-section discover endpoints.
+//
+// The Vue DiscoverView paginates a configurable list of "sections"
+// (trending day/week, popular movies, top rated, etc.) and asks the
+// backend for a feed keyed by section name. We mirror that surface so
+// the React DiscoverPage can render the same rails without a rewrite.
+package handler
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// discoverSectionsHandler returns the catalog of sections the UI can
+// pick from. The names match the upstream Vue UI so existing settings
+// keep working.
+func discoverSectionsHandler(_ *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{
+			"sections": []gin.H{
+				{"key": "trending_day", "label": "今日热门"},
+				{"key": "trending_week", "label": "本周热门"},
+				{"key": "popular_movie", "label": "热门电影"},
+				{"key": "popular_tv", "label": "热门剧集"},
+				{"key": "top_rated_movie", "label": "高分电影"},
+				{"key": "upcoming_movie", "label": "即将上映"},
+			},
+		})
+	}
+}
+
+// discoverFeedHandler resolves one or more section keys (?sections=a,b)
+// to TMDb endpoint paths and returns the joined results keyed by
+// section name. Unknown keys are silently dropped so URL typos don't
+// break the page.
+func discoverFeedHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		keys := strings.Split(c.DefaultQuery("sections", "trending_day,popular_movie"), ",")
+		out := gin.H{}
+		for _, raw := range keys {
+			k := strings.TrimSpace(raw)
+			path := sectionPath(k)
+			if path == "" {
+				continue
+			}
+			items, err := svc.Discover.Fetch(c.Request.Context(), path)
+			if err != nil {
+				svc.Log.Debug("discover fetch failed", )
+				items = nil
+			}
+			out[k] = items
+		}
+		c.JSON(http.StatusOK, out)
+	}
+}
+
+// sectionPath maps the UI-facing key to the TMDb endpoint suffix.
+func sectionPath(k string) string {
+	switch k {
+	case "trending_day":
+		return "/trending/movie/day"
+	case "trending_week":
+		return "/trending/movie/week"
+	case "popular_movie":
+		return "/movie/popular"
+	case "popular_tv":
+		return "/tv/popular"
+	case "top_rated_movie":
+		return "/movie/top_rated"
+	case "upcoming_movie":
+		return "/movie/upcoming"
+	default:
+		return ""
+	}
+}

internal/handler/dlna_extra.go

@@ -0,0 +1,129 @@
+// Package handler — per-renderer DLNA control endpoints used by the
+// Vue UI. These are best-effort SOAP calls; failures surface as 4xx.
+package handler
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// dlnaControlPath maps the action name to the AVTransport SOAP body.
+// (kept for parity with the upstream Vue admin UI)
+type dlnaAction string
+
+const (
+	_dlnaPlay  dlnaAction = "Play"
+	_dlnaPause dlnaAction = "Pause"
+	_dlnaStop  dlnaAction = "Stop"
+)
+
+var _ = []dlnaAction{_dlnaPlay, _dlnaPause, _dlnaStop}
+
+// findRendererControlURL returns the cached control URL for the given
+// uuid (matched against the device UDN). We rely on DLNAService's
+// existing Discover() cache.
+func findRendererControlURL(ctx context.Context, svc *service.Container, uuid string) (string, error) {
+	devs, err := svc.DLNA.Discover(ctx, false)
+	if err != nil {
+		return "", err
+	}
+	for _, d := range devs {
+		if d.UDN == uuid || strings.HasSuffix(d.UDN, uuid) {
+			return d.ControlURL, nil
+		}
+	}
+	return "", errors.New("renderer not found")
+}
+
+// dlnaPlayHandler resumes playback on the chosen renderer.
+func dlnaPlayHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		controlURL, err := findRendererControlURL(c.Request.Context(), svc, c.Param("uuid"))
+		if err != nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+			return
+		}
+		envelope := buildSimpleAVTransport("Play", `<Speed>1</Speed>`)
+		if err := svc.DLNA.SOAP(c.Request.Context(), controlURL, "Play", envelope); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// dlnaPauseHandler pauses playback on the chosen renderer.
+func dlnaPauseHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		controlURL, err := findRendererControlURL(c.Request.Context(), svc, c.Param("uuid"))
+		if err != nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+			return
+		}
+		envelope := buildSimpleAVTransport("Pause", "")
+		if err := svc.DLNA.SOAP(c.Request.Context(), controlURL, "Pause", envelope); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// dlnaStopHandler stops playback.
+func dlnaStopHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		controlURL, err := findRendererControlURL(c.Request.Context(), svc, c.Param("uuid"))
+		if err != nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+			return
+		}
+		envelope := buildSimpleAVTransport("Stop", "")
+		if err := svc.DLNA.SOAP(c.Request.Context(), controlURL, "Stop", envelope); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// dlnaStatusHandler returns "playing" / "paused" / "stopped" via
+// GetTransportInfo. We don't parse the response — the UI can read the
+// raw body via the upstream proxy if it needs more detail.
+func dlnaStatusHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		controlURL, err := findRendererControlURL(c.Request.Context(), svc, c.Param("uuid"))
+		if err != nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+			return
+		}
+		envelope := buildSimpleAVTransport("GetTransportInfo", "")
+		if err := svc.DLNA.SOAP(c.Request.Context(), controlURL, "GetTransportInfo", envelope); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// buildSimpleAVTransport assembles a SOAP body for the given action +
+// extra body fragment.  InstanceID is hard-coded to 0 (single zone).
+func buildSimpleAVTransport(action string, extra string) string {
+	return fmt.Sprintf(
+		`<?xml version="1.0" encoding="utf-8"?>
+<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
+            s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
+  <s:Body>
+    <u:%s xmlns:u="urn:schemas-upnp-org:service:AVTransport:1">
+      <InstanceID>0</InstanceID>%s
+    </u:%s>
+  </s:Body>
+</s:Envelope>`, action, extra, action,
+	)
+}

internal/handler/download_clients.go

@@ -0,0 +1,90 @@
+// Package handler — download client (qBittorrent / Aria2 / Transmission)
+// configuration endpoints.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func listDownloadClientsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		rows, err := svc.DownloadClients.List(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, rows)
+	}
+}
+
+func createDownloadClientHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.DownloadClientInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		row, err := svc.DownloadClients.Create(c.Request.Context(), in)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func updateDownloadClientHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.DownloadClientInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		row, err := svc.DownloadClients.Update(c.Request.Context(), c.Param("id"), in)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func deleteDownloadClientHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.DownloadClients.Delete(c.Request.Context(), c.Param("id")); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+func testDownloadClientHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.DownloadClients.Test(c.Request.Context(), c.Param("id")); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"ok": false, "error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+func aria2StatsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		clientID := c.Query("client_id")
+		if clientID == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "client_id required"})
+			return
+		}
+		out, err := svc.DownloadClients.Aria2GlobalStats(c.Request.Context(), clientID)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, out)
+	}
+}

internal/handler/downloads_extra.go

@@ -0,0 +1,117 @@
+// Package handler — pause/resume/organize on individual download tasks
+// and a thin sync-trigger surface used by the Vue UI's auto-sync toggle.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// downloadPauseHandler is a thin alias — the underlying qBittorrent
+// service exposes pause via the WebUI; we mark our local row too so
+// the React UI shows the right state on next refresh.
+func downloadPauseHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Model(&model.DownloadTask{}).
+			Where("id = ?", c.Param("id")).
+			Update("status", "paused").Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// downloadResumeHandler marks the row as queued so the next poll picks it up.
+func downloadResumeHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Model(&model.DownloadTask{}).
+			Where("id = ?", c.Param("id")).
+			Update("status", "queued").Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// downloadOrganizeOneHandler runs the file organizer for one task.
+// It looks up the task, then delegates to OrganizerService.OrganizePath().
+func downloadOrganizeOneHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var t model.DownloadTask
+		if err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Where("id = ?", c.Param("id")).First(&t).Error; err != nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "task not found"})
+			return
+		}
+		if t.SavePath == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "task has no save_path"})
+			return
+		}
+		// We don't have a per-path organizer right now; return the
+		// path the caller would scan. The general OrganizeAll endpoint
+		// (below) is the supported workflow.
+		c.JSON(http.StatusOK, gin.H{
+			"ok":   true,
+			"path": t.SavePath,
+			"note": "use POST /api/download/organize to bulk-organize",
+		})
+	}
+}
+
+// downloadOrganizeAllHandler triggers a bulk re-organize. This is a
+// thin wrapper that lists every saved path and delegates to the
+// existing OrganizerService for each library that contains those files.
+func downloadOrganizeAllHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// Walk each library and re-organize. The OrganizerService is
+		// idempotent so this is safe to run repeatedly.
+		libs, err := svc.Repo.Library.List(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		results := make([]any, 0, len(libs))
+		for _, l := range libs {
+			res, err := svc.Organizer.OrganizeLibrary(c.Request.Context(), l.ID)
+			if err != nil {
+				results = append(results, gin.H{"library": l.Name, "error": err.Error()})
+				continue
+			}
+			results = append(results, gin.H{"library": l.Name, "result": res})
+		}
+		c.JSON(http.StatusOK, gin.H{"results": results})
+	}
+}
+
+// downloadSyncHandler triggers the qBittorrent reload + immediate poll.
+func downloadSyncHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.Downloads.ReloadConfig(c.Request.Context()); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// downloadAutoSyncHandler is a no-op stub — the poll loop already runs
+// continuously. Returning 200 keeps the Vue UI's toggle happy.
+func downloadAutoSyncHandler(_ *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true, "auto_sync": true})
+	}
+}
+
+// downloadTasksAliasHandler is the alias used by the Vue UI; it
+// returns the same shape as listDownloadsHandler but at /download/tasks.
+func downloadTasksAliasHandler(svc *service.Container) gin.HandlerFunc {
+	return listDownloadsHandler(svc)
+}

internal/handler/handler.go

@@ -138,6 +138,123 @@ func Register(r *gin.Engine, cfg *config.Config, log *zap.Logger, svc *service.C
 			authed.GET("/recycle", middleware.AdminRequired(), listRecycleHandler(svc))
 
 			authed.GET("/ws", wsHandler(svc))
+
+			// ── Auxiliary endpoints used by the React UI rails ──
+			authed.GET("/media/recent", recentMediaHandler(svc))
+			authed.GET("/media/stats", mediaStatsHandler(svc))
+
+			// Watch history (extra surface beyond /history).
+			authed.GET("/watch-history", historyListHandler(svc))
+			authed.GET("/watch-history/stats", historyStatsHandler(svc))
+			authed.GET("/watch-history/continue", historyContinueHandler(svc))
+			authed.DELETE("/watch-history", historyDeleteHandler(svc))
+			authed.DELETE("/watch-history/:id", historyDeleteOneHandler(svc))
+
+			// Multi-section TMDb feed used by DiscoverPage.
+			authed.GET("/discover/sections", discoverSectionsHandler(svc))
+			authed.GET("/discover/feed", discoverFeedHandler(svc))
+
+			// System metadata + read-only scheduler view.
+			authed.GET("/system/info", systemInfoHandler(svc))
+			authed.GET("/system/status", systemStatusHandler(svc))
+			authed.GET("/system/scheduler", systemSchedulerHandler(svc))
+
+			// Richer dashboard rails.
+			authed.GET("/stats/overview", statsOverviewHandler(svc))
+			authed.GET("/stats/trend", statsTrendHandler(svc))
+			authed.GET("/stats/top-content", statsTopContentHandler(svc))
+			authed.GET("/stats/libraries", statsLibrariesHandler(svc))
+			authed.GET("/stats/monitor", statsMonitorHandler(svc))
+
+			// Multi-persona play profiles (caller-scoped, admins via ?all=true).
+			authed.GET("/play-profiles", listPlayProfilesHandler(svc))
+			authed.POST("/play-profiles", createPlayProfileHandler(svc))
+			authed.PUT("/play-profiles/:id", updatePlayProfileHandler(svc))
+			authed.DELETE("/play-profiles/:id", deletePlayProfileHandler(svc))
+
+			// ── Auth extras ──
+			authed.POST("/auth/refresh", refreshHandler(svc))
+			authed.POST("/auth/logout", logoutHandler(svc))
+			authed.GET("/auth/me", meHandler(svc))
+			authed.PATCH("/auth/profile", updateProfileHandler(svc))
+			authed.POST("/auth/change-password", changePasswordHandler(svc))
+			authed.GET("/auth/permissions", myPermissionsHandler(svc))
+
+			// ── Search aliases ──
+			authed.GET("/search", searchUnifiedHandler(svc))
+			authed.GET("/search/advanced", searchAdvancedHandler(svc))
+			authed.GET("/search/tmdb", searchTMDbHandler(svc))
+			authed.GET("/search/sites", searchSitesHandler(svc))
+
+			// ── System extras ──
+			authed.GET("/system/config", listSystemConfigHandler(svc))
+			authed.GET("/settings/schema", schemaHandler(svc))
+			authed.GET("/system/events/ticket", systemEventsTicketHandler(svc))
+
+			// ── Per-user stats ──
+			authed.GET("/stats/user/:id", statsUserHandler(svc))
+			authed.GET("/stats/top-users", statsTopUsersHandler(svc))
+			authed.POST("/stats/play", statsPlayHandler(svc))
+
+			// ── Sites extras ──
+			authed.GET("/sites/:id/resource", siteResourceHandler(svc))
+			authed.GET("/sites/:id/userdata", siteUserdataHandler(svc))
+
+			// ── Subscription extras ──
+			authed.PUT("/subscriptions/:id", updateSubscriptionHandler(svc))
+			authed.POST("/subscriptions/:id/search", searchSubscriptionHandler(svc))
+
+			// ── Playlist extras ──
+			authed.POST("/playlists/:id/reorder", reorderPlaylistHandler(svc))
+			authed.DELETE("/playlists/:id/items/by-id/:item_id", deletePlaylistItemByIDHandler(svc))
+
+			// ── DLNA per-renderer control ──
+			authed.POST("/dlna/:uuid/play", dlnaPlayHandler(svc))
+			authed.POST("/dlna/:uuid/pause", dlnaPauseHandler(svc))
+			authed.POST("/dlna/:uuid/stop", dlnaStopHandler(svc))
+			authed.GET("/dlna/:uuid/status", dlnaStatusHandler(svc))
+
+			// ── Media favourite alias surface ──
+			authed.GET("/favorites", listFavoritesAliasHandler(svc))
+			authed.POST("/media/:id/favorite", addMediaFavoriteHandler(svc))
+			authed.DELETE("/media/:id/favorite", removeMediaFavoriteHandler(svc))
+			authed.GET("/media/:id/favorite/status", getMediaFavoriteStatusHandler(svc))
+			authed.POST("/media/:id/ai-scrape", aiScrapeMediaHandler(svc))
+			authed.POST("/media/scrape/test", scrapeTestHandler(svc))
+			authed.POST("/media/organize", middleware.AdminRequired(), organizeBulkHandler(svc))
+
+			// ── Playback metadata + external player handoff ──
+			authed.GET("/playback/:id/info", playbackInfoHandler(svc))
+			authed.POST("/playback/:id/progress", playbackProgressHandler(svc))
+			authed.GET("/playback/:id/external-players", externalPlayersHandler(svc))
+			authed.GET("/playback/:id/external-url", externalURLHandler(svc))
+			authed.GET("/playback/transcode/:job_id/status", transcodeStatusHandler(svc))
+
+			// ── Download task ops + sync triggers ──
+			authed.POST("/download/:id/pause", downloadPauseHandler(svc))
+			authed.POST("/download/:id/resume", downloadResumeHandler(svc))
+			authed.POST("/download/:id/organize", middleware.AdminRequired(), downloadOrganizeOneHandler(svc))
+			authed.POST("/download/organize", middleware.AdminRequired(), downloadOrganizeAllHandler(svc))
+			authed.POST("/download/sync", middleware.AdminRequired(), downloadSyncHandler(svc))
+			authed.POST("/download/start-auto-sync", middleware.AdminRequired(), downloadAutoSyncHandler(svc))
+			authed.GET("/download/tasks", downloadTasksAliasHandler(svc))
+			authed.POST("/download/add", addDownloadHandler(svc))
+
+			// ── License (anyone authenticated can activate / heartbeat) ──
+			authed.POST("/license/activate", licenseActivateHandler(svc))
+			authed.POST("/license/heartbeat", licenseHeartbeatHandler(svc))
+			authed.GET("/license/status", licenseStatusHandler(svc))
+			authed.GET("/license/heartbeat-status", licenseStatusHandler(svc))
+
+			// ── Assistant (multi-turn AI chat) ──
+			authed.GET("/admin/assistant/sessions", listAssistantSessionsHandler(svc))
+			authed.POST("/admin/assistant/sessions", createAssistantSessionHandler(svc))
+			authed.GET("/admin/assistant/session/:id", getAssistantSessionHandler(svc))
+			authed.DELETE("/admin/assistant/session/:id", deleteAssistantSessionHandler(svc))
+			authed.POST("/admin/assistant/chat", assistantChatHandler(svc))
+			authed.POST("/admin/assistant/execute", assistantExecuteHandler(svc))
+			authed.POST("/admin/assistant/undo/:op_id", assistantUndoHandler(svc))
+			authed.GET("/admin/assistant/history", assistantHistoryHandler(svc))
 		}
 
 		// Admin-only endpoints.
@@ -151,6 +268,35 @@ func Register(r *gin.Engine, cfg *config.Config, log *zap.Logger, svc *service.C
 			admin.PUT("/settings", updateSettingHandler(svc))
 			admin.GET("/logs", recentLogsHandler(svc))
 
+			// Permissions admin.
+			admin.GET("/users/:id/permissions", getUserPermissionsHandler(svc))
+			admin.PUT("/users/:id/permissions", updateUserPermissionsHandler(svc))
+			admin.POST("/users/:id/permissions/reset", resetUserPermissionsHandler(svc))
+
+			// Storage configs (Alist / S3 / WebDAV).
+			admin.GET("/storage/status", listStorageConfigsHandler(svc))
+			admin.GET("/storage/:type", getStorageConfigHandler(svc))
+			admin.PUT("/storage/:type", saveStorageConfigHandler(svc))
+			admin.POST("/storage/:type/test", testStorageConfigHandler(svc))
+
+			// Download client CRUD.
+			admin.GET("/download/clients", listDownloadClientsHandler(svc))
+			admin.POST("/download/clients", createDownloadClientHandler(svc))
+			admin.PUT("/download/clients/:id", updateDownloadClientHandler(svc))
+			admin.DELETE("/download/clients/:id", deleteDownloadClientHandler(svc))
+			admin.POST("/download/clients/:id/test", testDownloadClientHandler(svc))
+			admin.GET("/download/aria2/stats", aria2StatsHandler(svc))
+
+			// License generation / revocation.
+			admin.POST("/license/generate", licenseGenerateHandler(svc))
+			admin.GET("/license/list", licenseListHandler(svc))
+			admin.GET("/license/:id/activations", licenseListActivationsHandler(svc))
+			admin.POST("/license/activation/:id/unbind", licenseUnbindHandler(svc))
+			admin.POST("/license/:id/revoke", licenseRevokeHandler(svc))
+
+			// System scheduler trigger alias.
+			admin.POST("/system/scheduler/:name/trigger", schedulerTriggerHandler(svc))
+
 			// Database backup.
 			admin.GET("/backups", listBackupsHandler(svc))
 			admin.POST("/backups", createBackupHandler(svc))
@@ -160,6 +306,13 @@ func Register(r *gin.Engine, cfg *config.Config, log *zap.Logger, svc *service.C
 			// Notifications (test endpoint).
 			admin.POST("/notify/test", notifyTestHandler(svc))
 
+			// Notify channels CRUD + per-channel test.
+			admin.GET("/notify/channels", listNotifyChannelsHandler(svc))
+			admin.POST("/notify/channels", createNotifyChannelHandler(svc))
+			admin.PUT("/notify/channels/:id", updateNotifyChannelHandler(svc))
+			admin.DELETE("/notify/channels/:id", deleteNotifyChannelHandler(svc))
+			admin.POST("/notify/channels/:id/test", testNotifyChannelHandler(svc))
+
 			// File organizer.
 			admin.POST("/media/:id/organize", organizeMediaHandler(svc))
 			admin.POST("/libraries/:id/organize", organizeLibraryHandler(svc))

internal/handler/license.go

@@ -0,0 +1,145 @@
+// Package handler — license key endpoints.
+package handler
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+type generateKeyReq struct {
+	Customer       string `json:"customer"`
+	Plan           string `json:"plan"`
+	MaxActivations int    `json:"max_activations"`
+	ExpiresAt      string `json:"expires_at,omitempty"` // RFC3339, "" = perpetual
+	Notes          string `json:"notes,omitempty"`
+}
+
+func licenseGenerateHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req generateKeyReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		var expires *time.Time
+		if req.ExpiresAt != "" {
+			t, err := time.Parse(time.RFC3339, req.ExpiresAt)
+			if err != nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "expires_at must be RFC3339"})
+				return
+			}
+			expires = &t
+		}
+		k, err := svc.License.Generate(
+			c.Request.Context(),
+			req.Customer, req.Plan, req.Notes,
+			req.MaxActivations, expires,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, k)
+	}
+}
+
+func licenseListHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		rows, err := svc.License.List(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, rows)
+	}
+}
+
+type activateReq struct {
+	Key        string `json:"key" binding:"required"`
+	DeviceID   string `json:"device_id" binding:"required"`
+	DeviceName string `json:"device_name"`
+}
+
+func licenseActivateHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req activateReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		a, err := svc.License.Activate(
+			c.Request.Context(), req.Key, req.DeviceID, req.DeviceName, c.ClientIP(),
+		)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, a)
+	}
+}
+
+func licenseListActivationsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		rows, err := svc.License.ListActivations(c.Request.Context(), c.Param("id"))
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, rows)
+	}
+}
+
+func licenseUnbindHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.License.Unbind(c.Request.Context(), c.Param("id")); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+func licenseRevokeHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.License.Revoke(c.Request.Context(), c.Param("id")); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+func licenseHeartbeatHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		actID := c.Query("activation_id")
+		if actID == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "activation_id required"})
+			return
+		}
+		if err := svc.License.Heartbeat(c.Request.Context(), actID); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+func licenseStatusHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		keyID := c.Query("key_id")
+		if keyID == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "key_id required"})
+			return
+		}
+		out, err := svc.License.Status(c.Request.Context(), keyID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, out)
+	}
+}

internal/handler/media_extra.go

@@ -0,0 +1,70 @@
+// Package handler — auxiliary media endpoints used by the home page
+// rails (recent additions) and the admin dashboard summary card.
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func recentMediaHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "12"))
+		if limit <= 0 || limit > 100 {
+			limit = 12
+		}
+		var items []model.Media
+		if err := svc.Repo.DB.Order("created_at desc").Limit(limit).Find(&items).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, items)
+	}
+}
+
+func mediaStatsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var totals struct {
+			Movies   int64 `json:"movies"`
+			TV       int64 `json:"tv"`
+			Anime    int64 `json:"anime"`
+			Music    int64 `json:"music"`
+			Unscaped int64 `json:"unscraped"`
+		}
+		// Per-library type rolls up to per-media-type via the JOIN.
+		_ = svc.Repo.DB.Model(&model.Media{}).
+			Joins("JOIN libraries ON libraries.id = media.library_id").
+			Where("libraries.type = ?", "movie").Count(&totals.Movies).Error
+		_ = svc.Repo.DB.Model(&model.Media{}).
+			Joins("JOIN libraries ON libraries.id = media.library_id").
+			Where("libraries.type = ?", "tv").Count(&totals.TV).Error
+		_ = svc.Repo.DB.Model(&model.Media{}).
+			Joins("JOIN libraries ON libraries.id = media.library_id").
+			Where("libraries.type = ?", "anime").Count(&totals.Anime).Error
+		_ = svc.Repo.DB.Model(&model.Media{}).
+			Joins("JOIN libraries ON libraries.id = media.library_id").
+			Where("libraries.type = ?", "music").Count(&totals.Music).Error
+		_ = svc.Repo.DB.Model(&model.Media{}).
+			Where("scrape_status IS NULL OR scrape_status = '' OR scrape_status = 'pending'").
+			Count(&totals.Unscaped).Error
+
+		var totalCount, totalSize, totalSeconds int64
+		_ = svc.Repo.DB.Model(&model.Media{}).Count(&totalCount).Error
+		_ = svc.Repo.DB.Model(&model.Media{}).
+			Select("COALESCE(SUM(size_bytes),0)").Row().Scan(&totalSize)
+		_ = svc.Repo.DB.Model(&model.Media{}).
+			Select("COALESCE(SUM(duration_sec),0)").Row().Scan(&totalSeconds)
+
+		c.JSON(http.StatusOK, gin.H{
+			"by_type":       totals,
+			"total":         totalCount,
+			"total_size":    totalSize,
+			"total_seconds": totalSeconds,
+		})
+	}
+}

internal/handler/media_favorite.go

@@ -0,0 +1,141 @@
+// Package handler — alias endpoints used by the Vue UI's media detail
+// page that map onto the existing /favourites surface.
+//
+//	POST   /media/:id/favorite        → add to favourites
+//	DELETE /media/:id/favorite        → remove from favourites
+//	GET    /media/:id/favorite/status → boolean
+//	GET    /favorites                 → alias of /favourites
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// addMediaFavoriteHandler ensures the (user, media) row exists. If it
+// already does we return 200 with favourite=true so the call is
+// idempotent — different from the Toggle behaviour.
+func addMediaFavoriteHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		// Check current state.
+		var existing model.Favorite
+		err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Where("user_id = ? AND media_id = ?", uid, c.Param("id")).
+			First(&existing).Error
+		if err == nil {
+			c.JSON(http.StatusOK, gin.H{"favourite": true})
+			return
+		}
+		// Otherwise create.
+		fav := &model.Favorite{UserID: toString(uid), MediaID: c.Param("id")}
+		if err := svc.Repo.DB.WithContext(c.Request.Context()).Create(fav).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"favourite": true})
+	}
+}
+
+// removeMediaFavoriteHandler is the idempotent inverse.
+func removeMediaFavoriteHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		if err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Where("user_id = ? AND media_id = ?", uid, c.Param("id")).
+			Delete(&model.Favorite{}).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"favourite": false})
+	}
+}
+
+// getMediaFavoriteStatusHandler returns the current state.
+func getMediaFavoriteStatusHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		var n int64
+		_ = svc.Repo.DB.WithContext(c.Request.Context()).
+			Model(&model.Favorite{}).
+			Where("user_id = ? AND media_id = ?", uid, c.Param("id")).
+			Count(&n).Error
+		c.JSON(http.StatusOK, gin.H{"favourite": n > 0})
+	}
+}
+
+// listFavoritesAliasHandler is the /favorites alias of /favourites.
+// We reuse the existing service method.
+func listFavoritesAliasHandler(svc *service.Container) gin.HandlerFunc {
+	return listFavouritesHandler(svc)
+}
+
+// aiScrapeMediaHandler asks the scraper to enrich one media row using
+// AI-assisted matching. Today we just delegate to the existing scrape
+// path; the AI hint comes from svc.AI when configured.
+func aiScrapeMediaHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		m, err := svc.Repo.Media.FindByID(c.Request.Context(), c.Param("id"))
+		if err != nil || m == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "media not found"})
+			return
+		}
+		if err := svc.Scraper.EnrichOne(c.Request.Context(), m); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, m)
+	}
+}
+
+// scrapeTestHandler validates a (provider, code) pair without touching
+// the database.  Useful for the "preview" workflow in the Vue UI.
+type scrapeTestReq struct {
+	Code string `json:"code" binding:"required"`
+}
+
+func scrapeTestHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req scrapeTestReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		// Try TMDb first; the upstream chain handles fall-back to
+		// Bangumi/TheTVDB when configured.
+		match, err := svc.TMDb.SearchMovie(c.Request.Context(), req.Code, 0)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"match": match})
+	}
+}
+
+// organizeBulkHandler triggers organisation across every library when
+// the caller hits POST /media/organize without a media id. It mirrors
+// the upstream Vue surface.
+func organizeBulkHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		libs, err := svc.Repo.Library.List(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		out := make([]any, 0, len(libs))
+		for _, l := range libs {
+			res, err := svc.Organizer.OrganizeLibrary(c.Request.Context(), l.ID)
+			if err != nil {
+				out = append(out, gin.H{"library": l.Name, "error": err.Error()})
+				continue
+			}
+			out = append(out, gin.H{"library": l.Name, "result": res})
+		}
+		c.JSON(http.StatusOK, gin.H{"results": out})
+	}
+}

internal/handler/notify_channels.go

@@ -0,0 +1,73 @@
+// Package handler — notify channel CRUD + per-channel test endpoint.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func listNotifyChannelsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		rows, err := svc.NotifyChannels.List(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, rows)
+	}
+}
+
+func createNotifyChannelHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.ChannelInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		row, err := svc.NotifyChannels.Create(c.Request.Context(), in)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func updateNotifyChannelHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.ChannelInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		row, err := svc.NotifyChannels.Update(c.Request.Context(), c.Param("id"), in)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func deleteNotifyChannelHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.NotifyChannels.Delete(c.Request.Context(), c.Param("id")); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+func testNotifyChannelHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.NotifyChannels.Test(c.Request.Context(), c.Param("id")); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"message": "test sent"})
+	}
+}

internal/handler/permissions.go

@@ -0,0 +1,74 @@
+// Package handler — per-user feature toggle endpoints.
+//
+//	GET /auth/permissions          → caller's effective permissions
+//	GET /admin/users/:id/permissions
+//	PUT /admin/users/:id/permissions
+//	POST /admin/users/:id/permissions/reset
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func myPermissionsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		row, err := svc.Permissions.Effective(c.Request.Context(), toString(uid))
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		if row == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func getUserPermissionsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		row, err := svc.Permissions.Effective(c.Request.Context(), c.Param("id"))
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		if row == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func updateUserPermissionsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var p model.UserPermission
+		if err := c.ShouldBindJSON(&p); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		if err := svc.Permissions.Save(c.Request.Context(), c.Param("id"), &p); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, p)
+	}
+}
+
+func resetUserPermissionsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		row, err := svc.Permissions.Reset(c.Request.Context(), c.Param("id"))
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}

internal/handler/play_profile.go

@@ -0,0 +1,86 @@
+// Package handler — multi-persona play profile CRUD endpoints.
+//
+// Non-admin users see / mutate only their own profiles. Admins see
+// every profile so they can manage child accounts, etc.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// listPlayProfilesHandler returns the caller's profiles, or every
+// profile when the caller is an admin AND ?all=true is set.
+func listPlayProfilesHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		role, _ := c.Get(middleware.CtxUserRole)
+		if c.Query("all") == "true" && role == "admin" {
+			rows, err := svc.PlayProfiles.List(c.Request.Context())
+			if err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+			c.JSON(http.StatusOK, rows)
+			return
+		}
+		rows, err := svc.PlayProfiles.ListByUser(c.Request.Context(), toString(uid))
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, rows)
+	}
+}
+
+func createPlayProfileHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.PlayProfileInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		// Default the user_id to the caller; admins can override.
+		uid, _ := c.Get(middleware.CtxUserID)
+		role, _ := c.Get(middleware.CtxUserRole)
+		if in.UserID == "" || role != "admin" {
+			in.UserID = toString(uid)
+		}
+		row, err := svc.PlayProfiles.Create(c.Request.Context(), in)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func updatePlayProfileHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.PlayProfileInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		row, err := svc.PlayProfiles.Update(c.Request.Context(), c.Param("id"), in)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+func deletePlayProfileHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.PlayProfiles.Delete(c.Request.Context(), c.Param("id")); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}

internal/handler/playback_extra.go

@@ -0,0 +1,130 @@
+// Package handler — playback metadata endpoints expected by the Vue UI:
+//
+//	GET  /playback/:id/info
+//	POST /playback/:id/progress
+//	GET  /playback/:id/external-players
+//	GET  /playback/:id/external-url
+//	GET  /playback/transcode/:job_id/status
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// playbackInfoHandler returns the media row + a `stream_url` the React
+// player can hit. Mirrors the Python project's surface.
+func playbackInfoHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		m, err := svc.Repo.Media.FindByID(c.Request.Context(), c.Param("id"))
+		if err != nil || m == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "media not found"})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{
+			"media":       m,
+			"stream_url":  "/api/stream/" + m.ID,
+			"hls_url":     "/api/hls/" + m.ID + "/index.m3u8",
+		})
+	}
+}
+
+type playbackProgressReq struct {
+	PositionMs int64 `json:"position_ms"`
+	DurationMs int64 `json:"duration_ms"`
+	Completed  bool  `json:"completed"`
+}
+
+func playbackProgressHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req playbackProgressReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		uid, _ := c.Get(middleware.CtxUserID)
+		if err := svc.Playback.RecordProgress(
+			c.Request.Context(), toString(uid), c.Param("id"),
+			req.PositionMs, req.DurationMs,
+		); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+// externalPlayersHandler returns the list of external player URI
+// schemes the UI can offer the user. We lookup the media row to
+// produce the per-player launch URL.
+func externalPlayersHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		m, err := svc.Repo.Media.FindByID(c.Request.Context(), c.Param("id"))
+		if err != nil || m == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "media not found"})
+			return
+		}
+		streamURL := "/api/stream/" + m.ID
+		c.JSON(http.StatusOK, gin.H{
+			"players": []gin.H{
+				{"name": "VLC", "scheme": "vlc://", "url": "vlc://" + streamURL},
+				{"name": "PotPlayer", "scheme": "potplayer://", "url": "potplayer://" + streamURL},
+				{"name": "MX Player", "scheme": "intent://", "url": "intent://" + streamURL + "#Intent;package=com.mxtech.videoplayer.ad;end"},
+				{"name": "IINA", "scheme": "iina://", "url": "iina://weblink?url=" + streamURL},
+				{"name": "nPlayer", "scheme": "nplayer-", "url": "nplayer-" + streamURL},
+			},
+		})
+	}
+}
+
+// externalURLHandler returns just the raw stream URL plus the auth
+// token query string the external player needs.
+func externalURLHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		m, err := svc.Repo.Media.FindByID(c.Request.Context(), c.Param("id"))
+		if err != nil || m == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "media not found"})
+			return
+		}
+		// Re-issue a short-lived token for this stream.
+		uid, _ := c.Get(middleware.CtxUserID)
+		u, err := svc.Repo.User.FindByID(c.Request.Context(), toString(uid))
+		if err != nil || u == nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "user not found"})
+			return
+		}
+		token, err := svc.Auth.IssueToken(u)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{
+			"url":   "/api/stream/" + m.ID + "?token=" + token,
+			"token": token,
+		})
+	}
+}
+
+// transcodeStatusHandler reports the live status of one transcode job.
+// We surface the active jobs the transcoder knows about.
+func transcodeStatusHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		jobID := c.Param("job_id")
+		for _, j := range svc.Transcoder.Active() {
+			if j.MediaID == jobID {
+				c.JSON(http.StatusOK, gin.H{"job_id": jobID, "status": "running", "job": j})
+				return
+			}
+		}
+		c.JSON(http.StatusOK, gin.H{"job_id": jobID, "status": "idle"})
+	}
+}
+
+// _ keeps imports tidy when the model package isn't otherwise used.
+var _ = model.Media{}
+var _ = service.Container{}

internal/handler/playlist_extra.go

@@ -0,0 +1,55 @@
+// Package handler — playlist reordering + per-item-id removal that the
+// Vue UI uses on top of the basic /playlists/:id/items surface.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+type reorderReq struct {
+	// Order is a list of media IDs in the desired playback order.
+	Order []string `json:"order" binding:"required"`
+}
+
+// reorderPlaylistHandler updates the Position column on each
+// PlaylistItem to match the supplied order. Items missing from the
+// order keep their existing position.
+func reorderPlaylistHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req reorderReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		pid := c.Param("id")
+		for i, mid := range req.Order {
+			if err := svc.Repo.DB.WithContext(c.Request.Context()).
+				Model(&model.PlaylistItem{}).
+				Where("playlist_id = ? AND media_id = ?", pid, mid).
+				Update("position", i).Error; err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+// deletePlaylistItemByIDHandler is the alternate route at
+// /playlists/:id/items/:item_id (vs. the existing /:media_id variant).
+func deletePlaylistItemByIDHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Where("playlist_id = ? AND id = ?", c.Param("id"), c.Param("item_id")).
+			Delete(&model.PlaylistItem{}).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}

internal/handler/search_extra.go

@@ -0,0 +1,106 @@
+// Package handler — unified search surface that mirrors the Python
+// project's /api/search* endpoints. Internally we delegate to the
+// existing media + site adapters; advanced/tmdb/sites variants exist
+// so the upstream Vue UI's queries don't need rewriting.
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// searchUnifiedHandler is the basic /api/search endpoint.
+func searchUnifiedHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		q := c.Query("q")
+		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "30"))
+		if limit <= 0 || limit > 200 {
+			limit = 30
+		}
+		items, err := svc.Media.SearchMedia(c.Request.Context(), q, limit)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"items": items, "total": len(items)})
+	}
+}
+
+// searchAdvancedHandler accepts query + optional filters
+// (year, type, library_id) — currently it ignores the filters in the
+// SQL but threads them through to the response so the UI can echo
+// them back. This keeps API parity without a giant query builder.
+func searchAdvancedHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		q := c.Query("q")
+		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "30"))
+		if limit <= 0 || limit > 200 {
+			limit = 30
+		}
+		items, err := svc.Media.SearchMedia(c.Request.Context(), q, limit)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{
+			"items":   items,
+			"filters": gin.H{
+				"year":       c.Query("year"),
+				"type":       c.Query("type"),
+				"library_id": c.Query("library_id"),
+			},
+		})
+	}
+}
+
+// searchTMDbHandler proxies the TMDb /search endpoint via the existing
+// SearchMovie helper. Movies and TV use different URLs upstream but
+// only the movie path is wired today; TV is best-effort.
+func searchTMDbHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		q := c.Query("query")
+		if q == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "query required"})
+			return
+		}
+		if svc.TMDb == nil || !svc.TMDb.Enabled() {
+			c.JSON(http.StatusOK, gin.H{"items": []any{}, "note": "tmdb disabled"})
+			return
+		}
+		match, err := svc.TMDb.SearchMovie(c.Request.Context(), q, 0)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		out := make([]any, 0, 1)
+		if match != nil {
+			out = append(out, match)
+		}
+		c.JSON(http.StatusOK, gin.H{"items": out})
+	}
+}
+
+// searchSitesHandler mirrors the existing /sites/search but at the
+// /search/sites alias the Vue UI uses.
+func searchSitesHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		keyword := c.Query("keyword")
+		if keyword == "" {
+			keyword = c.Query("q")
+		}
+		if keyword == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "keyword required"})
+			return
+		}
+		results, err := svc.Site.Search(c.Request.Context(), keyword)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"items": results})
+	}
+}

internal/handler/sites_extra.go

@@ -0,0 +1,61 @@
+// Package handler — extra site endpoints used by the Vue UI:
+//
+//	GET /sites/:id/resource → keyword search scoped to one site
+//	GET /sites/:id/userdata → cookie-derived user info (stubbed)
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// siteResourceHandler runs a search restricted to a single site.
+//
+// We reuse the full SiteService.Search() and post-filter by site_id;
+// it's not the hottest path so we trade simplicity for speed here.
+func siteResourceHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		keyword := c.Query("keyword")
+		if keyword == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "keyword required"})
+			return
+		}
+		all, err := svc.Site.Search(c.Request.Context(), keyword)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		want := c.Param("id")
+		filtered := make([]service.SearchResult, 0, len(all))
+		for _, r := range all {
+			if r.SiteID == want {
+				filtered = append(filtered, r)
+			}
+		}
+		c.JSON(http.StatusOK, gin.H{"items": filtered})
+	}
+}
+
+// siteUserdataHandler returns whatever the site exposes about the
+// authenticated user (upload/download stats, ratio, etc.). This is a
+// stub: we report the cookie length so the UI can confirm a login is
+// present, but full per-site parsing is out of scope here.
+func siteUserdataHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		s, err := svc.Site.FindByID(c.Request.Context(), c.Param("id"))
+		if err != nil || s == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "site not found"})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{
+			"site_id":      s.ID,
+			"name":         s.Name,
+			"cookie_set":   len(s.Cookie) > 0,
+			"login_status": s.LoginStatus,
+			"note":         "userdata parsing not implemented; stub",
+		})
+	}
+}

internal/handler/stats_extra.go

@@ -0,0 +1,155 @@
+// Package handler — richer dashboard statistics endpoints.
+//
+// /api/stats already returns the basic snapshot. The Vue admin
+// dashboard also uses:
+//
+//   /api/stats/overview      — counts + total size + total seconds
+//   /api/stats/trend         — daily play count over last N days
+//   /api/stats/top-content   — top played media (by play count)
+//   /api/stats/libraries     — per-library item count + size
+//   /api/stats/monitor       — live CPU/mem/disk
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func statsOverviewHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		snap, err := svc.Stats.Compute(c.Request.Context(), svc.Cfg.App.DataDir)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{
+			"libraries":     snap.Libraries,
+			"media_count":   snap.MediaCount,
+			"users_count":   snap.UsersCount,
+			"total_size":    snap.TotalSizeBytes,
+			"total_seconds": snap.TotalSeconds,
+			"generated_at":  snap.GeneratedAt,
+		})
+	}
+}
+
+// statsTrendHandler returns play counts per day for the last N days.
+func statsTrendHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		days, _ := strconv.Atoi(c.DefaultQuery("days", "14"))
+		if days <= 0 || days > 90 {
+			days = 14
+		}
+		// Use the playback_history table; one row per (user, media)
+		// per day if we group by date(watched_at).
+		type bucket struct {
+			Day   string `json:"day"`
+			Count int64  `json:"count"`
+		}
+		out := make([]bucket, 0, days)
+		now := time.Now().UTC()
+		for i := days - 1; i >= 0; i-- {
+			start := now.AddDate(0, 0, -i).Truncate(24 * time.Hour)
+			end := start.Add(24 * time.Hour)
+			var n int64
+			_ = svc.Repo.DB.Model(&model.PlaybackHistory{}).
+				Where("watched_at >= ? AND watched_at < ?", start, end).
+				Count(&n).Error
+			out = append(out, bucket{
+				Day:   start.Format("2006-01-02"),
+				Count: n,
+			})
+		}
+		c.JSON(http.StatusOK, gin.H{"trend": out, "days": days})
+	}
+}
+
+// statsTopContentHandler returns the most-watched media items.
+func statsTopContentHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+		if limit <= 0 || limit > 50 {
+			limit = 10
+		}
+		type row struct {
+			MediaID    string `json:"media_id"`
+			PlayCount  int64  `json:"play_count"`
+			LastPlayed time.Time `json:"last_played"`
+		}
+		var rows []row
+		_ = svc.Repo.DB.Table("playback_histories").
+			Select("media_id, COUNT(*) as play_count, MAX(watched_at) as last_played").
+			Group("media_id").
+			Order("play_count desc").
+			Limit(limit).
+			Scan(&rows).Error
+		// Hydrate media titles in a single query.
+		ids := make([]string, 0, len(rows))
+		for _, r := range rows {
+			ids = append(ids, r.MediaID)
+		}
+		mIdx := map[string]model.Media{}
+		if len(ids) > 0 {
+			var media []model.Media
+			_ = svc.Repo.DB.Where("id IN ?", ids).Find(&media).Error
+			for _, m := range media {
+				mIdx[m.ID] = m
+			}
+		}
+		out := make([]gin.H, 0, len(rows))
+		for _, r := range rows {
+			out = append(out, gin.H{
+				"media":       mIdx[r.MediaID],
+				"play_count":  r.PlayCount,
+				"last_played": r.LastPlayed,
+			})
+		}
+		c.JSON(http.StatusOK, gin.H{"items": out})
+	}
+}
+
+// statsLibrariesHandler returns per-library counts + size.
+func statsLibrariesHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var libs []model.Library
+		if err := svc.Repo.DB.Find(&libs).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		out := make([]gin.H, 0, len(libs))
+		for _, l := range libs {
+			var count int64
+			var size int64
+			_ = svc.Repo.DB.Model(&model.Media{}).
+				Where("library_id = ?", l.ID).Count(&count).Error
+			_ = svc.Repo.DB.Model(&model.Media{}).
+				Where("library_id = ?", l.ID).
+				Select("COALESCE(SUM(size_bytes),0)").Row().Scan(&size)
+			out = append(out, gin.H{
+				"library":    l,
+				"item_count": count,
+				"total_size": size,
+			})
+		}
+		c.JSON(http.StatusOK, gin.H{"libraries": out})
+	}
+}
+
+// statsMonitorHandler returns live system resource usage; this is just
+// the Hardware portion of the snapshot but with a snappy schema.
+func statsMonitorHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		snap, err := svc.Stats.Compute(c.Request.Context(), svc.Cfg.App.DataDir)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, snap.Hardware)
+	}
+}

internal/handler/stats_user.go

@@ -0,0 +1,111 @@
+// Package handler — per-user stats and a play-event recorder.
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// statsUserHandler returns a watch-time summary for one user.
+func statsUserHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid := c.Param("id")
+		var watched int64
+		_ = svc.Repo.DB.Model(&model.PlaybackHistory{}).
+			Where("user_id = ?", uid).
+			Select("COALESCE(SUM(position_ms), 0)").
+			Row().Scan(&watched)
+		var total int64
+		_ = svc.Repo.DB.Model(&model.PlaybackHistory{}).
+			Where("user_id = ?", uid).Count(&total).Error
+		c.JSON(http.StatusOK, gin.H{
+			"user_id":      uid,
+			"watched_ms":   watched,
+			"plays":        total,
+			"watched_hours": float64(watched) / 1000.0 / 3600.0,
+		})
+	}
+}
+
+// statsTopUsersHandler returns the most active users by play count.
+func statsTopUsersHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+		if limit <= 0 || limit > 50 {
+			limit = 10
+		}
+		type row struct {
+			UserID string `json:"user_id"`
+			Plays  int64  `json:"plays"`
+		}
+		var rows []row
+		_ = svc.Repo.DB.Table("playback_histories").
+			Select("user_id, COUNT(*) as plays").
+			Group("user_id").
+			Order("plays desc").
+			Limit(limit).Scan(&rows).Error
+		// Hydrate usernames in one query.
+		ids := make([]string, 0, len(rows))
+		for _, r := range rows {
+			ids = append(ids, r.UserID)
+		}
+		nameIdx := map[string]string{}
+		if len(ids) > 0 {
+			var users []model.User
+			_ = svc.Repo.DB.Where("id IN ?", ids).Find(&users).Error
+			for _, u := range users {
+				nameIdx[u.ID] = u.Username
+			}
+		}
+		out := make([]gin.H, 0, len(rows))
+		for _, r := range rows {
+			out = append(out, gin.H{
+				"user_id":  r.UserID,
+				"username": nameIdx[r.UserID],
+				"plays":    r.Plays,
+			})
+		}
+		c.JSON(http.StatusOK, gin.H{"items": out})
+	}
+}
+
+// statsPlayHandler accepts a play event so the Vue analytics panel can
+// emit one even when the actual progress write goes through /history.
+type playEventReq struct {
+	MediaID    string `json:"media_id" binding:"required"`
+	PositionMs int64  `json:"position_ms"`
+	DurationMs int64  `json:"duration_ms"`
+	Completed  bool   `json:"completed"`
+}
+
+func statsPlayHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req playEventReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		uid, _ := c.Get(middleware.CtxUserID)
+		// Just upsert into PlaybackHistory; the existing service
+		// handles the dedup logic.
+		if err := svc.Repo.History.Upsert(c.Request.Context(), &model.PlaybackHistory{
+			UserID:     toString(uid),
+			MediaID:    req.MediaID,
+			PositionMs: req.PositionMs,
+			DurationMs: req.DurationMs,
+			WatchedAt:  time.Now(),
+			Completed:  req.Completed,
+		}); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}

internal/handler/storage_config.go

@@ -0,0 +1,75 @@
+// Package handler — Alist / S3 / WebDAV storage config endpoints.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// listStorageConfigsHandler returns the status overview used by the
+// admin storage panel: every persisted backend with secrets redacted.
+func listStorageConfigsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		rows, err := svc.StorageCfg.List(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"items": rows})
+	}
+}
+
+// getStorageConfigHandler returns one config (with the decrypted body).
+func getStorageConfigHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		row, err := svc.StorageCfg.Get(c.Request.Context(), c.Param("type"))
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		if row == nil {
+			c.JSON(http.StatusOK, gin.H{"type": c.Param("type"), "config": gin.H{}})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+// saveStorageConfigHandler upserts the config row; the caller passes
+// the type via URL and the body as a JSON object.
+func saveStorageConfigHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.StorageInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		in.Type = c.Param("type")
+		row, err := svc.StorageCfg.Save(c.Request.Context(), in)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, row)
+	}
+}
+
+// testStorageConfigHandler probes an unsaved config.
+func testStorageConfigHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var in service.StorageInput
+		if err := c.ShouldBindJSON(&in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		in.Type = c.Param("type")
+		if err := svc.StorageCfg.Test(c.Request.Context(), in); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"ok": false, "error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}

internal/handler/subscription_extra.go

@@ -0,0 +1,61 @@
+// Package handler — subscription update + per-subscription site search.
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// updateSubscriptionHandler patches a subscription row.
+func updateSubscriptionHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var patch model.Subscription
+		if err := c.ShouldBindJSON(&patch); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		if err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Model(&model.Subscription{}).
+			Where("id = ?", c.Param("id")).
+			Updates(map[string]any{
+				"name":     patch.Name,
+				"feed_url": patch.FeedURL,
+				"filter":   patch.Filter,
+				"enabled":  patch.Enabled,
+			}).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+// searchSubscriptionHandler runs a one-off keyword search against the
+// configured tracker sites for the given subscription. We treat the
+// subscription's filter as the search term; this lets the UI preview
+// what would be queued without actually downloading anything.
+func searchSubscriptionHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var sub model.Subscription
+		err := svc.Repo.DB.WithContext(c.Request.Context()).
+			Where("id = ?", c.Param("id")).First(&sub).Error
+		if err != nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "subscription not found"})
+			return
+		}
+		keyword := sub.Filter
+		if keyword == "" {
+			keyword = sub.Name
+		}
+		results, err := svc.Site.Search(c.Request.Context(), keyword)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"items": results, "subscription": sub})
+	}
+}

internal/handler/system_extra.go

@@ -0,0 +1,159 @@
+// Package handler — system config + scheduler trigger + events ticket.
+package handler
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// listSystemConfigHandler is the non-admin alias for /admin/settings.
+// It returns the same key/value rows so the Vue UI's `system.getConfig`
+// helper keeps working.
+func listSystemConfigHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		rows, err := svc.Repo.Setting.All(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		// Hide secret-flavoured keys for non-admins.
+		role, _ := c.Get(middleware.CtxUserRole)
+		out := make([]model.Setting, 0, len(rows))
+		for _, s := range rows {
+			if role != "admin" && isSecretKey(s.Key) {
+				s.Value = "********"
+			}
+			out = append(out, s)
+		}
+		c.JSON(http.StatusOK, gin.H{"items": out})
+	}
+}
+
+func isSecretKey(k string) bool {
+	for _, suffix := range []string{".token", ".secret", ".password", ".api_key", ".cookie"} {
+		if endsWith(k, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+func endsWith(s, suffix string) bool {
+	return len(s) >= len(suffix) && s[len(s)-len(suffix):] == suffix
+}
+
+// schemaHandler returns the curated settings schema (used by the
+// `getSchema()` Vue helper). It mirrors the SettingsPage groupings but
+// in JSON so the upstream UI can render its dynamic form.
+func schemaHandler(_ *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{
+			"groups": []gin.H{
+				{
+					"key":   "general",
+					"label": "常规",
+					"items": []gin.H{
+						{"key": "tmdb.language", "type": "select", "label": "TMDb 元数据语言"},
+						{"key": "transcode.enabled", "type": "toggle", "label": "启用转码"},
+						{"key": "transcode.hw_accel", "type": "select", "label": "硬件加速"},
+						{"key": "transcode.max_jobs", "type": "number", "label": "最大并发"},
+						{"key": "ffmpeg.path", "type": "text", "label": "FFmpeg 路径"},
+						{"key": "ffprobe.path", "type": "text", "label": "FFprobe 路径"},
+					},
+				},
+				{
+					"key":   "organize",
+					"label": "整理 & 刮削",
+					"items": []gin.H{
+						{"key": "organize.auto", "type": "toggle"},
+						{"key": "organize.movie_format", "type": "text"},
+						{"key": "organize.tv_format", "type": "text"},
+						{"key": "organize.anime_format", "type": "text"},
+						{"key": "scrape.auto_on_scan", "type": "toggle"},
+						{"key": "scrape.providers", "type": "text"},
+						{"key": "scrape.language", "type": "text"},
+					},
+				},
+				{
+					"key":   "adult",
+					"label": "Adult / NSFW",
+					"items": []gin.H{
+						{"key": "adult.enabled", "type": "toggle"},
+						{"key": "adult.require_pin", "type": "toggle"},
+						{"key": "adult.pin", "type": "text"},
+					},
+				},
+				{
+					"key":   "qbittorrent",
+					"label": "qBittorrent",
+					"items": []gin.H{
+						{"key": "qbittorrent.url", "type": "text"},
+						{"key": "qbittorrent.username", "type": "text"},
+						{"key": "qbittorrent.password", "type": "text"},
+						{"key": "qbittorrent.savepath", "type": "text"},
+					},
+				},
+			},
+		})
+	}
+}
+
+// schedulerTriggerHandler is the alternate path for /admin/scheduler/:name/run.
+func schedulerTriggerHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if err := svc.Scheduler.RunNow(c.Request.Context(), c.Param("name")); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	}
+}
+
+// ─── SSE ticket store ───────────────────────────────────────────────────────
+//
+// The Vue UI's SSE event stream wants a one-time signed ticket so the
+// EventSource (which can't set Authorization headers) can authenticate.
+// We don't expose the SSE stream itself yet, but we persist short-lived
+// tickets keyed to the user so the upstream consumer keeps working.
+
+type ticket struct {
+	userID  string
+	expires time.Time
+}
+
+var (
+	ticketStore   = map[string]ticket{}
+	ticketStoreMu sync.Mutex
+)
+
+func newTicket(userID string) string {
+	buf := make([]byte, 16)
+	_, _ = rand.Read(buf)
+	t := hex.EncodeToString(buf)
+	ticketStoreMu.Lock()
+	defer ticketStoreMu.Unlock()
+	ticketStore[t] = ticket{userID: userID, expires: time.Now().Add(60 * time.Second)}
+	// GC expired tickets opportunistically.
+	for k, v := range ticketStore {
+		if time.Now().After(v.expires) {
+			delete(ticketStore, k)
+		}
+	}
+	return t
+}
+
+func systemEventsTicketHandler(_ *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		c.JSON(http.StatusOK, gin.H{"ticket": newTicket(toString(uid))})
+	}
+}

internal/handler/system_meta.go

@@ -0,0 +1,66 @@
+// Package handler — system metadata endpoints used by the React shell
+// (footer "powered by", admin status panel, scheduled-task page).
+//
+// These mirror the Vue surface (/api/system/info, /api/system/status,
+// /api/system/scheduler) so the React port can reuse the same calls.
+package handler
+
+import (
+	"net/http"
+	"runtime"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/shirou/gopsutil/v3/cpu"
+	"github.com/shirou/gopsutil/v3/disk"
+	"github.com/shirou/gopsutil/v3/mem"
+
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// startedAt is captured at first call so /system/status can report uptime
+// without threading state through the container.
+var startedAt = time.Now()
+
+func systemInfoHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{
+			"name":      "MediaStationGo",
+			"version":   "0.1.0",
+			"go":        runtime.Version(),
+			"os":        runtime.GOOS,
+			"arch":      runtime.GOARCH,
+			"data_dir":  svc.Cfg.App.DataDir,
+			"cache_dir": svc.Cfg.Cache.CacheDir,
+		})
+	}
+}
+
+func systemStatusHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		out := gin.H{
+			"uptime_seconds": int64(time.Since(startedAt).Seconds()),
+			"goroutines":     runtime.NumGoroutine(),
+		}
+		if usage, err := cpu.Percent(0, false); err == nil && len(usage) > 0 {
+			out["cpu_percent"] = usage[0]
+		}
+		if v, err := mem.VirtualMemory(); err == nil {
+			out["memory_used"] = v.Used
+			out["memory_total"] = v.Total
+		}
+		if d, err := disk.Usage(svc.Cfg.App.DataDir); err == nil {
+			out["disk_used"] = d.Used
+			out["disk_total"] = d.Total
+		}
+		c.JSON(http.StatusOK, out)
+	}
+}
+
+// systemSchedulerHandler is the read-only (non-admin) variant of
+// /admin/scheduler — handy on user-facing dashboards.
+func systemSchedulerHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"jobs": svc.Scheduler.Status()})
+	}
+}

internal/handler/watch_history.go

@@ -0,0 +1,162 @@
+// Package handler — watch history endpoints.
+//
+// The base /history GET / POST routes already exist; these add the three
+// auxiliary surfaces the React WatchHistoryPage needs:
+//
+//   GET  /api/watch-history          paginated list (admin sees every user)
+//   GET  /api/watch-history/stats    aggregate watch time + completion
+//   GET  /api/watch-history/continue resume rail (incomplete only)
+//   DELETE /api/watch-history        clear (?media_item_id= optional)
+//   DELETE /api/watch-history/:id    remove one row
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+// historyListHandler returns the caller's history rows joined with the
+// matching media in a single response.
+func historyListHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
+		if limit <= 0 || limit > 500 {
+			limit = 50
+		}
+		items, err := svc.Playback.RecentHistory(c.Request.Context(), toString(uid), limit)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, items)
+	}
+}
+
+// historyStatsHandler returns aggregate watch time + completion counts
+// for the caller. Used by the WatchHistoryPage hero card.
+func historyStatsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		userID := toString(uid)
+
+		var total int64
+		_ = svc.Repo.DB.Model(&model.PlaybackHistory{}).
+			Where("user_id = ?", userID).Count(&total).Error
+
+		var completed int64
+		_ = svc.Repo.DB.Model(&model.PlaybackHistory{}).
+			Where("user_id = ? AND completed = ?", userID, true).Count(&completed).Error
+
+		var watchedMs int64
+		_ = svc.Repo.DB.Model(&model.PlaybackHistory{}).
+			Where("user_id = ?", userID).
+			Select("COALESCE(SUM(position_ms), 0)").
+			Row().Scan(&watchedMs)
+
+		var last *time.Time
+		row := svc.Repo.DB.Model(&model.PlaybackHistory{}).
+			Where("user_id = ?", userID).
+			Select("MAX(watched_at)").Row()
+		var lastT time.Time
+		if err := row.Scan(&lastT); err == nil && !lastT.IsZero() {
+			last = &lastT
+		}
+
+		c.JSON(http.StatusOK, gin.H{
+			"total":         total,
+			"completed":     completed,
+			"watched_ms":    watchedMs,
+			"watched_hours": float64(watchedMs) / 1000.0 / 3600.0,
+			"last_watched":  last,
+		})
+	}
+}
+
+// historyContinueHandler returns "Continue Watching" rows: incomplete
+// items, most recent first.
+func historyContinueHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+		if limit <= 0 || limit > 50 {
+			limit = 10
+		}
+		var rows []model.PlaybackHistory
+		if err := svc.Repo.DB.
+			Where("user_id = ? AND completed = ?", toString(uid), false).
+			Order("watched_at desc").
+			Limit(limit).
+			Find(&rows).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		// Hydrate media in one query.
+		ids := make([]string, 0, len(rows))
+		for _, r := range rows {
+			ids = append(ids, r.MediaID)
+		}
+		var media []model.Media
+		if len(ids) > 0 {
+			_ = svc.Repo.DB.Where("id IN ?", ids).Find(&media).Error
+		}
+		mIdx := make(map[string]model.Media, len(media))
+		for _, m := range media {
+			mIdx[m.ID] = m
+		}
+		out := make([]gin.H, 0, len(rows))
+		for _, r := range rows {
+			m, ok := mIdx[r.MediaID]
+			if !ok {
+				continue
+			}
+			out = append(out, gin.H{
+				"history": r,
+				"media":   m,
+			})
+		}
+		c.JSON(http.StatusOK, out)
+	}
+}
+
+// historyDeleteHandler removes one or all history rows for the caller.
+//
+//   DELETE /api/watch-history?media_id=xxx  → delete just that media's row
+//   DELETE /api/watch-history               → clear all rows for the user
+func historyDeleteHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		userID := toString(uid)
+		mediaID := c.Query("media_id")
+
+		q := svc.Repo.DB.Where("user_id = ?", userID)
+		if mediaID != "" {
+			q = q.Where("media_id = ?", mediaID)
+		}
+		if err := q.Delete(&model.PlaybackHistory{}).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}
+
+func historyDeleteOneHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		if err := svc.Repo.DB.
+			Where("user_id = ? AND id = ?", toString(uid), c.Param("id")).
+			Delete(&model.PlaybackHistory{}).Error; err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.Status(http.StatusNoContent)
+	}
+}

internal/model/model.go

@@ -229,6 +229,150 @@ type Site struct {
 	Downloader  string `gorm:"size:50" json:"downloader,omitempty"`
 }
 
+// NotifyChannel is one named outbound notification destination.
+//
+// The Config column holds a JSON blob whose schema depends on the
+// ChannelType (telegram/wechat/bark/webhook):
+//
+//	telegram → {bot_token, chat_id}
+//	wechat   → {sendkey}
+//	bark     → {device_key, server?}
+//	webhook  → {url, method, headers (JSON string), body_template}
+//
+// The Events column is a JSON array of event-type strings the channel
+// subscribes to; an empty array means "all events".
+type NotifyChannel struct {
+	Base
+	Name        string `gorm:"size:128;not null" json:"name"`
+	ChannelType string `gorm:"size:32;not null" json:"channel_type"`
+	Config      string `gorm:"type:text;not null" json:"config"`
+	Enabled     bool   `gorm:"default:true" json:"enabled"`
+	Events      string `gorm:"type:text;default:'[]'" json:"events"`
+}
+
+// PlayProfile lets one user define multiple "viewing personas" with
+// different content-rating limits, library access, and player defaults.
+// The original Vue project sketched this out as a forward-looking
+// feature; we materialise it server-side so the React port can fully
+// function without dropping the screen.
+//
+// AllowedLibraryIDs is a JSON array of library UUIDs (empty = all).
+type PlayProfile struct {
+	Base
+	UserID                string `gorm:"index;size:36;not null" json:"user_id"`
+	Name                  string `gorm:"size:64;not null" json:"name"`
+	IsDefault             bool   `gorm:"default:false" json:"is_default"`
+	ContentRatingLimit    string `gorm:"size:16" json:"content_rating_limit,omitempty"`
+	AllowAdult            bool   `gorm:"default:false" json:"allow_adult"`
+	RequirePIN            bool   `gorm:"default:false" json:"require_pin"`
+	PINHash               string `gorm:"size:128" json:"-"`
+	PreferredSubtitleLang string `gorm:"size:16" json:"preferred_subtitle_lang,omitempty"`
+	PreferredAudioLang    string `gorm:"size:16" json:"preferred_audio_lang,omitempty"`
+	AutoplayNext          bool   `gorm:"default:true" json:"autoplay_next"`
+	SkipIntro             bool   `gorm:"default:false" json:"skip_intro"`
+	AllowedLibraryIDs     string `gorm:"type:text;default:'[]'" json:"allowed_library_ids"`
+	TotalWatchTime        int64  `gorm:"default:0" json:"total_watch_time"`
+	LastActiveAt          *time.Time `json:"last_active_at,omitempty"`
+}
+
+// UserPermission stores per-user feature toggles for the React UI's
+// menu visibility + route guards. The original Python project surfaces
+// 11 boolean flags; we mirror the same set so the existing frontend
+// can swap to the Go API without code changes.
+type UserPermission struct {
+	UserID                 string    `gorm:"primaryKey;size:36" json:"user_id"`
+	CanPlayMedia           bool      `gorm:"default:true" json:"can_play_media"`
+	CanFavorite            bool      `gorm:"default:true" json:"can_favorite"`
+	CanViewHistory         bool      `gorm:"default:true" json:"can_view_history"`
+	CanViewDashboard       bool      `gorm:"default:true" json:"can_view_dashboard"`
+	CanViewDiscover        bool      `gorm:"default:true" json:"can_view_discover"`
+	CanManageDownloads     bool      `gorm:"default:false" json:"can_manage_downloads"`
+	CanManageSubscriptions bool      `gorm:"default:false" json:"can_manage_subscriptions"`
+	CanManageSites         bool      `gorm:"default:false" json:"can_manage_sites"`
+	CanManageFiles         bool      `gorm:"default:false" json:"can_manage_files"`
+	CanManageSTRM          bool      `gorm:"default:false" json:"can_manage_strm"`
+	CanCast                bool      `gorm:"default:true" json:"can_cast"`
+	CanUseAIAssistant      bool      `gorm:"default:false" json:"can_use_ai_assistant"`
+	CanAccessSettings      bool      `gorm:"default:false" json:"can_access_settings"`
+	UpdatedAt              time.Time `json:"updated_at"`
+}
+
+// StorageConfig holds the connection settings for one external storage
+// backend (Alist / S3 / WebDAV). Type column makes the row poly-typed
+// — Config is a JSON blob whose shape is determined by Type.
+//
+//	alist  → {server, token}
+//	s3     → {endpoint, region, bucket, access_key, secret_key, force_path_style}
+//	webdav → {url, username, password}
+type StorageConfig struct {
+	Base
+	Type      string `gorm:"uniqueIndex;size:16;not null" json:"type"`
+	Config    string `gorm:"type:text;not null" json:"-"` // ciphertext
+	Enabled   bool   `gorm:"default:true" json:"enabled"`
+	LastError string `gorm:"size:512" json:"last_error,omitempty"`
+}
+
+// LicenseKey is one issued license for a customer. Activations live in
+// a child table so a single key can bind to multiple devices when its
+// MaxActivations > 1.
+type LicenseKey struct {
+	Base
+	Key            string     `gorm:"uniqueIndex;size:64;not null" json:"key"`
+	Customer       string     `gorm:"size:128" json:"customer,omitempty"`
+	Plan           string     `gorm:"size:32;default:basic" json:"plan"`
+	MaxActivations int        `gorm:"default:1" json:"max_activations"`
+	IssuedAt       time.Time  `json:"issued_at"`
+	ExpiresAt      *time.Time `json:"expires_at,omitempty"`
+	Revoked        bool       `gorm:"default:false" json:"revoked"`
+	Notes          string     `gorm:"type:text" json:"notes,omitempty"`
+}
+
+// LicenseActivation is one (key, device) binding.
+type LicenseActivation struct {
+	Base
+	KeyID      string     `gorm:"index;size:36;not null" json:"key_id"`
+	DeviceID   string     `gorm:"size:128;not null" json:"device_id"`
+	DeviceName string     `gorm:"size:128" json:"device_name,omitempty"`
+	IP         string     `gorm:"size:64" json:"ip,omitempty"`
+	UnboundAt  *time.Time `json:"unbound_at,omitempty"`
+	HeartbeatAt *time.Time `json:"heartbeat_at,omitempty"`
+}
+
+// DownloadClient is one configured downloader (qBittorrent / Aria2 /
+// Transmission). We keep the password column out of JSON so list calls
+// don't leak secrets to the React UI.
+type DownloadClient struct {
+	Base
+	Name     string `gorm:"size:128;not null" json:"name"`
+	Type     string `gorm:"size:16;not null" json:"type"` // qbittorrent / transmission / aria2
+	URL      string `gorm:"size:512;not null" json:"url"`
+	Username string `gorm:"size:128" json:"username,omitempty"`
+	Password string `gorm:"size:512" json:"-"`
+	SavePath string `gorm:"size:1024" json:"save_path,omitempty"`
+	IsDefault bool  `gorm:"default:false" json:"is_default"`
+	Enabled  bool   `gorm:"default:true" json:"enabled"`
+}
+
+// AssistantSession groups a multi-turn chat with the AI assistant.
+type AssistantSession struct {
+	Base
+	UserID string `gorm:"index;size:36;not null" json:"user_id"`
+	Title  string `gorm:"size:255" json:"title,omitempty"`
+}
+
+// AssistantMessage is one entry in an AssistantSession transcript.
+//
+// Role is "user" | "assistant" | "system".  The optional OperationID
+// links a message to an action the assistant proposed (so the UI can
+// offer Undo).
+type AssistantMessage struct {
+	Base
+	SessionID   string `gorm:"index;size:36;not null" json:"session_id"`
+	Role        string `gorm:"size:16;not null" json:"role"`
+	Content     string `gorm:"type:text;not null" json:"content"`
+	OperationID string `gorm:"size:36" json:"operation_id,omitempty"`
+}
+
 // AllModels returns the slice consumed by gorm.AutoMigrate.
 func AllModels() []interface{} {
 	return []interface{}{
@@ -246,5 +390,14 @@ func AllModels() []interface{} {
 		&Site{},
 		&AccessLog{},
 		&APIConfig{},
+		&NotifyChannel{},
+		&PlayProfile{},
+		&UserPermission{},
+		&StorageConfig{},
+		&LicenseKey{},
+		&LicenseActivation{},
+		&DownloadClient{},
+		&AssistantSession{},
+		&AssistantMessage{},
 	}
 }

internal/repository/repository.go

@@ -30,23 +30,37 @@ type Container struct {
 	Subscription    *SubscriptionRepository
 	Setting         *SettingRepository
 	Log             *AccessLogRepository
+	NotifyChannel   *NotifyChannelRepository
+	PlayProfile     *PlayProfileRepository
+	Permission      *PermissionRepository
+	StorageConfig   *StorageConfigRepository
+	License         *LicenseRepository
+	DownloadClient  *DownloadClientRepository
+	Assistant       *AssistantRepository
 }
 
 // New wires every repository to a single *gorm.DB.
 func New(db *gorm.DB) *Container {
 	return &Container{
-		DB:           db,
-		User:         &UserRepository{db: db},
-		Library:      &LibraryRepository{db: db},
-		Media:        &MediaRepository{db: db},
-		Series:       &SeriesRepository{db: db},
-		History:      &HistoryRepository{db: db},
-		Favorite:     &FavoriteRepository{db: db},
-		Playlist:     &PlaylistRepository{db: db},
-		Download:     &DownloadRepository{db: db},
-		Subscription: &SubscriptionRepository{db: db},
-		Setting:      &SettingRepository{db: db},
-		Log:          &AccessLogRepository{db: db},
+		DB:             db,
+		User:           &UserRepository{db: db},
+		Library:        &LibraryRepository{db: db},
+		Media:          &MediaRepository{db: db},
+		Series:         &SeriesRepository{db: db},
+		History:        &HistoryRepository{db: db},
+		Favorite:       &FavoriteRepository{db: db},
+		Playlist:       &PlaylistRepository{db: db},
+		Download:       &DownloadRepository{db: db},
+		Subscription:   &SubscriptionRepository{db: db},
+		Setting:        &SettingRepository{db: db},
+		Log:            &AccessLogRepository{db: db},
+		NotifyChannel:  &NotifyChannelRepository{db: db},
+		PlayProfile:    &PlayProfileRepository{db: db},
+		Permission:     &PermissionRepository{db: db},
+		StorageConfig:  &StorageConfigRepository{db: db},
+		License:        &LicenseRepository{db: db},
+		DownloadClient: &DownloadClientRepository{db: db},
+		Assistant:      &AssistantRepository{db: db},
 	}
 }
 
@@ -389,3 +403,361 @@ func (r *AccessLogRepository) Recent(ctx context.Context, limit int) ([]model.Ac
 	err := r.db.WithContext(ctx).Order("created_at desc").Limit(limit).Find(&rows).Error
 	return rows, err
 }
+
+
+// ─── Notify Channel ──────────────────────────────────────────────────────────
+
+// NotifyChannelRepository persists model.NotifyChannel records.
+type NotifyChannelRepository struct{ db *gorm.DB }
+
+// Create inserts a new notify channel.
+func (r *NotifyChannelRepository) Create(ctx context.Context, n *model.NotifyChannel) error {
+	return r.db.WithContext(ctx).Create(n).Error
+}
+
+// FindByID returns the channel or (nil, nil).
+func (r *NotifyChannelRepository) FindByID(ctx context.Context, id string) (*model.NotifyChannel, error) {
+	var n model.NotifyChannel
+	err := r.db.WithContext(ctx).Where("id = ?", id).First(&n).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &n, nil
+}
+
+// List returns every channel ordered by creation time desc.
+func (r *NotifyChannelRepository) List(ctx context.Context) ([]model.NotifyChannel, error) {
+	var rows []model.NotifyChannel
+	err := r.db.WithContext(ctx).Order("created_at desc").Find(&rows).Error
+	return rows, err
+}
+
+// ListEnabled is the variant the dispatcher uses; honours Enabled flag.
+func (r *NotifyChannelRepository) ListEnabled(ctx context.Context) ([]model.NotifyChannel, error) {
+	var rows []model.NotifyChannel
+	err := r.db.WithContext(ctx).Where("enabled = ?", true).
+		Order("created_at desc").Find(&rows).Error
+	return rows, err
+}
+
+// Update applies a partial patch addressed by ID. The map keys must use
+// snake_case GORM column names.
+func (r *NotifyChannelRepository) Update(ctx context.Context, id string, patch map[string]any) error {
+	return r.db.WithContext(ctx).Model(&model.NotifyChannel{}).
+		Where("id = ?", id).Updates(patch).Error
+}
+
+// Delete soft-deletes a channel.
+func (r *NotifyChannelRepository) Delete(ctx context.Context, id string) error {
+	return r.db.WithContext(ctx).Delete(&model.NotifyChannel{}, "id = ?", id).Error
+}
+
+// ─── Play Profile ────────────────────────────────────────────────────────────
+
+// PlayProfileRepository persists model.PlayProfile records.
+type PlayProfileRepository struct{ db *gorm.DB }
+
+// Create inserts a new play profile.
+func (r *PlayProfileRepository) Create(ctx context.Context, p *model.PlayProfile) error {
+	return r.db.WithContext(ctx).Create(p).Error
+}
+
+// FindByID returns the profile or (nil, nil).
+func (r *PlayProfileRepository) FindByID(ctx context.Context, id string) (*model.PlayProfile, error) {
+	var p model.PlayProfile
+	err := r.db.WithContext(ctx).Where("id = ?", id).First(&p).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &p, nil
+}
+
+// ListByUser returns every profile owned by a user.
+func (r *PlayProfileRepository) ListByUser(ctx context.Context, userID string) ([]model.PlayProfile, error) {
+	var rows []model.PlayProfile
+	err := r.db.WithContext(ctx).Where("user_id = ?", userID).
+		Order("is_default desc, created_at asc").Find(&rows).Error
+	return rows, err
+}
+
+// List returns every profile across users (admin view).
+func (r *PlayProfileRepository) List(ctx context.Context) ([]model.PlayProfile, error) {
+	var rows []model.PlayProfile
+	err := r.db.WithContext(ctx).
+		Order("user_id asc, is_default desc, created_at asc").Find(&rows).Error
+	return rows, err
+}
+
+// ClearDefaultsFor flips all is_default flags to false for the given
+// user; called inside the same transaction that promotes a new default.
+func (r *PlayProfileRepository) ClearDefaultsFor(ctx context.Context, userID string) error {
+	return r.db.WithContext(ctx).Model(&model.PlayProfile{}).
+		Where("user_id = ?", userID).Update("is_default", false).Error
+}
+
+// Update applies a partial patch addressed by ID.
+func (r *PlayProfileRepository) Update(ctx context.Context, id string, patch map[string]any) error {
+	return r.db.WithContext(ctx).Model(&model.PlayProfile{}).
+		Where("id = ?", id).Updates(patch).Error
+}
+
+// Delete soft-deletes a profile.
+func (r *PlayProfileRepository) Delete(ctx context.Context, id string) error {
+	return r.db.WithContext(ctx).Delete(&model.PlayProfile{}, "id = ?", id).Error
+}
+
+
+// ─── Permissions ─────────────────────────────────────────────────────────────
+
+// PermissionRepository persists model.UserPermission.
+type PermissionRepository struct{ db *gorm.DB }
+
+// Get returns the row, or (nil, nil) when not yet seeded.
+func (r *PermissionRepository) Get(ctx context.Context, userID string) (*model.UserPermission, error) {
+	var p model.UserPermission
+	err := r.db.WithContext(ctx).Where("user_id = ?", userID).First(&p).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &p, nil
+}
+
+// Save upserts the row keyed by UserID.
+func (r *PermissionRepository) Save(ctx context.Context, p *model.UserPermission) error {
+	return r.db.WithContext(ctx).Save(p).Error
+}
+
+// Delete removes the row (used when a user is deleted).
+func (r *PermissionRepository) Delete(ctx context.Context, userID string) error {
+	return r.db.WithContext(ctx).Where("user_id = ?", userID).Delete(&model.UserPermission{}).Error
+}
+
+// ─── Storage Config ──────────────────────────────────────────────────────────
+
+// StorageConfigRepository persists model.StorageConfig records (Alist / S3 / WebDAV).
+type StorageConfigRepository struct{ db *gorm.DB }
+
+// Get returns the config for the given type, or (nil, nil).
+func (r *StorageConfigRepository) Get(ctx context.Context, kind string) (*model.StorageConfig, error) {
+	var s model.StorageConfig
+	err := r.db.WithContext(ctx).Where("type = ?", kind).First(&s).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+// Upsert inserts or updates the row keyed by Type.
+func (r *StorageConfigRepository) Upsert(ctx context.Context, s *model.StorageConfig) error {
+	return r.db.WithContext(ctx).Where("type = ?", s.Type).
+		Assign(map[string]any{
+			"config":     s.Config,
+			"enabled":    s.Enabled,
+			"last_error": s.LastError,
+		}).
+		FirstOrCreate(s).Error
+}
+
+// List returns every storage config (admin overview).
+func (r *StorageConfigRepository) List(ctx context.Context) ([]model.StorageConfig, error) {
+	var rows []model.StorageConfig
+	err := r.db.WithContext(ctx).Order("type asc").Find(&rows).Error
+	return rows, err
+}
+
+// ─── License ─────────────────────────────────────────────────────────────────
+
+// LicenseRepository persists model.LicenseKey and model.LicenseActivation.
+type LicenseRepository struct{ db *gorm.DB }
+
+// Create inserts a new license key.
+func (r *LicenseRepository) Create(ctx context.Context, k *model.LicenseKey) error {
+	return r.db.WithContext(ctx).Create(k).Error
+}
+
+// FindByKey returns the license key matching the value, or (nil, nil).
+func (r *LicenseRepository) FindByKey(ctx context.Context, key string) (*model.LicenseKey, error) {
+	var k model.LicenseKey
+	err := r.db.WithContext(ctx).Where("key = ?", key).First(&k).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &k, nil
+}
+
+// FindByID returns the license key by primary key.
+func (r *LicenseRepository) FindByID(ctx context.Context, id string) (*model.LicenseKey, error) {
+	var k model.LicenseKey
+	err := r.db.WithContext(ctx).Where("id = ?", id).First(&k).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &k, nil
+}
+
+// List returns every license key (admin view).
+func (r *LicenseRepository) List(ctx context.Context) ([]model.LicenseKey, error) {
+	var rows []model.LicenseKey
+	err := r.db.WithContext(ctx).Order("issued_at desc").Find(&rows).Error
+	return rows, err
+}
+
+// Update applies a partial patch (revoke / extend expiry, etc.).
+func (r *LicenseRepository) Update(ctx context.Context, id string, patch map[string]any) error {
+	return r.db.WithContext(ctx).Model(&model.LicenseKey{}).
+		Where("id = ?", id).Updates(patch).Error
+}
+
+// AddActivation creates an activation entry for a key.
+func (r *LicenseRepository) AddActivation(ctx context.Context, a *model.LicenseActivation) error {
+	return r.db.WithContext(ctx).Create(a).Error
+}
+
+// CountActiveActivations counts non-unbound activations for a key.
+func (r *LicenseRepository) CountActiveActivations(ctx context.Context, keyID string) (int64, error) {
+	var n int64
+	err := r.db.WithContext(ctx).Model(&model.LicenseActivation{}).
+		Where("key_id = ? AND unbound_at IS NULL", keyID).
+		Count(&n).Error
+	return n, err
+}
+
+// ListActivations returns all activations for a key.
+func (r *LicenseRepository) ListActivations(ctx context.Context, keyID string) ([]model.LicenseActivation, error) {
+	var rows []model.LicenseActivation
+	err := r.db.WithContext(ctx).Where("key_id = ?", keyID).Find(&rows).Error
+	return rows, err
+}
+
+// UnbindActivation marks an activation as unbound (soft).
+func (r *LicenseRepository) UnbindActivation(ctx context.Context, id string) error {
+	now := time.Now()
+	return r.db.WithContext(ctx).Model(&model.LicenseActivation{}).
+		Where("id = ?", id).Update("unbound_at", &now).Error
+}
+
+// TouchHeartbeat bumps the heartbeat_at column.
+func (r *LicenseRepository) TouchHeartbeat(ctx context.Context, id string) error {
+	now := time.Now()
+	return r.db.WithContext(ctx).Model(&model.LicenseActivation{}).
+		Where("id = ?", id).Update("heartbeat_at", &now).Error
+}
+
+// ─── Download Clients ────────────────────────────────────────────────────────
+
+// DownloadClientRepository persists model.DownloadClient records.
+type DownloadClientRepository struct{ db *gorm.DB }
+
+// Create inserts a new client config.
+func (r *DownloadClientRepository) Create(ctx context.Context, c *model.DownloadClient) error {
+	return r.db.WithContext(ctx).Create(c).Error
+}
+
+// FindByID returns one client by ID.
+func (r *DownloadClientRepository) FindByID(ctx context.Context, id string) (*model.DownloadClient, error) {
+	var c model.DownloadClient
+	err := r.db.WithContext(ctx).Where("id = ?", id).First(&c).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &c, nil
+}
+
+// List returns every configured client.
+func (r *DownloadClientRepository) List(ctx context.Context) ([]model.DownloadClient, error) {
+	var rows []model.DownloadClient
+	err := r.db.WithContext(ctx).Order("created_at asc").Find(&rows).Error
+	return rows, err
+}
+
+// Update applies a partial patch.
+func (r *DownloadClientRepository) Update(ctx context.Context, id string, patch map[string]any) error {
+	return r.db.WithContext(ctx).Model(&model.DownloadClient{}).
+		Where("id = ?", id).Updates(patch).Error
+}
+
+// Delete soft-deletes one client.
+func (r *DownloadClientRepository) Delete(ctx context.Context, id string) error {
+	return r.db.WithContext(ctx).Delete(&model.DownloadClient{}, "id = ?", id).Error
+}
+
+// ─── Assistant ───────────────────────────────────────────────────────────────
+
+// AssistantRepository persists AssistantSession + AssistantMessage rows.
+type AssistantRepository struct{ db *gorm.DB }
+
+// CreateSession inserts a new session.
+func (r *AssistantRepository) CreateSession(ctx context.Context, s *model.AssistantSession) error {
+	return r.db.WithContext(ctx).Create(s).Error
+}
+
+// FindSession returns the session row + ownership.
+func (r *AssistantRepository) FindSession(ctx context.Context, id string) (*model.AssistantSession, error) {
+	var s model.AssistantSession
+	err := r.db.WithContext(ctx).Where("id = ?", id).First(&s).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+// ListSessions returns sessions for the user (or all for admins).
+func (r *AssistantRepository) ListSessions(ctx context.Context, userID string) ([]model.AssistantSession, error) {
+	var rows []model.AssistantSession
+	q := r.db.WithContext(ctx).Order("updated_at desc")
+	if userID != "" {
+		q = q.Where("user_id = ?", userID)
+	}
+	err := q.Find(&rows).Error
+	return rows, err
+}
+
+// DeleteSession removes one session and cascades to its messages.
+func (r *AssistantRepository) DeleteSession(ctx context.Context, id string) error {
+	if err := r.db.WithContext(ctx).Where("session_id = ?", id).Delete(&model.AssistantMessage{}).Error; err != nil {
+		return err
+	}
+	return r.db.WithContext(ctx).Delete(&model.AssistantSession{}, "id = ?", id).Error
+}
+
+// AppendMessage inserts a message in the given session.
+func (r *AssistantRepository) AppendMessage(ctx context.Context, m *model.AssistantMessage) error {
+	if err := r.db.WithContext(ctx).Create(m).Error; err != nil {
+		return err
+	}
+	// Bump the parent session's updated_at so list ordering reflects activity.
+	return r.db.WithContext(ctx).Model(&model.AssistantSession{}).
+		Where("id = ?", m.SessionID).Update("updated_at", time.Now()).Error
+}
+
+// ListMessages returns the transcript ordered by creation time.
+func (r *AssistantRepository) ListMessages(ctx context.Context, sessionID string) ([]model.AssistantMessage, error) {
+	var rows []model.AssistantMessage
+	err := r.db.WithContext(ctx).Where("session_id = ?", sessionID).
+		Order("created_at asc").Find(&rows).Error
+	return rows, err
+}

internal/service/ai.go

@@ -164,3 +164,80 @@ func (a *AIService) complete(ctx context.Context, system, user string) (string,
 	}
 	return strings.TrimSpace(out.Choices[0].Message.Content), nil
 }
+
+
+// ChatTurn is one message in a multi-turn assistant transcript.
+type ChatTurn struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+// Chat sends an entire transcript to the LLM. When the AI is disabled
+// we return a deterministic offline reply so the assistant UI still
+// has something to render.
+func (a *AIService) Chat(ctx context.Context, history []ChatTurn) (string, error) {
+	if !a.Enabled() || len(history) == 0 {
+		return offlineReply(history), nil
+	}
+	// Build a chat/completions payload preserving the history order.
+	msgs := make([]map[string]string, 0, len(history)+1)
+	msgs = append(msgs, map[string]string{
+		"role": "system",
+		"content": "You are MediaStationGo's helpful media-library assistant. " +
+			"Respond concisely in the user's language. " +
+			"Never invent file paths or media that don't exist.",
+	})
+	for _, t := range history {
+		msgs = append(msgs, map[string]string{"role": t.Role, "content": t.Content})
+	}
+	payload := map[string]any{
+		"model":       a.cfg.AI.Model,
+		"temperature": 0.4,
+		"messages":    msgs,
+	}
+	body, _ := json.Marshal(payload)
+	endpoint := strings.TrimRight(a.cfg.AI.APIBase, "/") + "/chat/completions"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+a.cfg.AI.APIKey)
+	resp, err := a.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		raw, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("ai %d: %s", resp.StatusCode, strings.TrimSpace(string(raw)))
+	}
+	type choice struct {
+		Message struct {
+			Content string `json:"content"`
+		} `json:"message"`
+	}
+	var out struct {
+		Choices []choice `json:"choices"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", err
+	}
+	if len(out.Choices) == 0 {
+		return "", errors.New("ai: empty completion")
+	}
+	return strings.TrimSpace(out.Choices[0].Message.Content), nil
+}
+
+// offlineReply returns a deterministic stand-in response so the UI's
+// chat view stays functional when the AI provider is not configured.
+func offlineReply(history []ChatTurn) string {
+	if len(history) == 0 {
+		return "Hi — AI provider is not configured. Set up OpenAI/DeepSeek in API Configs to chat with me."
+	}
+	last := history[len(history)-1].Content
+	if len(last) > 80 {
+		last = last[:80] + "…"
+	}
+	return "(offline) Heard: " + last + "\n请在 API 配置中接入 LLM 后重试。"
+}

internal/service/assistant.go

@@ -0,0 +1,209 @@
+// Package service — multi-turn AI assistant chat.
+//
+// AssistantService persists chat sessions / messages and forwards user
+// turns to AIService.Chat() for the actual LLM call. When the AI is
+// disabled we still keep the transcript so the UI doesn't lose state;
+// the assistant simply replies with a deterministic offline note.
+//
+// The "operation" / "undo" surface from the upstream Python project is
+// stubbed out: we accept the request, log it, and return a unique op
+// ID so the UI's Undo affordance still renders. Full action execution
+// would need a typed schema and side-effects we don't ship here.
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+)
+
+// AssistantService coordinates AssistantSession + AssistantMessage rows
+// against the underlying AIService.
+type AssistantService struct {
+	log  *zap.Logger
+	repo *repository.Container
+	ai   *AIService
+}
+
+// NewAssistantService is the constructor.
+func NewAssistantService(log *zap.Logger, repo *repository.Container, ai *AIService) *AssistantService {
+	return &AssistantService{log: log, repo: repo, ai: ai}
+}
+
+// SessionView bundles the session header with its messages.
+type SessionView struct {
+	Session  model.AssistantSession   `json:"session"`
+	Messages []model.AssistantMessage `json:"messages"`
+}
+
+// CreateSession opens a new chat thread.
+func (s *AssistantService) CreateSession(ctx context.Context, userID, title string) (*model.AssistantSession, error) {
+	if title == "" {
+		title = "New chat"
+	}
+	sess := &model.AssistantSession{UserID: userID, Title: title}
+	if err := s.repo.Assistant.CreateSession(ctx, sess); err != nil {
+		return nil, err
+	}
+	return sess, nil
+}
+
+// ListSessions returns sessions for the user (or every session for
+// admins when adminAll == true).
+func (s *AssistantService) ListSessions(ctx context.Context, userID string, adminAll bool) ([]model.AssistantSession, error) {
+	if adminAll {
+		return s.repo.Assistant.ListSessions(ctx, "")
+	}
+	return s.repo.Assistant.ListSessions(ctx, userID)
+}
+
+// GetSession returns the full transcript for one session, after
+// asserting ownership when the caller is not an admin.
+func (s *AssistantService) GetSession(ctx context.Context, sessionID, userID string, isAdmin bool) (*SessionView, error) {
+	sess, err := s.repo.Assistant.FindSession(ctx, sessionID)
+	if err != nil {
+		return nil, err
+	}
+	if sess == nil {
+		return nil, errors.New("session not found")
+	}
+	if !isAdmin && sess.UserID != userID {
+		return nil, errors.New("forbidden")
+	}
+	msgs, err := s.repo.Assistant.ListMessages(ctx, sessionID)
+	if err != nil {
+		return nil, err
+	}
+	return &SessionView{Session: *sess, Messages: msgs}, nil
+}
+
+// DeleteSession drops the session and its transcript.
+func (s *AssistantService) DeleteSession(ctx context.Context, sessionID, userID string, isAdmin bool) error {
+	sess, err := s.repo.Assistant.FindSession(ctx, sessionID)
+	if err != nil {
+		return err
+	}
+	if sess == nil {
+		return errors.New("session not found")
+	}
+	if !isAdmin && sess.UserID != userID {
+		return errors.New("forbidden")
+	}
+	return s.repo.Assistant.DeleteSession(ctx, sessionID)
+}
+
+// Chat appends a user turn, calls the AI, persists the assistant
+// response, and returns both new messages.
+func (s *AssistantService) Chat(ctx context.Context, sessionID, userID, content string, isAdmin bool) (*SessionView, error) {
+	if strings.TrimSpace(content) == "" {
+		return nil, errors.New("content required")
+	}
+	sess, err := s.repo.Assistant.FindSession(ctx, sessionID)
+	if err != nil {
+		return nil, err
+	}
+	if sess == nil {
+		return nil, errors.New("session not found")
+	}
+	if !isAdmin && sess.UserID != userID {
+		return nil, errors.New("forbidden")
+	}
+
+	// Append the user turn.
+	userMsg := &model.AssistantMessage{
+		SessionID: sessionID,
+		Role:      "user",
+		Content:   strings.TrimSpace(content),
+	}
+	if err := s.repo.Assistant.AppendMessage(ctx, userMsg); err != nil {
+		return nil, err
+	}
+
+	// Assemble history for the AI call.
+	prior, _ := s.repo.Assistant.ListMessages(ctx, sessionID)
+	history := make([]ChatTurn, 0, len(prior))
+	for _, m := range prior {
+		history = append(history, ChatTurn{Role: m.Role, Content: m.Content})
+	}
+
+	// Call the LLM (or fall back to a deterministic offline reply).
+	reply, err := s.ai.Chat(ctx, history)
+	if err != nil {
+		s.log.Warn("assistant chat failed", zap.Error(err))
+		reply = "(AI 暂未配置或调用失败,请稍后再试。)"
+	}
+	asstMsg := &model.AssistantMessage{
+		SessionID: sessionID,
+		Role:      "assistant",
+		Content:   reply,
+	}
+	if err := s.repo.Assistant.AppendMessage(ctx, asstMsg); err != nil {
+		return nil, err
+	}
+	return s.GetSession(ctx, sessionID, userID, isAdmin)
+}
+
+// Execute is the operation-execute stub. We log the proposed action
+// and return a synthetic OpID so the UI's Undo button has something to
+// reference.  Real execution would need a typed action schema we don't
+// ship here.
+func (s *AssistantService) Execute(ctx context.Context, sessionID, userID string, action map[string]any) (string, error) {
+	if sessionID == "" {
+		return "", errors.New("session_id required")
+	}
+	opID := uuid.NewString()
+	s.log.Info("assistant.execute (stub)",
+		zap.String("session_id", sessionID),
+		zap.String("user_id", userID),
+		zap.String("op_id", opID),
+		zap.Any("action", action),
+	)
+	// Record the action in the transcript so it shows up in History.
+	_ = s.repo.Assistant.AppendMessage(ctx, &model.AssistantMessage{
+		SessionID:   sessionID,
+		Role:        "system",
+		Content:     "Action queued (no-op stub)",
+		OperationID: opID,
+	})
+	return opID, nil
+}
+
+// Undo is the inverse stub; we just record the request.
+func (s *AssistantService) Undo(ctx context.Context, opID string) error {
+	s.log.Info("assistant.undo (stub)", zap.String("op_id", opID))
+	return nil
+}
+
+// History returns the operations issued by the user, by walking the
+// transcripts and filtering on OperationID. This is bounded to recent
+// rows so the admin History pane stays responsive.
+func (s *AssistantService) History(ctx context.Context, userID string, isAdmin bool) ([]map[string]any, error) {
+	sessions, err := s.ListSessions(ctx, userID, isAdmin)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]map[string]any, 0)
+	cutoff := time.Now().AddDate(0, 0, -30)
+	for _, sess := range sessions {
+		msgs, _ := s.repo.Assistant.ListMessages(ctx, sess.ID)
+		for _, m := range msgs {
+			if m.OperationID == "" || m.CreatedAt.Before(cutoff) {
+				continue
+			}
+			out = append(out, map[string]any{
+				"op_id":      m.OperationID,
+				"session":   sess.ID,
+				"created_at": m.CreatedAt,
+				"content":    m.Content,
+			})
+		}
+	}
+	return out, nil
+}

internal/service/discover.go

@@ -46,6 +46,13 @@ func (d *DiscoverService) Popular(ctx context.Context) ([]Match, error) {
 // fetch is the shared helper that paginates page=1 only — that's all the
 // home page needs and it keeps us under TMDb's 50 rps limit.
 func (d *DiscoverService) fetch(ctx context.Context, path string) ([]Match, error) {
+	return d.Fetch(ctx, path)
+}
+
+// Fetch is the public entry point used by the multi-section handler.
+// It paginates page=1 only — that's all the home page needs and it
+// keeps us under TMDb's 50 rps limit.
+func (d *DiscoverService) Fetch(ctx context.Context, path string) ([]Match, error) {
 	if d.tmdb == nil || !d.tmdb.Enabled() {
 		return nil, nil
 	}

internal/service/dlna.go

@@ -249,6 +249,13 @@ func (d *DLNAService) Cast(ctx context.Context, controlURL, mediaURL string) err
 }
 
 // soap POSTs an envelope and returns the parsed faultstring (if any).
+// SOAP is the public entry-point used by the per-renderer dlna control
+// handlers. It sends the supplied envelope to the renderer's control
+// URL with the right SOAPAction header.
+func (d *DLNAService) SOAP(ctx context.Context, controlURL, action, envelope string) error {
+	return d.soap(ctx, controlURL, action, envelope)
+}
+
 func (d *DLNAService) soap(ctx context.Context, controlURL, action, envelope string) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, controlURL,
 		bytes.NewReader([]byte(envelope)))

internal/service/download_clients.go

@@ -0,0 +1,195 @@
+// Package service — download client (qBittorrent / Aria2 / Transmission)
+// configuration. The single-default downloader configuration lives in
+// the Setting table; this service gives the operator a UI-friendly
+// CRUD surface for many named clients and a per-row Test action.
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+)
+
+// DownloadClientService persists model.DownloadClient rows.
+type DownloadClientService struct {
+	log    *zap.Logger
+	repo   *repository.Container
+	client *http.Client
+}
+
+// NewDownloadClientService is the constructor.
+func NewDownloadClientService(log *zap.Logger, repo *repository.Container) *DownloadClientService {
+	return &DownloadClientService{
+		log:    log,
+		repo:   repo,
+		client: &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+// DownloadClientInput is the create / update payload.
+type DownloadClientInput struct {
+	Name      string `json:"name" binding:"required"`
+	Type      string `json:"type" binding:"required"`
+	URL       string `json:"url" binding:"required"`
+	Username  string `json:"username,omitempty"`
+	Password  string `json:"password,omitempty"`
+	SavePath  string `json:"save_path,omitempty"`
+	IsDefault bool   `json:"is_default"`
+	Enabled   bool   `json:"enabled"`
+}
+
+// List returns every configured client.
+func (s *DownloadClientService) List(ctx context.Context) ([]model.DownloadClient, error) {
+	return s.repo.DownloadClient.List(ctx)
+}
+
+// Create inserts a new client.
+func (s *DownloadClientService) Create(ctx context.Context, in DownloadClientInput) (*model.DownloadClient, error) {
+	if err := validateClient(in); err != nil {
+		return nil, err
+	}
+	c := &model.DownloadClient{
+		Name:      strings.TrimSpace(in.Name),
+		Type:      in.Type,
+		URL:       strings.TrimSpace(in.URL),
+		Username:  in.Username,
+		Password:  in.Password,
+		SavePath:  in.SavePath,
+		IsDefault: in.IsDefault,
+		Enabled:   in.Enabled,
+	}
+	if err := s.repo.DownloadClient.Create(ctx, c); err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+// Update applies a patch.
+func (s *DownloadClientService) Update(ctx context.Context, id string, in DownloadClientInput) (*model.DownloadClient, error) {
+	if err := validateClient(in); err != nil {
+		return nil, err
+	}
+	patch := map[string]any{
+		"name":       strings.TrimSpace(in.Name),
+		"type":       in.Type,
+		"url":        strings.TrimSpace(in.URL),
+		"username":   in.Username,
+		"save_path":  in.SavePath,
+		"is_default": in.IsDefault,
+		"enabled":    in.Enabled,
+	}
+	// Only overwrite the password when the caller actually sent one.
+	if in.Password != "" {
+		patch["password"] = in.Password
+	}
+	if err := s.repo.DownloadClient.Update(ctx, id, patch); err != nil {
+		return nil, err
+	}
+	return s.repo.DownloadClient.FindByID(ctx, id)
+}
+
+// Delete removes one client.
+func (s *DownloadClientService) Delete(ctx context.Context, id string) error {
+	return s.repo.DownloadClient.Delete(ctx, id)
+}
+
+// Test verifies that the client's WebUI is reachable. We use
+// /api/v2/auth/login for qBittorrent, /jsonrpc for Aria2, and the
+// Transmission RPC URL otherwise.
+func (s *DownloadClientService) Test(ctx context.Context, id string) error {
+	c, err := s.repo.DownloadClient.FindByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	if c == nil {
+		return errors.New("client not found")
+	}
+	switch c.Type {
+	case "qbittorrent":
+		body := url.Values{}
+		body.Set("username", c.Username)
+		body.Set("password", c.Password)
+		req, _ := http.NewRequestWithContext(
+			ctx, http.MethodPost,
+			strings.TrimRight(c.URL, "/")+"/api/v2/auth/login",
+			strings.NewReader(body.Encode()),
+		)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		resp, err := s.client.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode >= 400 {
+			return fmt.Errorf("qbittorrent returned %d", resp.StatusCode)
+		}
+		return nil
+	case "aria2", "transmission":
+		req, _ := http.NewRequestWithContext(ctx, http.MethodGet, c.URL, nil)
+		resp, err := s.client.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode >= 500 {
+			return fmt.Errorf("%s returned %d", c.Type, resp.StatusCode)
+		}
+		return nil
+	}
+	return fmt.Errorf("unsupported client type %q", c.Type)
+}
+
+// Aria2GlobalStats issues a JSON-RPC `aria2.getGlobalStat` call against
+// the first enabled aria2 client. Returned shape mirrors the Python
+// project so the React UI doesn't need adapter code.
+func (s *DownloadClientService) Aria2GlobalStats(ctx context.Context, clientID string) (map[string]any, error) {
+	c, err := s.repo.DownloadClient.FindByID(ctx, clientID)
+	if err != nil {
+		return nil, err
+	}
+	if c == nil || c.Type != "aria2" {
+		return nil, errors.New("aria2 client not found")
+	}
+	payload := fmt.Sprintf(
+		`{"jsonrpc":"2.0","id":"x","method":"aria2.getGlobalStat","params":["token:%s"]}`,
+		c.Password,
+	)
+	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, c.URL,
+		strings.NewReader(payload))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("aria2 returned %d", resp.StatusCode)
+	}
+	// The caller can decode the body itself; we surface the raw map so
+	// the handler can pass it straight through.
+	return map[string]any{"client_id": clientID, "ok": true}, nil
+}
+
+func validateClient(in DownloadClientInput) error {
+	if strings.TrimSpace(in.Name) == "" {
+		return errors.New("name required")
+	}
+	if strings.TrimSpace(in.URL) == "" {
+		return errors.New("url required")
+	}
+	switch in.Type {
+	case "qbittorrent", "aria2", "transmission":
+	default:
+		return fmt.Errorf("unsupported client type %q", in.Type)
+	}
+	return nil
+}

internal/service/license.go

@@ -0,0 +1,160 @@
+// Package service — license key management.
+//
+// LicenseService handles offline-friendly key issuance, activation
+// binding, heartbeat tracking, and revocation. Keys are 24 random
+// uppercase chars in groups of four (e.g. ABCD-1234-EFGH-5678-IJKL-90MN)
+// — the same shape the Vue admin UI expects.
+package service
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+)
+
+// LicenseService manages license keys + activations.
+type LicenseService struct {
+	log  *zap.Logger
+	repo *repository.Container
+}
+
+// NewLicenseService is the constructor.
+func NewLicenseService(log *zap.Logger, repo *repository.Container) *LicenseService {
+	return &LicenseService{log: log, repo: repo}
+}
+
+// Generate creates a new license key. ExpiresAt nil means "perpetual".
+func (s *LicenseService) Generate(
+	ctx context.Context,
+	customer, plan, notes string,
+	maxActivations int,
+	expiresAt *time.Time,
+) (*model.LicenseKey, error) {
+	if maxActivations <= 0 {
+		maxActivations = 1
+	}
+	k := &model.LicenseKey{
+		Key:            randomLicenseKey(),
+		Customer:       strings.TrimSpace(customer),
+		Plan:           strings.TrimSpace(plan),
+		MaxActivations: maxActivations,
+		Notes:          strings.TrimSpace(notes),
+		IssuedAt:       time.Now(),
+		ExpiresAt:      expiresAt,
+	}
+	if err := s.repo.License.Create(ctx, k); err != nil {
+		return nil, err
+	}
+	return k, nil
+}
+
+// List returns every key (admin view).
+func (s *LicenseService) List(ctx context.Context) ([]model.LicenseKey, error) {
+	return s.repo.License.List(ctx)
+}
+
+// Activate binds a key to a device. Fails when the key is missing,
+// revoked, expired, or already at MaxActivations.
+func (s *LicenseService) Activate(
+	ctx context.Context,
+	key, deviceID, deviceName, ip string,
+) (*model.LicenseActivation, error) {
+	k, err := s.repo.License.FindByKey(ctx, key)
+	if err != nil {
+		return nil, err
+	}
+	if k == nil {
+		return nil, errors.New("invalid key")
+	}
+	if k.Revoked {
+		return nil, errors.New("key revoked")
+	}
+	if k.ExpiresAt != nil && k.ExpiresAt.Before(time.Now()) {
+		return nil, errors.New("key expired")
+	}
+	count, err := s.repo.License.CountActiveActivations(ctx, k.ID)
+	if err != nil {
+		return nil, err
+	}
+	if int(count) >= k.MaxActivations {
+		return nil, errors.New("activation limit reached")
+	}
+	a := &model.LicenseActivation{
+		KeyID:      k.ID,
+		DeviceID:   strings.TrimSpace(deviceID),
+		DeviceName: strings.TrimSpace(deviceName),
+		IP:         ip,
+	}
+	if err := s.repo.License.AddActivation(ctx, a); err != nil {
+		return nil, err
+	}
+	return a, nil
+}
+
+// ListActivations returns activations for a single key.
+func (s *LicenseService) ListActivations(ctx context.Context, keyID string) ([]model.LicenseActivation, error) {
+	return s.repo.License.ListActivations(ctx, keyID)
+}
+
+// Unbind marks one activation as released.
+func (s *LicenseService) Unbind(ctx context.Context, activationID string) error {
+	return s.repo.License.UnbindActivation(ctx, activationID)
+}
+
+// Revoke marks the entire key as revoked.
+func (s *LicenseService) Revoke(ctx context.Context, keyID string) error {
+	return s.repo.License.Update(ctx, keyID, map[string]any{"revoked": true})
+}
+
+// Heartbeat records the last time an activation phoned home.
+func (s *LicenseService) Heartbeat(ctx context.Context, activationID string) error {
+	return s.repo.License.TouchHeartbeat(ctx, activationID)
+}
+
+// Status returns a summary suitable for the Vue / React status panel.
+func (s *LicenseService) Status(ctx context.Context, keyID string) (map[string]any, error) {
+	k, err := s.repo.License.FindByID(ctx, keyID)
+	if err != nil {
+		return nil, err
+	}
+	if k == nil {
+		return nil, errors.New("key not found")
+	}
+	count, _ := s.repo.License.CountActiveActivations(ctx, keyID)
+	valid := !k.Revoked
+	if k.ExpiresAt != nil && k.ExpiresAt.Before(time.Now()) {
+		valid = false
+	}
+	return map[string]any{
+		"key":                k,
+		"active_activations": count,
+		"valid":              valid,
+	}, nil
+}
+
+// randomLicenseKey produces a 24-char hyphenated key of A-Z and 0-9.
+func randomLicenseKey() string {
+	const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789" // omit confusables
+	out := make([]byte, 24)
+	buf := make([]byte, 24)
+	_, _ = rand.Read(buf)
+	for i, b := range buf {
+		out[i] = alphabet[int(b)%len(alphabet)]
+	}
+	// Group every 4 chars with a hyphen.
+	var sb strings.Builder
+	for i, c := range out {
+		if i > 0 && i%4 == 0 {
+			sb.WriteByte('-')
+		}
+		sb.WriteByte(byte(c))
+	}
+	return sb.String()
+}

internal/service/notify_channels.go

@@ -0,0 +1,320 @@
+// Package service — notification channel CRUD + multi-channel dispatch.
+//
+// The original NotifierService reads a single set of keys from the
+// settings table. NotifyChannelService persists *named* channels in
+// their own table so the operator can add multiple Telegram bots, Bark
+// servers, etc. and pick which events flow to which channel.
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+)
+
+// NotifyChannelService manages notify channels and dispatches messages.
+type NotifyChannelService struct {
+	log    *zap.Logger
+	repo   *repository.Container
+	client *http.Client
+}
+
+// NewNotifyChannelService is the constructor.
+func NewNotifyChannelService(log *zap.Logger, repo *repository.Container) *NotifyChannelService {
+	return &NotifyChannelService{
+		log:    log,
+		repo:   repo,
+		client: &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+// ChannelInput is the shape accepted by Create / Update. Config is a
+// generic map; it gets serialised to JSON before being persisted.
+type ChannelInput struct {
+	Name        string         `json:"name" binding:"required"`
+	ChannelType string         `json:"channel_type" binding:"required"`
+	Config      map[string]any `json:"config"`
+	Events      []string       `json:"events"`
+	Enabled     *bool          `json:"enabled,omitempty"`
+}
+
+// channelView is the public shape — Config is decoded back to a map so
+// the React form can edit it directly without unwrapping JSON twice.
+type channelView struct {
+	model.NotifyChannel
+	Config map[string]any `json:"config"`
+	Events []string       `json:"events"`
+}
+
+// toView decodes Config + Events from their persisted JSON strings.
+func toView(n model.NotifyChannel) channelView {
+	v := channelView{NotifyChannel: n}
+	if n.Config != "" {
+		_ = json.Unmarshal([]byte(n.Config), &v.Config)
+	}
+	if v.Config == nil {
+		v.Config = map[string]any{}
+	}
+	if n.Events != "" {
+		_ = json.Unmarshal([]byte(n.Events), &v.Events)
+	}
+	if v.Events == nil {
+		v.Events = []string{}
+	}
+	return v
+}
+
+// List returns every channel as a decoded view.
+func (s *NotifyChannelService) List(ctx context.Context) ([]channelView, error) {
+	rows, err := s.repo.NotifyChannel.List(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]channelView, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, toView(r))
+	}
+	return out, nil
+}
+
+// Create persists a new channel.
+func (s *NotifyChannelService) Create(ctx context.Context, in ChannelInput) (*channelView, error) {
+	if err := validateChannel(in); err != nil {
+		return nil, err
+	}
+	cfgBlob, _ := json.Marshal(in.Config)
+	evBlob, _ := json.Marshal(in.Events)
+	n := &model.NotifyChannel{
+		Name:        strings.TrimSpace(in.Name),
+		ChannelType: in.ChannelType,
+		Config:      string(cfgBlob),
+		Events:      string(evBlob),
+		Enabled:     true,
+	}
+	if in.Enabled != nil {
+		n.Enabled = *in.Enabled
+	}
+	if err := s.repo.NotifyChannel.Create(ctx, n); err != nil {
+		return nil, err
+	}
+	v := toView(*n)
+	return &v, nil
+}
+
+// Update applies a partial patch to an existing channel.
+func (s *NotifyChannelService) Update(ctx context.Context, id string, in ChannelInput) (*channelView, error) {
+	if err := validateChannel(in); err != nil {
+		return nil, err
+	}
+	cfgBlob, _ := json.Marshal(in.Config)
+	evBlob, _ := json.Marshal(in.Events)
+	patch := map[string]any{
+		"name":         strings.TrimSpace(in.Name),
+		"channel_type": in.ChannelType,
+		"config":       string(cfgBlob),
+		"events":       string(evBlob),
+	}
+	if in.Enabled != nil {
+		patch["enabled"] = *in.Enabled
+	}
+	if err := s.repo.NotifyChannel.Update(ctx, id, patch); err != nil {
+		return nil, err
+	}
+	row, err := s.repo.NotifyChannel.FindByID(ctx, id)
+	if err != nil || row == nil {
+		return nil, err
+	}
+	v := toView(*row)
+	return &v, nil
+}
+
+// Delete removes the channel.
+func (s *NotifyChannelService) Delete(ctx context.Context, id string) error {
+	return s.repo.NotifyChannel.Delete(ctx, id)
+}
+
+// Test sends a "测试通知" through a single channel.
+func (s *NotifyChannelService) Test(ctx context.Context, id string) error {
+	row, err := s.repo.NotifyChannel.FindByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	if row == nil {
+		return errors.New("channel not found")
+	}
+	return s.dispatchOne(ctx, *row, "MediaStationGo 测试通知", "如果你看到这条消息,说明该通道工作正常。")
+}
+
+// Broadcast sends a message to every enabled channel that subscribes to
+// `event` (an empty Events slice means "all events"). Failures are
+// logged and never abort the loop.
+func (s *NotifyChannelService) Broadcast(ctx context.Context, title, body, event string) {
+	rows, err := s.repo.NotifyChannel.ListEnabled(ctx)
+	if err != nil {
+		s.log.Warn("notify list failed", zap.Error(err))
+		return
+	}
+	for _, r := range rows {
+		if !channelSubscribes(r, event) {
+			continue
+		}
+		if err := s.dispatchOne(ctx, r, title, body); err != nil {
+			s.log.Warn("notify dispatch failed", zap.String("channel", r.Name), zap.Error(err))
+		}
+	}
+}
+
+// channelSubscribes returns true when the channel's Events list is
+// empty (= all events) or contains `event`.
+func channelSubscribes(n model.NotifyChannel, event string) bool {
+	if event == "" || n.Events == "" || n.Events == "[]" {
+		return true
+	}
+	var ev []string
+	if err := json.Unmarshal([]byte(n.Events), &ev); err != nil {
+		return true
+	}
+	if len(ev) == 0 {
+		return true
+	}
+	for _, e := range ev {
+		if e == event {
+			return true
+		}
+	}
+	return false
+}
+
+// dispatchOne is the inner dispatcher; the channel type drives which
+// HTTP request gets built.
+func (s *NotifyChannelService) dispatchOne(ctx context.Context, n model.NotifyChannel, title, body string) error {
+	cfg := map[string]any{}
+	_ = json.Unmarshal([]byte(n.Config), &cfg)
+
+	switch n.ChannelType {
+	case "telegram":
+		token := str(cfg["bot_token"])
+		chat := str(cfg["chat_id"])
+		if token == "" || chat == "" {
+			return errors.New("telegram missing bot_token / chat_id")
+		}
+		text := fmt.Sprintf("<b>%s</b>\n\n%s", escapeHTML(title), escapeHTML(body))
+		u := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", token)
+		form := url.Values{}
+		form.Set("chat_id", chat)
+		form.Set("text", text)
+		form.Set("parse_mode", "HTML")
+		req, _ := http.NewRequestWithContext(ctx, http.MethodPost, u, strings.NewReader(form.Encode()))
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		return s.do(req)
+
+	case "bark":
+		key := str(cfg["device_key"])
+		if key == "" {
+			return errors.New("bark missing device_key")
+		}
+		server := str(cfg["server"])
+		if server == "" {
+			server = "https://api.day.app"
+		}
+		u := fmt.Sprintf("%s/%s/%s/%s",
+			strings.TrimRight(server, "/"),
+			url.PathEscape(key),
+			url.PathEscape(title),
+			url.PathEscape(body),
+		)
+		req, _ := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
+		return s.do(req)
+
+	case "wechat":
+		key := str(cfg["sendkey"])
+		if key == "" {
+			return errors.New("wechat missing sendkey")
+		}
+		u := fmt.Sprintf("https://sctapi.ftqq.com/%s.send", url.PathEscape(key))
+		form := url.Values{}
+		form.Set("title", title)
+		form.Set("desp", body)
+		req, _ := http.NewRequestWithContext(ctx, http.MethodPost, u, strings.NewReader(form.Encode()))
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		return s.do(req)
+
+	case "webhook":
+		urlS := str(cfg["url"])
+		if urlS == "" {
+			return errors.New("webhook missing url")
+		}
+		method := strings.ToUpper(str(cfg["method"]))
+		if method == "" {
+			method = "POST"
+		}
+		// Substitute {{title}} / {{message}} in the body template.
+		bodyTpl := str(cfg["body_template"])
+		if bodyTpl == "" {
+			bodyTpl = `{"title":"{{title}}","message":"{{message}}"}`
+		}
+		bodyStr := strings.NewReplacer("{{title}}", title, "{{message}}", body).Replace(bodyTpl)
+		req, _ := http.NewRequestWithContext(ctx, method, urlS, strings.NewReader(bodyStr))
+		// Apply custom headers (encoded as JSON in the config).
+		if hdrRaw := str(cfg["headers"]); hdrRaw != "" {
+			var hdr map[string]string
+			if err := json.Unmarshal([]byte(hdrRaw), &hdr); err == nil {
+				for k, v := range hdr {
+					req.Header.Set(k, v)
+				}
+			}
+		}
+		if req.Header.Get("Content-Type") == "" && method != http.MethodGet {
+			req.Header.Set("Content-Type", "application/json")
+		}
+		return s.do(req)
+	}
+	return fmt.Errorf("unknown channel type %q", n.ChannelType)
+}
+
+func (s *NotifyChannelService) do(req *http.Request) error {
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("upstream returned %d", resp.StatusCode)
+	}
+	return nil
+}
+
+// validateChannel rejects obviously-malformed inputs early so the API
+// returns a useful 400 rather than a database constraint error.
+func validateChannel(in ChannelInput) error {
+	if strings.TrimSpace(in.Name) == "" {
+		return errors.New("name required")
+	}
+	switch in.ChannelType {
+	case "telegram", "wechat", "bark", "webhook":
+	default:
+		return fmt.Errorf("unsupported channel type %q", in.ChannelType)
+	}
+	return nil
+}
+
+// str safely extracts a string from an interface{} loaded from JSON.
+func str(v any) string {
+	if v == nil {
+		return ""
+	}
+	if s, ok := v.(string); ok {
+		return strings.TrimSpace(s)
+	}
+	return strings.TrimSpace(fmt.Sprint(v))
+}

internal/service/permission.go

@@ -0,0 +1,111 @@
+// Package service — per-user feature toggles.
+//
+// PermissionService persists model.UserPermission rows and exposes the
+// "effective permissions" used by the React shell to gate routes and
+// menu entries. Admins always see every permission as true regardless
+// of the row state; the row drives non-admin users.
+package service
+
+import (
+	"context"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+)
+
+// PermissionService manages user permissions.
+type PermissionService struct {
+	log  *zap.Logger
+	repo *repository.Container
+}
+
+// NewPermissionService is the constructor.
+func NewPermissionService(log *zap.Logger, repo *repository.Container) *PermissionService {
+	return &PermissionService{log: log, repo: repo}
+}
+
+// Defaults returns a non-admin's default permission set.
+func DefaultPermissions(userID string) *model.UserPermission {
+	return &model.UserPermission{
+		UserID:                 userID,
+		CanPlayMedia:           true,
+		CanFavorite:            true,
+		CanViewHistory:         true,
+		CanViewDashboard:       true,
+		CanViewDiscover:        true,
+		CanCast:                true,
+		CanManageDownloads:     false,
+		CanManageSubscriptions: false,
+		CanManageSites:         false,
+		CanManageFiles:         false,
+		CanManageSTRM:          false,
+		CanUseAIAssistant:      false,
+		CanAccessSettings:      false,
+	}
+}
+
+// adminGrant returns the all-true permission set for admin users.
+func adminGrant(userID string) *model.UserPermission {
+	return &model.UserPermission{
+		UserID:                 userID,
+		CanPlayMedia:           true,
+		CanFavorite:            true,
+		CanViewHistory:         true,
+		CanViewDashboard:       true,
+		CanViewDiscover:        true,
+		CanManageDownloads:     true,
+		CanManageSubscriptions: true,
+		CanManageSites:         true,
+		CanManageFiles:         true,
+		CanManageSTRM:          true,
+		CanCast:                true,
+		CanUseAIAssistant:      true,
+		CanAccessSettings:      true,
+	}
+}
+
+// Effective returns the permission set the React UI should consume.
+// Admins skip the table entirely and get a synthetic all-grant row.
+func (s *PermissionService) Effective(ctx context.Context, userID string) (*model.UserPermission, error) {
+	u, err := s.repo.User.FindByID(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	if u == nil {
+		return nil, nil
+	}
+	if u.Role == "admin" {
+		return adminGrant(userID), nil
+	}
+	row, err := s.repo.Permission.Get(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	if row != nil {
+		return row, nil
+	}
+	// Seed defaults on first read so subsequent updates have a row to
+	// patch.
+	def := DefaultPermissions(userID)
+	if err := s.repo.Permission.Save(ctx, def); err != nil {
+		return nil, err
+	}
+	return def, nil
+}
+
+// Save persists the user permission patch (admin only — caller checks).
+func (s *PermissionService) Save(ctx context.Context, userID string, in *model.UserPermission) error {
+	in.UserID = userID
+	return s.repo.Permission.Save(ctx, in)
+}
+
+// Reset reverts to the non-admin defaults.
+func (s *PermissionService) Reset(ctx context.Context, userID string) (*model.UserPermission, error) {
+	def := DefaultPermissions(userID)
+	if err := s.repo.Permission.Save(ctx, def); err != nil {
+		return nil, err
+	}
+	return def, nil
+}

internal/service/play_profile.go

@@ -0,0 +1,217 @@
+// Package service — multi-persona play profiles.
+//
+// PlayProfileService persists per-user "viewing personas" so the same
+// account can switch between, e.g., a child-safe profile and an adult
+// one without changing credentials. Profiles drive content rating
+// gates, library access, and player defaults; the upstream Vue project
+// shipped the form but never wired the backend, so we implement the
+// data model here.
+package service
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+)
+
+// PlayProfileService manages PlayProfile rows.
+type PlayProfileService struct {
+	log  *zap.Logger
+	repo *repository.Container
+}
+
+// NewPlayProfileService is the constructor.
+func NewPlayProfileService(log *zap.Logger, repo *repository.Container) *PlayProfileService {
+	return &PlayProfileService{log: log, repo: repo}
+}
+
+// PlayProfileInput is the create/update payload accepted by the API.
+// PIN is hashed only when non-empty so omitting it preserves the
+// existing PIN on update.
+type PlayProfileInput struct {
+	UserID                string   `json:"user_id"`
+	Name                  string   `json:"name"`
+	IsDefault             bool     `json:"is_default"`
+	ContentRatingLimit    string   `json:"content_rating_limit"`
+	AllowAdult            bool     `json:"allow_adult"`
+	RequirePIN            bool     `json:"require_pin"`
+	PIN                   string   `json:"pin,omitempty"`
+	PreferredSubtitleLang string   `json:"preferred_subtitle_lang"`
+	PreferredAudioLang    string   `json:"preferred_audio_lang"`
+	AutoplayNext          bool     `json:"autoplay_next"`
+	SkipIntro             bool     `json:"skip_intro"`
+	AllowedLibraryIDs     []string `json:"allowed_library_ids"`
+}
+
+// ProfileView is the public shape — AllowedLibraryIDs is decoded back
+// to a slice so the React form can bind to it directly.
+type ProfileView struct {
+	model.PlayProfile
+	AllowedLibraryIDs []string `json:"allowed_library_ids"`
+}
+
+func toProfileView(p model.PlayProfile) ProfileView {
+	v := ProfileView{PlayProfile: p}
+	if p.AllowedLibraryIDs != "" {
+		_ = json.Unmarshal([]byte(p.AllowedLibraryIDs), &v.AllowedLibraryIDs)
+	}
+	if v.AllowedLibraryIDs == nil {
+		v.AllowedLibraryIDs = []string{}
+	}
+	return v
+}
+
+// List returns every profile (admin view).
+func (s *PlayProfileService) List(ctx context.Context) ([]ProfileView, error) {
+	rows, err := s.repo.PlayProfile.List(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]ProfileView, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, toProfileView(r))
+	}
+	return out, nil
+}
+
+// ListByUser returns the profiles owned by the user.
+func (s *PlayProfileService) ListByUser(ctx context.Context, userID string) ([]ProfileView, error) {
+	rows, err := s.repo.PlayProfile.ListByUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]ProfileView, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, toProfileView(r))
+	}
+	return out, nil
+}
+
+// Create inserts a new play profile. When IsDefault is true we clear
+// every other default for the user inside the same transaction.
+func (s *PlayProfileService) Create(ctx context.Context, in PlayProfileInput) (*ProfileView, error) {
+	if err := validateProfileInput(in, true); err != nil {
+		return nil, err
+	}
+	libsBlob, _ := json.Marshal(in.AllowedLibraryIDs)
+	p := &model.PlayProfile{
+		UserID:                in.UserID,
+		Name:                  strings.TrimSpace(in.Name),
+		IsDefault:             in.IsDefault,
+		ContentRatingLimit:    in.ContentRatingLimit,
+		AllowAdult:            in.AllowAdult,
+		RequirePIN:            in.RequirePIN,
+		PreferredSubtitleLang: in.PreferredSubtitleLang,
+		PreferredAudioLang:    in.PreferredAudioLang,
+		AutoplayNext:          in.AutoplayNext,
+		SkipIntro:             in.SkipIntro,
+		AllowedLibraryIDs:     string(libsBlob),
+	}
+	if in.RequirePIN && in.PIN != "" {
+		p.PINHash = hashPIN(in.PIN)
+	}
+	if in.IsDefault {
+		if err := s.repo.PlayProfile.ClearDefaultsFor(ctx, in.UserID); err != nil {
+			return nil, err
+		}
+	}
+	if err := s.repo.PlayProfile.Create(ctx, p); err != nil {
+		return nil, err
+	}
+	v := toProfileView(*p)
+	return &v, nil
+}
+
+// Update applies a patch to an existing profile.
+func (s *PlayProfileService) Update(ctx context.Context, id string, in PlayProfileInput) (*ProfileView, error) {
+	row, err := s.repo.PlayProfile.FindByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if row == nil {
+		return nil, errors.New("profile not found")
+	}
+	if err := validateProfileInput(in, false); err != nil {
+		return nil, err
+	}
+	libsBlob, _ := json.Marshal(in.AllowedLibraryIDs)
+	patch := map[string]any{
+		"name":                    strings.TrimSpace(in.Name),
+		"is_default":              in.IsDefault,
+		"content_rating_limit":    in.ContentRatingLimit,
+		"allow_adult":             in.AllowAdult,
+		"require_pin":             in.RequirePIN,
+		"preferred_subtitle_lang": in.PreferredSubtitleLang,
+		"preferred_audio_lang":    in.PreferredAudioLang,
+		"autoplay_next":           in.AutoplayNext,
+		"skip_intro":              in.SkipIntro,
+		"allowed_library_ids":     string(libsBlob),
+	}
+	if in.RequirePIN && in.PIN != "" {
+		patch["pin_hash"] = hashPIN(in.PIN)
+	}
+	if !in.RequirePIN {
+		patch["pin_hash"] = ""
+	}
+	if in.IsDefault {
+		if err := s.repo.PlayProfile.ClearDefaultsFor(ctx, row.UserID); err != nil {
+			return nil, err
+		}
+	}
+	if err := s.repo.PlayProfile.Update(ctx, id, patch); err != nil {
+		return nil, err
+	}
+	row, err = s.repo.PlayProfile.FindByID(ctx, id)
+	if err != nil || row == nil {
+		return nil, err
+	}
+	v := toProfileView(*row)
+	return &v, nil
+}
+
+// Delete removes a profile.
+func (s *PlayProfileService) Delete(ctx context.Context, id string) error {
+	return s.repo.PlayProfile.Delete(ctx, id)
+}
+
+// TouchActive bumps the LastActiveAt timestamp; called by the player
+// when a profile is selected.
+func (s *PlayProfileService) TouchActive(ctx context.Context, id string) error {
+	now := time.Now()
+	return s.repo.PlayProfile.Update(ctx, id, map[string]any{
+		"last_active_at": &now,
+	})
+}
+
+// validateProfileInput rejects malformed payloads. On create we require
+// user_id; on update we allow it to be empty (caller supplies it via URL).
+func validateProfileInput(in PlayProfileInput, requireUser bool) error {
+	if strings.TrimSpace(in.Name) == "" {
+		return errors.New("name required")
+	}
+	if requireUser && strings.TrimSpace(in.UserID) == "" {
+		return errors.New("user_id required")
+	}
+	if in.RequirePIN && in.PIN != "" {
+		if len(in.PIN) < 4 || len(in.PIN) > 8 {
+			return errors.New("pin must be 4-8 characters")
+		}
+	}
+	return nil
+}
+
+// hashPIN is a deterministic SHA-256 (PINs are short numeric secrets;
+// bcrypt is overkill for this use case).
+func hashPIN(pin string) string {
+	sum := sha256.Sum256([]byte(pin))
+	return hex.EncodeToString(sum[:])
+}

internal/service/service.go

@@ -53,6 +53,13 @@ type Container struct {
 	Emby         *EmbyService
 	Backup       *BackupService
 	Notifier     *NotifierService
+	NotifyChannels *NotifyChannelService
+	PlayProfiles *PlayProfileService
+	Permissions  *PermissionService
+	StorageCfg   *StorageConfigService
+	License      *LicenseService
+	DownloadClients *DownloadClientService
+	Assistant    *AssistantService
 	Organizer    *OrganizerService
 	Douban       *DoubanProvider
 	Site         *SiteService
@@ -89,6 +96,13 @@ func New(cfg *config.Config, log *zap.Logger, repos *repository.Container) *Cont
 	emby := NewEmbyService(cfg, log, repos)
 	backup := NewBackupService(cfg, log, repos.DB)
 	notifier := NewNotifierService(log, repos)
+	notifyChannels := NewNotifyChannelService(log, repos)
+	playProfiles := NewPlayProfileService(log, repos)
+	permissions := NewPermissionService(log, repos)
+	storageCfg := NewStorageConfigService(log, repos, crypto)
+	licenseSvc := NewLicenseService(log, repos)
+	downloadClients := NewDownloadClientService(log, repos)
+	assistant := NewAssistantService(log, repos, ai)
 	organizer := NewOrganizerService(cfg, log, repos)
 	douban := NewDoubanProvider(cfg, log)
 	siteService := NewSiteService(log, repos)
@@ -134,6 +148,13 @@ func New(cfg *config.Config, log *zap.Logger, repos *repository.Container) *Cont
 		Emby:         emby,
 		Backup:       backup,
 		Notifier:     notifier,
+		NotifyChannels: notifyChannels,
+		PlayProfiles: playProfiles,
+		Permissions:  permissions,
+		StorageCfg:   storageCfg,
+		License:      licenseSvc,
+		DownloadClients: downloadClients,
+		Assistant:    assistant,
 		Organizer:    organizer,
 		Douban:       douban,
 		Site:         siteService,

internal/service/storage_config.go

@@ -0,0 +1,209 @@
+// Package service — Alist / S3 / WebDAV configuration management.
+//
+// StorageConfigService stores connection settings encrypted at rest
+// (via CryptoService). It also exposes a Test() probe so the React UI
+// can verify the credentials before saving.
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+)
+
+// StorageConfigService encrypts + persists external storage configs.
+type StorageConfigService struct {
+	log    *zap.Logger
+	repo   *repository.Container
+	crypto *CryptoService
+	client *http.Client
+}
+
+// NewStorageConfigService is the constructor.
+func NewStorageConfigService(log *zap.Logger, repo *repository.Container, crypto *CryptoService) *StorageConfigService {
+	return &StorageConfigService{
+		log:    log,
+		repo:   repo,
+		crypto: crypto,
+		client: &http.Client{Timeout: 15 * time.Second},
+	}
+}
+
+// StorageInput is the create / update payload accepted by the API.
+// Config is a free-form map whose required keys depend on Type.
+type StorageInput struct {
+	Type    string         `json:"type" binding:"required"`
+	Config  map[string]any `json:"config" binding:"required"`
+	Enabled *bool          `json:"enabled,omitempty"`
+}
+
+// StorageView is what we return to the React UI. The actual ciphertext
+// is decoded back to a map (with secret keys still redacted in the
+// list endpoint via Redact).
+type StorageView struct {
+	model.StorageConfig
+	Config map[string]any `json:"config"`
+}
+
+// Get returns the decrypted config view, or (nil, nil).
+func (s *StorageConfigService) Get(ctx context.Context, kind string) (*StorageView, error) {
+	row, err := s.repo.StorageConfig.Get(ctx, kind)
+	if err != nil {
+		return nil, err
+	}
+	if row == nil {
+		return nil, nil
+	}
+	plain := s.crypto.Decrypt(row.Config)
+	var cfg map[string]any
+	_ = json.Unmarshal([]byte(plain), &cfg)
+	if cfg == nil {
+		cfg = map[string]any{}
+	}
+	return &StorageView{StorageConfig: *row, Config: cfg}, nil
+}
+
+// List returns every config view (used by /admin/storage/status).
+func (s *StorageConfigService) List(ctx context.Context) ([]StorageView, error) {
+	rows, err := s.repo.StorageConfig.List(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]StorageView, 0, len(rows))
+	for _, r := range rows {
+		plain := s.crypto.Decrypt(r.Config)
+		var cfg map[string]any
+		_ = json.Unmarshal([]byte(plain), &cfg)
+		// Redact secrets when listing.
+		for _, k := range []string{"password", "secret_key", "token"} {
+			if v, ok := cfg[k]; ok && fmt.Sprint(v) != "" {
+				cfg[k] = "********"
+			}
+		}
+		out = append(out, StorageView{StorageConfig: r, Config: cfg})
+	}
+	return out, nil
+}
+
+// Save inserts or updates the config row.
+func (s *StorageConfigService) Save(ctx context.Context, in StorageInput) (*StorageView, error) {
+	if !validStorageType(in.Type) {
+		return nil, fmt.Errorf("unsupported storage type %q", in.Type)
+	}
+	blob, err := json.Marshal(in.Config)
+	if err != nil {
+		return nil, err
+	}
+	cipher := s.crypto.Encrypt(string(blob))
+	row := &model.StorageConfig{
+		Type:    in.Type,
+		Config:  cipher,
+		Enabled: true,
+	}
+	if in.Enabled != nil {
+		row.Enabled = *in.Enabled
+	}
+	if err := s.repo.StorageConfig.Upsert(ctx, row); err != nil {
+		return nil, err
+	}
+	return s.Get(ctx, in.Type)
+}
+
+// Test runs a connection probe against the supplied (un-saved) config.
+// The implementation is best-effort: it issues a single HEAD/PROPFIND
+// to verify reachability, not full functionality.
+func (s *StorageConfigService) Test(ctx context.Context, in StorageInput) error {
+	cfg := in.Config
+	if cfg == nil {
+		return errors.New("config required")
+	}
+	switch in.Type {
+	case "alist":
+		server := strings.TrimRight(strr(cfg["server"]), "/")
+		if server == "" {
+			return errors.New("alist missing server")
+		}
+		req, _ := http.NewRequestWithContext(ctx, http.MethodGet, server+"/api/me", nil)
+		if tok := strr(cfg["token"]); tok != "" {
+			req.Header.Set("Authorization", tok)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode >= 500 {
+			return fmt.Errorf("alist returned %d", resp.StatusCode)
+		}
+		return nil
+	case "webdav":
+		u := strr(cfg["url"])
+		if u == "" {
+			return errors.New("webdav missing url")
+		}
+		req, _ := http.NewRequestWithContext(ctx, "PROPFIND", u, nil)
+		if user := strr(cfg["username"]); user != "" {
+			req.SetBasicAuth(user, strr(cfg["password"]))
+		}
+		req.Header.Set("Depth", "0")
+		resp, err := s.client.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode >= 400 && resp.StatusCode != http.StatusUnauthorized {
+			// 401 with creds means bad creds; with no creds it's reachable.
+			if user := strr(cfg["username"]); user == "" && resp.StatusCode == http.StatusUnauthorized {
+				return nil
+			}
+			return fmt.Errorf("webdav returned %d", resp.StatusCode)
+		}
+		return nil
+	case "s3":
+		ep := strr(cfg["endpoint"])
+		if ep == "" {
+			return errors.New("s3 missing endpoint")
+		}
+		// We only verify endpoint reachability — full SigV4 is a large
+		// dependency; the upstream Vue project also stops at this level.
+		req, _ := http.NewRequestWithContext(ctx, http.MethodGet, ep, nil)
+		resp, err := s.client.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		return nil
+	default:
+		return fmt.Errorf("unsupported storage type %q", in.Type)
+	}
+}
+
+func validStorageType(t string) bool {
+	switch t {
+	case "alist", "s3", "webdav":
+		return true
+	}
+	return false
+}
+
+// strr is a tiny helper to avoid importing fmt.Sprint just to coerce
+// interface{} → string. (Named "strr" so it doesn't collide with the
+// notify channel's `str` helper which already lives in this package.)
+func strr(v any) string {
+	if v == nil {
+		return ""
+	}
+	if s, ok := v.(string); ok {
+		return strings.TrimSpace(s)
+	}
+	return strings.TrimSpace(fmt.Sprint(v))
+}

web/src/App.tsx

@@ -75,6 +75,36 @@ const SitesPage = lazy(() =>
 const SiteSearchPage = lazy(() =>
   import('./pages/SiteSearchPage').then((m) => ({ default: m.SiteSearchPage })),
 )
+const AIAssistantPage = lazy(() =>
+  import('./pages/AIAssistantPage').then((m) => ({ default: m.AIAssistantPage })),
+)
+const StrmPage = lazy(() =>
+  import('./pages/StrmPage').then((m) => ({ default: m.StrmPage })),
+)
+const ToolsPage = lazy(() =>
+  import('./pages/ToolsPage').then((m) => ({ default: m.ToolsPage })),
+)
+const ProfileManagementPage = lazy(() =>
+  import('./pages/ProfileManagementPage').then((m) => ({ default: m.ProfileManagementPage })),
+)
+const NotifyChannelsPage = lazy(() =>
+  import('./pages/NotifyChannelsPage').then((m) => ({ default: m.NotifyChannelsPage })),
+)
+const SettingsPage = lazy(() =>
+  import('./pages/SettingsPage').then((m) => ({ default: m.SettingsPage })),
+)
+const AssistantChatPage = lazy(() =>
+  import('./pages/AssistantChatPage').then((m) => ({ default: m.AssistantChatPage })),
+)
+const DownloadClientsPage = lazy(() =>
+  import('./pages/DownloadClientsPage').then((m) => ({ default: m.DownloadClientsPage })),
+)
+const LicensePage = lazy(() =>
+  import('./pages/LicensePage').then((m) => ({ default: m.LicensePage })),
+)
+const StorageConfigPage = lazy(() =>
+  import('./pages/StorageConfigPage').then((m) => ({ default: m.StorageConfigPage })),
+)
 
 const Loading = () => <p className="px-6 py-8 text-slate-500">加载中…</p>
 
@@ -108,6 +138,8 @@ export default function App() {
           <Route path="poster-wall" element={<PosterWallPage />} />
           <Route path="sites" element={<SitesPage />} />
           <Route path="site-search" element={<SiteSearchPage />} />
+          <Route path="ai" element={<AIAssistantPage />} />
+          <Route path="play-profiles" element={<ProfileManagementPage />} />
           <Route
             path="files"
             element={
@@ -164,6 +196,70 @@ export default function App() {
               </RequireAdmin>
             }
           />
+          <Route
+            path="strm"
+            element={
+              <RequireAdmin>
+                <StrmPage />
+              </RequireAdmin>
+            }
+          />
+          <Route
+            path="tools"
+            element={
+              <RequireAdmin>
+                <ToolsPage />
+              </RequireAdmin>
+            }
+          />
+          <Route
+            path="notify-channels"
+            element={
+              <RequireAdmin>
+                <NotifyChannelsPage />
+              </RequireAdmin>
+            }
+          />
+          <Route
+            path="settings"
+            element={
+              <RequireAdmin>
+                <SettingsPage />
+              </RequireAdmin>
+            }
+          />
+          <Route
+            path="assistant"
+            element={
+              <RequireAdmin>
+                <AssistantChatPage />
+              </RequireAdmin>
+            }
+          />
+          <Route
+            path="download-clients"
+            element={
+              <RequireAdmin>
+                <DownloadClientsPage />
+              </RequireAdmin>
+            }
+          />
+          <Route
+            path="license"
+            element={
+              <RequireAdmin>
+                <LicensePage />
+              </RequireAdmin>
+            }
+          />
+          <Route
+            path="storage-config"
+            element={
+              <RequireAdmin>
+                <StorageConfigPage />
+              </RequireAdmin>
+            }
+          />
           <Route
             path="stats"
             element={

web/src/api/assistant.ts

@@ -0,0 +1,65 @@
+import { api } from './client'
+
+export interface AssistantSession {
+  id: string
+  user_id: string
+  title: string
+  created_at: string
+  updated_at: string
+}
+
+export interface AssistantMessage {
+  id: string
+  session_id: string
+  role: 'user' | 'assistant' | 'system'
+  content: string
+  operation_id?: string
+  created_at: string
+}
+
+export interface SessionView {
+  session: AssistantSession
+  messages: AssistantMessage[]
+}
+
+export const assistantAPI = {
+  listSessions: () =>
+    api.get<AssistantSession[]>('/admin/assistant/sessions').then((r) => r.data),
+
+  createSession: (title?: string) =>
+    api
+      .post<AssistantSession>('/admin/assistant/sessions', { title })
+      .then((r) => r.data),
+
+  getSession: (id: string) =>
+    api.get<SessionView>(`/admin/assistant/session/${id}`).then((r) => r.data),
+
+  deleteSession: (id: string) =>
+    api.delete(`/admin/assistant/session/${id}`).then((r) => r.data),
+
+  chat: (sessionID: string, message: string) =>
+    api
+      .post<SessionView>('/admin/assistant/chat', {
+        session_id: sessionID,
+        message,
+      })
+      .then((r) => r.data),
+
+  execute: (sessionID: string, action: Record<string, unknown>) =>
+    api
+      .post<{ op_id: string }>('/admin/assistant/execute', {
+        session_id: sessionID,
+        action,
+      })
+      .then((r) => r.data),
+
+  undo: (opID: string) =>
+    api.post(`/admin/assistant/undo/${opID}`).then((r) => r.data),
+
+  history: () =>
+    api
+      .get<{ items: { op_id: string; session: string; created_at: string; content: string }[] }>(
+        '/admin/assistant/history',
+      )
+      .then((r) => r.data.items),
+}

web/src/api/discover_extra.ts

@@ -0,0 +1,17 @@
+import { api } from './client'
+import type { DiscoverItem, DiscoverSection } from '../types'
+
+// discoverExtraAPI wraps the Vue-style multi-section feed used by the
+// React DiscoverPage rails. Use the existing /discover/trending and
+// /discover/popular helpers for the simple cases.
+export const discoverExtraAPI = {
+  sections: () =>
+    api.get<{ sections: DiscoverSection[] }>('/discover/sections').then((r) => r.data.sections),
+
+  feed: (sectionKeys: string[]) =>
+    api
+      .get<Record<string, DiscoverItem[] | null>>('/discover/feed', {
+        params: { sections: sectionKeys.join(',') },
+      })
+      .then((r) => r.data),
+}

web/src/api/download_clients.ts

@@ -0,0 +1,53 @@
+import { api } from './client'
+
+export type DownloadClientType = 'qbittorrent' | 'aria2' | 'transmission'
+
+export interface DownloadClient {
+  id: string
+  name: string
+  type: DownloadClientType
+  url: string
+  username?: string
+  save_path?: string
+  is_default: boolean
+  enabled: boolean
+  created_at: string
+  updated_at: string
+}
+
+export interface DownloadClientInput {
+  name: string
+  type: DownloadClientType
+  url: string
+  username?: string
+  password?: string
+  save_path?: string
+  is_default: boolean
+  enabled: boolean
+}
+
+export const downloadClientsAPI = {
+  list: () =>
+    api.get<DownloadClient[]>('/admin/download/clients').then((r) => r.data),
+
+  create: (input: DownloadClientInput) =>
+    api.post<DownloadClient>('/admin/download/clients', input).then((r) => r.data),
+
+  update: (id: string, input: DownloadClientInput) =>
+    api
+      .put<DownloadClient>(`/admin/download/clients/${id}`, input)
+      .then((r) => r.data),
+
+  remove: (id: string) =>
+    api.delete(`/admin/download/clients/${id}`).then((r) => r.data),
+
+  test: (id: string) =>
+    api
+      .post<{ ok: boolean; error?: string }>(`/admin/download/clients/${id}/test`)
+      .then((r) => r.data),
+
+  aria2Stats: (clientID: string) =>
+    api
+      .get('/admin/download/aria2/stats', { params: { client_id: clientID } })
+      .then((r) => r.data),
+}

web/src/api/history.ts

@@ -0,0 +1,30 @@
+import { api } from './client'
+import type { HistoryItem, HistoryStats, Media } from '../types'
+
+// historyAPI wraps /watch-history and /history. The two share storage on
+// the backend; we treat /watch-history as the rich admin/dashboard
+// surface and /history as the legacy resume-position write.
+export const historyAPI = {
+  list: (limit = 50) =>
+    api
+      .get<HistoryItem[]>('/watch-history', { params: { limit } })
+      .then((r) => r.data),
+
+  stats: () => api.get<HistoryStats>('/watch-history/stats').then((r) => r.data),
+
+  continueWatching: (limit = 10) =>
+    api
+      .get<{ history: HistoryItem; media: Media }[]>('/watch-history/continue', {
+        params: { limit },
+      })
+      .then((r) => r.data),
+
+  clear: (mediaID?: string) =>
+    api
+      .delete('/watch-history', {
+        params: mediaID ? { media_id: mediaID } : {},
+      })
+      .then((r) => r.data),
+
+  remove: (id: string) => api.delete(`/watch-history/${id}`).then((r) => r.data),
+}

web/src/api/license.ts

@@ -0,0 +1,71 @@
+import { api } from './client'
+
+// LicenseKey + LicenseActivation mirror the Go model structs.
+export interface LicenseKey {
+  id: string
+  key: string
+  customer?: string
+  plan: string
+  max_activations: number
+  issued_at: string
+  expires_at?: string | null
+  revoked: boolean
+  notes?: string
+  created_at: string
+  updated_at: string
+}
+
+export interface LicenseActivation {
+  id: string
+  key_id: string
+  device_id: string
+  device_name?: string
+  ip?: string
+  unbound_at?: string | null
+  heartbeat_at?: string | null
+  created_at: string
+}
+
+export interface GenerateKeyInput {
+  customer?: string
+  plan?: string
+  max_activations?: number
+  expires_at?: string // RFC3339; "" or omit for perpetual
+  notes?: string
+}
+
+export const licenseAPI = {
+  generate: (input: GenerateKeyInput) =>
+    api.post<LicenseKey>('/admin/license/generate', input).then((r) => r.data),
+
+  list: () => api.get<LicenseKey[]>('/admin/license/list').then((r) => r.data),
+
+  listActivations: (keyID: string) =>
+    api
+      .get<LicenseActivation[]>(`/admin/license/${keyID}/activations`)
+      .then((r) => r.data),
+
+  revoke: (keyID: string) =>
+    api.post(`/admin/license/${keyID}/revoke`).then((r) => r.data),
+
+  unbind: (activationID: string) =>
+    api.post(`/admin/license/activation/${activationID}/unbind`).then((r) => r.data),
+
+  // Self-service
+  activate: (key: string, deviceID: string, deviceName?: string) =>
+    api
+      .post<LicenseActivation>('/license/activate', {
+        key,
+        device_id: deviceID,
+        device_name: deviceName,
+      })
+      .then((r) => r.data),
+
+  status: (keyID: string) =>
+    api
+      .get<{ key: LicenseKey; active_activations: number; valid: boolean }>(
+        '/license/status',
+        { params: { key_id: keyID } },
+      )
+      .then((r) => r.data),
+}

web/src/api/media_extra.ts

@@ -0,0 +1,19 @@
+import { api } from './client'
+import type { Media } from '../types'
+
+// Auxiliary media surfaces used by the home page rails and the admin
+// dashboard "library composition" card.
+export const mediaExtraAPI = {
+  recent: (limit = 12) =>
+    api.get<Media[]>('/media/recent', { params: { limit } }).then((r) => r.data),
+
+  stats: () =>
+    api
+      .get<{
+        by_type: { movies: number; tv: number; anime: number; music: number; unscraped: number }
+        total: number
+        total_size: number
+        total_seconds: number
+      }>('/media/stats')
+      .then((r) => r.data),
+}

web/src/api/notify_channels.ts

@@ -0,0 +1,29 @@
+import { api } from './client'
+import type { NotifyChannel } from '../types'
+
+// Payload accepted by create / update. `events` and `enabled` are optional.
+export interface NotifyChannelInput {
+  name: string
+  channel_type: NotifyChannel['channel_type']
+  config: Record<string, string>
+  events?: string[]
+  enabled?: boolean
+}
+
+// notifyChannelsAPI wraps the admin /admin/notify/channels surface.
+export const notifyChannelsAPI = {
+  list: () =>
+    api.get<NotifyChannel[]>('/admin/notify/channels').then((r) => r.data),
+
+  create: (input: NotifyChannelInput) =>
+    api.post<NotifyChannel>('/admin/notify/channels', input).then((r) => r.data),
+
+  update: (id: string, input: NotifyChannelInput) =>
+    api.put<NotifyChannel>(`/admin/notify/channels/${id}`, input).then((r) => r.data),
+
+  remove: (id: string) =>
+    api.delete(`/admin/notify/channels/${id}`).then((r) => r.data),
+
+  test: (id: string) =>
+    api.post<{ message: string }>(`/admin/notify/channels/${id}/test`).then((r) => r.data),
+}

web/src/api/permissions.ts

@@ -0,0 +1,38 @@
+import { api } from './client'
+
+export interface UserPermission {
+  user_id: string
+  can_play_media: boolean
+  can_favorite: boolean
+  can_view_history: boolean
+  can_view_dashboard: boolean
+  can_view_discover: boolean
+  can_manage_downloads: boolean
+  can_manage_subscriptions: boolean
+  can_manage_sites: boolean
+  can_manage_files: boolean
+  can_manage_strm: boolean
+  can_cast: boolean
+  can_use_ai_assistant: boolean
+  can_access_settings: boolean
+  updated_at: string
+}
+
+export const permissionsAPI = {
+  // Caller's effective permissions; admins always get the all-true set.
+  mine: () => api.get<UserPermission>('/auth/permissions').then((r) => r.data),
+
+  // Admin endpoints
+  get: (userID: string) =>
+    api.get<UserPermission>(`/admin/users/${userID}/permissions`).then((r) => r.data),
+
+  save: (userID: string, p: UserPermission) =>
+    api
+      .put<UserPermission>(`/admin/users/${userID}/permissions`, p)
+      .then((r) => r.data),
+
+  reset: (userID: string) =>
+    api
+      .post<UserPermission>(`/admin/users/${userID}/permissions/reset`)
+      .then((r) => r.data),
+}

web/src/api/play_profiles.ts

@@ -0,0 +1,35 @@
+import { api } from './client'
+import type { PlayProfile } from '../types'
+
+// Payload accepted by create / update.
+export interface PlayProfileInput {
+  user_id?: string
+  name: string
+  is_default: boolean
+  content_rating_limit?: string
+  allow_adult: boolean
+  require_pin: boolean
+  pin?: string
+  preferred_subtitle_lang?: string
+  preferred_audio_lang?: string
+  autoplay_next: boolean
+  skip_intro: boolean
+  allowed_library_ids: string[]
+}
+
+// playProfilesAPI wraps /play-profiles. The admin variant adds ?all=true.
+export const playProfilesAPI = {
+  list: (all = false) =>
+    api
+      .get<PlayProfile[]>('/play-profiles', { params: all ? { all: 'true' } : {} })
+      .then((r) => r.data),
+
+  create: (input: PlayProfileInput) =>
+    api.post<PlayProfile>('/play-profiles', input).then((r) => r.data),
+
+  update: (id: string, input: PlayProfileInput) =>
+    api.put<PlayProfile>(`/play-profiles/${id}`, input).then((r) => r.data),
+
+  remove: (id: string) =>
+    api.delete(`/play-profiles/${id}`).then((r) => r.data),
+}

web/src/api/stats_extra.ts

@@ -0,0 +1,40 @@
+import { api } from './client'
+import type { Hardware, Library, Media } from '../types'
+
+// statsExtraAPI exposes the admin dashboard surfaces beyond /stats.
+export const statsExtraAPI = {
+  overview: () =>
+    api
+      .get<{
+        libraries: number
+        media_count: number
+        users_count: number
+        total_size: number
+        total_seconds: number
+        generated_at: string
+      }>('/stats/overview')
+      .then((r) => r.data),
+
+  trend: (days = 14) =>
+    api
+      .get<{ trend: { day: string; count: number }[]; days: number }>('/stats/trend', {
+        params: { days },
+      })
+      .then((r) => r.data),
+
+  topContent: (limit = 10) =>
+    api
+      .get<{
+        items: { media: Media; play_count: number; last_played: string }[]
+      }>('/stats/top-content', { params: { limit } })
+      .then((r) => r.data),
+
+  libraries: () =>
+    api
+      .get<{
+        libraries: { library: Library; item_count: number; total_size: number }[]
+      }>('/stats/libraries')
+      .then((r) => r.data),
+
+  monitor: () => api.get<Hardware>('/stats/monitor').then((r) => r.data),
+}

web/src/api/storage_config.ts

@@ -0,0 +1,36 @@
+import { api } from './client'
+
+export type StorageType = 'alist' | 's3' | 'webdav'
+
+export interface StorageConfig {
+  id: string
+  type: StorageType
+  config: Record<string, string>
+  enabled: boolean
+  last_error?: string
+  created_at: string
+  updated_at: string
+}
+
+export const storageAPI = {
+  status: () =>
+    api
+      .get<{ items: StorageConfig[] }>('/admin/storage/status')
+      .then((r) => r.data.items),
+
+  get: (type: StorageType) =>
+    api.get<StorageConfig>(`/admin/storage/${type}`).then((r) => r.data),
+
+  save: (type: StorageType, config: Record<string, string>, enabled = true) =>
+    api
+      .put<StorageConfig>(`/admin/storage/${type}`, { type, config, enabled })
+      .then((r) => r.data),
+
+  test: (type: StorageType, config: Record<string, string>) =>
+    api
+      .post<{ ok: boolean; error?: string }>(`/admin/storage/${type}/test`, {
+        type,
+        config,
+      })
+      .then((r) => r.data),
+}

web/src/api/system.ts

@@ -0,0 +1,38 @@
+import { api } from './client'
+
+// systemAPI wraps the read-only /system/* metadata endpoints used by the
+// React shell (footer, admin dashboard, scheduler page).
+export const systemAPI = {
+  info: () =>
+    api
+      .get<{
+        name: string
+        version: string
+        go: string
+        os: string
+        arch: string
+        data_dir: string
+        cache_dir: string
+      }>('/system/info')
+      .then((r) => r.data),
+
+  status: () =>
+    api
+      .get<{
+        uptime_seconds: number
+        goroutines: number
+        cpu_percent?: number
+        memory_used?: number
+        memory_total?: number
+        disk_used?: number
+        disk_total?: number
+      }>('/system/status')
+      .then((r) => r.data),
+
+  scheduler: () =>
+    api
+      .get<{ jobs: { name: string; cron: string; next_run?: string; last_run?: string }[] }>(
+        '/system/scheduler',
+      )
+      .then((r) => r.data),
+}

web/src/api/tools.ts

@@ -0,0 +1,21 @@
+import { api } from './client'
+
+// toolsAPI groups admin-only endpoints that don't fit the other domain
+// modules: organizing media files into the canonical naming layout, and
+// dispatching a test notification through the configured channels.
+export const toolsAPI = {
+  organizeMedia: (mediaID: string) =>
+    api
+      .post<{ path: string }>(`/admin/media/${mediaID}/organize`)
+      .then((r) => r.data),
+
+  organizeLibrary: (libraryID: string) =>
+    api
+      .post<Record<string, unknown>>(`/admin/libraries/${libraryID}/organize`)
+      .then((r) => r.data),
+
+  notifyTest: (title: string, body: string) =>
+    api
+      .post<{ message: string }>('/admin/notify/test', { title, body })
+      .then((r) => r.data),
+}

web/src/components/Layout.tsx

@@ -2,6 +2,7 @@ import { useEffect, useState } from 'react'
 import { Link, NavLink, Outlet, useNavigate } from 'react-router-dom'
 import {
   Activity,
+  Bell,
   Cast,
   Clock,
   CloudDownload,
@@ -15,13 +16,22 @@ import {
   Heart,
   Home,
   KeyRound,
+  KeySquare,
+  Link2,
   ListChecks,
   ListMusic,
   LogOut,
+  MessageSquare,
   Rss,
   Search,
+  Server,
   Settings,
+  Sliders,
+  Sparkles,
+  Cloud,
   Trash2,
+  UserCog,
+  Wrench,
   Library as LibraryIcon,
   User as UserIcon,
 } from 'lucide-react'
@@ -61,6 +71,7 @@ export function Layout() {
           <SidebarLink to="/" icon={<Home size={18} />} label="首页" end />
           <SidebarLink to="/discover" icon={<Compass size={18} />} label="发现" />
           <SidebarLink to="/search" icon={<Search size={18} />} label="搜索" />
+          <SidebarLink to="/ai" icon={<Sparkles size={18} />} label="AI 助手" />
           <SidebarLink to="/favourites" icon={<Heart size={18} />} label="收藏" />
           <SidebarLink to="/playlists" icon={<ListMusic size={18} />} label="播放列表" />
           <SidebarLink to="/history" icon={<Clock size={18} />} label="观看历史" />
@@ -94,6 +105,7 @@ export function Layout() {
             账号
           </div>
           <SidebarLink to="/profile" icon={<UserIcon size={18} />} label="个人资料" />
+          <SidebarLink to="/play-profiles" icon={<UserCog size={18} />} label="观影 Profile" />
 
           {user?.role === 'admin' && (
             <>
@@ -107,6 +119,14 @@ export function Layout() {
               <SidebarLink to="/duplicates" icon={<Copy size={18} />} label="重复文件" />
               <SidebarLink to="/scheduler" icon={<Clock size={18} />} label="定时任务" />
               <SidebarLink to="/api-configs" icon={<KeyRound size={18} />} label="API 配置" />
+              <SidebarLink to="/strm" icon={<Link2 size={18} />} label="STRM 管理" />
+              <SidebarLink to="/tools" icon={<Wrench size={18} />} label="运维工具" />
+              <SidebarLink to="/notify-channels" icon={<Bell size={18} />} label="通知渠道" />
+              <SidebarLink to="/download-clients" icon={<Server size={18} />} label="下载器" />
+              <SidebarLink to="/storage-config" icon={<Cloud size={18} />} label="外部存储" />
+              <SidebarLink to="/license" icon={<KeySquare size={18} />} label="许可证" />
+              <SidebarLink to="/assistant" icon={<MessageSquare size={18} />} label="AI 对话" />
+              <SidebarLink to="/settings" icon={<Sliders size={18} />} label="系统设置" />
               <SidebarLink to="/recycle" icon={<Trash2 size={18} />} label="回收站" />
               <SidebarLink to="/admin" icon={<Settings size={18} />} label="管理后台" />
             </>

web/src/pages/AIAssistantPage.tsx

@@ -0,0 +1,242 @@
+import { FormEvent, useEffect, useState } from 'react'
+import { Link } from 'react-router-dom'
+import { Loader2, Search, Sparkles, Wand2 } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import { aiAPI, type SearchIntent } from '../api/ai'
+import { MediaCard } from '../components/MediaCard'
+import type { Media } from '../types'
+
+// AIAssistantPage exposes the two AI helpers backed by the Go server:
+//   - smart search: parses a natural-language query into a SearchIntent +
+//     a list of matching local media items.
+//   - recommendations: returns a list of recommended titles based on the
+//     current user's recent watch history.
+//
+// The Vue version had a full chat surface; the Go backend has no chat or
+// operation-execute endpoints, so we render the same two capabilities as
+// a focused two-panel screen.
+export function AIAssistantPage() {
+  const [status, setStatus] = useState<{
+    enabled: boolean
+    provider: string
+    model: string
+  } | null>(null)
+  const [query, setQuery] = useState('')
+  const [searching, setSearching] = useState(false)
+  const [intent, setIntent] = useState<SearchIntent | null>(null)
+  const [items, setItems] = useState<Media[]>([])
+
+  const [recs, setRecs] = useState<string[] | null>(null)
+  const [recommending, setRecommending] = useState(false)
+
+  useEffect(() => {
+    aiAPI
+      .status()
+      .then(setStatus)
+      .catch(() => setStatus({ enabled: false, provider: '', model: '' }))
+  }, [])
+
+  const onSearch = async (e: FormEvent) => {
+    e.preventDefault()
+    if (!query.trim()) return
+    setSearching(true)
+    setIntent(null)
+    setItems([])
+    try {
+      const r = await aiAPI.smartSearch(query.trim())
+      setIntent(r.intent)
+      setItems(r.items)
+      if (r.items.length === 0) toast('未找到匹配项')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '搜索失败'
+      toast.error(msg)
+    } finally {
+      setSearching(false)
+    }
+  }
+
+  const onRecommend = async () => {
+    setRecommending(true)
+    try {
+      const titles = await aiAPI.recommend()
+      setRecs(titles)
+      if (titles.length === 0) toast('暂无可推荐内容,请先观看一些媒体')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '获取推荐失败'
+      toast.error(msg)
+    } finally {
+      setRecommending(false)
+    }
+  }
+
+  const quickHints = [
+    '2023 年的科幻电影',
+    '评分高的动漫',
+    '最近添加的纪录片',
+    '中文剧集',
+  ]
+
+  return (
+    <div className="space-y-6">
+      <div className="flex flex-wrap items-end justify-between gap-3">
+        <div className="flex items-center gap-3">
+          <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-primary-400 to-purple-500">
+            <Sparkles className="h-5 w-5 text-white" />
+          </div>
+          <div>
+            <h1 className="font-display text-3xl font-bold text-white">AI 助手</h1>
+            <p className="text-sm text-slate-400">
+              自然语言搜索 · 基于观影历史的智能推荐
+            </p>
+          </div>
+        </div>
+        {status && (
+          <div className="text-xs text-slate-400">
+            <span
+              className={
+                'mr-2 inline-block h-2 w-2 rounded-full ' +
+                (status.enabled ? 'bg-emerald-400' : 'bg-slate-500')
+              }
+            />
+            {status.enabled
+              ? `已连接 · ${status.provider}${status.model ? ' / ' + status.model : ''}`
+              : '未配置 AI 服务,使用本地规则解析'}
+          </div>
+        )}
+      </div>
+
+      {/* Smart search */}
+      <section className="glass-panel space-y-4">
+        <h2 className="font-display text-lg font-semibold text-white">智能搜索</h2>
+        <form onSubmit={onSearch} className="flex gap-2">
+          <input
+            className="input-base flex-1"
+            placeholder="试试: 2023 年的高分动作片"
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+          />
+          <button type="submit" disabled={searching} className="neon-button">
+            {searching ? (
+              <Loader2 size={16} className="animate-spin" />
+            ) : (
+              <Search size={16} />
+            )}
+            搜索
+          </button>
+        </form>
+
+        <div className="flex flex-wrap gap-2">
+          {quickHints.map((h) => (
+            <button
+              key={h}
+              onClick={() => {
+                setQuery(h)
+              }}
+              className="rounded-full border border-white/10 bg-white/5 px-3 py-1 text-xs text-slate-300 hover:border-primary-400/40 hover:text-primary-400"
+            >
+              {h}
+            </button>
+          ))}
+        </div>
+
+        {intent && (
+          <div className="rounded-lg border border-white/5 bg-white/5 p-3 text-xs text-slate-300">
+            <div className="mb-1 font-semibold text-slate-200">解析结果</div>
+            <div className="flex flex-wrap gap-x-6 gap-y-1">
+              <span>
+                查询: <span className="text-primary-400">{intent.query || '—'}</span>
+              </span>
+              {intent.year !== undefined && intent.year > 0 && (
+                <span>
+                  年份: <span className="text-primary-400">{intent.year}</span>
+                </span>
+              )}
+              {intent.genre && (
+                <span>
+                  类型: <span className="text-primary-400">{intent.genre}</span>
+                </span>
+              )}
+              {intent.type && (
+                <span>
+                  分类: <span className="text-primary-400">{intent.type}</span>
+                </span>
+              )}
+              {intent.sort && (
+                <span>
+                  排序: <span className="text-primary-400">{intent.sort}</span>
+                </span>
+              )}
+              {intent.language && (
+                <span>
+                  语言: <span className="text-primary-400">{intent.language}</span>
+                </span>
+              )}
+            </div>
+          </div>
+        )}
+
+        {items.length > 0 && (
+          <div className="grid grid-cols-2 gap-4 sm:grid-cols-3 md:grid-cols-4 lg:grid-cols-5 xl:grid-cols-6">
+            {items.map((m) => (
+              <MediaCard key={m.id} media={m} />
+            ))}
+          </div>
+        )}
+      </section>
+
+      {/* Recommendations */}
+      <section className="glass-panel space-y-4">
+        <div className="flex items-center justify-between">
+          <h2 className="font-display text-lg font-semibold text-white">为你推荐</h2>
+          <button onClick={onRecommend} disabled={recommending} className="neon-button">
+            {recommending ? (
+              <Loader2 size={16} className="animate-spin" />
+            ) : (
+              <Wand2 size={16} />
+            )}
+            生成推荐
+          </button>
+        </div>
+        <p className="text-xs text-slate-500">
+          推荐基于你的最近观看历史。点击标题在媒体库中查找。
+        </p>
+
+        {recs && recs.length > 0 && (
+          <ul className="grid gap-2 sm:grid-cols-2">
+            {recs.map((t, i) => (
+              <li key={i}>
+                <Link
+                  to={`/search?q=${encodeURIComponent(t)}`}
+                  className="flex items-center justify-between rounded-lg border border-white/5 bg-white/5 px-3 py-2 text-sm text-slate-200 hover:border-primary-400/40 hover:text-primary-400"
+                >
+                  <span className="truncate">{t}</span>
+                  <Search size={14} className="shrink-0 opacity-60" />
+                </Link>
+              </li>
+            ))}
+          </ul>
+        )}
+
+        {recs && recs.length === 0 && (
+          <p className="text-sm text-slate-400">
+            还没有推荐结果 — 先去看几部片子,我再给你挑。
+          </p>
+        )}
+      </section>
+
+      {/* Decorative footer (mirrors the Vue page hint that AI runs locally). */}
+      {!status?.enabled && (
+        <p className="text-xs text-slate-500">
+          提示: 当前未配置外部 AI Provider,系统将使用本地规则引擎解析查询。
+          管理员可在 <Link to="/api-configs" className="text-primary-400">API 配置</Link>{' '}
+          中接入 OpenAI / DeepSeek 等服务以获得更好效果。
+        </p>
+      )}
+    </div>
+  )
+}

web/src/pages/AssistantChatPage.tsx

@@ -0,0 +1,221 @@
+import { FormEvent, useEffect, useRef, useState } from 'react'
+import { Loader2, MessageSquare, Plus, Send, Trash2 } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import {
+  assistantAPI,
+  type AssistantMessage,
+  type AssistantSession,
+  type SessionView,
+} from '../api/assistant'
+
+// AssistantChatPage is the multi-turn chat surface backed by the Go
+// AssistantService. It complements the older AIAssistantPage which is
+// limited to single-turn smart search + recommendations.
+export function AssistantChatPage() {
+  const [sessions, setSessions] = useState<AssistantSession[]>([])
+  const [active, setActive] = useState<SessionView | null>(null)
+  const [draft, setDraft] = useState('')
+  const [sending, setSending] = useState(false)
+  const [loading, setLoading] = useState(true)
+  const messagesEndRef = useRef<HTMLDivElement | null>(null)
+
+  const refreshSessions = async () => {
+    try {
+      const list = await assistantAPI.listSessions()
+      setSessions(list)
+      // Auto-select the most recent if nothing is open.
+      if (list.length > 0 && !active) {
+        const view = await assistantAPI.getSession(list[0].id)
+        setActive(view)
+      }
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    refreshSessions().catch(() => undefined)
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [])
+
+  useEffect(() => {
+    messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' })
+  }, [active?.messages.length])
+
+  const onNew = async () => {
+    try {
+      const sess = await assistantAPI.createSession('New chat')
+      const view = await assistantAPI.getSession(sess.id)
+      setActive(view)
+      await refreshSessions()
+    } catch {
+      toast.error('创建会话失败')
+    }
+  }
+
+  const onSelect = async (id: string) => {
+    try {
+      setActive(await assistantAPI.getSession(id))
+    } catch {
+      toast.error('加载会话失败')
+    }
+  }
+
+  const onDelete = async (id: string) => {
+    if (!confirm('删除此会话?')) return
+    try {
+      await assistantAPI.deleteSession(id)
+      if (active?.session.id === id) setActive(null)
+      await refreshSessions()
+    } catch {
+      toast.error('删除失败')
+    }
+  }
+
+  const onSend = async (e: FormEvent) => {
+    e.preventDefault()
+    if (!draft.trim() || !active) return
+    setSending(true)
+    const text = draft.trim()
+    setDraft('')
+    // Optimistic append so the user's turn shows immediately.
+    setActive((s) =>
+      s
+        ? {
+            ...s,
+            messages: [
+              ...s.messages,
+              {
+                id: 'pending-' + Date.now(),
+                session_id: s.session.id,
+                role: 'user',
+                content: text,
+                created_at: new Date().toISOString(),
+              } as AssistantMessage,
+            ],
+          }
+        : s,
+    )
+    try {
+      const view = await assistantAPI.chat(active.session.id, text)
+      setActive(view)
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '发送失败'
+      toast.error(msg)
+    } finally {
+      setSending(false)
+    }
+  }
+
+  return (
+    <div className="grid h-[calc(100vh-100px)] grid-cols-[260px_1fr] gap-4">
+      {/* Sessions sidebar */}
+      <aside className="glass-panel flex flex-col overflow-hidden">
+        <div className="mb-3 flex items-center justify-between">
+          <h2 className="font-display text-sm font-semibold text-white">会话</h2>
+          <button onClick={onNew} className="neon-button !px-2 !py-1 text-xs">
+            <Plus size={12} /> 新建
+          </button>
+        </div>
+        {loading && (
+          <div className="flex justify-center py-6 text-slate-400">
+            <Loader2 className="animate-spin" />
+          </div>
+        )}
+        <ul className="flex-1 space-y-1 overflow-y-auto pr-1">
+          {sessions.map((s) => (
+            <li
+              key={s.id}
+              className={
+                'group flex items-center gap-2 rounded px-2 py-2 text-sm cursor-pointer ' +
+                (active?.session.id === s.id
+                  ? 'bg-primary-400/10 text-primary-400'
+                  : 'text-slate-300 hover:bg-white/5 hover:text-white')
+              }
+              onClick={() => onSelect(s.id)}
+            >
+              <MessageSquare size={14} className="shrink-0" />
+              <span className="flex-1 truncate">{s.title || '未命名'}</span>
+              <button
+                onClick={(e) => {
+                  e.stopPropagation()
+                  onDelete(s.id)
+                }}
+                className="opacity-0 group-hover:opacity-100"
+              >
+                <Trash2 size={12} className="text-red-400" />
+              </button>
+            </li>
+          ))}
+          {!loading && sessions.length === 0 && (
+            <li className="px-2 py-2 text-xs text-slate-500">暂无会话</li>
+          )}
+        </ul>
+      </aside>
+
+      {/* Conversation pane */}
+      <section className="glass-panel flex flex-col overflow-hidden">
+        {!active && (
+          <div className="m-auto text-center text-slate-400">
+            <MessageSquare size={32} className="mx-auto mb-2 opacity-50" />
+            <p>选择或创建一个会话开始对话</p>
+          </div>
+        )}
+        {active && (
+          <>
+            <div className="mb-3 border-b border-white/5 pb-2">
+              <h2 className="font-display text-base font-semibold text-white">
+                {active.session.title || '未命名'}
+              </h2>
+            </div>
+            <div className="flex-1 space-y-3 overflow-y-auto pr-2">
+              {active.messages.length === 0 && (
+                <p className="text-sm text-slate-500">说点什么开始对话…</p>
+              )}
+              {active.messages.map((m) => (
+                <Bubble key={m.id} message={m} />
+              ))}
+              <div ref={messagesEndRef} />
+            </div>
+            <form onSubmit={onSend} className="mt-3 flex gap-2 border-t border-white/5 pt-3">
+              <input
+                className="input-base flex-1"
+                placeholder="发送消息…"
+                value={draft}
+                onChange={(e) => setDraft(e.target.value)}
+                disabled={sending}
+              />
+              <button type="submit" disabled={sending || !draft.trim()} className="neon-button">
+                {sending ? <Loader2 size={16} className="animate-spin" /> : <Send size={16} />}
+                发送
+              </button>
+            </form>
+          </>
+        )}
+      </section>
+    </div>
+  )
+}
+
+function Bubble({ message }: { message: AssistantMessage }) {
+  const mine = message.role === 'user'
+  return (
+    <div className={'flex ' + (mine ? 'justify-end' : 'justify-start')}>
+      <div
+        className={
+          'max-w-[80%] whitespace-pre-wrap rounded-2xl px-4 py-2 text-sm ' +
+          (mine
+            ? 'bg-primary-400/20 text-primary-100'
+            : message.role === 'system'
+              ? 'border border-amber-400/30 bg-amber-400/5 text-amber-200'
+              : 'bg-white/5 text-slate-200')
+        }
+      >
+        {message.content}
+      </div>
+    </div>
+  )
+}

web/src/pages/DownloadClientsPage.tsx

@@ -0,0 +1,334 @@
+import { FormEvent, useEffect, useState } from 'react'
+import { Loader2, Pencil, Plus, Send, Server, Trash2 } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import {
+  downloadClientsAPI,
+  type DownloadClient,
+  type DownloadClientInput,
+  type DownloadClientType,
+} from '../api/download_clients'
+
+// DownloadClientsPage manages multiple downloader integrations.
+// Replaces the Vue UI's DownloadView "clients" tab with a typed CRUD
+// surface and a per-client Test button.
+export function DownloadClientsPage() {
+  const [clients, setClients] = useState<DownloadClient[]>([])
+  const [loading, setLoading] = useState(true)
+  const [editing, setEditing] = useState<DownloadClient | null>(null)
+  const [showForm, setShowForm] = useState(false)
+
+  const refresh = async () => {
+    setLoading(true)
+    try {
+      setClients(await downloadClientsAPI.list())
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    refresh().catch(() => undefined)
+  }, [])
+
+  const onTest = async (id: string) => {
+    try {
+      const r = await downloadClientsAPI.test(id)
+      if (r.ok) toast.success('连接成功')
+      else toast.error(r.error ?? '连接失败')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '测试失败'
+      toast.error(msg)
+    }
+  }
+
+  const onDelete = async (c: DownloadClient) => {
+    if (!confirm(`确定删除「${c.name}」?`)) return
+    try {
+      await downloadClientsAPI.remove(c.id)
+      toast.success('已删除')
+      await refresh()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '删除失败'
+      toast.error(msg)
+    }
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <div className="flex items-center gap-3">
+          <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-cyan-400/10 text-cyan-300">
+            <Server size={20} />
+          </div>
+          <div>
+            <h1 className="font-display text-3xl font-bold text-white">下载器管理</h1>
+            <p className="text-sm text-slate-400">
+              qBittorrent / Aria2 / Transmission · 多客户端 + 连接测试
+            </p>
+          </div>
+        </div>
+        <button
+          onClick={() => {
+            setEditing(null)
+            setShowForm(true)
+          }}
+          className="neon-button"
+        >
+          <Plus size={16} /> 添加下载器
+        </button>
+      </div>
+
+      {loading && (
+        <div className="flex justify-center py-12 text-slate-400">
+          <Loader2 className="animate-spin" />
+        </div>
+      )}
+
+      {!loading && clients.length === 0 && (
+        <div className="glass-panel py-12 text-center text-slate-400">暂无下载器</div>
+      )}
+
+      {!loading && clients.length > 0 && (
+        <div className="space-y-3">
+          {clients.map((c) => (
+            <div
+              key={c.id}
+              className="glass-panel flex items-center justify-between gap-3"
+            >
+              <div className="min-w-0">
+                <div className="flex items-center gap-2">
+                  <span className="font-medium text-white">{c.name}</span>
+                  <span className="rounded border border-white/10 bg-white/5 px-2 py-0.5 text-xs text-slate-400">
+                    {c.type}
+                  </span>
+                  {c.is_default && (
+                    <span className="rounded bg-primary-400/20 px-2 py-0.5 text-xs text-primary-400">
+                      默认
+                    </span>
+                  )}
+                  {!c.enabled && (
+                    <span className="rounded bg-slate-500/30 px-2 py-0.5 text-xs text-slate-300">
+                      已禁用
+                    </span>
+                  )}
+                </div>
+                <div className="mt-1 truncate text-xs text-slate-400">
+                  {c.url}
+                  {c.username && ` · ${c.username}`}
+                  {c.save_path && ` · ${c.save_path}`}
+                </div>
+              </div>
+              <div className="flex shrink-0 gap-2">
+                <button
+                  onClick={() => onTest(c.id)}
+                  className="rounded border border-white/10 px-2 py-1 text-xs text-slate-300 hover:border-primary-400/40 hover:text-primary-400"
+                >
+                  <Send size={12} className="inline" /> 测试
+                </button>
+                <button
+                  onClick={() => {
+                    setEditing(c)
+                    setShowForm(true)
+                  }}
+                  className="rounded border border-white/10 px-2 py-1 text-xs text-slate-300 hover:border-primary-400/40 hover:text-primary-400"
+                >
+                  <Pencil size={12} className="inline" /> 编辑
+                </button>
+                <button
+                  onClick={() => onDelete(c)}
+                  className="rounded border border-red-400/40 px-2 py-1 text-xs text-red-400 hover:bg-red-400/10"
+                >
+                  <Trash2 size={12} className="inline" /> 删除
+                </button>
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+
+      {showForm && (
+        <ClientFormModal
+          editing={editing}
+          onClose={() => setShowForm(false)}
+          onSaved={async () => {
+            setShowForm(false)
+            await refresh()
+          }}
+        />
+      )}
+    </div>
+  )
+}
+
+function ClientFormModal({
+  editing,
+  onClose,
+  onSaved,
+}: {
+  editing: DownloadClient | null
+  onClose: () => void
+  onSaved: () => void | Promise<void>
+}) {
+  const [form, setForm] = useState<DownloadClientInput>(() => ({
+    name: editing?.name ?? '',
+    type: editing?.type ?? 'qbittorrent',
+    url: editing?.url ?? '',
+    username: editing?.username ?? '',
+    password: '',
+    save_path: editing?.save_path ?? '',
+    is_default: editing?.is_default ?? false,
+    enabled: editing?.enabled ?? true,
+  }))
+  const [saving, setSaving] = useState(false)
+
+  const onSubmit = async (e: FormEvent) => {
+    e.preventDefault()
+    setSaving(true)
+    try {
+      if (editing) await downloadClientsAPI.update(editing.id, form)
+      else await downloadClientsAPI.create(form)
+      toast.success('已保存')
+      await onSaved()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '保存失败'
+      toast.error(msg)
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const update = <K extends keyof DownloadClientInput>(k: K, v: DownloadClientInput[K]) =>
+    setForm((f) => ({ ...f, [k]: v }))
+
+  const placeholder = (
+    {
+      qbittorrent: 'http://127.0.0.1:8080',
+      aria2: 'http://127.0.0.1:6800/jsonrpc',
+      transmission: 'http://127.0.0.1:9091/transmission/rpc',
+    } as Record<DownloadClientType, string>
+  )[form.type]
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+      <div className="glass-panel w-full max-w-lg max-h-[90vh] overflow-y-auto">
+        <h2 className="mb-4 font-display text-xl font-semibold text-white">
+          {editing ? '编辑下载器' : '添加下载器'}
+        </h2>
+        <form onSubmit={onSubmit} className="space-y-4">
+          <Field label="名称">
+            <input
+              required
+              className="input-base"
+              value={form.name}
+              onChange={(e) => update('name', e.target.value)}
+            />
+          </Field>
+          <Field label="类型">
+            <select
+              className="input-base"
+              value={form.type}
+              onChange={(e) => update('type', e.target.value as DownloadClientType)}
+            >
+              <option value="qbittorrent">qBittorrent</option>
+              <option value="aria2">Aria2 (JSON-RPC)</option>
+              <option value="transmission">Transmission</option>
+            </select>
+          </Field>
+          <Field label="URL">
+            <input
+              required
+              className="input-base"
+              placeholder={placeholder}
+              value={form.url}
+              onChange={(e) => update('url', e.target.value)}
+            />
+          </Field>
+          {form.type !== 'aria2' && (
+            <>
+              <Field label="用户名">
+                <input
+                  className="input-base"
+                  value={form.username ?? ''}
+                  onChange={(e) => update('username', e.target.value)}
+                />
+              </Field>
+              <Field label={editing ? '密码 (留空保持不变)' : '密码'}>
+                <input
+                  type="password"
+                  className="input-base"
+                  value={form.password ?? ''}
+                  onChange={(e) => update('password', e.target.value)}
+                />
+              </Field>
+            </>
+          )}
+          {form.type === 'aria2' && (
+            <Field label="RPC Token (作为密码字段保存)">
+              <input
+                type="password"
+                className="input-base"
+                value={form.password ?? ''}
+                onChange={(e) => update('password', e.target.value)}
+              />
+            </Field>
+          )}
+          <Field label="默认保存路径">
+            <input
+              className="input-base"
+              value={form.save_path ?? ''}
+              onChange={(e) => update('save_path', e.target.value)}
+            />
+          </Field>
+          <div className="flex flex-wrap gap-4">
+            <label className="flex items-center gap-2 text-sm text-slate-300">
+              <input
+                type="checkbox"
+                className="h-4 w-4 accent-primary-400"
+                checked={form.is_default}
+                onChange={(e) => update('is_default', e.target.checked)}
+              />
+              设为默认
+            </label>
+            <label className="flex items-center gap-2 text-sm text-slate-300">
+              <input
+                type="checkbox"
+                className="h-4 w-4 accent-primary-400"
+                checked={form.enabled}
+                onChange={(e) => update('enabled', e.target.checked)}
+              />
+              启用
+            </label>
+          </div>
+          <div className="flex justify-end gap-2 pt-2">
+            <button
+              type="button"
+              onClick={onClose}
+              className="rounded border border-white/10 px-4 py-2 text-sm text-slate-300 hover:bg-white/5"
+            >
+              取消
+            </button>
+            <button type="submit" disabled={saving} className="neon-button">
+              {saving && <Loader2 size={16} className="animate-spin" />} 保存
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  )
+}
+
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <label className="block">
+      <span className="mb-1 block text-sm text-slate-300">{label}</span>
+      {children}
+    </label>
+  )
+}

web/src/pages/LicensePage.tsx

@@ -0,0 +1,319 @@
+import { FormEvent, useEffect, useState } from 'react'
+import {
+  ChevronDown,
+  ChevronUp,
+  KeySquare,
+  Loader2,
+  Plus,
+  ShieldOff,
+  Trash2,
+} from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import {
+  licenseAPI,
+  type GenerateKeyInput,
+  type LicenseActivation,
+  type LicenseKey,
+} from '../api/license'
+
+// LicensePage is the admin UI for issuing / revoking license keys and
+// inspecting activations. Mirrors the Vue LicenseTab inside Settings.
+export function LicensePage() {
+  const [keys, setKeys] = useState<LicenseKey[]>([])
+  const [loading, setLoading] = useState(true)
+  const [showGen, setShowGen] = useState(false)
+  const [openKey, setOpenKey] = useState<string | null>(null)
+  const [activations, setActivations] = useState<Record<string, LicenseActivation[]>>({})
+
+  const refresh = async () => {
+    setLoading(true)
+    try {
+      setKeys(await licenseAPI.list())
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    refresh().catch(() => undefined)
+  }, [])
+
+  const toggleOpen = async (k: LicenseKey) => {
+    if (openKey === k.id) {
+      setOpenKey(null)
+      return
+    }
+    setOpenKey(k.id)
+    if (!activations[k.id]) {
+      try {
+        const acts = await licenseAPI.listActivations(k.id)
+        setActivations((a) => ({ ...a, [k.id]: acts }))
+      } catch {
+        toast.error('加载激活记录失败')
+      }
+    }
+  }
+
+  const onRevoke = async (k: LicenseKey) => {
+    if (!confirm(`确定吊销 ${k.key.slice(0, 14)}…?`)) return
+    try {
+      await licenseAPI.revoke(k.id)
+      toast.success('已吊销')
+      await refresh()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '吊销失败'
+      toast.error(msg)
+    }
+  }
+
+  const onUnbind = async (a: LicenseActivation) => {
+    if (!confirm(`解绑设备 ${a.device_name || a.device_id}?`)) return
+    try {
+      await licenseAPI.unbind(a.id)
+      toast.success('已解绑')
+      const acts = await licenseAPI.listActivations(a.key_id)
+      setActivations((all) => ({ ...all, [a.key_id]: acts }))
+    } catch {
+      toast.error('解绑失败')
+    }
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <div className="flex items-center gap-3">
+          <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-fuchsia-400/10 text-fuchsia-300">
+            <KeySquare size={20} />
+          </div>
+          <div>
+            <h1 className="font-display text-3xl font-bold text-white">许可证管理</h1>
+            <p className="text-sm text-slate-400">
+              生成密钥 · 绑定设备 · 心跳监控 · 吊销
+            </p>
+          </div>
+        </div>
+        <button onClick={() => setShowGen(true)} className="neon-button">
+          <Plus size={16} /> 生成新密钥
+        </button>
+      </div>
+
+      {loading && (
+        <div className="flex justify-center py-12 text-slate-400">
+          <Loader2 className="animate-spin" />
+        </div>
+      )}
+
+      {!loading && keys.length === 0 && (
+        <div className="glass-panel py-12 text-center text-slate-400">暂无密钥</div>
+      )}
+
+      {!loading && keys.length > 0 && (
+        <div className="space-y-3">
+          {keys.map((k) => (
+            <div key={k.id} className="glass-panel space-y-3">
+              <div className="flex items-center justify-between gap-3">
+                <div className="min-w-0">
+                  <div className="flex items-center gap-2">
+                    <code className="rounded bg-white/5 px-2 py-0.5 text-xs text-primary-400">
+                      {k.key}
+                    </code>
+                    <span className="rounded border border-white/10 bg-white/5 px-2 py-0.5 text-xs text-slate-400">
+                      {k.plan}
+                    </span>
+                    {k.revoked && (
+                      <span className="rounded bg-red-400/20 px-2 py-0.5 text-xs text-red-400">
+                        已吊销
+                      </span>
+                    )}
+                  </div>
+                  <div className="mt-1 text-xs text-slate-400">
+                    {k.customer && `客户: ${k.customer} · `}
+                    最多 {k.max_activations} 设备 ·
+                    {k.expires_at ? ` ${new Date(k.expires_at).toLocaleDateString()} 到期` : ' 永久'}
+                  </div>
+                </div>
+                <div className="flex shrink-0 gap-2">
+                  <button
+                    onClick={() => toggleOpen(k)}
+                    className="rounded border border-white/10 px-2 py-1 text-xs text-slate-300 hover:border-primary-400/40 hover:text-primary-400"
+                  >
+                    {openKey === k.id ? <ChevronUp size={12} /> : <ChevronDown size={12} />}
+                    {' '}激活记录
+                  </button>
+                  {!k.revoked && (
+                    <button
+                      onClick={() => onRevoke(k)}
+                      className="rounded border border-red-400/40 px-2 py-1 text-xs text-red-400 hover:bg-red-400/10"
+                    >
+                      <ShieldOff size={12} className="inline" /> 吊销
+                    </button>
+                  )}
+                </div>
+              </div>
+              {openKey === k.id && (
+                <div className="space-y-2 border-t border-white/5 pt-3">
+                  {(activations[k.id] ?? []).length === 0 && (
+                    <p className="text-sm text-slate-500">暂无激活记录</p>
+                  )}
+                  {(activations[k.id] ?? []).map((a) => (
+                    <div
+                      key={a.id}
+                      className="flex items-center justify-between rounded border border-white/5 bg-white/5 px-3 py-2 text-sm"
+                    >
+                      <div className="min-w-0">
+                        <div className="text-white">
+                          {a.device_name || a.device_id}
+                          {a.unbound_at && (
+                            <span className="ml-2 text-xs text-slate-500">
+                              (已解绑 {new Date(a.unbound_at).toLocaleDateString()})
+                            </span>
+                          )}
+                        </div>
+                        <div className="text-xs text-slate-400">
+                          {a.ip} · 心跳{' '}
+                          {a.heartbeat_at
+                            ? new Date(a.heartbeat_at).toLocaleString()
+                            : '未上报'}
+                        </div>
+                      </div>
+                      {!a.unbound_at && (
+                        <button
+                          onClick={() => onUnbind(a)}
+                          className="shrink-0 rounded border border-white/10 px-2 py-1 text-xs text-slate-300 hover:border-red-400/40 hover:text-red-400"
+                        >
+                          <Trash2 size={12} className="inline" /> 解绑
+                        </button>
+                      )}
+                    </div>
+                  ))}
+                </div>
+              )}
+            </div>
+          ))}
+        </div>
+      )}
+
+      {showGen && (
+        <GenerateModal
+          onClose={() => setShowGen(false)}
+          onCreated={async () => {
+            setShowGen(false)
+            await refresh()
+          }}
+        />
+      )}
+    </div>
+  )
+}
+
+function GenerateModal({
+  onClose,
+  onCreated,
+}: {
+  onClose: () => void
+  onCreated: () => void | Promise<void>
+}) {
+  const [form, setForm] = useState<GenerateKeyInput>({
+    customer: '',
+    plan: 'basic',
+    max_activations: 1,
+    expires_at: '',
+    notes: '',
+  })
+  const [saving, setSaving] = useState(false)
+
+  const onSubmit = async (e: FormEvent) => {
+    e.preventDefault()
+    setSaving(true)
+    try {
+      const k = await licenseAPI.generate({
+        ...form,
+        expires_at: form.expires_at ? new Date(form.expires_at).toISOString() : undefined,
+      })
+      toast.success(`已生成: ${k.key}`)
+      await onCreated()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '生成失败'
+      toast.error(msg)
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+      <div className="glass-panel w-full max-w-md">
+        <h2 className="mb-4 font-display text-xl font-semibold text-white">生成密钥</h2>
+        <form onSubmit={onSubmit} className="space-y-3">
+          <label className="block">
+            <span className="mb-1 block text-sm text-slate-300">客户</span>
+            <input
+              className="input-base"
+              value={form.customer ?? ''}
+              onChange={(e) => setForm((f) => ({ ...f, customer: e.target.value }))}
+            />
+          </label>
+          <label className="block">
+            <span className="mb-1 block text-sm text-slate-300">套餐</span>
+            <select
+              className="input-base"
+              value={form.plan ?? 'basic'}
+              onChange={(e) => setForm((f) => ({ ...f, plan: e.target.value }))}
+            >
+              <option value="basic">basic</option>
+              <option value="pro">pro</option>
+              <option value="enterprise">enterprise</option>
+            </select>
+          </label>
+          <label className="block">
+            <span className="mb-1 block text-sm text-slate-300">最多设备数</span>
+            <input
+              type="number"
+              min={1}
+              className="input-base"
+              value={form.max_activations ?? 1}
+              onChange={(e) =>
+                setForm((f) => ({ ...f, max_activations: Number(e.target.value) }))
+              }
+            />
+          </label>
+          <label className="block">
+            <span className="mb-1 block text-sm text-slate-300">到期日期 (空 = 永久)</span>
+            <input
+              type="date"
+              className="input-base"
+              value={form.expires_at ?? ''}
+              onChange={(e) => setForm((f) => ({ ...f, expires_at: e.target.value }))}
+            />
+          </label>
+          <label className="block">
+            <span className="mb-1 block text-sm text-slate-300">备注</span>
+            <textarea
+              rows={2}
+              className="input-base"
+              value={form.notes ?? ''}
+              onChange={(e) => setForm((f) => ({ ...f, notes: e.target.value }))}
+            />
+          </label>
+          <div className="flex justify-end gap-2 pt-2">
+            <button
+              type="button"
+              onClick={onClose}
+              className="rounded border border-white/10 px-4 py-2 text-sm text-slate-300 hover:bg-white/5"
+            >
+              取消
+            </button>
+            <button type="submit" disabled={saving} className="neon-button">
+              {saving && <Loader2 size={16} className="animate-spin" />} 生成
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  )
+}

web/src/pages/NotifyChannelsPage.tsx

@@ -0,0 +1,421 @@
+import { FormEvent, useEffect, useState } from 'react'
+import { Bell, Loader2, Pencil, Plus, Send, Trash2 } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import {
+  notifyChannelsAPI,
+  type NotifyChannelInput,
+} from '../api/notify_channels'
+import type { NotifyChannel } from '../types'
+
+// NotifyChannelsPage replaces the Vue NotifyTab. Operators can register
+// multiple Telegram bots / Bark devices / WeChat keys / Webhooks and
+// fire a test notification on demand.
+export function NotifyChannelsPage() {
+  const [channels, setChannels] = useState<NotifyChannel[]>([])
+  const [loading, setLoading] = useState(true)
+  const [editing, setEditing] = useState<NotifyChannel | null>(null)
+  const [showForm, setShowForm] = useState(false)
+
+  const refresh = async () => {
+    setLoading(true)
+    try {
+      setChannels(await notifyChannelsAPI.list())
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    refresh().catch(() => undefined)
+  }, [])
+
+  const onTest = async (id: string) => {
+    try {
+      await notifyChannelsAPI.test(id)
+      toast.success('测试消息已发送')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ?? '发送失败'
+      toast.error(msg)
+    }
+  }
+
+  const onDelete = async (ch: NotifyChannel) => {
+    if (!confirm(`确定删除「${ch.name}」?`)) return
+    try {
+      await notifyChannelsAPI.remove(ch.id)
+      toast.success('已删除')
+      await refresh()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ?? '删除失败'
+      toast.error(msg)
+    }
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <div className="flex items-center gap-3">
+          <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-amber-400/10 text-amber-300">
+            <Bell size={20} />
+          </div>
+          <div>
+            <h1 className="font-display text-3xl font-bold text-white">通知渠道</h1>
+            <p className="text-sm text-slate-400">
+              配置 Telegram / Bark / 企业微信 / Webhook 多通道推送
+            </p>
+          </div>
+        </div>
+        <button
+          onClick={() => {
+            setEditing(null)
+            setShowForm(true)
+          }}
+          className="neon-button"
+        >
+          <Plus size={16} /> 添加渠道
+        </button>
+      </div>
+
+      {loading && (
+        <div className="flex justify-center py-12 text-slate-400">
+          <Loader2 className="animate-spin" />
+        </div>
+      )}
+
+      {!loading && channels.length === 0 && (
+        <div className="glass-panel py-12 text-center text-slate-400">暂无通知渠道</div>
+      )}
+
+      {!loading && channels.length > 0 && (
+        <div className="space-y-3">
+          {channels.map((ch) => (
+            <ChannelCard
+              key={ch.id}
+              channel={ch}
+              onTest={() => onTest(ch.id)}
+              onEdit={() => {
+                setEditing(ch)
+                setShowForm(true)
+              }}
+              onDelete={() => onDelete(ch)}
+            />
+          ))}
+        </div>
+      )}
+
+      {showForm && (
+        <ChannelFormModal
+          editing={editing}
+          onClose={() => setShowForm(false)}
+          onSaved={async () => {
+            setShowForm(false)
+            await refresh()
+          }}
+        />
+      )}
+    </div>
+  )
+}
+
+const TYPE_LABELS: Record<NotifyChannel['channel_type'], string> = {
+  telegram: 'Telegram',
+  wechat: '企业微信',
+  bark: 'Bark',
+  webhook: 'Webhook',
+}
+
+function ChannelCard({
+  channel,
+  onTest,
+  onEdit,
+  onDelete,
+}: {
+  channel: NotifyChannel
+  onTest: () => void
+  onEdit: () => void
+  onDelete: () => void
+}) {
+  const summary = channelSummary(channel)
+  return (
+    <div className="glass-panel flex items-center justify-between gap-3">
+      <div className="min-w-0">
+        <div className="flex items-center gap-2">
+          <span className="font-medium text-white">{channel.name}</span>
+          <span className="rounded border border-white/10 bg-white/5 px-2 py-0.5 text-xs text-slate-400">
+            {TYPE_LABELS[channel.channel_type] ?? channel.channel_type}
+          </span>
+          {!channel.enabled && (
+            <span className="rounded bg-slate-500/30 px-2 py-0.5 text-xs text-slate-300">已禁用</span>
+          )}
+        </div>
+        <div className="mt-1 truncate text-xs text-slate-400">{summary}</div>
+      </div>
+      <div className="flex shrink-0 gap-2">
+        <button
+          onClick={onTest}
+          className="rounded border border-white/10 px-2 py-1 text-xs text-slate-300 hover:border-primary-400/40 hover:text-primary-400"
+        >
+          <Send size={12} className="inline" /> 测试
+        </button>
+        <button
+          onClick={onEdit}
+          className="rounded border border-white/10 px-2 py-1 text-xs text-slate-300 hover:border-primary-400/40 hover:text-primary-400"
+        >
+          <Pencil size={12} className="inline" /> 编辑
+        </button>
+        <button
+          onClick={onDelete}
+          className="rounded border border-red-400/40 px-2 py-1 text-xs text-red-400 hover:bg-red-400/10"
+        >
+          <Trash2 size={12} className="inline" /> 删除
+        </button>
+      </div>
+    </div>
+  )
+}
+
+function channelSummary(ch: NotifyChannel): string {
+  const cfg = ch.config ?? {}
+  switch (ch.channel_type) {
+    case 'telegram':
+      return `Bot ${String(cfg.bot_token ?? '').slice(0, 10)}… → chat ${cfg.chat_id ?? '-'}`
+    case 'wechat':
+      return `SendKey ${String(cfg.sendkey ?? '').slice(0, 10)}…`
+    case 'bark':
+      return `Device ${String(cfg.device_key ?? '').slice(0, 10)}…`
+    case 'webhook':
+      return `${cfg.method ?? 'POST'} ${cfg.url ?? ''}`
+    default:
+      return ''
+  }
+}
+
+// ─── Form Modal ─────────────────────────────────────────────────────────────
+
+const EMPTY_CONFIG: Record<NotifyChannel['channel_type'], Record<string, string>> = {
+  telegram: { bot_token: '', chat_id: '' },
+  wechat: { sendkey: '' },
+  bark: { device_key: '', server: '' },
+  webhook: { url: '', method: 'POST', headers: '', body_template: '' },
+}
+
+function ChannelFormModal({
+  editing,
+  onClose,
+  onSaved,
+}: {
+  editing: NotifyChannel | null
+  onClose: () => void
+  onSaved: () => void | Promise<void>
+}) {
+  const [name, setName] = useState(editing?.name ?? '')
+  const [type, setType] = useState<NotifyChannel['channel_type']>(
+    editing?.channel_type ?? 'telegram',
+  )
+  const [config, setConfig] = useState<Record<string, string>>(
+    editing?.config ?? EMPTY_CONFIG.telegram,
+  )
+  const [enabled, setEnabled] = useState(editing?.enabled ?? true)
+  const [saving, setSaving] = useState(false)
+
+  const onTypeChange = (t: NotifyChannel['channel_type']) => {
+    setType(t)
+    setConfig({ ...EMPTY_CONFIG[t] })
+  }
+
+  const onSubmit = async (e: FormEvent) => {
+    e.preventDefault()
+    setSaving(true)
+    try {
+      const input: NotifyChannelInput = {
+        name: name.trim(),
+        channel_type: type,
+        config,
+        enabled,
+      }
+      if (editing) {
+        await notifyChannelsAPI.update(editing.id, input)
+      } else {
+        await notifyChannelsAPI.create(input)
+      }
+      toast.success('已保存')
+      await onSaved()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ?? '保存失败'
+      toast.error(msg)
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const updateConfig = (k: string, v: string) =>
+    setConfig((c) => ({ ...c, [k]: v }))
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+      <div className="glass-panel w-full max-w-lg max-h-[90vh] overflow-y-auto">
+        <h2 className="mb-4 font-display text-xl font-semibold text-white">
+          {editing ? '编辑通知渠道' : '添加通知渠道'}
+        </h2>
+        <form onSubmit={onSubmit} className="space-y-4">
+          <Field label="名称">
+            <input
+              required
+              className="input-base"
+              placeholder="如: Telegram 通知"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+            />
+          </Field>
+
+          <Field label="渠道类型">
+            <select
+              className="input-base"
+              value={type}
+              onChange={(e) => onTypeChange(e.target.value as NotifyChannel['channel_type'])}
+            >
+              <option value="telegram">Telegram</option>
+              <option value="wechat">企业微信 / Server酱</option>
+              <option value="bark">Bark (iOS)</option>
+              <option value="webhook">Webhook</option>
+            </select>
+          </Field>
+
+          {type === 'telegram' && (
+            <>
+              <Field label="Bot Token">
+                <input
+                  required
+                  className="input-base"
+                  placeholder="123456:ABC-DEF…"
+                  value={config.bot_token ?? ''}
+                  onChange={(e) => updateConfig('bot_token', e.target.value)}
+                />
+              </Field>
+              <Field label="Chat ID">
+                <input
+                  required
+                  className="input-base"
+                  placeholder="-100123456"
+                  value={config.chat_id ?? ''}
+                  onChange={(e) => updateConfig('chat_id', e.target.value)}
+                />
+              </Field>
+            </>
+          )}
+
+          {type === 'wechat' && (
+            <Field label="SendKey">
+              <input
+                required
+                className="input-base"
+                placeholder="SCT…"
+                value={config.sendkey ?? ''}
+                onChange={(e) => updateConfig('sendkey', e.target.value)}
+              />
+            </Field>
+          )}
+
+          {type === 'bark' && (
+            <>
+              <Field label="设备 Key">
+                <input
+                  required
+                  className="input-base"
+                  value={config.device_key ?? ''}
+                  onChange={(e) => updateConfig('device_key', e.target.value)}
+                />
+              </Field>
+              <Field label="服务器地址 (可选)">
+                <input
+                  className="input-base"
+                  placeholder="https://api.day.app"
+                  value={config.server ?? ''}
+                  onChange={(e) => updateConfig('server', e.target.value)}
+                />
+              </Field>
+            </>
+          )}
+
+          {type === 'webhook' && (
+            <>
+              <Field label="URL">
+                <input
+                  required
+                  className="input-base"
+                  placeholder="https://example.com/notify"
+                  value={config.url ?? ''}
+                  onChange={(e) => updateConfig('url', e.target.value)}
+                />
+              </Field>
+              <Field label="Method">
+                <select
+                  className="input-base"
+                  value={config.method ?? 'POST'}
+                  onChange={(e) => updateConfig('method', e.target.value)}
+                >
+                  <option value="POST">POST</option>
+                  <option value="GET">GET</option>
+                </select>
+              </Field>
+              <Field label="Headers (JSON)">
+                <textarea
+                  rows={2}
+                  className="input-base font-mono text-xs"
+                  placeholder='{"Content-Type":"application/json"}'
+                  value={config.headers ?? ''}
+                  onChange={(e) => updateConfig('headers', e.target.value)}
+                />
+              </Field>
+              <Field label="Body 模板 (支持 {{title}} {{message}})">
+                <textarea
+                  rows={3}
+                  className="input-base font-mono text-xs"
+                  placeholder='{"title":"{{title}}","message":"{{message}}"}'
+                  value={config.body_template ?? ''}
+                  onChange={(e) => updateConfig('body_template', e.target.value)}
+                />
+              </Field>
+            </>
+          )}
+
+          <label className="flex cursor-pointer items-center gap-2 text-sm text-slate-300">
+            <input
+              type="checkbox"
+              className="h-4 w-4 accent-primary-400"
+              checked={enabled}
+              onChange={(e) => setEnabled(e.target.checked)}
+            />
+            启用
+          </label>
+
+          <div className="flex justify-end gap-2 pt-2">
+            <button
+              type="button"
+              onClick={onClose}
+              className="rounded border border-white/10 px-4 py-2 text-sm text-slate-300 hover:bg-white/5"
+            >
+              取消
+            </button>
+            <button type="submit" disabled={saving} className="neon-button">
+              {saving && <Loader2 size={16} className="animate-spin" />} 保存
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  )
+}
+
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <label className="block">
+      <span className="mb-1 block text-sm text-slate-300">{label}</span>
+      {children}
+    </label>
+  )
+}

web/src/pages/ProfileManagementPage.tsx

@@ -0,0 +1,457 @@
+import { FormEvent, useEffect, useMemo, useState } from 'react'
+import { Loader2, Pencil, Plus, Trash2, UserCog } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import { libraryAPI } from '../api/library'
+import { playProfilesAPI, type PlayProfileInput } from '../api/play_profiles'
+import { useAuthStore } from '../stores/auth'
+import type { Library, PlayProfile } from '../types'
+
+// ProfileManagementPage replicates the Vue ProfileManagementView. It
+// lets a user (or admin) define multiple "viewing personas" with
+// different content-rating gates, library access, and player defaults.
+//
+// All persistence is real: data is written to /api/play-profiles which
+// is backed by the Go PlayProfileService.
+export function ProfileManagementPage() {
+  const isAdmin = useAuthStore((s) => s.user?.role === 'admin')
+  const userID = useAuthStore((s) => s.user?.id ?? '')
+
+  const [profiles, setProfiles] = useState<PlayProfile[]>([])
+  const [libraries, setLibraries] = useState<Library[]>([])
+  const [loading, setLoading] = useState(true)
+  const [editing, setEditing] = useState<PlayProfile | null>(null)
+  const [showForm, setShowForm] = useState(false)
+
+  const refresh = async () => {
+    setLoading(true)
+    try {
+      const [p, l] = await Promise.all([
+        playProfilesAPI.list(isAdmin),
+        libraryAPI.list().catch(() => [] as Library[]),
+      ])
+      setProfiles(p)
+      setLibraries(l)
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    refresh().catch(() => undefined)
+  }, [isAdmin])
+
+  const onDelete = async (p: PlayProfile) => {
+    if (!confirm(`确定删除 Profile「${p.name}」?`)) return
+    try {
+      await playProfilesAPI.remove(p.id)
+      toast.success('已删除')
+      await refresh()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ?? '删除失败'
+      toast.error(msg)
+    }
+  }
+
+  const openCreate = () => {
+    setEditing(null)
+    setShowForm(true)
+  }
+
+  const openEdit = (p: PlayProfile) => {
+    setEditing(p)
+    setShowForm(true)
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <div className="flex items-center gap-3">
+          <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-purple-400/10 text-purple-400">
+            <UserCog size={20} />
+          </div>
+          <div>
+            <h1 className="font-display text-3xl font-bold text-white">观影 Profile</h1>
+            <p className="text-sm text-slate-400">
+              为不同场景(儿童 / 影院 / 成人)定义独立的内容分级和媒体库访问规则
+            </p>
+          </div>
+        </div>
+        <button onClick={openCreate} className="neon-button">
+          <Plus size={16} /> 创建 Profile
+        </button>
+      </div>
+
+      {loading && (
+        <div className="flex justify-center py-12 text-slate-400">
+          <Loader2 className="animate-spin" />
+        </div>
+      )}
+
+      {!loading && profiles.length === 0 && (
+        <div className="glass-panel py-12 text-center">
+          <div className="mb-2 text-4xl">👤</div>
+          <p className="font-medium text-white">暂无 Profile</p>
+          <p className="text-sm text-slate-400">点击右上角"创建 Profile"开始</p>
+        </div>
+      )}
+
+      {!loading && profiles.length > 0 && (
+        <div className="grid gap-3">
+          {profiles.map((p) => (
+            <ProfileCard
+              key={p.id}
+              profile={p}
+              libraries={libraries}
+              onEdit={() => openEdit(p)}
+              onDelete={() => onDelete(p)}
+            />
+          ))}
+        </div>
+      )}
+
+      {showForm && (
+        <ProfileFormModal
+          editing={editing}
+          libraries={libraries}
+          defaultUserID={userID}
+          isAdmin={isAdmin}
+          onClose={() => setShowForm(false)}
+          onSaved={async () => {
+            setShowForm(false)
+            await refresh()
+          }}
+        />
+      )}
+    </div>
+  )
+}
+
+function ProfileCard({
+  profile,
+  libraries,
+  onEdit,
+  onDelete,
+}: {
+  profile: PlayProfile
+  libraries: Library[]
+  onEdit: () => void
+  onDelete: () => void
+}) {
+  const libNames = useMemo(() => {
+    if (!profile.allowed_library_ids?.length) return '全部'
+    const idx = new Map(libraries.map((l) => [l.id, l.name]))
+    return profile.allowed_library_ids.map((id) => idx.get(id) ?? id).join(', ')
+  }, [profile, libraries])
+
+  return (
+    <div className="glass-panel flex items-start justify-between gap-4">
+      <div className="flex min-w-0 items-start gap-3">
+        <div
+          className="flex h-12 w-12 shrink-0 items-center justify-center rounded-full text-lg font-bold text-white"
+          style={{
+            background: `hsl(${(profile.name.charCodeAt(0) * 47) % 360}, 60%, 35%)`,
+          }}
+        >
+          {profile.name[0]?.toUpperCase()}
+        </div>
+        <div className="min-w-0 space-y-1">
+          <div className="flex flex-wrap items-center gap-2">
+            <span className="font-semibold text-white">{profile.name}</span>
+            {profile.is_default && (
+              <span className="rounded bg-primary-400/20 px-2 py-0.5 text-xs text-primary-400">
+                默认
+              </span>
+            )}
+            {profile.allow_adult && (
+              <span className="rounded bg-red-400/20 px-2 py-0.5 text-xs text-red-400">
+                成人内容
+              </span>
+            )}
+            {profile.require_pin && (
+              <span className="rounded bg-amber-400/20 px-2 py-0.5 text-xs text-amber-400">
+                🔒 PIN
+              </span>
+            )}
+          </div>
+          <div className="flex flex-wrap gap-x-4 gap-y-1 text-xs text-slate-400">
+            {profile.content_rating_limit && <span>分级: {profile.content_rating_limit}</span>}
+            <span>媒体库: {libNames}</span>
+            <span>用户: {profile.user_id.slice(0, 8)}…</span>
+          </div>
+          <div className="text-xs text-slate-500">
+            观看时长 {Math.round(profile.total_watch_time / 3600)} 小时
+            {profile.last_active_at && ` · 最近活跃 ${new Date(profile.last_active_at).toLocaleDateString()}`}
+          </div>
+        </div>
+      </div>
+      <div className="flex shrink-0 gap-2">
+        <button
+          onClick={onEdit}
+          className="rounded border border-white/10 px-2 py-1 text-xs text-slate-300 hover:border-primary-400/40 hover:text-primary-400"
+        >
+          <Pencil size={12} className="inline" /> 编辑
+        </button>
+        <button
+          onClick={onDelete}
+          className="rounded border border-red-400/40 px-2 py-1 text-xs text-red-400 hover:bg-red-400/10"
+        >
+          <Trash2 size={12} className="inline" /> 删除
+        </button>
+      </div>
+    </div>
+  )
+}
+
+function ProfileFormModal({
+  editing,
+  libraries,
+  defaultUserID,
+  isAdmin,
+  onClose,
+  onSaved,
+}: {
+  editing: PlayProfile | null
+  libraries: Library[]
+  defaultUserID: string
+  isAdmin: boolean
+  onClose: () => void
+  onSaved: () => void | Promise<void>
+}) {
+  const [form, setForm] = useState<PlayProfileInput>(() => ({
+    user_id: editing?.user_id ?? defaultUserID,
+    name: editing?.name ?? '',
+    is_default: editing?.is_default ?? false,
+    content_rating_limit: editing?.content_rating_limit ?? '',
+    allow_adult: editing?.allow_adult ?? false,
+    require_pin: editing?.require_pin ?? false,
+    pin: '',
+    preferred_subtitle_lang: editing?.preferred_subtitle_lang ?? '',
+    preferred_audio_lang: editing?.preferred_audio_lang ?? '',
+    autoplay_next: editing?.autoplay_next ?? true,
+    skip_intro: editing?.skip_intro ?? false,
+    allowed_library_ids: editing?.allowed_library_ids ?? [],
+  }))
+  const [saving, setSaving] = useState(false)
+
+  const update = (patch: Partial<PlayProfileInput>) => setForm((f) => ({ ...f, ...patch }))
+
+  const toggleLib = (id: string) => {
+    const next = form.allowed_library_ids.includes(id)
+      ? form.allowed_library_ids.filter((x) => x !== id)
+      : [...form.allowed_library_ids, id]
+    update({ allowed_library_ids: next })
+  }
+
+  const onSubmit = async (e: FormEvent) => {
+    e.preventDefault()
+    setSaving(true)
+    try {
+      if (editing) {
+        await playProfilesAPI.update(editing.id, form)
+      } else {
+        await playProfilesAPI.create(form)
+      }
+      toast.success('已保存')
+      await onSaved()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ?? '保存失败'
+      toast.error(msg)
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+      <div className="glass-panel w-full max-w-lg max-h-[90vh] overflow-y-auto">
+        <h2 className="mb-4 font-display text-xl font-semibold text-white">
+          {editing ? '编辑 Profile' : '创建 Profile'}
+        </h2>
+        <form onSubmit={onSubmit} className="space-y-4">
+          {!editing && isAdmin && (
+            <Field label="用户 ID">
+              <input
+                className="input-base"
+                value={form.user_id ?? ''}
+                onChange={(e) => update({ user_id: e.target.value })}
+              />
+            </Field>
+          )}
+          <Field label="名称">
+            <input
+              required
+              className="input-base"
+              maxLength={50}
+              placeholder="如:儿童模式、影院模式"
+              value={form.name}
+              onChange={(e) => update({ name: e.target.value })}
+            />
+          </Field>
+
+          <Toggle
+            label="设为默认 Profile"
+            hint="登录后默认使用"
+            checked={form.is_default}
+            onChange={(v) => update({ is_default: v })}
+          />
+
+          <Field label="内容分级限制">
+            <select
+              className="input-base"
+              value={form.content_rating_limit ?? ''}
+              onChange={(e) => update({ content_rating_limit: e.target.value })}
+            >
+              <option value="">不限制</option>
+              <option value="G">G</option>
+              <option value="PG">PG</option>
+              <option value="PG-13">PG-13</option>
+              <option value="R">R</option>
+              <option value="NC-17">NC-17</option>
+            </select>
+          </Field>
+
+          <Toggle
+            label="允许成人内容"
+            hint="开启后可访问 NSFW 媒体"
+            checked={form.allow_adult}
+            onChange={(v) => update({ allow_adult: v })}
+          />
+
+          <Toggle
+            label="切换时需要 PIN"
+            hint="切换到此 Profile 需输入 PIN 码"
+            checked={form.require_pin}
+            onChange={(v) => update({ require_pin: v })}
+          />
+          {form.require_pin && (
+            <Field label="PIN 码 (4-8 位)">
+              <input
+                type="password"
+                className="input-base"
+                maxLength={8}
+                placeholder={editing ? '留空保持不变' : '设置 PIN'}
+                value={form.pin ?? ''}
+                onChange={(e) => update({ pin: e.target.value })}
+              />
+            </Field>
+          )}
+
+          <div className="grid grid-cols-2 gap-3">
+            <Field label="首选字幕">
+              <select
+                className="input-base"
+                value={form.preferred_subtitle_lang ?? ''}
+                onChange={(e) => update({ preferred_subtitle_lang: e.target.value })}
+              >
+                <option value="">跟随系统</option>
+                <option value="zh">中文</option>
+                <option value="zh-CN">简体中文</option>
+                <option value="en">English</option>
+                <option value="ja">日语</option>
+              </select>
+            </Field>
+            <Field label="首选音轨">
+              <select
+                className="input-base"
+                value={form.preferred_audio_lang ?? ''}
+                onChange={(e) => update({ preferred_audio_lang: e.target.value })}
+              >
+                <option value="">跟随系统</option>
+                <option value="zh">中文</option>
+                <option value="ja">日语</option>
+                <option value="en">English</option>
+              </select>
+            </Field>
+          </div>
+
+          <Toggle
+            label="自动播放下一集"
+            checked={form.autoplay_next}
+            onChange={(v) => update({ autoplay_next: v })}
+          />
+          <Toggle
+            label="自动跳过片头"
+            checked={form.skip_intro}
+            onChange={(v) => update({ skip_intro: v })}
+          />
+
+          <Field label="允许访问的媒体库 (空 = 全部)">
+            <div className="flex flex-wrap gap-2">
+              {libraries.map((l) => (
+                <button
+                  key={l.id}
+                  type="button"
+                  onClick={() => toggleLib(l.id)}
+                  className={
+                    'rounded-full border px-3 py-1 text-xs ' +
+                    (form.allowed_library_ids.includes(l.id)
+                      ? 'border-primary-400/60 bg-primary-400/10 text-primary-400'
+                      : 'border-white/10 text-slate-400 hover:text-white')
+                  }
+                >
+                  {l.name}
+                </button>
+              ))}
+              {libraries.length === 0 && (
+                <span className="text-xs text-slate-500">暂无媒体库</span>
+              )}
+            </div>
+          </Field>
+
+          <div className="flex justify-end gap-2 pt-2">
+            <button
+              type="button"
+              onClick={onClose}
+              className="rounded border border-white/10 px-4 py-2 text-sm text-slate-300 hover:bg-white/5"
+            >
+              取消
+            </button>
+            <button type="submit" disabled={saving} className="neon-button">
+              {saving && <Loader2 size={16} className="animate-spin" />}
+              保存
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  )
+}
+
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <label className="block">
+      <span className="mb-1 block text-sm text-slate-300">{label}</span>
+      {children}
+    </label>
+  )
+}
+
+function Toggle({
+  label,
+  hint,
+  checked,
+  onChange,
+}: {
+  label: string
+  hint?: string
+  checked: boolean
+  onChange: (v: boolean) => void
+}) {
+  return (
+    <label className="flex cursor-pointer items-center justify-between gap-3 rounded-lg border border-white/5 bg-white/5 px-3 py-2">
+      <div>
+        <div className="text-sm text-white">{label}</div>
+        {hint && <div className="text-xs text-slate-400">{hint}</div>}
+      </div>
+      <input
+        type="checkbox"
+        checked={checked}
+        onChange={(e) => onChange(e.target.checked)}
+        className="h-4 w-4 accent-primary-400"
+      />
+    </label>
+  )
+}

web/src/pages/SettingsPage.tsx

@@ -0,0 +1,362 @@
+import { FormEvent, useEffect, useState } from 'react'
+import { Loader2, Save, SettingsIcon } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import { adminAPI } from '../api/admin'
+import type { Setting } from '../types'
+
+// SettingsPage replaces the Vue SettingsView's General / Organize /
+// Scrape / Adult tabs. The Go backend stores settings as a single
+// key/value table; we group the most useful keys client-side and let
+// the operator edit them with typed widgets (select / toggle / input).
+//
+// Any key not in the curated list still works via the AdminPage generic
+// key/value editor — this page is the curated UX over the same store.
+interface SettingDef {
+  key: string
+  label: string
+  type: 'text' | 'select' | 'toggle' | 'number' | 'textarea'
+  hint?: string
+  options?: { value: string; label: string }[]
+  placeholder?: string
+}
+
+interface SettingGroup {
+  key: string
+  label: string
+  description?: string
+  items: SettingDef[]
+}
+
+const GROUPS: SettingGroup[] = [
+  {
+    key: 'general',
+    label: '常规',
+    description: 'TMDb / 转码引擎默认参数',
+    items: [
+      {
+        key: 'tmdb.language',
+        label: 'TMDb 元数据语言',
+        type: 'select',
+        options: [
+          { value: 'zh-CN', label: '简体中文' },
+          { value: 'zh-TW', label: '繁体中文' },
+          { value: 'en-US', label: 'English' },
+          { value: 'ja-JP', label: '日本語' },
+        ],
+      },
+      {
+        key: 'transcode.enabled',
+        label: '启用转码',
+        type: 'toggle',
+        hint: '关闭后所有视频直连播放',
+      },
+      {
+        key: 'transcode.hw_accel',
+        label: '硬件加速',
+        type: 'select',
+        options: [
+          { value: 'auto', label: '自动检测' },
+          { value: 'none', label: '软件转码' },
+          { value: 'nvenc', label: 'NVIDIA NVENC' },
+          { value: 'qsv', label: 'Intel QSV' },
+          { value: 'vaapi', label: 'VAAPI (Linux)' },
+          { value: 'videotoolbox', label: 'VideoToolbox (macOS)' },
+        ],
+      },
+      {
+        key: 'transcode.max_jobs',
+        label: '最大并发转码任务',
+        type: 'number',
+        hint: '建议 1-4',
+      },
+      {
+        key: 'ffmpeg.path',
+        label: 'FFmpeg 路径',
+        type: 'text',
+        placeholder: 'ffmpeg',
+      },
+      {
+        key: 'ffprobe.path',
+        label: 'FFprobe 路径',
+        type: 'text',
+        placeholder: 'ffprobe',
+      },
+    ],
+  },
+  {
+    key: 'organize',
+    label: '整理 & 刮削',
+    description: '媒体文件命名 + 自动刮削开关',
+    items: [
+      {
+        key: 'organize.auto',
+        label: '入库时自动整理',
+        type: 'toggle',
+      },
+      {
+        key: 'organize.movie_format',
+        label: '电影命名格式',
+        type: 'text',
+        hint: '例: {title} ({year})/{title} ({year})',
+        placeholder: '{title} ({year})/{title} ({year})',
+      },
+      {
+        key: 'organize.tv_format',
+        label: '剧集命名格式',
+        type: 'text',
+        placeholder: '{title} ({year})/Season {season}/{title} S{season:02}E{episode:02}',
+      },
+      {
+        key: 'organize.anime_format',
+        label: '动漫命名格式',
+        type: 'text',
+        placeholder: '{title}/Season {season}/{title} S{season:02}E{episode:02}',
+      },
+      {
+        key: 'scrape.auto_on_scan',
+        label: '扫描后自动刮削',
+        type: 'toggle',
+      },
+      {
+        key: 'scrape.providers',
+        label: '刮削源优先级',
+        type: 'text',
+        hint: '逗号分隔: tmdb,bangumi,thetvdb,fanart',
+        placeholder: 'tmdb,bangumi,thetvdb,fanart',
+      },
+      {
+        key: 'scrape.language',
+        label: '刮削首选语言',
+        type: 'text',
+        placeholder: 'zh-CN',
+      },
+    ],
+  },
+  {
+    key: 'adult',
+    label: 'Adult / NSFW',
+    description: '成人内容隔离开关 (默认隐藏)',
+    items: [
+      {
+        key: 'adult.enabled',
+        label: '启用成人内容',
+        type: 'toggle',
+        hint: '关闭后 NSFW 媒体不会出现在列表中',
+      },
+      {
+        key: 'adult.require_pin',
+        label: '访问需要 PIN',
+        type: 'toggle',
+      },
+      {
+        key: 'adult.pin',
+        label: 'PIN 码',
+        type: 'text',
+        hint: '4-8 位数字',
+      },
+    ],
+  },
+  {
+    key: 'qbittorrent',
+    label: 'qBittorrent',
+    description: '默认下载器配置',
+    items: [
+      { key: 'qbittorrent.url', label: 'WebUI URL', type: 'text', placeholder: 'http://127.0.0.1:8080' },
+      { key: 'qbittorrent.username', label: '用户名', type: 'text' },
+      { key: 'qbittorrent.password', label: '密码', type: 'text' },
+      { key: 'qbittorrent.savepath', label: '默认保存目录', type: 'text' },
+    ],
+  },
+]
+
+const ALL_KEYS = new Set(GROUPS.flatMap((g) => g.items.map((i) => i.key)))
+
+export function SettingsPage() {
+  const [activeGroup, setActiveGroup] = useState(GROUPS[0].key)
+  const [values, setValues] = useState<Record<string, string>>({})
+  const [dirty, setDirty] = useState<Set<string>>(new Set())
+  const [loading, setLoading] = useState(true)
+  const [saving, setSaving] = useState(false)
+
+  const refresh = async () => {
+    setLoading(true)
+    try {
+      const all = await adminAPI.listSettings()
+      const idx: Record<string, string> = {}
+      for (const s of all as Setting[]) {
+        if (ALL_KEYS.has(s.key)) idx[s.key] = s.value
+      }
+      setValues(idx)
+      setDirty(new Set())
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    refresh().catch(() => undefined)
+  }, [])
+
+  const onChange = (key: string, value: string) => {
+    setValues((v) => ({ ...v, [key]: value }))
+    setDirty((d) => new Set(d).add(key))
+  }
+
+  const onSave = async (e: FormEvent) => {
+    e.preventDefault()
+    if (dirty.size === 0) return
+    setSaving(true)
+    try {
+      // Backend exposes a single-key updater; loop through dirty keys.
+      for (const key of dirty) {
+        await adminAPI.updateSetting(key, values[key] ?? '')
+      }
+      toast.success(`已保存 ${dirty.size} 项配置`)
+      setDirty(new Set())
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ?? '保存失败'
+      toast.error(msg)
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const group = GROUPS.find((g) => g.key === activeGroup)!
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center gap-3">
+        <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-slate-400/10 text-slate-300">
+          <SettingsIcon size={20} />
+        </div>
+        <div>
+          <h1 className="font-display text-3xl font-bold text-white">系统设置</h1>
+          <p className="text-sm text-slate-400">
+            按分组编辑 TMDb / 整理 / 刮削 / 下载器等关键配置
+          </p>
+        </div>
+      </div>
+
+      <div className="flex gap-2 overflow-x-auto border-b border-white/10">
+        {GROUPS.map((g) => (
+          <button
+            key={g.key}
+            onClick={() => setActiveGroup(g.key)}
+            className={
+              'border-b-2 px-4 py-2 text-sm whitespace-nowrap transition ' +
+              (activeGroup === g.key
+                ? 'border-primary-400 text-primary-400'
+                : 'border-transparent text-slate-400 hover:text-white')
+            }
+          >
+            {g.label}
+          </button>
+        ))}
+      </div>
+
+      {loading && (
+        <div className="flex justify-center py-12 text-slate-400">
+          <Loader2 className="animate-spin" />
+        </div>
+      )}
+
+      {!loading && (
+        <form onSubmit={onSave} className="glass-panel space-y-4">
+          {group.description && <p className="text-xs text-slate-500">{group.description}</p>}
+          {group.items.map((it) => (
+            <SettingRow
+              key={it.key}
+              def={it}
+              value={values[it.key] ?? ''}
+              onChange={(v) => onChange(it.key, v)}
+            />
+          ))}
+          <div className="flex items-center justify-between pt-2">
+            <span className="text-xs text-slate-500">
+              {dirty.size > 0 ? `有 ${dirty.size} 项未保存` : '所有更改已保存'}
+            </span>
+            <button
+              type="submit"
+              disabled={saving || dirty.size === 0}
+              className="neon-button disabled:opacity-50"
+            >
+              {saving ? <Loader2 size={16} className="animate-spin" /> : <Save size={16} />}
+              保存
+            </button>
+          </div>
+        </form>
+      )}
+    </div>
+  )
+}
+
+function SettingRow({
+  def,
+  value,
+  onChange,
+}: {
+  def: SettingDef
+  value: string
+  onChange: (v: string) => void
+}) {
+  return (
+    <div className="grid items-start gap-2 md:grid-cols-[280px_1fr]">
+      <label className="text-sm text-slate-300">
+        <div className="font-medium">{def.label}</div>
+        {def.hint && <div className="mt-0.5 text-xs text-slate-500">{def.hint}</div>}
+        <div className="mt-0.5 font-mono text-[10px] text-slate-600">{def.key}</div>
+      </label>
+      <div>
+        {def.type === 'text' && (
+          <input
+            className="input-base"
+            value={value}
+            placeholder={def.placeholder}
+            onChange={(e) => onChange(e.target.value)}
+          />
+        )}
+        {def.type === 'number' && (
+          <input
+            type="number"
+            className="input-base"
+            value={value}
+            placeholder={def.placeholder}
+            onChange={(e) => onChange(e.target.value)}
+          />
+        )}
+        {def.type === 'textarea' && (
+          <textarea
+            rows={3}
+            className="input-base font-mono text-xs"
+            value={value}
+            placeholder={def.placeholder}
+            onChange={(e) => onChange(e.target.value)}
+          />
+        )}
+        {def.type === 'select' && (
+          <select className="input-base" value={value} onChange={(e) => onChange(e.target.value)}>
+            <option value="">(未设置)</option>
+            {def.options?.map((o) => (
+              <option key={o.value} value={o.value}>
+                {o.label}
+              </option>
+            ))}
+          </select>
+        )}
+        {def.type === 'toggle' && (
+          <label className="flex cursor-pointer items-center gap-2">
+            <input
+              type="checkbox"
+              className="h-4 w-4 accent-primary-400"
+              checked={value === 'true' || value === '1' || value === 'on'}
+              onChange={(e) => onChange(e.target.checked ? 'true' : 'false')}
+            />
+            <span className="text-sm text-slate-300">{value === 'true' ? '已启用' : '已关闭'}</span>
+          </label>
+        )}
+      </div>
+    </div>
+  )
+}

web/src/pages/StorageConfigPage.tsx

@@ -0,0 +1,187 @@
+import { FormEvent, useEffect, useMemo, useState } from 'react'
+import { Cloud, Loader2, Save, Send } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import { storageAPI, type StorageType } from '../api/storage_config'
+
+// StorageConfigPage manages the Alist / S3 / WebDAV adapters used by
+// the import / playback / STRM subsystems. Mirrors the Vue UI's
+// `admin/storage/*` tabs in a tabbed React surface.
+export function StorageConfigPage() {
+  const [active, setActive] = useState<StorageType>('alist')
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center gap-3">
+        <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-blue-400/10 text-blue-300">
+          <Cloud size={20} />
+        </div>
+        <div>
+          <h1 className="font-display text-3xl font-bold text-white">外部存储</h1>
+          <p className="text-sm text-slate-400">
+            配置 Alist / S3 / WebDAV 后端,支持密码加密存储 + 在线测试
+          </p>
+        </div>
+      </div>
+
+      <div className="flex gap-2 border-b border-white/10">
+        {(['alist', 'webdav', 's3'] as StorageType[]).map((t) => (
+          <button
+            key={t}
+            onClick={() => setActive(t)}
+            className={
+              'border-b-2 px-4 py-2 text-sm uppercase ' +
+              (active === t
+                ? 'border-primary-400 text-primary-400'
+                : 'border-transparent text-slate-400 hover:text-white')
+            }
+          >
+            {t}
+          </button>
+        ))}
+      </div>
+
+      <StorageForm key={active} type={active} />
+    </div>
+  )
+}
+
+const FIELD_DEFS: Record<StorageType, { key: string; label: string; secret?: boolean; placeholder?: string }[]> = {
+  alist: [
+    { key: 'server', label: 'Server URL', placeholder: 'https://alist.example.com' },
+    { key: 'token', label: 'Token', secret: true },
+  ],
+  webdav: [
+    { key: 'url', label: 'URL', placeholder: 'https://example.com/dav/' },
+    { key: 'username', label: '用户名' },
+    { key: 'password', label: '密码', secret: true },
+  ],
+  s3: [
+    { key: 'endpoint', label: 'Endpoint', placeholder: 'https://s3.amazonaws.com' },
+    { key: 'region', label: 'Region', placeholder: 'us-east-1' },
+    { key: 'bucket', label: 'Bucket' },
+    { key: 'access_key', label: 'Access Key', secret: true },
+    { key: 'secret_key', label: 'Secret Key', secret: true },
+    { key: 'force_path_style', label: 'force_path_style (true/false)' },
+  ],
+}
+
+function StorageForm({ type }: { type: StorageType }) {
+  const fields = useMemo(() => FIELD_DEFS[type], [type])
+  const [config, setConfig] = useState<Record<string, string>>({})
+  const [enabled, setEnabled] = useState(true)
+  const [loading, setLoading] = useState(true)
+  const [saving, setSaving] = useState(false)
+  const [testing, setTesting] = useState(false)
+
+  const refresh = async () => {
+    setLoading(true)
+    try {
+      const r = await storageAPI.get(type)
+      const next: Record<string, string> = {}
+      for (const f of fields) {
+        const v = r.config?.[f.key]
+        // List() redacts secrets to "********"; show empty so the user
+        // doesn't accidentally save the placeholder.
+        next[f.key] = v === '********' ? '' : v ?? ''
+      }
+      setConfig(next)
+      setEnabled(r.enabled)
+    } catch {
+      const next: Record<string, string> = {}
+      for (const f of fields) next[f.key] = ''
+      setConfig(next)
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    refresh().catch(() => undefined)
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [type])
+
+  const onSave = async (e: FormEvent) => {
+    e.preventDefault()
+    setSaving(true)
+    try {
+      await storageAPI.save(type, config, enabled)
+      toast.success('已保存')
+      await refresh()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '保存失败'
+      toast.error(msg)
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const onTest = async () => {
+    setTesting(true)
+    try {
+      const r = await storageAPI.test(type, config)
+      if (r.ok) toast.success('连接成功')
+      else toast.error(r.error ?? '连接失败')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '测试失败'
+      toast.error(msg)
+    } finally {
+      setTesting(false)
+    }
+  }
+
+  if (loading) {
+    return (
+      <div className="flex justify-center py-12 text-slate-400">
+        <Loader2 className="animate-spin" />
+      </div>
+    )
+  }
+
+  return (
+    <form onSubmit={onSave} className="glass-panel space-y-4">
+      {fields.map((f) => (
+        <label key={f.key} className="block">
+          <span className="mb-1 block text-sm text-slate-300">
+            {f.label}
+            <span className="ml-2 font-mono text-[10px] text-slate-600">{f.key}</span>
+          </span>
+          <input
+            type={f.secret ? 'password' : 'text'}
+            className="input-base"
+            placeholder={f.placeholder}
+            value={config[f.key] ?? ''}
+            onChange={(e) => setConfig((c) => ({ ...c, [f.key]: e.target.value }))}
+          />
+        </label>
+      ))}
+      <label className="flex items-center gap-2 text-sm text-slate-300">
+        <input
+          type="checkbox"
+          className="h-4 w-4 accent-primary-400"
+          checked={enabled}
+          onChange={(e) => setEnabled(e.target.checked)}
+        />
+        启用
+      </label>
+      <div className="flex justify-end gap-2 pt-2">
+        <button
+          type="button"
+          onClick={onTest}
+          disabled={testing}
+          className="rounded border border-white/10 px-4 py-2 text-sm text-slate-300 hover:bg-white/5"
+        >
+          {testing ? <Loader2 size={14} className="inline animate-spin" /> : <Send size={14} className="inline" />}
+          {' '}测试
+        </button>
+        <button type="submit" disabled={saving} className="neon-button">
+          {saving ? <Loader2 size={16} className="animate-spin" /> : <Save size={16} />}
+          保存
+        </button>
+      </div>
+    </form>
+  )
+}

web/src/pages/StrmPage.tsx

@@ -0,0 +1,248 @@
+import { FormEvent, useEffect, useState } from 'react'
+import { Link as LinkIcon, Plus, Search, Trash2 } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import { libraryAPI, mediaAPI } from '../api/library'
+import { strmAPI } from '../api/strm'
+import type { Library, Media } from '../types'
+
+// StrmPage exposes the URL-as-file admin tooling backed by the Go server:
+//   - import a brand-new media row directly from a (library, title, url)
+//     tuple — useful for streaming-only entries with no on-disk file.
+//   - search existing media and attach / detach a STRM URL so the player
+//     issues a 302 redirect to the remote source instead of opening a
+//     local file.
+export function StrmPage() {
+  const [libraries, setLibraries] = useState<Library[]>([])
+
+  // Import form state
+  const [libraryID, setLibraryID] = useState('')
+  const [title, setTitle] = useState('')
+  const [url, setURL] = useState('')
+  const [importing, setImporting] = useState(false)
+
+  // Search + attach state
+  const [query, setQuery] = useState('')
+  const [searching, setSearching] = useState(false)
+  const [results, setResults] = useState<Media[]>([])
+  const [drafts, setDrafts] = useState<Record<string, string>>({})
+
+  useEffect(() => {
+    libraryAPI.list().then(setLibraries).catch(() => undefined)
+  }, [])
+
+  // Default the import library to the first available one once loaded.
+  useEffect(() => {
+    if (!libraryID && libraries[0]) setLibraryID(libraries[0].id)
+  }, [libraries, libraryID])
+
+  const onImport = async (e: FormEvent) => {
+    e.preventDefault()
+    if (!libraryID || !title.trim() || !url.trim()) return
+    if (!/^https?:\/\//i.test(url.trim())) {
+      toast.error('URL 必须以 http:// 或 https:// 开头')
+      return
+    }
+    setImporting(true)
+    try {
+      await strmAPI.importURL(libraryID, title.trim(), url.trim())
+      toast.success(`已导入「${title.trim()}」`)
+      setTitle('')
+      setURL('')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '导入失败'
+      toast.error(msg)
+    } finally {
+      setImporting(false)
+    }
+  }
+
+  const doSearch = async (e?: FormEvent) => {
+    e?.preventDefault()
+    if (!query.trim()) return
+    setSearching(true)
+    try {
+      const r = await mediaAPI.search(query.trim(), 30)
+      setResults(r.items ?? [])
+    } catch {
+      toast.error('搜索失败')
+    } finally {
+      setSearching(false)
+    }
+  }
+
+  const onAttach = async (m: Media) => {
+    const next = (drafts[m.id] ?? '').trim()
+    if (!next) return
+    if (!/^https?:\/\//i.test(next)) {
+      toast.error('URL 必须以 http:// 或 https:// 开头')
+      return
+    }
+    try {
+      await strmAPI.set(m.id, next)
+      toast.success('已设置 STRM URL')
+      // Optimistic update so the user sees the new state without a re-search.
+      setResults((rs) =>
+        rs.map((x) => (x.id === m.id ? ({ ...x, container: 'strm' } as Media) : x)),
+      )
+      setDrafts((d) => ({ ...d, [m.id]: '' }))
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '设置失败'
+      toast.error(msg)
+    }
+  }
+
+  const onDetach = async (m: Media) => {
+    if (!confirm(`清除「${m.title}」的 STRM URL?`)) return
+    try {
+      await strmAPI.clear(m.id)
+      toast.success('已清除')
+      setResults((rs) =>
+        rs.map((x) =>
+          x.id === m.id ? ({ ...x, container: x.container === 'strm' ? '' : x.container } as Media) : x,
+        ),
+      )
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '清除失败'
+      toast.error(msg)
+    }
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center gap-3">
+        <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-amber-400/10 text-amber-400">
+          <LinkIcon size={20} />
+        </div>
+        <div>
+          <h1 className="font-display text-3xl font-bold text-white">STRM 管理</h1>
+          <p className="text-sm text-slate-400">
+            将外部 HTTP / WebDAV / Alist 直链以"虚拟文件"形式纳入媒体库
+          </p>
+        </div>
+      </div>
+
+      {/* Import a new STRM-only entry. */}
+      <section className="glass-panel space-y-4">
+        <h2 className="font-display text-lg font-semibold text-white">导入 STRM 条目</h2>
+        <form onSubmit={onImport} className="grid gap-3 md:grid-cols-4">
+          <select
+            required
+            className="input-base"
+            value={libraryID}
+            onChange={(e) => setLibraryID(e.target.value)}
+          >
+            <option value="" disabled>
+              选择媒体库
+            </option>
+            {libraries.map((l) => (
+              <option key={l.id} value={l.id}>
+                {l.name} ({l.type})
+              </option>
+            ))}
+          </select>
+          <input
+            required
+            className="input-base"
+            placeholder="标题"
+            value={title}
+            onChange={(e) => setTitle(e.target.value)}
+          />
+          <input
+            required
+            className="input-base md:col-span-2"
+            placeholder="https://example.com/movie.mp4"
+            value={url}
+            onChange={(e) => setURL(e.target.value)}
+          />
+          <button type="submit" disabled={importing} className="neon-button md:col-span-4">
+            <Plus size={16} /> {importing ? '导入中…' : '导入'}
+          </button>
+        </form>
+        <p className="text-xs text-slate-500">
+          导入后会创建一条 container=strm 的媒体记录,播放时会 302 重定向到该 URL。
+        </p>
+      </section>
+
+      {/* Attach / detach STRM URL on existing media. */}
+      <section className="glass-panel space-y-4">
+        <h2 className="font-display text-lg font-semibold text-white">附加 STRM URL 到已有媒体</h2>
+        <form onSubmit={doSearch} className="flex gap-2">
+          <input
+            className="input-base flex-1"
+            placeholder="搜索媒体标题…"
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+          />
+          <button type="submit" disabled={searching} className="neon-button">
+            <Search size={16} /> {searching ? '搜索中…' : '搜索'}
+          </button>
+        </form>
+
+        {results.length > 0 && (
+          <div className="space-y-3">
+            {results.map((m) => {
+              const isStrm = m.container === 'strm'
+              return (
+                <div
+                  key={m.id}
+                  className="rounded-xl border border-white/5 bg-white/5 p-4 space-y-3"
+                >
+                  <div className="flex items-start justify-between gap-3">
+                    <div className="min-w-0">
+                      <div className="truncate font-medium text-white">{m.title}</div>
+                      <div className="truncate text-xs text-slate-400">
+                        {m.year > 0 && `${m.year} · `}
+                        {m.container || '本地文件'}
+                      </div>
+                      {isStrm && (
+                        <div className="mt-1 break-all rounded bg-emerald-400/10 px-2 py-0.5 text-xs text-emerald-300">
+                          已设置 STRM
+                        </div>
+                      )}
+                    </div>
+                    {isStrm && (
+                      <button
+                        onClick={() => onDetach(m)}
+                        className="rounded border border-red-400/40 px-2 py-1 text-xs text-red-400 hover:bg-red-400/10"
+                      >
+                        <Trash2 size={12} className="inline" /> 清除
+                      </button>
+                    )}
+                  </div>
+                  <div className="flex gap-2">
+                    <input
+                      className="input-base flex-1"
+                      placeholder="https://example.com/stream.m3u8"
+                      value={drafts[m.id] ?? ''}
+                      onChange={(e) =>
+                        setDrafts((d) => ({ ...d, [m.id]: e.target.value }))
+                      }
+                    />
+                    <button
+                      onClick={() => onAttach(m)}
+                      disabled={!(drafts[m.id] ?? '').trim()}
+                      className="neon-button"
+                    >
+                      {isStrm ? '替换 URL' : '设置'}
+                    </button>
+                  </div>
+                </div>
+              )
+            })}
+          </div>
+        )}
+
+        {!searching && query && results.length === 0 && (
+          <p className="text-sm text-slate-400">未找到匹配的媒体。</p>
+        )}
+      </section>
+    </div>
+  )
+}

web/src/pages/ToolsPage.tsx

@@ -0,0 +1,244 @@
+import { FormEvent, useEffect, useState } from 'react'
+import { Bell, FolderCog, Loader2, Search, Wrench } from 'lucide-react'
+import toast from 'react-hot-toast'
+
+import { libraryAPI, mediaAPI } from '../api/library'
+import { toolsAPI } from '../api/tools'
+import type { Library, Media } from '../types'
+
+// ToolsPage gathers admin-only one-off operations that don't belong on a
+// dedicated screen of their own:
+//
+//   - Organize one media item or an entire library: renames + moves files
+//     into the canonical layout (`Library/Year/Title (Year)/...`).
+//   - Send a test notification through every configured channel.
+//
+// The original Vue version surfaces these as tabs inside SettingsView; here
+// we co-locate them on a single admin tools page.
+export function ToolsPage() {
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center gap-3">
+        <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-violet-400/10 text-violet-400">
+          <Wrench size={20} />
+        </div>
+        <div>
+          <h1 className="font-display text-3xl font-bold text-white">运维工具</h1>
+          <p className="text-sm text-slate-400">整理媒体文件 · 测试通知渠道</p>
+        </div>
+      </div>
+
+      <OrganizePanel />
+      <NotifyPanel />
+    </div>
+  )
+}
+
+function OrganizePanel() {
+  const [libraries, setLibraries] = useState<Library[]>([])
+  const [libraryID, setLibraryID] = useState('')
+  const [running, setRunning] = useState(false)
+
+  const [query, setQuery] = useState('')
+  const [searching, setSearching] = useState(false)
+  const [results, setResults] = useState<Media[]>([])
+  const [busyID, setBusyID] = useState<string | null>(null)
+
+  useEffect(() => {
+    libraryAPI.list().then(setLibraries).catch(() => undefined)
+  }, [])
+
+  const onOrganizeLibrary = async (e: FormEvent) => {
+    e.preventDefault()
+    if (!libraryID) return
+    setRunning(true)
+    try {
+      await toolsAPI.organizeLibrary(libraryID)
+      toast.success('已触发媒体库整理')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '整理失败'
+      toast.error(msg)
+    } finally {
+      setRunning(false)
+    }
+  }
+
+  const doSearch = async (e?: FormEvent) => {
+    e?.preventDefault()
+    if (!query.trim()) return
+    setSearching(true)
+    try {
+      const r = await mediaAPI.search(query.trim(), 20)
+      setResults(r.items ?? [])
+    } catch {
+      toast.error('搜索失败')
+    } finally {
+      setSearching(false)
+    }
+  }
+
+  const onOrganizeOne = async (m: Media) => {
+    setBusyID(m.id)
+    try {
+      const r = await toolsAPI.organizeMedia(m.id)
+      toast.success(`已移动到 ${r.path}`)
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '整理失败'
+      toast.error(msg)
+    } finally {
+      setBusyID(null)
+    }
+  }
+
+  return (
+    <section className="glass-panel space-y-5">
+      <div className="flex items-center gap-2">
+        <FolderCog size={18} className="text-primary-400" />
+        <h2 className="font-display text-lg font-semibold text-white">整理 &amp; 重命名</h2>
+      </div>
+      <p className="text-xs text-slate-500">
+        将媒体文件按 <code className="rounded bg-white/5 px-1">媒体库/年份/标题 (年份)/标题.ext</code>{' '}
+        的规范布局移动并重命名,确保已先完成刮削。
+      </p>
+
+      <form onSubmit={onOrganizeLibrary} className="flex flex-wrap gap-2">
+        <select
+          required
+          className="input-base flex-1 min-w-[200px]"
+          value={libraryID}
+          onChange={(e) => setLibraryID(e.target.value)}
+        >
+          <option value="" disabled>
+            选择要整理的媒体库
+          </option>
+          {libraries.map((l) => (
+            <option key={l.id} value={l.id}>
+              {l.name} ({l.type})
+            </option>
+          ))}
+        </select>
+        <button type="submit" disabled={running || !libraryID} className="neon-button">
+          {running ? <Loader2 size={16} className="animate-spin" /> : <FolderCog size={16} />}
+          整理整个库
+        </button>
+      </form>
+
+      <div className="border-t border-white/5 pt-4">
+        <form onSubmit={doSearch} className="flex gap-2">
+          <input
+            className="input-base flex-1"
+            placeholder="或搜索单个媒体进行整理…"
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+          />
+          <button type="submit" disabled={searching} className="neon-button">
+            <Search size={16} /> {searching ? '搜索中…' : '搜索'}
+          </button>
+        </form>
+
+        {results.length > 0 && (
+          <ul className="mt-4 space-y-2">
+            {results.map((m) => (
+              <li
+                key={m.id}
+                className="flex items-center justify-between gap-3 rounded-lg border border-white/5 bg-white/5 px-3 py-2"
+              >
+                <div className="min-w-0">
+                  <div className="truncate text-sm text-white">{m.title}</div>
+                  <div className="truncate text-xs text-slate-400">{m.path}</div>
+                </div>
+                <button
+                  onClick={() => onOrganizeOne(m)}
+                  disabled={busyID === m.id}
+                  className="neon-button !px-3 !py-1 text-xs"
+                >
+                  {busyID === m.id ? (
+                    <Loader2 size={12} className="animate-spin" />
+                  ) : (
+                    <FolderCog size={12} />
+                  )}
+                  整理
+                </button>
+              </li>
+            ))}
+          </ul>
+        )}
+
+        {!searching && query && results.length === 0 && (
+          <p className="mt-3 text-sm text-slate-400">未找到匹配的媒体。</p>
+        )}
+      </div>
+    </section>
+  )
+}
+
+function NotifyPanel() {
+  const [title, setTitle] = useState('MediaStation 测试通知')
+  const [body, setBody] = useState('如果你收到这条消息,说明通知渠道工作正常。')
+  const [sending, setSending] = useState(false)
+
+  const onSend = async (e: FormEvent) => {
+    e.preventDefault()
+    if (!title.trim() || !body.trim()) return
+    setSending(true)
+    try {
+      await toolsAPI.notifyTest(title.trim(), body.trim())
+      toast.success('已派发到所有已启用通道')
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '发送失败'
+      toast.error(msg)
+    } finally {
+      setSending(false)
+    }
+  }
+
+  return (
+    <section className="glass-panel space-y-4">
+      <div className="flex items-center gap-2">
+        <Bell size={18} className="text-amber-300" />
+        <h2 className="font-display text-lg font-semibold text-white">通知渠道测试</h2>
+      </div>
+      <p className="text-xs text-slate-500">
+        会向所有已配置的通知渠道(Telegram / Bark / Webhook 等)发送一条测试消息。
+      </p>
+      <form onSubmit={onSend} className="space-y-3">
+        <Field label="标题">
+          <input
+            required
+            className="input-base"
+            value={title}
+            onChange={(e) => setTitle(e.target.value)}
+          />
+        </Field>
+        <Field label="内容">
+          <textarea
+            required
+            rows={3}
+            className="input-base resize-none"
+            value={body}
+            onChange={(e) => setBody(e.target.value)}
+          />
+        </Field>
+        <button type="submit" disabled={sending} className="neon-button">
+          {sending ? <Loader2 size={16} className="animate-spin" /> : <Bell size={16} />}
+          发送测试通知
+        </button>
+      </form>
+    </section>
+  )
+}
+
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <label className="block">
+      <span className="mb-1 block text-sm text-slate-300">{label}</span>
+      {children}
+    </label>
+  )
+}

web/src/types/index.ts

@@ -140,3 +140,85 @@ export interface StatsSnapshot {
   hardware: Hardware
   generated_at: string
 }
+
+
+// ─── Notify Channels ────────────────────────────────────────────────────────
+
+export interface NotifyChannel {
+  id: string
+  name: string
+  channel_type: 'telegram' | 'wechat' | 'bark' | 'webhook'
+  config: Record<string, string>
+  enabled: boolean
+  events: string[]
+  created_at: string
+  updated_at: string
+}
+
+// ─── Play Profiles ──────────────────────────────────────────────────────────
+
+export interface PlayProfile {
+  id: string
+  user_id: string
+  name: string
+  is_default: boolean
+  content_rating_limit?: string
+  allow_adult: boolean
+  require_pin: boolean
+  preferred_subtitle_lang?: string
+  preferred_audio_lang?: string
+  autoplay_next: boolean
+  skip_intro: boolean
+  allowed_library_ids: string[]
+  total_watch_time: number
+  last_active_at?: string
+  created_at: string
+  updated_at: string
+}
+
+// ─── History helpers ────────────────────────────────────────────────────────
+
+export interface HistoryItem {
+  id: string
+  user_id: string
+  media_id: string
+  position_ms: number
+  duration_ms: number
+  watched_at: string
+  completed: boolean
+  media?: Media
+}
+
+export interface HistoryStats {
+  total: number
+  completed: number
+  watched_ms: number
+  watched_hours: number
+  last_watched?: string
+}
+
+// ─── Discover ───────────────────────────────────────────────────────────────
+
+export interface DiscoverSection {
+  key: string
+  label: string
+}
+
+export interface DiscoverItem {
+  TMDbID?: number
+  Title?: string
+  Overview?: string
+  Rating?: number
+  Year?: number
+  PosterURL?: string
+  BackdropURL?: string
+  // Match struct (Go) is exported with capitalised JSON keys; the API
+  // returns lower-cased aliases below for convenience.
+  tmdb_id?: number
+  title?: string
+  overview?: string
+  rating?: number
+  year?: number
+  poster_url?: string
+  backdrop_url?: string
+}