diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 53f0ec6..fa335cb 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -73,7 +73,7 @@ jobs:
       - name: Security audit
         run: |
           cargo install cargo-audit --locked
-          cd backend && cargo audit --ignore RUSTSEC-2023-0071
+          cd backend && cargo audit
 
       - name: Build frontend
         run: pnpm --dir frontend build
diff --git a/.gitignore b/.gitignore
index 2fa28f3..1b26d97 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,7 +19,6 @@ build/
 
 # Rust
 target/
-Cargo.lock
 debug/
 release/
 
diff --git a/Dockerfile b/Dockerfile
index 1bae445..8a25311 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,6 +5,7 @@ RUN corepack enable && corepack prepare pnpm --activate
 COPY frontend/package.json frontend/pnpm-lock.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY frontend/ ./
+RUN pnpm svelte-kit sync
 RUN pnpm run check
 RUN pnpm run build
 
diff --git a/Makefile b/Makefile
index 4f83551..c635dc1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+SHELL := /bin/bash
+
 .PHONY: dev dev-backend dev-frontend build test compose-up seed-demo \
         test-up test-down test-reset test-rebuild test-e2e
 
@@ -58,10 +60,19 @@ test-up:
 		exit 0; \
 	fi; \
 	[ -f "$$TT_TEST_DB" ] || $(MAKE) test-rebuild; \
+	rm -f data/test/.port; \
 	DATABASE_URL="sqlite:$$TT_TEST_DB" PORT=$$TT_TEST_PORT TT_TEST_MODE=1 JWT_SECRET=testsecret STATIC_DIR=frontend/build \
 		cargo run --manifest-path backend/Cargo.toml &>/tmp/tutortool-test.log & \
 	echo $$! > data/test/.pid; \
 	echo "[test-up] Backend PID $$(cat data/test/.pid) starting on port $$TT_TEST_PORT..."; \
+	if [ "$$TT_TEST_PORT" = "0" ]; then \
+		for i in $$(seq 1 30); do \
+			[ -f data/test/.port ] && break; \
+			sleep 1; \
+		done; \
+		. scripts/test-env.sh; \
+		echo "[test-up] Backend bound to port $$TT_TEST_PORT"; \
+	fi; \
 	for i in $$(seq 1 30); do \
 		curl -fs "$$TT_BASE_URL/health" >/dev/null 2>&1 && break; \
 		sleep 1; \
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
new file mode 100644
index 0000000..4ec107c
--- /dev/null
+++ b/backend/Cargo.lock
@@ -0,0 +1,3047 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.40.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "axum-macros",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "multer",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-extra"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9963ff19f40c6102c76756ef0a46004c0d58957d87259fc9208ff8441c12ab96"
+dependencies = [
+ "axum",
+ "axum-core",
+ "bytes",
+ "cookie",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "serde_core",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-macros"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aa268c23bfbbd2c4363b9cd302a4f504fb2a9dfe7e3451d66f35dd392e20aca"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bcrypt"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "523ab528ce3a7ada6597f8ccf5bd8d85ebe26d5edf311cad4d1d3cfb2d357ac6"
+dependencies = [
+ "base64",
+ "blowfish",
+ "getrandom 0.4.2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "dashmap"
+version = "6.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "forwarded-header-value"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8835f84f38484cc86f110a805655697908257fb9a7af005234060891557198e9"
+dependencies = [
+ "nonempty",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-timer"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "governor"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be93b4ec2e4710b04d9264c0c7350cdd62a8c20e5e4ac732552ebb8f0debe8eb"
+dependencies = [
+ "cfg-if",
+ "dashmap",
+ "futures-sink",
+ "futures-timer",
+ "futures-util",
+ "getrandom 0.3.4",
+ "no-std-compat",
+ "nonzero_ext",
+ "parking_lot",
+ "portable-atomic",
+ "quanta",
+ "rand 0.9.4",
+ "smallvec",
+ "spinning_top",
+ "web-time",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.0",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.97"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1840c94c045fbcf8ba2812c95db44499f7c64910a912551aaaa541decebcacf"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "10.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0529410abe238729a60b108898784df8984c87f6054c9c4fcacc47e4803c1ce1"
+dependencies = [
+ "aws-lc-rs",
+ "base64",
+ "getrandom 0.2.17",
+ "js-sys",
+ "pem",
+ "serde",
+ "serde_json",
+ "signature",
+ "simple_asn1",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall 0.7.5",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "multer"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83e87776546dc87511aa5ee218730c92b666d7264ab6ed41f9d215af9cd5224b"
+dependencies = [
+ "bytes",
+ "encoding_rs",
+ "futures-util",
+ "http",
+ "httparse",
+ "memchr",
+ "mime",
+ "spin",
+ "version_check",
+]
+
+[[package]]
+name = "no-std-compat"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b93853da6d84c2e3c7d730d6473e8817692dd89be387eb01b94d7f108ecb5b8c"
+
+[[package]]
+name = "nonempty"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e591e719385e6ebaeb5ce5d3887f7d5676fceca6411d1925ccc95745f3d6f7"
+
+[[package]]
+name = "nonzero_ext"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.6",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64",
+ "serde_core",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4666a1a60d8412eab19d94f6d13dcc9cea0a5ef4fdf6a5db306537413c661b1b"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "scc"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
+dependencies = [
+ "sdd",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sdd"
+version = "3.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serial_test"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+dependencies = [
+ "futures-executor",
+ "futures-util",
+ "log",
+ "once_cell",
+ "parking_lot",
+ "scc",
+ "serial_test_derive",
+]
+
+[[package]]
+name = "serial_test_derive"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror 2.0.18",
+ "time",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spinning_top"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
+dependencies = [
+ "base64",
+ "bytes",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.15.5",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.6",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.6",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+dependencies = [
+ "atoi",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "serde_urlencoded",
+ "sqlx-core",
+ "thiserror 2.0.18",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "temp-env"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96374855068f47402c3121c6eed88d29cb1de8f3ab27090e273e420bdabcf050"
+dependencies = [
+ "parking_lot",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "110a78583f19d5cdb2c5ccf321d1290344e71313c6c37d43520d386027d18386"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tower_governor"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57a2ccff6830fa835371af7541e561a90e4c07b84f72991ebac4b3cb6790dc0d"
+dependencies = [
+ "axum",
+ "forwarded-header-value",
+ "governor",
+ "http",
+ "pin-project",
+ "thiserror 2.0.18",
+ "tower",
+ "tracing",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "tutortool"
+version = "0.1.0"
+dependencies = [
+ "argon2",
+ "axum",
+ "axum-extra",
+ "bcrypt",
+ "bytes",
+ "chrono",
+ "http-body-util",
+ "jsonwebtoken",
+ "rand 0.8.6",
+ "serde",
+ "serde_json",
+ "serial_test",
+ "sqlx",
+ "temp-env",
+ "thiserror 2.0.18",
+ "tokio",
+ "tower",
+ "tower-http",
+ "tower_governor",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.120"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df52b6d9b87e0c74c9edfa1eb2d9bf85e5d63515474513aa50fa181b3c4f5db1"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.120"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78b1041f495fb322e64aca85f5756b2172e35cd459376e67f2a6c9dffcedb103"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.120"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dcd0ff20416988a18ac686d4d4d0f6aae9ebf08a389ff5d29012b05af2a1b41"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.120"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49757b3c82ebf16c57d69365a142940b384176c24df52a087fb748e2085359ea"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.97"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eadbac71025cd7b0834f20d1fe8472e8495821b4e9801eb0a60bd1f19827602"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yoke"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 5a0eee7..c443983 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -11,7 +11,7 @@ tokio = { version = "1", features = ["full"] }
 sqlx = { version = "0.8", features = ["sqlite", "runtime-tokio", "macros", "migrate"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-jsonwebtoken = { version = "10", features = ["rust_crypto"] }
+jsonwebtoken = { version = "10", features = ["aws_lc_rs"] }
 bcrypt = "0.19"
 argon2 = "0.5"
 tower-http = { version = "0.6", features = ["fs", "cors", "trace", "set-header"] }
diff --git a/backend/demo/demo_seed.sql b/backend/demo/demo_seed.sql
index 1aebdc4..d9d0bdc 100644
--- a/backend/demo/demo_seed.sql
+++ b/backend/demo/demo_seed.sql
@@ -14,30 +14,222 @@ VALUES (1, 1);
 -- Rooms
 INSERT OR IGNORE INTO rooms (id, name, layout_json)
 VALUES (1, 'Room A (Small)', '[
-    { "id": "T1", "label": "T1", "x": 90, "y": 150, "width": 200, "height": 70, "type": "table" },
-    { "id": "T2", "label": "T2", "x": 470, "y": 150, "width": 200, "height": 70, "type": "table" },
-    { "id": "T3", "label": "T3", "x": 90, "y": 320, "width": 200, "height": 70, "type": "table" },
-    { "id": "T4", "label": "T4", "x": 470, "y": 320, "width": 200, "height": 70, "type": "table" },
-    { "id": "T1-1", "label": "1", "x": 146.0, "y": 128, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T1-2", "label": "2", "x": 234.0, "y": 128, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T1-3", "label": "3", "x": 146.0, "y": 242, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T1-4", "label": "4", "x": 234.0, "y": 242, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T1-5", "label": "5", "x": 316, "y": 185.0, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T2-1", "label": "1", "x": 526.0, "y": 128, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T2-2", "label": "2", "x": 614.0, "y": 128, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T2-3", "label": "3", "x": 526.0, "y": 242, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T2-4", "label": "4", "x": 614.0, "y": 242, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T2-5", "label": "5", "x": 696, "y": 185.0, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T3-1", "label": "1", "x": 146.0, "y": 298, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T3-2", "label": "2", "x": 234.0, "y": 298, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T3-3", "label": "3", "x": 146.0, "y": 412, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T3-4", "label": "4", "x": 234.0, "y": 412, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T3-5", "label": "5", "x": 316, "y": 355.0, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T4-1", "label": "1", "x": 526.0, "y": 298, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T4-2", "label": "2", "x": 614.0, "y": 298, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T4-3", "label": "3", "x": 526.0, "y": 412, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T4-4", "label": "4", "x": 614.0, "y": 412, "width": 36, "height": 36, "type": "seat" },
-    { "id": "T4-5", "label": "5", "x": 696, "y": 355.0, "width": 36, "height": 36, "type": "seat" }
+    {
+        "id": "T1",
+        "label": "T1",
+        "x": 2.25,
+        "y": 3.75,
+        "width": 5.0,
+        "height": 1.75,
+        "type": "table"
+    },
+    {
+        "id": "T2",
+        "label": "T2",
+        "x": 11.75,
+        "y": 3.75,
+        "width": 5.0,
+        "height": 1.75,
+        "type": "table"
+    },
+    {
+        "id": "T3",
+        "label": "T3",
+        "x": 2.25,
+        "y": 8.0,
+        "width": 5.0,
+        "height": 1.75,
+        "type": "table"
+    },
+    {
+        "id": "T4",
+        "label": "T4",
+        "x": 11.75,
+        "y": 8.0,
+        "width": 5.0,
+        "height": 1.75,
+        "type": "table"
+    },
+    {
+        "id": "T1-1",
+        "label": "1",
+        "x": 3.65,
+        "y": 3.2,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T1-2",
+        "label": "2",
+        "x": 5.85,
+        "y": 3.2,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T1-3",
+        "label": "3",
+        "x": 3.65,
+        "y": 6.05,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T1-4",
+        "label": "4",
+        "x": 5.85,
+        "y": 6.05,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T1-5",
+        "label": "5",
+        "x": 7.9,
+        "y": 4.62,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T2-1",
+        "label": "1",
+        "x": 13.15,
+        "y": 3.2,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T2-2",
+        "label": "2",
+        "x": 15.35,
+        "y": 3.2,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T2-3",
+        "label": "3",
+        "x": 13.15,
+        "y": 6.05,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T2-4",
+        "label": "4",
+        "x": 15.35,
+        "y": 6.05,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T2-5",
+        "label": "5",
+        "x": 17.4,
+        "y": 4.62,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T3-1",
+        "label": "1",
+        "x": 3.65,
+        "y": 7.45,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T3-2",
+        "label": "2",
+        "x": 5.85,
+        "y": 7.45,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T3-3",
+        "label": "3",
+        "x": 3.65,
+        "y": 10.3,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T3-4",
+        "label": "4",
+        "x": 5.85,
+        "y": 10.3,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T3-5",
+        "label": "5",
+        "x": 7.9,
+        "y": 8.88,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T4-1",
+        "label": "1",
+        "x": 13.15,
+        "y": 7.45,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T4-2",
+        "label": "2",
+        "x": 15.35,
+        "y": 7.45,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T4-3",
+        "label": "3",
+        "x": 13.15,
+        "y": 10.3,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T4-4",
+        "label": "4",
+        "x": 15.35,
+        "y": 10.3,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    },
+    {
+        "id": "T4-5",
+        "label": "5",
+        "x": 17.4,
+        "y": 8.88,
+        "width": 0.9,
+        "height": 0.9,
+        "type": "seat"
+    }
 ]');
 
 -- Students
diff --git a/backend/migrations/003_normalize_room_layout_units.sql b/backend/migrations/003_normalize_room_layout_units.sql
new file mode 100644
index 0000000..296a1a2
--- /dev/null
+++ b/backend/migrations/003_normalize_room_layout_units.sql
@@ -0,0 +1,26 @@
+-- Normalize room layout units: divide pixel-scale coordinates by 40.
+-- Only runs on rooms that contain at least one element with a coordinate > 50
+-- (i.e. still in pixel scale). Once identified, all elements are converted
+-- unconditionally — no per-element heuristic needed.
+UPDATE rooms
+SET layout_json = (
+    SELECT json_group_array(
+        json_object(
+            'id', json_extract(value, '$.id'),
+            'label', json_extract(value, '$.label'),
+            'x', ROUND(CAST(json_extract(value, '$.x') AS REAL) / 40.0, 2),
+            'y', ROUND(CAST(json_extract(value, '$.y') AS REAL) / 40.0, 2),
+            'width', ROUND(CAST(json_extract(value, '$.width') AS REAL) / 40.0, 2),
+            'height', ROUND(CAST(json_extract(value, '$.height') AS REAL) / 40.0, 2),
+            'type', json_extract(value, '$.type')
+        )
+    )
+    FROM json_each(rooms.layout_json)
+)
+WHERE EXISTS (
+    SELECT 1 FROM json_each(rooms.layout_json)
+    WHERE json_extract(value, '$.x') > 50
+       OR json_extract(value, '$.y') > 50
+       OR json_extract(value, '$.width') > 50
+       OR json_extract(value, '$.height') > 50
+);
diff --git a/backend/migrations/004_tutor_is_active.sql b/backend/migrations/004_tutor_is_active.sql
new file mode 100644
index 0000000..ae51ab9
--- /dev/null
+++ b/backend/migrations/004_tutor_is_active.sql
@@ -0,0 +1 @@
+ALTER TABLE tutors ADD COLUMN is_active BOOLEAN NOT NULL DEFAULT 1;
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 9920801..cc6da32 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -85,7 +85,14 @@ async fn main() {
     let listener = tokio::net::TcpListener::bind(&addr)
         .await
         .expect("failed to bind");
-    tracing::info!("listening on {}", addr);
+    let actual_addr = listener.local_addr().expect("failed to get local addr");
+    tracing::info!("listening on {}", actual_addr);
+
+    // When started with PORT=0 (random), write actual port so the test harness can discover it
+    if port == "0" {
+        let _ = std::fs::create_dir_all("data/test");
+        let _ = std::fs::write("data/test/.port", actual_addr.port().to_string());
+    }
 
     axum::serve(
         listener,
diff --git a/backend/src/models.rs b/backend/src/models.rs
index c352ba6..3baf034 100644
--- a/backend/src/models.rs
+++ b/backend/src/models.rs
@@ -14,6 +14,7 @@ pub struct Tutor {
     pub name: String,
     pub email: String,
     pub is_superadmin: bool,
+    pub is_active: bool,
 }
 
 #[derive(Debug, Clone, Serialize, sqlx::FromRow)]
@@ -48,6 +49,8 @@ pub struct Slot {
     pub end_time: String,
     pub status: String,
     pub code: Option<String>,
+    #[sqlx(skip)]
+    pub layout: Option<Vec<LayoutElement>>,
 }
 
 #[derive(Debug, Clone, Serialize, sqlx::FromRow)]
@@ -131,6 +134,10 @@ pub struct AssignTutor {
     pub tutor_id: i64,
 }
 #[derive(Deserialize)]
+pub struct SetTutorActive {
+    pub is_active: bool,
+}
+#[derive(Deserialize)]
 pub struct CheckinRequest {
     pub code: String,
     pub student_id: i64,
diff --git a/backend/src/routes/attendance.rs b/backend/src/routes/attendance.rs
index 7ff72a2..1731b56 100644
--- a/backend/src/routes/attendance.rs
+++ b/backend/src/routes/attendance.rs
@@ -79,14 +79,52 @@ async fn get_session_attendance(
     .fetch_all(&pool)
     .await?;
 
-    // Get all slots for the session
-    let slots: Vec<crate::models::Slot> = sqlx::query_as(
-        "SELECT id, session_id, room_id, tutor_id, start_time, end_time, status, code FROM slots WHERE session_id = ?"
+    type SlotRow = (
+        i64,
+        i64,
+        Option<i64>,
+        i64,
+        String,
+        String,
+        String,
+        Option<String>,
+        Option<String>,
+    );
+    let slot_rows: Vec<SlotRow> = sqlx::query_as(
+        "SELECT s.id, s.session_id, s.room_id, s.tutor_id, s.start_time, s.end_time, s.status, s.code, r.layout_json
+         FROM slots s
+         LEFT JOIN rooms r ON s.room_id = r.id
+         WHERE s.session_id = ?"
     )
     .bind(session_id)
     .fetch_all(&pool)
     .await?;
 
+    let mut slots = Vec::new();
+    for row in slot_rows {
+        let layout: Option<Vec<crate::models::LayoutElement>> = match row.8 {
+            Some(ref json_str) => match serde_json::from_str(json_str) {
+                Ok(v) => Some(v),
+                Err(e) => {
+                    tracing::error!(slot_id = row.0, err = %e, "failed to deserialize room layout_json");
+                    None
+                }
+            },
+            None => None,
+        };
+        slots.push(crate::models::Slot {
+            id: row.0,
+            session_id: row.1,
+            room_id: row.2,
+            tutor_id: row.3,
+            start_time: row.4,
+            end_time: row.5,
+            status: row.6,
+            code: row.7,
+            layout,
+        });
+    }
+
     // Get all attendances for these slots
     let attendances: Vec<crate::models::Attendance> = sqlx::query_as(
         "SELECT id, slot_id, student_id, seat_id, checked_in_at FROM attendances WHERE slot_id IN (SELECT id FROM slots WHERE session_id = ?)"
diff --git a/backend/src/routes/auth_routes.rs b/backend/src/routes/auth_routes.rs
index a642402..206ce00 100644
--- a/backend/src/routes/auth_routes.rs
+++ b/backend/src/routes/auth_routes.rs
@@ -24,14 +24,14 @@ async fn login(
     jar: CookieJar,
     Json(req): Json<LoginRequest>,
 ) -> Result<(CookieJar, Json<Value>), AppError> {
-    let tutor: Option<(i64, String, String, bool)> = sqlx::query_as(
-        "SELECT id, email, password_hash, is_superadmin FROM tutors WHERE email = ?",
+    let tutor: Option<(i64, String, String, bool, bool)> = sqlx::query_as(
+        "SELECT id, email, password_hash, is_superadmin, is_active FROM tutors WHERE email = ?",
     )
     .bind(&req.email)
     .fetch_optional(&state.pool)
     .await?;
 
-    let (id, _email, hash, is_superadmin) = tutor.ok_or(AppError::Unauthorized)?;
+    let (id, _email, hash, is_superadmin, is_active) = tutor.ok_or(AppError::Unauthorized)?;
 
     let mut rehash_needed = false;
     let mut authed = false;
@@ -57,6 +57,11 @@ async fn login(
         return Err(AppError::Unauthorized);
     }
 
+    // Reject inactive tutors AFTER password verification to avoid timing attacks or info leakage
+    if !is_active {
+        return Err(AppError::Unauthorized);
+    }
+
     // Lazy rehash to Argon2 if we used bcrypt
     if rehash_needed {
         let salt = SaltString::generate(&mut rand::thread_rng());
@@ -106,6 +111,15 @@ async fn refresh(
 
     let claims = auth::decode_jwt(&refresh_token, &state.jwt_secret, true)?;
 
+    // Re-check is_active so deactivated tutors cannot refresh their session
+    let is_active: Option<bool> = sqlx::query_scalar("SELECT is_active FROM tutors WHERE id = ?")
+        .bind(claims.sub)
+        .fetch_optional(&state.pool)
+        .await?;
+    if !is_active.unwrap_or(false) {
+        return Err(AppError::Unauthorized);
+    }
+
     // Issue new access token
     let access_token =
         auth::encode_jwt(claims.sub, claims.is_superadmin, &state.jwt_secret, false)?;
@@ -172,10 +186,11 @@ mod tests {
     #[sqlx::test(migrations = "./migrations")]
     async fn login_returns_superadmin_and_cookies(pool: sqlx::SqlitePool) {
         let hash = bcrypt::hash("secret", 4).unwrap();
-        sqlx::query("INSERT INTO tutors (name,email,password_hash) VALUES (?,?,?)")
+        sqlx::query("INSERT INTO tutors (name,email,password_hash,is_active) VALUES (?,?,?,?)")
             .bind("Test")
             .bind("t@test.com")
             .bind(&hash)
+            .bind(true)
             .execute(&pool)
             .await
             .unwrap();
diff --git a/backend/src/routes/courses.rs b/backend/src/routes/courses.rs
index c0f3595..d9c5321 100644
--- a/backend/src/routes/courses.rs
+++ b/backend/src/routes/courses.rs
@@ -65,6 +65,20 @@ async fn assign_tutor(
     if !claims.is_superadmin {
         return Err(AppError::Unauthorized);
     }
+
+    // Verify tutor exists and is active
+    let maybe_active: Option<bool> =
+        sqlx::query_scalar("SELECT is_active FROM tutors WHERE id = ?")
+            .bind(req.tutor_id)
+            .fetch_optional(&pool)
+            .await?;
+    let is_active = maybe_active.ok_or(AppError::NotFound)?;
+    if !is_active {
+        return Err(AppError::BadRequest(
+            "Tutor:in ist inaktiv und kann nicht zugewiesen werden.".into(),
+        ));
+    }
+
     sqlx::query("INSERT OR IGNORE INTO tutor_courses (tutor_id, course_id) VALUES (?, ?)")
         .bind(req.tutor_id)
         .bind(course_id)
@@ -101,7 +115,7 @@ async fn list_assigned_tutors(
     }
 
     let tutors = sqlx::query_as::<_, crate::models::Tutor>(
-        "SELECT t.id, t.name, t.email, t.is_superadmin FROM tutors t
+        "SELECT t.id, t.name, t.email, t.is_superadmin, t.is_active FROM tutors t
          JOIN tutor_courses tc ON tc.tutor_id = t.id
          WHERE tc.course_id = ?",
     )
diff --git a/backend/src/routes/rooms.rs b/backend/src/routes/rooms.rs
index 0835628..29a0779 100644
--- a/backend/src/routes/rooms.rs
+++ b/backend/src/routes/rooms.rs
@@ -51,6 +51,23 @@ fn validate_layout(layout: &[LayoutElement]) -> Result<(), AppError> {
                 "x, y, width, height must all be >= 0.0".into(),
             ));
         }
+        // MAX_CANVAS = 100 bound
+        if elem.x + elem.width > 100.0 || elem.y + elem.height > 100.0 {
+            return Err(AppError::BadRequest(
+                "element outside of 100x100 canvas".into(),
+            ));
+        }
+        // 0.5-step multiple check — use epsilon comparison to avoid IEEE-754 fract() edge cases
+        let not_half_step = |v: f64| ((v * 2.0).round() - v * 2.0).abs() > f64::EPSILON;
+        if not_half_step(elem.x)
+            || not_half_step(elem.y)
+            || not_half_step(elem.width)
+            || not_half_step(elem.height)
+        {
+            return Err(AppError::BadRequest(
+                "coords/dims must be multiples of 0.5".into(),
+            ));
+        }
         // seat labels must be unique among seats
         if elem.kind == "seat" {
             if elem.label.is_empty() {
@@ -143,10 +160,39 @@ async fn update_room_layout(
     Ok(Json(json!({"id": id})))
 }
 
+async fn delete_room(
+    _claims: TutorClaims,
+    State(pool): State<SqlitePool>,
+    Path(id): Path<i64>,
+) -> Result<StatusCode, AppError> {
+    // Check if room is attached to any slots
+    let slot_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM slots WHERE room_id = ?")
+        .bind(id)
+        .fetch_one(&pool)
+        .await?;
+    if slot_count > 0 {
+        return Err(AppError::Conflict(format!(
+            "Raum hat noch {} Slot(s). Bitte zuerst entfernen.",
+            slot_count
+        )));
+    }
+
+    let result = sqlx::query("DELETE FROM rooms WHERE id = ?")
+        .bind(id)
+        .execute(&pool)
+        .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(AppError::NotFound);
+    }
+
+    Ok(StatusCode::NO_CONTENT)
+}
+
 pub fn router() -> Router<AppState> {
     Router::new()
         .route("/api/admin/rooms", get(list_rooms).post(create_room))
-        .route("/api/admin/rooms/{id}", get(get_room))
+        .route("/api/admin/rooms/{id}", get(get_room).delete(delete_room))
         .route("/api/admin/rooms/{id}/layout", put(update_room_layout))
 }
 
@@ -321,6 +367,89 @@ mod tests {
         assert_eq!(status, StatusCode::BAD_REQUEST);
     }
 
+    #[sqlx::test(migrations = "./migrations")]
+    async fn layout_validation_rejects_out_of_bounds(pool: sqlx::SqlitePool) {
+        let (app, auth) = build_test_app(pool).await;
+        let layout = json!([
+            {"id":"s1","label":"A1","x":99.0,"y":0.0,"width":2.0,"height":1.0,"type":"seat"}
+        ]);
+        let (status, _) = post_json(
+            app,
+            "/api/admin/rooms",
+            &auth,
+            json!({"name":"Bad","layout":layout}),
+        )
+        .await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn layout_validation_rejects_non_step(pool: sqlx::SqlitePool) {
+        let (app, auth) = build_test_app(pool).await;
+        let layout = json!([
+            {"id":"s1","label":"A1","x":0.1,"y":0.0,"width":1.0,"height":1.0,"type":"seat"}
+        ]);
+        let (status, _) = post_json(
+            app,
+            "/api/admin/rooms",
+            &auth,
+            json!({"name":"Bad","layout":layout}),
+        )
+        .await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn delete_room_with_no_slots_succeeds(pool: sqlx::SqlitePool) {
+        use crate::test_helpers::delete;
+        let (app, auth) = build_test_app(pool.clone()).await;
+        // create room
+        let (_, body) = post_json(
+            app.clone(),
+            "/api/admin/rooms",
+            &auth,
+            json!({"name":"R1","layout":[{"id":"s1","label":"A1","x":0.0,"y":0.0,"width":1.0,"height":1.0,"type":"seat"}]}),
+        )
+        .await;
+        let id = serde_json::from_slice::<Value>(&body).unwrap()["id"]
+            .as_i64()
+            .unwrap();
+
+        let (status, _) = delete(app, &format!("/api/admin/rooms/{id}"), &auth).await;
+        assert_eq!(status, StatusCode::NO_CONTENT);
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn delete_room_with_slot_returns_409(pool: sqlx::SqlitePool) {
+        use crate::test_helpers::delete;
+        let (app, auth) = build_test_app(pool.clone()).await;
+        // create room
+        let (_, body) = post_json(
+            app.clone(),
+            "/api/admin/rooms",
+            &auth,
+            json!({"name":"R1","layout":[{"id":"s1","label":"A1","x":0.0,"y":0.0,"width":1.0,"height":1.0,"type":"seat"}]}),
+        )
+        .await;
+        let room_id = serde_json::from_slice::<Value>(&body).unwrap()["id"]
+            .as_i64()
+            .unwrap();
+
+        let course_id: i64 = sqlx::query_scalar(
+            "INSERT INTO courses (name, semester) VALUES ('FP', 'SS2026') RETURNING id",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        let session_id: i64 = sqlx::query_scalar("INSERT INTO sessions (course_id, week_nr, date) VALUES (?, 1, '2026-05-04') RETURNING id").bind(course_id).fetch_one(&pool).await.unwrap();
+        sqlx::query("INSERT INTO slots (session_id, room_id, tutor_id, start_time, end_time, status) VALUES (?, ?, 1, '09:00', '10:00', 'open')")
+            .bind(session_id).bind(room_id).execute(&pool).await.unwrap();
+
+        let (status, body) = delete(app, &format!("/api/admin/rooms/{room_id}"), &auth).await;
+        assert_eq!(status, StatusCode::CONFLICT);
+        assert!(String::from_utf8_lossy(&body).contains("Slot"));
+    }
+
     #[sqlx::test(migrations = "./migrations")]
     async fn get_room_not_found(pool: sqlx::SqlitePool) {
         let (app, auth) = build_test_app(pool).await;
diff --git a/backend/src/routes/sessions.rs b/backend/src/routes/sessions.rs
index e615905..bdaf338 100644
--- a/backend/src/routes/sessions.rs
+++ b/backend/src/routes/sessions.rs
@@ -108,16 +108,19 @@ async fn create_slot(
     // Verify requesting tutor has access to the course
     super::verify_tutor_course_access(&pool, claims.sub, course_id).await?;
 
-    // Verify the slot's tutor_id belongs to this course
-    let member: Option<(i64,)> =
-        sqlx::query_as("SELECT 1 FROM tutor_courses WHERE tutor_id = ? AND course_id = ?")
-            .bind(req.tutor_id)
-            .bind(course_id)
-            .fetch_optional(&pool)
-            .await?;
+    // Verify the slot's tutor_id belongs to this course AND is active
+    let member: Option<(i64,)> = sqlx::query_as(
+        "SELECT 1 FROM tutor_courses tc
+                        JOIN tutors t ON t.id = tc.tutor_id
+                        WHERE tc.tutor_id = ? AND tc.course_id = ? AND t.is_active = 1",
+    )
+    .bind(req.tutor_id)
+    .bind(course_id)
+    .fetch_optional(&pool)
+    .await?;
     if member.is_none() {
         return Err(AppError::BadRequest(
-            "tutor_id is not a member of this course".into(),
+            "Tutor:in ist in diesem Kurs nicht aktiv oder existiert nicht.".into(),
         ));
     }
 
diff --git a/backend/src/routes/tutors.rs b/backend/src/routes/tutors.rs
index 4810761..b21e03c 100644
--- a/backend/src/routes/tutors.rs
+++ b/backend/src/routes/tutors.rs
@@ -2,13 +2,13 @@ use crate::{
     AppState,
     auth::TutorClaims,
     error::AppError,
-    models::{CreateTutor, Tutor},
+    models::{CreateTutor, SetTutorActive, Tutor},
 };
 use axum::{
     Json, Router,
     extract::{Path, State},
     http::StatusCode,
-    routing::{delete, get},
+    routing::{delete, get, patch},
 };
 use sqlx::SqlitePool;
 
@@ -21,7 +21,7 @@ async fn list_tutors(
     }
 
     let tutors = sqlx::query_as::<_, Tutor>(
-        "SELECT id, name, email, is_superadmin FROM tutors ORDER BY name",
+        "SELECT id, name, email, is_superadmin, is_active FROM tutors ORDER BY name",
     )
     .fetch_all(&pool)
     .await?;
@@ -50,7 +50,7 @@ async fn create_tutor(
         .to_string();
 
     let id = sqlx::query(
-        "INSERT INTO tutors (name, email, password_hash, is_superadmin) VALUES (?, ?, ?, ?)",
+        "INSERT INTO tutors (name, email, password_hash, is_superadmin, is_active) VALUES (?, ?, ?, ?, 1)",
     )
     .bind(&req.name)
     .bind(&req.email)
@@ -67,10 +67,39 @@ async fn create_tutor(
             name: req.name,
             email: req.email,
             is_superadmin: req.is_superadmin,
+            is_active: true,
         }),
     ))
 }
 
+async fn set_tutor_active(
+    claims: TutorClaims,
+    State(pool): State<SqlitePool>,
+    Path(id): Path<i64>,
+    Json(req): Json<SetTutorActive>,
+) -> Result<StatusCode, AppError> {
+    if !claims.is_superadmin {
+        return Err(AppError::Unauthorized);
+    }
+
+    // Don't allow deactivating yourself
+    if claims.sub == id && !req.is_active {
+        return Err(AppError::Conflict("cannot deactivate yourself".into()));
+    }
+
+    let result = sqlx::query("UPDATE tutors SET is_active = ? WHERE id = ?")
+        .bind(req.is_active)
+        .bind(id)
+        .execute(&pool)
+        .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(AppError::NotFound);
+    }
+
+    Ok(StatusCode::NO_CONTENT)
+}
+
 async fn delete_tutor(
     claims: TutorClaims,
     State(pool): State<SqlitePool>,
@@ -85,16 +114,243 @@ async fn delete_tutor(
         return Err(AppError::Conflict("cannot delete yourself".into()));
     }
 
-    sqlx::query("DELETE FROM tutors WHERE id = ?")
-        .bind(id)
-        .execute(&pool)
-        .await?;
+    // Wrap reference checks and DELETE in one transaction to avoid TOCTOU
+    let mut tx = pool.begin().await?;
 
+    let course_count: i64 =
+        sqlx::query_scalar("SELECT COUNT(*) FROM tutor_courses WHERE tutor_id = ?")
+            .bind(id)
+            .fetch_one(&mut *tx)
+            .await?;
+    if course_count > 0 {
+        return Err(AppError::Conflict(format!(
+            "Tutor:in hat noch {} Kurszuordnung(en). Bitte zuerst entfernen oder deaktivieren.",
+            course_count
+        )));
+    }
+
+    let slot_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM slots WHERE tutor_id = ?")
+        .bind(id)
+        .fetch_one(&mut *tx)
+        .await?;
+    if slot_count > 0 {
+        return Err(AppError::Conflict(format!(
+            "Tutor:in hat noch {} Slot(s). Bitte zuerst entfernen oder deaktivieren.",
+            slot_count
+        )));
+    }
+
+    let note_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM notes WHERE tutor_id = ?")
+        .bind(id)
+        .fetch_one(&mut *tx)
+        .await?;
+    if note_count > 0 {
+        return Err(AppError::Conflict(format!(
+            "Tutor:in hat noch {} Notiz(en). Bitte zuerst entfernen oder deaktivieren.",
+            note_count
+        )));
+    }
+
+    match sqlx::query("DELETE FROM tutors WHERE id = ?")
+        .bind(id)
+        .execute(&mut *tx)
+        .await
+    {
+        Ok(_) => {}
+        Err(sqlx::Error::Database(e)) if e.message().contains("FOREIGN KEY") => {
+            return Err(AppError::Conflict(
+                "Tutor:in hat noch Verweise in der Datenbank.".into(),
+            ));
+        }
+        Err(e) => return Err(AppError::Db(e)),
+    }
+
+    tx.commit().await?;
     Ok(StatusCode::NO_CONTENT)
 }
-
 pub fn router() -> Router<AppState> {
     Router::new()
         .route("/api/admin/tutors", get(list_tutors).post(create_tutor))
         .route("/api/admin/tutors/{id}", delete(delete_tutor))
+        .route("/api/admin/tutors/{id}/active", patch(set_tutor_active))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_helpers::{build_test_admin_app, delete, patch_json};
+    use argon2::PasswordHasher;
+    use serde_json::json;
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn delete_tutor_with_no_refs_succeeds(pool: SqlitePool) {
+        let (app, auth) = build_test_admin_app(pool.clone()).await;
+
+        // Create a tutor to delete
+        let hash = bcrypt::hash("test", 4).unwrap();
+        let id: i64 = sqlx::query_scalar("INSERT INTO tutors (name, email, password_hash, is_superadmin, is_active) VALUES ('DeleteMe', 'del@test.com', ?, 0, 1) RETURNING id")
+            .bind(hash)
+            .fetch_one(&pool)
+            .await.unwrap();
+
+        let status = delete(app, &format!("/api/admin/tutors/{}", id), &auth)
+            .await
+            .0;
+        assert_eq!(status, StatusCode::NO_CONTENT);
+
+        let exists: bool = sqlx::query_scalar("SELECT EXISTS(SELECT 1 FROM tutors WHERE id = ?)")
+            .bind(id)
+            .fetch_one(&pool)
+            .await
+            .unwrap();
+        assert!(!exists);
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn delete_tutor_with_course_assignment_returns_409(pool: SqlitePool) {
+        let (app, auth) = build_test_admin_app(pool.clone()).await;
+
+        let id: i64 = sqlx::query_scalar("INSERT INTO tutors (name, email, password_hash, is_superadmin, is_active) VALUES ('CourseTutor', 'course@test.com', 'hash', 0, 1) RETURNING id")
+            .fetch_one(&pool).await.unwrap();
+        let course_id: i64 = sqlx::query_scalar(
+            "INSERT INTO courses (name, semester) VALUES ('FP', 'SS2026') RETURNING id",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        sqlx::query("INSERT INTO tutor_courses (tutor_id, course_id) VALUES (?, ?)")
+            .bind(id)
+            .bind(course_id)
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        let (status, body) = delete(app, &format!("/api/admin/tutors/{}", id), &auth).await;
+        assert_eq!(status, StatusCode::CONFLICT);
+        assert!(String::from_utf8_lossy(&body).contains("Kurszuordnung"));
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn delete_tutor_with_slot_returns_409(pool: SqlitePool) {
+        let (app, auth) = build_test_admin_app(pool.clone()).await;
+
+        let id: i64 = sqlx::query_scalar("INSERT INTO tutors (name, email, password_hash, is_superadmin, is_active) VALUES ('SlotTutor', 'slot@test.com', 'hash', 0, 1) RETURNING id")
+            .fetch_one(&pool).await.unwrap();
+        let course_id: i64 = sqlx::query_scalar(
+            "INSERT INTO courses (name, semester) VALUES ('FP', 'SS2026') RETURNING id",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        let session_id: i64 = sqlx::query_scalar("INSERT INTO sessions (course_id, week_nr, date) VALUES (?, 1, '2026-05-04') RETURNING id")
+            .bind(course_id).fetch_one(&pool).await.unwrap();
+        sqlx::query("INSERT INTO slots (session_id, tutor_id, start_time, end_time, status) VALUES (?, ?, '09:00', '10:00', 'closed')")
+            .bind(session_id).bind(id).execute(&pool).await.unwrap();
+
+        let (status, body) = delete(app, &format!("/api/admin/tutors/{}", id), &auth).await;
+        assert_eq!(status, StatusCode::CONFLICT);
+        assert!(String::from_utf8_lossy(&body).contains("Slot"));
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn delete_tutor_with_note_returns_409(pool: SqlitePool) {
+        let (app, auth) = build_test_admin_app(pool.clone()).await;
+
+        let id: i64 = sqlx::query_scalar("INSERT INTO tutors (name, email, password_hash, is_superadmin, is_active) VALUES ('NoteTutor', 'note@test.com', 'hash', 0, 1) RETURNING id")
+            .fetch_one(&pool).await.unwrap();
+        let course_id: i64 = sqlx::query_scalar(
+            "INSERT INTO courses (name, semester) VALUES ('FP', 'SS2026') RETURNING id",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        let student_id: i64 = sqlx::query_scalar(
+            "INSERT INTO students (course_id, name) VALUES (?, 'Alice') RETURNING id",
+        )
+        .bind(course_id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        let session_id: i64 = sqlx::query_scalar("INSERT INTO sessions (course_id, week_nr, date) VALUES (?, 1, '2026-05-04') RETURNING id")
+            .bind(course_id).fetch_one(&pool).await.unwrap();
+        let slot_id: i64 = sqlx::query_scalar("INSERT INTO slots (session_id, tutor_id, start_time, end_time, status) VALUES (?, ?, '09:00', '10:00', 'closed') RETURNING id")
+            .bind(session_id).bind(1).fetch_one(&pool).await.unwrap(); // Bind to admin
+
+        sqlx::query("INSERT INTO notes (slot_id, student_id, tutor_id, content, updated_at) VALUES (?, ?, ?, 'test', '2026-05-04T10:00:00Z')")
+            .bind(slot_id).bind(student_id).bind(id).execute(&pool).await.unwrap();
+
+        let (status, body) = delete(app, &format!("/api/admin/tutors/{}", id), &auth).await;
+        assert_eq!(status, StatusCode::CONFLICT);
+        assert!(String::from_utf8_lossy(&body).contains("Notiz"));
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn delete_self_returns_409(pool: SqlitePool) {
+        let (app, auth) = build_test_admin_app(pool.clone()).await;
+        let admin_id: i64 =
+            sqlx::query_scalar("SELECT id FROM tutors WHERE email = 'admin@test.com'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+
+        let (status, body) = delete(app, &format!("/api/admin/tutors/{}", admin_id), &auth).await;
+        assert_eq!(status, StatusCode::CONFLICT);
+        assert!(String::from_utf8_lossy(&body).contains("cannot delete yourself"));
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn cannot_deactivate_self_returns_409(pool: SqlitePool) {
+        let (app, auth) = build_test_admin_app(pool.clone()).await;
+        let admin_id: i64 =
+            sqlx::query_scalar("SELECT id FROM tutors WHERE email = 'admin@test.com'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+
+        let (status, body) = patch_json(
+            app,
+            &format!("/api/admin/tutors/{}/active", admin_id),
+            &auth,
+            json!({"is_active": false}),
+        )
+        .await;
+        assert_eq!(status, StatusCode::CONFLICT);
+        assert!(String::from_utf8_lossy(&body).contains("cannot deactivate yourself"));
+    }
+
+    #[sqlx::test(migrations = "./migrations")]
+    async fn set_active_false_then_login_fails(pool: SqlitePool) {
+        let (app, auth) = build_test_admin_app(pool.clone()).await;
+
+        let hash = argon2::Argon2::default()
+            .hash_password(
+                "pass".as_bytes(),
+                &argon2::password_hash::SaltString::generate(&mut rand::thread_rng()),
+            )
+            .unwrap()
+            .to_string();
+        let id: i64 = sqlx::query_scalar("INSERT INTO tutors (name, email, password_hash, is_superadmin, is_active) VALUES ('LoginFail', 'fail@test.com', ?, 0, 1) RETURNING id")
+            .bind(hash).fetch_one(&pool).await.unwrap();
+
+        // Deactivate
+        let status = patch_json(
+            app.clone(),
+            &format!("/api/admin/tutors/{}/active", id),
+            &auth,
+            json!({"is_active": false}),
+        )
+        .await
+        .0;
+        assert_eq!(status, StatusCode::NO_CONTENT);
+
+        // Attempt login
+        let (status, _) = crate::test_helpers::post_json(
+            app,
+            "/api/auth/login",
+            "",
+            json!({"email": "fail@test.com", "password": "pass"}),
+        )
+        .await;
+        assert_eq!(status, StatusCode::UNAUTHORIZED);
+    }
 }
diff --git a/backend/src/test_helpers.rs b/backend/src/test_helpers.rs
index d12bf09..f609742 100644
--- a/backend/src/test_helpers.rs
+++ b/backend/src/test_helpers.rs
@@ -17,7 +17,7 @@ pub async fn make_token(
 ) -> String {
     let hash = bcrypt::hash("testpass", 4).unwrap();
     sqlx::query(
-        "INSERT OR IGNORE INTO tutors (name,email,password_hash,is_superadmin) VALUES (?,?,?,?)",
+        "INSERT OR IGNORE INTO tutors (name,email,password_hash,is_superadmin,is_active) VALUES (?,?,?,?,1)",
     )
     .bind("Test Tutor")
     .bind(email)
diff --git a/frontend/src/app.css b/frontend/src/app.css
index 9aa2a9a..866fb48 100644
--- a/frontend/src/app.css
+++ b/frontend/src/app.css
@@ -80,6 +80,7 @@ body, .ui {
 
 .pill.open { color: var(--amber); background: rgba(176,125,42,0.08); }
 .pill.closed { color: var(--ink-3); }
+.pill.inactive { color: var(--ink-4); border-style: dashed; }
 .pill.locked { color: var(--accent); background: rgba(138,44,31,0.06); }
 .pill.present { color: var(--green); background: rgba(74,107,58,0.08); }
 .pill.absent { color: var(--accent); }
diff --git a/frontend/src/lib/RoomCanvas.svelte b/frontend/src/lib/RoomCanvas.svelte
index 32caf8d..8314b75 100644
--- a/frontend/src/lib/RoomCanvas.svelte
+++ b/frontend/src/lib/RoomCanvas.svelte
@@ -4,7 +4,9 @@
     interface Props {
         elements: LayoutElement[];
         editable?: boolean;
-        onElementClick?: (el: LayoutElement) => void;
+        clickable?: boolean;
+        snapStep?: number;
+        onElementClick?: (el: LayoutElement | null) => void;
         onLayoutChange?: (elements: LayoutElement[]) => void;
         selectedId?: string | null;
         occupiedSeatIds?: string[];
@@ -15,6 +17,8 @@
     let { 
         elements = $bindable([]), 
         editable = false, 
+        clickable = false,
+        snapStep = 0.5,
         onElementClick, 
         onLayoutChange,
         selectedId = null,
@@ -24,57 +28,148 @@
     }: Props = $props();
 
     let draggingId = $state<string | null>(null);
+    let resizingId = $state<string | null>(null);
+    let resizeDir = $state<'e' | 's' | 'se' | null>(null);
+
     let startX = 0;
     let startY = 0;
+    let initialX = 0;
+    let initialY = 0;
+    let initialW = 0;
+    let initialH = 0;
+    let dragMoved = false;
+
+    const GRID_SIZE = 40;
 
     function handleMouseDown(e: MouseEvent, el: LayoutElement) {
-        if (!editable) {
+        if (clickable && !editable) {
             onElementClick?.(el);
             return;
         }
+        if (!editable) return;
+
         draggingId = el.id;
-        startX = e.clientX - el.x * 40;
-        startY = e.clientY - el.y * 40;
+        dragMoved = false;
+        startX = e.clientX;
+        startY = e.clientY;
+        initialX = el.x;
+        initialY = el.y;
+        e.stopPropagation();
     }
 
-    function handleMouseMove(e: MouseEvent) {
-        if (!draggingId || !editable) return;
-        const index = elements.findIndex((el: LayoutElement) => el.id === draggingId);
-        if (index === -1) return;
-        const el = elements[index];
-        if (!el) return;
-
-        const newX = Math.round((e.clientX - startX) / 10) * 10 / 40;
-        const newY = Math.round((e.clientY - startY) / 10) * 10 / 40;
-
-        elements[index] = { ...el, x: newX, y: newY };
+    function handleResizeDown(e: MouseEvent, el: LayoutElement, dir: 'e' | 's' | 'se') {
+        if (!editable) return;
+        resizingId = el.id;
+        resizeDir = dir;
+        startX = e.clientX;
+        startY = e.clientY;
+        initialW = el.width;
+        initialH = el.height;
+        e.stopPropagation();
     }
 
-    function handleMouseUp() {
-        if (draggingId && editable) {
-            onLayoutChange?.(elements);
+    function handleWindowMouseMove(e: MouseEvent) {
+        if (!editable) return;
+
+        if (draggingId) {
+            dragMoved = true;
+            const index = elements.findIndex(el => el.id === draggingId);
+            if (index !== -1) {
+                const dx = (e.clientX - startX) / GRID_SIZE;
+                const dy = (e.clientY - startY) / GRID_SIZE;
+                
+                let newX = initialX + dx;
+                let newY = initialY + dy;
+                
+                if (snapStep > 0) {
+                    newX = Math.round(newX / snapStep) * snapStep;
+                    newY = Math.round(newY / snapStep) * snapStep;
+                }
+
+                const currentEl = elements[index];
+                if (currentEl) {
+                    elements[index] = { ...currentEl, x: Math.max(0, newX), y: Math.max(0, newY) };
+                }
+            }
+        } else if (resizingId && resizeDir) {
+            const index = elements.findIndex(el => el.id === resizingId);
+            if (index !== -1) {
+                const dx = (e.clientX - startX) / GRID_SIZE;
+                const dy = (e.clientY - startY) / GRID_SIZE;
+                
+                let newW = initialW;
+                let newH = initialH;
+
+                if (resizeDir.includes('e')) newW = initialW + dx;
+                if (resizeDir.includes('s')) newH = initialH + dy;
+
+                if (snapStep > 0) {
+                    newW = Math.round(newW / snapStep) * snapStep;
+                    newH = Math.round(newH / snapStep) * snapStep;
+                }
+
+                const currentEl = elements[index];
+                if (currentEl) {
+                    elements[index] = { 
+                        ...currentEl, 
+                        width: Math.max(snapStep || 0.1, newW), 
+                        height: Math.max(snapStep || 0.1, newH) 
+                    };
+                }
+            }
+        }
+    }
+
+    function handleWindowMouseUp() {
+        if (editable) {
+            if (draggingId) {
+                if (dragMoved) {
+                    onLayoutChange?.(elements);
+                } else {
+                    const el = elements.find(e => e.id === draggingId);
+                    if (el) onElementClick?.(el);
+                }
+            } else if (resizingId) {
+                onLayoutChange?.(elements);
+            }
         }
         draggingId = null;
+        resizingId = null;
+        resizeDir = null;
+        dragMoved = false;
     }
 
-    const GRID_SIZE = 40;
+    // Compute viewBox based on elements or default
+    let maxX = $derived(elements.reduce((max, el) => Math.max(max, el.x + el.width), 20));
+    let maxY = $derived(elements.reduce((max, el) => Math.max(max, el.y + el.height), 15));
+    let viewBox = $derived(`0 0 ${Math.ceil(maxX * GRID_SIZE)} ${Math.ceil(maxY * GRID_SIZE)}`);
 </script>
 
+<svelte:window 
+    onmousemove={handleWindowMouseMove} 
+    onmouseup={handleWindowMouseUp} 
+/>
+
 <!-- svelte-ignore a11y_no_static_element_interactions -->
+<!-- svelte-ignore a11y_click_events_have_key_events -->
 <svg 
-    width="800" 
-    height="600" 
+    {viewBox}
+    preserveAspectRatio="xMidYMid meet"
     class="room-canvas" 
     class:editable
-    onmousemove={handleMouseMove}
-    onmouseup={handleMouseUp}
-    onmouseleave={handleMouseUp}
+    class:clickable={clickable || editable}
+    onclick={(e) => {
+        // Deselect if clicking on empty canvas
+        if (editable && e.target === e.currentTarget) {
+            onElementClick?.(null);
+        }
+    }}
 >
     <!-- Grid -->
-    {#if editable}
+    {#if editable && snapStep > 0}
         <defs>
-            <pattern id="grid" width={GRID_SIZE} height={GRID_SIZE} patternUnits="userSpaceOnUse">
-                <path d="M {GRID_SIZE} 0 L 0 0 0 {GRID_SIZE}" fill="none" stroke="#eee" stroke-width="1"/>
+            <pattern id="grid" width={GRID_SIZE * snapStep} height={GRID_SIZE * snapStep} patternUnits="userSpaceOnUse">
+                <path d="M {GRID_SIZE * snapStep} 0 L 0 0 0 {GRID_SIZE * snapStep}" fill="none" stroke="var(--rule-soft)" stroke-width="1" stroke-dasharray="2,2"/>
             </pattern>
         </defs>
         <rect width="100%" height="100%" fill="url(#grid)" />
@@ -93,7 +188,7 @@
                 <rect 
                     width={el.width * GRID_SIZE} 
                     height={el.height * GRID_SIZE} 
-                    rx="4"
+                    rx="8"
                 />
                 <text 
                     x={(el.width * GRID_SIZE) / 2} 
@@ -106,7 +201,7 @@
                 {#if studentNames[el.id]}
                     <text 
                         x={(el.width * GRID_SIZE) / 2} 
-                        y={(el.height * GRID_SIZE) + 15} 
+                        y={(el.height * GRID_SIZE) + 14} 
                         text-anchor="middle" 
                         class="student-name"
                     >
@@ -117,72 +212,124 @@
                 <rect 
                     width={el.width * GRID_SIZE} 
                     height={el.height * GRID_SIZE} 
-                    fill="#e9ecef"
-                    stroke="#dee2e6"
+                    rx="16"
                 />
+            {:else if el.type === 'gap'}
+                <!-- Invisible interaction target -->
+                <rect 
+                    width={el.width * GRID_SIZE} 
+                    height={el.height * GRID_SIZE} 
+                    fill="transparent"
+                    stroke={editable ? "var(--rule)" : "none"}
+                    stroke-dasharray="4,4"
+                />
+                {#if editable}
+                    <text 
+                        x={(el.width * GRID_SIZE) / 2} 
+                        y={(el.height * GRID_SIZE) / 2} 
+                        text-anchor="middle" 
+                        dominant-baseline="middle"
+                        style="font-size: 10px; fill: var(--ink-4);"
+                    >
+                        GAP
+                    </text>
+                {/if}
             {:else if el.type === 'door'}
                 <rect 
                     width={el.width * GRID_SIZE} 
                     height={el.height * GRID_SIZE} 
-                    fill="#ffeeba"
-                    stroke="#ffe082"
+                    fill="transparent"
+                    stroke="var(--rule)"
+                    stroke-width="2"
                 />
                 <text 
                     x={(el.width * GRID_SIZE) / 2} 
                     y={(el.height * GRID_SIZE) / 2} 
                     text-anchor="middle" 
                     dominant-baseline="middle"
-                    style="font-size: 10px;"
+                    style="font-size: 10px; fill: var(--ink-3); font-family: var(--mono); letter-spacing: 0.1em;"
                 >
                     DOOR
                 </text>
             {/if}
+
+            {#if editable && selectedId === el.id}
+                <!-- Resize handles -->
+                <rect class="resize-handle e" x={el.width * GRID_SIZE - 4} y={(el.height * GRID_SIZE) / 2 - 4} width="8" height="8" onmousedown={(e) => handleResizeDown(e, el, 'e')} />
+                <rect class="resize-handle s" x={(el.width * GRID_SIZE) / 2 - 4} y={el.height * GRID_SIZE - 4} width="8" height="8" onmousedown={(e) => handleResizeDown(e, el, 's')} />
+                <rect class="resize-handle se" x={el.width * GRID_SIZE - 4} y={el.height * GRID_SIZE - 4} width="8" height="8" onmousedown={(e) => handleResizeDown(e, el, 'se')} />
+            {/if}
         </g>
     {/each}
 </svg>
 
 <style>
     .room-canvas {
-        background: white;
-        border: 1px solid #ccc;
+        background: transparent;
+        width: 100%;
+        height: auto;
         user-select: none;
+        touch-action: none;
     }
-    .room-canvas.editable {
-        cursor: crosshair;
-    }
-    .element {
+    .room-canvas.clickable .element {
         cursor: pointer;
     }
+    
+    .element rect {
+        transition: fill 0.2s, stroke 0.2s;
+    }
+
     .element.seat rect {
-        fill: #fff;
-        stroke: #007bff;
-        stroke-width: 2;
+        fill: #fbf7ee;
+        stroke: var(--ink-2);
+        stroke-width: 1.5;
     }
     .element.seat text {
-        fill: #007bff;
-        font-weight: bold;
-        font-size: 14px;
+        fill: var(--ink);
+        font-weight: 500;
+        font-family: var(--mono);
+        font-size: 12px;
     }
+    
     .element.seat.occupied rect {
-        fill: #e7f1ff;
-        stroke: #6c757d;
+        fill: #d6cdb5;
+        stroke: var(--ink-2);
     }
     .element.seat.occupied text {
-        fill: #6c757d;
+        fill: var(--ink-2);
     }
+
     .element.seat.is-mine rect {
-        fill: #28a745;
-        stroke: #1e7e34;
+        fill: var(--accent);
+        stroke: var(--accent);
     }
     .element.seat.is-mine text {
         fill: white;
     }
+
     .element.selected rect {
-        stroke: #ffc107;
-        stroke-width: 3;
+        stroke: var(--highlight);
+        stroke-width: 2.5;
     }
+    
+    .element.table rect {
+        fill: rgba(0,0,0,0.03);
+        stroke: var(--rule);
+        stroke-width: 1;
+    }
+
     .student-name {
-        font-size: 10px;
-        fill: #333;
+        font-size: 11px;
+        fill: var(--ink-3);
+        font-family: var(--sans);
     }
+
+    .resize-handle {
+        fill: white;
+        stroke: var(--accent);
+        stroke-width: 1.5;
+    }
+    .resize-handle.e { cursor: ew-resize; }
+    .resize-handle.s { cursor: ns-resize; }
+    .resize-handle.se { cursor: nwse-resize; }
 </style>
diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index f43979f..4069fce 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -44,7 +44,10 @@ export async function request<T>(path: string, init?: RequestInit): Promise<T> {
     }
 
     if (res.status === 204) return {} as T;
-    return res.json() as Promise<T>;
+
+    const text = await res.text();
+    if (!text) return {} as T;
+    return JSON.parse(text) as T;
 }
 
 export const api = {
@@ -96,6 +99,11 @@ export const api = {
                     body: JSON.stringify(tutor) 
                 }),
             delete: (id: number) => request<void>(`/admin/tutors/${id}`, { method: 'DELETE' }),
+            setActive: (id: number, is_active: boolean) => 
+                request<void>(`/admin/tutors/${id}/active`, { 
+                    method: 'PATCH', 
+                    body: JSON.stringify({ is_active }) 
+                }),
         },
         students: {
             delete: (id: number) => request<void>(`/admin/students/${id}`, { method: 'DELETE' }),
@@ -115,6 +123,7 @@ export const api = {
                     method: 'PUT', 
                     body: JSON.stringify(layout) 
                 }),
+            delete: (id: number) => request<void>(`/admin/rooms/${id}`, { method: 'DELETE' }),
         },
         sessions: {
             list: (course_id: number) => request<Session[]>(`/admin/sessions?course_id=${course_id}`),
@@ -163,7 +172,7 @@ export const api = {
         getInfo: (code: string) => request<CheckinInfo>(`/checkin/${code}`),
         getStudents: (code: string) => request<Student[]>(`/checkin/${code}/students`),
         post: (code: string, student_id: number, seat_id?: string) =>
-            request<Attendance>('/checkin', {
+            request<{ok: boolean}>('/checkin', {
                 method: 'POST', 
                 body: JSON.stringify({ code, student_id, seat_id }) 
             }),
diff --git a/frontend/src/lib/components/SeatMap.svelte b/frontend/src/lib/components/SeatMap.svelte
deleted file mode 100644
index 38ffdef..0000000
--- a/frontend/src/lib/components/SeatMap.svelte
+++ /dev/null
@@ -1,169 +0,0 @@
-<script lang="ts">
-  interface SeatDef {
-    id: string;
-    x: number;
-    y: number;
-    table: string;
-  }
-
-  interface StudentRef {
-    id: number;
-    name: string;
-    initials: string;
-  }
-
-  const {
-    assignments = {},
-    students = [],
-    selectedStudent = null,
-    onSeatClick,
-    variant = 'tutor',
-    ownSeat = null,
-    scale = 1,
-  } = $props<{
-    assignments?: Record<string, number>;
-    students?: StudentRef[];
-    selectedStudent?: number | null;
-    onSeatClick?: (seat: SeatDef) => void;
-    variant?: 'tutor' | 'student' | 'student-self';
-    ownSeat?: string | null;
-    scale?: number;
-  }>();
-
-  const W = 760;
-  const H = 460;
-
-  const WALLS  = { x: 12,  y: 12,  w: 736, h: 436 };
-  const WINDOW = { x: 12,  y: 120, w: 6,   h: 220 };
-  const DOOR   = { x: 60,  y: 448, w: 70,  h: 6   };
-  const BEAMER = { x: 372, y: 24,  w: 110, h: 8   };
-  const PODIUM = { x: 332, y: 60,  w: 190, h: 38  };
-  const TABLES = [
-    { id: 'T1', x: 90,  y: 150, w: 200, h: 70, label: 'T1' },
-    { id: 'T2', x: 470, y: 150, w: 200, h: 70, label: 'T2' },
-    { id: 'T3', x: 90,  y: 320, w: 200, h: 70, label: 'T3' },
-    { id: 'T4', x: 470, y: 320, w: 200, h: 70, label: 'T4' },
-  ];
-
-  function makeSeats(): SeatDef[] {
-    return TABLES.flatMap((t) => [
-      { id: `${t.id}-1`, x: t.x + t.w * 0.28, y: t.y - 22,        table: t.id },
-      { id: `${t.id}-2`, x: t.x + t.w * 0.72, y: t.y - 22,        table: t.id },
-      { id: `${t.id}-3`, x: t.x + t.w * 0.28, y: t.y + t.h + 22,  table: t.id },
-      { id: `${t.id}-4`, x: t.x + t.w * 0.72, y: t.y + t.h + 22,  table: t.id },
-      { id: `${t.id}-5`, x: t.x + t.w + 26,   y: t.y + t.h / 2,   table: t.id },
-    ]);
-  }
-
-  const SEATS = makeSeats();
-
-  function studentById(id: number): StudentRef | undefined {
-    return students.find((s: StudentRef) => s.id === id);
-  }
-
-  function seatStyle(seat: SeatDef): { bg: string; border: string; label: string; labelColor: string; shadow: string } {
-    const sid = assignments[seat.id];
-    const student = sid ? studentById(sid) : undefined;
-    const isSelected = selectedStudent != null && sid === selectedStudent;
-    const isOwn = ownSeat === seat.id;
-
-    if (variant === 'tutor') {
-      if (student) {
-        return {
-          bg: isSelected ? 'var(--ink)' : '#fbf7ee',
-          border: isSelected ? 'var(--ink)' : 'var(--ink-2)',
-          label: student.initials,
-          labelColor: isSelected ? '#f7eedc' : 'var(--ink)',
-          shadow: isSelected ? '0 0 0 3px rgba(241,211,106,0.6)' : 'none',
-        };
-      }
-      return { bg: '#f7f1e3', border: 'var(--ink-4)', label: '', labelColor: 'var(--ink-4)', shadow: 'none' };
-    }
-
-    if (variant === 'student') {
-      if (isOwn) {
-        return { bg: 'var(--accent)', border: 'var(--accent)', label: '★', labelColor: '#f7eedc', shadow: 'none' };
-      }
-      if (sid) {
-        return { bg: '#d6cdb5', border: 'var(--ink-4)', label: '', labelColor: '', shadow: 'none' };
-      }
-      return { bg: '#fbf7ee', border: 'var(--ink-2)', label: '', labelColor: '', shadow: 'none' };
-    }
-
-    // student-self (read-only)
-    if (isOwn) {
-      return { bg: 'var(--accent)', border: 'var(--accent)', label: '★', labelColor: '#f7eedc', shadow: 'none' };
-    }
-    if (sid) {
-      return { bg: '#d6cdb5', border: 'var(--ink-4)', label: '', labelColor: '', shadow: 'none' };
-    }
-    return { bg: '#fbf7ee', border: 'var(--ink-3)', label: '', labelColor: '', shadow: 'none' };
-  }
-</script>
-
-<div style="position:relative;width:{W * scale}px;height:{H * scale}px;background:#f7f1e3;border:1px solid var(--rule);border-radius:4px;overflow:hidden;box-shadow:inset 0 0 0 1px rgba(0,0,0,0.02),0 1px 0 rgba(0,0,0,0.03)">
-
-  <!-- Inner graph-paper grid -->
-  <div style="position:absolute;inset:0;background-image:linear-gradient(to right,rgba(110,90,60,0.05) 1px,transparent 1px),linear-gradient(to bottom,rgba(110,90,60,0.05) 1px,transparent 1px);background-size:{24*scale}px {24*scale}px"></div>
-
-  <!-- Design-space inner container at 1× coords, CSS-scaled -->
-  <div style="position:absolute;inset:0;transform:scale({scale});transform-origin:top left;width:{W}px;height:{H}px">
-
-    <!-- Walls -->
-    <div style="position:absolute;left:{WALLS.x}px;top:{WALLS.y}px;width:{WALLS.w}px;height:{WALLS.h}px;border:2px solid var(--ink-2);border-radius:2px"></div>
-
-    <!-- Window -->
-    <div style="position:absolute;left:{WINDOW.x - 2}px;top:{WINDOW.y}px;width:{WINDOW.w + 4}px;height:{WINDOW.h}px;background:#dfeaf0;border-top:2px solid var(--ink-2);border-bottom:2px solid var(--ink-2)">
-      <div style="position:absolute;left:1px;top:50%;width:{WINDOW.w + 2}px;height:2px;background:var(--ink-2)"></div>
-    </div>
-    <div style="position:absolute;left:-8px;top:{WINDOW.y + WINDOW.h / 2 - 6}px;font-family:var(--mono);font-size:9px;color:var(--ink-3);transform:rotate(-90deg);transform-origin:left top;letter-spacing:0.1em;text-transform:uppercase">Fenster</div>
-
-    <!-- Door gap + arc -->
-    <div style="position:absolute;left:{DOOR.x}px;top:{DOOR.y - 2}px;width:{DOOR.w}px;height:4px;background:#f7f1e3"></div>
-    <svg style="position:absolute;left:{DOOR.x}px;top:{DOOR.y - 36}px;pointer-events:none" width="{DOOR.w + 10}" height="40">
-      <path d="M 2 38 Q 2 2 {DOOR.w} 2" stroke="var(--ink-3)" stroke-width="1" stroke-dasharray="2 2" fill="none"/>
-      <line x1="2" y1="38" x2="2" y2="2" stroke="var(--ink-2)" stroke-width="1.5"/>
-    </svg>
-    <div style="position:absolute;left:{DOOR.x + 6}px;top:{DOOR.y + 6}px;font-family:var(--mono);font-size:9px;color:var(--ink-3);letter-spacing:0.1em;text-transform:uppercase">Tür</div>
-
-    <!-- Beamer -->
-    <div style="position:absolute;left:{BEAMER.x}px;top:{BEAMER.y}px;width:{BEAMER.w}px;height:{BEAMER.h}px;background:var(--ink-2);border-radius:1px"></div>
-    <div style="position:absolute;left:{BEAMER.x + BEAMER.w + 6}px;top:{BEAMER.y}px;font-family:var(--mono);font-size:9px;color:var(--ink-3);letter-spacing:0.1em;text-transform:uppercase">Beamer</div>
-
-    <!-- Podium -->
-    <div style="position:absolute;left:{PODIUM.x}px;top:{PODIUM.y}px;width:{PODIUM.w}px;height:{PODIUM.h}px;border:1.5px solid var(--ink-2);background:#efe6d2;border-radius:2px;display:flex;align-items:center;justify-content:center;font-family:var(--mono);font-size:10px;color:var(--ink-3);letter-spacing:0.15em;text-transform:uppercase">
-      Pult · Tutor:in
-    </div>
-
-    <!-- Tables -->
-    {#each TABLES as t (t.id)}
-      <div style="position:absolute;left:{t.x}px;top:{t.y}px;width:{t.w}px;height:{t.h}px;background:#e8dec5;border:1.5px solid var(--ink-2);border-radius:3px;display:flex;align-items:center;justify-content:center;font-family:var(--serif);font-size:22px;color:rgba(31,27,22,0.35);font-style:italic">
-        {t.label}
-      </div>
-    {/each}
-
-    <!-- Seats -->
-    {#each SEATS as seat (seat.id)}
-      {@const s = seatStyle(seat)}
-      <button
-        style="position:absolute;left:{seat.x - 18}px;top:{seat.y - 18}px;width:36px;height:36px;border-radius:50%;background:{s.bg};border:1.5px solid {s.border};cursor:{onSeatClick && variant !== 'student-self' ? 'pointer' : 'default'};display:flex;align-items:center;justify-content:center;font-family:var(--sans);font-weight:600;font-size:11px;color:{s.labelColor};padding:0;box-shadow:{s.shadow};transition:background 120ms,border-color 120ms"
-        title={assignments[seat.id] ? (studentById(assignments[seat.id])?.name ?? 'besetzt') : 'frei'}
-        disabled={variant === 'student-self'}
-        onclick={() => onSeatClick?.(seat)}
-      >
-        {s.label}
-      </button>
-    {/each}
-
-    <!-- Compass -->
-    <div style="position:absolute;right:18px;bottom:14px;font-family:var(--mono);font-size:9px;color:var(--ink-3);letter-spacing:0.15em">
-      <div style="display:flex;flex-direction:column;align-items:center">
-        <span>N</span>
-        <svg width="14" height="22">
-          <path d="M7 2 L7 20 M3 6 L7 2 L11 6" stroke="var(--ink-3)" stroke-width="1" fill="none"/>
-        </svg>
-      </div>
-    </div>
-
-  </div>
-</div>
diff --git a/frontend/src/lib/components/TutorShell.svelte b/frontend/src/lib/components/TutorShell.svelte
index 60ac527..5c0a9d0 100644
--- a/frontend/src/lib/components/TutorShell.svelte
+++ b/frontend/src/lib/components/TutorShell.svelte
@@ -1,6 +1,8 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
   import { auth } from '$lib/auth.svelte';
+  import { api } from '$lib/api';
+  import { goto } from '$app/navigation';
 
   const {
     activePath,
@@ -40,6 +42,16 @@
   function initials(name: string): string {
     return name.split(' ').map((w) => w[0]).slice(0, 2).join('').toUpperCase();
   }
+
+  async function handleLogout() {
+    try {
+      await api.auth.logout();
+    } catch (e) {
+      console.error('Logout failed', e);
+    }
+    auth.logout();
+    goto('/admin/login');
+  }
 </script>
 
 <div class="paper-bg" style="width:100%;min-height:100vh;display:grid;grid-template-columns:220px 1fr;overflow:hidden">
@@ -79,6 +91,14 @@
           </a>
         {/if}
       {/each}
+
+      <button
+        onclick={handleLogout}
+        style="text-align:left;text-decoration:none;background:transparent;padding:8px 10px;border-radius:4px;font-family:var(--sans);font-size:13px;color:var(--ink-2);border:none;cursor:pointer;display:flex;align-items:center;gap:8px;margin-top:12px;border-top:1px solid var(--rule);width:100%"
+      >
+        <span style="width:4px;height:4px;border-radius:50%;flex-shrink:0;background:var(--ink-4)"></span>
+        Abmelden
+      </button>
     </nav>
 
     <div style="flex:1"></div>
diff --git a/frontend/src/lib/types.ts b/frontend/src/lib/types.ts
index de3b59b..d659367 100644
--- a/frontend/src/lib/types.ts
+++ b/frontend/src/lib/types.ts
@@ -9,6 +9,7 @@ export interface Tutor {
     name: string;
     email: string;
     is_superadmin: boolean;
+    is_active: boolean;
 }
 
 export interface Student {
@@ -50,6 +51,7 @@ export interface Slot {
     end_time: string;
     status: "closed" | "open" | "locked";
     code: string | null;
+    layout?: LayoutElement[];
 }
 
 export interface Attendance {
diff --git a/frontend/src/routes/admin/live/[slotId]/+page.svelte b/frontend/src/routes/admin/live/[slotId]/+page.svelte
index d8226b8..475ada3 100644
--- a/frontend/src/routes/admin/live/[slotId]/+page.svelte
+++ b/frontend/src/routes/admin/live/[slotId]/+page.svelte
@@ -6,7 +6,7 @@
   import Icon from '$lib/components/Icon.svelte';
   import StatusPill from '$lib/components/StatusPill.svelte';
   import NoteEditor from '$lib/components/NoteEditor.svelte';
-  import SeatMap from '$lib/components/SeatMap.svelte';
+  import RoomCanvas from '$lib/RoomCanvas.svelte';
   import UnderlineStroke from '$lib/components/UnderlineStroke.svelte';
   import Tally from '$lib/components/Tally.svelte';
 
@@ -22,6 +22,7 @@
   let loading = $state(true);
 
   let pollInterval: ReturnType<typeof setInterval> | null = null;
+  let loadError = $state<string | null>(null);
 
   onMount(async () => {
     await loadData();
@@ -59,6 +60,11 @@
             session = sess;
             students = await api.admin.courses.listStudents(course.id);
             const attendance = await api.admin.sessions.getAttendance(sess.id);
+            // Instead of just taking the session layout, the slot comes with its own layout from get_session_attendance now
+            const fullSlot = attendance.slots.find(s => s.id === slotId);
+            if (fullSlot) {
+                slot = fullSlot;
+            }
             attendances = (attendance.attendances ?? []).filter((a: Attendance) => a.slot_id === slotId);
             notes = await api.admin.slots.getNotes(slotId);
             found = true;
@@ -68,7 +74,8 @@
         if (found) break;
       }
     } catch (e) {
-      console.error(e);
+      loadError = e instanceof Error ? e.message : 'Daten konnten nicht geladen werden.';
+      console.error('[live/loadData]', e);
     }
   }
 
@@ -101,6 +108,29 @@
 
   const presentCount = $derived(attendances.length);
   const absentCount = $derived(students.length - presentCount);
+  
+  const occupiedSeatIds = $derived(attendances.map(a => a.seat_id).filter(Boolean) as string[]);
+  const studentNamesBySeat = $derived((() => {
+      const map: Record<string, string> = {};
+      for (const att of attendances) {
+          if (att.seat_id) {
+              const student = students.find(s => s.id === att.student_id);
+              if (student) {
+                  map[att.seat_id] = student.name;
+              }
+          }
+      }
+      return map;
+  })());
+
+  function handleSeatClick(el: { id: string } | null) {
+      if (!el) {
+          selectedStudentId = null;
+          return;
+      }
+      const att = attendances.find(a => a.seat_id === el.id);
+      selectedStudentId = att ? att.student_id : null;
+  }
 
   function weekLabel(n: number): string {
     return `W${String(n).padStart(2, '0')}`;
@@ -109,6 +139,12 @@
 
 <div style="padding:28px 36px;display:flex;flex-direction:column;gap:22px">
 
+  {#if loadError}
+    <div style="background:rgba(138,44,31,0.06);border:1px solid var(--accent);color:var(--accent);padding:10px 14px;border-radius:4px;font-size:13px">
+      Fehler beim Laden: {loadError}
+    </div>
+  {/if}
+
   {#if loading}
     <div style="padding:48px;text-align:center">
       <span class="small" style="color:var(--ink-4)">Wird geladen…</span>
@@ -158,7 +194,13 @@
         </div>
 
         <div class="card" style="overflow:hidden;padding:16px">
-          <SeatMap variant="tutor" scale={0.78} />
+          <RoomCanvas 
+            elements={slot.layout ?? []} 
+            clickable={true} 
+            occupiedSeatIds={occupiedSeatIds} 
+            studentNames={studentNamesBySeat}
+            onElementClick={handleSeatClick} 
+          />
         </div>
 
         <!-- Tally row -->
diff --git a/frontend/src/routes/admin/rooms/+page.svelte b/frontend/src/routes/admin/rooms/+page.svelte
index 44679e6..49b7bd8 100644
--- a/frontend/src/routes/admin/rooms/+page.svelte
+++ b/frontend/src/routes/admin/rooms/+page.svelte
@@ -5,19 +5,42 @@
 
   let rooms = $state<Room[]>([]);
   let newRoomName = $state('');
+  let errorMsg = $state<string | null>(null);
 
   onMount(async () => {
-    rooms = await api.admin.rooms.list();
+    try {
+      rooms = await api.admin.rooms.list();
+    } catch (e) {
+      errorMsg = e instanceof Error ? e.message : 'Räume konnten nicht geladen werden.';
+    }
   });
 
   async function createRoom() {
     if (!newRoomName.trim()) return;
+    errorMsg = null;
     try {
       await api.admin.rooms.create(newRoomName, []);
       newRoomName = '';
+    } catch (e) {
+      errorMsg = e instanceof Error ? e.message : 'Raum konnte nicht erstellt werden.';
+      console.error('[rooms/createRoom]', e);
+      return;
+    }
+    try {
       rooms = await api.admin.rooms.list();
-    } catch {
-      console.error('failed to fetch rooms');
+    } catch (e) {
+      console.error('[rooms/createRoom/list]', e);
+    }
+  }
+
+  async function deleteRoom(id: number) {
+    if (!confirm('Raum wirklich löschen?')) return;
+    errorMsg = null;
+    try {
+      await api.admin.rooms.delete(id);
+      rooms = await api.admin.rooms.list();
+    } catch (err) {
+      errorMsg = err instanceof Error ? err.message : 'Raum konnte nicht gelöscht werden.';
     }
   }
 </script>
@@ -28,6 +51,12 @@
     <h1 class="h1" style="font-family:var(--serif)">Raumlayout-Editor</h1>
   </div>
 
+  {#if errorMsg}
+    <div style="background:rgba(138,44,31,0.06);border:1px solid var(--accent);color:var(--accent);padding:10px 14px;border-radius:4px;font-size:13px;margin-bottom:12px">
+      {errorMsg}
+    </div>
+  {/if}
+
   <div class="card" style="overflow:hidden">
     <div style="padding:14px 18px;border-bottom:1px solid var(--rule);display:flex;align-items:center;justify-content:space-between">
       <div class="serif" style="font-size:18px;font-weight:500">Räume</div>
@@ -54,7 +83,10 @@
             <tr class="row-hover" style="border-top:{i === 0 ? 'none' : '1px solid var(--rule)'}">
               <td style="padding:12px 14px">{room.name}</td>
               <td style="padding:12px 14px;text-align:right">
-                <a href="/admin/rooms/{room.id}" class="btn ghost sm">Bearbeiten</a>
+                <div style="display:flex;justify-content:flex-end;gap:8px">
+                    <a href="/admin/rooms/{room.id}" class="btn ghost sm">Bearbeiten</a>
+                    <button class="btn ghost sm" style="color:var(--accent);border-color:rgba(138,44,31,0.2)" onclick={() => deleteRoom(room.id)}>Löschen</button>
+                </div>
               </td>
             </tr>
           {/each}
diff --git a/frontend/src/routes/admin/rooms/[roomId]/+page.svelte b/frontend/src/routes/admin/rooms/[roomId]/+page.svelte
index 5e33733..3059d13 100644
--- a/frontend/src/routes/admin/rooms/[roomId]/+page.svelte
+++ b/frontend/src/routes/admin/rooms/[roomId]/+page.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
   import { page } from '$app/stores';
-  import { onMount } from 'svelte';
   import { api } from '$lib/api';
   import RoomCanvas from '$lib/RoomCanvas.svelte';
   import type { Room, LayoutElement } from '$lib/types';
@@ -9,38 +8,82 @@
   const roomId = $derived(roomIdStr ? parseInt(roomIdStr) : 0);
 
   let room = $state<Room | null>(null);
-
-  onMount(async () => {
-    room = await api.admin.rooms.get(roomId);
-  });
+  let errorMsg = $state<string | null>(null);
+  let snapToGrid = $state(true);
 
   $effect(() => {
     if (roomId) {
-      api.admin.rooms.get(roomId).then((r: Room) => { room = r; });
+      api.admin.rooms.get(roomId)
+        .then((r: Room) => { room = r; })
+        .catch((e: unknown) => {
+          errorMsg = e instanceof Error ? e.message : 'Raum konnte nicht geladen werden.';
+        });
     }
   });
 
   async function saveLayout() {
     if (!room) return;
+    errorMsg = null;
     try {
       await api.admin.rooms.updateLayout(room.id, room.layout);
-    } catch {
-        console.error('failed to save layout');
+    } catch (e) {
+      errorMsg = e instanceof Error ? e.message : 'failed to save layout';
     }
   }
 
   function addElement(type: LayoutElement['type']) {
     if (!room) return;
-    const id = Math.random().toString(36).substr(2, 9);
+    const id = Math.random().toString(36).slice(2, 11);
+    let nextLabel: string;
+    
+    if (type === 'seat') {
+      const existingLabels = room.layout
+        .filter((e: LayoutElement) => e.type === 'seat')
+        .map((e: LayoutElement) => parseInt(e.label, 10))
+        .filter(n => !isNaN(n));
+      const maxLabel = existingLabels.length > 0 ? Math.max(...existingLabels) : 0;
+      nextLabel = (maxLabel + 1).toString();
+    } else {
+      nextLabel = '';
+    }
+
     const newEl: LayoutElement = {
       id,
-      label: type === 'seat' ? (room.layout.filter((e: LayoutElement) => e.type === 'seat').length + 1).toString() : '',
+      label: nextLabel,
       x: 0, y: 0,
       width: type === 'table' ? 2 : 1,
       height: 1,
       type,
     };
     room.layout = [...room.layout, newEl];
+    selectedElementId = id;
+  }
+
+  function duplicateElement() {
+    if (!room || !selectedElement) return;
+    const id = Math.random().toString(36).slice(2, 11);
+    
+    let nextLabel: string;
+    if (selectedElement.type === 'seat') {
+      const existingLabels = room.layout
+        .filter((e: LayoutElement) => e.type === 'seat')
+        .map((e: LayoutElement) => parseInt(e.label, 10))
+        .filter(n => !isNaN(n));
+      const maxLabel = existingLabels.length > 0 ? Math.max(...existingLabels) : 0;
+      nextLabel = (maxLabel + 1).toString();
+    } else {
+        nextLabel = selectedElement.label;
+    }
+
+    const duplicatedEl: LayoutElement = {
+        ...selectedElement,
+        id,
+        label: nextLabel,
+        x: selectedElement.x + (snapToGrid ? 0.5 : 0.1),
+        y: selectedElement.y + (snapToGrid ? 0.5 : 0.1),
+    };
+    room.layout = [...room.layout, duplicatedEl];
+    selectedElementId = id;
   }
 
   let selectedElementId = $state<string | null>(null);
@@ -61,20 +104,31 @@
         <h2 class="h2" style="font-family:var(--serif)">{room.name}</h2>
       </div>
       <div style="display:flex;gap:8px">
+        <label style="display:flex;align-items:center;gap:6px;cursor:pointer;margin-right:12px;font-size:13px;color:var(--ink-3)">
+            <input type="checkbox" bind:checked={snapToGrid} /> Raster fangen
+        </label>
         <button class="btn ghost" onclick={() => addElement('seat')}>+ Sitz</button>
         <button class="btn ghost" onclick={() => addElement('table')}>+ Tisch</button>
         <button class="btn ghost" onclick={() => addElement('door')}>+ Tür</button>
+        <button class="btn ghost" onclick={() => addElement('gap')}>+ Gap</button>
         <button class="btn" onclick={saveLayout}>Speichern</button>
       </div>
     </div>
+    
+    {#if errorMsg}
+      <div style="background:rgba(138,44,31,0.06);border:1px solid var(--accent);color:var(--accent);padding:10px 14px;border-radius:4px;font-size:13px">
+          {errorMsg}
+      </div>
+    {/if}
 
     <div style="display:flex;gap:20px">
       <div style="flex:1">
         <RoomCanvas
           bind:elements={room.layout}
           editable={true}
+          snapStep={snapToGrid ? 0.5 : 0}
           selectedId={selectedElementId}
-          onElementClick={(el) => { selectedElementId = el.id; }}
+          onElementClick={(el) => { selectedElementId = el ? el.id : null; }}
         />
       </div>
 
@@ -86,6 +140,16 @@
               <div class="tiny" style="color:var(--ink-3)">Bezeichnung</div>
               <input class="input" bind:value={selectedElement.label} />
             </div>
+            <div style="display:grid;grid-template-columns:1fr 1fr;gap:8px">
+              <div>
+                <div class="tiny" style="color:var(--ink-3)">X-Pos</div>
+                <input class="input" type="number" step="0.5" bind:value={selectedElement.x} />
+              </div>
+              <div>
+                <div class="tiny" style="color:var(--ink-3)">Y-Pos</div>
+                <input class="input" type="number" step="0.5" bind:value={selectedElement.y} />
+              </div>
+            </div>
             <div style="display:grid;grid-template-columns:1fr 1fr;gap:8px">
               <div>
                 <div class="tiny" style="color:var(--ink-3)">Breite</div>
@@ -96,6 +160,11 @@
                 <input class="input" type="number" step="0.5" bind:value={selectedElement.height} />
               </div>
             </div>
+            <div style="height:1px;background:var(--rule);margin:8px 0"></div>
+            <button
+              class="btn ghost sm" style="justify-content:center"
+              onclick={duplicateElement}
+            >Duplizieren</button>
             <button
               style="color:var(--accent);background:none;border:none;cursor:pointer;text-align:left;font-family:var(--sans);font-size:13px;padding:4px 0"
               onclick={deleteElement}
diff --git a/frontend/src/routes/admin/tutors/+page.svelte b/frontend/src/routes/admin/tutors/+page.svelte
index 8984781..cb86444 100644
--- a/frontend/src/routes/admin/tutors/+page.svelte
+++ b/frontend/src/routes/admin/tutors/+page.svelte
@@ -7,6 +7,7 @@
 
   let tutors = $state<Tutor[]>([]);
   let loading = $state(true);
+  let loadError = $state<string | null>(null);
 
   let newTutor = $state({
     name: '',
@@ -23,8 +24,10 @@
   async function loadTutors() {
     try {
       tutors = await api.admin.tutors.list();
+      loadError = null;
     } catch (e) {
-      console.error(e);
+      loadError = e instanceof Error ? e.message : 'Tutor:innen konnten nicht geladen werden.';
+      console.error('[tutors/loadTutors]', e);
     }
   }
 
@@ -49,6 +52,15 @@
     }
   }
 
+  async function toggleActive(tutor: Tutor) {
+    try {
+      await api.admin.tutors.setActive(tutor.id, !tutor.is_active);
+      await loadTutors();
+    } catch (err) {
+      if (err instanceof Error) alert(err.message);
+    }
+  }
+
   function initials(name: string): string {
     return name.split(' ').map((w) => w[0]).slice(0, 2).join('').toUpperCase();
   }
@@ -75,12 +87,18 @@
         <UnderlineStroke width={120} />
       </div>
 
+      {#if loadError}
+        <div style="background:rgba(138,44,31,0.06);border:1px solid var(--accent);color:var(--accent);padding:10px 14px;border-radius:4px;font-size:13px;margin-bottom:12px">
+          {loadError}
+        </div>
+      {/if}
+
       <div class="card" style="overflow:hidden">
         {#if loading}
           <div style="padding:32px;text-align:center">
             <span class="small" style="color:var(--ink-4)">Wird geladen…</span>
           </div>
-        {:else if tutors.length === 0}
+        {:else if tutors.length === 0 && !loadError}
           <div style="padding:32px;text-align:center">
             <span class="small" style="color:var(--ink-4)">Keine Tutor:innen gefunden.</span>
           </div>
@@ -108,18 +126,31 @@
                     </div>
                   </td>
                   <td style="padding:12px 14px">
-                    {#if tutor.is_superadmin}
-                      <span class="pill locked">Superadmin</span>
-                    {:else}
-                      <span class="pill closed">Tutor:in</span>
-                    {/if}
+                    <div style="display:flex;flex-direction:column;gap:4px;align-items:flex-start">
+                      {#if tutor.is_superadmin}
+                        <span class="pill locked">Superadmin</span>
+                      {:else}
+                        <span class="pill closed">Tutor:in</span>
+                      {/if}
+                      {#if !tutor.is_active}
+                        <span class="pill inactive">Inaktiv</span>
+                      {/if}
+                    </div>
                   </td>
                   <td style="padding:12px 14px;text-align:right">
-                    <button
-                      class="btn ghost sm"
-                      style="color:var(--accent);border-color:rgba(138,44,31,0.2)"
-                      onclick={() => deleteTutor(tutor.id)}
-                    >Löschen</button>
+                    <div style="display:flex;justify-content:flex-end;gap:8px">
+                      <button
+                        class="btn ghost sm"
+                        onclick={() => toggleActive(tutor)}
+                      >
+                        {tutor.is_active ? 'Deaktivieren' : 'Aktivieren'}
+                      </button>
+                      <button
+                        class="btn ghost sm"
+                        style="color:var(--accent);border-color:rgba(138,44,31,0.2)"
+                        onclick={() => deleteTutor(tutor.id)}
+                      >Löschen</button>
+                    </div>
                   </td>
                 </tr>
               {/each}
diff --git a/frontend/src/routes/s/[code]/+page.svelte b/frontend/src/routes/s/[code]/+page.svelte
index 2a3db51..564652b 100644
--- a/frontend/src/routes/s/[code]/+page.svelte
+++ b/frontend/src/routes/s/[code]/+page.svelte
@@ -2,8 +2,8 @@
   import { onMount } from 'svelte';
   import { page } from '$app/stores';
   import { api } from '$lib/api';
-  import type { Slot, Student, Attendance, CheckinAttendance } from '$lib/types';
-  import SeatMap from '$lib/components/SeatMap.svelte';
+  import type { Slot, Student, Attendance, CheckinAttendance, LayoutElement } from '$lib/types';
+  import RoomCanvas from '$lib/RoomCanvas.svelte';
   import StatusPill from '$lib/components/StatusPill.svelte';
 
   const code = $page.params.code as string;
@@ -13,6 +13,7 @@
   let errorMsg = $state('');
 
   let slot = $state<Slot | null>(null);
+  let layout = $state<LayoutElement[]>([]);
   let students = $state<Student[]>([]);
   let attendances = $state<CheckinAttendance[]>([]);
   let myAttendance = $state<Attendance | null>(null);
@@ -42,8 +43,10 @@
   async function loadInfo() {
     const res = await api.checkin.getInfo(code);
     slot = res.slot;
+    layout = res.layout ?? [];
     // We don't have is_mine in the regular Attendance type, so we use CheckinAttendance locally
     const checkinAttendances = res.attendances ?? [];
+    attendances = checkinAttendances;
 
     const mine = checkinAttendances.find((a: CheckinAttendance) => a.is_mine);
     if (mine && slot) {
@@ -77,20 +80,24 @@
 
   async function checkin(seatId?: string) {
     if (!selectedStudent) return;
+    errorMsg = '';
     try {
-      const res = await api.checkin.post(code, selectedStudent.id, seatId);
-      myAttendance = res;
-      await loadInfo();
+      await api.checkin.post(code, selectedStudent.id, seatId);
     } catch (e) {
       if (e instanceof Error) {
-          if (e.message?.includes('already checked in') || e.message?.includes('409')) {
-            errorMsg = 'Dieser Platz ist bereits belegt.';
-          } else {
-            errorMsg = e.message ?? 'Einchecken fehlgeschlagen.';
-          }
+        errorMsg = e.message.includes('seat taken')
+          ? 'Dieser Platz ist bereits belegt.'
+          : (e.message || 'Einchecken fehlgeschlagen.');
       } else {
-          errorMsg = 'Einchecken fehlgeschlagen.';
+        errorMsg = 'Einchecken fehlgeschlagen.';
       }
+      return;
+    }
+    try {
+      await loadInfo();
+    } catch (e) {
+      step = 'confirmed';
+      console.error('[checkin/loadInfo]', e);
     }
   }
 
@@ -102,6 +109,8 @@
     students.filter((s: Student) => s.name.toLowerCase().includes(search.toLowerCase()))
   );
 
+  const occupiedSeatIds = $derived(attendances.map(a => a.seat_id).filter(Boolean) as string[]);
+
   function initials(name: string): string {
     return name.split(' ').map((w: string) => w[0]).slice(0, 2).join('').toUpperCase();
   }
@@ -207,10 +216,11 @@
         {/if}
 
         <div style="overflow-x:auto">
-          <SeatMap
-            variant="student"
-            scale={0.46}
-            onSeatClick={(seat) => checkin(seat.id)}
+          <RoomCanvas
+            elements={layout}
+            clickable={true}
+            occupiedSeatIds={occupiedSeatIds}
+            onElementClick={(el) => { if (el?.type === 'seat' && !occupiedSeatIds.includes(el.id)) checkin(el.id); }}
           />
         </div>
 
@@ -245,7 +255,11 @@
         </div>
 
         <div style="overflow-x:auto">
-          <SeatMap variant="student-self" scale={0.46} ownSeat={myAttendance?.seat_id ?? null} />
+          <RoomCanvas
+            elements={layout}
+            mySeatId={myAttendance?.seat_id ?? null}
+            occupiedSeatIds={occupiedSeatIds}
+          />
         </div>
 
         <button class="btn ghost sm" style="align-self:center" onclick={changeSeat}>
@@ -313,10 +327,11 @@
             </div>
           {/if}
 
-          <SeatMap
-            variant="student"
-            scale={0.78}
-            onSeatClick={(seat) => checkin(seat.id)}
+          <RoomCanvas
+            elements={layout}
+            clickable={true}
+            occupiedSeatIds={occupiedSeatIds}
+            onElementClick={(el) => { if (el?.type === 'seat' && !occupiedSeatIds.includes(el.id)) checkin(el.id); }}
           />
 
           <div style="display:flex;gap:20px" class="tiny">
@@ -365,7 +380,11 @@
             </div>
           </div>
 
-          <SeatMap variant="student-self" scale={0.78} ownSeat={myAttendance?.seat_id ?? null} />
+          <RoomCanvas
+            elements={layout}
+            mySeatId={myAttendance?.seat_id ?? null}
+            occupiedSeatIds={occupiedSeatIds}
+          />
 
           <div style="display:flex;gap:10px">
             <button class="btn ghost" onclick={changeSeat}>Sitz wechseln</button>
diff --git a/scripts/test-env.sh b/scripts/test-env.sh
index 41b016c..88b2426 100755
--- a/scripts/test-env.sh
+++ b/scripts/test-env.sh
@@ -13,6 +13,15 @@ if [ "${TT_TEST_PORT_RANDOM:-0}" = "1" ]; then
   TT_TEST_PORT=0
 fi
 
+# If port is 0 and the backend already wrote its actual port, use it
+_port_file="${TT_WORKTREE_ROOT}/data/test/.port"
+if [ "$TT_TEST_PORT" = "0" ] && [ -f "$_port_file" ]; then
+  _real_port=$(cat "$_port_file")
+  if [ -n "$_real_port" ] && [ "$_real_port" != "0" ]; then
+    TT_TEST_PORT=$_real_port
+  fi
+fi
+
 TT_TEST_DB="${TT_WORKTREE_ROOT}/data/test/attendance.db"
 TT_TEST_MODE=1
 TT_BASE_URL="http://127.0.0.1:${TT_TEST_PORT}"