camera capture wip

backend/Cargo.lock

@@ -907,7 +907,6 @@ dependencies = [
  "sysinfo",
  "tokio",
  "tokio-stream",
- "tokio-util",
  "tower",
  "tower-http",
  "tower_governor",

backend/Cargo.toml

@@ -17,7 +17,6 @@ bcrypt = "0.15"
 uuid = { version = "1", features = ["v4", "serde"] }
 chrono = { version = "0.4", features = ["serde"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
-tokio-util = { version = "0.7", features = ["io", "compat"] }
 futures = "0.3"
 sha2 = "0.10"
 rand = "0.9"

backend/src/handlers/admin.rs

@@ -1,279 +0,0 @@
-use axum::extract::State;
-use axum::http::StatusCode;
-use axum::Json;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use sysinfo::System;
-
-use crate::auth::middleware::RequireAdmin;
-use crate::error::AppError;
-use crate::state::AppState;
-
-// ── DTOs ─────────────────────────────────────────────────────────────────────
-
-#[derive(Serialize)]
-pub struct StatsDto {
-    pub user_count: i64,
-    pub upload_count: i64,
-    pub comment_count: i64,
-    pub disk_total_bytes: u64,
-    pub disk_used_bytes: u64,
-    pub disk_free_bytes: u64,
-}
-
-#[derive(Serialize, sqlx::FromRow)]
-pub struct ExportJobDto {
-    pub id: uuid::Uuid,
-    pub r#type: String,
-    pub status: String,
-    pub progress_pct: i16,
-    pub error_message: Option<String>,
-    pub created_at: chrono::DateTime<chrono::Utc>,
-    pub completed_at: Option<chrono::DateTime<chrono::Utc>>,
-}
-
-// ── Handlers ─────────────────────────────────────────────────────────────────
-
-pub async fn get_stats(
-    State(state): State<AppState>,
-    RequireAdmin(_auth): RequireAdmin,
-) -> Result<Json<StatsDto>, AppError> {
-    let event = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
-
-    let (user_count,): (i64,) =
-        sqlx::query_as("SELECT COUNT(*) FROM \"user\" WHERE event_id = $1")
-            .bind(event.id)
-            .fetch_one(&state.pool)
-            .await?;
-
-    let (upload_count,): (i64,) = sqlx::query_as(
-        "SELECT COUNT(*) FROM upload WHERE event_id = $1 AND deleted_at IS NULL",
-    )
-    .bind(event.id)
-    .fetch_one(&state.pool)
-    .await?;
-
-    let (comment_count,): (i64,) = sqlx::query_as(
-        "SELECT COUNT(*) FROM comment c
-         JOIN upload u ON u.id = c.upload_id
-         WHERE u.event_id = $1 AND c.deleted_at IS NULL",
-    )
-    .bind(event.id)
-    .fetch_one(&state.pool)
-    .await?;
-
-    // Disk usage via sysinfo
-    let mut sys = System::new();
-    sys.refresh_all();
-
-    let media_path = state.config.media_path.to_string_lossy().to_string();
-    let (disk_total, disk_free) = sysinfo::Disks::new_with_refreshed_list()
-        .iter()
-        .find(|d| media_path.starts_with(d.mount_point().to_string_lossy().as_ref()))
-        .map(|d| (d.total_space(), d.available_space()))
-        .unwrap_or_else(|| {
-            // Fall back to the root disk
-            sysinfo::Disks::new_with_refreshed_list()
-                .iter()
-                .find(|d| d.mount_point().to_string_lossy() == "/")
-                .map(|d| (d.total_space(), d.available_space()))
-                .unwrap_or((0, 0))
-        });
-
-    let disk_used = disk_total.saturating_sub(disk_free);
-
-    Ok(Json(StatsDto {
-        user_count,
-        upload_count,
-        comment_count,
-        disk_total_bytes: disk_total,
-        disk_used_bytes: disk_used,
-        disk_free_bytes: disk_free,
-    }))
-}
-
-pub async fn get_config(
-    State(state): State<AppState>,
-    RequireAdmin(_auth): RequireAdmin,
-) -> Result<Json<HashMap<String, String>>, AppError> {
-    let rows: Vec<(String, String)> =
-        sqlx::query_as("SELECT key, value FROM config ORDER BY key")
-            .fetch_all(&state.pool)
-            .await?;
-
-    Ok(Json(rows.into_iter().collect()))
-}
-
-#[derive(Deserialize)]
-pub struct PatchConfigRequest(pub HashMap<String, String>);
-
-pub async fn patch_config(
-    State(state): State<AppState>,
-    RequireAdmin(_auth): RequireAdmin,
-    Json(body): Json<HashMap<String, String>>,
-) -> Result<StatusCode, AppError> {
-    const ALLOWED_KEYS: &[&str] = &[
-        "max_image_size_mb",
-        "max_video_size_mb",
-        "upload_rate_per_hour",
-        "feed_rate_per_min",
-        "export_rate_per_day",
-        "quota_tolerance",
-        "estimated_guest_count",
-        "compression_concurrency",
-    ];
-
-    for (key, value) in &body {
-        if !ALLOWED_KEYS.contains(&key.as_str()) {
-            return Err(AppError::BadRequest(format!("Unbekannter Konfigurationsschlüssel: {key}")));
-        }
-        // Validate numeric values
-        if value.parse::<f64>().is_err() {
-            return Err(AppError::BadRequest(format!("Ungültiger Wert für {key}: muss eine Zahl sein.")));
-        }
-        sqlx::query(
-            "INSERT INTO config (key, value, updated_at) VALUES ($1, $2, NOW())
-             ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()",
-        )
-        .bind(key)
-        .bind(value)
-        .execute(&state.pool)
-        .await?;
-    }
-
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn get_export_jobs(
-    State(state): State<AppState>,
-    RequireAdmin(_auth): RequireAdmin,
-) -> Result<Json<Vec<ExportJobDto>>, AppError> {
-    let event = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
-
-    let jobs = sqlx::query_as::<_, ExportJobDto>(
-        "SELECT id, type::text, status::text, progress_pct, error_message, created_at, completed_at
-         FROM export_job
-         WHERE event_id = $1
-         ORDER BY created_at DESC",
-    )
-    .bind(event.id)
-    .fetch_all(&state.pool)
-    .await?;
-
-    Ok(Json(jobs))
-}
-
-// ── Export download endpoints (authenticated guests) ─────────────────────────
-
-pub async fn download_zip(
-    State(state): State<AppState>,
-    _auth: crate::auth::middleware::AuthUser,
-) -> Result<axum::response::Response, AppError> {
-    let event = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
-
-    if !event.export_zip_ready {
-        return Err(AppError::NotFound(
-            "Der ZIP-Export ist noch nicht verfügbar.".into(),
-        ));
-    }
-
-    let path = state.config.media_path.join("exports").join("Gallery.zip");
-    if !path.exists() {
-        return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
-    }
-
-    serve_file(path, "Gallery.zip", "application/zip").await
-}
-
-pub async fn download_html(
-    State(state): State<AppState>,
-    _auth: crate::auth::middleware::AuthUser,
-) -> Result<axum::response::Response, AppError> {
-    let event = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
-
-    if !event.export_html_ready {
-        return Err(AppError::NotFound(
-            "Der HTML-Export ist noch nicht verfügbar.".into(),
-        ));
-    }
-
-    let path = state.config.media_path.join("exports").join("Memories.zip");
-    if !path.exists() {
-        return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
-    }
-
-    serve_file(path, "Memories.zip", "application/zip").await
-}
-
-async fn serve_file(
-    path: std::path::PathBuf,
-    filename: &str,
-    content_type: &str,
-) -> Result<axum::response::Response, AppError> {
-    use axum::body::Body;
-    use axum::http::{header, Response, StatusCode};
-    use tokio_util::io::ReaderStream;
-
-    let file = tokio::fs::File::open(&path)
-        .await
-        .map_err(|e| AppError::Internal(e.into()))?;
-    let metadata = file
-        .metadata()
-        .await
-        .map_err(|e| AppError::Internal(e.into()))?;
-    let stream = ReaderStream::new(file);
-
-    let disposition = format!("attachment; filename=\"{filename}\"");
-
-    let response = Response::builder()
-        .status(StatusCode::OK)
-        .header(header::CONTENT_TYPE, content_type)
-        .header(header::CONTENT_DISPOSITION, disposition)
-        .header(header::CONTENT_LENGTH, metadata.len())
-        .body(Body::from_stream(stream))
-        .map_err(|e| AppError::Internal(e.into()))?;
-
-    Ok(response)
-}
-
-/// Also expose export status to all authenticated users (guests need it for the export page)
-pub async fn export_status(
-    State(state): State<AppState>,
-    _auth: crate::auth::middleware::AuthUser,
-) -> Result<Json<serde_json::Value>, AppError> {
-    let event = crate::models::event::Event::find_by_slug(&state.pool, &state.config.event_slug)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
-
-    let released = event.export_released_at.is_some();
-
-    let jobs: Vec<(String, String, i16)> = sqlx::query_as(
-        "SELECT type::text, status::text, progress_pct FROM export_job WHERE event_id = $1",
-    )
-    .bind(event.id)
-    .fetch_all(&state.pool)
-    .await?;
-
-    let job_status = |type_name: &str| {
-        jobs.iter()
-            .find(|(t, _, _)| t == type_name)
-            .map(|(_, status, pct)| {
-                serde_json::json!({ "status": status, "progress_pct": pct })
-            })
-            .unwrap_or_else(|| serde_json::json!({ "status": "locked", "progress_pct": 0 }))
-    };
-
-    Ok(Json(serde_json::json!({
-        "released": released,
-        "zip": job_status("zip"),
-        "html": job_status("html"),
-    })))
-}

backend/src/handlers/host.rs

@@ -1,269 +0,0 @@
-use axum::extract::{Path, State};
-use axum::http::StatusCode;
-use axum::Json;
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Serialize};
-use uuid::Uuid;
-
-use crate::auth::middleware::RequireHost;
-use crate::error::AppError;
-use crate::models::comment::Comment;
-use crate::models::event::Event;
-use crate::models::upload::Upload;
-use crate::state::AppState;
-
-// ── DTOs ─────────────────────────────────────────────────────────────────────
-
-#[derive(Serialize, sqlx::FromRow)]
-pub struct UserSummary {
-    pub id: Uuid,
-    pub display_name: String,
-    pub role: String,
-    pub is_banned: bool,
-    pub uploads_hidden: bool,
-    pub upload_count: i64,
-    pub total_upload_bytes: i64,
-    pub created_at: DateTime<Utc>,
-}
-
-#[derive(Serialize)]
-pub struct EventStatus {
-    pub name: String,
-    pub is_active: bool,
-    pub uploads_locked: bool,
-    pub export_released: bool,
-}
-
-#[derive(Deserialize)]
-pub struct BanRequest {
-    pub hide_uploads: bool,
-}
-
-#[derive(Deserialize)]
-pub struct SetRoleRequest {
-    pub role: String,
-}
-
-// ── Handlers ─────────────────────────────────────────────────────────────────
-
-pub async fn get_event_status(
-    State(state): State<AppState>,
-    RequireHost(_auth): RequireHost,
-) -> Result<Json<EventStatus>, AppError> {
-    let event = Event::find_by_slug(&state.pool, &state.config.event_slug)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
-
-    Ok(Json(EventStatus {
-        name: event.name,
-        is_active: event.is_active,
-        uploads_locked: event.uploads_locked_at.is_some(),
-        export_released: event.export_released_at.is_some(),
-    }))
-}
-
-pub async fn list_users(
-    State(state): State<AppState>,
-    RequireHost(auth): RequireHost,
-) -> Result<Json<Vec<UserSummary>>, AppError> {
-    let rows = sqlx::query_as::<_, UserSummary>(
-        "SELECT u.id,
-                u.display_name,
-                u.role::text AS role,
-                u.is_banned,
-                u.uploads_hidden,
-                COALESCE(COUNT(up.id), 0) AS upload_count,
-                u.total_upload_bytes,
-                u.created_at
-         FROM \"user\" u
-         LEFT JOIN upload up ON up.user_id = u.id AND up.deleted_at IS NULL
-         WHERE u.event_id = $1
-         GROUP BY u.id
-         ORDER BY u.created_at ASC",
-    )
-    .bind(auth.event_id)
-    .fetch_all(&state.pool)
-    .await?;
-
-    Ok(Json(rows))
-}
-
-pub async fn ban_user(
-    State(state): State<AppState>,
-    RequireHost(auth): RequireHost,
-    Path(user_id): Path<Uuid>,
-    Json(body): Json<BanRequest>,
-) -> Result<StatusCode, AppError> {
-    // Cannot ban yourself or another host/admin
-    if user_id == auth.user_id {
-        return Err(AppError::BadRequest("Du kannst dich nicht selbst sperren.".into()));
-    }
-    let target = sqlx::query_as::<_, (String,)>(
-        "SELECT role::text FROM \"user\" WHERE id = $1 AND event_id = $2",
-    )
-    .bind(user_id)
-    .bind(auth.event_id)
-    .fetch_optional(&state.pool)
-    .await?
-    .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;
-
-    if target.0 == "admin" || (target.0 == "host" && auth.role != crate::models::user::UserRole::Admin) {
-        return Err(AppError::Forbidden("Du kannst diesen Benutzer nicht sperren.".into()));
-    }
-
-    sqlx::query(
-        "UPDATE \"user\" SET is_banned = TRUE, uploads_hidden = $2 WHERE id = $1",
-    )
-    .bind(user_id)
-    .bind(body.hide_uploads)
-    .execute(&state.pool)
-    .await?;
-
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn unban_user(
-    State(state): State<AppState>,
-    RequireHost(_auth): RequireHost,
-    Path(user_id): Path<Uuid>,
-) -> Result<StatusCode, AppError> {
-    sqlx::query("UPDATE \"user\" SET is_banned = FALSE WHERE id = $1")
-        .bind(user_id)
-        .execute(&state.pool)
-        .await?;
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn set_role(
-    State(state): State<AppState>,
-    RequireHost(auth): RequireHost,
-    Path(user_id): Path<Uuid>,
-    Json(body): Json<SetRoleRequest>,
-) -> Result<StatusCode, AppError> {
-    if user_id == auth.user_id {
-        return Err(AppError::BadRequest("Du kannst deine eigene Rolle nicht ändern.".into()));
-    }
-    let new_role = match body.role.as_str() {
-        "guest" => "guest",
-        "host" => "host",
-        _ => return Err(AppError::BadRequest("Ungültige Rolle. Erlaubt: guest, host.".into())),
-    };
-    sqlx::query("UPDATE \"user\" SET role = $2::user_role WHERE id = $1 AND event_id = $3")
-        .bind(user_id)
-        .bind(new_role)
-        .bind(auth.event_id)
-        .execute(&state.pool)
-        .await?;
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn host_delete_upload(
-    State(state): State<AppState>,
-    RequireHost(_auth): RequireHost,
-    Path(upload_id): Path<Uuid>,
-) -> Result<StatusCode, AppError> {
-    let upload = Upload::find_by_id(&state.pool, upload_id)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
-
-    Upload::soft_delete(&state.pool, upload_id).await?;
-
-    let _ = state.sse_tx.send(crate::state::SseEvent {
-        event_type: "upload-deleted".to_string(),
-        data: serde_json::json!({ "upload_id": upload.id }).to_string(),
-    });
-
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn host_delete_comment(
-    State(state): State<AppState>,
-    RequireHost(_auth): RequireHost,
-    Path(comment_id): Path<Uuid>,
-) -> Result<StatusCode, AppError> {
-    Comment::find_by_id(&state.pool, comment_id)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Kommentar nicht gefunden.".into()))?;
-
-    Comment::soft_delete(&state.pool, comment_id).await?;
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn close_event(
-    State(state): State<AppState>,
-    RequireHost(_auth): RequireHost,
-) -> Result<StatusCode, AppError> {
-    sqlx::query(
-        "UPDATE event SET uploads_locked_at = NOW() WHERE slug = $1 AND uploads_locked_at IS NULL",
-    )
-    .bind(&state.config.event_slug)
-    .execute(&state.pool)
-    .await?;
-
-    let _ = state.sse_tx.send(crate::state::SseEvent {
-        event_type: "event-closed".to_string(),
-        data: "{}".to_string(),
-    });
-
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn open_event(
-    State(state): State<AppState>,
-    RequireHost(_auth): RequireHost,
-) -> Result<StatusCode, AppError> {
-    sqlx::query(
-        "UPDATE event SET uploads_locked_at = NULL WHERE slug = $1",
-    )
-    .bind(&state.config.event_slug)
-    .execute(&state.pool)
-    .await?;
-
-    let _ = state.sse_tx.send(crate::state::SseEvent {
-        event_type: "event-opened".to_string(),
-        data: "{}".to_string(),
-    });
-
-    Ok(StatusCode::NO_CONTENT)
-}
-
-pub async fn release_gallery(
-    State(state): State<AppState>,
-    RequireHost(_auth): RequireHost,
-) -> Result<StatusCode, AppError> {
-    let event = Event::find_by_slug(&state.pool, &state.config.event_slug)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
-
-    if event.export_released_at.is_some() {
-        return Err(AppError::BadRequest("Galerie wurde bereits freigegeben.".into()));
-    }
-
-    sqlx::query("UPDATE event SET export_released_at = NOW() WHERE slug = $1")
-        .bind(&state.config.event_slug)
-        .execute(&state.pool)
-        .await?;
-
-    // Enqueue export jobs
-    for export_type in ["zip", "html"] {
-        sqlx::query(
-            "INSERT INTO export_job (event_id, type) VALUES ($1, $2::export_type)
-             ON CONFLICT (event_id, type) DO NOTHING",
-        )
-        .bind(event.id)
-        .bind(export_type)
-        .execute(&state.pool)
-        .await?;
-    }
-
-    // Spawn export workers
-    crate::services::export::spawn_export_jobs(
-        event.id,
-        event.name,
-        state.pool.clone(),
-        state.config.media_path.clone(),
-        state.sse_tx.clone(),
-    );
-
-    Ok(StatusCode::NO_CONTENT)
-}

backend/src/handlers/mod.rs

@@ -1,6 +1,4 @@
-pub mod admin;
 pub mod feed;
-pub mod host;
 pub mod social;
 pub mod sse;
 pub mod upload;

backend/src/main.rs

@@ -58,29 +58,7 @@ async fn main() -> Result<()> {
         )
         .route("/api/v1/comment/{id}", delete(handlers::social::delete_comment))
         // SSE
-        .route("/api/v1/stream", get(handlers::sse::stream))
+        .route("/api/v1/stream", get(handlers::sse::stream));
-        // Host Dashboard
-        .route("/api/v1/host/event", get(handlers::host::get_event_status))
-        .route("/api/v1/host/event/close", post(handlers::host::close_event))
-        .route("/api/v1/host/event/open", post(handlers::host::open_event))
-        .route("/api/v1/host/gallery/release", post(handlers::host::release_gallery))
-        .route("/api/v1/host/users", get(handlers::host::list_users))
-        .route("/api/v1/host/users/{id}/ban", post(handlers::host::ban_user))
-        .route("/api/v1/host/users/{id}/unban", post(handlers::host::unban_user))
-        .route("/api/v1/host/users/{id}/role", patch(handlers::host::set_role))
-        .route("/api/v1/host/upload/{id}", delete(handlers::host::host_delete_upload))
-        .route("/api/v1/host/comment/{id}", delete(handlers::host::host_delete_comment))
-        // Export (all authenticated users)
-        .route("/api/v1/export/status", get(handlers::admin::export_status))
-        .route("/api/v1/export/zip", get(handlers::admin::download_zip))
-        .route("/api/v1/export/html", get(handlers::admin::download_html))
-        // Admin Dashboard
-        .route("/api/v1/admin/stats", get(handlers::admin::get_stats))
-        .route(
-            "/api/v1/admin/config",
-            get(handlers::admin::get_config).patch(handlers::admin::patch_config),
-        )
-        .route("/api/v1/admin/export/jobs", get(handlers::admin::get_export_jobs));
 
     // Serve media files from disk
     let media_service = ServeDir::new(&config.media_path);

backend/src/services/export.rs

@@ -1,569 +0,0 @@
-use std::path::{Path, PathBuf};
-
-use anyhow::{Context, Result};
-use async_zip::tokio::write::ZipFileWriter;
-use async_zip::{Compression, ZipEntryBuilder};
-use chrono::{DateTime, Utc};
-use futures::io::{copy as fcopy, AllowStdIo};
-use serde::Serialize;
-use sqlx::PgPool;
-use tokio::sync::broadcast;
-use tokio_util::compat::TokioAsyncReadCompatExt;
-use uuid::Uuid;
-
-use crate::state::SseEvent;
-
-// ── DB query rows ────────────────────────────────────────────────────────────
-
-#[derive(sqlx::FromRow)]
-struct ExportUploadRow {
-    id: Uuid,
-    original_path: String,
-    mime_type: String,
-    caption: Option<String>,
-    uploader_name: String,
-    like_count: i64,
-    created_at: DateTime<Utc>,
-}
-
-#[derive(sqlx::FromRow)]
-struct ExportCommentRow {
-    upload_id: Uuid,
-    uploader_name: String,
-    body: String,
-    created_at: DateTime<Utc>,
-}
-
-// ── Template context structs ─────────────────────────────────────────────────
-
-#[derive(Serialize)]
-struct TmplComment {
-    uploader_name: String,
-    body: String,
-    created_at: String,
-}
-
-#[derive(Serialize)]
-struct TmplUpload {
-    id: String,
-    path: String,
-    is_video: bool,
-    caption: String,
-    uploader_name: String,
-    like_count: i64,
-    created_at: String,
-    comments: Vec<TmplComment>,
-    hashtags: Vec<String>,
-}
-
-// ── Entry point ──────────────────────────────────────────────────────────────
-
-pub fn spawn_export_jobs(
-    event_id: Uuid,
-    event_name: String,
-    pool: PgPool,
-    media_path: PathBuf,
-    sse_tx: broadcast::Sender<SseEvent>,
-) {
-    let pool2 = pool.clone();
-    let media_path2 = media_path.clone();
-    let sse_tx2 = sse_tx.clone();
-    let event_name2 = event_name.clone();
-
-    tokio::spawn(async move {
-        if let Err(e) = run_zip_export(event_id, &pool, &media_path, &sse_tx).await {
-            tracing::error!("ZIP export failed for event {event_id}: {e:#}");
-            mark_failed(&pool, event_id, "zip", &e.to_string()).await;
-        }
-        maybe_broadcast_complete(&pool, event_id, &sse_tx).await;
-    });
-
-    tokio::spawn(async move {
-        if let Err(e) =
-            run_html_export(event_id, &event_name2, &pool2, &media_path2, &sse_tx2).await
-        {
-            tracing::error!("HTML export failed for event {event_id}: {e:#}");
-            mark_failed(&pool2, event_id, "html", &e.to_string()).await;
-        }
-        maybe_broadcast_complete(&pool2, event_id, &sse_tx2).await;
-    });
-}
-
-// ── ZIP export ───────────────────────────────────────────────────────────────
-
-async fn run_zip_export(
-    event_id: Uuid,
-    pool: &PgPool,
-    media_path: &Path,
-    sse_tx: &broadcast::Sender<SseEvent>,
-) -> Result<()> {
-    mark_running(pool, event_id, "zip").await;
-
-    let uploads = query_uploads(pool, event_id).await?;
-    let total = uploads.len().max(1) as f32;
-
-    let exports_dir = media_path.join("exports");
-    tokio::fs::create_dir_all(&exports_dir).await?;
-
-    let tmp_path = exports_dir.join("Gallery.zip.tmp");
-    let out_path = exports_dir.join("Gallery.zip");
-
-    {
-        let file = tokio::fs::File::create(&tmp_path).await?;
-        let mut zip = ZipFileWriter::with_tokio(file);
-
-        for (i, row) in uploads.iter().enumerate() {
-            let src = media_path.join(&row.original_path);
-            if !src.exists() {
-                continue;
-            }
-            let ext = ext_from_path(&row.original_path);
-            let date = row.created_at.format("%Y-%m-%d_%H-%M").to_string();
-            let name_safe = sanitize_name(&row.uploader_name);
-            let folder = if row.mime_type.starts_with("video/") { "Videos" } else { "Photos" };
-            let entry_name = format!("{folder}/{date}_{name_safe}_{}.{ext}", row.id);
-
-            let builder = ZipEntryBuilder::new(entry_name.into(), Compression::Stored);
-            let mut entry = zip.write_entry_stream(builder).await?;
-
-            let mut f = tokio::fs::File::open(&src).await?.compat();
-            fcopy(&mut f, &mut entry).await?;
-            entry.close().await?;
-
-            let pct = ((i + 1) as f32 / total * 100.0) as i16;
-            update_progress(pool, event_id, "zip", pct.min(99)).await;
-        }
-
-        zip.close().await?;
-    }
-
-    tokio::fs::rename(&tmp_path, &out_path).await?;
-
-    sqlx::query(
-        "UPDATE export_job SET status = 'done', progress_pct = 100, file_path = $2, completed_at = NOW()
-         WHERE event_id = $1 AND type = 'zip'::export_type",
-    )
-    .bind(event_id)
-    .bind("exports/Gallery.zip")
-    .execute(pool)
-    .await?;
-
-    sqlx::query("UPDATE event SET export_zip_ready = TRUE WHERE id = $1")
-        .bind(event_id)
-        .execute(pool)
-        .await?;
-
-    let _ = sse_tx.send(SseEvent {
-        event_type: "export-progress".to_string(),
-        data: serde_json::json!({ "type": "zip", "progress_pct": 100 }).to_string(),
-    });
-
-    tracing::info!("ZIP export complete for event {event_id}");
-    Ok(())
-}
-
-// ── HTML export ──────────────────────────────────────────────────────────────
-
-async fn run_html_export(
-    event_id: Uuid,
-    event_name: &str,
-    pool: &PgPool,
-    media_path: &Path,
-    sse_tx: &broadcast::Sender<SseEvent>,
-) -> Result<()> {
-    mark_running(pool, event_id, "html").await;
-
-    let uploads = query_uploads(pool, event_id).await?;
-    let comments = query_comments(pool, event_id).await?;
-    let hashtags_per_upload = query_hashtags(pool, event_id).await?;
-    let total = uploads.len().max(1) as f32;
-
-    let exports_dir = media_path.join("exports");
-    tokio::fs::create_dir_all(&exports_dir).await?;
-
-    // Build template context
-    let mut tmpl_uploads: Vec<TmplUpload> = Vec::new();
-    for (i, row) in uploads.iter().enumerate() {
-        let ext = ext_from_path(&row.original_path);
-        let date_str = row.created_at.format("%Y-%m-%d_%H-%M").to_string();
-        let name_safe = sanitize_name(&row.uploader_name);
-        let folder = if row.mime_type.starts_with("video/") { "Videos" } else { "Photos" };
-        let filename = format!("{date_str}_{name_safe}_{}.{ext}", row.id);
-
-        let upload_comments: Vec<TmplComment> = comments
-            .iter()
-            .filter(|c| c.upload_id == row.id)
-            .map(|c| TmplComment {
-                uploader_name: c.uploader_name.clone(),
-                body: c.body.clone(),
-                created_at: c.created_at.format("%d.%m.%Y %H:%M").to_string(),
-            })
-            .collect();
-
-        let tags: Vec<String> = hashtags_per_upload
-            .iter()
-            .filter(|(uid, _)| *uid == row.id)
-            .map(|(_, tag)| tag.clone())
-            .collect();
-
-        tmpl_uploads.push(TmplUpload {
-            id: row.id.to_string(),
-            path: format!("{folder}/{filename}"),
-            is_video: row.mime_type.starts_with("video/"),
-            caption: row.caption.clone().unwrap_or_default(),
-            uploader_name: row.uploader_name.clone(),
-            like_count: row.like_count,
-            created_at: row.created_at.format("%d.%m.%Y %H:%M").to_string(),
-            comments: upload_comments,
-            hashtags: tags,
-        });
-
-        let pct = ((i + 1) as f32 / total * 50.0) as i16;
-        update_progress(pool, event_id, "html", pct.min(49)).await;
-    }
-
-    // Render HTML
-    let mut env = minijinja::Environment::new();
-    env.add_template("memories", MEMORIES_TEMPLATE)
-        .context("template compile error")?;
-    let tmpl = env.get_template("memories").unwrap();
-    let html = tmpl
-        .render(minijinja::context!(
-            event_name => event_name,
-            uploads => minijinja::Value::from_serialize(&tmpl_uploads),
-            generated_at => Utc::now().format("%d.%m.%Y").to_string(),
-        ))
-        .context("template render error")?;
-
-    update_progress(pool, event_id, "html", 55).await;
-
-    let tmp_path = exports_dir.join("Memories.zip.tmp");
-    let out_path = exports_dir.join("Memories.zip");
-
-    {
-        let file = tokio::fs::File::create(&tmp_path).await?;
-        let mut zip = ZipFileWriter::with_tokio(file);
-
-        // Memories.html
-        {
-            let builder =
-                ZipEntryBuilder::new("Memories/Memories.html".into(), Compression::Deflate);
-            let mut entry = zip.write_entry_stream(builder).await?;
-            let mut cursor = AllowStdIo::new(std::io::Cursor::new(html.as_bytes()));
-            fcopy(&mut cursor, &mut entry).await?;
-            entry.close().await?;
-        }
-
-        update_progress(pool, event_id, "html", 60).await;
-
-        // README.txt
-        {
-            let builder =
-                ZipEntryBuilder::new("Memories/README.txt".into(), Compression::Deflate);
-            let mut entry = zip.write_entry_stream(builder).await?;
-            let mut cursor = AllowStdIo::new(std::io::Cursor::new(README_TEXT.as_bytes()));
-            fcopy(&mut cursor, &mut entry).await?;
-            entry.close().await?;
-        }
-
-        // Media files
-        for (i, row) in uploads.iter().enumerate() {
-            let src = media_path.join(&row.original_path);
-            if !src.exists() {
-                continue;
-            }
-            let ext = ext_from_path(&row.original_path);
-            let date_str = row.created_at.format("%Y-%m-%d_%H-%M").to_string();
-            let name_safe = sanitize_name(&row.uploader_name);
-            let folder = if row.mime_type.starts_with("video/") { "Videos" } else { "Photos" };
-            let filename = format!("{date_str}_{name_safe}_{}.{ext}", row.id);
-            let entry_name = format!("Memories/{folder}/{filename}");
-
-            let builder = ZipEntryBuilder::new(entry_name.into(), Compression::Stored);
-            let mut entry = zip.write_entry_stream(builder).await?;
-            let mut f = tokio::fs::File::open(&src).await?.compat();
-            fcopy(&mut f, &mut entry).await?;
-            entry.close().await?;
-
-            let pct = 60 + ((i + 1) as f32 / total * 39.0) as i16;
-            update_progress(pool, event_id, "html", pct.min(99)).await;
-        }
-
-        zip.close().await?;
-    }
-
-    tokio::fs::rename(&tmp_path, &out_path).await?;
-
-    sqlx::query(
-        "UPDATE export_job SET status = 'done', progress_pct = 100, file_path = $2, completed_at = NOW()
-         WHERE event_id = $1 AND type = 'html'::export_type",
-    )
-    .bind(event_id)
-    .bind("exports/Memories.zip")
-    .execute(pool)
-    .await?;
-
-    sqlx::query("UPDATE event SET export_html_ready = TRUE WHERE id = $1")
-        .bind(event_id)
-        .execute(pool)
-        .await?;
-
-    let _ = sse_tx.send(SseEvent {
-        event_type: "export-progress".to_string(),
-        data: serde_json::json!({ "type": "html", "progress_pct": 100 }).to_string(),
-    });
-
-    tracing::info!("HTML export complete for event {event_id}");
-    Ok(())
-}
-
-// ── DB helpers ───────────────────────────────────────────────────────────────
-
-async fn query_uploads(pool: &PgPool, event_id: Uuid) -> Result<Vec<ExportUploadRow>> {
-    Ok(sqlx::query_as::<_, ExportUploadRow>(
-        "SELECT u.id, u.original_path, u.mime_type, u.caption,
-                usr.display_name AS uploader_name,
-                COUNT(DISTINCT l.user_id) AS like_count,
-                u.created_at
-         FROM upload u
-         JOIN \"user\" usr ON usr.id = u.user_id
-         LEFT JOIN \"like\" l ON l.upload_id = u.id
-         WHERE u.event_id = $1 AND u.deleted_at IS NULL AND usr.uploads_hidden = FALSE
-         GROUP BY u.id, usr.display_name
-         ORDER BY u.created_at ASC",
-    )
-    .bind(event_id)
-    .fetch_all(pool)
-    .await?)
-}
-
-async fn query_comments(pool: &PgPool, event_id: Uuid) -> Result<Vec<ExportCommentRow>> {
-    Ok(sqlx::query_as::<_, ExportCommentRow>(
-        "SELECT c.upload_id, usr.display_name AS uploader_name, c.body, c.created_at
-         FROM comment c
-         JOIN \"user\" usr ON usr.id = c.user_id
-         JOIN upload u ON u.id = c.upload_id
-         WHERE u.event_id = $1 AND c.deleted_at IS NULL AND u.deleted_at IS NULL
-         ORDER BY c.created_at ASC",
-    )
-    .bind(event_id)
-    .fetch_all(pool)
-    .await?)
-}
-
-async fn query_hashtags(pool: &PgPool, event_id: Uuid) -> Result<Vec<(Uuid, String)>> {
-    let rows: Vec<(Uuid, String)> = sqlx::query_as(
-        "SELECT uh.upload_id, h.tag
-         FROM upload_hashtag uh
-         JOIN hashtag h ON h.id = uh.hashtag_id
-         JOIN upload u ON u.id = uh.upload_id
-         WHERE h.event_id = $1 AND u.deleted_at IS NULL",
-    )
-    .bind(event_id)
-    .fetch_all(pool)
-    .await?;
-    Ok(rows)
-}
-
-async fn mark_running(pool: &PgPool, event_id: Uuid, export_type: &str) {
-    let _ = sqlx::query(
-        "UPDATE export_job SET status = 'running' WHERE event_id = $1 AND type = $2::export_type",
-    )
-    .bind(event_id)
-    .bind(export_type)
-    .execute(pool)
-    .await;
-}
-
-async fn mark_failed(pool: &PgPool, event_id: Uuid, export_type: &str, msg: &str) {
-    let _ = sqlx::query(
-        "UPDATE export_job SET status = 'failed', error_message = $3
-         WHERE event_id = $1 AND type = $2::export_type",
-    )
-    .bind(event_id)
-    .bind(export_type)
-    .bind(msg)
-    .execute(pool)
-    .await;
-}
-
-async fn update_progress(pool: &PgPool, event_id: Uuid, export_type: &str, pct: i16) {
-    let _ = sqlx::query(
-        "UPDATE export_job SET progress_pct = $3 WHERE event_id = $1 AND type = $2::export_type",
-    )
-    .bind(event_id)
-    .bind(export_type)
-    .bind(pct)
-    .execute(pool)
-    .await;
-}
-
-async fn maybe_broadcast_complete(
-    pool: &PgPool,
-    event_id: Uuid,
-    sse_tx: &broadcast::Sender<SseEvent>,
-) {
-    let row: Option<(bool, bool)> = sqlx::query_as(
-        "SELECT export_zip_ready, export_html_ready FROM event WHERE id = $1",
-    )
-    .bind(event_id)
-    .fetch_optional(pool)
-    .await
-    .unwrap_or(None);
-
-    if let Some((zip_ready, html_ready)) = row {
-        if zip_ready && html_ready {
-            let _ = sse_tx.send(SseEvent {
-                event_type: "export-available".to_string(),
-                data: serde_json::json!({ "types": ["zip", "html"] }).to_string(),
-            });
-        }
-    }
-}
-
-fn ext_from_path(path: &str) -> &str {
-    path.rsplit('.').next().unwrap_or("bin")
-}
-
-fn sanitize_name(name: &str) -> String {
-    name.chars()
-        .map(|c| if c.is_alphanumeric() || c == '-' { c } else { '_' })
-        .collect()
-}
-
-// ── Static content ───────────────────────────────────────────────────────────
-
-const README_TEXT: &str = "Willkommen in der Event-Galerie!\n\
-\n\
-So geht's:\n\
-1. Entpacke diese ZIP-Datei\n\
-   (Windows: Rechtsklick > \"Alle extrahieren\"; Mac: Doppelklick;\n\
-    Handy: Dateimanager-App verwenden).\n\
-2. Öffne die Datei \"Memories.html\" in deinem Browser\n\
-   (z. B. Chrome, Safari oder Firefox).\n\
-3. Stöbere durch alle Fotos und Videos.\n\
-   Du kannst nach Hashtags filtern — klicke einfach auf einen Hashtag.\n\
-4. Eine Internetverbindung ist nicht nötig.\n\
-   Alles ist lokal auf deinem Gerät gespeichert.\n\
-\n\
-Viel Freude mit den Erinnerungen!\n";
-
-const MEMORIES_TEMPLATE: &str = r#"<!DOCTYPE html>
-<html lang="de">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>{{ event_name }} – Erinnerungen</title>
-<style>
-*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
-body{font-family:Georgia,serif;background:#faf7f2;color:#3d2b1f;min-height:100vh}
-header{background:#fff8f0;border-bottom:1px solid #e8d9c8;padding:1.5rem 1rem;text-align:center}
-header h1{font-size:1.75rem;font-weight:700;color:#5c3317;letter-spacing:.02em}
-header p{font-size:.85rem;color:#9a7060;margin-top:.25rem}
-.chips{display:flex;flex-wrap:wrap;gap:.5rem;padding:1rem;justify-content:center;border-bottom:1px solid #e8d9c8;background:#fff8f0}
-.chip{cursor:pointer;padding:.3rem .8rem;border-radius:999px;border:1px solid #c8a98a;font-size:.8rem;color:#6b4c36;background:#fff;transition:all .15s}
-.chip:hover,.chip.active{background:#c8a98a;color:#fff;border-color:#c8a98a}
-.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:1rem;padding:1.25rem;max-width:1100px;margin:0 auto}
-.card{background:#fff;border-radius:.75rem;overflow:hidden;box-shadow:0 1px 4px rgba(0,0,0,.08);cursor:pointer;transition:transform .15s,box-shadow .15s}
-.card:hover{transform:translateY(-2px);box-shadow:0 4px 16px rgba(0,0,0,.12)}
-.card.hidden{display:none}
-.thumb-wrap{position:relative;width:100%;aspect-ratio:1;overflow:hidden;background:#e8d9c8}
-.thumb{width:100%;height:100%;object-fit:cover;display:block}
-.vid-icon{position:absolute;inset:0;display:flex;align-items:center;justify-content:center;font-size:2.5rem;pointer-events:none}
-.card-info{padding:.6rem .75rem}
-.card-uploader{font-size:.75rem;color:#9a7060;margin-bottom:.2rem}
-.card-caption{font-size:.85rem;color:#3d2b1f;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}
-.card-meta{display:flex;align-items:center;gap:.5rem;margin-top:.4rem;font-size:.75rem;color:#b08060}
-.lb{display:none;position:fixed;inset:0;z-index:100;background:rgba(0,0,0,.88);overflow-y:auto}
-.lb.open{display:flex;flex-direction:column}
-.lb-close{position:fixed;top:.75rem;right:1rem;font-size:1.75rem;color:#fff;cursor:pointer;z-index:101;line-height:1}
-.lb-close:hover{color:#e8c89a}
-.lb-media{max-width:900px;width:100%;margin:3rem auto 0;padding:0 .5rem}
-.lb-media img,.lb-media video{width:100%;border-radius:.5rem;max-height:70vh;object-fit:contain;background:#1a1a1a;display:block}
-.lb-details{max-width:900px;width:100%;margin:1rem auto 2rem;padding:0 1rem}
-.lb-caption{font-size:1rem;color:#fff;margin-bottom:.5rem}
-.lb-meta{font-size:.8rem;color:#b08060;margin-bottom:.75rem}
-.lb-tags{display:flex;flex-wrap:wrap;gap:.4rem;margin-bottom:1rem}
-.lb-tag{font-size:.75rem;color:#e8c89a;background:rgba(255,255,255,.1);padding:.2rem .6rem;border-radius:999px}
-.lb-likes{font-size:.85rem;color:#d4a574;margin-bottom:.75rem}
-.lb-comments h3{font-size:.9rem;color:#e8d9c8;margin-bottom:.5rem;font-weight:600}
-.comment{border-top:1px solid rgba(255,255,255,.1);padding:.5rem 0}
-.comment-name{font-size:.75rem;color:#b08060}
-.comment-body{font-size:.85rem;color:#e8d9c8;margin-top:.15rem}
-.empty{text-align:center;padding:3rem 1rem;color:#b08060;font-size:.95rem}
-footer{text-align:center;padding:1.5rem;font-size:.75rem;color:#b08060;border-top:1px solid #e8d9c8;margin-top:2rem}
-</style>
-</head>
-<body>
-<header>
-  <h1>{{ event_name }}</h1>
-  <p>Erinnerungen · Erstellt am {{ generated_at }}</p>
-</header>
-{% set ns = namespace(all_tags=[]) %}
-{% for u in uploads %}{% for t in u.hashtags %}{% if t not in ns.all_tags %}{% set ns.all_tags = ns.all_tags + [t] %}{% endif %}{% endfor %}{% endfor %}
-{% if ns.all_tags %}
-<div class="chips" id="chips">
-  <span class="chip active" data-tag="">Alle</span>
-  {% for tag in ns.all_tags %}<span class="chip" data-tag="{{ tag }}">#{{ tag }}</span>{% endfor %}
-</div>
-{% endif %}
-{% if uploads %}
-<div class="grid" id="grid">
-  {% for u in uploads %}
-  <div class="card" data-tags="{{ u.hashtags | join(',') }}" onclick="openLb({{ loop.index0 }})">
-    <div class="thumb-wrap">
-      {% if u.is_video %}
-      <video class="thumb" src="{{ u.path }}" preload="none"></video>
-      <div class="vid-icon">▶</div>
-      {% else %}
-      <img class="thumb" src="{{ u.path }}" alt="" loading="lazy">
-      {% endif %}
-    </div>
-    <div class="card-info">
-      <div class="card-uploader">{{ u.uploader_name }} · {{ u.created_at }}</div>
-      {% if u.caption %}<div class="card-caption">{{ u.caption }}</div>{% endif %}
-      <div class="card-meta">
-        <span>♡ {{ u.like_count }}</span>
-        {% if u.comments %}<span>💬 {{ u.comments | length }}</span>{% endif %}
-      </div>
-    </div>
-  </div>
-  {% endfor %}
-</div>
-{% else %}
-<div class="empty">Noch keine Fotos vorhanden.</div>
-{% endif %}
-<div class="lb" id="lb">
-  <span class="lb-close" onclick="closeLb()">×</span>
-  <div class="lb-media" id="lb-media"></div>
-  <div class="lb-details" id="lb-details"></div>
-</div>
-<footer>{{ event_name }} · Offline-Galerie · EventSnap</footer>
-<script>
-const uploads = {{ uploads | tojson }};
-let activeTag = '';
-function filterCards(){document.querySelectorAll('#grid .card').forEach((card,i)=>{const tags=(card.dataset.tags||'').split(',').filter(Boolean);card.classList.toggle('hidden',activeTag!==''&&!tags.includes(activeTag));});}
-document.querySelectorAll('#chips .chip').forEach(chip=>{chip.addEventListener('click',()=>{document.querySelectorAll('#chips .chip').forEach(c=>c.classList.remove('active'));chip.classList.add('active');activeTag=chip.dataset.tag;filterCards();});});
-function esc(s){return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');}
-function openLb(idx){
-  const u=uploads[idx];
-  const lb=document.getElementById('lb');
-  const media=document.getElementById('lb-media');
-  const details=document.getElementById('lb-details');
-  if(u.is_video){media.innerHTML=`<video src="${esc(u.path)}" controls autoplay playsinline></video>`;}
-  else{media.innerHTML=`<img src="${esc(u.path)}" alt="${esc(u.caption)}">`;}
-  const tags=u.hashtags.map(t=>`<span class="lb-tag">#${esc(t)}</span>`).join('');
-  const comments=u.comments.map(c=>`<div class="comment"><div class="comment-name">${esc(c.uploader_name)} · ${esc(c.created_at)}</div><div class="comment-body">${esc(c.body)}</div></div>`).join('');
-  details.innerHTML=(u.caption?`<div class="lb-caption">${esc(u.caption)}</div>`:'')+
-    `<div class="lb-meta">${esc(u.uploader_name)} · ${esc(u.created_at)}</div>`+
-    (tags?`<div class="lb-tags">${tags}</div>`:'')+
-    `<div class="lb-likes">♡ ${u.like_count} Likes</div>`+
-    (u.comments.length?`<div class="lb-comments"><h3>Kommentare (${u.comments.length})</h3>${comments}</div>`:'');
-  lb.classList.add('open');document.body.style.overflow='hidden';
-}
-function closeLb(){document.getElementById('lb').classList.remove('open');document.getElementById('lb-media').innerHTML='';document.body.style.overflow='';}
-document.getElementById('lb').addEventListener('click',e=>{if(e.target===e.currentTarget)closeLb();});
-document.addEventListener('keydown',e=>{if(e.key==='Escape')closeLb();});
-</script>
-</body>
-</html>"#;

backend/src/services/mod.rs

@@ -1,2 +1 @@
 pub mod compression;
-pub mod export;

frontend/package-lock.json

@@ -1029,7 +1029,6 @@
 			"integrity": "sha512-MdFRjevVxmAknf2NbaUkDF16jSIzXMWd4Nfah0Qp8TtQVoSp3bV4jKt8mX7z7qTUTWvgSaxtR0EG5WJf53gcuA==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"@standard-schema/spec": "^1.0.0",
 				"@sveltejs/acorn-typescript": "^1.0.5",
@@ -1072,7 +1071,6 @@
 			"integrity": "sha512-ou/d51QSdTyN26D7h6dSpusAKaZkAiGM55/AKYi+9AGZw7q85hElbjK3kEyzXHhLSnRISHOYzVge6x0jRZ7DXA==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"@sveltejs/vite-plugin-svelte-inspector": "^5.0.0",
 				"deepmerge": "^4.3.1",
@@ -1446,7 +1444,6 @@
 			"integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"bin": {
 				"acorn": "bin/acorn"
 			},
@@ -2384,7 +2381,6 @@
 			"integrity": "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"@types/estree": "1.0.8"
 			},
@@ -2520,7 +2516,6 @@
 			"integrity": "sha512-QjvU7EFemf6mRzdMGlAFttMWtAAVXrax61SZYHdkD6yoVGQ89VeyKfZD4H1JrV1WLmJBxWhFch9H6ig/87VGjw==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"@jridgewell/remapping": "^2.3.4",
 				"@jridgewell/sourcemap-codec": "^1.5.0",
@@ -2621,7 +2616,6 @@
 			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
 			"dev": true,
 			"license": "Apache-2.0",
-			"peer": true,
 			"bin": {
 				"tsc": "bin/tsc",
 				"tsserver": "bin/tsserver"
@@ -2643,7 +2637,6 @@
 			"integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
 			"dev": true,
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"esbuild": "^0.27.0",
 				"fdir": "^6.5.0",

frontend/src/lib/auth.ts

@@ -38,17 +38,6 @@ export function clearAuth(): void {
 	isAuthenticated.set(false);
 }
 
-export function getRole(): 'guest' | 'host' | 'admin' | null {
-	const token = getToken();
-	if (!token) return null;
-	try {
-		const payload = JSON.parse(atob(token.split('.')[1]));
-		return payload.role ?? null;
-	} catch {
-		return null;
-	}
-}
-
 export function initAuth(): void {
 	if (!browser) return;
 	isAuthenticated.set(!!getToken());

frontend/src/lib/components/CameraCapture.svelte

@@ -8,8 +8,8 @@
 
 	let { oncapture, onclose }: Props = $props();
 
-	let videoEl: HTMLVideoElement = $state()!;
+	let videoEl: HTMLVideoElement;
-	let canvasEl: HTMLCanvasElement = $state()!;
+	let canvasEl: HTMLCanvasElement;
 	let stream: MediaStream | null = $state(null);
 	let facingMode = $state<'environment' | 'user'>('environment');
 	let recording = $state(false);

frontend/src/routes/admin/+page.svelte

@@ -1,266 +0,0 @@
-<script lang="ts">
-	import { goto } from '$app/navigation';
-	import { getToken, getRole } from '$lib/auth';
-	import { api } from '$lib/api';
-	import { onMount } from 'svelte';
-
-	interface StatsDto {
-		user_count: number;
-		upload_count: number;
-		comment_count: number;
-		disk_total_bytes: number;
-		disk_used_bytes: number;
-		disk_free_bytes: number;
-	}
-
-	interface ExportJob {
-		id: string;
-		type: string;
-		status: string;
-		progress_pct: number;
-		error_message: string | null;
-		created_at: string;
-		completed_at: string | null;
-	}
-
-	const CONFIG_LABELS: Record<string, string> = {
-		max_image_size_mb: 'Max. Bildgröße (MB)',
-		max_video_size_mb: 'Max. Videogröße (MB)',
-		upload_rate_per_hour: 'Upload-Limit pro Stunde',
-		feed_rate_per_min: 'Feed-Anfragen pro Minute',
-		export_rate_per_day: 'Export-Downloads pro Tag',
-		quota_tolerance: 'Speicherkontingent-Toleranz (0–1)',
-		estimated_guest_count: 'Geschätzte Gästezahl',
-		compression_concurrency: 'Kompressions-Worker'
-	};
-
-	let stats = $state<StatsDto | null>(null);
-	let config = $state<Record<string, string>>({});
-	let configDraft = $state<Record<string, string>>({});
-	let exportJobs = $state<ExportJob[]>([]);
-	let loading = $state(true);
-	let saving = $state(false);
-	let error = $state<string | null>(null);
-	let toast = $state<string | null>(null);
-
-	onMount(async () => {
-		const token = getToken();
-		const role = getRole();
-		if (!token || role !== 'admin') {
-			goto('/join');
-			return;
-		}
-		await reload();
-	});
-
-	async function reload() {
-		loading = true;
-		error = null;
-		try {
-			[stats, config, exportJobs] = await Promise.all([
-				api.get<StatsDto>('/admin/stats'),
-				api.get<Record<string, string>>('/admin/config'),
-				api.get<ExportJob[]>('/admin/export/jobs')
-			]);
-			configDraft = { ...config };
-		} catch (e: unknown) {
-			error = e instanceof Error ? e.message : 'Fehler beim Laden.';
-		} finally {
-			loading = false;
-		}
-	}
-
-	function showToast(msg: string) {
-		toast = msg;
-		setTimeout(() => (toast = null), 3000);
-	}
-
-	async function saveConfig() {
-		saving = true;
-		try {
-			// Only send changed values
-			const changes: Record<string, string> = {};
-			for (const key of Object.keys(configDraft)) {
-				if (configDraft[key] !== config[key]) {
-					changes[key] = configDraft[key];
-				}
-			}
-			if (Object.keys(changes).length === 0) {
-				showToast('Keine Änderungen.');
-				return;
-			}
-			await api.patch('/admin/config', changes);
-			config = { ...configDraft };
-			showToast('Konfiguration gespeichert.');
-		} catch (e: unknown) {
-			showToast(e instanceof Error ? e.message : 'Fehler beim Speichern.');
-		} finally {
-			saving = false;
-		}
-	}
-
-	function formatBytes(bytes: number): string {
-		if (bytes >= 1024 ** 3) return `${(bytes / 1024 ** 3).toFixed(1)} GB`;
-		if (bytes >= 1024 ** 2) return `${(bytes / 1024 ** 2).toFixed(1)} MB`;
-		return `${(bytes / 1024).toFixed(1)} KB`;
-	}
-
-	function diskPct(stats: StatsDto): number {
-		if (stats.disk_total_bytes === 0) return 0;
-		return Math.round((stats.disk_used_bytes / stats.disk_total_bytes) * 100);
-	}
-
-	function jobLabel(type: string): string {
-		return type === 'zip' ? 'ZIP-Archiv' : 'HTML-Viewer';
-	}
-
-	function statusBadgeClass(status: string): string {
-		switch (status) {
-			case 'done': return 'bg-green-100 text-green-700';
-			case 'running': return 'bg-blue-100 text-blue-700';
-			case 'failed': return 'bg-red-100 text-red-700';
-			default: return 'bg-gray-100 text-gray-600';
-		}
-	}
-
-	function statusLabel(status: string): string {
-		switch (status) {
-			case 'pending': return 'Ausstehend';
-			case 'running': return 'Läuft';
-			case 'done': return 'Fertig';
-			case 'failed': return 'Fehlgeschlagen';
-			default: return status;
-		}
-	}
-</script>
-
-<!-- Toast -->
-{#if toast}
-	<div class="fixed bottom-6 left-1/2 z-50 -translate-x-1/2 rounded-full bg-gray-900 px-5 py-2.5 text-sm text-white shadow-lg">
-		{toast}
-	</div>
-{/if}
-
-<div class="min-h-screen bg-gray-50">
-	<!-- Header -->
-	<div class="border-b border-gray-200 bg-white">
-		<div class="mx-auto flex max-w-3xl items-center justify-between px-4 py-4">
-			<h1 class="text-xl font-bold text-gray-900">Admin Dashboard</h1>
-			<div class="flex items-center gap-3">
-				<a href="/host" class="text-sm text-blue-600 hover:underline">Host-Dashboard</a>
-				<a href="/feed" class="text-sm text-gray-500 hover:text-gray-700">Galerie</a>
-			</div>
-		</div>
-	</div>
-
-	<div class="mx-auto max-w-3xl space-y-4 p-4">
-		{#if loading}
-			<div class="py-16 text-center text-gray-400">Laden…</div>
-		{:else if error}
-			<div class="rounded-lg bg-red-50 p-4 text-sm text-red-700">{error}</div>
-		{:else}
-			<!-- Stats -->
-			{#if stats}
-				<div class="rounded-xl border border-gray-200 bg-white p-5">
-					<h2 class="mb-4 font-semibold text-gray-900">Statistiken</h2>
-					<div class="grid grid-cols-3 gap-4 text-center">
-						<div class="rounded-lg bg-gray-50 p-3">
-							<p class="text-2xl font-bold text-gray-900">{stats.user_count}</p>
-							<p class="text-xs text-gray-500">Gäste</p>
-						</div>
-						<div class="rounded-lg bg-gray-50 p-3">
-							<p class="text-2xl font-bold text-gray-900">{stats.upload_count}</p>
-							<p class="text-xs text-gray-500">Uploads</p>
-						</div>
-						<div class="rounded-lg bg-gray-50 p-3">
-							<p class="text-2xl font-bold text-gray-900">{stats.comment_count}</p>
-							<p class="text-xs text-gray-500">Kommentare</p>
-						</div>
-					</div>
-
-					<!-- Disk usage -->
-					<div class="mt-4">
-						<div class="mb-1 flex items-center justify-between text-xs text-gray-500">
-							<span>Speicher</span>
-							<span>{formatBytes(stats.disk_used_bytes)} / {formatBytes(stats.disk_total_bytes)} ({diskPct(stats)} %)</span>
-						</div>
-						<div class="h-2 overflow-hidden rounded-full bg-gray-200">
-							<div
-								class="h-full rounded-full transition-all {diskPct(stats) >= 90 ? 'bg-red-500' : diskPct(stats) >= 75 ? 'bg-amber-500' : 'bg-blue-500'}"
-								style="width: {diskPct(stats)}%"
-							></div>
-						</div>
-						<p class="mt-1 text-xs text-gray-400">{formatBytes(stats.disk_free_bytes)} frei</p>
-					</div>
-				</div>
-			{/if}
-
-			<!-- Config -->
-			<div class="rounded-xl border border-gray-200 bg-white p-5">
-				<h2 class="mb-4 font-semibold text-gray-900">Konfiguration</h2>
-				<div class="space-y-3">
-					{#each Object.entries(CONFIG_LABELS) as [key, label]}
-						<div class="flex items-center gap-3">
-							<label for={key} class="w-56 shrink-0 text-sm text-gray-700">{label}</label>
-							<input
-								id={key}
-								type="number"
-								step="any"
-								bind:value={configDraft[key]}
-								class="w-32 rounded-lg border border-gray-300 px-3 py-1.5 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-200"
-							/>
-						</div>
-					{/each}
-				</div>
-				<button
-					onclick={saveConfig}
-					disabled={saving}
-					class="mt-4 rounded-lg bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-700 disabled:opacity-50"
-				>
-					{saving ? 'Wird gespeichert…' : 'Speichern'}
-				</button>
-			</div>
-
-			<!-- Export jobs -->
-			<div class="rounded-xl border border-gray-200 bg-white p-5">
-				<div class="mb-4 flex items-center justify-between">
-					<h2 class="font-semibold text-gray-900">Export-Jobs</h2>
-					<button onclick={reload} class="text-xs text-blue-600 hover:underline">Aktualisieren</button>
-				</div>
-				{#if exportJobs.length === 0}
-					<p class="text-sm text-gray-400">Noch keine Export-Jobs.</p>
-				{:else}
-					<div class="space-y-3">
-						{#each exportJobs as job}
-							<div class="rounded-lg border border-gray-100 p-3">
-								<div class="flex items-center justify-between">
-									<span class="text-sm font-medium text-gray-900">{jobLabel(job.type)}</span>
-									<span class="rounded-full px-2 py-0.5 text-xs font-medium {statusBadgeClass(job.status)}">
-										{statusLabel(job.status)}
-									</span>
-								</div>
-								{#if job.status === 'running'}
-									<div class="mt-2">
-										<div class="mb-1 flex justify-between text-xs text-gray-500">
-											<span>Fortschritt</span>
-											<span>{job.progress_pct} %</span>
-										</div>
-										<div class="h-1.5 overflow-hidden rounded-full bg-gray-200">
-											<div
-												class="h-full rounded-full bg-blue-500 transition-all"
-												style="width: {job.progress_pct}%"
-											></div>
-										</div>
-									</div>
-								{/if}
-								{#if job.error_message}
-									<p class="mt-1 text-xs text-red-600">{job.error_message}</p>
-								{/if}
-							</div>
-						{/each}
-					</div>
-				{/if}
-			</div>
-		{/if}
-	</div>
-</div>

frontend/src/routes/export/+page.svelte

@@ -1,195 +0,0 @@
-<script lang="ts">
-	import { goto } from '$app/navigation';
-	import { getToken } from '$lib/auth';
-	import { api } from '$lib/api';
-	import { onMount, onDestroy } from 'svelte';
-	import { connectSse, disconnectSse, onSseEvent } from '$lib/sse';
-
-	interface JobStatus {
-		status: 'locked' | 'pending' | 'running' | 'done' | 'failed';
-		progress_pct: number;
-	}
-
-	interface ExportStatus {
-		released: boolean;
-		zip: JobStatus;
-		html: JobStatus;
-	}
-
-	let status = $state<ExportStatus | null>(null);
-	let showHtmlGuide = $state(false);
-	let loading = $state(true);
-
-	let unsubscribers: (() => void)[] = [];
-
-	onMount(async () => {
-		if (!getToken()) {
-			goto('/join');
-			return;
-		}
-
-		await loadStatus();
-		connectSse();
-
-		unsubscribers.push(
-			onSseEvent('export-progress', async () => {
-				await loadStatus();
-			}),
-			onSseEvent('export-available', async () => {
-				await loadStatus();
-			})
-		);
-	});
-
-	onDestroy(() => {
-		disconnectSse();
-		for (const unsub of unsubscribers) unsub();
-	});
-
-	async function loadStatus() {
-		try {
-			status = await api.get<ExportStatus>('/export/status');
-		} catch {
-			// ignore
-		} finally {
-			loading = false;
-		}
-	}
-
-	function jobLabel(type: 'zip' | 'html'): string {
-		return type === 'zip' ? 'ZIP-Archiv (Gallery.zip)' : 'HTML-Viewer (Memories.zip)';
-	}
-
-	function statusText(job: JobStatus): string {
-		switch (job.status) {
-			case 'locked': return 'Noch nicht freigegeben';
-			case 'pending': return 'Wird vorbereitet…';
-			case 'running': return `Wird erstellt (${job.progress_pct} %)`;
-			case 'done': return 'Bereit zum Download';
-			case 'failed': return 'Fehlgeschlagen';
-		}
-	}
-
-	function downloadZip() {
-		window.location.href = '/api/v1/export/zip';
-	}
-
-	function downloadHtml() {
-		showHtmlGuide = true;
-	}
-
-	function confirmHtmlDownload() {
-		showHtmlGuide = false;
-		window.location.href = '/api/v1/export/html';
-	}
-</script>
-
-<!-- HTML guide modal -->
-{#if showHtmlGuide}
-	<div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
-		<div class="w-full max-w-sm rounded-2xl bg-white p-6 shadow-xl">
-			<h2 class="mb-3 text-lg font-bold text-gray-900">Hinweis zum HTML-Viewer</h2>
-			<ol class="mb-4 space-y-2 text-sm text-gray-700">
-				<li class="flex gap-2"><span class="font-bold text-blue-600">1.</span> ZIP-Datei entpacken (Windows: Rechtsklick → "Alle extrahieren"; Mac: Doppelklick).</li>
-				<li class="flex gap-2"><span class="font-bold text-blue-600">2.</span> <strong>Memories.html</strong> im Browser öffnen.</li>
-				<li class="flex gap-2"><span class="font-bold text-blue-600">3.</span> Kein Internet nötig — alles ist lokal gespeichert.</li>
-			</ol>
-			<p class="mb-4 rounded-lg bg-amber-50 px-3 py-2 text-xs text-amber-700">
-				Tipp: Am besten im WLAN herunterladen — die Datei kann mehrere GB groß sein.
-			</p>
-			<div class="flex gap-2">
-				<button
-					onclick={() => (showHtmlGuide = false)}
-					class="flex-1 rounded-lg border border-gray-300 py-2 text-sm text-gray-700 hover:bg-gray-50"
-				>
-					Abbrechen
-				</button>
-				<button
-					onclick={confirmHtmlDownload}
-					class="flex-1 rounded-lg bg-blue-600 py-2 text-sm font-medium text-white hover:bg-blue-700"
-				>
-					Herunterladen
-				</button>
-			</div>
-		</div>
-	</div>
-{/if}
-
-<div class="min-h-screen bg-gray-50">
-	<div class="border-b border-gray-200 bg-white">
-		<div class="mx-auto flex max-w-lg items-center justify-between px-4 py-4">
-			<h1 class="text-xl font-bold text-gray-900">Export</h1>
-			<a href="/feed" class="text-sm text-blue-600 hover:underline">Zur Galerie</a>
-		</div>
-	</div>
-
-	<div class="mx-auto max-w-lg space-y-4 p-4">
-		{#if loading}
-			<div class="py-16 text-center text-gray-400">Laden…</div>
-		{:else if !status?.released}
-			<div class="rounded-xl border border-gray-200 bg-white p-6 text-center">
-				<svg class="mx-auto mb-3 h-12 w-12 text-gray-300" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-					<path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z" />
-				</svg>
-				<p class="font-medium text-gray-700">Export noch nicht verfügbar</p>
-				<p class="mt-1 text-sm text-gray-500">Schau nach der Veranstaltung noch einmal vorbei.</p>
-			</div>
-		{:else if status}
-			<p class="text-sm text-gray-500">Wähle dein bevorzugtes Format:</p>
-
-			<!-- ZIP card -->
-			<div class="rounded-xl border border-gray-200 bg-white p-5">
-				<div class="flex items-start justify-between gap-4">
-					<div class="min-w-0">
-						<h2 class="font-semibold text-gray-900">ZIP-Archiv</h2>
-						<p class="mt-0.5 text-sm text-gray-500">Alle Original-Fotos und Videos in strukturierten Ordnern.</p>
-						<p class="mt-1 text-xs {status.zip.status === 'done' ? 'text-green-600' : status.zip.status === 'failed' ? 'text-red-500' : 'text-gray-400'}">
-							{statusText(status.zip)}
-						</p>
-					</div>
-					<button
-						onclick={downloadZip}
-						disabled={status.zip.status !== 'done'}
-						class="shrink-0 rounded-lg px-4 py-2 text-sm font-medium {status.zip.status === 'done' ? 'bg-blue-600 text-white hover:bg-blue-700' : 'bg-gray-100 text-gray-400 cursor-not-allowed'}"
-					>
-						Download
-					</button>
-				</div>
-				{#if status.zip.status === 'running'}
-					<div class="mt-3">
-						<div class="h-1.5 overflow-hidden rounded-full bg-gray-200">
-							<div class="h-full rounded-full bg-blue-500 transition-all" style="width: {status.zip.progress_pct}%"></div>
-						</div>
-					</div>
-				{/if}
-			</div>
-
-			<!-- HTML card -->
-			<div class="rounded-xl border border-gray-200 bg-white p-5">
-				<div class="flex items-start justify-between gap-4">
-					<div class="min-w-0">
-						<h2 class="font-semibold text-gray-900">HTML-Viewer</h2>
-						<p class="mt-0.5 text-sm text-gray-500">Schöne Offline-Galerie mit Filterung, Kommentaren und Likes — kein Internet nötig.</p>
-						<p class="mt-1 text-xs {status.html.status === 'done' ? 'text-green-600' : status.html.status === 'failed' ? 'text-red-500' : 'text-gray-400'}">
-							{statusText(status.html)}
-						</p>
-					</div>
-					<button
-						onclick={downloadHtml}
-						disabled={status.html.status !== 'done'}
-						class="shrink-0 rounded-lg px-4 py-2 text-sm font-medium {status.html.status === 'done' ? 'bg-blue-600 text-white hover:bg-blue-700' : 'bg-gray-100 text-gray-400 cursor-not-allowed'}"
-					>
-						Download
-					</button>
-				</div>
-				{#if status.html.status === 'running'}
-					<div class="mt-3">
-						<div class="h-1.5 overflow-hidden rounded-full bg-gray-200">
-							<div class="h-full rounded-full bg-blue-500 transition-all" style="width: {status.html.progress_pct}%"></div>
-						</div>
-					</div>
-				{/if}
-			</div>
-		{/if}
-	</div>
-</div>

frontend/src/routes/host/+page.svelte

@@ -1,318 +0,0 @@
-<script lang="ts">
-	import { goto } from '$app/navigation';
-	import { getToken, getRole } from '$lib/auth';
-	import { api } from '$lib/api';
-	import { onMount } from 'svelte';
-
-	interface UserSummary {
-		id: string;
-		display_name: string;
-		role: string;
-		is_banned: boolean;
-		uploads_hidden: boolean;
-		upload_count: number;
-		total_upload_bytes: number;
-		created_at: string;
-	}
-
-	interface EventStatus {
-		name: string;
-		is_active: boolean;
-		uploads_locked: boolean;
-		export_released: boolean;
-	}
-
-	let event = $state<EventStatus | null>(null);
-	let users = $state<UserSummary[]>([]);
-	let loading = $state(true);
-	let error = $state<string | null>(null);
-
-	// Ban modal state
-	let banTarget = $state<UserSummary | null>(null);
-	let banHideUploads = $state(false);
-	let banSubmitting = $state(false);
-
-	// Toast state
-	let toast = $state<string | null>(null);
-
-	onMount(async () => {
-		const token = getToken();
-		const role = getRole();
-		if (!token || (role !== 'host' && role !== 'admin')) {
-			goto('/join');
-			return;
-		}
-		await reload();
-	});
-
-	async function reload() {
-		loading = true;
-		error = null;
-		try {
-			[event, users] = await Promise.all([
-				api.get<EventStatus>('/host/event'),
-				api.get<UserSummary[]>('/host/users')
-			]);
-		} catch (e: unknown) {
-			error = e instanceof Error ? e.message : 'Fehler beim Laden.';
-		} finally {
-			loading = false;
-		}
-	}
-
-	function showToast(msg: string) {
-		toast = msg;
-		setTimeout(() => (toast = null), 3000);
-	}
-
-	async function toggleEventLock() {
-		if (!event) return;
-		try {
-			if (event.uploads_locked) {
-				await api.post('/host/event/open');
-				showToast('Uploads wurden wieder geöffnet.');
-			} else {
-				await api.post('/host/event/close');
-				showToast('Uploads wurden gesperrt.');
-			}
-			await reload();
-		} catch (e: unknown) {
-			showToast(e instanceof Error ? e.message : 'Fehler.');
-		}
-	}
-
-	async function releaseGallery() {
-		try {
-			await api.post('/host/gallery/release');
-			showToast('Galerie wurde freigegeben. Export wird vorbereitet…');
-			await reload();
-		} catch (e: unknown) {
-			showToast(e instanceof Error ? e.message : 'Fehler.');
-		}
-	}
-
-	function openBanModal(user: UserSummary) {
-		banTarget = user;
-		banHideUploads = false;
-	}
-
-	async function confirmBan() {
-		if (!banTarget) return;
-		banSubmitting = true;
-		try {
-			await api.post(`/host/users/${banTarget.id}/ban`, { hide_uploads: banHideUploads });
-			showToast(`${banTarget.display_name} wurde gesperrt.`);
-			banTarget = null;
-			await reload();
-		} catch (e: unknown) {
-			showToast(e instanceof Error ? e.message : 'Fehler.');
-		} finally {
-			banSubmitting = false;
-		}
-	}
-
-	async function unban(user: UserSummary) {
-		try {
-			await api.post(`/host/users/${user.id}/unban`);
-			showToast(`Sperre für ${user.display_name} aufgehoben.`);
-			await reload();
-		} catch (e: unknown) {
-			showToast(e instanceof Error ? e.message : 'Fehler.');
-		}
-	}
-
-	async function promoteToHost(user: UserSummary) {
-		try {
-			await api.patch(`/host/users/${user.id}/role`, { role: 'host' });
-			showToast(`${user.display_name} ist jetzt Host.`);
-			await reload();
-		} catch (e: unknown) {
-			showToast(e instanceof Error ? e.message : 'Fehler.');
-		}
-	}
-
-	async function demoteToGuest(user: UserSummary) {
-		try {
-			await api.patch(`/host/users/${user.id}/role`, { role: 'guest' });
-			showToast(`${user.display_name} ist jetzt Gast.`);
-			await reload();
-		} catch (e: unknown) {
-			showToast(e instanceof Error ? e.message : 'Fehler.');
-		}
-	}
-
-	function formatBytes(bytes: number): string {
-		if (bytes < 1024) return `${bytes} B`;
-		if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-		return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-	}
-
-	const myRole = getRole();
-</script>
-
-<!-- Ban modal -->
-{#if banTarget}
-	<div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
-		<div class="w-full max-w-sm rounded-2xl bg-white p-6 shadow-xl">
-			<h2 class="mb-1 text-lg font-bold text-gray-900">Benutzer sperren</h2>
-			<p class="mb-4 text-sm text-gray-600">
-				Was soll mit den Uploads von <strong>{banTarget.display_name}</strong> passieren?
-			</p>
-			<label class="mb-4 flex cursor-pointer items-center gap-3 rounded-lg border border-gray-200 p-3">
-				<input
-					type="checkbox"
-					bind:checked={banHideUploads}
-					class="h-4 w-4 rounded border-gray-300 text-red-600 focus:ring-red-500"
-				/>
-				<span class="text-sm text-gray-700">Uploads aus der Galerie ausblenden</span>
-			</label>
-			<div class="flex gap-2">
-				<button
-					onclick={() => (banTarget = null)}
-					class="flex-1 rounded-lg border border-gray-300 py-2 text-sm text-gray-700 hover:bg-gray-50"
-				>
-					Abbrechen
-				</button>
-				<button
-					onclick={confirmBan}
-					disabled={banSubmitting}
-					class="flex-1 rounded-lg bg-red-600 py-2 text-sm font-medium text-white hover:bg-red-700 disabled:opacity-50"
-				>
-					{banSubmitting ? 'Wird gesperrt…' : 'Sperren'}
-				</button>
-			</div>
-		</div>
-	</div>
-{/if}
-
-<!-- Toast -->
-{#if toast}
-	<div class="fixed bottom-6 left-1/2 z-50 -translate-x-1/2 rounded-full bg-gray-900 px-5 py-2.5 text-sm text-white shadow-lg">
-		{toast}
-	</div>
-{/if}
-
-<div class="min-h-screen bg-gray-50">
-	<!-- Header -->
-	<div class="border-b border-gray-200 bg-white">
-		<div class="mx-auto flex max-w-3xl items-center justify-between px-4 py-4">
-			<div>
-				<h1 class="text-xl font-bold text-gray-900">Host Dashboard</h1>
-				{#if event}
-					<p class="text-sm text-gray-500">{event.name}</p>
-				{/if}
-			</div>
-			<a href="/feed" class="text-sm text-blue-600 hover:underline">Zur Galerie</a>
-		</div>
-	</div>
-
-	<div class="mx-auto max-w-3xl space-y-4 p-4">
-		{#if loading}
-			<div class="py-16 text-center text-gray-400">Laden…</div>
-		{:else if error}
-			<div class="rounded-lg bg-red-50 p-4 text-sm text-red-700">{error}</div>
-		{:else if event}
-			<!-- Event controls -->
-			<div class="rounded-xl border border-gray-200 bg-white p-5">
-				<h2 class="mb-4 font-semibold text-gray-900">Veranstaltung</h2>
-				<div class="flex flex-wrap gap-3">
-					<button
-						onclick={toggleEventLock}
-						class="rounded-lg px-4 py-2 text-sm font-medium {event.uploads_locked
-							? 'bg-green-600 text-white hover:bg-green-700'
-							: 'bg-amber-500 text-white hover:bg-amber-600'}"
-					>
-						{event.uploads_locked ? 'Uploads wieder öffnen' : 'Uploads sperren'}
-					</button>
-					<button
-						onclick={releaseGallery}
-						disabled={event.export_released}
-						class="rounded-lg px-4 py-2 text-sm font-medium {event.export_released
-							? 'cursor-default bg-gray-100 text-gray-400'
-							: 'bg-blue-600 text-white hover:bg-blue-700'}"
-					>
-						{event.export_released ? 'Galerie bereits freigegeben' : 'Galerie freigeben'}
-					</button>
-				</div>
-				<div class="mt-3 flex gap-4 text-xs text-gray-500">
-					<span class="flex items-center gap-1">
-						<span class="h-2 w-2 rounded-full {event.uploads_locked ? 'bg-red-500' : 'bg-green-500'}"></span>
-						Uploads {event.uploads_locked ? 'gesperrt' : 'offen'}
-					</span>
-					<span class="flex items-center gap-1">
-						<span class="h-2 w-2 rounded-full {event.export_released ? 'bg-blue-500' : 'bg-gray-300'}"></span>
-						Export {event.export_released ? 'freigegeben' : 'gesperrt'}
-					</span>
-				</div>
-			</div>
-
-			<!-- User management -->
-			<div class="rounded-xl border border-gray-200 bg-white">
-				<div class="border-b border-gray-100 px-5 py-4">
-					<h2 class="font-semibold text-gray-900">Gäste ({users.length})</h2>
-				</div>
-				{#if users.length === 0}
-					<p class="px-5 py-8 text-center text-sm text-gray-400">Noch keine Gäste.</p>
-				{:else}
-					<div class="divide-y divide-gray-100">
-						{#each users as user}
-							<div class="flex items-center gap-3 px-5 py-3">
-								<div class="min-w-0 flex-1">
-									<div class="flex items-center gap-2">
-										<span class="truncate font-medium text-gray-900">{user.display_name}</span>
-										{#if user.role === 'host'}
-											<span class="rounded-full bg-blue-100 px-2 py-0.5 text-xs font-medium text-blue-700">Host</span>
-										{:else if user.role === 'admin'}
-											<span class="rounded-full bg-purple-100 px-2 py-0.5 text-xs font-medium text-purple-700">Admin</span>
-										{/if}
-										{#if user.is_banned}
-											<span class="rounded-full bg-red-100 px-2 py-0.5 text-xs font-medium text-red-700">Gesperrt</span>
-										{/if}
-									</div>
-									<p class="text-xs text-gray-400">
-										{user.upload_count} Upload{user.upload_count !== 1 ? 's' : ''} · {formatBytes(user.total_upload_bytes)}
-									</p>
-								</div>
-								<div class="flex shrink-0 gap-1.5">
-									{#if user.role !== 'admin'}
-										{#if user.is_banned}
-											<button
-												onclick={() => unban(user)}
-												class="rounded-lg bg-gray-100 px-3 py-1.5 text-xs font-medium text-gray-700 hover:bg-gray-200"
-											>
-												Entsperren
-											</button>
-										{:else}
-											{#if user.role === 'guest' && (myRole === 'host' || myRole === 'admin')}
-												<button
-													onclick={() => promoteToHost(user)}
-													class="rounded-lg bg-blue-50 px-3 py-1.5 text-xs font-medium text-blue-700 hover:bg-blue-100"
-												>
-													Host
-												</button>
-											{/if}
-											{#if user.role === 'host' && myRole === 'admin'}
-												<button
-													onclick={() => demoteToGuest(user)}
-													class="rounded-lg bg-gray-100 px-3 py-1.5 text-xs font-medium text-gray-700 hover:bg-gray-200"
-												>
-													Degradieren
-												</button>
-											{/if}
-											<button
-												onclick={() => openBanModal(user)}
-												class="rounded-lg bg-red-50 px-3 py-1.5 text-xs font-medium text-red-700 hover:bg-red-100"
-											>
-												Sperren
-											</button>
-										{/if}
-									{/if}
-								</div>
-							</div>
-						{/each}
-					</div>
-				{/if}
-			</div>
-		{/if}
-	</div>
-</div>

frontend/src/routes/upload/+page.svelte

@@ -3,13 +3,11 @@
 	import { getToken } from '$lib/auth';
 	import { addToQueue, loadQueue } from '$lib/upload-queue';
 	import UploadQueue from '$lib/components/UploadQueue.svelte';
-	import CameraCapture from '$lib/components/CameraCapture.svelte';
 	import { onMount } from 'svelte';
 
 	let caption = $state('');
 	let hashtags = $state('');
 	let fileInput: HTMLInputElement;
-	let showCamera = $state(false);
 
 	onMount(() => {
 		if (!getToken()) {
@@ -32,23 +30,8 @@
 		hashtags = '';
 		if (fileInput) fileInput.value = '';
 	}
-
-	async function handleCapture(blob: Blob, type: 'photo' | 'video') {
-		const ext = type === 'photo' ? 'jpg' : blob.type.includes('mp4') ? 'mp4' : 'webm';
-		const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-		const fileName = `${type}_${timestamp}.${ext}`;
-		const file = new File([blob], fileName, { type: blob.type });
-		await addToQueue(file, caption, hashtags);
-	}
 </script>
 
-{#if showCamera}
-	<CameraCapture
-		oncapture={handleCapture}
-		onclose={() => (showCamera = false)}
-	/>
-{/if}
-
 <div class="min-h-screen bg-gray-50 p-4">
 	<div class="mx-auto max-w-lg">
 		<div class="mb-6 flex items-center justify-between">
@@ -57,16 +40,14 @@
 		</div>
 
 		<div class="rounded-lg border border-gray-200 bg-white p-4">
-			<div class="grid grid-cols-2 gap-3">
-				<!-- File picker -->
 			<label
-					class="flex cursor-pointer flex-col items-center justify-center rounded-lg border-2 border-dashed border-gray-300 bg-gray-50 p-6 transition hover:border-blue-400 hover:bg-blue-50"
+				class="flex cursor-pointer flex-col items-center justify-center rounded-lg border-2 border-dashed border-gray-300 bg-gray-50 p-8 transition hover:border-blue-400 hover:bg-blue-50"
 			>
-					<svg class="mb-2 h-8 w-8 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+				<svg class="mb-2 h-10 w-10 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
 					<path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M12 16V4m0 0l-4 4m4-4l4 4M4 20h16" />
 				</svg>
-					<span class="text-center text-sm font-medium text-gray-600">Galerie</span>
+				<span class="text-sm font-medium text-gray-600">Fotos oder Videos auswählen</span>
-					<span class="mt-1 text-center text-xs text-gray-400">Mehrere Dateien</span>
+				<span class="mt-1 text-xs text-gray-400">Mehrere Dateien möglich</span>
 				<input
 					bind:this={fileInput}
 					type="file"
@@ -77,20 +58,6 @@
 				/>
 			</label>
 
-				<!-- Camera button -->
-				<button
-					onclick={() => (showCamera = true)}
-					class="flex flex-col items-center justify-center rounded-lg border-2 border-dashed border-gray-300 bg-gray-50 p-6 transition hover:border-blue-400 hover:bg-blue-50"
-				>
-					<svg class="mb-2 h-8 w-8 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-						<path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M3 9a2 2 0 012-2h.93a2 2 0 001.664-.89l.812-1.22A2 2 0 0110.07 4h3.86a2 2 0 011.664.89l.812 1.22A2 2 0 0018.07 7H19a2 2 0 012 2v9a2 2 0 01-2 2H5a2 2 0 01-2-2V9z" />
-						<path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M15 13a3 3 0 11-6 0 3 3 0 016 0z" />
-					</svg>
-					<span class="text-sm font-medium text-gray-600">Kamera</span>
-					<span class="mt-1 text-xs text-gray-400">Foto & Video</span>
-				</button>
-			</div>
-
 			<div class="mt-4 space-y-3">
 				<input
 					type="text"