Merge feature/v1.4: Essenszeiten variabel, DeepL-Button-Sichtbarkeit, Bugfix mobiler Sprachumschalter

Changelog: Hinweis auf noch offenen Merge für 1.4.0 entfernt
Bug: Sprachumschalter in mobiler Ansicht doppelt
2026-07-18 08:33:25 +02:00 · 2026-07-18 08:33:17 +02:00 · 2026-07-18 08:30:20 +02:00 · 2026-07-18 08:26:15 +02:00 · 2026-07-18 08:15:31 +02:00 · 2026-07-18 08:15:20 +02:00
68 changed files with 6668 additions and 126 deletions
@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "canteen-menu-dev",
+      "runtimeExecutable": "C:\\Program Files\\nodejs\\npm.cmd",
+      "runtimeArgs": ["run", "dev"],
+      "port": 3000
+    }
+  ]
+}
@@ -0,0 +1,11 @@
+node_modules
+.next
+.git
+.claude
+.env*
+!.env.example
+ZUGANGSDATEN.md
+supabase/local
+Dockerfile
+docker-compose.yml
+README.md
@@ -0,0 +1,27 @@
+# Vorlage für .env.local (Entwicklung) bzw. die Umgebungsvariablen
+# beim Hoster (Live-Betrieb). Echte Werte niemals committen!
+
+# Supabase-Projekt-URL (Dashboard -> Project Settings -> API)
+NEXT_PUBLIC_SUPABASE_URL=https://<projekt-ref>.supabase.co
+
+# Öffentlicher anon-Key (darf im Browser landen, RLS schützt die Daten)
+NEXT_PUBLIC_SUPABASE_ANON_KEY=<anon-key>
+
+# Service-Role-Key (GEHEIM! Nur serverseitig, für die Benutzerverwaltung)
+SUPABASE_SERVICE_ROLE_KEY=<service-role-key>
+
+# Öffentliche URL, unter der die App erreichbar ist (Schema + Domain).
+# Wird für den CSRF-Origin-Check hinter Reverse-Proxies genutzt und ist
+# zugleich die Passkey-Domain: nach einer Änderung einmalig
+#   SUPABASE_ACCESS_TOKEN=<token> node scripts/configure-passkeys.mjs
+# ausführen, damit Passkeys auf der neuen Domain funktionieren.
+APP_URL=http://localhost:3000
+
+# Titel im Browser-Tab und Überschrift, solange kein Logo hochgeladen ist.
+SITE_TITLE=Canteen Menu
+
+# Optional: DeepL-API-Key für automatische Übersetzung von Gerichten nach
+# Englisch/Polnisch (kostenloser Free-Tier unter deepl.com/de/pro-api,
+# Free-Keys enden auf ":fx"). Ohne Key bleibt "Automatisch übersetzen"
+# inaktiv; Englisch/Polnisch lassen sich weiterhin manuell eintragen.
+DEEPL_API_KEY=
@@ -32,6 +32,7 @@ yarn-error.log*

 # env files (can opt-in for committing if needed)
 .env*
+!.env.example

 # vercel
 .vercel
@@ -39,3 +40,9 @@ yarn-error.log*
 # typescript
 *.tsbuildinfo
 next-env.d.ts
+
+# Zugangsdaten (lokal)
+ZUGANGSDATEN.md
+
+# lokale Claude-Code-Einstellungen
+.claude/settings.local.json
@@ -0,0 +1,113 @@
+# Changelog
+
+Alle nennenswerten Änderungen an diesem Projekt werden hier dokumentiert.
+Format angelehnt an [Keep a Changelog](https://keepachangelog.com/de/1.1.0/),
+Versionierung nach [Semantic Versioning](https://semver.org/lang/de/).
+
+## [1.4.0] – 2026-07-18
+
+### Hinzugefügt
+- Essenszeiten (Brotzeit/Mittagessen/…) vollständig verwaltbar: anlegen,
+  umbenennen (inkl. EN/PL), Uhrzeit ändern, löschen und per Pfeil-Buttons
+  neu anordnen – neue Seite „Essenszeiten" im Kantinen-Bereich. Löschen
+  entfernt zugewiesene Gerichte automatisch aus allen Wochenplänen.
+
+### Geändert
+- „Automatisch übersetzen"-Button bei Gerichten/Allergenen/Zusatzstoffen
+  ist nur noch sichtbar, wenn `DEEPL_API_KEY` gesetzt ist, statt erst
+  nach Klick auf die fehlende Konfiguration hinzuweisen.
+
+### Behoben
+- Sprachumschalter (DE/EN/PL) erschien auf der öffentlichen Speisekarte
+  in der mobilen Ansicht doppelt.
+
+## [1.3.0] – 2026-07-18
+
+### Hinzugefügt
+- Mehrsprachigkeit für die komplette Anwendung (Deutsch, Englisch,
+  Polnisch): Sprachumschalter (Cookie-basiert, kein Neuladen der
+  Seite nötig), sämtliche Oberflächentexte übersetzt
+- Gerichte, Bereiche, Allergene und Zusatzstoffe zusätzlich mit
+  englischem/polnischem Namen; öffentliche Speisekarte zeigt je nach
+  gewählter Sprache automatisch den passenden Namen (Fallback:
+  Deutsch, falls keine Übersetzung hinterlegt ist)
+- Automatische Übersetzung per DeepL: Button „Automatisch übersetzen“
+  beim Anlegen/Bearbeiten von Gerichten, Allergenen und Zusatzstoffen;
+  Ergebnis bleibt danach manuell korrigierbar. Aktivierung über die
+  neue Docker-Variable `DEEPL_API_KEY` – ohne Key bleibt der Button
+  inaktiv, die Felder lassen sich weiterhin von Hand ausfüllen
+- Rezeptvorschläge im öffentlichen Bereich: nicht angemeldete
+  Besucher können über „Rezept vorschlagen“ ein fehlendes Gericht
+  vorschlagen (Name + optionale Beschreibung), inkl. Dublettenprüfung
+  gegen bestehende Gerichte und einfachem Honeypot-Spamschutz
+- Neue Seite „Vorschläge“ im Kantinen-Bereich: eingereichte Vorschläge
+  sichten, als Gericht übernehmen oder ablehnen
+
+### Behoben
+- Passwort-wiederholen-Feld beim Bearbeiten eines Benutzers erschien
+  erst, nachdem im ersten Passwortfeld schon getippt wurde – wirkte
+  wie ein einzelnes Pflichtfeld
+- Anmelden-Button überlappte auf Mobilgeräten mit breiten Logos
+  (Banner-Format) das Logo, da er absolut in der oberen Ecke
+  positioniert war
+
+## [1.2.0] – 2026-07-18
+
+### Hinzugefügt
+- „Heute"-Button in der Wochennavigation (öffentliche Speisekarte und
+  Wochenplan-Editor)
+- Mobile Ansicht der öffentlichen Speisekarte: umschaltbar zwischen
+  Tag (Standard) und Woche, unabhängig von der Desktop-Tabelle
+- Allergene und Zusatzstoffe wieder pro Gericht auswählbar (Chip-Auswahl
+  im Formular) und als kleine Kürzel neben dem Gerichtnamen sichtbar –
+  in Speisekarte, mobiler Ansicht und Wochenplan-Editor
+- Passwort-Wiederholung beim Anlegen neuer Benutzer und beim optionalen
+  Passwort-Reset
+- Passwort-Anmeldung pro Konto deaktivierbar (nur wenn mindestens ein
+  Passkey registriert ist), Durchsetzung im Login-Flow
+- `SITE_TITLE`-Umgebungsvariable für Browser-Tab-Titel und Überschrift
+  ohne Logo
+- Austauschbares Favicon über den Admin-Design-Bereich
+
+### Geändert
+- Gemeinsame Navigation für Kantinen- und Admin-Bereich statt zwei
+  getrennter Menüs
+- Live-Suche bei den Gerichten
+- Mehrfachauswahl zum Batch-Löschen von Gerichten
+- App erreichbar auf `0.0.0.0` statt nur `localhost` (Docker und
+  nativer Betrieb)
+- Projekt umbenannt von „Speisekarte“ zu „canteen-menu“ (Docker-,
+  npm- und Supabase-Namen; deutsche In-App-Texte unverändert)
+- Öffentliche URL über `APP_URL` konfigurierbar (CSRF-Origin-Check
+  hinter Reverse-Proxy, Passkey-Domain)
+
+### Behoben
+- Next.js band `app/favicon.ico` zusätzlich zu einem dynamisch
+  gesetzten Favicon ein – Favicon wird jetzt immer explizit gesetzt
+- Weiterleitungen (Logout, Zugriffsschutz) übernahmen nach der
+  0.0.0.0-Bindung fälschlich die Server-Adresse statt des
+  aufgerufenen Hosts
+
+## [1.1.0] – 2026-07-17
+
+### Hinzugefügt
+- Versionsnummer im Fußbereich jeder Seite
+
+## [1.0.0] – 2026-07-17
+
+Erste vollständige Version.
+
+### Hinzugefügt
+- Öffentliche Speisekarte ohne Login: Wochenansicht Mo–Fr mit den
+  Bereichen Brotzeit, Mittagessen, Mittagessen vegetarisch und Suppe;
+  Wochen-Navigation; Logo zentriert; Allergene & Zusatzstoffe unterhalb
+  der Karte
+- Anmeldung mit E-Mail/Passwort oder Passkey
+- Kantinen-Bereich: Gerichte anlegen/bearbeiten/löschen, Wochenplan
+  pflegen, globale Allergen-/Zusatzstofflisten verwalten
+- Admin-Bereich: Benutzerverwaltung, Farbgebung, Logo-Upload
+- Eigenes Konto verwalten: Name, E-Mail, Passwort, Passkeys
+- Row-Level-Security, HTTP-Security-Header, CSRF-Origin-Check
+- Docker-Setup (App-Image, lokale PostgreSQL-Kopie, Dev-Profil ohne
+  lokales Node.js)
+- Lokale PostgreSQL-Kopie mit Sync-Skript
@@ -0,0 +1,41 @@
+# =============================================================
+# Next.js-App als eigenständiges Produktions-Image (Multi-Stage)
+# Build:  docker compose --env-file .env.local build
+# =============================================================
+
+# ---------- Abhängigkeiten ----------
+FROM node:24-alpine AS deps
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+
+# ---------- Build ----------
+FROM node:24-alpine AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+# NEXT_PUBLIC_*-Variablen werden zur Build-Zeit ins Client-Bundle eingebacken
+ARG NEXT_PUBLIC_SUPABASE_URL
+ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
+ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL
+ENV NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY
+
+RUN npm run build
+
+# ---------- Runtime ----------
+FROM node:24-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+
+RUN addgroup -S nodejs && adduser -S nextjs -G nodejs
+
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+EXPOSE 3000
+CMD ["node", "server.js"]
@@ -1,36 +1,174 @@
-This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).
+# Canteen Menu – Speisekarte für die Betriebskantine

-## Getting Started
+Digitale Speisekarte für eine Firmenkantine (ca. 250 Mitarbeiter) mit
+öffentlicher Wochenansicht, Kantinen-Bereich zur Pflege der Gerichte und
+Admin-Bereich für Benutzerverwaltung und Branding.

-First, run the development server:
+**Stack:** Next.js 16 (App Router, TypeScript, Tailwind CSS) · Supabase
+(PostgreSQL, Auth inkl. Passkeys, Storage, Row Level Security)

-```bash
-npm run dev
-# or
-yarn dev
-# or
-pnpm dev
-# or
-bun dev
+Änderungen je Version stehen in [CHANGELOG.md](CHANGELOG.md), Git-Tags
+markieren die jeweiligen Versionsstände (`git tag`).
+
+## Funktionen
+
+| Bereich | Funktionen |
+| --- | --- |
+| Öffentlich (ohne Login) | Wochenplan Mo–Fr mit den Essenszeiten Brotzeit (09:00–10:00), Mittagessen, Mittagessen vegetarisch und Suppe (je 11:30–13:30); Navigation vorherige/nächste Woche/Heute; auf schmalen Bildschirmen umschaltbare Tages-/Wochenansicht (Tag ist Standard); Logo zentriert über der Karte; Allergen-/Zusatzstoff-Kürzel je Gericht, Legende unterhalb der Karte; Sprachumschalter Deutsch/Englisch/Polnisch; Rezeptvorschläge einreichen |
+| Kantinen-Team (`/intern`) | Gerichte anlegen/bearbeiten/löschen (inkl. Live-Suche, Mehrfachauswahl zum Batch-Löschen, englischem/polnischem Namen mit automatischer DeepL-Übersetzung) mit Allergenen/Zusatzstoffen je Gericht; Gerichte Tagen/Essenszeiten zuweisen (mehrere pro Zelle) und wieder entfernen; globale Allergen-/Zusatzstofflisten pflegen (ebenfalls mehrsprachig); eingereichte Rezeptvorschläge sichten, übernehmen oder ablehnen; eigenes Konto verwalten (Name, E-Mail, Passwort, Passkeys, Passwort-Anmeldung an/aus) |
+| Admin (`/admin`) | Kantinenmitarbeiter anlegen/bearbeiten/löschen (inkl. Passwort-Reset mit Wiederholung und Rollenvergabe); Farbgebung der Speisekarte anpassen; Logo und Favicon hochladen/entfernen |
+
+Anmeldung mit E-Mail + Passwort oder alternativ per **Passkey**
+(Registrierung im eigenen Konto nach dem ersten Login). Die
+Passwort-Anmeldung kann pro Konto deaktiviert werden, sobald mindestens
+ein Passkey registriert ist.
+
+Die gesamte Oberfläche ist auf Deutsch, Englisch und Polnisch verfügbar
+(Sprachumschalter, Cookie-basiert). Gerichte, Essenszeiten, Allergene und
+Zusatzstoffe lassen sich zusätzlich auf Englisch/Polnisch benennen –
+mit optionaler automatischer Übersetzung über DeepL (siehe
+`DEEPL_API_KEY` unten) und jederzeit manuell korrigierbar.
+
+## Projektstruktur
+
+```
+app/                    Next.js-Routen
+  page.tsx              Öffentliche Speisekarte
+  login/                Login (Passwort + Passkey)
+  vorschlag/             Öffentliches Rezeptvorschlag-Formular
+  intern/               Kantinen-Bereich (Rolle: staff oder admin)
+    vorschlaege/         Rezeptvorschläge sichten/übernehmen
+  admin/                Verwaltung (Rolle: admin)
+  api/admin/users/      Benutzerverwaltung (serverseitig, Service-Role-Key)
+  api/translate/         DeepL-Anbindung (serverseitig)
+  api/locale/             Sprach-Cookie setzen
+components/             Client-Komponenten (WeekEditor, DishManager, …)
+components/i18n/        Sprachkontext, Sprachumschalter
+lib/i18n/               Wörterbücher (de/en/pl), Locale-Helfer
+lib/supabase/           Supabase-Clients (Browser / Server / Admin)
+lib/                    Typen, Datums-/Formatierungshelfer
+proxy.ts                Session-Refresh + Schutz von /intern und /admin
+supabase/migrations/    Schema & Seed-Daten (Referenz/Doku)
+supabase/local/         Skripte + Dumps für die lokale PostgreSQL-Kopie
+scripts/                Hilfsskripte (DB-Migration, lokaler Sync)
 ```

-Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
+## Entwicklung

-You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.
+Voraussetzung in beiden Varianten: `.env.local` mit den Werten aus
+`.env.example` (liegt lokal bereits vor und ist per `.gitignore` vom
+Repo ausgeschlossen).

-This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.
+**Variante A – Docker (nichts vorinstallieren außer Docker):**

-## Learn More
+```bash
+docker compose --env-file .env.local --profile dev up dev
+# http://localhost:3000 (Hot-Reload, Quellcode wird gemountet)
+```

-To learn more about Next.js, take a look at the following resources:
+**Variante B – lokal installiertes Node.js:**

- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
+```bash
+npm install
+npm run dev            # http://localhost:3000 (bindet an 0.0.0.0, auch im LAN erreichbar)
+```

-You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!
+## Umgebungsvariablen (Live-Betrieb)

-## Deploy on Vercel
+Beim Webserver/Hoster müssen genau diese drei Variablen hinterlegt werden
+(Werte: Supabase-Dashboard → Project Settings → API Keys):

-The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.
+| Variable | Bedeutung | Geheim? |
+| --- | --- | --- |
+| `NEXT_PUBLIC_SUPABASE_URL` | URL des Supabase-Projekts, z. B. `https://hvzikwjoyhoakedlywhj.supabase.co` | nein |
+| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Öffentlicher anon-Key (RLS schützt die Daten) | nein |
+| `SUPABASE_SERVICE_ROLE_KEY` | Service-Role-Key für die Benutzerverwaltung | **ja – niemals im Browser/Repo!** |
+| `APP_URL` | Öffentliche URL der App, z. B. `https://menu.example.de` (Origin-Check hinter Reverse-Proxy; zugleich Passkey-Domain) | nein |
+| `SITE_TITLE` | Titel im Browser-Tab und Überschrift ohne Logo, Default `Canteen Menu` | nein |
+| `DEEPL_API_KEY` | Optional: aktiviert „Automatisch übersetzen“ für Gerichte/Allergene/Zusatzstoffe (DeepL, kostenloser Free-Tier). Ohne Key funktioniert alles weiter, nur automatisch übersetzen ist deaktiviert | **ja – niemals im Browser/Repo!** |

-Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.
+Build & Start auf dem Server – **mit Docker** (empfohlen, Node.js und
+PostgreSQL müssen nicht installiert sein):
+
+```bash
+docker compose --env-file .env.local up -d --build
+# App: Port 3000 (hinter Reverse-Proxy mit HTTPS betreiben)
+# Lokale DB-Kopie: Port 5433 (Dienst "db", optional)
+```
+
+Oder klassisch ohne Docker:
+
+```bash
+npm ci
+npm run build
+npm run start          # Port 3000, bindet an 0.0.0.0 (hinter Reverse-Proxy betreiben)
+```
+
+### Passkeys für die Produktions-Domain freischalten
+
+Passkeys sind an die Domain gebunden. Aktuell ist `localhost` konfiguriert.
+Vor dem Livegang: `APP_URL` auf die öffentliche URL setzen und einmalig
+
+```bash
+SUPABASE_ACCESS_TOKEN=<personal-access-token> node scripts/configure-passkeys.mjs
+```
+
+ausführen (liest `APP_URL` aus der Umgebung; die URL kann alternativ als
+Argument übergeben werden). Ohne lokales Node.js geht es auch über Docker:
+
+```bash
+docker run --rm -v .:/app -w /app \
+  -e SUPABASE_ACCESS_TOKEN=<token> -e APP_URL=https://menu.example.de \
+  node:24-alpine node scripts/configure-passkeys.mjs
+```
+
+Achtung: Bereits registrierte Passkeys der alten Domain verlieren dabei
+ihre Gültigkeit und müssen neu registriert werden.
+
+## Datenbank
+
+### Supabase (führende Datenbank)
+
+- Projekt-Ref: `hvzikwjoyhoakedlywhj` (Region `eu-central-1`, Frankfurt)
+- Schema und Seed-Daten: `supabase/migrations/0001_init.sql` und `0002_seed.sql`
+- Ausführen weiterer SQL-Dateien:
+  `SUPABASE_ACCESS_TOKEN=<token> node scripts/db-apply.mjs <datei.sql>`
+
+Sicherheitsmodell (Row Level Security):
+
+- `anon` darf ausschließlich lesen (Speisekarte, Essenszeiten, Allergene,
+  Zusatzstoffe, Einstellungen).
+- `staff`/`admin` (Rolle im `profiles`-Eintrag) pflegen Gerichte,
+  Wochenplan und Kennzeichnungen.
+- Nur `admin` ändert Einstellungen (Farben/Logo) und verwaltet Benutzer;
+  das Anlegen/Löschen von Benutzern läuft serverseitig über den
+  Service-Role-Key (`app/api/admin/users`).
+- Storage-Bucket `branding` (Logo): öffentlich lesbar, Schreibzugriff nur Admin.
+
+### Lokale PostgreSQL-Kopie
+
+Die Datenbank `canteen_menu` (Kopie von Schema + Daten aus Supabase, inkl.
+Minimal-Stubs für `auth`/`storage`) gibt es in zwei Varianten:
+
+**Per Docker:** Der Dienst `db` aus `docker-compose.yml` spielt die
+Skripte aus `supabase/local/` beim ersten Start automatisch ein
+(PostgreSQL 17, Host-Port 5433 – 5432 ist meist durch eine native
+PostgreSQL-Installation belegt –, Passwort über `LOCAL_PG_PASSWORD`).
+
+**Nativ:** Auf dem Entwicklungsrechner läuft PostgreSQL 17 mit derselben
+Datenbank. Neu aufbauen bzw. aktualisieren:
+
+```powershell
+$env:SUPABASE_DB_PASSWORD = "<Supabase-DB-Passwort>"
+$env:LOCAL_PG_PASSWORD    = "<lokales postgres-Passwort>"
+powershell -File scripts\sync-local-db.ps1
+```
+
+Hinweis: Die lokale Kopie dient als Ablage/Backup und für Auswertungen.
+Logins (Passwort-Hashes, Passkeys) verbleiben ausschließlich in Supabase.
+
+## Zugangsdaten
+
+Die Anmeldedaten (Admin, Demo-Mitarbeiter, Datenbank-Passwörter) stehen in
+`ZUGANGSDATEN.md` – diese Datei ist bewusst **nicht** im Repository
+(`.gitignore`). Nach dem ersten Login bitte die Startpasswörter ändern.
@@ -0,0 +1,5 @@
+import DesignEditor from "@/components/DesignEditor";
+
+export default function DesignPage() {
+  return <DesignEditor />;
+}
@@ -0,0 +1,34 @@
+import { redirect } from "next/navigation";
+import { createClient } from "@/lib/supabase/server";
+import AppHeader from "@/components/AppHeader";
+
+export default async function AdminLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) redirect("/login");
+
+  const { data: profile } = await supabase
+    .from("profiles")
+    .select("role, full_name")
+    .eq("id", user.id)
+    .single();
+  if (profile?.role !== "admin") redirect("/intern");
+
+  return (
+    <div className="flex-1 flex flex-col">
+      <AppHeader
+        role="admin"
+        displayName={profile.full_name || user.email || ""}
+      />
+      <main className="max-w-[1600px] mx-auto w-full px-4 py-6 flex-1">
+        {children}
+      </main>
+    </div>
+  );
+}
@@ -0,0 +1,5 @@
+import UserManager from "@/components/UserManager";
+
+export default function AdminPage() {
+  return <UserManager />;
+}
@@ -0,0 +1,119 @@
+import { NextResponse } from "next/server";
+import { createClient } from "@/lib/supabase/server";
+import { createAdminClient } from "@/lib/supabase/admin";
+import { isSameOrigin } from "@/lib/origin";
+
+// Benutzerverwaltung (nur Admin). Läuft serverseitig mit dem
+// Service-Role-Key, da das Anlegen/Löschen von Auth-Benutzern
+// nicht über den anon key möglich ist.
+
+async function requireAdmin(request: Request) {
+  if (!isSameOrigin(request)) return null;
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return null;
+
+  const admin = createAdminClient();
+  const { data: profile } = await admin
+    .from("profiles")
+    .select("role")
+    .eq("id", user.id)
+    .single();
+  if (profile?.role !== "admin") return null;
+  return { user, admin };
+}
+
+export async function POST(request: Request) {
+  const ctx = await requireAdmin(request);
+  if (!ctx) return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
+
+  const body = await request.json().catch(() => null);
+  const { email, password, full_name, role } = body ?? {};
+  if (!email || !password || !["admin", "staff"].includes(role)) {
+    return NextResponse.json({ error: "Ungültige Eingaben." }, { status: 400 });
+  }
+  if (String(password).length < 8) {
+    return NextResponse.json(
+      { error: "Das Passwort muss mindestens 8 Zeichen lang sein." },
+      { status: 400 }
+    );
+  }
+
+  const { data, error } = await ctx.admin.auth.admin.createUser({
+    email,
+    password,
+    email_confirm: true,
+    user_metadata: { full_name: full_name ?? "", role },
+  });
+  if (error) {
+    return NextResponse.json(
+      {
+        error: /already been registered/i.test(error.message)
+          ? "Diese E-Mail-Adresse ist bereits registriert."
+          : error.message,
+      },
+      { status: 400 }
+    );
+  }
+  return NextResponse.json({ id: data.user?.id });
+}
+
+export async function PATCH(request: Request) {
+  const ctx = await requireAdmin(request);
+  if (!ctx) return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
+
+  const body = await request.json().catch(() => null);
+  const { id, full_name, role, password } = body ?? {};
+  if (!id || (role && !["admin", "staff"].includes(role))) {
+    return NextResponse.json({ error: "Ungültige Eingaben." }, { status: 400 });
+  }
+  // Der Admin darf sich nicht selbst die Admin-Rolle entziehen,
+  // sonst sperrt er sich aus der Verwaltung aus.
+  if (id === ctx.user.id && role === "staff") {
+    return NextResponse.json(
+      { error: "Du kannst dir nicht selbst die Admin-Rolle entziehen." },
+      { status: 400 }
+    );
+  }
+
+  if (password) {
+    if (String(password).length < 8) {
+      return NextResponse.json(
+        { error: "Das Passwort muss mindestens 8 Zeichen lang sein." },
+        { status: 400 }
+      );
+    }
+    const { error } = await ctx.admin.auth.admin.updateUserById(id, { password });
+    if (error) return NextResponse.json({ error: error.message }, { status: 400 });
+  }
+
+  const updates: Record<string, string> = {};
+  if (typeof full_name === "string") updates.full_name = full_name;
+  if (role) updates.role = role;
+  if (Object.keys(updates).length > 0) {
+    const { error } = await ctx.admin.from("profiles").update(updates).eq("id", id);
+    if (error) return NextResponse.json({ error: error.message }, { status: 400 });
+  }
+  return NextResponse.json({ ok: true });
+}
+
+export async function DELETE(request: Request) {
+  const ctx = await requireAdmin(request);
+  if (!ctx) return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
+
+  const body = await request.json().catch(() => null);
+  const { id } = body ?? {};
+  if (!id) return NextResponse.json({ error: "Ungültige Eingaben." }, { status: 400 });
+  if (id === ctx.user.id) {
+    return NextResponse.json(
+      { error: "Du kannst dich nicht selbst löschen." },
+      { status: 400 }
+    );
+  }
+
+  const { error } = await ctx.admin.auth.admin.deleteUser(id);
+  if (error) return NextResponse.json({ error: error.message }, { status: 400 });
+  return NextResponse.json({ ok: true });
+}
@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { isLocale, LOCALE_COOKIE } from "@/lib/i18n";
+import { isSameOrigin } from "@/lib/origin";
+
+// Setzt das Sprach-Cookie. Kein Login nötig (auch anonyme Besucher
+// der öffentlichen Speisekarte sollen die Sprache wechseln können).
+export async function POST(request: Request) {
+  if (!isSameOrigin(request)) {
+    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
+  }
+  const body = await request.json().catch(() => null);
+  const locale = body?.locale;
+  if (!isLocale(locale)) {
+    return NextResponse.json({ error: "Ungültige Sprache." }, { status: 400 });
+  }
+  const response = NextResponse.json({ ok: true });
+  response.cookies.set(LOCALE_COOKIE, locale, {
+    path: "/",
+    maxAge: 60 * 60 * 24 * 365,
+    sameSite: "lax",
+  });
+  return response;
+}
@@ -0,0 +1,100 @@
+import { NextResponse } from "next/server";
+import { createClient } from "@/lib/supabase/server";
+import { createAdminClient } from "@/lib/supabase/admin";
+import { isSameOrigin } from "@/lib/origin";
+
+// Übersetzt einen deutschen Text nach Englisch/Polnisch via DeepL und
+// schreibt das Ergebnis in die _en/_pl-Spalte der angegebenen Zeile.
+// Ohne DEEPL_API_KEY läuft die Route kontrolliert ins Leere (configured:
+// false), damit das UI die manuelle Eingabe anbieten kann.
+
+const ALLOWED_TABLES: Record<string, { idColumn: string; textColumn: string }> = {
+  dishes: { idColumn: "id", textColumn: "name" },
+  sections: { idColumn: "key", textColumn: "label" },
+  allergens: { idColumn: "code", textColumn: "name" },
+  additives: { idColumn: "code", textColumn: "name" },
+};
+
+async function translateWithDeepL(text: string, targetLang: "EN" | "PL", apiKey: string) {
+  const host = apiKey.endsWith(":fx")
+    ? "https://api-free.deepl.com"
+    : "https://api.deepl.com";
+  const res = await fetch(`${host}/v2/translate`, {
+    method: "POST",
+    headers: {
+      Authorization: `DeepL-Auth-Key ${apiKey}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      text: [text],
+      target_lang: targetLang,
+      source_lang: "DE",
+    }),
+  });
+  if (!res.ok) {
+    throw new Error(`DeepL antwortete mit ${res.status}: ${await res.text()}`);
+  }
+  const data = await res.json();
+  return data.translations?.[0]?.text as string | undefined;
+}
+
+export async function POST(request: Request) {
+  if (!isSameOrigin(request)) {
+    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
+  }
+
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return NextResponse.json({ error: "Nicht angemeldet." }, { status: 401 });
+
+  const admin = createAdminClient();
+  const { data: profile } = await admin
+    .from("profiles")
+    .select("role")
+    .eq("id", user.id)
+    .single();
+  if (!profile || !["staff", "admin"].includes(profile.role)) {
+    return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
+  }
+
+  const body = await request.json().catch(() => null);
+  const { table, id, text } = body ?? {};
+  const config = ALLOWED_TABLES[table];
+  if (!config || typeof text !== "string" || !text.trim()) {
+    return NextResponse.json({ error: "Ungültige Eingaben." }, { status: 400 });
+  }
+  // Bei einem noch nicht gespeicherten (neuen) Eintrag gibt es keine
+  // Zeile zum Aktualisieren – nur übersetzen, das Speichern übernimmt
+  // anschließend das reguläre Formular.
+  const persist = typeof id === "string" && id.length > 0;
+
+  const apiKey = process.env.DEEPL_API_KEY;
+  if (!apiKey) {
+    return NextResponse.json({ configured: false });
+  }
+
+  try {
+    const [en, pl] = await Promise.all([
+      translateWithDeepL(text, "EN", apiKey),
+      translateWithDeepL(text, "PL", apiKey),
+    ]);
+    if (!en || !pl) throw new Error("Keine Übersetzung erhalten.");
+
+    if (persist) {
+      const { error } = await admin
+        .from(table)
+        .update({ [`${config.textColumn}_en`]: en, [`${config.textColumn}_pl`]: pl })
+        .eq(config.idColumn, id);
+      if (error) throw new Error(error.message);
+    }
+
+    return NextResponse.json({ configured: true, en, pl });
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Übersetzung fehlgeschlagen." },
+      { status: 502 }
+    );
+  }
+}
@@ -1,26 +1,138 @@
@import "tailwindcss";

+/* Farb-Variablen: Defaults entsprechen r-hofmann.de; werden zur Laufzeit
+   aus den Einstellungen (Supabase settings.colors) überschrieben. */
 :root {
-  --background: #ffffff;
-  --foreground: #171717;
-}
-
-@theme inline {
-  --color-background: var(--background);
-  --color-foreground: var(--foreground);
-  --font-sans: var(--font-geist-sans);
-  --font-mono: var(--font-geist-mono);
-}
-
-@media (prefers-color-scheme: dark) {
-  :root {
-    --background: #0a0a0a;
-    --foreground: #ededed;
-  }
+  --c-primary: #003388;
+  --c-primary-dark: #0d315c;
+  --c-accent: #ff6900;
+  --c-header-text: #ffffff;
+  --c-row-bg: #e3e4f1;
+  --c-row-bg-alt: #f4f4fa;
+  --c-add: #6da54c;
+  --c-del: #e2371d;
 }

 body {
-  background: var(--background);
-  color: var(--foreground);
-  font-family: Arial, Helvetica, sans-serif;
+  background: #ffffff;
+  color: #1a1a1a;
+  font-family: var(--font-geist-sans), Arial, Helvetica, sans-serif;
+}
+
+/* ---------- Buttons ---------- */
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 9999px;
+  padding: 0.35rem 1rem;
+  font-size: 0.8rem;
+  font-weight: 600;
+  color: #ffffff;
+  cursor: pointer;
+  border: 1px solid rgb(0 0 0 / 0.15);
+  transition: filter 0.15s ease;
+  text-decoration: none;
+  white-space: nowrap;
+}
+.btn:hover { filter: brightness(1.08); }
+.btn:disabled { opacity: 0.5; cursor: not-allowed; }
+.btn-add { background: var(--c-add); }
+.btn-del { background: var(--c-del); }
+.btn-primary { background: var(--c-primary); }
+.btn-neutral { background: #6b7280; }
+
+/* ---------- Formulare ---------- */
+.input {
+  width: 100%;
+  border: 1px solid #d1d5db;
+  border-radius: 0.375rem;
+  padding: 0.4rem 0.6rem;
+  font-size: 0.9rem;
+  background: #ffffff;
+  color: #1a1a1a;
+}
+.input:focus { outline: 2px solid var(--c-primary); outline-offset: 0; }
+.label {
+  display: block;
+  font-size: 0.8rem;
+  font-weight: 600;
+  margin-bottom: 0.15rem;
+  color: #374151;
+}
+.card {
+  background: #ffffff;
+  border: 1px solid #e5e7eb;
+  border-radius: 0.5rem;
+  padding: 1rem;
+  box-shadow: 0 1px 2px rgb(0 0 0 / 0.05);
+}
+
+/* ---------- Speisekarten-Tabelle ---------- */
+.menu-table {
+  width: 100%;
+  border-collapse: separate;
+  border-spacing: 2px;
+  table-layout: fixed;
+}
+.menu-table th.day-head {
+  background: var(--c-primary);
+  color: var(--c-header-text);
+  padding: 0.5rem 0.5rem;
+  font-size: 0.9rem;
+  line-height: 1.3;
+}
+.menu-table th.section-head {
+  background: var(--c-primary);
+  color: var(--c-header-text);
+  text-align: left;
+  vertical-align: middle;
+  padding: 0.6rem 0.8rem;
+  font-size: 0.95rem;
+}
+.menu-table th.section-head .time {
+  font-weight: 400;
+  font-size: 0.8rem;
+}
+.menu-table td.cell {
+  background: var(--c-row-bg);
+  vertical-align: top;
+  text-align: center;
+  padding: 0.5rem;
+  font-size: 0.85rem;
+}
+.menu-table tr:nth-child(even) td.cell { background: var(--c-row-bg-alt); }
+.menu-table td.cell .dish { margin-bottom: 0.35rem; }
+.menu-table td.cell .dish sup {
+  font-size: 0.6rem;
+  color: #4b5563;
+  margin-left: 0.15rem;
+}
+
+/* ---------- Chip-Auswahl (Allergene/Zusatzstoffe je Gericht) ---------- */
+.chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.25rem;
+  border-radius: 9999px;
+  padding: 0.2rem 0.65rem;
+  font-size: 0.75rem;
+  line-height: 1.2;
+  border: 1px solid #d1d5db;
+  background: #f9fafb;
+  color: #374151;
+  cursor: pointer;
+  transition: background 0.15s ease, border-color 0.15s ease, color 0.15s ease;
+}
+.chip:hover { border-color: var(--c-primary); }
+.chip-active {
+  background: var(--c-primary);
+  border-color: var(--c-primary);
+  color: #ffffff;
+}
+.dish-codes {
+  font-size: 0.65rem;
+  color: #6b7280;
+  vertical-align: super;
+  margin-left: 0.15rem;
 }
@@ -0,0 +1,5 @@
+import SectionManager from "@/components/SectionManager";
+
+export default function EssenszeitenPage() {
+  return <SectionManager />;
+}
@@ -0,0 +1,5 @@
+import DishManager from "@/components/DishManager";
+
+export default function GerichtePage() {
+  return <DishManager translateEnabled={!!process.env.DEEPL_API_KEY} />;
+}
@@ -0,0 +1,11 @@
+import CodeListManager from "@/components/CodeListManager";
+
+export default function KennzeichnungPage() {
+  const translateEnabled = !!process.env.DEEPL_API_KEY;
+  return (
+    <div className="grid gap-6 lg:grid-cols-2">
+      <CodeListManager table="allergens" translateEnabled={translateEnabled} />
+      <CodeListManager table="additives" translateEnabled={translateEnabled} />
+    </div>
+  );
+}
@@ -0,0 +1,34 @@
+import { redirect } from "next/navigation";
+import { createClient } from "@/lib/supabase/server";
+import AppHeader from "@/components/AppHeader";
+
+export default async function InternLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) redirect("/login");
+
+  const { data: profile } = await supabase
+    .from("profiles")
+    .select("role, full_name")
+    .eq("id", user.id)
+    .single();
+  if (!profile || !["staff", "admin"].includes(profile.role)) redirect("/");
+
+  return (
+    <div className="flex-1 flex flex-col">
+      <AppHeader
+        role={profile.role}
+        displayName={profile.full_name || user.email || ""}
+      />
+      <main className="max-w-[1600px] mx-auto w-full px-4 py-6 flex-1">
+        {children}
+      </main>
+    </div>
+  );
+}
@@ -0,0 +1,11 @@
+import { mondayOf } from "@/lib/menu";
+import WeekEditor from "@/components/WeekEditor";
+
+export default async function InternPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ woche?: string }>;
+}) {
+  const { woche } = await searchParams;
+  return <WeekEditor monday={mondayOf(woche)} />;
+}
@@ -0,0 +1,5 @@
+import SuggestionReview from "@/components/SuggestionReview";
+
+export default function VorschlaegePage() {
+  return <SuggestionReview />;
+}
@@ -0,0 +1,36 @@
+import { redirect } from "next/navigation";
+import { createClient } from "@/lib/supabase/server";
+import AppHeader from "@/components/AppHeader";
+import AccountManager from "@/components/AccountManager";
+
+export default async function KontoPage() {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) redirect("/login");
+
+  const { data: profile } = await supabase
+    .from("profiles")
+    .select("role, full_name, password_auth_enabled")
+    .eq("id", user.id)
+    .single();
+  if (!profile || !["staff", "admin"].includes(profile.role)) redirect("/");
+
+  return (
+    <div className="flex-1 flex flex-col">
+      <AppHeader
+        role={profile.role}
+        displayName={profile.full_name || user.email || ""}
+      />
+      <main className="max-w-[1600px] mx-auto w-full px-4 py-6 flex-1">
+        <AccountManager
+          role={profile.role}
+          initialFullName={profile.full_name ?? ""}
+          initialEmail={user.email ?? ""}
+          initialPasswordAuthEnabled={profile.password_auth_enabled}
+        />
+      </main>
+    </div>
+  );
+}
@@ -1,33 +1,68 @@
 import type { Metadata } from "next";
-import { Geist, Geist_Mono } from "next/font/google";
+import { Geist } from "next/font/google";
 import "./globals.css";
+import { createClient } from "@/lib/supabase/server";
+import { COLOR_VARS, DEFAULT_COLORS, faviconUrl, SITE_TITLE } from "@/lib/types";
+import { getDictionary, getLocale } from "@/lib/i18n";
+import { LocaleProvider } from "@/components/i18n/LocaleProvider";
+import packageJson from "@/package.json";
+
+// Farben/Logo/Favicon sollen Änderungen sofort widerspiegeln.
+export const dynamic = "force-dynamic";

 const geistSans = Geist({
  variable: "--font-geist-sans",
  subsets: ["latin"],
 });

-const geistMono = Geist_Mono({
-  variable: "--font-geist-mono",
-  subsets: ["latin"],
-});
+export async function generateMetadata(): Promise<Metadata> {
+  const supabase = await createClient();
+  const { data: settings } = await supabase
+    .from("settings")
+    .select("favicon_path")
+    .eq("id", 1)
+    .maybeSingle();

-export const metadata: Metadata = {
-  title: "Create Next App",
-  description: "Generated by create next app",
-};
+  return {
+    title: SITE_TITLE,
+    description: "Speisekarte der Betriebskantine",
+    // Immer explizit setzen: app/favicon.ico würde sonst zusätzlich zu
+    // einem eigenen Favicon eingebunden (Next.js kombiniert Datei-
+    // Konvention und Metadata statt sie zu ersetzen).
+    icons: { icon: faviconUrl(settings?.favicon_path) ?? "/favicon.ico" },
+  };
+}

-export default function RootLayout({
+export default async function RootLayout({
  children,
 }: Readonly<{
  children: React.ReactNode;
 }>) {
+  const supabase = await createClient();
+  const [{ data: settings }, locale] = await Promise.all([
+    supabase.from("settings").select("colors").eq("id", 1).maybeSingle(),
+    getLocale(),
+  ]);
+  const dict = getDictionary(locale);
+
+  const colors: Record<string, string> = {
+    ...DEFAULT_COLORS,
+    ...((settings?.colors as Record<string, string>) ?? {}),
+  };
+  const style = Object.fromEntries(
+    Object.entries(COLOR_VARS).map(([key, cssVar]) => [cssVar, colors[key]])
+  ) as React.CSSProperties;
+
  return (
-    <html
-      lang="en"
-      className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`}
-    >
-      <body className="min-h-full flex flex-col">{children}</body>
+    <html lang={locale} className={`${geistSans.variable} h-full antialiased`}>
+      <body style={style} className="min-h-full flex flex-col">
+        <LocaleProvider locale={locale} dict={dict}>
+          {children}
+        </LocaleProvider>
+        <footer className="mt-auto px-4 py-2 text-right text-xs text-gray-400 select-none">
+          Version {packageJson.version}
+        </footer>
+      </body>
    </html>
  );
 }
@@ -0,0 +1,156 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import Link from "next/link";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { useDict } from "@/components/i18n/LocaleProvider";
+import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
+import type { Dict } from "@/lib/i18n/shared";
+
+function authErrorMessage(dict: Dict, message: string): string {
+  if (/invalid login credentials/i.test(message))
+    return dict.login.errorInvalidCredentials;
+  if (/email not confirmed/i.test(message))
+    return dict.login.errorEmailNotConfirmed;
+  if (/cancelled|aborted|NotAllowedError/i.test(message))
+    return dict.login.errorPasskeyCancelled;
+  return formatMessage(dict.login.errorGeneric, { message });
+}
+
+export default function LoginPage() {
+  const router = useRouter();
+  const supabase = createClient();
+  const dict = useDict();
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  async function redirectByRole(userId: string) {
+    const { data: profile } = await supabase
+      .from("profiles")
+      .select("role")
+      .eq("id", userId)
+      .single();
+    router.replace(profile?.role === "admin" ? "/admin" : "/intern");
+    router.refresh();
+  }
+
+  async function signInWithPassword(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    setBusy(true);
+    const { data, error } = await supabase.auth.signInWithPassword({
+      email,
+      password,
+    });
+    if (error || !data.user) {
+      setError(authErrorMessage(dict, error?.message ?? "Unbekannter Fehler"));
+      setBusy(false);
+      return;
+    }
+
+    const { data: profile } = await supabase
+      .from("profiles")
+      .select("role, password_auth_enabled")
+      .eq("id", data.user.id)
+      .single();
+    if (profile?.password_auth_enabled === false) {
+      await supabase.auth.signOut();
+      setError(dict.login.errorPasswordDisabled);
+      setBusy(false);
+      return;
+    }
+    router.replace(profile?.role === "admin" ? "/admin" : "/intern");
+    router.refresh();
+  }
+
+  async function signInWithPasskey() {
+    setError(null);
+    setBusy(true);
+    try {
+      const { data, error } = await supabase.auth.signInWithPasskey();
+      if (error || !data?.user) {
+        setError(
+          authErrorMessage(dict, error?.message ?? "Passkey-Anmeldung fehlgeschlagen")
+        );
+        setBusy(false);
+        return;
+      }
+      await redirectByRole(data.user.id);
+    } catch (err) {
+      setError(authErrorMessage(dict, err instanceof Error ? err.message : String(err)));
+      setBusy(false);
+    }
+  }
+
+  return (
+    <div className="flex-1 flex items-center justify-center p-4">
+      <div className="card w-full max-w-sm">
+        <div className="flex justify-between items-center mb-4">
+          <h1 className="text-xl font-bold text-[var(--c-primary)]">
+            {dict.login.title}
+          </h1>
+          <LanguageSwitcher variant="light" />
+        </div>
+        <form onSubmit={signInWithPassword} className="space-y-3">
+          <div>
+            <label className="label" htmlFor="email">
+              {dict.common.email}
+            </label>
+            <input
+              id="email"
+              type="email"
+              className="input"
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              autoComplete="username webauthn"
+              required
+            />
+          </div>
+          <div>
+            <label className="label" htmlFor="password">
+              {dict.common.password}
+            </label>
+            <input
+              id="password"
+              type="password"
+              className="input"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              autoComplete="current-password"
+              required
+            />
+          </div>
+          {error && <p className="text-sm text-[var(--c-del)]">{error}</p>}
+          <button type="submit" className="btn btn-primary w-full" disabled={busy}>
+            {dict.login.submit}
+          </button>
+        </form>
+
+        <div className="my-4 flex items-center gap-3 text-xs text-gray-400">
+          <span className="h-px flex-1 bg-gray-200" />
+          {dict.login.or}
+          <span className="h-px flex-1 bg-gray-200" />
+        </div>
+
+        <button
+          type="button"
+          onClick={signInWithPasskey}
+          className="btn btn-neutral w-full"
+          disabled={busy}
+        >
+          {dict.login.passkeyButton}
+        </button>
+
+        <p className="mt-4 text-center text-sm">
+          <Link href="/" className="text-gray-500 hover:text-[var(--c-primary)]">
+            {dict.login.backToMenu}
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}
@@ -0,0 +1,18 @@
+import { NextResponse } from "next/server";
+import { createClient } from "@/lib/supabase/server";
+import { isSameOrigin } from "@/lib/origin";
+
+export async function POST(request: Request) {
+  if (!isSameOrigin(request)) {
+    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
+  }
+  const supabase = await createClient();
+  await supabase.auth.signOut();
+  // Relative Weiterleitung: bei einer absoluten URL aus request.url landet
+  // sonst die Server-Bindung (0.0.0.0) statt des aufgerufenen Hosts im
+  // Location-Header.
+  return new NextResponse(null, {
+    status: 303,
+    headers: { Location: "/login" },
+  });
+}
@@ -1,65 +1,190 @@
-import Image from "next/image";
+import Link from "next/link";
+import { createClient } from "@/lib/supabase/server";
+import {
+  addDays,
+  dishCodes,
+  entriesFor,
+  formatDateLong,
+  formatPrice,
+  mondayOf,
+  todayISO,
+} from "@/lib/menu";
+import { getDictionary, getLocale } from "@/lib/i18n";
+import { localized, logoUrl, SITE_TITLE } from "@/lib/types";
+import type { CodeItem, MenuEntry, Section } from "@/lib/types";
+import PublicMobileMenu from "@/components/PublicMobileMenu";
+import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
+
+export default async function Home({
+  searchParams,
+}: {
+  searchParams: Promise<{ woche?: string }>;
+}) {
+  const { woche } = await searchParams;
+  const monday = mondayOf(woche);
+  const friday = addDays(monday, 4);
+  const currentWeek = mondayOf(todayISO());
+  const locale = await getLocale();
+  const dict = getDictionary(locale);
+  const days = dict.weekdays.long.map((weekday, i) => ({
+    weekday,
+    iso: addDays(monday, i),
+  }));
+
+  const supabase = await createClient();
+  const [sectionsRes, entriesRes, allergensRes, additivesRes, settingsRes] =
+    await Promise.all([
+      supabase.from("sections").select("*").order("sort"),
+      supabase
+        .from("menu_entries")
+        .select(
+          "id, menu_date, section_key, position, dish:dishes(id, name, name_en, name_pl, price, allergens, additives)"
+        )
+        .gte("menu_date", monday)
+        .lte("menu_date", friday)
+        .order("position")
+        .order("created_at"),
+      supabase.from("allergens").select("*").order("sort"),
+      supabase.from("additives").select("*").order("sort"),
+      supabase.from("settings").select("logo_path").eq("id", 1).maybeSingle(),
+    ]);
+
+  const sections = (sectionsRes.data ?? []) as Section[];
+  const entries = (entriesRes.data ?? []) as unknown as MenuEntry[];
+  const allergens = (allergensRes.data ?? []) as CodeItem[];
+  const additives = (additivesRes.data ?? []) as CodeItem[];
+  const logo = logoUrl(settingsRes.data?.logo_path);

-export default function Home() {
  return (
-    <div className="flex flex-col flex-1 items-center justify-center bg-zinc-50 font-sans dark:bg-black">
-      <main className="flex flex-1 w-full max-w-3xl flex-col items-center justify-between py-32 px-16 bg-white dark:bg-black sm:items-start">
-        <Image
-          className="dark:invert"
-          src="/next.svg"
-          alt="Next.js logo"
-          width={100}
-          height={20}
-          priority
+    <div className="flex-1 px-4 py-6 max-w-[1600px] mx-auto w-full">
+      {/* Kopfbereich: Sprache + Login-Link eigene Zeile, Logo zentriert
+          darunter. Kein absolutes Positionieren mehr – ein breites Logo
+          (z. B. ein Banner-Format) konnte sonst mit dem Login-Link
+          kollidieren. */}
+      <header className="mb-6">
+        <div className="flex justify-end items-center gap-3 mb-2">
+          {/* Auf Mobilgeräten übernimmt PublicMobileMenu den
+              Sprachumschalter, hier würde er sonst doppelt erscheinen. */}
+          <div className="hidden sm:block">
+            <LanguageSwitcher variant="light" />
+          </div>
+          <Link
+            href="/login"
+            className="text-sm text-gray-500 hover:text-[var(--c-primary)]"
+          >
+            {dict.common.login}
+          </Link>
+        </div>
+        <div className="flex justify-center">
+          {logo ? (
+            // eslint-disable-next-line @next/next/no-img-element
+            <img
+              src={logo}
+              alt="Logo"
+              className="h-20 max-w-full object-contain"
            />
-        <div className="flex flex-col items-center gap-6 text-center sm:items-start sm:text-left">
-          <h1 className="max-w-xs text-3xl font-semibold leading-10 tracking-tight text-black dark:text-zinc-50">
-            To get started, edit the page.tsx file.
+          ) : (
+            <h1 className="text-4xl font-extrabold tracking-tight text-[var(--c-primary)]">
+              {SITE_TITLE}
            </h1>
-          <p className="max-w-md text-lg leading-8 text-zinc-600 dark:text-zinc-400">
-            Looking for a starting point or more instructions? Head over to{" "}
-            <a
-              href="https://vercel.com/templates?framework=next.js&utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-              className="font-medium text-zinc-950 dark:text-zinc-50"
-            >
-              Templates
-            </a>{" "}
-            or the{" "}
-            <a
-              href="https://nextjs.org/learn?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-              className="font-medium text-zinc-950 dark:text-zinc-50"
-            >
-              Learning
-            </a>{" "}
-            center.
-          </p>
+          )}
        </div>
-        <div className="flex flex-col gap-4 text-base font-medium sm:flex-row">
-          <a
-            className="flex h-12 w-full items-center justify-center gap-2 rounded-full bg-foreground px-5 text-background transition-colors hover:bg-[#383838] dark:hover:bg-[#ccc] md:w-[158px]"
-            href="https://vercel.com/new?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-            target="_blank"
-            rel="noopener noreferrer"
-          >
-            <Image
-              className="dark:invert"
-              src="/vercel.svg"
-              alt="Vercel logomark"
-              width={16}
-              height={16}
-            />
-            Deploy Now
-          </a>
-          <a
-            className="flex h-12 w-full items-center justify-center rounded-full border border-solid border-black/[.08] px-5 transition-colors hover:border-transparent hover:bg-black/[.04] dark:border-white/[.145] dark:hover:bg-[#1a1a1a] md:w-[158px]"
-            href="https://nextjs.org/docs?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-            target="_blank"
-            rel="noopener noreferrer"
-          >
-            Documentation
-          </a>
+      </header>
+
+      {/* Mobil: Tag (Standard) oder Woche umschaltbar */}
+      <PublicMobileMenu monday={monday} sections={sections} entries={entries} />
+
+      {/* Ab "sm": klassische Wochentabelle */}
+      <div className="hidden sm:block">
+        <div className="flex flex-wrap items-center gap-3 mb-4">
+          <Link href={`/?woche=${addDays(monday, -7)}`} className="btn btn-add">
+            {dict.publicMenu.prevWeek}
+          </Link>
+          <Link href={`/?woche=${currentWeek}`} className="btn btn-primary">
+            {dict.publicMenu.today}
+          </Link>
+          <Link href={`/?woche=${addDays(monday, 7)}`} className="btn btn-add">
+            {dict.publicMenu.nextWeek}
+          </Link>
+          <Link href="/vorschlag" className="btn btn-neutral ml-auto">
+            {dict.publicMenu.suggestDish}
+          </Link>
        </div>
-      </main>
+
+        <div className="overflow-x-auto">
+          <table className="menu-table">
+            <thead>
+              <tr>
+                <th className="section-head w-56" aria-hidden />
+                {days.map((d) => (
+                  <th key={d.iso} className="day-head">
+                    <span className="font-bold">{d.weekday}</span>
+                    <br />
+                    {formatDateLong(d.iso, dict.dateLocale)}
+                  </th>
+                ))}
+              </tr>
+            </thead>
+            <tbody>
+              {sections.map((s) => (
+                <tr key={s.key}>
+                  <th className="section-head">
+                    <div>{localized(s, locale)}</div>
+                    <div className="time">{s.time_range}</div>
+                  </th>
+                  {days.map((d) => (
+                    <td key={d.iso} className="cell">
+                      {entriesFor(entries, d.iso, s.key).map((e) => {
+                        const codes = dishCodes(e.dish);
+                        return (
+                          <div key={e.id} className="dish">
+                            <span className="font-bold">
+                              {localized(e.dish, locale)}
+                            </span>
+                            {codes && <sup className="dish-codes">{codes}</sup>}
+                            {" – "}
+                            {formatPrice(e.dish.price)}
+                          </div>
+                        );
+                      })}
+                    </td>
+                  ))}
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      </div>
+
+      {/* Allergene & Zusatzstoffe: Legende zu den Kürzeln bei den Gerichten */}
+      <section className="mt-8 grid gap-6 sm:grid-cols-2 text-sm text-gray-700">
+        <div>
+          <h2 className="font-bold text-[var(--c-primary)] mb-2">
+            {dict.publicMenu.allergens}
+          </h2>
+          <ul className="space-y-0.5">
+            {allergens.map((a) => (
+              <li key={a.code}>
+                <span className="font-semibold">{a.code}</span> –{" "}
+                {localized(a, locale)}
+              </li>
+            ))}
+          </ul>
+        </div>
+        <div>
+          <h2 className="font-bold text-[var(--c-primary)] mb-2">
+            {dict.publicMenu.additives}
+          </h2>
+          <ul className="space-y-0.5">
+            {additives.map((a) => (
+              <li key={a.code}>
+                <span className="font-semibold">{a.code}</span> –{" "}
+                {localized(a, locale)}
+              </li>
+            ))}
+          </ul>
+        </div>
+      </section>
    </div>
  );
 }
@@ -0,0 +1,5 @@
+import SuggestionForm from "@/components/SuggestionForm";
+
+export default function VorschlagPage() {
+  return <SuggestionForm />;
+}
@@ -0,0 +1,333 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import { useRouter } from "next/navigation";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import type { Dict } from "@/lib/i18n/shared";
+import PasskeyManager from "@/components/PasskeyManager";
+import { useDict } from "@/components/i18n/LocaleProvider";
+
+function authErrorMessage(dict: Dict, message: string): string {
+  if (/invalid login credentials/i.test(message))
+    return dict.account.wrongCurrentPassword;
+  if (/should be at least/i.test(message)) return dict.account.passwordTooShort;
+  if (/email.*already|already.*registered/i.test(message))
+    return dict.account.emailAlreadyUsed;
+  return message;
+}
+
+export default function AccountManager({
+  role,
+  initialFullName,
+  initialEmail,
+  initialPasswordAuthEnabled,
+}: {
+  role: string;
+  initialFullName: string;
+  initialEmail: string;
+  initialPasswordAuthEnabled: boolean;
+}) {
+  const supabase = useMemo(() => createClient(), []);
+  const router = useRouter();
+  const dict = useDict();
+  const roleLabel = role === "admin" ? dict.common.roleAdmin : dict.common.roleStaff;
+
+  // Persönliche Daten
+  const [fullName, setFullName] = useState(initialFullName);
+  const [nameError, setNameError] = useState<string | null>(null);
+  const [nameInfo, setNameInfo] = useState<string | null>(null);
+  const [nameBusy, setNameBusy] = useState(false);
+
+  // E-Mail-Adresse
+  const [email, setEmail] = useState(initialEmail);
+  const [emailError, setEmailError] = useState<string | null>(null);
+  const [emailInfo, setEmailInfo] = useState<string | null>(null);
+  const [emailBusy, setEmailBusy] = useState(false);
+
+  // Passwort
+  const [currentPassword, setCurrentPassword] = useState("");
+  const [newPassword, setNewPassword] = useState("");
+  const [newPasswordRepeat, setNewPasswordRepeat] = useState("");
+  const [pwError, setPwError] = useState<string | null>(null);
+  const [pwInfo, setPwInfo] = useState<string | null>(null);
+  const [pwBusy, setPwBusy] = useState(false);
+
+  // Passwort-Anmeldung an/aus
+  const [passwordAuthEnabled, setPasswordAuthEnabled] = useState(
+    initialPasswordAuthEnabled
+  );
+  const [passkeyCount, setPasskeyCount] = useState<number | null>(null);
+  const [authError, setAuthError] = useState<string | null>(null);
+  const [authInfo, setAuthInfo] = useState<string | null>(null);
+  const [authBusy, setAuthBusy] = useState(false);
+
+  useEffect(() => {
+    supabase.auth.passkey
+      .list()
+      .then(({ data }) => setPasskeyCount((data ?? []).length));
+  }, [supabase]);
+
+  async function saveName(e: React.FormEvent) {
+    e.preventDefault();
+    setNameError(null);
+    setNameInfo(null);
+    const name = fullName.trim();
+    if (!name) {
+      setNameError(dict.account.nameRequired);
+      return;
+    }
+    setNameBusy(true);
+    const { error } = await supabase
+      .from("profiles")
+      .update({ full_name: name })
+      .eq("id", (await supabase.auth.getUser()).data.user?.id ?? "");
+    if (error)
+      setNameError(formatMessage(dict.account.saveError, { message: error.message }));
+    else {
+      setNameInfo(dict.account.nameSaved);
+      router.refresh();
+    }
+    setNameBusy(false);
+  }
+
+  async function saveEmail(e: React.FormEvent) {
+    e.preventDefault();
+    setEmailError(null);
+    setEmailInfo(null);
+    const next = email.trim();
+    if (!next || next === initialEmail) return;
+    setEmailBusy(true);
+    const { error } = await supabase.auth.updateUser({ email: next });
+    if (error) {
+      setEmailError(
+        formatMessage(dict.account.changeError, {
+          message: authErrorMessage(dict, error.message),
+        })
+      );
+    } else {
+      setEmailInfo(dict.account.emailSent);
+    }
+    setEmailBusy(false);
+  }
+
+  async function savePassword(e: React.FormEvent) {
+    e.preventDefault();
+    setPwError(null);
+    setPwInfo(null);
+    if (newPassword.length < 8) {
+      setPwError(dict.account.passwordTooShort);
+      return;
+    }
+    if (newPassword !== newPasswordRepeat) {
+      setPwError(dict.account.passwordMismatch);
+      return;
+    }
+    setPwBusy(true);
+
+    // Zur Verifizierung: aktuelles Passwort gegenprüfen, bevor geändert wird.
+    const { error: verifyError } = await supabase.auth.signInWithPassword({
+      email: initialEmail,
+      password: currentPassword,
+    });
+    if (verifyError) {
+      setPwError(authErrorMessage(dict, verifyError.message));
+      setPwBusy(false);
+      return;
+    }
+
+    const { error } = await supabase.auth.updateUser({ password: newPassword });
+    if (error) {
+      setPwError(
+        formatMessage(dict.account.changeError, {
+          message: authErrorMessage(dict, error.message),
+        })
+      );
+    } else {
+      setPwInfo(dict.account.passwordChanged);
+      setCurrentPassword("");
+      setNewPassword("");
+      setNewPasswordRepeat("");
+    }
+    setPwBusy(false);
+  }
+
+  async function togglePasswordAuth() {
+    setAuthError(null);
+    setAuthInfo(null);
+    const next = !passwordAuthEnabled;
+    if (!next && (passkeyCount ?? 0) === 0) {
+      setAuthError(dict.account.passwordAuthNeedsPasskey);
+      return;
+    }
+    if (!next && !window.confirm(dict.account.confirmDisablePasswordAuth)) return;
+
+    setAuthBusy(true);
+    const { error } = await supabase
+      .from("profiles")
+      .update({ password_auth_enabled: next })
+      .eq("id", (await supabase.auth.getUser()).data.user?.id ?? "");
+    if (error) {
+      setAuthError(formatMessage(dict.account.saveError, { message: error.message }));
+    } else {
+      setPasswordAuthEnabled(next);
+      setAuthInfo(
+        next ? dict.account.passwordAuthEnabled : dict.account.passwordAuthDisabled
+      );
+    }
+    setAuthBusy(false);
+  }
+
+  return (
+    <div className="max-w-3xl space-y-6">
+      <div>
+        <h1 className="text-xl font-bold text-[var(--c-primary)]">
+          {dict.account.title}
+        </h1>
+        <p className="text-sm text-gray-500">
+          {initialEmail} – {roleLabel}
+        </p>
+      </div>
+
+      <section className="card">
+        <h2 className="font-semibold mb-3">{dict.account.personalTitle}</h2>
+        <form onSubmit={saveName} className="space-y-3">
+          <div className="max-w-80">
+            <label className="label" htmlFor="account-name">
+              {dict.common.name}
+            </label>
+            <input
+              id="account-name"
+              className="input"
+              value={fullName}
+              onChange={(e) => setFullName(e.target.value)}
+              required
+            />
+          </div>
+          {nameError && (
+            <p className="text-sm text-[var(--c-del)]" role="alert">
+              {nameError}
+            </p>
+          )}
+          {nameInfo && <p className="text-sm text-green-700">{nameInfo}</p>}
+          <button type="submit" className="btn btn-add" disabled={nameBusy}>
+            {dict.account.saveName}
+          </button>
+        </form>
+      </section>
+
+      <section className="card">
+        <h2 className="font-semibold mb-3">{dict.account.emailTitle}</h2>
+        <form onSubmit={saveEmail} className="space-y-3">
+          <div className="max-w-80">
+            <label className="label" htmlFor="account-email">
+              {dict.common.email}
+            </label>
+            <input
+              id="account-email"
+              type="email"
+              className="input"
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              required
+            />
+          </div>
+          {emailError && (
+            <p className="text-sm text-[var(--c-del)]" role="alert">
+              {emailError}
+            </p>
+          )}
+          {emailInfo && <p className="text-sm text-green-700">{emailInfo}</p>}
+          <button
+            type="submit"
+            className="btn btn-add"
+            disabled={emailBusy || email.trim() === initialEmail}
+          >
+            {dict.account.changeEmail}
+          </button>
+        </form>
+      </section>
+
+      <section className="card">
+        <h2 className="font-semibold mb-3">{dict.account.passwordTitle}</h2>
+        <form onSubmit={savePassword} className="space-y-3">
+          <div className="max-w-80">
+            <label className="label" htmlFor="account-current-password">
+              {dict.account.currentPassword}
+            </label>
+            <input
+              id="account-current-password"
+              type="password"
+              className="input"
+              value={currentPassword}
+              onChange={(e) => setCurrentPassword(e.target.value)}
+              autoComplete="current-password"
+              required
+            />
+          </div>
+          <div className="max-w-80">
+            <label className="label" htmlFor="account-new-password">
+              {dict.account.newPassword}
+            </label>
+            <input
+              id="account-new-password"
+              type="password"
+              className="input"
+              value={newPassword}
+              onChange={(e) => setNewPassword(e.target.value)}
+              autoComplete="new-password"
+              minLength={8}
+              required
+            />
+          </div>
+          <div className="max-w-80">
+            <label className="label" htmlFor="account-new-password-repeat">
+              {dict.account.newPasswordRepeat}
+            </label>
+            <input
+              id="account-new-password-repeat"
+              type="password"
+              className="input"
+              value={newPasswordRepeat}
+              onChange={(e) => setNewPasswordRepeat(e.target.value)}
+              autoComplete="new-password"
+              minLength={8}
+              required
+            />
+          </div>
+          {pwError && (
+            <p className="text-sm text-[var(--c-del)]" role="alert">
+              {pwError}
+            </p>
+          )}
+          {pwInfo && <p className="text-sm text-green-700">{pwInfo}</p>}
+          <button type="submit" className="btn btn-add" disabled={pwBusy}>
+            {dict.account.changePassword}
+          </button>
+        </form>
+      </section>
+
+      <section className="card">
+        <h2 className="font-semibold mb-1">{dict.account.passwordAuthTitle}</h2>
+        <p className="text-sm text-gray-600 mb-3">{dict.account.passwordAuthHint}</p>
+        {authError && (
+          <p className="mb-2 text-sm text-[var(--c-del)]" role="alert">
+            {authError}
+          </p>
+        )}
+        {authInfo && <p className="mb-2 text-sm text-green-700">{authInfo}</p>}
+        <label className="flex items-center gap-2 cursor-pointer text-sm w-fit">
+          <input
+            type="checkbox"
+            checked={passwordAuthEnabled}
+            onChange={togglePasswordAuth}
+            disabled={authBusy || passkeyCount === null}
+          />
+          {dict.account.passwordAuthCheckbox}
+        </label>
+      </section>
+
+      <PasskeyManager />
+    </div>
+  );
+}
@@ -0,0 +1,105 @@
+"use client";
+
+// Gemeinsamer Kopfbereich für alle internen Seiten. Statt zweier
+// getrennter Bereiche (Kantine/Verwaltung) gibt es eine Navigation:
+// Admins sehen zusätzlich die Verwaltungs-Links, der aktive Punkt
+// wird hervorgehoben.
+
+import Link from "next/link";
+import { usePathname } from "next/navigation";
+import type { Role } from "@/lib/types";
+import { useDict } from "@/components/i18n/LocaleProvider";
+import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
+
+export default function AppHeader({
+  role,
+  displayName,
+}: {
+  role: Role;
+  displayName: string;
+}) {
+  const pathname = usePathname();
+  const dict = useDict();
+
+  const menuLinks = [
+    { href: "/intern", label: dict.header.weekPlan },
+    { href: "/intern/essenszeiten", label: dict.header.sections },
+    { href: "/intern/gerichte", label: dict.header.dishes },
+    { href: "/intern/kennzeichnung", label: dict.header.labels },
+    { href: "/intern/vorschlaege", label: dict.header.suggestions },
+  ];
+  const adminLinks = [
+    { href: "/admin", label: dict.header.users },
+    { href: "/admin/design", label: dict.header.design },
+  ];
+
+  const linkClass = (href: string) =>
+    `rounded px-2 py-0.5 transition-colors hover:bg-white/10 ${
+      pathname === href ? "bg-white/20 font-semibold" : "text-white/90"
+    }`;
+
+  return (
+    <header className="bg-[var(--c-primary-dark)] text-white">
+      <div className="max-w-[1600px] mx-auto w-full px-4 py-3 flex flex-wrap items-center gap-x-6 gap-y-2 text-sm">
+        <span className="font-bold text-base">{dict.header.canteen}</span>
+
+        <nav
+          className="flex flex-wrap items-center gap-x-1 gap-y-1"
+          aria-label={dict.header.menuGroup}
+        >
+          <span className="mr-1 text-xs uppercase tracking-wider text-white/50">
+            {dict.header.menuGroup}
+          </span>
+          {menuLinks.map((l) => (
+            <Link key={l.href} href={l.href} className={linkClass(l.href)}>
+              {l.label}
+            </Link>
+          ))}
+        </nav>
+
+        {role === "admin" && (
+          <nav
+            className="flex flex-wrap items-center gap-x-1 gap-y-1"
+            aria-label={dict.header.adminGroup}
+          >
+            <span className="mr-1 text-xs uppercase tracking-wider text-white/50">
+              {dict.header.adminGroup}
+            </span>
+            {adminLinks.map((l) => (
+              <Link key={l.href} href={l.href} className={linkClass(l.href)}>
+                {l.label}
+              </Link>
+            ))}
+          </nav>
+        )}
+
+        <Link
+          href="/"
+          className="rounded px-2 py-0.5 text-white/70 hover:bg-white/10"
+        >
+          {dict.header.viewMenu}
+        </Link>
+
+        <div className="ml-auto flex items-center gap-3">
+          <LanguageSwitcher />
+          <Link
+            href="/konto"
+            title={dict.header.myAccount}
+            className={`rounded px-2 py-0.5 hover:bg-white/10 ${
+              pathname === "/konto"
+                ? "bg-white/20 font-semibold"
+                : "text-white/80"
+            }`}
+          >
+            {displayName}
+          </Link>
+          <form action="/logout" method="post">
+            <button type="submit" className="btn btn-del">
+              {dict.common.logout}
+            </button>
+          </form>
+        </div>
+      </div>
+    </header>
+  );
+}
@@ -0,0 +1,48 @@
+"use client";
+
+import type { CodeItem } from "@/lib/types";
+import { localized } from "@/lib/types";
+import { useDict, useLocale } from "@/components/i18n/LocaleProvider";
+
+export default function ChipPicker({
+  items,
+  selected,
+  onToggle,
+  label,
+}: {
+  items: CodeItem[];
+  selected: string[];
+  onToggle: (code: string) => void;
+  label: string;
+}) {
+  const dict = useDict();
+  const locale = useLocale();
+
+  return (
+    <div>
+      <label className="label">{label}</label>
+      {items.length === 0 ? (
+        <p className="text-sm text-gray-400">{dict.codeList.empty}</p>
+      ) : (
+        <div className="flex flex-wrap gap-1.5">
+          {items.map((item) => {
+            const active = selected.includes(item.code);
+            const name = localized(item, locale);
+            return (
+              <button
+                key={item.code}
+                type="button"
+                onClick={() => onToggle(item.code)}
+                className={`chip ${active ? "chip-active" : ""}`}
+                aria-pressed={active}
+                title={name}
+              >
+                <span className="font-semibold">{item.code}</span> {name}
+              </button>
+            );
+          })}
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,264 @@
+"use client";
+
+// Pflege der globalen Allergen-/Zusatzstofflisten, die unterhalb
+// der öffentlichen Speisekarte angezeigt werden.
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { localized } from "@/lib/types";
+import type { CodeItem } from "@/lib/types";
+import { useDict, useLocale } from "@/components/i18n/LocaleProvider";
+
+export default function CodeListManager({
+  table,
+  translateEnabled,
+}: {
+  table: "allergens" | "additives";
+  translateEnabled: boolean;
+}) {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const locale = useLocale();
+  const title =
+    table === "allergens" ? dict.codeList.allergensTitle : dict.codeList.additivesTitle;
+  const codeLabel =
+    table === "allergens"
+      ? dict.codeList.allergenCodeLabel
+      : dict.codeList.additiveCodeLabel;
+
+  const [items, setItems] = useState<CodeItem[]>([]);
+  const [editing, setEditing] = useState<{
+    original: string | null; // code vor der Bearbeitung, null = neu
+    code: string;
+    name: string;
+    nameEn: string;
+    namePl: string;
+  } | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [translateState, setTranslateState] = useState<"idle" | "busy" | "done">(
+    "idle"
+  );
+
+  const load = useCallback(async () => {
+    const { data, error } = await supabase.from(table).select("*").order("sort");
+    if (error) setError(formatMessage(dict.codeList.loadError, { message: error.message }));
+    else setItems(data as CodeItem[]);
+  }, [supabase, table, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function save(e: React.FormEvent) {
+    e.preventDefault();
+    if (!editing) return;
+    setError(null);
+    const code = editing.code.trim();
+    const name = editing.name.trim();
+    if (!code || !name) return;
+    const payload = {
+      code,
+      name,
+      name_en: editing.nameEn.trim() || null,
+      name_pl: editing.namePl.trim() || null,
+    };
+
+    let dbError;
+    if (editing.original) {
+      ({ error: dbError } = await supabase
+        .from(table)
+        .update(payload)
+        .eq("code", editing.original));
+    } else {
+      const maxSort = items.reduce((m, i) => Math.max(m, i.sort), 0);
+      ({ error: dbError } = await supabase
+        .from(table)
+        .insert({ ...payload, sort: maxSort + 1 }));
+    }
+    if (dbError) {
+      setError(
+        /duplicate key/i.test(dbError.message)
+          ? formatMessage(dict.codeList.duplicateCode, { code })
+          : formatMessage(dict.codeList.saveError, { message: dbError.message })
+      );
+      return;
+    }
+    setEditing(null);
+    await load();
+  }
+
+  async function remove(item: CodeItem) {
+    if (
+      !window.confirm(
+        formatMessage(dict.codeList.confirmDelete, { code: item.code, name: item.name })
+      )
+    )
+      return;
+    const { error } = await supabase.from(table).delete().eq("code", item.code);
+    if (error)
+      setError(formatMessage(dict.codeList.deleteError, { message: error.message }));
+    await load();
+  }
+
+  async function autoTranslate() {
+    if (!editing || !editing.name.trim()) return;
+    setTranslateState("busy");
+    setError(null);
+    try {
+      const res = await fetch("/api/translate", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          table,
+          id: editing.original,
+          text: editing.name.trim(),
+        }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data?.error ?? `Fehler (${res.status})`);
+      setEditing((prev) =>
+        prev ? { ...prev, nameEn: data.en ?? prev.nameEn, namePl: data.pl ?? prev.namePl } : prev
+      );
+      setTranslateState("done");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setTranslateState("idle");
+    }
+  }
+
+  return (
+    <section className="card">
+      <div className="flex items-center gap-3 mb-3">
+        <h2 className="text-lg font-bold text-[var(--c-primary)] mr-auto">
+          {title}
+        </h2>
+        <button
+          type="button"
+          className="btn btn-add"
+          onClick={() => {
+            setEditing({ original: null, code: "", name: "", nameEn: "", namePl: "" });
+            setTranslateState("idle");
+          }}
+        >
+          {dict.common.add}
+        </button>
+      </div>
+
+      {error && (
+        <p className="mb-2 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+
+      {editing && (
+        <form onSubmit={save} className="mb-3 space-y-2 border-b border-gray-200 pb-3">
+          <div className="max-w-36">
+            <label className="label">{codeLabel}</label>
+            <input
+              className="input"
+              value={editing.code}
+              onChange={(e) => setEditing({ ...editing, code: e.target.value })}
+              required
+            />
+          </div>
+          <div>
+            <label className="label">{dict.codeList.nameLabel}</label>
+            <input
+              className="input"
+              value={editing.name}
+              onChange={(e) => setEditing({ ...editing, name: e.target.value })}
+              required
+            />
+          </div>
+          <div className="grid gap-2 sm:grid-cols-2">
+            <div>
+              <label className="label">{dict.dishManager.nameEnLabel}</label>
+              <input
+                className="input"
+                value={editing.nameEn}
+                onChange={(e) => setEditing({ ...editing, nameEn: e.target.value })}
+              />
+            </div>
+            <div>
+              <label className="label">{dict.dishManager.namePlLabel}</label>
+              <input
+                className="input"
+                value={editing.namePl}
+                onChange={(e) => setEditing({ ...editing, namePl: e.target.value })}
+              />
+            </div>
+          </div>
+          {translateEnabled && (
+            <div>
+              <button
+                type="button"
+                className="btn btn-neutral"
+                onClick={autoTranslate}
+                disabled={translateState === "busy" || !editing.name.trim()}
+              >
+                {translateState === "busy"
+                  ? dict.dishManager.translating
+                  : dict.dishManager.autoTranslate}
+              </button>
+              {translateState === "done" && (
+                <span className="ml-2 text-sm text-green-700">
+                  {dict.dishManager.translated}
+                </span>
+              )}
+            </div>
+          )}
+          <div className="flex gap-2">
+            <button type="submit" className="btn btn-add">
+              {dict.common.save}
+            </button>
+            <button
+              type="button"
+              className="btn btn-neutral"
+              onClick={() => setEditing(null)}
+            >
+              {dict.common.cancel}
+            </button>
+          </div>
+        </form>
+      )}
+
+      <ul className="divide-y divide-gray-100">
+        {items.map((item) => (
+          <li key={item.code} className="flex items-center gap-2 py-1.5 text-sm">
+            <span className="mr-auto">
+              <span className="font-semibold">{item.code}</span> –{" "}
+              {localized(item, locale)}
+            </span>
+            <button
+              type="button"
+              className="btn btn-primary"
+              onClick={() => {
+                setEditing({
+                  original: item.code,
+                  code: item.code,
+                  name: item.name,
+                  nameEn: item.name_en ?? "",
+                  namePl: item.name_pl ?? "",
+                });
+                setTranslateState("idle");
+              }}
+            >
+              {dict.common.edit}
+            </button>
+            <button
+              type="button"
+              className="btn btn-del"
+              onClick={() => remove(item)}
+            >
+              {dict.common.delete}
+            </button>
+          </li>
+        ))}
+        {items.length === 0 && (
+          <li className="py-2 text-gray-500 text-sm">{dict.codeList.empty}</li>
+        )}
+      </ul>
+    </section>
+  );
+}
@@ -0,0 +1,277 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { useRouter } from "next/navigation";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { DEFAULT_COLORS, faviconUrl, logoUrl } from "@/lib/types";
+import { useDict } from "@/components/i18n/LocaleProvider";
+
+type AssetKind = "logo" | "favicon";
+
+const ASSET_COLUMN: Record<AssetKind, "logo_path" | "favicon_path"> = {
+  logo: "logo_path",
+  favicon: "favicon_path",
+};
+
+export default function DesignEditor() {
+  const supabase = useMemo(() => createClient(), []);
+  const router = useRouter();
+  const dict = useDict();
+  const colorLabels: Record<string, string> = {
+    primary: dict.designEditor.colorPrimary,
+    primaryDark: dict.designEditor.colorPrimaryDark,
+    accent: dict.designEditor.colorAccent,
+    headerText: dict.designEditor.colorHeaderText,
+    rowBg: dict.designEditor.colorRowBg,
+    rowBgAlt: dict.designEditor.colorRowBgAlt,
+    addBtn: dict.designEditor.colorAddBtn,
+    deleteBtn: dict.designEditor.colorDeleteBtn,
+  };
+  const [colors, setColors] = useState<Record<string, string>>(DEFAULT_COLORS);
+  const [logoPath, setLogoPath] = useState<string | null>(null);
+  const [faviconPath, setFaviconPath] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [info, setInfo] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    const { data, error } = await supabase
+      .from("settings")
+      .select("colors, logo_path, favicon_path")
+      .eq("id", 1)
+      .maybeSingle();
+    if (error) {
+      setError(formatMessage(dict.designEditor.loadError, { message: error.message }));
+      return;
+    }
+    setColors({ ...DEFAULT_COLORS, ...(data?.colors ?? {}) });
+    setLogoPath(data?.logo_path ?? null);
+    setFaviconPath(data?.favicon_path ?? null);
+  }, [supabase, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function saveColors() {
+    setBusy(true);
+    setError(null);
+    setInfo(null);
+    const { error } = await supabase
+      .from("settings")
+      .update({ colors })
+      .eq("id", 1);
+    if (error)
+      setError(formatMessage(dict.designEditor.saveError, { message: error.message }));
+    else {
+      setInfo(dict.designEditor.colorsSaved);
+      router.refresh();
+    }
+    setBusy(false);
+  }
+
+  async function resetColors() {
+    setColors(DEFAULT_COLORS);
+  }
+
+  async function uploadAsset(kind: AssetKind, e: React.ChangeEvent<HTMLInputElement>) {
+    const file = e.target.files?.[0];
+    e.target.value = "";
+    if (!file) return;
+    if (!/^image\//.test(file.type)) {
+      setError(dict.designEditor.invalidImage);
+      return;
+    }
+    setBusy(true);
+    setError(null);
+    setInfo(null);
+
+    const oldPath = kind === "logo" ? logoPath : faviconPath;
+    const ext = file.name.split(".").pop()?.toLowerCase() ?? "png";
+    const path = `${kind}-${Date.now()}.${ext}`;
+    const { error: uploadError } = await supabase.storage
+      .from("branding")
+      .upload(path, file, { contentType: file.type });
+    if (uploadError) {
+      setError(formatMessage(dict.designEditor.uploadError, { message: uploadError.message }));
+      setBusy(false);
+      return;
+    }
+
+    const { error: settingsError } = await supabase
+      .from("settings")
+      .update({ [ASSET_COLUMN[kind]]: path })
+      .eq("id", 1);
+    if (settingsError) {
+      setError(formatMessage(dict.designEditor.saveError, { message: settingsError.message }));
+      setBusy(false);
+      return;
+    }
+    if (oldPath) await supabase.storage.from("branding").remove([oldPath]);
+
+    if (kind === "logo") setLogoPath(path);
+    else setFaviconPath(path);
+    setInfo(kind === "logo" ? dict.designEditor.logoUpdated : dict.designEditor.faviconUpdated);
+    router.refresh();
+    setBusy(false);
+  }
+
+  async function removeAsset(kind: AssetKind) {
+    const path = kind === "logo" ? logoPath : faviconPath;
+    if (!path) return;
+    if (
+      !window.confirm(
+        kind === "logo"
+          ? dict.designEditor.confirmRemoveLogo
+          : dict.designEditor.confirmRemoveFavicon
+      )
+    )
+      return;
+    setBusy(true);
+    setError(null);
+    const { error } = await supabase
+      .from("settings")
+      .update({ [ASSET_COLUMN[kind]]: null })
+      .eq("id", 1);
+    if (error) {
+      setError(formatMessage(dict.designEditor.saveError, { message: error.message }));
+    } else {
+      await supabase.storage.from("branding").remove([path]);
+      if (kind === "logo") setLogoPath(null);
+      else setFaviconPath(null);
+      setInfo(kind === "logo" ? dict.designEditor.logoRemoved : dict.designEditor.faviconRemoved);
+      router.refresh();
+    }
+    setBusy(false);
+  }
+
+  const currentLogo = logoUrl(logoPath);
+  const currentFavicon = faviconUrl(faviconPath);
+
+  return (
+    <div className="max-w-3xl space-y-6">
+      <h1 className="text-xl font-bold text-[var(--c-primary)]">
+        {dict.designEditor.title}
+      </h1>
+
+      {error && (
+        <p className="text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+      {info && <p className="text-sm text-green-700">{info}</p>}
+
+      <section className="card">
+        <h2 className="font-semibold mb-3">{dict.designEditor.logoTitle}</h2>
+        <p className="text-sm text-gray-600 mb-3">{dict.designEditor.logoHint}</p>
+        {currentLogo ? (
+          // eslint-disable-next-line @next/next/no-img-element
+          <img
+            src={currentLogo}
+            alt="Logo"
+            className="h-20 object-contain mb-3 border border-gray-200 rounded p-2"
+          />
+        ) : (
+          <p className="text-sm text-gray-400 mb-3">{dict.designEditor.logoNone}</p>
+        )}
+        <div className="flex gap-2 items-center">
+          <label className="btn btn-primary cursor-pointer">
+            {dict.designEditor.logoUpload}
+            <input
+              type="file"
+              accept="image/*"
+              className="hidden"
+              onChange={(e) => uploadAsset("logo", e)}
+              disabled={busy}
+            />
+          </label>
+          {currentLogo && (
+            <button
+              type="button"
+              className="btn btn-del"
+              onClick={() => removeAsset("logo")}
+              disabled={busy}
+            >
+              {dict.designEditor.logoRemove}
+            </button>
+          )}
+        </div>
+      </section>
+
+      <section className="card">
+        <h2 className="font-semibold mb-3">{dict.designEditor.faviconTitle}</h2>
+        <p className="text-sm text-gray-600 mb-3">{dict.designEditor.faviconHint}</p>
+        {currentFavicon ? (
+          // eslint-disable-next-line @next/next/no-img-element
+          <img
+            src={currentFavicon}
+            alt="Favicon"
+            className="h-10 w-10 object-contain mb-3 border border-gray-200 rounded p-1"
+          />
+        ) : (
+          <p className="text-sm text-gray-400 mb-3">{dict.designEditor.faviconNone}</p>
+        )}
+        <div className="flex gap-2 items-center">
+          <label className="btn btn-primary cursor-pointer">
+            {dict.designEditor.faviconUpload}
+            <input
+              type="file"
+              accept="image/*"
+              className="hidden"
+              onChange={(e) => uploadAsset("favicon", e)}
+              disabled={busy}
+            />
+          </label>
+          {currentFavicon && (
+            <button
+              type="button"
+              className="btn btn-del"
+              onClick={() => removeAsset("favicon")}
+              disabled={busy}
+            >
+              {dict.designEditor.faviconRemove}
+            </button>
+          )}
+        </div>
+      </section>
+
+      <section className="card">
+        <h2 className="font-semibold mb-3">{dict.designEditor.colorsTitle}</h2>
+        <div className="grid gap-3 sm:grid-cols-2">
+          {Object.entries(colorLabels).map(([key, label]) => (
+            <label key={key} className="flex items-center gap-3 text-sm">
+              <input
+                type="color"
+                value={colors[key] ?? "#000000"}
+                onChange={(e) =>
+                  setColors({ ...colors, [key]: e.target.value })
+                }
+                className="h-9 w-14 cursor-pointer border border-gray-300 rounded"
+              />
+              {label}
+            </label>
+          ))}
+        </div>
+        <div className="flex gap-2 mt-4">
+          <button
+            type="button"
+            className="btn btn-add"
+            onClick={saveColors}
+            disabled={busy}
+          >
+            {dict.designEditor.colorsSave}
+          </button>
+          <button
+            type="button"
+            className="btn btn-neutral"
+            onClick={resetColors}
+            disabled={busy}
+          >
+            {dict.designEditor.colorsReset}
+          </button>
+        </div>
+      </section>
+    </div>
+  );
+}
@@ -0,0 +1,446 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { createClient } from "@/lib/supabase/client";
+import { dishCodes, formatPrice } from "@/lib/menu";
+import { formatMessage } from "@/lib/i18n/shared";
+import { localized } from "@/lib/types";
+import type { CodeItem, Dish } from "@/lib/types";
+import ChipPicker from "@/components/ChipPicker";
+import { useDict, useLocale } from "@/components/i18n/LocaleProvider";
+
+interface DishForm {
+  id: string | null; // null = neues Gericht
+  name: string;
+  nameEn: string;
+  namePl: string;
+  price: string;
+  allergens: string[];
+  additives: string[];
+}
+
+const EMPTY_FORM: DishForm = {
+  id: null,
+  name: "",
+  nameEn: "",
+  namePl: "",
+  price: "",
+  allergens: [],
+  additives: [],
+};
+
+export default function DishManager({
+  translateEnabled,
+}: {
+  translateEnabled: boolean;
+}) {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const locale = useLocale();
+  const [dishes, setDishes] = useState<Dish[]>([]);
+  const [allergens, setAllergens] = useState<CodeItem[]>([]);
+  const [additives, setAdditives] = useState<CodeItem[]>([]);
+  const [form, setForm] = useState<DishForm | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const [bulkBusy, setBulkBusy] = useState(false);
+  const [search, setSearch] = useState("");
+  const [translateState, setTranslateState] = useState<"idle" | "busy" | "done">(
+    "idle"
+  );
+
+  // Live-Suche: filtert die Liste bereits während des Tippens
+  const visible = useMemo(() => {
+    const q = search.trim().toLowerCase();
+    return q ? dishes.filter((d) => d.name.toLowerCase().includes(q)) : dishes;
+  }, [dishes, search]);
+
+  const load = useCallback(async () => {
+    const [dishesRes, allergensRes, additivesRes] = await Promise.all([
+      supabase.from("dishes").select("*").order("name"),
+      supabase.from("allergens").select("*").order("sort"),
+      supabase.from("additives").select("*").order("sort"),
+    ]);
+    const problem = dishesRes.error ?? allergensRes.error ?? additivesRes.error;
+    if (problem)
+      setError(formatMessage(dict.dishManager.loadError, { message: problem.message }));
+    else {
+      setDishes(dishesRes.data as Dish[]);
+      setAllergens(allergensRes.data as CodeItem[]);
+      setAdditives(additivesRes.data as CodeItem[]);
+    }
+    setLoading(false);
+  }, [supabase, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function save(e: React.FormEvent) {
+    e.preventDefault();
+    if (!form) return;
+    setError(null);
+    const price = Number.parseFloat(form.price.replace(",", "."));
+    if (Number.isNaN(price) || price < 0) {
+      setError(dict.dishManager.invalidPrice);
+      return;
+    }
+    const payload = {
+      name: form.name.trim(),
+      name_en: form.nameEn.trim() || null,
+      name_pl: form.namePl.trim() || null,
+      price,
+      allergens: form.allergens,
+      additives: form.additives,
+    };
+    const { error } = form.id
+      ? await supabase.from("dishes").update(payload).eq("id", form.id)
+      : await supabase.from("dishes").insert(payload);
+    if (error) {
+      setError(formatMessage(dict.dishManager.saveError, { message: error.message }));
+      return;
+    }
+    setForm(null);
+    await load();
+  }
+
+  async function remove(dish: Dish) {
+    if (
+      !window.confirm(
+        formatMessage(dict.dishManager.confirmDelete, { name: dish.name })
+      )
+    )
+      return;
+    const { error } = await supabase.from("dishes").delete().eq("id", dish.id);
+    if (error)
+      setError(formatMessage(dict.dishManager.deleteError, { message: error.message }));
+    setSelected((prev) => {
+      const next = new Set(prev);
+      next.delete(dish.id);
+      return next;
+    });
+    await load();
+  }
+
+  function toggleOne(id: string) {
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  }
+
+  // "Alle auswählen" bezieht sich auf die aktuell gefilterte Liste
+  function toggleAll() {
+    setSelected((prev) => {
+      const next = new Set(prev);
+      const everyVisibleSelected = visible.every((d) => next.has(d.id));
+      visible.forEach((d) =>
+        everyVisibleSelected ? next.delete(d.id) : next.add(d.id)
+      );
+      return next;
+    });
+  }
+
+  async function removeSelected() {
+    if (selected.size === 0) return;
+    if (
+      !window.confirm(
+        formatMessage(dict.dishManager.confirmDeleteSelected, {
+          count: selected.size,
+        })
+      )
+    )
+      return;
+    setBulkBusy(true);
+    setError(null);
+    const { error } = await supabase
+      .from("dishes")
+      .delete()
+      .in("id", Array.from(selected));
+    if (error)
+      setError(formatMessage(dict.dishManager.deleteError, { message: error.message }));
+    setSelected(new Set());
+    setBulkBusy(false);
+    await load();
+  }
+
+  function toggleAllergen(code: string) {
+    if (!form) return;
+    setForm({
+      ...form,
+      allergens: form.allergens.includes(code)
+        ? form.allergens.filter((c) => c !== code)
+        : [...form.allergens, code],
+    });
+  }
+
+  function toggleAdditive(code: string) {
+    if (!form) return;
+    setForm({
+      ...form,
+      additives: form.additives.includes(code)
+        ? form.additives.filter((c) => c !== code)
+        : [...form.additives, code],
+    });
+  }
+
+  async function autoTranslate() {
+    if (!form || !form.name.trim()) return;
+    setTranslateState("busy");
+    setError(null);
+    try {
+      const res = await fetch("/api/translate", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          table: "dishes",
+          id: form.id,
+          text: form.name.trim(),
+        }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data?.error ?? `Fehler (${res.status})`);
+      setForm((prev) =>
+        prev ? { ...prev, nameEn: data.en ?? prev.nameEn, namePl: data.pl ?? prev.namePl } : prev
+      );
+      setTranslateState("done");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setTranslateState("idle");
+    }
+  }
+
+  const allSelected =
+    visible.length > 0 && visible.every((d) => selected.has(d.id));
+
+  return (
+    <div className="max-w-3xl">
+      <div className="flex items-center gap-3 mb-4">
+        <h1 className="text-xl font-bold text-[var(--c-primary)] mr-auto">
+          {dict.dishManager.title}
+        </h1>
+        <button
+          type="button"
+          className="btn btn-add"
+          onClick={() => {
+            setForm(EMPTY_FORM);
+            setTranslateState("idle");
+          }}
+        >
+          {dict.dishManager.newDish}
+        </button>
+      </div>
+
+      {error && (
+        <p className="mb-3 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+
+      {form && (
+        <form onSubmit={save} className="card mb-4 space-y-4">
+          <h2 className="font-semibold">
+            {form.id ? dict.dishManager.editDish : dict.dishManager.newDish}
+          </h2>
+          <div>
+            <label className="label" htmlFor="dish-name">
+              {dict.dishManager.nameLabel}
+            </label>
+            <input
+              id="dish-name"
+              className="input"
+              value={form.name}
+              onChange={(e) => setForm({ ...form, name: e.target.value })}
+              required
+            />
+          </div>
+          <div className="max-w-40">
+            <label className="label" htmlFor="dish-price">
+              {dict.dishManager.priceLabel}
+            </label>
+            <input
+              id="dish-price"
+              className="input"
+              inputMode="decimal"
+              placeholder={dict.dishManager.pricePlaceholder}
+              value={form.price}
+              onChange={(e) => setForm({ ...form, price: e.target.value })}
+              required
+            />
+          </div>
+
+          <div className="grid gap-3 sm:grid-cols-2">
+            <div>
+              <label className="label" htmlFor="dish-name-en">
+                {dict.dishManager.nameEnLabel}
+              </label>
+              <input
+                id="dish-name-en"
+                className="input"
+                value={form.nameEn}
+                onChange={(e) => setForm({ ...form, nameEn: e.target.value })}
+              />
+            </div>
+            <div>
+              <label className="label" htmlFor="dish-name-pl">
+                {dict.dishManager.namePlLabel}
+              </label>
+              <input
+                id="dish-name-pl"
+                className="input"
+                value={form.namePl}
+                onChange={(e) => setForm({ ...form, namePl: e.target.value })}
+              />
+            </div>
+          </div>
+          {translateEnabled && (
+            <div>
+              <button
+                type="button"
+                className="btn btn-neutral"
+                onClick={autoTranslate}
+                disabled={translateState === "busy" || !form.name.trim()}
+              >
+                {translateState === "busy"
+                  ? dict.dishManager.translating
+                  : dict.dishManager.autoTranslate}
+              </button>
+              {translateState === "done" && (
+                <span className="ml-2 text-sm text-green-700">
+                  {dict.dishManager.translated}
+                </span>
+              )}
+            </div>
+          )}
+
+          <ChipPicker
+            label={dict.codeList.allergensTitle}
+            items={allergens}
+            selected={form.allergens}
+            onToggle={toggleAllergen}
+          />
+          <ChipPicker
+            label={dict.codeList.additivesTitle}
+            items={additives}
+            selected={form.additives}
+            onToggle={toggleAdditive}
+          />
+          <div className="flex gap-2">
+            <button type="submit" className="btn btn-add">
+              {dict.common.save}
+            </button>
+            <button
+              type="button"
+              className="btn btn-neutral"
+              onClick={() => setForm(null)}
+            >
+              {dict.common.cancel}
+            </button>
+          </div>
+        </form>
+      )}
+
+      {loading ? (
+        <p className="text-gray-500">{dict.common.loading}</p>
+      ) : (
+        <>
+          {dishes.length > 0 && (
+            <input
+              type="search"
+              className="input mb-3"
+              placeholder={dict.dishManager.searchPlaceholder}
+              value={search}
+              onChange={(e) => setSearch(e.target.value)}
+              aria-label={dict.dishManager.searchPlaceholder}
+            />
+          )}
+          {dishes.length > 0 && (
+            <div className="flex items-center gap-3 mb-2 text-sm">
+              <label className="flex items-center gap-2 cursor-pointer">
+                <input
+                  type="checkbox"
+                  checked={allSelected}
+                  onChange={toggleAll}
+                />
+                {dict.dishManager.selectAll}
+              </label>
+              <span className="text-gray-500">
+                {formatMessage(dict.dishManager.selectedCount, { count: selected.size })}
+              </span>
+              <button
+                type="button"
+                className="btn btn-del ml-auto"
+                onClick={removeSelected}
+                disabled={selected.size === 0 || bulkBusy}
+              >
+                {selected.size > 0
+                  ? formatMessage(dict.dishManager.deleteSelectedCount, {
+                      count: selected.size,
+                    })
+                  : dict.dishManager.deleteSelected}
+              </button>
+            </div>
+          )}
+          <ul className="divide-y divide-gray-200 border border-gray-200 rounded-md bg-white">
+            {visible.map((dish) => {
+              const codes = dishCodes(dish);
+              return (
+                <li key={dish.id} className="flex items-center gap-3 px-4 py-2">
+                  <input
+                    type="checkbox"
+                    checked={selected.has(dish.id)}
+                    onChange={() => toggleOne(dish.id)}
+                    aria-label={dish.name}
+                  />
+                  <span className="mr-auto">
+                    <span className="font-semibold">{localized(dish, locale)}</span>
+                    {codes && <sup className="dish-codes">{codes}</sup>}{" "}
+                    <span className="text-gray-500">
+                      – {formatPrice(dish.price)}
+                    </span>
+                  </span>
+                  <button
+                    type="button"
+                    className="btn btn-primary"
+                    onClick={() => {
+                      setForm({
+                        id: dish.id,
+                        name: dish.name,
+                        nameEn: dish.name_en ?? "",
+                        namePl: dish.name_pl ?? "",
+                        price: String(dish.price).replace(".", ","),
+                        allergens: dish.allergens ?? [],
+                        additives: dish.additives ?? [],
+                      });
+                      setTranslateState("idle");
+                    }}
+                  >
+                    {dict.common.edit}
+                  </button>
+                  <button
+                    type="button"
+                    className="btn btn-del"
+                    onClick={() => remove(dish)}
+                  >
+                    {dict.common.delete}
+                  </button>
+                </li>
+              );
+            })}
+            {dishes.length === 0 && (
+              <li className="px-4 py-3 text-gray-500">{dict.dishManager.empty}</li>
+            )}
+            {dishes.length > 0 && visible.length === 0 && (
+              <li className="px-4 py-3 text-gray-500">
+                {formatMessage(dict.dishManager.noResults, { query: search })}
+              </li>
+            )}
+          </ul>
+        </>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,115 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { useDict } from "@/components/i18n/LocaleProvider";
+
+interface PasskeyItem {
+  id: string;
+  friendly_name?: string;
+  created_at: string;
+  last_used_at?: string;
+}
+
+export default function PasskeyManager() {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const [passkeys, setPasskeys] = useState<PasskeyItem[]>([]);
+  const [error, setError] = useState<string | null>(null);
+  const [info, setInfo] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    const { data, error } = await supabase.auth.passkey.list();
+    if (error)
+      setError(formatMessage(dict.passkeys.loadError, { message: error.message }));
+    else setPasskeys((data ?? []) as PasskeyItem[]);
+  }, [supabase, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function register() {
+    setError(null);
+    setInfo(null);
+    setBusy(true);
+    try {
+      const { error } = await supabase.auth.registerPasskey();
+      if (error) {
+        setError(formatMessage(dict.passkeys.registerError, { message: error.message }));
+      } else {
+        setInfo(dict.passkeys.registered);
+        await load();
+      }
+    } catch (err) {
+      setError(
+        /NotAllowedError|abort/i.test(String(err))
+          ? dict.passkeys.registerCancelled
+          : formatMessage(dict.passkeys.registerError, {
+              message: err instanceof Error ? err.message : String(err),
+            })
+      );
+    }
+    setBusy(false);
+  }
+
+  async function remove(pk: PasskeyItem) {
+    if (!window.confirm(dict.passkeys.confirmDelete)) return;
+    const { error } = await supabase.auth.passkey.delete({ passkeyId: pk.id });
+    if (error)
+      setError(formatMessage(dict.passkeys.deleteError, { message: error.message }));
+    await load();
+  }
+
+  return (
+    <section className="card">
+      <h2 className="font-semibold mb-1">{dict.passkeys.title}</h2>
+      <p className="text-sm text-gray-600 mb-3">{dict.passkeys.hint}</p>
+
+      {error && (
+        <p className="mb-2 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+      {info && <p className="mb-2 text-sm text-green-700">{info}</p>}
+
+      <button
+        type="button"
+        className="btn btn-add mb-3"
+        onClick={register}
+        disabled={busy}
+      >
+        {dict.passkeys.register}
+      </button>
+
+      <ul className="divide-y divide-gray-100">
+        {passkeys.map((pk) => (
+          <li key={pk.id} className="flex items-center gap-3 py-1.5 text-sm">
+            <span className="mr-auto">
+              <span className="font-semibold">
+                {pk.friendly_name || "Passkey"}
+              </span>{" "}
+              <span className="text-gray-500">
+                {formatMessage(dict.passkeys.createdOn, {
+                  date: new Date(pk.created_at).toLocaleDateString(dict.dateLocale),
+                })}
+              </span>
+            </span>
+            <button
+              type="button"
+              className="btn btn-del"
+              onClick={() => remove(pk)}
+            >
+              {dict.common.delete}
+            </button>
+          </li>
+        ))}
+        {passkeys.length === 0 && (
+          <li className="py-2 text-gray-500 text-sm">{dict.passkeys.empty}</li>
+        )}
+      </ul>
+    </section>
+  );
+}
@@ -0,0 +1,182 @@
+"use client";
+
+// Mobile Ansicht der öffentlichen Speisekarte: Tag (Standard) oder Woche,
+// umschaltbar ohne Seiten-Reload. Ab dem "sm"-Breakpoint übernimmt die
+// normale Wochentabelle (siehe app/page.tsx), diese Komponente blendet
+// sich dort per CSS aus.
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+import {
+  addDays,
+  dishCodes,
+  entriesFor,
+  formatDateLong,
+  formatPrice,
+  mondayOf,
+  todayISO,
+  weekdayIndex,
+} from "@/lib/menu";
+import { localized } from "@/lib/types";
+import type { MenuEntry, Section } from "@/lib/types";
+import { useDict, useLocale } from "@/components/i18n/LocaleProvider";
+import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
+
+export default function PublicMobileMenu({
+  monday,
+  sections,
+  entries,
+}: {
+  monday: string;
+  sections: Section[];
+  entries: MenuEntry[];
+}) {
+  const router = useRouter();
+  const dict = useDict();
+  const locale = useLocale();
+  const days = dict.weekdays.long.map((weekday, i) => ({
+    weekday,
+    short: dict.weekdays.short[i],
+    iso: addDays(monday, i),
+  }));
+  const isCurrentWeek = monday === mondayOf(todayISO());
+  const todayIdx = isCurrentWeek ? weekdayIndex(todayISO()) : -1;
+
+  const [tab, setTab] = useState<"tag" | "woche">("tag");
+  const [selectedIdx, setSelectedIdx] = useState(todayIdx >= 0 ? todayIdx : 0);
+
+  function goToday() {
+    const currentMonday = mondayOf(todayISO());
+    if (currentMonday === monday) {
+      const idx = weekdayIndex(todayISO());
+      setSelectedIdx(idx >= 0 ? idx : 0);
+      setTab("tag");
+    } else {
+      router.push(`/?woche=${currentMonday}`);
+    }
+  }
+
+  function renderDay(day: { weekday: string; iso: string }) {
+    return (
+      <div key={day.iso} className="mb-4 last:mb-0">
+        <h3 className="font-bold text-[var(--c-primary)] mb-2">
+          {day.weekday} · {formatDateLong(day.iso, dict.dateLocale)}
+        </h3>
+        <div className="space-y-3">
+          {sections.map((s) => {
+            const items = entriesFor(entries, day.iso, s.key);
+            return (
+              <div
+                key={s.key}
+                className="rounded-md border border-gray-200 overflow-hidden"
+              >
+                <div className="bg-[var(--c-primary)] text-[var(--c-header-text)] px-3 py-1.5 text-sm">
+                  <span className="font-semibold">{localized(s, locale)}</span>{" "}
+                  <span className="opacity-80">· {s.time_range}</span>
+                </div>
+                <div className="bg-[var(--c-row-bg)] px-3 py-2 text-sm">
+                  {items.length === 0 ? (
+                    <p className="text-gray-500">{dict.publicMenu.noEntry}</p>
+                  ) : (
+                    items.map((e) => {
+                      const codes = dishCodes(e.dish);
+                      return (
+                        <p key={e.id} className="mb-1 last:mb-0">
+                          <span className="font-semibold">
+                            {localized(e.dish, locale)}
+                          </span>
+                          {codes && <sup className="dish-codes">{codes}</sup>}{" "}
+                          – {formatPrice(e.dish.price)}
+                        </p>
+                      );
+                    })
+                  )}
+                </div>
+              </div>
+            );
+          })}
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="sm:hidden mb-6">
+      <div className="flex justify-end mb-3">
+        <LanguageSwitcher variant="light" />
+      </div>
+
+      <div className="flex gap-2 mb-3">
+        <Link
+          href={`/?woche=${addDays(monday, -7)}`}
+          className="btn btn-add flex-1 justify-center"
+        >
+          {dict.publicMenu.prevWeekShort}
+        </Link>
+        <button
+          type="button"
+          onClick={goToday}
+          className="btn btn-primary flex-1"
+        >
+          {dict.publicMenu.today}
+        </button>
+        <Link
+          href={`/?woche=${addDays(monday, 7)}`}
+          className="btn btn-add flex-1 justify-center"
+        >
+          {dict.publicMenu.nextWeekShort}
+        </Link>
+      </div>
+
+      <div className="flex gap-2 mb-3" role="tablist" aria-label="Ansicht">
+        <button
+          type="button"
+          role="tab"
+          aria-selected={tab === "tag"}
+          onClick={() => setTab("tag")}
+          className={`btn flex-1 ${tab === "tag" ? "btn-primary" : "btn-neutral"}`}
+        >
+          {dict.publicMenu.dayTab}
+        </button>
+        <button
+          type="button"
+          role="tab"
+          aria-selected={tab === "woche"}
+          onClick={() => setTab("woche")}
+          className={`btn flex-1 ${tab === "woche" ? "btn-primary" : "btn-neutral"}`}
+        >
+          {dict.publicMenu.weekTab}
+        </button>
+      </div>
+
+      {tab === "tag" ? (
+        <>
+          <div className="flex gap-1 mb-3">
+            {days.map((d, i) => (
+              <button
+                key={d.iso}
+                type="button"
+                onClick={() => setSelectedIdx(i)}
+                className={`flex-1 rounded-md py-1.5 text-sm font-semibold border transition-colors ${
+                  i === selectedIdx
+                    ? "bg-[var(--c-primary)] text-white border-[var(--c-primary)]"
+                    : "bg-white text-gray-600 border-gray-200"
+                } ${i === todayIdx ? "ring-2 ring-[var(--c-accent)] ring-offset-1" : ""}`}
+              >
+                {d.short}
+              </button>
+            ))}
+          </div>
+          {renderDay(days[selectedIdx])}
+        </>
+      ) : (
+        <div>{days.map((d) => renderDay(d))}</div>
+      )}
+
+      <Link href="/vorschlag" className="btn btn-neutral w-full justify-center mt-2">
+        {dict.publicMenu.suggestDish}
+      </Link>
+    </div>
+  );
+}
@@ -0,0 +1,298 @@
+"use client";
+
+// Verwaltung der Essenszeiten (Brotzeit, Mittagessen, …):
+// anlegen, umbenennen, Uhrzeit ändern, löschen, Reihenfolge anpassen.
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { localized } from "@/lib/types";
+import type { Section } from "@/lib/types";
+import { useDict, useLocale } from "@/components/i18n/LocaleProvider";
+
+interface SectionForm {
+  key: string | null; // null = neue Essenszeit
+  label: string;
+  labelEn: string;
+  labelPl: string;
+  timeFrom: string;
+  timeTo: string;
+}
+
+const EMPTY_FORM: SectionForm = {
+  key: null,
+  label: "",
+  labelEn: "",
+  labelPl: "",
+  timeFrom: "",
+  timeTo: "",
+};
+
+function splitTimeRange(range: string): { from: string; to: string } {
+  const [from, to] = range.split("-").map((s) => s.trim());
+  return { from: from ?? "", to: to ?? "" };
+}
+
+export default function SectionManager() {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const locale = useLocale();
+  const [sections, setSections] = useState<Section[]>([]);
+  const [form, setForm] = useState<SectionForm | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [busy, setBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    const { data, error } = await supabase.from("sections").select("*").order("sort");
+    if (error)
+      setError(formatMessage(dict.sectionManager.loadError, { message: error.message }));
+    else setSections(data as Section[]);
+    setLoading(false);
+  }, [supabase, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function save(e: React.FormEvent) {
+    e.preventDefault();
+    if (!form) return;
+    setError(null);
+    const label = form.label.trim();
+    if (!label || !form.timeFrom || !form.timeTo) return;
+    const payload = {
+      label,
+      label_en: form.labelEn.trim() || null,
+      label_pl: form.labelPl.trim() || null,
+      time_range: `${form.timeFrom} - ${form.timeTo}`,
+    };
+
+    let dbError;
+    if (form.key) {
+      ({ error: dbError } = await supabase
+        .from("sections")
+        .update(payload)
+        .eq("key", form.key));
+    } else {
+      // Frisch aus der DB lesen statt den lokalen State zu nutzen, damit
+      // ein veralteter Snapshot nicht zu doppelten sort-Werten führt.
+      const { data: maxRow } = await supabase
+        .from("sections")
+        .select("sort")
+        .order("sort", { ascending: false })
+        .limit(1)
+        .maybeSingle();
+      ({ error: dbError } = await supabase
+        .from("sections")
+        .insert({ ...payload, sort: (maxRow?.sort ?? 0) + 1 }));
+    }
+    if (dbError) {
+      setError(formatMessage(dict.sectionManager.saveError, { message: dbError.message }));
+      return;
+    }
+    setForm(null);
+    await load();
+  }
+
+  async function remove(section: Section) {
+    if (
+      !window.confirm(
+        formatMessage(dict.sectionManager.confirmDelete, { name: section.label })
+      )
+    )
+      return;
+    const { error } = await supabase.from("sections").delete().eq("key", section.key);
+    if (error)
+      setError(formatMessage(dict.sectionManager.deleteError, { message: error.message }));
+    await load();
+  }
+
+  async function move(section: Section, direction: -1 | 1) {
+    const idx = sections.findIndex((s) => s.key === section.key);
+    const neighbor = sections[idx + direction];
+    if (!neighbor) return;
+    setBusy(true);
+    setError(null);
+    const [r1, r2] = await Promise.all([
+      supabase.from("sections").update({ sort: neighbor.sort }).eq("key", section.key),
+      supabase.from("sections").update({ sort: section.sort }).eq("key", neighbor.key),
+    ]);
+    const dbError = r1.error ?? r2.error;
+    if (dbError)
+      setError(formatMessage(dict.sectionManager.saveError, { message: dbError.message }));
+    setBusy(false);
+    await load();
+  }
+
+  return (
+    <div className="max-w-3xl">
+      <div className="flex items-center gap-3 mb-4">
+        <h1 className="text-xl font-bold text-[var(--c-primary)] mr-auto">
+          {dict.sectionManager.title}
+        </h1>
+        <button
+          type="button"
+          className="btn btn-add"
+          onClick={() => setForm(EMPTY_FORM)}
+        >
+          {dict.sectionManager.newSection}
+        </button>
+      </div>
+
+      {error && (
+        <p className="mb-3 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+
+      {form && (
+        <form onSubmit={save} className="card mb-4 space-y-4">
+          <h2 className="font-semibold">
+            {form.key ? dict.sectionManager.editSection : dict.sectionManager.newSection}
+          </h2>
+          <div>
+            <label className="label" htmlFor="section-label">
+              {dict.sectionManager.nameLabel}
+            </label>
+            <input
+              id="section-label"
+              className="input"
+              value={form.label}
+              onChange={(e) => setForm({ ...form, label: e.target.value })}
+              required
+            />
+          </div>
+          <div className="grid gap-3 sm:grid-cols-2">
+            <div>
+              <label className="label" htmlFor="section-label-en">
+                {dict.sectionManager.nameEnLabel}
+              </label>
+              <input
+                id="section-label-en"
+                className="input"
+                value={form.labelEn}
+                onChange={(e) => setForm({ ...form, labelEn: e.target.value })}
+              />
+            </div>
+            <div>
+              <label className="label" htmlFor="section-label-pl">
+                {dict.sectionManager.namePlLabel}
+              </label>
+              <input
+                id="section-label-pl"
+                className="input"
+                value={form.labelPl}
+                onChange={(e) => setForm({ ...form, labelPl: e.target.value })}
+              />
+            </div>
+          </div>
+          <div className="flex gap-3">
+            <div className="max-w-32">
+              <label className="label" htmlFor="section-time-from">
+                {dict.sectionManager.timeFrom}
+              </label>
+              <input
+                id="section-time-from"
+                type="time"
+                className="input"
+                value={form.timeFrom}
+                onChange={(e) => setForm({ ...form, timeFrom: e.target.value })}
+                required
+              />
+            </div>
+            <div className="max-w-32">
+              <label className="label" htmlFor="section-time-to">
+                {dict.sectionManager.timeTo}
+              </label>
+              <input
+                id="section-time-to"
+                type="time"
+                className="input"
+                value={form.timeTo}
+                onChange={(e) => setForm({ ...form, timeTo: e.target.value })}
+                required
+              />
+            </div>
+          </div>
+          <div className="flex gap-2">
+            <button type="submit" className="btn btn-add">
+              {dict.common.save}
+            </button>
+            <button
+              type="button"
+              className="btn btn-neutral"
+              onClick={() => setForm(null)}
+            >
+              {dict.common.cancel}
+            </button>
+          </div>
+        </form>
+      )}
+
+      {loading ? (
+        <p className="text-gray-500">{dict.common.loading}</p>
+      ) : (
+        <ul className="divide-y divide-gray-200 border border-gray-200 rounded-md bg-white">
+          {sections.map((section, idx) => (
+            <li key={section.key} className="flex items-center gap-3 px-4 py-2">
+              <div className="flex flex-col">
+                <button
+                  type="button"
+                  className="text-gray-400 hover:text-[var(--c-primary)] disabled:opacity-30"
+                  onClick={() => move(section, -1)}
+                  disabled={busy || idx === 0}
+                  aria-label={dict.sectionManager.moveUp}
+                  title={dict.sectionManager.moveUp}
+                >
+                  ▲
+                </button>
+                <button
+                  type="button"
+                  className="text-gray-400 hover:text-[var(--c-primary)] disabled:opacity-30"
+                  onClick={() => move(section, 1)}
+                  disabled={busy || idx === sections.length - 1}
+                  aria-label={dict.sectionManager.moveDown}
+                  title={dict.sectionManager.moveDown}
+                >
+                  ▼
+                </button>
+              </div>
+              <span className="mr-auto">
+                <span className="font-semibold">{localized(section, locale)}</span>{" "}
+                <span className="text-gray-500">– {section.time_range}</span>
+              </span>
+              <button
+                type="button"
+                className="btn btn-primary"
+                onClick={() => {
+                  const { from, to } = splitTimeRange(section.time_range);
+                  setForm({
+                    key: section.key,
+                    label: section.label,
+                    labelEn: section.label_en ?? "",
+                    labelPl: section.label_pl ?? "",
+                    timeFrom: from,
+                    timeTo: to,
+                  });
+                }}
+              >
+                {dict.common.edit}
+              </button>
+              <button
+                type="button"
+                className="btn btn-del"
+                onClick={() => remove(section)}
+              >
+                {dict.common.delete}
+              </button>
+            </li>
+          ))}
+          {sections.length === 0 && (
+            <li className="px-4 py-3 text-gray-500">{dict.sectionManager.empty}</li>
+          )}
+        </ul>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+"use client";
+
+import { useState } from "react";
+import Link from "next/link";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { useDict } from "@/components/i18n/LocaleProvider";
+import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
+
+export default function SuggestionForm() {
+  const supabase = createClient();
+  const dict = useDict();
+  const [name, setName] = useState("");
+  const [description, setDescription] = useState("");
+  // Honeypot: für echte Nutzer unsichtbares Feld. Füllt ein Bot es aus,
+  // tun wir so, als sei alles gut gegangen, ohne wirklich zu speichern.
+  const [website, setWebsite] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [success, setSuccess] = useState(false);
+  const [busy, setBusy] = useState(false);
+
+  async function submit(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    const trimmedName = name.trim();
+    if (!trimmedName) {
+      setError(dict.suggestions.nameRequired);
+      return;
+    }
+    if (website.trim()) {
+      // Bot-Falle ausgelöst: keine echte Anfrage, aber Erfolg vortäuschen.
+      setSuccess(true);
+      return;
+    }
+    setBusy(true);
+
+    const { data: existing } = await supabase
+      .from("dishes")
+      .select("id")
+      .ilike("name", trimmedName)
+      .limit(1);
+    if (existing && existing.length > 0) {
+      setError(dict.suggestions.duplicate);
+      setBusy(false);
+      return;
+    }
+
+    const { error: insertError } = await supabase.from("dish_suggestions").insert({
+      name: trimmedName,
+      description: description.trim() || null,
+    });
+    if (insertError) {
+      setError(formatMessage(dict.suggestions.genericError, { message: insertError.message }));
+      setBusy(false);
+      return;
+    }
+    setSuccess(true);
+    setBusy(false);
+  }
+
+  return (
+    <div className="flex-1 flex items-center justify-center p-4">
+      <div className="card w-full max-w-md">
+        <div className="flex justify-between items-center mb-1">
+          <h1 className="text-xl font-bold text-[var(--c-primary)]">
+            {dict.suggestions.formTitle}
+          </h1>
+          <LanguageSwitcher variant="light" />
+        </div>
+        <p className="text-sm text-gray-600 mb-4">{dict.suggestions.formHint}</p>
+
+        {success ? (
+          <p className="text-sm text-green-700">{dict.suggestions.success}</p>
+        ) : (
+          <form onSubmit={submit} className="space-y-3">
+            <div>
+              <label className="label" htmlFor="suggestion-name">
+                {dict.suggestions.nameLabel}
+              </label>
+              <input
+                id="suggestion-name"
+                className="input"
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                required
+              />
+            </div>
+            <div>
+              <label className="label" htmlFor="suggestion-description">
+                {dict.suggestions.descriptionLabel}
+              </label>
+              <textarea
+                id="suggestion-description"
+                className="input"
+                rows={3}
+                value={description}
+                onChange={(e) => setDescription(e.target.value)}
+              />
+            </div>
+            {/* Honeypot – für Menschen unsichtbar, keine echten Nutzerdaten */}
+            <div className="absolute -left-[9999px]" aria-hidden="true">
+              <label htmlFor="website">Website</label>
+              <input
+                id="website"
+                name="website"
+                type="text"
+                tabIndex={-1}
+                autoComplete="off"
+                value={website}
+                onChange={(e) => setWebsite(e.target.value)}
+              />
+            </div>
+            {error && (
+              <p className="text-sm text-[var(--c-del)]" role="alert">
+                {error}
+              </p>
+            )}
+            <button type="submit" className="btn btn-primary w-full" disabled={busy}>
+              {busy ? dict.suggestions.submitting : dict.suggestions.submit}
+            </button>
+          </form>
+        )}
+
+        <p className="mt-4 text-center text-sm">
+          <Link href="/" className="text-gray-500 hover:text-[var(--c-primary)]">
+            {dict.suggestions.backToMenu}
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}
@@ -0,0 +1,137 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import { useDict } from "@/components/i18n/LocaleProvider";
+import type { DishSuggestion } from "@/lib/types";
+
+export default function SuggestionReview() {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const [items, setItems] = useState<DishSuggestion[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [info, setInfo] = useState<string | null>(null);
+  const [busyId, setBusyId] = useState<string | null>(null);
+
+  const load = useCallback(async () => {
+    const { data, error } = await supabase
+      .from("dish_suggestions")
+      .select("*")
+      .order("created_at", { ascending: false });
+    if (error)
+      setError(formatMessage(dict.suggestions.loadError, { message: error.message }));
+    else setItems(data as DishSuggestion[]);
+    setLoading(false);
+  }, [supabase, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function accept(item: DishSuggestion) {
+    setBusyId(item.id);
+    setError(null);
+    setInfo(null);
+    const { error: insertError } = await supabase.from("dishes").insert({
+      name: item.name,
+      price: 0,
+    });
+    if (insertError) {
+      setError(
+        formatMessage(dict.suggestions.actionError, { message: insertError.message })
+      );
+      setBusyId(null);
+      return;
+    }
+    const { error: deleteError } = await supabase
+      .from("dish_suggestions")
+      .delete()
+      .eq("id", item.id);
+    if (deleteError) {
+      setError(
+        formatMessage(dict.suggestions.actionError, { message: deleteError.message })
+      );
+      setBusyId(null);
+      return;
+    }
+    setInfo(dict.suggestions.accepted);
+    setBusyId(null);
+    await load();
+  }
+
+  async function reject(item: DishSuggestion) {
+    if (!window.confirm(formatMessage(dict.suggestions.confirmReject, { name: item.name })))
+      return;
+    setBusyId(item.id);
+    setError(null);
+    setInfo(null);
+    const { error } = await supabase.from("dish_suggestions").delete().eq("id", item.id);
+    if (error) {
+      setError(formatMessage(dict.suggestions.actionError, { message: error.message }));
+    } else {
+      setInfo(dict.suggestions.rejected);
+    }
+    setBusyId(null);
+    await load();
+  }
+
+  return (
+    <div className="max-w-3xl">
+      <h1 className="text-xl font-bold text-[var(--c-primary)] mb-4">
+        {dict.suggestions.reviewTitle}
+      </h1>
+
+      {error && (
+        <p className="mb-3 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+      {info && <p className="mb-3 text-sm text-green-700">{info}</p>}
+
+      {loading ? (
+        <p className="text-gray-500">{dict.common.loading}</p>
+      ) : (
+        <ul className="divide-y divide-gray-200 border border-gray-200 rounded-md bg-white">
+          {items.map((item) => (
+            <li key={item.id} className="flex flex-wrap items-center gap-3 px-4 py-3">
+              <span className="mr-auto">
+                <span className="font-semibold">{item.name}</span>
+                {item.description && (
+                  <span className="block text-sm text-gray-600 mt-0.5">
+                    {item.description}
+                  </span>
+                )}
+                <span className="block text-xs text-gray-400 mt-0.5">
+                  {formatMessage(dict.suggestions.submittedOn, {
+                    date: new Date(item.created_at).toLocaleDateString(dict.dateLocale),
+                  })}
+                </span>
+              </span>
+              <button
+                type="button"
+                className="btn btn-add"
+                onClick={() => accept(item)}
+                disabled={busyId === item.id}
+              >
+                {dict.suggestions.accept}
+              </button>
+              <button
+                type="button"
+                className="btn btn-del"
+                onClick={() => reject(item)}
+                disabled={busyId === item.id}
+              >
+                {dict.suggestions.reject}
+              </button>
+            </li>
+          ))}
+          {items.length === 0 && (
+            <li className="px-4 py-3 text-gray-500">{dict.suggestions.reviewEmpty}</li>
+          )}
+        </ul>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,270 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { createClient } from "@/lib/supabase/client";
+import { formatMessage } from "@/lib/i18n/shared";
+import type { Profile, Role } from "@/lib/types";
+import { useDict } from "@/components/i18n/LocaleProvider";
+
+interface UserForm {
+  id: string | null; // null = neuer Benutzer
+  email: string;
+  full_name: string;
+  role: Role;
+  password: string; // bei Bearbeitung optional (leer = unverändert)
+  passwordRepeat: string;
+}
+
+const EMPTY_FORM: UserForm = {
+  id: null,
+  email: "",
+  full_name: "",
+  role: "staff",
+  password: "",
+  passwordRepeat: "",
+};
+
+export default function UserManager() {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const roleLabels: Record<Role, string> = {
+    admin: dict.common.roleAdmin,
+    staff: dict.common.roleStaff,
+  };
+  const [profiles, setProfiles] = useState<Profile[]>([]);
+  const [me, setMe] = useState<string | null>(null);
+  const [form, setForm] = useState<UserForm | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    const [{ data: profileData, error: profileError }, { data: userData }] =
+      await Promise.all([
+        supabase.from("profiles").select("*").order("created_at"),
+        supabase.auth.getUser(),
+      ]);
+    if (profileError)
+      setError(formatMessage(dict.userManager.loadError, { message: profileError.message }));
+    else setProfiles(profileData as Profile[]);
+    setMe(userData.user?.id ?? null);
+  }, [supabase, dict]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  async function callApi(method: string, body: unknown): Promise<boolean> {
+    setBusy(true);
+    setError(null);
+    try {
+      const res = await fetch("/api/admin/users", {
+        method,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+      if (!res.ok) {
+        const data = await res.json().catch(() => null);
+        setError(data?.error ?? `Fehler (${res.status})`);
+        return false;
+      }
+      return true;
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      return false;
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function save(e: React.FormEvent) {
+    e.preventDefault();
+    if (!form) return;
+    if (form.password && form.password !== form.passwordRepeat) {
+      setError(dict.userManager.passwordMismatch);
+      return;
+    }
+    const ok = form.id
+      ? await callApi("PATCH", {
+          id: form.id,
+          full_name: form.full_name,
+          role: form.role,
+          password: form.password || undefined,
+        })
+      : await callApi("POST", {
+          email: form.email,
+          full_name: form.full_name,
+          role: form.role,
+          password: form.password,
+        });
+    if (ok) {
+      setForm(null);
+      await load();
+    }
+  }
+
+  async function remove(profile: Profile) {
+    if (
+      !window.confirm(
+        formatMessage(dict.userManager.confirmDelete, { email: profile.email })
+      )
+    )
+      return;
+    if (await callApi("DELETE", { id: profile.id })) await load();
+  }
+
+  return (
+    <div className="max-w-3xl">
+      <div className="flex items-center gap-3 mb-4">
+        <h1 className="text-xl font-bold text-[var(--c-primary)] mr-auto">
+          {dict.userManager.title}
+        </h1>
+        <button
+          type="button"
+          className="btn btn-add"
+          onClick={() => setForm(EMPTY_FORM)}
+        >
+          {dict.userManager.newUser}
+        </button>
+      </div>
+
+      {error && (
+        <p className="mb-3 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+
+      {form && (
+        <form onSubmit={save} className="card mb-4 space-y-3">
+          <h2 className="font-semibold">
+            {form.id ? dict.userManager.editUser : dict.userManager.newUser}
+          </h2>
+          {!form.id && (
+            <div>
+              <label className="label" htmlFor="user-email">
+                {dict.common.email}
+              </label>
+              <input
+                id="user-email"
+                type="email"
+                className="input"
+                value={form.email}
+                onChange={(e) => setForm({ ...form, email: e.target.value })}
+                required
+              />
+            </div>
+          )}
+          <div>
+            <label className="label" htmlFor="user-name">
+              {dict.common.name}
+            </label>
+            <input
+              id="user-name"
+              className="input"
+              value={form.full_name}
+              onChange={(e) => setForm({ ...form, full_name: e.target.value })}
+            />
+          </div>
+          <div className="max-w-60">
+            <label className="label" htmlFor="user-role">
+              {dict.common.role}
+            </label>
+            <select
+              id="user-role"
+              className="input"
+              value={form.role}
+              onChange={(e) =>
+                setForm({ ...form, role: e.target.value as Role })
+              }
+            >
+              <option value="staff">{dict.common.roleStaff}</option>
+              <option value="admin">{dict.common.roleAdmin}</option>
+            </select>
+          </div>
+          <div className="max-w-60">
+            <label className="label" htmlFor="user-password">
+              {form.id ? dict.userManager.newPasswordLabel : dict.common.password}
+            </label>
+            <input
+              id="user-password"
+              type="password"
+              className="input"
+              value={form.password}
+              onChange={(e) => setForm({ ...form, password: e.target.value })}
+              minLength={8}
+              required={!form.id}
+              autoComplete="new-password"
+            />
+          </div>
+          <div className="max-w-60">
+            <label className="label" htmlFor="user-password-repeat">
+              {dict.userManager.repeatPasswordLabel}
+            </label>
+            <input
+              id="user-password-repeat"
+              type="password"
+              className="input"
+              value={form.passwordRepeat}
+              onChange={(e) =>
+                setForm({ ...form, passwordRepeat: e.target.value })
+              }
+              minLength={8}
+              required={!form.id || !!form.password}
+              autoComplete="new-password"
+            />
+          </div>
+          <div className="flex gap-2">
+            <button type="submit" className="btn btn-add" disabled={busy}>
+              {dict.common.save}
+            </button>
+            <button
+              type="button"
+              className="btn btn-neutral"
+              onClick={() => setForm(null)}
+            >
+              {dict.common.cancel}
+            </button>
+          </div>
+        </form>
+      )}
+
+      <ul className="divide-y divide-gray-200 border border-gray-200 rounded-md bg-white">
+        {profiles.map((p) => (
+          <li key={p.id} className="flex items-center gap-3 px-4 py-2 text-sm">
+            <span className="mr-auto">
+              <span className="font-semibold">{p.full_name || p.email}</span>{" "}
+              <span className="text-gray-500">
+                – {p.email} – {roleLabels[p.role]}
+              </span>
+              {p.id === me && <span className="text-gray-400"> {dict.common.you}</span>}
+            </span>
+            <button
+              type="button"
+              className="btn btn-primary"
+              onClick={() =>
+                setForm({
+                  id: p.id,
+                  email: p.email,
+                  full_name: p.full_name,
+                  role: p.role,
+                  password: "",
+                  passwordRepeat: "",
+                })
+              }
+            >
+              {dict.common.edit}
+            </button>
+            {p.id !== me && (
+              <button
+                type="button"
+                className="btn btn-del"
+                onClick={() => remove(p)}
+              >
+                {dict.common.delete}
+              </button>
+            )}
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}
@@ -0,0 +1,239 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import Link from "next/link";
+import { createClient } from "@/lib/supabase/client";
+import {
+  addDays,
+  dishCodes,
+  entriesFor,
+  formatDateLong,
+  formatPrice,
+  mondayOf,
+  todayISO,
+} from "@/lib/menu";
+import { formatMessage } from "@/lib/i18n/shared";
+import { localized } from "@/lib/types";
+import type { Dish, MenuEntry, Section } from "@/lib/types";
+import { useDict, useLocale } from "@/components/i18n/LocaleProvider";
+
+export default function WeekEditor({ monday }: { monday: string }) {
+  const supabase = useMemo(() => createClient(), []);
+  const dict = useDict();
+  const locale = useLocale();
+  const friday = addDays(monday, 4);
+  const days = dict.weekdays.long.map((weekday, i) => ({
+    weekday,
+    iso: addDays(monday, i),
+  }));
+
+  const [sections, setSections] = useState<Section[]>([]);
+  const [dishes, setDishes] = useState<Dish[]>([]);
+  const [entries, setEntries] = useState<MenuEntry[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  // Zelle, in der gerade ein Gericht hinzugefügt wird
+  const [adding, setAdding] = useState<{ iso: string; section: string } | null>(
+    null
+  );
+  const [selectedDish, setSelectedDish] = useState("");
+
+  const load = useCallback(async () => {
+    setError(null);
+    const [se, di, en] = await Promise.all([
+      supabase.from("sections").select("*").order("sort"),
+      supabase.from("dishes").select("*").order("name"),
+      supabase
+        .from("menu_entries")
+        .select(
+          "id, menu_date, section_key, position, dish:dishes(id, name, name_en, name_pl, price, allergens, additives)"
+        )
+        .gte("menu_date", monday)
+        .lte("menu_date", friday)
+        .order("position")
+        .order("created_at"),
+    ]);
+    const problem = se.error ?? di.error ?? en.error;
+    if (problem) {
+      setError(formatMessage(dict.weekEditor.loadError, { message: problem.message }));
+    } else {
+      setSections(se.data as Section[]);
+      setDishes(di.data as Dish[]);
+      setEntries(en.data as unknown as MenuEntry[]);
+    }
+    setLoading(false);
+  }, [supabase, monday, friday, dict]);
+
+  useEffect(() => {
+    setLoading(true);
+    load();
+  }, [load]);
+
+  async function addEntry() {
+    if (!adding || !selectedDish) return;
+    const { error } = await supabase.from("menu_entries").insert({
+      menu_date: adding.iso,
+      section_key: adding.section,
+      dish_id: selectedDish,
+    });
+    if (error) {
+      setError(
+        /duplicate key/i.test(error.message)
+          ? dict.weekEditor.duplicateEntry
+          : formatMessage(dict.weekEditor.saveError, { message: error.message })
+      );
+    }
+    setAdding(null);
+    setSelectedDish("");
+    await load();
+  }
+
+  async function removeEntry(id: string) {
+    const { error } = await supabase.from("menu_entries").delete().eq("id", id);
+    if (error)
+      setError(formatMessage(dict.weekEditor.deleteError, { message: error.message }));
+    await load();
+  }
+
+  const [hintBefore, hintAfter] = dict.weekEditor.newDishesHint.split("{link}");
+
+  return (
+    <div>
+      <div className="flex flex-wrap items-center gap-3 mb-4">
+        <h1 className="text-xl font-bold text-[var(--c-primary)] mr-auto">
+          {dict.weekEditor.title}
+        </h1>
+        <Link href={`/intern?woche=${addDays(monday, -7)}`} className="btn btn-add">
+          {dict.publicMenu.prevWeek}
+        </Link>
+        <Link
+          href={`/intern?woche=${mondayOf(todayISO())}`}
+          className="btn btn-primary"
+        >
+          {dict.publicMenu.today}
+        </Link>
+        <Link href={`/intern?woche=${addDays(monday, 7)}`} className="btn btn-add">
+          {dict.publicMenu.nextWeek}
+        </Link>
+      </div>
+
+      {error && (
+        <p className="mb-3 text-sm text-[var(--c-del)]" role="alert">
+          {error}
+        </p>
+      )}
+      {loading ? (
+        <p className="text-gray-500">{dict.weekEditor.loading}</p>
+      ) : (
+        <table className="menu-table">
+          <thead>
+            <tr>
+              <th className="section-head w-52" aria-hidden />
+              {days.map((d) => (
+                <th key={d.iso} className="day-head">
+                  <span className="font-bold">{d.weekday}</span>
+                  <br />
+                  {formatDateLong(d.iso, dict.dateLocale)}
+                </th>
+              ))}
+            </tr>
+          </thead>
+          <tbody>
+            {sections.map((s) => (
+              <tr key={s.key}>
+                <th className="section-head">
+                  <div>{localized(s, locale)}</div>
+                  <div className="time">{s.time_range}</div>
+                </th>
+                {days.map((d) => {
+                  const isAdding =
+                    adding?.iso === d.iso && adding?.section === s.key;
+                  return (
+                    <td key={d.iso} className="cell">
+                      {entriesFor(entries, d.iso, s.key).map((e) => {
+                        const codes = dishCodes(e.dish);
+                        return (
+                          <div key={e.id} className="dish">
+                            <span className="font-bold">
+                              {localized(e.dish, locale)}
+                            </span>
+                            {codes && <sup className="dish-codes">{codes}</sup>}
+                            {" – "}
+                            {formatPrice(e.dish.price)}
+                            <div className="mt-1">
+                              <button
+                                type="button"
+                                className="btn btn-del"
+                                onClick={() => removeEntry(e.id)}
+                              >
+                                {dict.common.delete}
+                              </button>
+                            </div>
+                          </div>
+                        );
+                      })}
+                      {isAdding ? (
+                        <div className="mt-2 space-y-1 text-left">
+                          <select
+                            className="input"
+                            value={selectedDish}
+                            onChange={(e) => setSelectedDish(e.target.value)}
+                          >
+                            <option value="">{dict.weekEditor.selectDish}</option>
+                            {dishes.map((dish) => (
+                              <option key={dish.id} value={dish.id}>
+                                {localized(dish, locale)} ({formatPrice(dish.price)})
+                              </option>
+                            ))}
+                          </select>
+                          <div className="flex gap-1 justify-center">
+                            <button
+                              type="button"
+                              className="btn btn-add"
+                              onClick={addEntry}
+                              disabled={!selectedDish}
+                            >
+                              {dict.common.add}
+                            </button>
+                            <button
+                              type="button"
+                              className="btn btn-neutral"
+                              onClick={() => {
+                                setAdding(null);
+                                setSelectedDish("");
+                              }}
+                            >
+                              {dict.common.cancel}
+                            </button>
+                          </div>
+                        </div>
+                      ) : (
+                        <button
+                          type="button"
+                          className="btn btn-add mt-1"
+                          onClick={() => {
+                            setAdding({ iso: d.iso, section: s.key });
+                            setSelectedDish("");
+                          }}
+                        >
+                          {dict.weekEditor.addMeal}
+                        </button>
+                      )}
+                    </td>
+                  );
+                })}
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+      <p className="mt-4 text-sm text-gray-500">
+        {hintBefore}
+        <Link href="/intern/gerichte" className="underline">
+          {dict.weekEditor.newDishesLinkLabel}
+        </Link>
+        {hintAfter}
+      </p>
+    </div>
+  );
+}
@@ -0,0 +1,58 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+import { LOCALES, LOCALE_LABELS } from "@/lib/i18n/shared";
+import type { Locale } from "@/lib/i18n/shared";
+import { useLocale } from "@/components/i18n/LocaleProvider";
+
+export default function LanguageSwitcher({
+  className = "",
+  variant = "dark",
+}: {
+  className?: string;
+  variant?: "dark" | "light";
+}) {
+  const locale = useLocale();
+  const router = useRouter();
+  const [busy, setBusy] = useState(false);
+
+  async function change(next: Locale) {
+    if (next === locale || busy) return;
+    setBusy(true);
+    await fetch("/api/locale", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ locale: next }),
+    });
+    router.refresh();
+    setBusy(false);
+  }
+
+  const activeCls =
+    variant === "dark" ? "bg-white/25 text-white" : "bg-gray-200 text-gray-900";
+  const inactiveCls =
+    variant === "dark"
+      ? "text-white/60 hover:text-white hover:bg-white/10"
+      : "text-gray-400 hover:text-gray-700 hover:bg-gray-100";
+
+  return (
+    <div className={`flex gap-1 text-xs ${className}`} aria-label="Sprache">
+      {LOCALES.map((l) => (
+        <button
+          key={l}
+          type="button"
+          onClick={() => change(l)}
+          disabled={busy}
+          aria-current={l === locale}
+          title={LOCALE_LABELS[l]}
+          className={`rounded px-1.5 py-0.5 uppercase font-semibold transition-colors ${
+            l === locale ? activeCls : inactiveCls
+          }`}
+        >
+          {l}
+        </button>
+      ))}
+    </div>
+  );
+}
@@ -0,0 +1,46 @@
+"use client";
+
+// Stellt Sprache + Wörterbuch für Client-Komponenten bereit. Wird einmal
+// im Root-Layout mit dem serverseitig aus dem Cookie gelesenen Locale
+// instanziiert; Client-Komponenten lesen darüber via useDict()/useLocale().
+
+import { createContext, useContext, useMemo } from "react";
+import { formatMessage } from "@/lib/i18n/shared";
+import type { Dict, Locale } from "@/lib/i18n/shared";
+
+interface LocaleContextValue {
+  locale: Locale;
+  dict: Dict;
+}
+
+const LocaleContext = createContext<LocaleContextValue | null>(null);
+
+export function LocaleProvider({
+  locale,
+  dict,
+  children,
+}: LocaleContextValue & { children: React.ReactNode }) {
+  const value = useMemo(() => ({ locale, dict }), [locale, dict]);
+  return (
+    <LocaleContext.Provider value={value}>{children}</LocaleContext.Provider>
+  );
+}
+
+function useLocaleContext(): LocaleContextValue {
+  const ctx = useContext(LocaleContext);
+  if (!ctx) throw new Error("useDict/useLocale muss innerhalb von LocaleProvider verwendet werden.");
+  return ctx;
+}
+
+export function useDict(): Dict {
+  return useLocaleContext().dict;
+}
+
+export function useLocale(): Locale {
+  return useLocaleContext().locale;
+}
+
+/** t("Text mit {var}", { var: "Wert" }) für Platzhalter in Übersetzungen. */
+export function useFormatMessage() {
+  return formatMessage;
+}
@@ -0,0 +1,87 @@
+# =============================================================
+# Canteen Menu – Docker-Setup
+#
+# Produktion (App + lokale PostgreSQL-Kopie):
+#   docker compose --env-file .env.local up -d --build
+#
+# Entwicklung (Dev-Server mit Hot-Reload, kein lokales Node nötig):
+#   docker compose --env-file .env.local --profile dev up dev
+#
+# Die --env-file-Angabe speist NEXT_PUBLIC_* in den Build und
+# SUPABASE_SERVICE_ROLE_KEY in die Laufzeit-Umgebung.
+#
+# "name" fixiert den Compose-Projektnamen explizit auf "canteen-menu" –
+# ohne diese Angabe leitet Compose ihn aus dem Ordnernamen ab.
+# =============================================================
+
+name: canteen-menu
+
+services:
+  # ---------- Next.js-App (Produktions-Build) ----------
+  app:
+    build:
+      context: .
+      args:
+        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
+    image: canteen-menu-app
+    container_name: canteen-menu-app
+    environment:
+      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
+      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
+      # Öffentliche URL der App (Domain hinter dem Reverse-Proxy).
+      # Wird für den CSRF-Origin-Check genutzt; dieselbe URL ist die
+      # Passkey-Domain (siehe scripts/configure-passkeys.mjs).
+      APP_URL: ${APP_URL:-http://localhost:3000}
+      # Titel im Browser-Tab und Überschrift, solange kein Logo hochgeladen ist.
+      SITE_TITLE: ${SITE_TITLE:-Canteen Menu}
+      # Optional: DeepL-API-Key für automatische Übersetzung von Gerichten
+      # (Kürzel-Erklärungen, Bereichen) nach Englisch/Polnisch. Ohne Key
+      # bleibt "Automatisch übersetzen" inaktiv, manuelle Eingabe geht immer.
+      DEEPL_API_KEY: ${DEEPL_API_KEY:-}
+    ports:
+      - "0.0.0.0:3000:3000"
+    restart: unless-stopped
+
+  # ---------- Lokale PostgreSQL-Kopie (Ablage/Auswertungen) ----------
+  # Beim ersten Start werden die Skripte aus supabase/local
+  # automatisch in alphabetischer Reihenfolge eingespielt.
+  db:
+    image: postgres:17-alpine
+    container_name: canteen-menu-db
+    environment:
+      POSTGRES_DB: canteen_menu
+      POSTGRES_PASSWORD: ${LOCAL_PG_PASSWORD:-canteen_menu}
+    ports:
+      # Host-Port 5433, da 5432 meist schon von einer nativen
+      # PostgreSQL-Installation belegt ist.
+      - "5433:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+      - ./supabase/local:/docker-entrypoint-initdb.d:ro
+    restart: unless-stopped
+
+  # ---------- Dev-Server (nur mit --profile dev) ----------
+  dev:
+    image: node:24-alpine
+    container_name: canteen-menu-dev
+    profiles: ["dev"]
+    working_dir: /app
+    command: sh -c "npm install && npm run dev"
+    environment:
+      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
+      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
+      APP_URL: ${APP_URL:-http://localhost:3000}
+      SITE_TITLE: ${SITE_TITLE:-Canteen Menu}
+      DEEPL_API_KEY: ${DEEPL_API_KEY:-}
+    ports:
+      - "0.0.0.0:3000:3000"
+    volumes:
+      - .:/app
+      - dev_node_modules:/app/node_modules
+
+volumes:
+  pgdata:
+  dev_node_modules:
@@ -0,0 +1,770 @@
+// Übersetzungswörterbücher für die komplette Oberfläche.
+// "de" ist die Referenzstruktur; en/pl werden dagegen typgeprüft,
+// damit kein Schlüssel in einer Sprache fehlt.
+
+const de = {
+  common: {
+    save: "Speichern",
+    cancel: "Abbrechen",
+    delete: "Löschen",
+    edit: "Bearbeiten",
+    add: "Hinzufügen",
+    back: "Zurück",
+    login: "Anmelden",
+    logout: "Abmelden",
+    loading: "Lade…",
+    you: "(du)",
+    name: "Name",
+    email: "E-Mail-Adresse",
+    password: "Passwort",
+    role: "Rolle",
+    roleAdmin: "Administrator",
+    roleStaff: "Kantinenmitarbeiter",
+  },
+  weekdays: {
+    long: ["Montag", "Dienstag", "Mittwoch", "Donnerstag", "Freitag"],
+    short: ["Mo", "Di", "Mi", "Do", "Fr"],
+  },
+  dateLocale: "de-DE",
+  header: {
+    canteen: "Kantine",
+    menuGroup: "Speiseplan",
+    weekPlan: "Wochenplan",
+    sections: "Essenszeiten",
+    dishes: "Gerichte",
+    labels: "Allergene & Zusatzstoffe",
+    adminGroup: "Verwaltung",
+    users: "Benutzer",
+    design: "Design",
+    suggestions: "Vorschläge",
+    viewMenu: "Speisekarte ansehen",
+    myAccount: "Mein Konto",
+  },
+  login: {
+    title: "Anmeldung",
+    submit: "Anmelden",
+    or: "oder",
+    passkeyButton: "Mit Passkey anmelden",
+    backToMenu: "← Zur Speisekarte",
+    errorInvalidCredentials: "E-Mail-Adresse oder Passwort ist falsch.",
+    errorEmailNotConfirmed: "Die E-Mail-Adresse wurde noch nicht bestätigt.",
+    errorPasskeyCancelled: "Passkey-Anmeldung wurde abgebrochen.",
+    errorGeneric: "Anmeldung fehlgeschlagen: {message}",
+    errorPasswordDisabled:
+      "Die Anmeldung mit Passwort ist für dieses Konto deaktiviert. Bitte mit Passkey anmelden.",
+  },
+  publicMenu: {
+    prevWeek: "← Vorherige Woche",
+    nextWeek: "Nächste Woche →",
+    prevWeekShort: "← Woche",
+    nextWeekShort: "Woche →",
+    today: "Heute",
+    dayTab: "Tag",
+    weekTab: "Woche",
+    allergens: "Allergene",
+    additives: "Zusatzstoffe",
+    suggestDish: "Rezept vorschlagen",
+    noEntry: "–",
+  },
+  weekEditor: {
+    title: "Wochenplan",
+    loading: "Lade Wochenplan…",
+    selectDish: "– Gericht wählen –",
+    addMeal: "Mahlzeit hinzufügen",
+    newDishesHint: "Neue Gerichte legst du unter {link} an.",
+    newDishesLinkLabel: "Gerichte",
+    loadError: "Laden fehlgeschlagen: {message}",
+    duplicateEntry: "Dieses Gericht ist an diesem Tag bereits zugewiesen.",
+    saveError: "Speichern fehlgeschlagen: {message}",
+    deleteError: "Löschen fehlgeschlagen: {message}",
+  },
+  dishManager: {
+    title: "Gerichte",
+    newDish: "Neues Gericht",
+    editDish: "Gericht bearbeiten",
+    nameLabel: "Bezeichnung",
+    nameEnLabel: "Name (Englisch)",
+    namePlLabel: "Name (Polnisch)",
+    autoTranslate: "Automatisch übersetzen",
+    translating: "Übersetze…",
+    translated: "Übersetzt.",
+    priceLabel: "Preis in €",
+    pricePlaceholder: "3,50",
+    searchPlaceholder: "Gericht suchen…",
+    selectAll: "Alle auswählen",
+    selectedCount: "{count} ausgewählt",
+    deleteSelected: "Ausgewählte löschen",
+    deleteSelectedCount: "Ausgewählte löschen ({count})",
+    empty: "Noch keine Gerichte angelegt.",
+    noResults: "Keine Treffer für „{query}“.",
+    confirmDelete:
+      "„{name}“ wirklich löschen? Das Gericht wird auch aus allen Wochenplänen entfernt.",
+    confirmDeleteSelected:
+      "{count} Gericht(e) wirklich löschen? Sie werden auch aus allen Wochenplänen entfernt.",
+    invalidPrice: "Bitte einen gültigen Preis angeben, z. B. 3,50",
+    loadError: "Laden fehlgeschlagen: {message}",
+    saveError: "Speichern fehlgeschlagen: {message}",
+    deleteError: "Löschen fehlgeschlagen: {message}",
+  },
+  codeList: {
+    allergensTitle: "Allergene",
+    additivesTitle: "Zusatzstoffe",
+    allergenCodeLabel: "Kürzel (z. B. A)",
+    additiveCodeLabel: "Kürzel (z. B. 1)",
+    nameLabel: "Bezeichnung",
+    empty: "Keine Einträge.",
+    confirmDelete: "„{code} – {name}“ wirklich löschen?",
+    duplicateCode: "Das Kürzel „{code}“ existiert bereits.",
+    loadError: "Laden fehlgeschlagen: {message}",
+    saveError: "Speichern fehlgeschlagen: {message}",
+    deleteError: "Löschen fehlgeschlagen: {message}",
+  },
+  sectionManager: {
+    title: "Essenszeiten",
+    newSection: "Neue Essenszeit",
+    editSection: "Essenszeit bearbeiten",
+    nameLabel: "Bezeichnung",
+    nameEnLabel: "Bezeichnung (Englisch)",
+    namePlLabel: "Bezeichnung (Polnisch)",
+    timeFrom: "Von",
+    timeTo: "Bis",
+    moveUp: "Nach oben",
+    moveDown: "Nach unten",
+    empty: "Noch keine Essenszeiten angelegt.",
+    confirmDelete:
+      "„{name}“ wirklich löschen? Zugewiesene Gerichte werden auch aus allen Wochenplänen entfernt.",
+    loadError: "Laden fehlgeschlagen: {message}",
+    saveError: "Speichern fehlgeschlagen: {message}",
+    deleteError: "Löschen fehlgeschlagen: {message}",
+  },
+  userManager: {
+    title: "Benutzer",
+    newUser: "Neuer Benutzer",
+    editUser: "Benutzer bearbeiten",
+    newPasswordLabel: "Neues Passwort (optional)",
+    repeatPasswordLabel: "Passwort wiederholen",
+    passwordMismatch: "Die Passwörter stimmen nicht überein.",
+    confirmDelete:
+      "Benutzer „{email}“ wirklich löschen? Der Zugang wird dauerhaft entfernt.",
+    loadError: "Laden fehlgeschlagen: {message}",
+  },
+  designEditor: {
+    title: "Design",
+    logoTitle: "Logo",
+    logoHint: "Das Logo wird zentriert über der Speisekarte angezeigt.",
+    logoNone: "Kein Logo hinterlegt.",
+    logoUpload: "Logo hochladen",
+    logoRemove: "Logo entfernen",
+    logoUpdated: "Logo aktualisiert.",
+    logoRemoved: "Logo entfernt.",
+    faviconTitle: "Favicon",
+    faviconHint:
+      "Wird als Icon im Browser-Tab angezeigt. Ohne eigenes Favicon gilt das Standard-Icon der Anwendung.",
+    faviconNone: "Kein eigenes Favicon hinterlegt.",
+    faviconUpload: "Favicon hochladen",
+    faviconRemove: "Favicon entfernen",
+    faviconUpdated: "Favicon aktualisiert.",
+    faviconRemoved: "Favicon entfernt.",
+    invalidImage: "Bitte eine Bilddatei auswählen (PNG, JPG, SVG, WebP, ICO).",
+    colorsTitle: "Farbgebung",
+    colorsSave: "Farben speichern",
+    colorsReset: "Auf Standard zurücksetzen",
+    colorsSaved: "Farben gespeichert.",
+    colorPrimary: "Primärfarbe (Tabellenkopf)",
+    colorPrimaryDark: "Primärfarbe dunkel (Kopfleiste intern)",
+    colorAccent: "Akzentfarbe",
+    colorHeaderText: "Schriftfarbe im Tabellenkopf",
+    colorRowBg: "Zellen-Hintergrund",
+    colorRowBgAlt: "Zellen-Hintergrund (alternierend)",
+    colorAddBtn: "Button „Hinzufügen“",
+    colorDeleteBtn: "Button „Löschen“",
+    loadError: "Laden fehlgeschlagen: {message}",
+    saveError: "Speichern fehlgeschlagen: {message}",
+    uploadError: "Upload fehlgeschlagen: {message}",
+    confirmRemoveLogo: "Logo wirklich entfernen?",
+    confirmRemoveFavicon: "Favicon wirklich entfernen?",
+  },
+  passkeys: {
+    title: "Passkeys",
+    hint: "Mit einem Passkey (Fingerabdruck, Gesichtserkennung oder Sicherheitsschlüssel) kannst du dich künftig ohne Passwort anmelden. Passkeys gelten pro Domain – für den Live-Betrieb muss die Domain in der Supabase-Konfiguration hinterlegt sein.",
+    register: "Neuen Passkey registrieren",
+    empty: "Noch keine Passkeys registriert.",
+    createdOn: "– angelegt am {date}",
+    registered: "Passkey wurde erfolgreich registriert.",
+    registerError: "Registrierung fehlgeschlagen: {message}",
+    registerCancelled: "Die Passkey-Registrierung wurde abgebrochen.",
+    loadError: "Passkeys konnten nicht geladen werden: {message}",
+    deleteError: "Löschen fehlgeschlagen: {message}",
+    confirmDelete: "Diesen Passkey wirklich löschen?",
+  },
+  account: {
+    title: "Mein Konto",
+    personalTitle: "Persönliche Daten",
+    saveName: "Name speichern",
+    nameSaved: "Name gespeichert.",
+    nameRequired: "Bitte einen Namen angeben.",
+    emailTitle: "E-Mail-Adresse",
+    changeEmail: "E-Mail-Adresse ändern",
+    emailSent:
+      "Bestätigungs-E-Mails wurden verschickt. Die neue Adresse wird erst nach Bestätigung des Links aktiv.",
+    passwordTitle: "Passwort ändern",
+    currentPassword: "Aktuelles Passwort (zur Verifizierung)",
+    newPassword: "Neues Passwort",
+    newPasswordRepeat: "Neues Passwort wiederholen",
+    changePassword: "Passwort ändern",
+    passwordChanged: "Passwort geändert.",
+    passwordMismatch: "Die Passwörter stimmen nicht überein.",
+    passwordTooShort: "Das neue Passwort muss mindestens 8 Zeichen lang sein.",
+    passwordAuthTitle: "Anmeldung mit Passwort",
+    passwordAuthHint:
+      "Du kannst die Anmeldung mit E-Mail und Passwort für dein Konto deaktivieren und dich künftig ausschließlich per Passkey anmelden. Dafür muss mindestens ein Passkey registriert sein.",
+    passwordAuthCheckbox: "Anmeldung mit E-Mail und Passwort erlaubt",
+    passwordAuthEnabled: "Passwort-Anmeldung aktiviert.",
+    passwordAuthDisabled: "Passwort-Anmeldung deaktiviert.",
+    passwordAuthNeedsPasskey:
+      "Ohne registrierten Passkey kannst du die Passwort-Anmeldung nicht deaktivieren – sonst wärst du ausgesperrt. Registriere zuerst einen Passkey weiter unten.",
+    confirmDisablePasswordAuth:
+      "Anmeldung mit E-Mail und Passwort wirklich deaktivieren? Du kannst dich danach nur noch per Passkey anmelden.",
+    wrongCurrentPassword: "Das aktuelle Passwort ist falsch.",
+    emailAlreadyUsed: "Diese E-Mail-Adresse wird bereits verwendet.",
+    saveError: "Speichern fehlgeschlagen: {message}",
+    changeError: "Ändern fehlgeschlagen: {message}",
+  },
+  suggestions: {
+    formTitle: "Rezept vorschlagen",
+    formHint:
+      "Fehlt dir ein Gericht auf der Speisekarte? Schlage es hier vor – das Kantinen-Team sichtet deinen Vorschlag.",
+    nameLabel: "Gerichtname",
+    descriptionLabel: "Beschreibung / Zutaten (optional)",
+    submit: "Vorschlag senden",
+    submitting: "Wird gesendet…",
+    success: "Danke! Dein Vorschlag wurde übermittelt.",
+    duplicate: "Dieses Gericht gibt es bereits auf der Speisekarte.",
+    genericError: "Senden fehlgeschlagen: {message}",
+    nameRequired: "Bitte einen Namen angeben.",
+    backToMenu: "← Zur Speisekarte",
+    reviewTitle: "Rezeptvorschläge",
+    reviewEmpty: "Noch keine Vorschläge.",
+    accept: "Als Gericht übernehmen",
+    reject: "Ablehnen",
+    confirmReject: "Vorschlag „{name}“ wirklich ablehnen und löschen?",
+    accepted: "Als Gericht übernommen.",
+    rejected: "Vorschlag abgelehnt.",
+    loadError: "Laden fehlgeschlagen: {message}",
+    actionError: "Aktion fehlgeschlagen: {message}",
+    submittedOn: "eingereicht am {date}",
+  },
+};
+
+type Dict = typeof de;
+
+const en: Dict = {
+  common: {
+    save: "Save",
+    cancel: "Cancel",
+    delete: "Delete",
+    edit: "Edit",
+    add: "Add",
+    back: "Back",
+    login: "Log in",
+    logout: "Log out",
+    loading: "Loading…",
+    you: "(you)",
+    name: "Name",
+    email: "Email address",
+    password: "Password",
+    role: "Role",
+    roleAdmin: "Administrator",
+    roleStaff: "Canteen staff",
+  },
+  weekdays: {
+    long: ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday"],
+    short: ["Mon", "Tue", "Wed", "Thu", "Fri"],
+  },
+  dateLocale: "en-GB",
+  header: {
+    canteen: "Canteen",
+    menuGroup: "Menu",
+    weekPlan: "Weekly plan",
+    sections: "Meal times",
+    dishes: "Dishes",
+    labels: "Allergens & Additives",
+    adminGroup: "Administration",
+    users: "Users",
+    design: "Design",
+    suggestions: "Suggestions",
+    viewMenu: "View menu",
+    myAccount: "My account",
+  },
+  login: {
+    title: "Sign in",
+    submit: "Log in",
+    or: "or",
+    passkeyButton: "Sign in with passkey",
+    backToMenu: "← Back to menu",
+    errorInvalidCredentials: "Email address or password is incorrect.",
+    errorEmailNotConfirmed: "This email address has not been confirmed yet.",
+    errorPasskeyCancelled: "Passkey sign-in was cancelled.",
+    errorGeneric: "Sign-in failed: {message}",
+    errorPasswordDisabled:
+      "Password sign-in is disabled for this account. Please sign in with a passkey.",
+  },
+  publicMenu: {
+    prevWeek: "← Previous week",
+    nextWeek: "Next week →",
+    prevWeekShort: "← Week",
+    nextWeekShort: "Week →",
+    today: "Today",
+    dayTab: "Day",
+    weekTab: "Week",
+    allergens: "Allergens",
+    additives: "Additives",
+    suggestDish: "Suggest a dish",
+    noEntry: "–",
+  },
+  weekEditor: {
+    title: "Weekly plan",
+    loading: "Loading weekly plan…",
+    selectDish: "– Select dish –",
+    addMeal: "Add meal",
+    newDishesHint: "Add new dishes under {link}.",
+    newDishesLinkLabel: "Dishes",
+    loadError: "Loading failed: {message}",
+    duplicateEntry: "This dish is already assigned on this day.",
+    saveError: "Saving failed: {message}",
+    deleteError: "Deleting failed: {message}",
+  },
+  dishManager: {
+    title: "Dishes",
+    newDish: "New dish",
+    editDish: "Edit dish",
+    nameLabel: "Name",
+    nameEnLabel: "Name (English)",
+    namePlLabel: "Name (Polish)",
+    autoTranslate: "Auto-translate",
+    translating: "Translating…",
+    translated: "Translated.",
+    priceLabel: "Price in €",
+    pricePlaceholder: "3.50",
+    searchPlaceholder: "Search dishes…",
+    selectAll: "Select all",
+    selectedCount: "{count} selected",
+    deleteSelected: "Delete selected",
+    deleteSelectedCount: "Delete selected ({count})",
+    empty: "No dishes yet.",
+    noResults: "No results for “{query}”.",
+    confirmDelete:
+      "Really delete “{name}”? The dish will also be removed from all weekly plans.",
+    confirmDeleteSelected:
+      "Really delete {count} dish(es)? They will also be removed from all weekly plans.",
+    invalidPrice: "Please enter a valid price, e.g. 3.50",
+    loadError: "Loading failed: {message}",
+    saveError: "Saving failed: {message}",
+    deleteError: "Deleting failed: {message}",
+  },
+  codeList: {
+    allergensTitle: "Allergens",
+    additivesTitle: "Additives",
+    allergenCodeLabel: "Code (e.g. A)",
+    additiveCodeLabel: "Code (e.g. 1)",
+    nameLabel: "Name",
+    empty: "No entries.",
+    confirmDelete: "Really delete “{code} – {name}”?",
+    duplicateCode: "The code “{code}” already exists.",
+    loadError: "Loading failed: {message}",
+    saveError: "Saving failed: {message}",
+    deleteError: "Deleting failed: {message}",
+  },
+  sectionManager: {
+    title: "Meal times",
+    newSection: "New meal time",
+    editSection: "Edit meal time",
+    nameLabel: "Name",
+    nameEnLabel: "Name (English)",
+    namePlLabel: "Name (Polish)",
+    timeFrom: "From",
+    timeTo: "To",
+    moveUp: "Move up",
+    moveDown: "Move down",
+    empty: "No meal times yet.",
+    confirmDelete:
+      "Really delete “{name}”? Assigned dishes will also be removed from all weekly plans.",
+    loadError: "Loading failed: {message}",
+    saveError: "Saving failed: {message}",
+    deleteError: "Deleting failed: {message}",
+  },
+  userManager: {
+    title: "Users",
+    newUser: "New user",
+    editUser: "Edit user",
+    newPasswordLabel: "New password (optional)",
+    repeatPasswordLabel: "Repeat password",
+    passwordMismatch: "The passwords do not match.",
+    confirmDelete:
+      "Really delete user “{email}”? Access will be permanently removed.",
+    loadError: "Loading failed: {message}",
+  },
+  designEditor: {
+    title: "Design",
+    logoTitle: "Logo",
+    logoHint: "The logo is displayed centered above the menu.",
+    logoNone: "No logo set.",
+    logoUpload: "Upload logo",
+    logoRemove: "Remove logo",
+    logoUpdated: "Logo updated.",
+    logoRemoved: "Logo removed.",
+    faviconTitle: "Favicon",
+    faviconHint:
+      "Shown as the icon in the browser tab. Without a custom favicon, the application's default icon is used.",
+    faviconNone: "No custom favicon set.",
+    faviconUpload: "Upload favicon",
+    faviconRemove: "Remove favicon",
+    faviconUpdated: "Favicon updated.",
+    faviconRemoved: "Favicon removed.",
+    invalidImage: "Please choose an image file (PNG, JPG, SVG, WebP, ICO).",
+    colorsTitle: "Colors",
+    colorsSave: "Save colors",
+    colorsReset: "Reset to default",
+    colorsSaved: "Colors saved.",
+    colorPrimary: "Primary color (table header)",
+    colorPrimaryDark: "Primary color, dark (internal top bar)",
+    colorAccent: "Accent color",
+    colorHeaderText: "Table header text color",
+    colorRowBg: "Cell background",
+    colorRowBgAlt: "Cell background (alternating)",
+    colorAddBtn: "“Add” button",
+    colorDeleteBtn: "“Delete” button",
+    loadError: "Loading failed: {message}",
+    saveError: "Saving failed: {message}",
+    uploadError: "Upload failed: {message}",
+    confirmRemoveLogo: "Really remove the logo?",
+    confirmRemoveFavicon: "Really remove the favicon?",
+  },
+  passkeys: {
+    title: "Passkeys",
+    hint: "With a passkey (fingerprint, face recognition, or a security key) you can sign in without a password in the future. Passkeys are bound to a domain – for production use, the domain must be configured in Supabase.",
+    register: "Register new passkey",
+    empty: "No passkeys registered yet.",
+    createdOn: "– created on {date}",
+    registered: "Passkey registered successfully.",
+    registerError: "Registration failed: {message}",
+    registerCancelled: "Passkey registration was cancelled.",
+    loadError: "Could not load passkeys: {message}",
+    deleteError: "Deleting failed: {message}",
+    confirmDelete: "Really delete this passkey?",
+  },
+  account: {
+    title: "My account",
+    personalTitle: "Personal details",
+    saveName: "Save name",
+    nameSaved: "Name saved.",
+    nameRequired: "Please enter a name.",
+    emailTitle: "Email address",
+    changeEmail: "Change email address",
+    emailSent:
+      "Confirmation emails have been sent. The new address becomes active only after confirming the link.",
+    passwordTitle: "Change password",
+    currentPassword: "Current password (for verification)",
+    newPassword: "New password",
+    newPasswordRepeat: "Repeat new password",
+    changePassword: "Change password",
+    passwordChanged: "Password changed.",
+    passwordMismatch: "The passwords do not match.",
+    passwordTooShort: "The new password must be at least 8 characters long.",
+    passwordAuthTitle: "Password sign-in",
+    passwordAuthHint:
+      "You can disable email and password sign-in for your account and sign in exclusively with a passkey in the future. At least one passkey must be registered for this.",
+    passwordAuthCheckbox: "Email and password sign-in allowed",
+    passwordAuthEnabled: "Password sign-in enabled.",
+    passwordAuthDisabled: "Password sign-in disabled.",
+    passwordAuthNeedsPasskey:
+      "You can't disable password sign-in without a registered passkey – you would lock yourself out. Register a passkey below first.",
+    confirmDisablePasswordAuth:
+      "Really disable email and password sign-in? Afterwards you can only sign in with a passkey.",
+    wrongCurrentPassword: "The current password is incorrect.",
+    emailAlreadyUsed: "This email address is already in use.",
+    saveError: "Saving failed: {message}",
+    changeError: "Change failed: {message}",
+  },
+  suggestions: {
+    formTitle: "Suggest a dish",
+    formHint:
+      "Missing a dish on the menu? Suggest it here – the canteen team will review your suggestion.",
+    nameLabel: "Dish name",
+    descriptionLabel: "Description / ingredients (optional)",
+    submit: "Submit suggestion",
+    submitting: "Submitting…",
+    success: "Thanks! Your suggestion has been submitted.",
+    duplicate: "This dish already exists on the menu.",
+    genericError: "Submission failed: {message}",
+    nameRequired: "Please enter a name.",
+    backToMenu: "← Back to menu",
+    reviewTitle: "Dish suggestions",
+    reviewEmpty: "No suggestions yet.",
+    accept: "Add as dish",
+    reject: "Reject",
+    confirmReject: "Really reject and delete the suggestion “{name}”?",
+    accepted: "Added as dish.",
+    rejected: "Suggestion rejected.",
+    loadError: "Loading failed: {message}",
+    actionError: "Action failed: {message}",
+    submittedOn: "submitted on {date}",
+  },
+};
+
+const pl: Dict = {
+  common: {
+    save: "Zapisz",
+    cancel: "Anuluj",
+    delete: "Usuń",
+    edit: "Edytuj",
+    add: "Dodaj",
+    back: "Wstecz",
+    login: "Zaloguj się",
+    logout: "Wyloguj się",
+    loading: "Wczytywanie…",
+    you: "(ty)",
+    name: "Nazwa",
+    email: "Adres e-mail",
+    password: "Hasło",
+    role: "Rola",
+    roleAdmin: "Administrator",
+    roleStaff: "Personel stołówki",
+  },
+  weekdays: {
+    long: ["Poniedziałek", "Wtorek", "Środa", "Czwartek", "Piątek"],
+    short: ["Pon", "Wto", "Śro", "Czw", "Pią"],
+  },
+  dateLocale: "pl-PL",
+  header: {
+    canteen: "Stołówka",
+    menuGroup: "Jadłospis",
+    weekPlan: "Plan tygodnia",
+    sections: "Pory posiłków",
+    dishes: "Dania",
+    labels: "Alergeny i dodatki",
+    adminGroup: "Administracja",
+    users: "Użytkownicy",
+    design: "Wygląd",
+    suggestions: "Propozycje",
+    viewMenu: "Zobacz jadłospis",
+    myAccount: "Moje konto",
+  },
+  login: {
+    title: "Logowanie",
+    submit: "Zaloguj się",
+    or: "lub",
+    passkeyButton: "Zaloguj się kluczem dostępu",
+    backToMenu: "← Powrót do jadłospisu",
+    errorInvalidCredentials: "Nieprawidłowy adres e-mail lub hasło.",
+    errorEmailNotConfirmed: "Adres e-mail nie został jeszcze potwierdzony.",
+    errorPasskeyCancelled: "Logowanie kluczem dostępu zostało anulowane.",
+    errorGeneric: "Logowanie nie powiodło się: {message}",
+    errorPasswordDisabled:
+      "Logowanie hasłem jest wyłączone dla tego konta. Zaloguj się kluczem dostępu.",
+  },
+  publicMenu: {
+    prevWeek: "← Poprzedni tydzień",
+    nextWeek: "Następny tydzień →",
+    prevWeekShort: "← Tydzień",
+    nextWeekShort: "Tydzień →",
+    today: "Dziś",
+    dayTab: "Dzień",
+    weekTab: "Tydzień",
+    allergens: "Alergeny",
+    additives: "Dodatki",
+    suggestDish: "Zaproponuj danie",
+    noEntry: "–",
+  },
+  weekEditor: {
+    title: "Plan tygodnia",
+    loading: "Wczytywanie planu tygodnia…",
+    selectDish: "– Wybierz danie –",
+    addMeal: "Dodaj posiłek",
+    newDishesHint: "Nowe dania możesz dodać w zakładce {link}.",
+    newDishesLinkLabel: "Dania",
+    loadError: "Wczytywanie nie powiodło się: {message}",
+    duplicateEntry: "To danie jest już przypisane na ten dzień.",
+    saveError: "Zapisywanie nie powiodło się: {message}",
+    deleteError: "Usuwanie nie powiodło się: {message}",
+  },
+  dishManager: {
+    title: "Dania",
+    newDish: "Nowe danie",
+    editDish: "Edytuj danie",
+    nameLabel: "Nazwa",
+    nameEnLabel: "Nazwa (angielski)",
+    namePlLabel: "Nazwa (polski)",
+    autoTranslate: "Przetłumacz automatycznie",
+    translating: "Tłumaczenie…",
+    translated: "Przetłumaczono.",
+    priceLabel: "Cena w €",
+    pricePlaceholder: "3,50",
+    searchPlaceholder: "Szukaj dania…",
+    selectAll: "Zaznacz wszystko",
+    selectedCount: "Zaznaczono: {count}",
+    deleteSelected: "Usuń zaznaczone",
+    deleteSelectedCount: "Usuń zaznaczone ({count})",
+    empty: "Nie dodano jeszcze żadnych dań.",
+    noResults: "Brak wyników dla „{query}”.",
+    confirmDelete:
+      "Czy na pewno usunąć „{name}”? Danie zostanie również usunięte ze wszystkich planów tygodniowych.",
+    confirmDeleteSelected:
+      "Czy na pewno usunąć {count} danie/dania? Zostaną również usunięte ze wszystkich planów tygodniowych.",
+    invalidPrice: "Podaj prawidłową cenę, np. 3,50",
+    loadError: "Wczytywanie nie powiodło się: {message}",
+    saveError: "Zapisywanie nie powiodło się: {message}",
+    deleteError: "Usuwanie nie powiodło się: {message}",
+  },
+  codeList: {
+    allergensTitle: "Alergeny",
+    additivesTitle: "Dodatki",
+    allergenCodeLabel: "Kod (np. A)",
+    additiveCodeLabel: "Kod (np. 1)",
+    nameLabel: "Nazwa",
+    empty: "Brak wpisów.",
+    confirmDelete: "Czy na pewno usunąć „{code} – {name}”?",
+    duplicateCode: "Kod „{code}” już istnieje.",
+    loadError: "Wczytywanie nie powiodło się: {message}",
+    saveError: "Zapisywanie nie powiodło się: {message}",
+    deleteError: "Usuwanie nie powiodło się: {message}",
+  },
+  sectionManager: {
+    title: "Pory posiłków",
+    newSection: "Nowa pora posiłku",
+    editSection: "Edytuj porę posiłku",
+    nameLabel: "Nazwa",
+    nameEnLabel: "Nazwa (angielski)",
+    namePlLabel: "Nazwa (polski)",
+    timeFrom: "Od",
+    timeTo: "Do",
+    moveUp: "Przesuń w górę",
+    moveDown: "Przesuń w dół",
+    empty: "Nie dodano jeszcze żadnych pór posiłków.",
+    confirmDelete:
+      "Czy na pewno usunąć „{name}”? Przypisane dania zostaną również usunięte ze wszystkich planów tygodniowych.",
+    loadError: "Wczytywanie nie powiodło się: {message}",
+    saveError: "Zapisywanie nie powiodło się: {message}",
+    deleteError: "Usuwanie nie powiodło się: {message}",
+  },
+  userManager: {
+    title: "Użytkownicy",
+    newUser: "Nowy użytkownik",
+    editUser: "Edytuj użytkownika",
+    newPasswordLabel: "Nowe hasło (opcjonalnie)",
+    repeatPasswordLabel: "Powtórz hasło",
+    passwordMismatch: "Hasła nie są zgodne.",
+    confirmDelete:
+      "Czy na pewno usunąć użytkownika „{email}”? Dostęp zostanie trwale usunięty.",
+    loadError: "Wczytywanie nie powiodło się: {message}",
+  },
+  designEditor: {
+    title: "Wygląd",
+    logoTitle: "Logo",
+    logoHint: "Logo jest wyświetlane wyśrodkowane nad jadłospisem.",
+    logoNone: "Nie ustawiono logo.",
+    logoUpload: "Prześlij logo",
+    logoRemove: "Usuń logo",
+    logoUpdated: "Logo zaktualizowane.",
+    logoRemoved: "Logo usunięte.",
+    faviconTitle: "Favicon",
+    faviconHint:
+      "Wyświetlane jako ikona na karcie przeglądarki. Bez własnego favicona używana jest domyślna ikona aplikacji.",
+    faviconNone: "Nie ustawiono własnego favicona.",
+    faviconUpload: "Prześlij favicon",
+    faviconRemove: "Usuń favicon",
+    faviconUpdated: "Favicon zaktualizowany.",
+    faviconRemoved: "Favicon usunięty.",
+    invalidImage: "Wybierz plik graficzny (PNG, JPG, SVG, WebP, ICO).",
+    colorsTitle: "Kolorystyka",
+    colorsSave: "Zapisz kolory",
+    colorsReset: "Przywróć domyślne",
+    colorsSaved: "Kolory zapisane.",
+    colorPrimary: "Kolor główny (nagłówek tabeli)",
+    colorPrimaryDark: "Kolor główny, ciemny (górny pasek wewnętrzny)",
+    colorAccent: "Kolor akcentu",
+    colorHeaderText: "Kolor tekstu w nagłówku tabeli",
+    colorRowBg: "Tło komórek",
+    colorRowBgAlt: "Tło komórek (naprzemienne)",
+    colorAddBtn: "Przycisk „Dodaj”",
+    colorDeleteBtn: "Przycisk „Usuń”",
+    loadError: "Wczytywanie nie powiodło się: {message}",
+    saveError: "Zapisywanie nie powiodło się: {message}",
+    uploadError: "Przesyłanie nie powiodło się: {message}",
+    confirmRemoveLogo: "Czy na pewno usunąć logo?",
+    confirmRemoveFavicon: "Czy na pewno usunąć favicon?",
+  },
+  passkeys: {
+    title: "Klucze dostępu",
+    hint: "Dzięki kluczowi dostępu (odcisk palca, rozpoznawanie twarzy lub klucz bezpieczeństwa) możesz w przyszłości logować się bez hasła. Klucze dostępu są przypisane do domeny – w środowisku produkcyjnym domena musi być skonfigurowana w Supabase.",
+    register: "Zarejestruj nowy klucz dostępu",
+    empty: "Nie zarejestrowano jeszcze żadnych kluczy dostępu.",
+    createdOn: "– utworzono {date}",
+    registered: "Klucz dostępu został pomyślnie zarejestrowany.",
+    registerError: "Rejestracja nie powiodła się: {message}",
+    registerCancelled: "Rejestracja klucza dostępu została anulowana.",
+    loadError: "Nie udało się wczytać kluczy dostępu: {message}",
+    deleteError: "Usuwanie nie powiodło się: {message}",
+    confirmDelete: "Czy na pewno usunąć ten klucz dostępu?",
+  },
+  account: {
+    title: "Moje konto",
+    personalTitle: "Dane osobowe",
+    saveName: "Zapisz nazwę",
+    nameSaved: "Nazwa zapisana.",
+    nameRequired: "Podaj nazwę.",
+    emailTitle: "Adres e-mail",
+    changeEmail: "Zmień adres e-mail",
+    emailSent:
+      "Wysłano e-maile potwierdzające. Nowy adres zacznie obowiązywać dopiero po potwierdzeniu linku.",
+    passwordTitle: "Zmień hasło",
+    currentPassword: "Obecne hasło (do weryfikacji)",
+    newPassword: "Nowe hasło",
+    newPasswordRepeat: "Powtórz nowe hasło",
+    changePassword: "Zmień hasło",
+    passwordChanged: "Hasło zmienione.",
+    passwordMismatch: "Hasła nie są zgodne.",
+    passwordTooShort: "Nowe hasło musi mieć co najmniej 8 znaków.",
+    passwordAuthTitle: "Logowanie hasłem",
+    passwordAuthHint:
+      "Możesz wyłączyć logowanie e-mailem i hasłem dla swojego konta i logować się w przyszłości wyłącznie kluczem dostępu. Wymaga to zarejestrowania co najmniej jednego klucza dostępu.",
+    passwordAuthCheckbox: "Logowanie e-mailem i hasłem dozwolone",
+    passwordAuthEnabled: "Logowanie hasłem włączone.",
+    passwordAuthDisabled: "Logowanie hasłem wyłączone.",
+    passwordAuthNeedsPasskey:
+      "Bez zarejestrowanego klucza dostępu nie możesz wyłączyć logowania hasłem – stracisz dostęp do konta. Najpierw zarejestruj klucz dostępu poniżej.",
+    confirmDisablePasswordAuth:
+      "Czy na pewno wyłączyć logowanie e-mailem i hasłem? Potem będziesz mógł/mogła zalogować się tylko kluczem dostępu.",
+    wrongCurrentPassword: "Obecne hasło jest nieprawidłowe.",
+    emailAlreadyUsed: "Ten adres e-mail jest już używany.",
+    saveError: "Zapisywanie nie powiodło się: {message}",
+    changeError: "Zmiana nie powiodła się: {message}",
+  },
+  suggestions: {
+    formTitle: "Zaproponuj danie",
+    formHint:
+      "Brakuje dania w jadłospisie? Zaproponuj je tutaj – zespół stołówki sprawdzi Twoją propozycję.",
+    nameLabel: "Nazwa dania",
+    descriptionLabel: "Opis / składniki (opcjonalnie)",
+    submit: "Wyślij propozycję",
+    submitting: "Wysyłanie…",
+    success: "Dziękujemy! Twoja propozycja została przesłana.",
+    duplicate: "To danie już istnieje w jadłospisie.",
+    genericError: "Wysyłanie nie powiodło się: {message}",
+    nameRequired: "Podaj nazwę.",
+    backToMenu: "← Powrót do jadłospisu",
+    reviewTitle: "Propozycje dań",
+    reviewEmpty: "Brak propozycji.",
+    accept: "Dodaj jako danie",
+    reject: "Odrzuć",
+    confirmReject: "Czy na pewno odrzucić i usunąć propozycję „{name}”?",
+    accepted: "Dodano jako danie.",
+    rejected: "Propozycja odrzucona.",
+    loadError: "Wczytywanie nie powiodło się: {message}",
+    actionError: "Czynność nie powiodła się: {message}",
+    submittedOn: "przesłano {date}",
+  },
+};
+
+export type { Dict };
+export const dictionaries = { de, en, pl };
@@ -0,0 +1,16 @@
+// Nur für Server-Komponenten/Routen importieren (next/headers)!
+// Client-Komponenten müssen stattdessen "@/lib/i18n/shared" verwenden,
+// sonst landet next/headers im Client-Bundle.
+
+import "server-only";
+import { cookies } from "next/headers";
+import { DEFAULT_LOCALE, isLocale, type Locale } from "./locales";
+
+export * from "./shared";
+
+/** Aktuelle Sprache aus dem Cookie lesen (Server-Komponenten). */
+export async function getLocale(): Promise<Locale> {
+  const store = await cookies();
+  const value = store.get("locale")?.value;
+  return isLocale(value) ? value : DEFAULT_LOCALE;
+}
@@ -0,0 +1,13 @@
+export const LOCALES = ["de", "en", "pl"] as const;
+export type Locale = (typeof LOCALES)[number];
+export const DEFAULT_LOCALE: Locale = "de";
+
+export const LOCALE_LABELS: Record<Locale, string> = {
+  de: "Deutsch",
+  en: "English",
+  pl: "Polski",
+};
+
+export function isLocale(value: string | undefined | null): value is Locale {
+  return !!value && (LOCALES as readonly string[]).includes(value);
+}
@@ -0,0 +1,26 @@
+// Client-sicherer Teil von lib/i18n: keine Abhängigkeit auf next/headers,
+// darf daher auch von "use client"-Komponenten importiert werden.
+
+import { dictionaries, type Dict } from "./dictionaries";
+import type { Locale } from "./locales";
+
+export { LOCALES, LOCALE_LABELS, DEFAULT_LOCALE, isLocale } from "./locales";
+export type { Locale } from "./locales";
+export type { Dict } from "./dictionaries";
+
+export const LOCALE_COOKIE = "locale";
+
+export function getDictionary(locale: Locale): Dict {
+  return dictionaries[locale];
+}
+
+/** Platzhalter der Form "{name}" durch vars.name ersetzen. */
+export function formatMessage(
+  template: string,
+  vars?: Record<string, string | number>
+): string {
+  if (!vars) return template;
+  return template.replace(/\{(\w+)\}/g, (match, key) =>
+    key in vars ? String(vars[key]) : match
+  );
+}
@@ -0,0 +1,74 @@
+// Datums- und Formatierungshelfer für den Wochenplan (Mo–Fr).
+// Alle Berechnungen laufen über UTC, damit Server und Browser
+// unabhängig von der Zeitzone dieselbe Woche ermitteln.
+
+import type { MenuEntry } from "./types";
+
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+
+function toDate(iso: string): Date {
+  return new Date(`${iso}T00:00:00Z`);
+}
+
+export function toISO(d: Date): string {
+  return d.toISOString().slice(0, 10);
+}
+
+/** Montag der Woche, in der `iso` liegt (bzw. der aktuellen Woche). */
+export function mondayOf(iso?: string | null): string {
+  const base =
+    iso && ISO_DATE.test(iso)
+      ? toDate(iso)
+      : new Date();
+  const day = (base.getUTCDay() + 6) % 7; // Montag = 0
+  const monday = new Date(
+    Date.UTC(base.getUTCFullYear(), base.getUTCMonth(), base.getUTCDate() - day)
+  );
+  return toISO(monday);
+}
+
+export function addDays(iso: string, days: number): string {
+  const d = toDate(iso);
+  d.setUTCDate(d.getUTCDate() + days);
+  return toISO(d);
+}
+
+/** Heutiges Datum als YYYY-MM-DD (UTC). */
+export function todayISO(): string {
+  return toISO(new Date());
+}
+
+/** Index (0=Montag…4=Freitag) von `iso` innerhalb seiner Woche, sonst -1 (Wochenende). */
+export function weekdayIndex(iso: string): number {
+  const day = (toDate(iso).getUTCDay() + 6) % 7;
+  return day <= 4 ? day : -1;
+}
+
+/** z. B. "13. Juli 2026" (dateLocale z. B. "de-DE", "en-GB", "pl-PL") */
+export function formatDateLong(iso: string, dateLocale: string): string {
+  return toDate(iso).toLocaleDateString(dateLocale, {
+    day: "numeric",
+    month: "long",
+    year: "numeric",
+    timeZone: "UTC",
+  });
+}
+
+/** z. B. "3,50€" */
+export function formatPrice(price: number | string): string {
+  return Number(price).toFixed(2).replace(".", ",") + "€";
+}
+
+/** Allergen-/Zusatzstoff-Kürzel eines Gerichts, z. B. "A,G,2" */
+export function dishCodes(dish: { allergens: string[]; additives: string[] }): string {
+  return [...(dish.allergens ?? []), ...(dish.additives ?? [])].join(",");
+}
+
+/** Einträge eines Tages/einer Essenszeit aus der geladenen Wochenliste herausfiltern. */
+export function entriesFor(
+  entries: MenuEntry[],
+  iso: string,
+  sectionKey: string
+): MenuEntry[] {
+  return entries.filter((e) => e.menu_date === iso && e.section_key === sectionKey);
+}
@@ -0,0 +1,22 @@
+// CSRF-Schutz (Defense-in-Depth) für schreibende Route-Handler:
+// Browser senden bei Cross-Site-POSTs immer einen Origin-Header –
+// stimmt er nicht mit dem Host überein, wird die Anfrage abgelehnt.
+// (Erste Verteidigungslinie sind bereits die SameSite=Lax-Session-
+// Cookies von @supabase/ssr sowie der JSON-Content-Type.)
+export function isSameOrigin(request: Request): boolean {
+  const origin = request.headers.get("origin");
+  // Kein Origin-Header: kein Browser-Cross-Site-Kontext (z. B. curl);
+  // die Authentifizierung greift trotzdem.
+  if (!origin) return true;
+  const host = request.headers.get("host");
+  try {
+    const originUrl = new URL(origin);
+    if (originUrl.host === host) return true;
+    // Hinter einem Reverse-Proxy, der den Host-Header umschreibt, gilt
+    // zusätzlich die öffentlich konfigurierte App-URL als eigene Origin.
+    const appUrl = process.env.APP_URL;
+    return !!appUrl && originUrl.origin === new URL(appUrl).origin;
+  } catch {
+    return false;
+  }
+}
@@ -0,0 +1,14 @@
+import "server-only";
+import { createClient as createSupabaseClient } from "@supabase/supabase-js";
+
+// Service-Role-Client: umgeht RLS. Ausschließlich serverseitig verwenden
+// (Benutzerverwaltung durch den Admin).
+export function createAdminClient() {
+  return createSupabaseClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.SUPABASE_SERVICE_ROLE_KEY!,
+    {
+      auth: { persistSession: false, autoRefreshToken: false },
+    }
+  );
+}
@@ -0,0 +1,15 @@
+import { createBrowserClient } from "@supabase/ssr";
+
+// Browser-Client (Client Components). Passkey-Support ist bei Supabase
+// derzeit als experimentelles Feature markiert und muss aktiviert werden.
+export function createClient() {
+  return createBrowserClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      auth: {
+        experimental: { passkey: true },
+      },
+    }
+  );
+}
@@ -0,0 +1,30 @@
+import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
+
+// Server-Client (Server Components, Route Handler, Server Actions).
+// Muss pro Request neu erzeugt werden.
+export async function createClient() {
+  const cookieStore = await cookies();
+
+  return createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return cookieStore.getAll();
+        },
+        setAll(cookiesToSet) {
+          try {
+            cookiesToSet.forEach(({ name, value, options }) =>
+              cookieStore.set(name, value, options)
+            );
+          } catch {
+            // In Server Components dürfen keine Cookies gesetzt werden –
+            // das Session-Refresh übernimmt proxy.ts.
+          }
+        },
+      },
+    }
+  );
+}
@@ -0,0 +1,98 @@
+export type Role = "admin" | "staff";
+
+export interface Profile {
+  id: string;
+  email: string;
+  full_name: string;
+  role: Role;
+  password_auth_enabled: boolean;
+  created_at: string;
+}
+
+export interface Section {
+  key: string;
+  label: string;
+  label_en: string | null;
+  label_pl: string | null;
+  time_range: string;
+  sort: number;
+}
+
+export interface Dish {
+  id: string;
+  name: string;
+  name_en: string | null;
+  name_pl: string | null;
+  price: number;
+  allergens: string[];
+  additives: string[];
+}
+
+export interface MenuEntry {
+  id: string;
+  menu_date: string;
+  section_key: string;
+  position: number;
+  dish: Dish;
+}
+
+export interface CodeItem {
+  code: string;
+  name: string;
+  name_en: string | null;
+  name_pl: string | null;
+  sort: number;
+}
+
+export interface DishSuggestion {
+  id: string;
+  name: string;
+  description: string | null;
+  created_at: string;
+}
+
+/** Übersetzten Namen für die aktuelle Sprache liefern, sonst Deutsch als Fallback. */
+export function localized(
+  item: { name?: string; label?: string; name_en?: string | null; name_pl?: string | null; label_en?: string | null; label_pl?: string | null },
+  locale: string
+): string {
+  const de = item.name ?? item.label ?? "";
+  if (locale === "en") return item.name_en || item.label_en || de;
+  if (locale === "pl") return item.name_pl || item.label_pl || de;
+  return de;
+}
+
+// Farb-Defaults (r-hofmann.de: Blau #003388, Navy #0d315c, Orange #ff6900)
+export const DEFAULT_COLORS: Record<string, string> = {
+  primary: "#003388",
+  primaryDark: "#0d315c",
+  accent: "#ff6900",
+  headerText: "#ffffff",
+  rowBg: "#e3e4f1",
+  rowBgAlt: "#f4f4fa",
+  addBtn: "#6da54c",
+  deleteBtn: "#e2371d",
+};
+
+export const COLOR_VARS: Record<string, string> = {
+  primary: "--c-primary",
+  primaryDark: "--c-primary-dark",
+  accent: "--c-accent",
+  headerText: "--c-header-text",
+  rowBg: "--c-row-bg",
+  rowBgAlt: "--c-row-bg-alt",
+  addBtn: "--c-add",
+  deleteBtn: "--c-del",
+};
+
+export function logoUrl(path: string | null | undefined): string | null {
+  if (!path) return null;
+  return `${process.env.NEXT_PUBLIC_SUPABASE_URL}/storage/v1/object/public/branding/${path}`;
+}
+
+export function faviconUrl(path: string | null | undefined): string | null {
+  if (!path) return null;
+  return `${process.env.NEXT_PUBLIC_SUPABASE_URL}/storage/v1/object/public/branding/${path}`;
+}
+
+export const SITE_TITLE = process.env.SITE_TITLE?.trim() || "Canteen Menu";
@@ -1,7 +1,30 @@
 import type { NextConfig } from "next";

+// HTTP-Security-Header für alle Routen.
+// HTTPS/HSTS übernimmt im Live-Betrieb der Reverse-Proxy.
+const securityHeaders = [
+  // Verhindert Einbettung in fremde Seiten (Clickjacking)
+  { key: "X-Frame-Options", value: "DENY" },
+  { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+  // Browser darf Content-Types nicht "erraten"
+  { key: "X-Content-Type-Options", value: "nosniff" },
+  // Keine vollständigen URLs an fremde Seiten weitergeben
+  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+  // Sensorische APIs werden nicht benötigt
+  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
+];
+
 const nextConfig: NextConfig = {
-  /* config options here */
+  // Für den Docker-Betrieb: minimales, eigenständiges Server-Bundle
+  output: "standalone",
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: securityHeaders,
+      },
+    ];
+  },
 };

 export default nextConfig;
@@ -1,16 +1,19 @@
 {
-  "name": "speisekarte",
-  "version": "0.1.0",
+  "name": "canteen-menu",
+  "version": "1.4.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
-      "name": "speisekarte",
-      "version": "0.1.0",
+      "name": "canteen-menu",
+      "version": "1.4.0",
      "dependencies": {
+        "@supabase/ssr": "^0.12.3",
+        "@supabase/supabase-js": "^2.110.7",
        "next": "16.2.10",
        "react": "19.2.4",
-        "react-dom": "19.2.4"
+        "react-dom": "19.2.4",
+        "server-only": "^0.0.1"
      },
      "devDependencies": {
        "@tailwindcss/postcss": "^4",
@@ -1313,6 +1316,102 @@
      "dev": true,
      "license": "MIT"
    },
+    "node_modules/@supabase/auth-js": {
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.110.7.tgz",
+      "integrity": "sha512-M5Bpl4hCv6kHcOO/xM06Dyfg1mYLHljMkp1plhzG9IRZPc3czvyMsSN1XpL5+GKisOKM3lSN59zhpcm6sMVXfA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/functions-js": {
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.110.7.tgz",
+      "integrity": "sha512-megYmexlYEoR/0qlsr4Snh9wtzAodO7MAri3NMevZrXzNvQRKlvmTcSBoKGLQEPDakgDZMqbMdf9DwoZz6qfoA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/phoenix": {
+      "version": "0.4.5",
+      "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.5.tgz",
+      "integrity": "sha512-aAn9H9ovVyeApKy11OWOrrOGq8DV68yWeH4ud2lN9fzn4aO8Zb5GLL9m1pUg9nLqIcT+ZDfAcsZe0E/nqdv2lw==",
+      "license": "MIT"
+    },
+    "node_modules/@supabase/postgrest-js": {
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.110.7.tgz",
+      "integrity": "sha512-ban6YV0djhVaqVYezlOARKLIuOBSvLLhyQVZjA2nxPrtswhxHCl1+gI4giFgI9ATQAaMNbUZb4JXiuL5lEA/5g==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/realtime-js": {
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.110.7.tgz",
+      "integrity": "sha512-AMtZjyFA2gsmjuxopPNS/sRznLQHG0Ht5x+ytTPTOh3vAcOTUlVRLx7gW4/CONNnbb3PKOkE+HmM35HOSbmomQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@supabase/phoenix": "0.4.5",
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/ssr": {
+      "version": "0.12.3",
+      "resolved": "https://registry.npmjs.org/@supabase/ssr/-/ssr-0.12.3.tgz",
+      "integrity": "sha512-qWXJ/dI7CiYDKyTgIPqJ4Qkh8y5edh2LdF/nkN48z47mmEVzAO2OE+YErYeQ/UemVfonn/F4kFz+lhLqoVMdpw==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "^1.0.2"
+      },
+      "peerDependencies": {
+        "@supabase/supabase-js": "^2.110.5"
+      }
+    },
+    "node_modules/@supabase/storage-js": {
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.110.7.tgz",
+      "integrity": "sha512-2tcDE8cjEDy1uKxKavBpKQod1JdMV1jDXQag48TCa+kycmJOltc0yVabC0BUlhOwAl6WykXU2aOsH3ELMtZrmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "iceberg-js": "^0.8.1",
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/supabase-js": {
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.110.7.tgz",
+      "integrity": "sha512-AnfO3A230Shy6RMO7cya3Wl1OcXnABJrzH8vP+fY7/RFjhzcchB7DjKkkTIAntlwekD+GkSFzEvt2tC+D4Fp8w==",
+      "license": "MIT",
+      "dependencies": {
+        "@supabase/auth-js": "2.110.7",
+        "@supabase/functions-js": "2.110.7",
+        "@supabase/postgrest-js": "2.110.7",
+        "@supabase/realtime-js": "2.110.7",
+        "@supabase/storage-js": "2.110.7"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
    "node_modules/@swc/helpers": {
      "version": "0.5.15",
      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
@@ -2816,6 +2915,19 @@
      "dev": true,
      "license": "MIT"
    },
+    "node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
    "node_modules/cross-spawn": {
      "version": "7.0.6",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@@ -4103,6 +4215,15 @@
        "hermes-estree": "0.25.1"
      }
    },
+    "node_modules/iceberg-js": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/iceberg-js/-/iceberg-js-0.8.1.tgz",
+      "integrity": "sha512-1dhVQZXhcHje7798IVM+xoo/1ZdVfzOMIc8/rgVSijRK38EDqOJoGula9N/8ZI5RD8QTxNQtK/Gozpr+qUqRRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
    "node_modules/ignore": {
      "version": "5.3.2",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -5873,6 +5994,12 @@
        "semver": "bin/semver.js"
      }
    },
+    "node_modules/server-only": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/server-only/-/server-only-0.0.1.tgz",
+      "integrity": "sha512-qepMx2JxAa5jjfzxG79yPPq+8BuFToHd1hm7kI+Z4zAq1ftQiP7HcxMhDDItrbtwVeLg/cY2JnKnrcFkmiswNA==",
+      "license": "MIT"
+    },
    "node_modules/set-function-length": {
      "version": "1.2.2",
      "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
@@ -1,17 +1,20 @@
 {
-  "name": "speisekarte",
-  "version": "0.1.0",
+  "name": "canteen-menu",
+  "version": "1.4.0",
  "private": true,
  "scripts": {
-    "dev": "next dev",
+    "dev": "next dev -H 0.0.0.0",
    "build": "next build",
-    "start": "next start",
+    "start": "next start -H 0.0.0.0",
    "lint": "eslint"
  },
  "dependencies": {
+    "@supabase/ssr": "^0.12.3",
+    "@supabase/supabase-js": "^2.110.7",
    "next": "16.2.10",
    "react": "19.2.4",
-    "react-dom": "19.2.4"
+    "react-dom": "19.2.4",
+    "server-only": "^0.0.1"
  },
  "devDependencies": {
    "@tailwindcss/postcss": "^4",
@@ -0,0 +1,49 @@
+import { createServerClient } from "@supabase/ssr";
+import { NextResponse, type NextRequest } from "next/server";
+
+// Session-Refresh + Zugriffsschutz für die internen Bereiche.
+export async function proxy(request: NextRequest) {
+  let response = NextResponse.next({ request });
+
+  const supabase = createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return request.cookies.getAll();
+        },
+        setAll(cookiesToSet) {
+          cookiesToSet.forEach(({ name, value }) =>
+            request.cookies.set(name, value)
+          );
+          response = NextResponse.next({ request });
+          cookiesToSet.forEach(({ name, value, options }) =>
+            response.cookies.set(name, value, options)
+          );
+        },
+      },
+    }
+  );
+
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  if (!user) {
+    // Absolute URL aus dem Host-Header des Browsers bauen: request.nextUrl
+    // trägt bei "-H 0.0.0.0" die Server-Bindung statt des aufgerufenen
+    // Hosts, und relative Location-Header lehnt die Middleware ab.
+    const host = request.headers.get("host") ?? request.nextUrl.host;
+    const proto =
+      request.headers.get("x-forwarded-proto") ??
+      request.nextUrl.protocol.replace(":", "");
+    return NextResponse.redirect(`${proto}://${host}/login`, 303);
+  }
+
+  return response;
+}
+
+export const config = {
+  matcher: ["/intern/:path*", "/admin/:path*", "/konto/:path*"],
+};
@@ -0,0 +1,47 @@
+// Konfiguriert die Passkey-Domain (WebAuthn Relying Party) des
+// Supabase-Projekts auf die öffentliche App-URL. Passkeys sind an die
+// Domain gebunden – nach einem Domain-Wechsel einmal ausführen.
+//
+// Aufruf:
+//   SUPABASE_ACCESS_TOKEN=... APP_URL=https://menu.example.de node scripts/configure-passkeys.mjs
+// oder mit der URL als Argument:
+//   SUPABASE_ACCESS_TOKEN=... node scripts/configure-passkeys.mjs https://menu.example.de
+
+const PROJECT_REF = "hvzikwjoyhoakedlywhj";
+const token = process.env.SUPABASE_ACCESS_TOKEN;
+const rawUrl = process.argv[2] ?? process.env.APP_URL;
+
+if (!token || !rawUrl) {
+  console.error(
+    "Nutzung: SUPABASE_ACCESS_TOKEN=... [APP_URL=https://…] node scripts/configure-passkeys.mjs [url]"
+  );
+  process.exit(1);
+}
+
+const url = new URL(rawUrl);
+const res = await fetch(
+  `https://api.supabase.com/v1/projects/${PROJECT_REF}/config/auth`,
+  {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      passkey_enabled: true,
+      webauthn_rp_id: url.hostname,
+      webauthn_rp_display_name: "Canteen Menu",
+      webauthn_rp_origins: url.origin,
+    }),
+  }
+);
+
+if (!res.ok) {
+  console.error(`Fehler ${res.status}: ${await res.text()}`);
+  process.exit(1);
+}
+
+console.log(`Passkey-Domain gesetzt: rp_id=${url.hostname}, origin=${url.origin}`);
+console.log(
+  "Hinweis: Bereits auf einer anderen Domain registrierte Passkeys verlieren ihre Gültigkeit."
+);
@@ -0,0 +1,47 @@
+# Synchronisiert die lokale PostgreSQL-Kopie mit der Supabase-Datenbank.
+# Voraussetzungen:
+#   - PostgreSQL 17 lokal installiert (Standardpfad, Dienst läuft)
+#   - Umgebungsvariablen:
+#       SUPABASE_DB_PASSWORD  = Datenbank-Passwort des Supabase-Projekts
+#       LOCAL_PG_PASSWORD     = Passwort des lokalen postgres-Benutzers
+# Aufruf:  powershell -File scripts\sync-local-db.ps1
+
+$ErrorActionPreference = "Stop"
+
+$PgBin      = "C:\Program Files\PostgreSQL\17\bin"
+$RemoteHost = "aws-0-eu-central-1.pooler.supabase.com"
+$RemoteUser = "postgres.hvzikwjoyhoakedlywhj"
+$LocalDir   = Join-Path $PSScriptRoot "..\supabase\local"
+
+if (-not $env:SUPABASE_DB_PASSWORD) { throw "SUPABASE_DB_PASSWORD ist nicht gesetzt." }
+if (-not $env:LOCAL_PG_PASSWORD)    { throw "LOCAL_PG_PASSWORD ist nicht gesetzt." }
+
+# 1. Aktuellen Stand aus Supabase ziehen (Session-Pooler, Port 5432)
+$env:PGPASSWORD = $env:SUPABASE_DB_PASSWORD
+$SchemaFile = Join-Path $LocalDir "10_schema.sql"
+& "$PgBin\pg_dump" -h $RemoteHost -p 5432 -U $RemoteUser -d postgres `
+  --schema=public --schema-only --no-owner --no-privileges `
+  -f $SchemaFile
+& "$PgBin\pg_dump" -h $RemoteHost -p 5432 -U $RemoteUser -d postgres `
+  --schema=public --data-only --no-owner --disable-triggers `
+  -f (Join-Path $LocalDir "20_data.sql")
+
+# pg_dump legt "CREATE SCHEMA public;" und \restrict/\unrestrict-Marker an.
+# Das offizielle postgres-Docker-Image besitzt "public" bereits und bricht
+# mit ON_ERROR_STOP=1 sonst das komplette Init-Skript ab.
+(Get-Content $SchemaFile) `
+  -replace '^CREATE SCHEMA public;$', 'CREATE SCHEMA IF NOT EXISTS public;' `
+  -replace '^\\restrict .*$', '' `
+  -replace '^\\unrestrict .*$', '' |
+  Set-Content $SchemaFile
+
+# 2. Lokale Datenbank neu aufbauen
+$env:PGPASSWORD = $env:LOCAL_PG_PASSWORD
+& "$PgBin\psql" -h localhost -U postgres -c "drop database if exists canteen_menu;"
+& "$PgBin\psql" -h localhost -U postgres -c "create database canteen_menu;"
+
+foreach ($file in @("00_stubs.sql", "10_schema.sql", "15_auth_users.sql", "20_data.sql")) {
+  & "$PgBin\psql" -h localhost -U postgres -d canteen_menu -q -f (Join-Path $LocalDir $file)
+}
+
+Write-Host "Lokale Datenbank 'canteen_menu' wurde aktualisiert."
@@ -0,0 +1,58 @@
+-- =============================================================
+-- Stubs für die LOKALE PostgreSQL-Kopie (ohne Supabase-Stack).
+-- Stellt die minimalen Supabase-Objekte bereit, die das public-
+-- Schema referenziert (auth.users, auth.uid(), Rollen, storage).
+-- Reihenfolge: 00_stubs.sql -> Schema-Dump -> Daten-Dump
+-- =============================================================
+
+-- Rollen, die in den RLS-Policies referenziert werden
+do $$
+begin
+  if not exists (select from pg_roles where rolname = 'anon') then
+    create role anon nologin;
+  end if;
+  if not exists (select from pg_roles where rolname = 'authenticated') then
+    create role authenticated nologin;
+  end if;
+  if not exists (select from pg_roles where rolname = 'service_role') then
+    create role service_role nologin bypassrls;
+  end if;
+end
+$$;
+
+-- ---------- auth-Schema (Minimal-Stub) ----------
+create schema if not exists auth;
+
+create table if not exists auth.users (
+  id                 uuid primary key,
+  email              text,
+  raw_user_meta_data jsonb not null default '{}'::jsonb,
+  created_at         timestamptz not null default now()
+);
+
+-- Entspricht supabase auth.uid(); liefert lokal null,
+-- sofern kein JWT-Claim gesetzt ist.
+create or replace function auth.uid()
+returns uuid
+language sql
+stable
+as $$
+  select nullif(current_setting('request.jwt.claim.sub', true), '')::uuid
+$$;
+
+-- ---------- storage-Schema (Minimal-Stub) ----------
+create schema if not exists storage;
+
+create table if not exists storage.buckets (
+  id     text primary key,
+  name   text not null,
+  public boolean not null default false
+);
+
+create table if not exists storage.objects (
+  id         uuid primary key default gen_random_uuid(),
+  bucket_id  text references storage.buckets (id),
+  name       text,
+  owner      uuid,
+  created_at timestamptz not null default now()
+);
@@ -0,0 +1,502 @@
+--
+-- PostgreSQL database dump
+--
+
+
+-- Dumped from database version 17.6
+-- Dumped by pg_dump version 17.10
+
+SET statement_timeout = 0;
+SET lock_timeout = 0;
+SET idle_in_transaction_session_timeout = 0;
+SET transaction_timeout = 0;
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+SELECT pg_catalog.set_config('search_path', '', false);
+SET check_function_bodies = false;
+SET xmloption = content;
+SET client_min_messages = warning;
+SET row_security = off;
+
+--
+-- Name: public; Type: SCHEMA; Schema: -; Owner: -
+--
+
+CREATE SCHEMA IF NOT EXISTS public;
+
+
+--
+-- Name: SCHEMA public; Type: COMMENT; Schema: -; Owner: -
+--
+
+COMMENT ON SCHEMA public IS 'standard public schema';
+
+
+--
+-- Name: app_role(); Type: FUNCTION; Schema: public; Owner: -
+--
+
+CREATE FUNCTION public.app_role() RETURNS text
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+  select role from public.profiles where id = auth.uid()
+$$;
+
+
+--
+-- Name: handle_new_user(); Type: FUNCTION; Schema: public; Owner: -
+--
+
+CREATE FUNCTION public.handle_new_user() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+begin
+  insert into public.profiles (id, email, full_name, role)
+  values (
+    new.id,
+    new.email,
+    coalesce(new.raw_user_meta_data ->> 'full_name', ''),
+    coalesce(new.raw_user_meta_data ->> 'role', 'staff')
+  )
+  on conflict (id) do nothing;
+  return new;
+end;
+$$;
+
+
+--
+-- Name: handle_user_email_change(); Type: FUNCTION; Schema: public; Owner: -
+--
+
+CREATE FUNCTION public.handle_user_email_change() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+begin
+  update public.profiles set email = new.email where id = new.id;
+  return new;
+end;
+$$;
+
+
+--
+-- Name: touch_updated_at(); Type: FUNCTION; Schema: public; Owner: -
+--
+
+CREATE FUNCTION public.touch_updated_at() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+begin
+  new.updated_at := now();
+  return new;
+end;
+$$;
+
+
+SET default_tablespace = '';
+
+SET default_table_access_method = heap;
+
+--
+-- Name: additives; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.additives (
+    code text NOT NULL,
+    name text NOT NULL,
+    sort integer DEFAULT 0 NOT NULL,
+    name_en text,
+    name_pl text
+);
+
+
+--
+-- Name: allergens; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.allergens (
+    code text NOT NULL,
+    name text NOT NULL,
+    sort integer DEFAULT 0 NOT NULL,
+    name_en text,
+    name_pl text
+);
+
+
+--
+-- Name: dish_suggestions; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.dish_suggestions (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    name text NOT NULL,
+    description text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+
+--
+-- Name: dishes; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.dishes (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    name text NOT NULL,
+    price numeric(6,2) DEFAULT 0 NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    allergens text[] DEFAULT '{}'::text[] NOT NULL,
+    additives text[] DEFAULT '{}'::text[] NOT NULL,
+    name_en text,
+    name_pl text
+);
+
+
+--
+-- Name: menu_entries; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.menu_entries (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    menu_date date NOT NULL,
+    section_key text NOT NULL,
+    dish_id uuid NOT NULL,
+    "position" integer DEFAULT 0 NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+
+--
+-- Name: profiles; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.profiles (
+    id uuid NOT NULL,
+    email text NOT NULL,
+    full_name text DEFAULT ''::text NOT NULL,
+    role text DEFAULT 'staff'::text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    password_auth_enabled boolean DEFAULT true NOT NULL,
+    CONSTRAINT profiles_role_check CHECK ((role = ANY (ARRAY['admin'::text, 'staff'::text])))
+);
+
+
+--
+-- Name: sections; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.sections (
+    key text DEFAULT (gen_random_uuid())::text NOT NULL,
+    label text NOT NULL,
+    time_range text NOT NULL,
+    sort integer NOT NULL,
+    label_en text,
+    label_pl text
+);
+
+
+--
+-- Name: settings; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.settings (
+    id integer NOT NULL,
+    colors jsonb DEFAULT '{}'::jsonb NOT NULL,
+    logo_path text,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    favicon_path text,
+    CONSTRAINT settings_id_check CHECK ((id = 1))
+);
+
+
+--
+-- Name: additives additives_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.additives
+    ADD CONSTRAINT additives_pkey PRIMARY KEY (code);
+
+
+--
+-- Name: allergens allergens_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.allergens
+    ADD CONSTRAINT allergens_pkey PRIMARY KEY (code);
+
+
+--
+-- Name: dish_suggestions dish_suggestions_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.dish_suggestions
+    ADD CONSTRAINT dish_suggestions_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: dishes dishes_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.dishes
+    ADD CONSTRAINT dishes_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: menu_entries menu_entries_menu_date_section_key_dish_id_key; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.menu_entries
+    ADD CONSTRAINT menu_entries_menu_date_section_key_dish_id_key UNIQUE (menu_date, section_key, dish_id);
+
+
+--
+-- Name: menu_entries menu_entries_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.menu_entries
+    ADD CONSTRAINT menu_entries_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: profiles profiles_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.profiles
+    ADD CONSTRAINT profiles_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: sections sections_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.sections
+    ADD CONSTRAINT sections_pkey PRIMARY KEY (key);
+
+
+--
+-- Name: settings settings_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.settings
+    ADD CONSTRAINT settings_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: menu_entries_date_idx; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX menu_entries_date_idx ON public.menu_entries USING btree (menu_date);
+
+
+--
+-- Name: dishes dishes_touch_updated_at; Type: TRIGGER; Schema: public; Owner: -
+--
+
+CREATE TRIGGER dishes_touch_updated_at BEFORE UPDATE ON public.dishes FOR EACH ROW EXECUTE FUNCTION public.touch_updated_at();
+
+
+--
+-- Name: settings settings_touch_updated_at; Type: TRIGGER; Schema: public; Owner: -
+--
+
+CREATE TRIGGER settings_touch_updated_at BEFORE UPDATE ON public.settings FOR EACH ROW EXECUTE FUNCTION public.touch_updated_at();
+
+
+--
+-- Name: menu_entries menu_entries_dish_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.menu_entries
+    ADD CONSTRAINT menu_entries_dish_id_fkey FOREIGN KEY (dish_id) REFERENCES public.dishes(id) ON DELETE CASCADE;
+
+
+--
+-- Name: menu_entries menu_entries_section_key_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.menu_entries
+    ADD CONSTRAINT menu_entries_section_key_fkey FOREIGN KEY (section_key) REFERENCES public.sections(key) ON DELETE CASCADE;
+
+
+--
+-- Name: profiles profiles_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.profiles
+    ADD CONSTRAINT profiles_id_fkey FOREIGN KEY (id) REFERENCES auth.users(id) ON DELETE CASCADE;
+
+
+--
+-- Name: additives; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.additives ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: additives additives_public_read; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY additives_public_read ON public.additives FOR SELECT TO authenticated, anon USING (true);
+
+
+--
+-- Name: additives additives_staff_write; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY additives_staff_write ON public.additives TO authenticated USING ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text]))) WITH CHECK ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text])));
+
+
+--
+-- Name: allergens; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.allergens ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: allergens allergens_public_read; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY allergens_public_read ON public.allergens FOR SELECT TO authenticated, anon USING (true);
+
+
+--
+-- Name: allergens allergens_staff_write; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY allergens_staff_write ON public.allergens TO authenticated USING ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text]))) WITH CHECK ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text])));
+
+
+--
+-- Name: dish_suggestions; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.dish_suggestions ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: dish_suggestions dish_suggestions_public_insert; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY dish_suggestions_public_insert ON public.dish_suggestions FOR INSERT TO authenticated, anon WITH CHECK (true);
+
+
+--
+-- Name: dish_suggestions dish_suggestions_staff_delete; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY dish_suggestions_staff_delete ON public.dish_suggestions FOR DELETE TO authenticated USING ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text])));
+
+
+--
+-- Name: dish_suggestions dish_suggestions_staff_select; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY dish_suggestions_staff_select ON public.dish_suggestions FOR SELECT TO authenticated USING ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text])));
+
+
+--
+-- Name: dishes; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.dishes ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: dishes dishes_public_read; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY dishes_public_read ON public.dishes FOR SELECT TO authenticated, anon USING (true);
+
+
+--
+-- Name: dishes dishes_staff_write; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY dishes_staff_write ON public.dishes TO authenticated USING ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text]))) WITH CHECK ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text])));
+
+
+--
+-- Name: menu_entries; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.menu_entries ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: menu_entries menu_entries_public_read; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY menu_entries_public_read ON public.menu_entries FOR SELECT TO authenticated, anon USING (true);
+
+
+--
+-- Name: menu_entries menu_entries_staff_write; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY menu_entries_staff_write ON public.menu_entries TO authenticated USING ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text]))) WITH CHECK ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text])));
+
+
+--
+-- Name: profiles; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: profiles profiles_select_own_or_admin; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY profiles_select_own_or_admin ON public.profiles FOR SELECT TO authenticated USING (((id = ( SELECT auth.uid() AS uid)) OR (public.app_role() = 'admin'::text)));
+
+
+--
+-- Name: profiles profiles_update_own; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY profiles_update_own ON public.profiles FOR UPDATE TO authenticated USING ((id = ( SELECT auth.uid() AS uid))) WITH CHECK ((id = ( SELECT auth.uid() AS uid)));
+
+
+--
+-- Name: sections; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.sections ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: sections sections_public_read; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY sections_public_read ON public.sections FOR SELECT TO authenticated, anon USING (true);
+
+
+--
+-- Name: sections sections_staff_write; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY sections_staff_write ON public.sections TO authenticated USING ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text]))) WITH CHECK ((public.app_role() = ANY (ARRAY['staff'::text, 'admin'::text])));
+
+
+--
+-- Name: settings; Type: ROW SECURITY; Schema: public; Owner: -
+--
+
+ALTER TABLE public.settings ENABLE ROW LEVEL SECURITY;
+
+--
+-- Name: settings settings_admin_update; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY settings_admin_update ON public.settings FOR UPDATE TO authenticated USING ((public.app_role() = 'admin'::text)) WITH CHECK ((public.app_role() = 'admin'::text));
+
+
+--
+-- Name: settings settings_public_read; Type: POLICY; Schema: public; Owner: -
+--
+
+CREATE POLICY settings_public_read ON public.settings FOR SELECT TO authenticated, anon USING (true);
+
+
+--
+-- PostgreSQL database dump complete
+--
+
+
@@ -0,0 +1,6 @@
+-- Benutzer-Stammdaten für die lokale Kopie (ohne Passwort-Hashes –
+-- Login ist nur gegen die Supabase-Instanz möglich).
+insert into auth.users (id, email, raw_user_meta_data) values
+  ('cee4160a-ab3a-4109-b706-b9f27d515596', 'fw@wildeflorian.de',  '{"full_name": "Florian Wilde", "role": "admin"}'),
+  ('102d405c-b010-41f6-9409-244004a3c567', 'kantine@example.com', '{"full_name": "Kantinen-Team", "role": "staff"}')
+on conflict (id) do nothing;
@@ -0,0 +1,212 @@
+--
+-- PostgreSQL database dump
+--
+
+\restrict y6aLgjBTAX9fiLwtkHEGaN6baJ1dCr2Yjdb6nmrL5LPA6jgf5Ml1Mm0EpXO56Kk
+
+-- Dumped from database version 17.6
+-- Dumped by pg_dump version 17.10
+
+SET statement_timeout = 0;
+SET lock_timeout = 0;
+SET idle_in_transaction_session_timeout = 0;
+SET transaction_timeout = 0;
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+SELECT pg_catalog.set_config('search_path', '', false);
+SET check_function_bodies = false;
+SET xmloption = content;
+SET client_min_messages = warning;
+SET row_security = off;
+
+--
+-- Data for Name: additives; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+SET SESSION AUTHORIZATION DEFAULT;
+
+ALTER TABLE public.additives DISABLE TRIGGER ALL;
+
+COPY public.additives (code, name, sort, name_en, name_pl) FROM stdin;
+1	mit Farbstoff	1	with colouring	z barwnikiem
+2	mit Konservierungsstoff	2	with preservative	z konserwantem
+3	mit Antioxidationsmittel	3	with antioxidant	z przeciwutleniaczem
+4	mit Geschmacksverstärker	4	with flavour enhancer	ze wzmacniaczem smaku
+5	geschwefelt	5	sulphured	siarkowany
+6	geschwärzt	6	blackened	barwiony na czarno
+7	gewachst	7	waxed	woskowany
+8	mit Phosphat	8	with phosphate	z fosforanem
+9	mit Süßungsmittel(n)	9	with sweetener(s)	ze słodzikiem/słodzikami
+10	enthält eine Phenylalaninquelle	10	contains a source of phenylalanine	zawiera źródło fenyloalaniny
+11	koffeinhaltig	11	caffeinated	zawiera kofeinę
+\.
+
+
+ALTER TABLE public.additives ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: allergens; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.allergens DISABLE TRIGGER ALL;
+
+COPY public.allergens (code, name, sort, name_en, name_pl) FROM stdin;
+A	Glutenhaltiges Getreide	1	Cereals containing gluten	Zboża zawierające gluten
+B	Krebstiere	2	Crustaceans	Skorupiaki
+C	Eier	3	Eggs	Jaja
+D	Fisch	4	Fish	Ryby
+E	Erdnüsse	5	Peanuts	Orzeszki ziemne
+F	Sojabohnen	6	Soybeans	Soja
+G	Milch (einschließlich Laktose)	7	Milk (including lactose)	Mleko (w tym laktoza)
+H	Schalenfrüchte (Nüsse)	8	Tree nuts	Orzechy
+I	Sellerie	9	Celery	Seler
+J	Senf	10	Mustard	Gorczyca
+K	Sesamsamen	11	Sesame seeds	Nasiona sezamu
+L	Schwefeldioxid und Sulfite	12	Sulphur dioxide and sulphites	Dwutlenek siarki i siarczyny
+M	Lupinen	13	Lupin	Łubin
+N	Weichtiere	14	Molluscs	Mięczaki
+\.
+
+
+ALTER TABLE public.allergens ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: dish_suggestions; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.dish_suggestions DISABLE TRIGGER ALL;
+
+COPY public.dish_suggestions (id, name, description, created_at) FROM stdin;
+\.
+
+
+ALTER TABLE public.dish_suggestions ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: dishes; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.dishes DISABLE TRIGGER ALL;
+
+COPY public.dishes (id, name, price, created_at, updated_at, allergens, additives, name_en, name_pl) FROM stdin;
+bf612ae7-8cdd-4149-8b21-f651631ccc02	Hackfleischbaguette	3.20	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+81c58cc6-7298-4d4a-9997-71d17df5aedf	Knusperhähnchen Wrap	3.70	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+cc7fb9d9-a9ab-4c4c-a376-a8fae0e801c9	Leberkäse im Brötchen	2.30	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+14ef6893-93a7-4649-afe3-d6b6bdf5903c	Schnitzel Baguette	3.50	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+ec3c5e37-9cbc-4c92-ab05-1e3fb942c504	Penne mit Grünen Spargel und Garnelenspieße	5.90	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+dbe5ee6e-8b04-4bf7-99bb-f936f6564217	Bratkartoffel Gemüse Pfanne mit Hähnchenbrust und Dip	5.90	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+c0613fe7-e5c6-489e-afe5-6da2533b2bd4	Schweinefilet im Speckmantel dazu Rahmsoße und Butterspätzle	5.90	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+c5cfa5b4-e502-4b56-b579-b9fbbf817f25	Penne mit Grünen Spargel, get. Tomaten und Cherrytomaten	5.30	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+f8ba1844-1f23-4b23-9e03-f59148f8b2ed	Spaghetti mit fruchtiger Tomatensauce und Parmesan	5.30	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+7a6fed05-e0f5-4e97-bdd4-a46c5ef1376a	Gebackener Feta mit griechischen Bauernsalat und Baguette	5.30	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+ff40ea65-63bc-4d01-b626-e0c9e5d2acb3	Gemüse-Curry mit Basmatireis	4.90	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+ea26f18b-ddf3-4899-95e7-5dbd0878d90c	Kartoffelcremesuppe	1.50	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+6222d5f4-05e3-4af4-a41c-3f8b4c9c5c78	Gulaschsuppe	2.50	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+3c8cf0c2-b0a9-43e3-8233-723d5718a157	Tomatensuppe mit Croutons	1.80	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+2dd85835-5425-4271-9fc0-e5215bbce476	Kürbiscremesuppe	1.80	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+06df753a-65ed-4bd0-a325-d32c78ec88fa	Linseneintopf mit Würstchen	2.20	2026-07-17 15:17:02.979184+00	2026-07-17 15:17:02.979184+00	{}	{}	\N	\N
+a987c96f-25a0-4e5e-b8a8-aab683a01feb	Chili con Carne mit Brötchen	3.90	2026-07-17 15:17:02.979184+00	2026-07-17 22:21:35.276672+00	{A}	{4}	\N	\N
+7ebdf56a-9482-4bde-bf60-e6e5424e397b	Kürbisrisotto	0.00	2026-07-17 23:57:48.351754+00	2026-07-17 23:57:48.351754+00	{}	{}	\N	\N
+fd356340-e10f-42d7-ae5a-3521a9151bb8	Test	0.00	2026-07-17 23:58:04.141825+00	2026-07-17 23:58:19.411846+00	{}	{}	abc	bca
+\.
+
+
+ALTER TABLE public.dishes ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: sections; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.sections DISABLE TRIGGER ALL;
+
+COPY public.sections (key, label, time_range, sort, label_en, label_pl) FROM stdin;
+mittagessen_veg	Mittagessen vegetarisch	11:30 - 13:30	4	Lunch (vegetarian)	Obiad (wegetariański)
+mittagessen	Mittagessen	11:30 - 13:30	3	Lunch	Obiad
+brotzeit	Brotzeit	09:00 - 10:00	2	Breakfast	Śniadanie
+suppe	Suppe	11:30 - 13:30	6	Soup	Zupa
+\.
+
+
+ALTER TABLE public.sections ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: menu_entries; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.menu_entries DISABLE TRIGGER ALL;
+
+COPY public.menu_entries (id, menu_date, section_key, dish_id, "position", created_at) FROM stdin;
+70469091-417b-47ed-aab5-747ff97e4ad4	2026-07-14	brotzeit	bf612ae7-8cdd-4149-8b21-f651631ccc02	0	2026-07-17 15:17:02.979184+00
+1e1f9b4e-75e7-413f-a747-c2884675d9f7	2026-07-15	brotzeit	81c58cc6-7298-4d4a-9997-71d17df5aedf	0	2026-07-17 15:17:02.979184+00
+7b2089f7-7c01-4d6a-9e68-ebfa594bb713	2026-07-16	brotzeit	cc7fb9d9-a9ab-4c4c-a376-a8fae0e801c9	0	2026-07-17 15:17:02.979184+00
+d6e24a0d-cc32-438d-9d91-e39ecbb82d5d	2026-07-17	brotzeit	a987c96f-25a0-4e5e-b8a8-aab683a01feb	0	2026-07-17 15:17:02.979184+00
+c165765a-1eb3-4d7e-9566-3768e9007793	2026-07-13	mittagessen	14ef6893-93a7-4649-afe3-d6b6bdf5903c	0	2026-07-17 15:17:02.979184+00
+78be0a94-1b31-47ef-af62-40548d75aa4e	2026-07-14	mittagessen	ec3c5e37-9cbc-4c92-ab05-1e3fb942c504	0	2026-07-17 15:17:02.979184+00
+0635198c-6aa9-4811-a8fd-67e31174eb73	2026-07-15	mittagessen	dbe5ee6e-8b04-4bf7-99bb-f936f6564217	0	2026-07-17 15:17:02.979184+00
+f02305b6-7650-4b52-b440-3df7045e17a7	2026-07-16	mittagessen	c0613fe7-e5c6-489e-afe5-6da2533b2bd4	0	2026-07-17 15:17:02.979184+00
+b838a6a4-1a58-469e-9201-af686c7a780a	2026-07-14	mittagessen_veg	c5cfa5b4-e502-4b56-b579-b9fbbf817f25	0	2026-07-17 15:17:02.979184+00
+4886ee1a-f8fd-4548-8483-893a0f2dd9aa	2026-07-15	mittagessen_veg	f8ba1844-1f23-4b23-9e03-f59148f8b2ed	0	2026-07-17 15:17:02.979184+00
+1f6400bb-0b9a-444c-b793-e1cbd96ec215	2026-07-16	mittagessen_veg	7a6fed05-e0f5-4e97-bdd4-a46c5ef1376a	0	2026-07-17 15:17:02.979184+00
+7df88a12-6fb8-457e-8cf8-5ddc43e06583	2026-07-13	suppe	ea26f18b-ddf3-4899-95e7-5dbd0878d90c	0	2026-07-17 15:17:02.979184+00
+e2bfe62e-12c4-4f68-a7e7-ca1ee30a6039	2026-07-14	suppe	6222d5f4-05e3-4af4-a41c-3f8b4c9c5c78	0	2026-07-17 15:17:02.979184+00
+662902e0-bb5e-4268-b977-cef2ac20dc35	2026-07-15	suppe	3c8cf0c2-b0a9-43e3-8233-723d5718a157	0	2026-07-17 15:17:02.979184+00
+6083a3f3-a54e-40c5-be1f-c96e474eb8a0	2026-07-16	suppe	2dd85835-5425-4271-9fc0-e5215bbce476	0	2026-07-17 15:17:02.979184+00
+36279cd1-b0e2-46a8-b46c-c23f9f5dbb1b	2026-07-17	suppe	06df753a-65ed-4bd0-a325-d32c78ec88fa	0	2026-07-17 15:17:02.979184+00
+bfa36cb8-82d6-466c-b954-bf82c6a67b95	2026-07-23	brotzeit	bf612ae7-8cdd-4149-8b21-f651631ccc02	0	2026-07-17 15:17:02.979184+00
+b86caf93-34eb-46a3-bbe4-3a67dcf79be0	2026-07-21	brotzeit	81c58cc6-7298-4d4a-9997-71d17df5aedf	0	2026-07-17 15:17:02.979184+00
+d8a962cd-f1cf-4f87-95fb-f5af79cbd0a5	2026-07-20	brotzeit	cc7fb9d9-a9ab-4c4c-a376-a8fae0e801c9	0	2026-07-17 15:17:02.979184+00
+c800ef28-70ba-4439-8f1d-e5dcec3ce1c6	2026-07-24	brotzeit	a987c96f-25a0-4e5e-b8a8-aab683a01feb	0	2026-07-17 15:17:02.979184+00
+a5c54296-1667-4d5d-a62d-3983e1643959	2026-07-22	mittagessen	14ef6893-93a7-4649-afe3-d6b6bdf5903c	0	2026-07-17 15:17:02.979184+00
+4a06dd6c-7de8-4628-b491-3dafd409f344	2026-07-23	mittagessen	ec3c5e37-9cbc-4c92-ab05-1e3fb942c504	0	2026-07-17 15:17:02.979184+00
+ea9a2936-95bf-4cbd-a013-db7ba995efce	2026-07-20	mittagessen	dbe5ee6e-8b04-4bf7-99bb-f936f6564217	0	2026-07-17 15:17:02.979184+00
+64bc501f-dbcd-474c-b47b-1e99670a3c3e	2026-07-21	mittagessen	c0613fe7-e5c6-489e-afe5-6da2533b2bd4	0	2026-07-17 15:17:02.979184+00
+dd4105b4-76b8-4ea1-8ee0-6db663a1ffa8	2026-07-23	mittagessen_veg	c5cfa5b4-e502-4b56-b579-b9fbbf817f25	0	2026-07-17 15:17:02.979184+00
+bac80cc9-ad0e-4cee-81ae-8aa405cad1b9	2026-07-21	mittagessen_veg	f8ba1844-1f23-4b23-9e03-f59148f8b2ed	0	2026-07-17 15:17:02.979184+00
+62bbb0f9-88e2-4b9f-a7e5-c0dab5ff54c8	2026-07-22	mittagessen_veg	7a6fed05-e0f5-4e97-bdd4-a46c5ef1376a	0	2026-07-17 15:17:02.979184+00
+167e0869-126d-4ab7-8e74-051e5c782865	2026-07-20	mittagessen_veg	ff40ea65-63bc-4d01-b626-e0c9e5d2acb3	0	2026-07-17 15:17:02.979184+00
+34031197-4c3a-4b7e-bc05-7ad7254e8348	2026-07-21	suppe	ea26f18b-ddf3-4899-95e7-5dbd0878d90c	0	2026-07-17 15:17:02.979184+00
+a6f66639-7a0a-4129-bcea-c6ac9cbccac3	2026-07-20	suppe	6222d5f4-05e3-4af4-a41c-3f8b4c9c5c78	0	2026-07-17 15:17:02.979184+00
+b0dbf487-c704-4ab2-af67-082addc88039	2026-07-23	suppe	3c8cf0c2-b0a9-43e3-8233-723d5718a157	0	2026-07-17 15:17:02.979184+00
+d7b5d414-85c2-495a-9945-2ffc10de32ea	2026-07-24	suppe	2dd85835-5425-4271-9fc0-e5215bbce476	0	2026-07-17 15:17:02.979184+00
+7a025e66-44b7-43e7-a51b-5564ab8150b1	2026-07-22	suppe	06df753a-65ed-4bd0-a325-d32c78ec88fa	0	2026-07-17 15:17:02.979184+00
+2eb81b52-3c50-4449-bef9-bb12aac9991e	2026-07-13	brotzeit	6222d5f4-05e3-4af4-a41c-3f8b4c9c5c78	0	2026-07-17 15:43:22.829239+00
+\.
+
+
+ALTER TABLE public.menu_entries ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: profiles; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.profiles DISABLE TRIGGER ALL;
+
+COPY public.profiles (id, email, full_name, role, created_at, password_auth_enabled) FROM stdin;
+cee4160a-ab3a-4109-b706-b9f27d515596	fw@wildeflorian.de	Florian Wilde	admin	2026-07-17 15:17:33.46696+00	t
+6e3ebbd4-a00a-4b08-a799-1a445a3f9eaa	test@test.de	Hans	admin	2026-07-17 16:56:13.331443+00	t
+102d405c-b010-41f6-9409-244004a3c567	kantine@example.com	Kantinen-Team	staff	2026-07-17 15:17:34.233848+00	t
+952b21ad-65a0-4a12-aed1-6c86709e0eb2	kantine@kantine.de	Kantine	staff	2026-07-17 22:02:36.854844+00	t
+\.
+
+
+ALTER TABLE public.profiles ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: settings; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.settings DISABLE TRIGGER ALL;
+
+COPY public.settings (id, colors, logo_path, updated_at, favicon_path) FROM stdin;
+1	{"rowBg": "#e3e4f1", "accent": "#ff6900", "addBtn": "#6da54c", "primary": "#003388", "rowBgAlt": "#f4f4fa", "deleteBtn": "#e2371d", "headerText": "#ffffff", "primaryDark": "#0d315c"}	logo-1784305413466.webp	2026-07-17 22:40:52.997491+00	\N
+\.
+
+
+ALTER TABLE public.settings ENABLE TRIGGER ALL;
+
+--
+-- PostgreSQL database dump complete
+--
+
+\unrestrict y6aLgjBTAX9fiLwtkHEGaN6baJ1dCr2Yjdb6nmrL5LPA6jgf5Ml1Mm0EpXO56Kk
+
@@ -49,7 +49,7 @@ create trigger on_auth_user_created
  after insert on auth.users
  for each row execute function public.handle_new_user();

-- ---------- Bereiche der Speisekarte ----------
+-- ---------- Essenszeiten der Speisekarte ----------
 create table public.sections (
  key        text primary key,
  label      text not null,
@@ -101,7 +101,7 @@ create trigger dishes_touch_updated_at
  before update on public.dishes
  for each row execute function public.touch_updated_at();

-- ---------- Zuweisung Gericht -> Tag/Bereich ----------
+-- ---------- Zuweisung Gericht -> Tag/Essenszeit ----------
 create table public.menu_entries (
  id          uuid primary key default gen_random_uuid(),
  menu_date   date not null,
@@ -0,0 +1,36 @@
+-- =============================================================
+-- Selbstverwaltung des eigenen Kontos (Name, E-Mail-Abgleich)
+-- =============================================================
+
+-- Jeder Benutzer darf seinen eigenen Anzeigenamen ändern. Die Spalte
+-- "role" bleibt geschützt: Rechte werden nicht per RLS eingeschränkt,
+-- sondern per Spalten-Grant – selbst ein manuell gebauter Request mit
+-- {"role": "admin"} im Payload scheitert an fehlenden Rechten auf die
+-- Spalte. Rollenänderungen laufen weiterhin ausschließlich über die
+-- Admin-API mit dem Service-Role-Key.
+revoke update on public.profiles from authenticated;
+grant update (full_name) on public.profiles to authenticated;
+
+create policy "profiles_update_own_name"
+  on public.profiles for update
+  to authenticated
+  using (id = (select auth.uid()))
+  with check (id = (select auth.uid()));
+
+-- Hält profiles.email synchron, sobald eine E-Mail-Änderung in
+-- auth.users bestätigt wurde (supabase.auth.updateUser({ email })).
+create or replace function public.handle_user_email_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  update public.profiles set email = new.email where id = new.id;
+  return new;
+end;
+$$;
+
+create trigger on_auth_user_email_updated
+  after update of email on auth.users
+  for each row execute function public.handle_user_email_change();
@@ -0,0 +1,32 @@
+-- =============================================================
+-- Allergene/Zusatzstoffe pro Gericht, Passwort-Login abschaltbar,
+-- austauschbares Favicon
+-- =============================================================
+
+-- ---------- Allergene/Zusatzstoffe je Gericht ----------
+-- Referenziert Kürzel aus den globalen Listen (allergens/additives),
+-- die weiterhin unterhalb der Speisekarte als Legende dienen.
+alter table public.dishes
+  add column allergens text[] not null default '{}',
+  add column additives text[] not null default '{}';
+
+-- ---------- Passwort-Login pro Benutzer abschaltbar ----------
+alter table public.profiles
+  add column password_auth_enabled boolean not null default true;
+
+-- Selbstverwaltung: Nutzer dürfen zusätzlich zum Namen (Migration 0003)
+-- jetzt auch dieses eine Flag für ihr eigenes Konto setzen. Weiterhin
+-- kein Zugriff auf "role" oder "email" über diesen Weg.
+grant update (password_auth_enabled) on public.profiles to authenticated;
+
+-- Klarerer Name für die inzwischen zwei selbstverwaltbaren Spalten.
+drop policy "profiles_update_own_name" on public.profiles;
+create policy "profiles_update_own"
+  on public.profiles for update
+  to authenticated
+  using (id = (select auth.uid()))
+  with check (id = (select auth.uid()));
+
+-- ---------- Austauschbares Favicon ----------
+alter table public.settings
+  add column favicon_path text;
@@ -0,0 +1,68 @@
+-- =============================================================
+-- Mehrsprachigkeit (Inhalte) + Rezeptvorschläge
+-- =============================================================
+
+-- ---------- Übersetzungsspalten ----------
+-- Nullable: ohne Übersetzung fällt die Anzeige auf den deutschen
+-- Text zurück. Werden manuell oder per DeepL-Anbindung befüllt.
+alter table public.dishes    add column name_en  text, add column name_pl  text;
+alter table public.sections  add column label_en text, add column label_pl text;
+alter table public.allergens add column name_en  text, add column name_pl  text;
+alter table public.additives add column name_en  text, add column name_pl  text;
+
+-- ---------- Referenz-Übersetzungen (feste EU-Kennzeichnung) ----------
+update public.sections set label_en = 'Breakfast',            label_pl = 'Śniadanie'               where key = 'brotzeit';
+update public.sections set label_en = 'Lunch',                label_pl = 'Obiad'                    where key = 'mittagessen';
+update public.sections set label_en = 'Lunch (vegetarian)',   label_pl = 'Obiad (wegetariański)'    where key = 'mittagessen_veg';
+update public.sections set label_en = 'Soup',                 label_pl = 'Zupa'                     where key = 'suppe';
+
+update public.allergens set name_en = 'Cereals containing gluten',      name_pl = 'Zboża zawierające gluten'         where code = 'A';
+update public.allergens set name_en = 'Crustaceans',                    name_pl = 'Skorupiaki'                       where code = 'B';
+update public.allergens set name_en = 'Eggs',                           name_pl = 'Jaja'                             where code = 'C';
+update public.allergens set name_en = 'Fish',                           name_pl = 'Ryby'                             where code = 'D';
+update public.allergens set name_en = 'Peanuts',                        name_pl = 'Orzeszki ziemne'                  where code = 'E';
+update public.allergens set name_en = 'Soybeans',                       name_pl = 'Soja'                             where code = 'F';
+update public.allergens set name_en = 'Milk (including lactose)',       name_pl = 'Mleko (w tym laktoza)'            where code = 'G';
+update public.allergens set name_en = 'Tree nuts',                      name_pl = 'Orzechy'                          where code = 'H';
+update public.allergens set name_en = 'Celery',                         name_pl = 'Seler'                            where code = 'I';
+update public.allergens set name_en = 'Mustard',                        name_pl = 'Gorczyca'                         where code = 'J';
+update public.allergens set name_en = 'Sesame seeds',                   name_pl = 'Nasiona sezamu'                   where code = 'K';
+update public.allergens set name_en = 'Sulphur dioxide and sulphites',  name_pl = 'Dwutlenek siarki i siarczyny'     where code = 'L';
+update public.allergens set name_en = 'Lupin',                          name_pl = 'Łubin'                            where code = 'M';
+update public.allergens set name_en = 'Molluscs',                       name_pl = 'Mięczaki'                         where code = 'N';
+
+update public.additives set name_en = 'with colouring',                 name_pl = 'z barwnikiem'                     where code = '1';
+update public.additives set name_en = 'with preservative',              name_pl = 'z konserwantem'                   where code = '2';
+update public.additives set name_en = 'with antioxidant',               name_pl = 'z przeciwutleniaczem'             where code = '3';
+update public.additives set name_en = 'with flavour enhancer',          name_pl = 'ze wzmacniaczem smaku'            where code = '4';
+update public.additives set name_en = 'sulphured',                      name_pl = 'siarkowany'                       where code = '5';
+update public.additives set name_en = 'blackened',                      name_pl = 'barwiony na czarno'               where code = '6';
+update public.additives set name_en = 'waxed',                          name_pl = 'woskowany'                        where code = '7';
+update public.additives set name_en = 'with phosphate',                 name_pl = 'z fosforanem'                     where code = '8';
+update public.additives set name_en = 'with sweetener(s)',              name_pl = 'ze słodzikiem/słodzikami'         where code = '9';
+update public.additives set name_en = 'contains a source of phenylalanine', name_pl = 'zawiera źródło fenyloalaniny' where code = '10';
+update public.additives set name_en = 'caffeinated',                    name_pl = 'zawiera kofeinę'                  where code = '11';
+
+-- ---------- Rezeptvorschläge ----------
+create table public.dish_suggestions (
+  id          uuid primary key default gen_random_uuid(),
+  name        text not null,
+  description text,
+  created_at  timestamptz not null default now()
+);
+
+alter table public.dish_suggestions enable row level security;
+
+-- Jeder darf einen Vorschlag einreichen, aber niemand außer dem
+-- Kantinen-Team darf die Liste einsehen (kein Lesezugriff für anon).
+create policy "dish_suggestions_public_insert" on public.dish_suggestions
+  for insert to anon, authenticated
+  with check (true);
+
+create policy "dish_suggestions_staff_select" on public.dish_suggestions
+  for select to authenticated
+  using (public.app_role() in ('staff', 'admin'));
+
+create policy "dish_suggestions_staff_delete" on public.dish_suggestions
+  for delete to authenticated
+  using (public.app_role() in ('staff', 'admin'));
@@ -0,0 +1,25 @@
+-- =============================================================
+-- Essenszeiten (Brotzeit/Mittagessen/…) vollständig verwaltbar machen:
+-- anlegen, umbenennen, Uhrzeit ändern, löschen.
+-- =============================================================
+
+-- Neue Essenszeiten bekommen einen automatisch generierten Schlüssel
+-- (wie bei dishes.id) statt eines von Hand vergebenen Slugs.
+alter table public.sections
+  alter column key set default (gen_random_uuid())::text;
+
+-- Löscht man eine Essenszeit, werden ihre Wochenplan-Einträge mit
+-- entfernt (analog zu menu_entries_dish_id_fkey bei Gerichten) statt
+-- die Löschung zu blockieren.
+alter table public.menu_entries
+  drop constraint menu_entries_section_key_fkey;
+alter table public.menu_entries
+  add constraint menu_entries_section_key_fkey
+  foreign key (section_key) references public.sections(key) on delete cascade;
+
+-- Bisher gab es nur eine Lesepolicy für sections; jetzt dürfen
+-- Kantinenmitarbeiter/Admins Essenszeiten auch anlegen/ändern/löschen.
+create policy "sections_staff_write" on public.sections
+  for all to authenticated
+  using (public.app_role() in ('staff', 'admin'))
+  with check (public.app_role() in ('staff', 'admin'));
Author	SHA1	Message	Date
florian.wilde	4c5376a8c7	Merge feature/v1.4: Essenszeiten variabel, DeepL-Button-Sichtbarkeit, Bugfix mobiler Sprachumschalter	2026-07-18 08:33:25 +02:00
florian.wilde	0a1f533880	Changelog: Hinweis auf noch offenen Merge für 1.4.0 entfernt	2026-07-18 08:33:17 +02:00
florian.wilde	4d5e7fca04	Bug: Sprachumschalter in mobiler Ansicht doppelt Der Kopfbereich der öffentlichen Speisekarte zeigte seinen eigenen LanguageSwitcher auch auf schmalen Bildschirmen an, obwohl PublicMobileMenu dort bereits einen eigenen rendert. Der Header-Switcher ist jetzt wie der Rest des Desktop-Layouts erst ab dem sm-Breakpoint sichtbar.	2026-07-18 08:30:20 +02:00
florian.wilde	0f20ad6527	"Bereiche" zu "Essenszeiten" umbenannt Betrifft UI-Texte (DE/EN/PL), Route (/intern/bereiche -> /intern/essenszeiten), Code-Kommentare, Changelog und README. Fachlich unverändert (weiterhin die Tabelle/Komponente "sections"/ SectionManager im Code), da "Essenszeiten" den Zeitbezug des Features klarer ausdrückt als der bisherige Sammelbegriff.	2026-07-18 08:26:15 +02:00
florian.wilde	d85d2e3fe3	Version 1.4.0	2026-07-18 08:15:31 +02:00
florian.wilde	a80cd5bd12	Lokale PostgreSQL-Kopie: Dump nach Migration 0006 aktualisiert	2026-07-18 08:15:20 +02:00
florian.wilde	51fdb93e97	Automatisch-übersetzen-Button nur bei konfiguriertem DEEPL_API_KEY Statt den Button immer anzuzeigen und erst nach Klick auf die fehlende Konfiguration hinzuweisen, wird er serverseitig anhand von process.env.DEEPL_API_KEY ein-/ausgeblendet (Gerichte, Allergene, Zusatzstoffe). Die dadurch überflüssige "translateUnavailable"- Meldung wurde aus allen drei Sprachen entfernt.	2026-07-18 08:14:49 +02:00
florian.wilde	868a5d2fcf	Bereiche vollständig verwaltbar (anlegen/bearbeiten/löschen/Uhrzeit) Migration 0006: sections.key bekommt einen automatisch generierten Schlüssel (wie dishes.id), menu_entries.section_key kaskadiert beim Löschen eines Bereichs, neue RLS-Policy erlaubt Kantinenmitarbeitern/ Admins Schreibzugriff auf sections. Neue Seite „Bereiche" im Kantinen-Bereich (SectionManager): Bereiche anlegen, umbenennen (inkl. EN/PL), Uhrzeit setzen, löschen und per Pfeil-Buttons neu anordnen.	2026-07-18 08:14:32 +02:00
florian.wilde	8b98294998	Merge feature/v1.3: Mehrsprachigkeit (DE/EN/PL), Rezeptvorschläge, Bugfixes - Mehrsprachige Oberfläche mit Sprachumschalter (Cookie-basiert) - Gerichte/Bereiche/Allergene/Zusatzstoffe mit EN/PL-Namen, automatische Übersetzung über DeepL (optional, DEEPL_API_KEY) mit manueller Korrekturmöglichkeit - Rezeptvorschläge: öffentliches Formular mit Dubletten-Check und Honeypot-Spamschutz, Sichtung/Übernahme im Kantinen-Bereich - Fix: Passwort-wiederholen-Feld beim Bearbeiten erschien erst nach Tippen im ersten Feld - Fix: Anmelden-Button überlappte auf Mobilgeräten mit breiten Logos Version 1.3.0	2026-07-18 02:12:23 +02:00
florian.wilde	a5b68d577d	Version 1.3.0	2026-07-18 02:08:04 +02:00
florian.wilde	babc55e781	Rezeptvorschläge: öffentliches Formular + Sichtung im Kantinen-Bereich Nicht angemeldete Besucher können unter /vorschlag ein fehlendes Gericht vorschlagen (Name + optionale Beschreibung); Dublettenprüfung gegen bestehende Gerichte, einfacher Honeypot gegen Bot-Spam. Staff/ Admin sichten eingereichte Vorschläge unter /intern/vorschlaege und übernehmen sie als Gericht oder lehnen sie ab.	2026-07-18 02:08:03 +02:00
florian.wilde	a6165de10c	Mehrsprachige Oberfläche + lokalisierte Gericht-/Bereichsnamen Alle Seiten und Komponenten (öffentliche Speisekarte, Login, Kantinen- und Admin-Bereich, eigenes Konto) verwenden jetzt die Wörterbücher aus lib/i18n statt fest codierter deutscher Texte. Gerichte/Bereiche/ Allergene/Zusatzstoffe zeigen den Namen zur aktuell gewählten Sprache; Gerichte- und Kennzeichnungs-Formulare bekommen Englisch-/Polnisch- Felder mit Übersetzen-Button (siehe vorherigen Commit). Datumsformat- ierung (formatDateLong) nimmt jetzt ein locale-Argument statt fix 'de-DE'.	2026-07-18 02:08:03 +02:00
florian.wilde	30a02ba7b7	DeepL-Anbindung für automatische Übersetzung app/api/translate ruft DeepL für EN+PL auf und schreibt das Ergebnis in die jeweilige _en/_pl-Spalte (Staff/Admin-only, Service-Role-Key). Ohne DEEPL_API_KEY (neue Docker-Variable) antwortet die Route mit configured:false, das Frontend zeigt dann den Hinweis zur manuellen Eingabe statt eines Fehlers.	2026-07-18 02:08:02 +02:00
florian.wilde	1cc19de221	Migration: Übersetzungsspalten für Inhalte + Rezeptvorschläge-Tabelle dishes/sections/allergens/additives bekommen _en/_pl-Spalten; die 14 EU-Allergene, 11 Zusatzstoff-Kennzeichnungen und 4 Bereiche sind direkt mit Referenz-Übersetzungen befüllt. localized() liefert den Text zur aktuellen Sprache mit Fallback auf Deutsch. Neue Tabelle dish_suggestions (RLS: jeder darf einreichen, nur Staff/Admin lesen). Lokale PostgreSQL-Kopie auf den neuen Stand gebracht.	2026-07-18 02:08:01 +02:00
florian.wilde	33909c660b	i18n-Fundament: Cookie-basierte Sprachumschaltung (DE/EN/PL) Wörterbücher unter lib/i18n statt next-intl (Next.js 16 ist neu genug, dass eine externe Routing-Middleware zusätzliches Risiko bedeutet hätte); Sprache liegt in einem Cookie, kein URL-Präfix nötig, dadurch bleibt proxy.ts unverändert. LocaleProvider stellt Wörterbuch + Sprache per Context für Client-Komponenten bereit (lib/i18n/shared.ts ist bewusst getrennt von lib/i18n/index.ts, damit next/headers nicht in den Client-Bundle gelangt).	2026-07-18 02:08:01 +02:00
florian.wilde	d96faad4d5	Changelog: 1.3.0 vorbereiten (geplante Features, bereits behobene Bugs)	2026-07-18 01:29:57 +02:00
florian.wilde	0c4fad9649	Fix: Anmelden-Button überlappte auf Mobilgeräten mit breitem Logo Absolute Positionierung im Header kollidierte mit Logos in breitem Seitenverhältnis (z. B. Banner-Format), da das Logo bei h-20 nahezu bildschirmbreit gerendert wird. Anmelden-Link steht jetzt auf eigener Zeile über dem Logo statt absolut positioniert in der oberen Ecke.	2026-07-18 01:29:27 +02:00
florian.wilde	5c9df6e33b	Fix: Passwort-wiederholen-Feld beim Bearbeiten erst nach Tippen sichtbar Feld war beim Bearbeiten an form.password gebunden und erschien erst, nachdem im ersten Feld schon getippt wurde – wirkte, als reiche ein einziges Passwortfeld. Jetzt immer sichtbar, Pflicht bleibt weiterhin nur, wenn tatsächlich ein neues Passwort gesetzt wird.	2026-07-18 01:29:27 +02:00
florian.wilde	bb6093dbfe	Changelog hinzufügen	2026-07-18 00:49:01 +02:00
florian.wilde	088df8a26b	Version 1.2.0 Versionsnummer und README auf den aktuellen Funktionsstand gebracht.	2026-07-18 00:46:41 +02:00
florian.wilde	39181be3fb	SITE_TITLE per Docker-Variable, Favicon im Admin-Bereich austauschbar - SITE_TITLE (Default "Canteen Menu") steuert Browser-Tab-Titel und H1-Fallback ohne Logo - Favicon-Upload analog zum Logo über den Design-Bereich (Storage- Bucket branding); generateMetadata setzt icons.icon jetzt immer explizit, da Next.js sonst app/favicon.ico zusätzlich einbindet – die Datei liegt daher als expliziter Fallback unter public/	2026-07-18 00:46:41 +02:00
florian.wilde	72459d8da5	Konto: Passwort-Anmeldung pro Nutzer deaktivierbar Schalter im eigenen Konto, erzwingt vorher mindestens einen registrierten Passkey (sonst Aussperrung). Durchsetzung beim Login: nach erfolgreicher Passwort-Prüfung wird bei deaktiviertem Flag sofort wieder abgemeldet; Passkey-Anmeldung bleibt davon unberührt.	2026-07-18 00:46:40 +02:00
florian.wilde	00745ae48b	Benutzerverwaltung: Passwort-Wiederholung gegen Tippfehler Gilt beim Anlegen (Pflicht) und beim optionalen Passwort-Reset im Bearbeiten-Formular.	2026-07-18 00:46:39 +02:00
florian.wilde	675503e1f4	Allergene/Zusatzstoffe je Gericht auswählbar, klein angezeigt Chip-Auswahl im Gericht-Formular (Klick zum An-/Abwählen) statt Checkbox-Liste; Kürzel erscheinen hochgestellt neben dem Gerichtnamen in Speisekarte, mobiler Ansicht und Wochenplan-Editor. Editor bekommt außerdem einen Heute-Button.	2026-07-18 00:46:39 +02:00
florian.wilde	1db89a54bf	Öffentliche Speisekarte: Heute-Button, mobile Tages-/Wochenansicht - "Heute" springt direkt zur aktuellen Woche - Unter dem sm-Breakpoint umschaltbar zwischen Tag (Standard) und Woche statt der Tabelle; Desktop bleibt vollständig serverseitig gerendert, nur der mobile Umschalter ist eine Client-Komponente	2026-07-18 00:46:39 +02:00
florian.wilde	29ca8e1227	Migration: Allergene/Zusatzstoffe je Gericht, abschaltbarer Passwort-Login, Favicon - dishes.allergens/additives (text[]): Kennzeichnung wieder pro Gericht statt nur global, referenziert weiterhin die globalen Listen - profiles.password_auth_enabled: Nutzer können die eigene Passwort-Anmeldung deaktivieren; Spalten-Grant + neue Policy "profiles_update_own" (ersetzt profiles_update_own_name) - settings.favicon_path fürs austauschbare Favicon - Lokale PostgreSQL-Kopie (Docker + nativ) auf den neuen Stand gebracht	2026-07-18 00:46:38 +02:00
florian.wilde	4e4abed0ca	Version 1.1.0 mit Anzeige im Fußbereich Versionsnummer aus package.json wird auf jeder Seite unten rechts dezent eingeblendet.	2026-07-17 23:53:13 +02:00
florian.wilde	bfd32d1aa7	Konfigurierbare öffentliche URL (APP_URL) inkl. Passkey-Anbindung - Neue Umgebungsvariable APP_URL (docker-compose reicht sie durch, Default http://localhost:3000): gilt beim CSRF-Origin-Check als eigene Origin, falls ein Reverse-Proxy den Host-Header umschreibt - scripts/configure-passkeys.mjs setzt die Passkey-Domain (WebAuthn rp_id/origins) des Supabase-Projekts auf APP_URL – ein Befehl statt manueller Dashboard-Konfiguration beim Domain-Wechsel	2026-07-17 23:53:13 +02:00
florian.wilde	32594c2dd8	Fix: Weiterleitungen übernehmen nicht mehr die Server-Bindung 0.0.0.0 Nach dem Abmelden landete man auf 0.0.0.0:3000, weil die absolute Redirect-URL aus request.url gebaut wurde und dort seit der Bindung an 0.0.0.0 die Server-Adresse statt des aufgerufenen Hosts steht. Logout leitet jetzt relativ weiter; der Proxy baut die URL aus dem Host-Header des Browsers (inkl. x-forwarded-proto hinter Proxies).	2026-07-17 23:53:12 +02:00
florian.wilde	5c7112ecd2	Gerichte: Live-Suche Filtert die Liste bereits während des Tippens (Name, ohne Groß-/ Kleinschreibung). "Alle auswählen" bezieht sich auf die gefilterte Liste, Treffer-Hinweis bei leerem Ergebnis.	2026-07-17 23:53:12 +02:00
florian.wilde	2a62d07dc4	Navigation: gemeinsamer Kopfbereich statt getrennter Bereiche Eine Leiste für alles: Gruppe "Speiseplan" (Wochenplan, Gerichte, Allergene & Zusatzstoffe) und für Admins zusätzlich Gruppe "Verwaltung" (Benutzer, Design). Aktiver Menüpunkt wird hervorgehoben, die Konto-Seite nutzt denselben Header – kein Hin- und Herspringen mehr zwischen Kantinen-Bereich und Verwaltung.	2026-07-17 23:53:11 +02:00
florian.wilde	0dbf89dfa2	Erreichbarkeit auf 0.0.0.0; Projekt zu "canteen-menu" umbenannt - next dev/start binden jetzt explizit an 0.0.0.0 statt nur localhost (Docker war über die Port-Freigabe bereits erreichbar, jetzt auch beim nativen npm-Betrieb); docker-compose.yml macht das Binden an alle Interfaces zusätzlich explizit - package.json-Name, Docker-Image/Container/Netzwerk-Namen, lokaler DB-Name (canteen_menu), Browser-Tab-Titel und README auf den englischen Projektnamen "canteen-menu" umgestellt; deutsche In-App-Texte für die Kantinen-Mitarbeiter bleiben unverändert - Supabase-Projekt (Anzeigename) und native lokale Postgres-DB entsprechend umbenannt (Ref/URL/Keys unverändert)	2026-07-17 20:07:53 +02:00
florian.wilde	41a6508b89	Gerichte: Mehrfachauswahl zum Batch-Löschen Checkbox je Zeile plus "Alle auswählen"; "Ausgewählte löschen (n)" löscht alle markierten Gerichte in einem einzigen delete().in()-Request.	2026-07-17 20:07:53 +02:00
florian.wilde	d59b20d4ba	Lokale DB-Kopie: Schema-Dump auf Migration 0003 aktualisieren	2026-07-17 19:16:53 +02:00
florian.wilde	7d08e6fd81	Konto-Seite: eigenen Namen, E-Mail, Passwort und Passkeys selbst verwalten - Klick auf den Benutzernamen im Header (Kantinen- und Admin-Bereich) öffnet /konto - Name-Änderung per RLS-Policy mit spaltenscharfem Grant (nur full_name), Rolle bleibt ausschließlich über die Admin-API änderbar - E-Mail-Änderung über supabase.auth.updateUser mit Bestätigungslink; Trigger synchronisiert profiles.email nach Bestätigung - Passwortänderung verlangt zur Verifizierung das aktuelle Passwort (Re-Login-Check) plus Wiederholung des neuen Passworts - Passkey-Verwaltung aus /intern/konto hierher verschoben	2026-07-17 19:15:09 +02:00
florian.wilde	902725acae	Docker: Compose-Projektnamen fest auf "speisekarte" setzen Ohne explizite Angabe leitet Compose den Projektnamen aus dem Ordnernamen ab und wirft dabei das "ß" ersatzlos weg (Images/ Container hießen "speiekarte-*"). name+image+container_name fixieren das auf "speisekarte-app"/"speisekarte-db"/"speisekarte-dev".	2026-07-17 19:15:09 +02:00
florian.wilde	b499708a8f	Docker-Fix: DB-Init bricht bei CREATE SCHEMA public nicht mehr ab, Port 5433 statt 5432	2026-07-17 18:52:49 +02:00
florian.wilde	8dd6ba236e	Docker-Setup: App-Image (standalone), PostgreSQL-Dienst mit Auto-Import, Dev-Profil	2026-07-17 18:26:36 +02:00
florian.wilde	7cac8cd4fc	Sicherheit: HTTP-Security-Header und Origin-Prüfung für schreibende Routen - X-Frame-Options/CSP frame-ancestors gegen Clickjacking, nosniff, Referrer-Policy, Permissions-Policy - Origin-Check als CSRF-Defense-in-Depth für /api/admin/users und /logout (zusätzlich zu SameSite=Lax-Cookies und JSON-Content-Type)	2026-07-17 18:21:22 +02:00
florian.wilde	fbd4659346	Doku und Tooling: README, .env-Vorlage, Launch-Konfiguration	2026-07-17 18:18:45 +02:00
florian.wilde	b1e41026b6	Lokale PostgreSQL-Kopie: Auth/Storage-Stubs, Dumps und Sync-Skript	2026-07-17 18:18:44 +02:00
florian.wilde	8a393dce1a	Admin-Bereich: Benutzerverwaltung (Service-Role, serverseitig), Farben und Logo-Upload	2026-07-17 18:18:43 +02:00
florian.wilde	76f90d519c	Kantinen-Bereich: Wochenplan-Editor, Gerichte, Kennzeichnungen, Passkey-Verwaltung	2026-07-17 18:18:41 +02:00
florian.wilde	d2bb39d815	Auth: Login mit E-Mail/Passwort und Passkey, Logout	2026-07-17 18:18:34 +02:00
florian.wilde	7e31dce237	Öffentliche Speisekarte: Wochenansicht, konfigurierbare Farben, Allergen-Legende	2026-07-17 18:18:27 +02:00
florian.wilde	74ce663813	Supabase-Clients (Browser/Server/Admin), Session-Proxy und Basis-Typen	2026-07-17 18:18:19 +02:00