diff --git a/web-server/.env.example b/web-server/.env.example
new file mode 100644
index 0000000..5ff4158
--- /dev/null
+++ b/web-server/.env.example
@@ -0,0 +1,20 @@
+PORT=3000
+SQLSERVER_HOST=172.20.235.176
+SQLSERVER_PORT=1433
+SQLSERVER_DATABASE=RobotInstaller
+SQLSERVER_USER=sa
+SQLSERVER_PASSWORD=change_me
+SQLSERVER_ENCRYPT=false
+SQLSERVER_TRUST_SERVER_CERTIFICATE=true
+AUTH_SECRET=change_this_to_a_long_random_value
+SESSION_MAX_AGE_MS=28800000
+EMAIL_CONFIRMATION_EXPIRES_MS=86400000
+APP_BASE_URL=http://localhost:3000
+
+# Mail chính dùng để gửi email xác nhận tới các tài khoản đăng ký
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=main_sender_email@gmail.com
+SMTP_PASSWORD=main_sender_app_password
+MAIL_FROM="Robot Installer <main_sender_email@gmail.com>"
diff --git a/web-server/.gitignore b/web-server/.gitignore
new file mode 100644
index 0000000..25262c9
--- /dev/null
+++ b/web-server/.gitignore
@@ -0,0 +1,9 @@
+node_modules/
+.env
+uploads/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+*.log
+.DS_Store
diff --git a/web-server/database/01_create_database.sql b/web-server/database/01_create_database.sql
new file mode 100644
index 0000000..dd0c286
--- /dev/null
+++ b/web-server/database/01_create_database.sql
@@ -0,0 +1,11 @@
+IF DB_ID(N'RobotInstaller') IS NULL
+BEGIN
+    CREATE DATABASE [RobotInstaller];
+END;
+GO
+
+USE [RobotInstaller];
+GO
+
+PRINT N'Database RobotInstaller is ready.';
+GO
diff --git a/web-server/database/02_schema.sql b/web-server/database/02_schema.sql
new file mode 100644
index 0000000..707a19c
--- /dev/null
+++ b/web-server/database/02_schema.sql
@@ -0,0 +1,291 @@
+USE [RobotInstaller];
+GO
+
+SET ANSI_NULLS ON;
+SET QUOTED_IDENTIFIER ON;
+GO
+
+IF OBJECT_ID(N'dbo.ApplicationPackages', N'U') IS NOT NULL
+    OR OBJECT_ID(N'dbo.PackageVersions', N'U') IS NOT NULL
+    OR OBJECT_ID(N'dbo.Applications', N'U') IS NOT NULL
+    OR OBJECT_ID(N'dbo.Packages', N'U') IS NOT NULL
+    OR OBJECT_ID(N'dbo.EmailConfirmationTokens', N'U') IS NOT NULL
+    OR OBJECT_ID(N'dbo.Users', N'U') IS NOT NULL
+BEGIN
+    THROW 50001, 'Schema tables already exist. Review, drop, or migrate existing tables before running 02_schema.sql.', 1;
+END;
+GO
+
+CREATE TABLE dbo.Users
+(
+    Id UNIQUEIDENTIFIER NOT NULL
+        CONSTRAINT PK_Users PRIMARY KEY CLUSTERED
+        CONSTRAINT DF_Users_Id DEFAULT NEWSEQUENTIALID(),
+    Username NVARCHAR(100) NOT NULL,
+    Email NVARCHAR(255) NOT NULL,
+    PasswordHash NVARCHAR(500) NOT NULL,
+    FullName NVARCHAR(200) NULL,
+    Role NVARCHAR(50) NOT NULL
+        CONSTRAINT DF_Users_Role DEFAULT N'User',
+    IsActive BIT NOT NULL
+        CONSTRAINT DF_Users_IsActive DEFAULT 1,
+    CreatedAt DATETIME2(3) NOT NULL
+        CONSTRAINT DF_Users_CreatedAt DEFAULT SYSUTCDATETIME(),
+    UpdatedAt DATETIME2(3) NULL,
+    CONSTRAINT CK_Users_Role CHECK (Role IN (N'Admin', N'User')),
+    CONSTRAINT CK_Users_Username_NotBlank CHECK (LEN(LTRIM(RTRIM(Username))) > 0),
+    CONSTRAINT CK_Users_Email_NotBlank CHECK (LEN(LTRIM(RTRIM(Email))) > 0)
+);
+GO
+
+CREATE TABLE dbo.EmailConfirmationTokens
+(
+    Id UNIQUEIDENTIFIER NOT NULL
+        CONSTRAINT PK_EmailConfirmationTokens PRIMARY KEY CLUSTERED
+        CONSTRAINT DF_EmailConfirmationTokens_Id DEFAULT NEWSEQUENTIALID(),
+    UserId UNIQUEIDENTIFIER NOT NULL,
+    TokenHash CHAR(64) NOT NULL,
+    ExpiresAt DATETIME2(3) NOT NULL,
+    ConfirmedAt DATETIME2(3) NULL,
+    CreatedAt DATETIME2(3) NOT NULL
+        CONSTRAINT DF_EmailConfirmationTokens_CreatedAt DEFAULT SYSUTCDATETIME(),
+    CONSTRAINT FK_EmailConfirmationTokens_User
+        FOREIGN KEY (UserId) REFERENCES dbo.Users(Id) ON DELETE CASCADE
+);
+GO
+
+CREATE TABLE dbo.Packages
+(
+    Id UNIQUEIDENTIFIER NOT NULL
+        CONSTRAINT PK_Packages PRIMARY KEY CLUSTERED
+        CONSTRAINT DF_Packages_Id DEFAULT NEWSEQUENTIALID(),
+    PackageCode NVARCHAR(100) NOT NULL,
+    PackageName NVARCHAR(200) NOT NULL,
+    PackageType NVARCHAR(20) NOT NULL,
+    Description NVARCHAR(MAX) NULL,
+    CreatedByUserId UNIQUEIDENTIFIER NOT NULL,
+    CreatedAt DATETIME2(3) NOT NULL
+        CONSTRAINT DF_Packages_CreatedAt DEFAULT SYSUTCDATETIME(),
+    UpdatedAt DATETIME2(3) NULL,
+    IsActive BIT NOT NULL
+        CONSTRAINT DF_Packages_IsActive DEFAULT 1,
+    CONSTRAINT FK_Packages_CreatedByUser
+        FOREIGN KEY (CreatedByUserId) REFERENCES dbo.Users(Id),
+    CONSTRAINT CK_Packages_PackageType CHECK (PackageType IN (N'deb', N'docker')),
+    CONSTRAINT CK_Packages_PackageCode_NotBlank CHECK (LEN(LTRIM(RTRIM(PackageCode))) > 0),
+    CONSTRAINT CK_Packages_PackageName_NotBlank CHECK (LEN(LTRIM(RTRIM(PackageName))) > 0)
+);
+GO
+
+CREATE TABLE dbo.PackageVersions
+(
+    Id UNIQUEIDENTIFIER NOT NULL
+        CONSTRAINT PK_PackageVersions PRIMARY KEY CLUSTERED
+        CONSTRAINT DF_PackageVersions_Id DEFAULT NEWSEQUENTIALID(),
+    PackageId UNIQUEIDENTIFIER NOT NULL,
+    Version NVARCHAR(50) NOT NULL,
+    FilePath NVARCHAR(1000) NULL,
+    DockerImage NVARCHAR(500) NULL,
+    FileChecksumSha256 CHAR(64) NULL,
+    FileSizeBytes BIGINT NULL,
+    ChangeLog NVARCHAR(MAX) NULL,
+    ReleaseDate DATETIME2(3) NOT NULL
+        CONSTRAINT DF_PackageVersions_ReleaseDate DEFAULT SYSUTCDATETIME(),
+    UploadedAt DATETIME2(3) NOT NULL
+        CONSTRAINT DF_PackageVersions_UploadedAt DEFAULT SYSUTCDATETIME(),
+    IsLatest BIT NOT NULL
+        CONSTRAINT DF_PackageVersions_IsLatest DEFAULT 0,
+    IsDeprecated BIT NOT NULL
+        CONSTRAINT DF_PackageVersions_IsDeprecated DEFAULT 0,
+    CONSTRAINT FK_PackageVersions_Package
+        FOREIGN KEY (PackageId) REFERENCES dbo.Packages(Id) ON DELETE CASCADE,
+    CONSTRAINT CK_PackageVersions_Version_NotBlank CHECK (LEN(LTRIM(RTRIM(Version))) > 0),
+    CONSTRAINT CK_PackageVersions_FileSizeBytes CHECK (FileSizeBytes IS NULL OR FileSizeBytes >= 0),
+    CONSTRAINT CK_PackageVersions_FileChecksumSha256 CHECK (
+        FileChecksumSha256 IS NULL
+        OR FileChecksumSha256 NOT LIKE '%[^0-9A-Fa-f]%'
+    )
+);
+GO
+
+CREATE TABLE dbo.Applications
+(
+    Id UNIQUEIDENTIFIER NOT NULL
+        CONSTRAINT PK_Applications PRIMARY KEY CLUSTERED
+        CONSTRAINT DF_Applications_Id DEFAULT NEWSEQUENTIALID(),
+    AppCode NVARCHAR(100) NOT NULL,
+    AppName NVARCHAR(200) NOT NULL,
+    AppVersion NVARCHAR(50) NOT NULL
+        CONSTRAINT DF_Applications_AppVersion DEFAULT N'1.0.0',
+    Description NVARCHAR(MAX) NULL,
+    CreatedByUserId UNIQUEIDENTIFIER NOT NULL,
+    CreatedAt DATETIME2(3) NOT NULL
+        CONSTRAINT DF_Applications_CreatedAt DEFAULT SYSUTCDATETIME(),
+    UpdatedAt DATETIME2(3) NULL,
+    Status NVARCHAR(50) NOT NULL
+        CONSTRAINT DF_Applications_Status DEFAULT N'Draft',
+    Notes NVARCHAR(500) NULL,
+    CONSTRAINT FK_Applications_CreatedByUser
+        FOREIGN KEY (CreatedByUserId) REFERENCES dbo.Users(Id),
+    CONSTRAINT CK_Applications_Status CHECK (Status IN (N'Draft', N'Released', N'Archived')),
+    CONSTRAINT CK_Applications_AppCode_NotBlank CHECK (LEN(LTRIM(RTRIM(AppCode))) > 0),
+    CONSTRAINT CK_Applications_AppName_NotBlank CHECK (LEN(LTRIM(RTRIM(AppName))) > 0),
+    CONSTRAINT CK_Applications_AppVersion_NotBlank CHECK (LEN(LTRIM(RTRIM(AppVersion))) > 0)
+);
+GO
+
+CREATE TABLE dbo.ApplicationPackages
+(
+    Id UNIQUEIDENTIFIER NOT NULL
+        CONSTRAINT PK_ApplicationPackages PRIMARY KEY CLUSTERED
+        CONSTRAINT DF_ApplicationPackages_Id DEFAULT NEWSEQUENTIALID(),
+    ApplicationId UNIQUEIDENTIFIER NOT NULL,
+    PackageId UNIQUEIDENTIFIER NOT NULL,
+    SelectedVersionId UNIQUEIDENTIFIER NULL,
+    AddedAt DATETIME2(3) NOT NULL
+        CONSTRAINT DF_ApplicationPackages_AddedAt DEFAULT SYSUTCDATETIME(),
+    Notes NVARCHAR(500) NULL,
+    CONSTRAINT FK_ApplicationPackages_Application
+        FOREIGN KEY (ApplicationId) REFERENCES dbo.Applications(Id) ON DELETE CASCADE,
+    CONSTRAINT FK_ApplicationPackages_Package
+        FOREIGN KEY (PackageId) REFERENCES dbo.Packages(Id) ON DELETE CASCADE
+);
+GO
+
+CREATE UNIQUE INDEX UX_Users_Username ON dbo.Users(Username);
+CREATE UNIQUE INDEX UX_Users_Email ON dbo.Users(Email);
+GO
+
+CREATE UNIQUE INDEX UX_EmailConfirmationTokens_TokenHash
+ON dbo.EmailConfirmationTokens(TokenHash);
+
+CREATE INDEX IX_EmailConfirmationTokens_UserId
+ON dbo.EmailConfirmationTokens(UserId);
+GO
+
+CREATE UNIQUE INDEX UX_Packages_PackageCode ON dbo.Packages(PackageCode);
+CREATE INDEX IX_Packages_CreatedByUserId ON dbo.Packages(CreatedByUserId);
+CREATE INDEX IX_Packages_PackageType ON dbo.Packages(PackageType);
+GO
+
+CREATE UNIQUE INDEX UX_PackageVersions_PackageId_Version
+ON dbo.PackageVersions(PackageId, Version);
+
+CREATE UNIQUE INDEX UX_PackageVersions_Id_PackageId
+ON dbo.PackageVersions(Id, PackageId);
+
+CREATE UNIQUE INDEX UX_PackageVersions_OneLatestPerPackage
+ON dbo.PackageVersions(PackageId)
+WHERE IsLatest = 1;
+
+CREATE INDEX IX_PackageVersions_PackageId_ReleaseDate
+ON dbo.PackageVersions(PackageId, ReleaseDate DESC);
+GO
+
+CREATE UNIQUE INDEX UX_Applications_AppCode
+ON dbo.Applications(AppCode);
+
+CREATE INDEX IX_Applications_CreatedByUserId ON dbo.Applications(CreatedByUserId);
+CREATE INDEX IX_Applications_Status ON dbo.Applications(Status);
+GO
+
+CREATE UNIQUE INDEX UX_ApplicationPackages_ApplicationId_PackageId
+ON dbo.ApplicationPackages(ApplicationId, PackageId);
+
+CREATE INDEX IX_ApplicationPackages_PackageId
+ON dbo.ApplicationPackages(PackageId);
+
+CREATE INDEX IX_ApplicationPackages_SelectedVersionId
+ON dbo.ApplicationPackages(SelectedVersionId);
+GO
+
+ALTER TABLE dbo.ApplicationPackages
+ADD CONSTRAINT FK_ApplicationPackages_SelectedVersionBelongsToPackage
+    FOREIGN KEY (SelectedVersionId, PackageId)
+    REFERENCES dbo.PackageVersions(Id, PackageId);
+GO
+
+CREATE OR ALTER PROCEDURE dbo.SetLatestPackageVersion
+    @PackageVersionId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON;
+    SET XACT_ABORT ON;
+
+    DECLARE @PackageId UNIQUEIDENTIFIER;
+
+    SELECT @PackageId = PackageId
+    FROM dbo.PackageVersions
+    WHERE Id = @PackageVersionId;
+
+    IF @PackageId IS NULL
+    BEGIN
+        THROW 50002, 'Package version does not exist.', 1;
+    END;
+
+    BEGIN TRANSACTION;
+
+    UPDATE dbo.PackageVersions
+    SET IsLatest = 0
+    WHERE PackageId = @PackageId;
+
+    UPDATE dbo.PackageVersions
+    SET IsLatest = 1,
+        IsDeprecated = 0
+    WHERE Id = @PackageVersionId;
+
+    COMMIT TRANSACTION;
+END;
+GO
+
+CREATE OR ALTER PROCEDURE dbo.DeletePackageVersion
+    @PackageVersionId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON;
+    SET XACT_ABORT ON;
+
+    DECLARE @PackageId UNIQUEIDENTIFIER;
+    DECLARE @WasLatest BIT;
+
+    SELECT
+        @PackageId = PackageId,
+        @WasLatest = IsLatest
+    FROM dbo.PackageVersions
+    WHERE Id = @PackageVersionId;
+
+    IF @PackageId IS NULL
+    BEGIN
+        THROW 50003, 'Package version does not exist.', 1;
+    END;
+
+    BEGIN TRANSACTION;
+
+    DELETE FROM dbo.ApplicationPackages
+    WHERE SelectedVersionId = @PackageVersionId;
+
+    DELETE FROM dbo.PackageVersions
+    WHERE Id = @PackageVersionId;
+
+    IF @WasLatest = 1
+    BEGIN
+        DECLARE @NextLatestId UNIQUEIDENTIFIER;
+
+        SELECT TOP (1) @NextLatestId = Id
+        FROM dbo.PackageVersions
+        WHERE PackageId = @PackageId
+          AND IsDeprecated = 0
+        ORDER BY ReleaseDate DESC, UploadedAt DESC;
+
+        IF @NextLatestId IS NOT NULL
+        BEGIN
+            EXEC dbo.SetLatestPackageVersion @NextLatestId;
+        END;
+    END;
+
+    COMMIT TRANSACTION;
+END;
+GO
+
+PRINT N'RobotInstaller schema was created successfully.';
+GO
diff --git a/web-server/database/03_views.sql b/web-server/database/03_views.sql
new file mode 100644
index 0000000..ba50af1
--- /dev/null
+++ b/web-server/database/03_views.sql
@@ -0,0 +1,131 @@
+USE [RobotInstaller];
+GO
+
+CREATE OR ALTER VIEW dbo.vw_PackageList
+AS
+SELECT
+    p.Id,
+    p.PackageCode,
+    p.PackageName,
+    p.PackageType,
+    p.Description,
+    p.IsActive,
+    p.CreatedAt,
+    p.UpdatedAt,
+    p.CreatedByUserId,
+    u.Username AS CreatedByUsername,
+    latest.Id AS LatestVersionId,
+    latest.Version AS LatestVersion,
+    latest.ReleaseDate AS LatestReleaseDate,
+    latest.FilePath AS LatestFilePath,
+    latest.DockerImage AS LatestDockerImage,
+    version_count.VersionCount
+FROM dbo.Packages AS p
+INNER JOIN dbo.Users AS u
+    ON u.Id = p.CreatedByUserId
+OUTER APPLY
+(
+    SELECT TOP (1)
+        pv.Id,
+        pv.Version,
+        pv.ReleaseDate,
+        pv.FilePath,
+        pv.DockerImage
+    FROM dbo.PackageVersions AS pv
+    WHERE pv.PackageId = p.Id
+    ORDER BY pv.IsLatest DESC, pv.ReleaseDate DESC, pv.UploadedAt DESC
+) AS latest
+OUTER APPLY
+(
+    SELECT COUNT_BIG(*) AS VersionCount
+    FROM dbo.PackageVersions AS pv
+    WHERE pv.PackageId = p.Id
+) AS version_count;
+GO
+
+CREATE OR ALTER VIEW dbo.vw_PackageVersionList
+AS
+SELECT
+    pv.Id,
+    pv.PackageId,
+    p.PackageCode,
+    p.PackageName,
+    p.PackageType,
+    pv.Version,
+    pv.FilePath,
+    pv.DockerImage,
+    pv.FileChecksumSha256,
+    pv.FileSizeBytes,
+    pv.ChangeLog,
+    pv.ReleaseDate,
+    pv.UploadedAt,
+    pv.IsLatest,
+    pv.IsDeprecated
+FROM dbo.PackageVersions AS pv
+INNER JOIN dbo.Packages AS p
+    ON p.Id = pv.PackageId;
+GO
+
+CREATE OR ALTER VIEW dbo.vw_ApplicationList
+AS
+SELECT
+    a.Id,
+    a.AppCode,
+    a.AppName,
+    a.AppVersion,
+    a.Description,
+    a.Status,
+    a.Notes,
+    a.CreatedAt,
+    a.UpdatedAt,
+    a.CreatedByUserId,
+    u.Username AS CreatedByUsername,
+    COUNT_BIG(ap.Id) AS PackageCount
+FROM dbo.Applications AS a
+INNER JOIN dbo.Users AS u
+    ON u.Id = a.CreatedByUserId
+LEFT JOIN dbo.ApplicationPackages AS ap
+    ON ap.ApplicationId = a.Id
+GROUP BY
+    a.Id,
+    a.AppCode,
+    a.AppName,
+    a.AppVersion,
+    a.Description,
+    a.Status,
+    a.Notes,
+    a.CreatedAt,
+    a.UpdatedAt,
+    a.CreatedByUserId,
+    u.Username;
+GO
+
+CREATE OR ALTER VIEW dbo.vw_ApplicationPackageDetails
+AS
+SELECT
+    ap.Id,
+    ap.ApplicationId,
+    a.AppCode,
+    a.AppName,
+    a.AppVersion,
+    ap.PackageId,
+    p.PackageCode,
+    p.PackageName,
+    p.PackageType,
+    ap.SelectedVersionId,
+    pv.Version AS SelectedVersion,
+    pv.FilePath,
+    pv.DockerImage,
+    ap.AddedAt,
+    ap.Notes
+FROM dbo.ApplicationPackages AS ap
+INNER JOIN dbo.Applications AS a
+    ON a.Id = ap.ApplicationId
+INNER JOIN dbo.Packages AS p
+    ON p.Id = ap.PackageId
+LEFT JOIN dbo.PackageVersions AS pv
+    ON pv.Id = ap.SelectedVersionId;
+GO
+
+PRINT N'RobotInstaller views were created successfully.';
+GO
diff --git a/web-server/database/README.md b/web-server/database/README.md
new file mode 100644
index 0000000..7b48e26
--- /dev/null
+++ b/web-server/database/README.md
@@ -0,0 +1,93 @@
+# RobotInstaller database
+
+Thiết kế này bám theo `database.md` và sơ đồ database hiện có, sau đó bổ sung vài cột cần cho web server:
+
+- `PackageType`: phân biệt package `.deb` và `docker`.
+- `AppVersion`: version hiện tại của app đóng gói.
+- metadata artifact: `DockerImage`, `FileChecksumSha256`, `FileSizeBytes`, `UploadedAt`.
+- `Role`, `IsActive` cho tài khoản đăng nhập web.
+
+## Database
+
+Tên database được chọn: `RobotInstaller`
+
+Server:
+
+```powershell
+172.20.235.176
+```
+
+Không lưu mật khẩu thật vào file cấu hình. Khi chạy local, tạo file `.env` từ `web-server/.env.example` rồi điền mật khẩu thật.
+
+## Cấu trúc chính
+
+| Bảng | Vai trò |
+| --- | --- |
+| `dbo.Users` | Người dùng web server |
+| `dbo.Packages` | Danh mục package |
+| `dbo.PackageVersions` | Các version của từng package |
+| `dbo.Applications` | App được đóng gói từ nhiều package |
+| `dbo.ApplicationPackages` | Liên kết app-package, có thể chọn version cụ thể |
+
+## Ràng buộc quan trọng
+
+- `Users.Username`, `Users.Email` là duy nhất.
+- `Packages.PackageCode` là duy nhất.
+- `Applications.AppCode` là duy nhất.
+- Mỗi package không được trùng `Version`.
+- Mỗi app chỉ chứa một dòng cho mỗi package.
+- Mỗi package chỉ có tối đa một `IsLatest = 1`.
+- `ApplicationPackages.SelectedVersionId` bắt buộc thuộc đúng `PackageId` trên cùng dòng.
+
+## View cho API
+
+| View | Dùng cho màn hình |
+| --- | --- |
+| `dbo.vw_PackageList` | Danh sách package kèm latest version |
+| `dbo.vw_PackageVersionList` | Chi tiết version của package |
+| `dbo.vw_ApplicationList` | Danh sách app kèm số package |
+| `dbo.vw_ApplicationPackageDetails` | Chi tiết package/version trong app |
+
+## Stored procedure
+
+| Procedure | Mục đích |
+| --- | --- |
+| `dbo.SetLatestPackageVersion` | Đặt một version là latest và tự clear latest cũ |
+| `dbo.DeletePackageVersion` | Xóa version và các liên kết app đang dùng version đó |
+
+## Triển khai bằng sqlcmd
+
+```powershell
+$env:SQLCMDPASSWORD = '<mat-khau-sa>'
+
+sqlcmd -S 172.20.235.176 -U sa -b -i .\database\01_create_database.sql
+sqlcmd -S 172.20.235.176 -U sa -d RobotInstaller -b -i .\database\02_schema.sql
+sqlcmd -S 172.20.235.176 -U sa -d RobotInstaller -b -i .\database\03_views.sql
+```
+
+Chạy các lệnh trên từ thư mục `web-server`.
+
+Khi dùng `sqlcmd` để seed/test dữ liệu, thêm `-I` hoặc bật `SET QUOTED_IDENTIFIER ON` vì schema có filtered index cho ràng buộc một latest version trên mỗi package.
+
+## Luồng dữ liệu đề xuất
+
+1. Upload package mới:
+   - nếu package chưa tồn tại, insert vào `Packages`;
+   - insert version vào `PackageVersions`;
+   - gọi `dbo.SetLatestPackageVersion @PackageVersionId`.
+
+2. Update package:
+   - insert thêm một dòng mới vào `PackageVersions`;
+   - gọi `dbo.SetLatestPackageVersion @PackageVersionId`.
+
+3. Tạo app:
+   - insert vào `Applications`;
+   - insert các package được chọn vào `ApplicationPackages`;
+   - nếu user chọn version cụ thể, điền `SelectedVersionId`.
+
+4. Xóa package:
+   - xóa dòng trong `Packages`;
+   - database tự cascade sang `PackageVersions` và `ApplicationPackages`.
+
+5. Xóa version:
+   - gọi `dbo.DeletePackageVersion @PackageVersionId` để xóa cả liên kết app đang dùng version đó.
diff --git a/web-server/package-lock.json b/web-server/package-lock.json
new file mode 100644
index 0000000..a8da708
--- /dev/null
+++ b/web-server/package-lock.json
@@ -0,0 +1,1948 @@
+{
+  "name": "robot-installer-web-server",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "robot-installer-web-server",
+      "version": "0.1.0",
+      "dependencies": {
+        "dotenv": "^17.4.2",
+        "ejs": "^3.1.10",
+        "express": "^4.19.2",
+        "mssql": "^12.5.4",
+        "multer": "^2.1.1",
+        "nodemailer": "^8.0.7",
+        "notiflix": "^3.2.8"
+      }
+    },
+    "node_modules/@azure-rest/core-client": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@azure-rest/core-client/-/core-client-2.6.0.tgz",
+      "integrity": "sha512-iuFKDm8XPzNxPfRjhyU5/xKZmcRDzSuEghXDHHk4MjBV/wFL34GmYVBZnn9wmuoLBeS1qAw9ceMdaeJBPcB1QQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2",
+        "@azure/core-auth": "^1.10.0",
+        "@azure/core-rest-pipeline": "^1.22.0",
+        "@azure/core-tracing": "^1.3.0",
+        "@typespec/ts-http-runtime": "^0.3.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-auth": {
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/@azure/core-auth/-/core-auth-1.10.1.tgz",
+      "integrity": "sha512-ykRMW8PjVAn+RS6ww5cmK9U2CyH9p4Q88YJwvUslfuMmN98w/2rdGRLPqJYObapBCdzBVeDgYWdJnFPFb7qzpg==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2",
+        "@azure/core-util": "^1.13.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/core-client": {
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz",
+      "integrity": "sha512-Nh5PhEOeY6PrnxNPsEHRr9eimxLwgLlpmguQaHKBinFYA/RU9+kOYVOQqOrTsCL+KSxrLLl1gD8Dk5BFW/7l/w==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2",
+        "@azure/core-auth": "^1.10.0",
+        "@azure/core-rest-pipeline": "^1.22.0",
+        "@azure/core-tracing": "^1.3.0",
+        "@azure/core-util": "^1.13.0",
+        "@azure/logger": "^1.3.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/core-http-compat": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.4.0.tgz",
+      "integrity": "sha512-f1P96IB399YiN2ARYHP7EpZi3Bf3wH4SN2lGzrw7JVwm7bbsVYtf2iKSBwTywD2P62NOPZGHFSZi+6jjb75JuA==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      },
+      "peerDependencies": {
+        "@azure/core-client": "^1.10.0",
+        "@azure/core-rest-pipeline": "^1.22.0"
+      }
+    },
+    "node_modules/@azure/core-lro": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.7.2.tgz",
+      "integrity": "sha512-0YIpccoX8m/k00O7mDDMdJpbr6mf1yWo2dfmxt5A8XVZVVMz2SSKaEbMCeJRvgQ0IaSlqhjT47p4hVIRRy90xw==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-util": "^1.2.0",
+        "@azure/logger": "^1.0.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-paging": {
+      "version": "1.6.2",
+      "resolved": "https://registry.npmjs.org/@azure/core-paging/-/core-paging-1.6.2.tgz",
+      "integrity": "sha512-YKWi9YuCU04B55h25cnOYZHxXYtEvQEbKST5vqRga7hWY9ydd3FZHdeQF8pyh+acWZvppw13M/LMGx0LABUVMA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-rest-pipeline": {
+      "version": "1.23.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.23.0.tgz",
+      "integrity": "sha512-Evs1INHo+jUjwHi1T6SG6Ua/LHOQBCLuKEEE6efIpt4ZOoNonaT1kP32GoOcdNDbfqsD2445CPri3MubBy5DEQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2",
+        "@azure/core-auth": "^1.10.0",
+        "@azure/core-tracing": "^1.3.0",
+        "@azure/core-util": "^1.13.0",
+        "@azure/logger": "^1.3.0",
+        "@typespec/ts-http-runtime": "^0.3.4",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/core-tracing": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
+      "integrity": "sha512-9MWKevR7Hz8kNzzPLfX4EAtGM2b8mr50HPDBvio96bURP/9C+HjdH3sBlLSNNrvRAr5/k/svoH457gB5IKpmwQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/core-util": {
+      "version": "1.13.1",
+      "resolved": "https://registry.npmjs.org/@azure/core-util/-/core-util-1.13.1.tgz",
+      "integrity": "sha512-XPArKLzsvl0Hf0CaGyKHUyVgF7oDnhKoP85Xv6M4StF/1AhfORhZudHtOyf2s+FcbuQ9dPRAjB8J2KvRRMUK2A==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2",
+        "@typespec/ts-http-runtime": "^0.3.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/identity": {
+      "version": "4.13.1",
+      "resolved": "https://registry.npmjs.org/@azure/identity/-/identity-4.13.1.tgz",
+      "integrity": "sha512-5C/2WD5Vb1lHnZS16dNQRPMjN6oV/Upba+C9nBIs15PmOi6A3ZGs4Lr2u60zw4S04gi+u3cEXiqTVP7M4Pz3kw==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-auth": "^1.9.0",
+        "@azure/core-client": "^1.9.2",
+        "@azure/core-rest-pipeline": "^1.17.0",
+        "@azure/core-tracing": "^1.0.0",
+        "@azure/core-util": "^1.11.0",
+        "@azure/logger": "^1.0.0",
+        "@azure/msal-browser": "^5.5.0",
+        "@azure/msal-node": "^5.1.0",
+        "open": "^10.1.0",
+        "tslib": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/keyvault-common": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@azure/keyvault-common/-/keyvault-common-2.1.0.tgz",
+      "integrity": "sha512-aCDidWuKY06LWQ4x7/8TIXK6iRqTaRWRL3t7T+LC+j1b07HtoIsOxP/tU90G4jCSBn5TAyUTCtA4MS/y5Hudaw==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure-rest/core-client": "^2.3.3",
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-auth": "^1.3.0",
+        "@azure/core-rest-pipeline": "^1.8.0",
+        "@azure/core-tracing": "^1.0.0",
+        "@azure/core-util": "^1.10.0",
+        "@azure/logger": "^1.1.4",
+        "tslib": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/keyvault-keys": {
+      "version": "4.10.0",
+      "resolved": "https://registry.npmjs.org/@azure/keyvault-keys/-/keyvault-keys-4.10.0.tgz",
+      "integrity": "sha512-eDT7iXoBTRZ2n3fLiftuGJFD+yjkiB1GNqzU2KbY1TLYeXeSPVTVgn2eJ5vmRTZ11978jy2Kg2wI7xa9Tyr8ag==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure-rest/core-client": "^2.3.3",
+        "@azure/abort-controller": "^2.1.2",
+        "@azure/core-auth": "^1.9.0",
+        "@azure/core-http-compat": "^2.2.0",
+        "@azure/core-lro": "^2.7.2",
+        "@azure/core-paging": "^1.6.2",
+        "@azure/core-rest-pipeline": "^1.19.0",
+        "@azure/core-tracing": "^1.2.0",
+        "@azure/core-util": "^1.11.0",
+        "@azure/keyvault-common": "^2.0.0",
+        "@azure/logger": "^1.1.4",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/logger": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@azure/logger/-/logger-1.3.0.tgz",
+      "integrity": "sha512-fCqPIfOcLE+CGqGPd66c8bZpwAji98tZ4JI9i/mlTNTlsIWslCfpg48s/ypyLxZTump5sypjrKn2/kY7q8oAbA==",
+      "license": "MIT",
+      "dependencies": {
+        "@typespec/ts-http-runtime": "^0.3.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@azure/msal-browser": {
+      "version": "5.10.1",
+      "resolved": "https://registry.npmjs.org/@azure/msal-browser/-/msal-browser-5.10.1.tgz",
+      "integrity": "sha512-hTbvOi9Ko2Jvn+G/fSmjzHf9WbNcf/o3epMtbeGx/pMwMrVAbi6OgCJVeCfsAb8IybSRpaCSc4EDRlYAhgngUQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/msal-common": "16.6.1"
+      },
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/@azure/msal-common": {
+      "version": "16.6.1",
+      "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.6.1.tgz",
+      "integrity": "sha512-VxKdEtUwDuLD0F1hOQP7kye0YadZxFJfv37Em440geEf/w9uggKnHpRrqwZJOdxmPUOdhZ9kyRtKuAJW8wUcRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/@azure/msal-node": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-5.2.1.tgz",
+      "integrity": "sha512-tmQiQ2HvtzaeLqYGy3BemiPOSGPY4wCy1IW5zDWITKSs/s35WEd7Zij/hCxvUdAOzj6U3qnyaGbYXY91ortFEQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/msal-common": "16.6.1",
+        "jsonwebtoken": "^9.0.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@js-joda/core": {
+      "version": "5.7.0",
+      "resolved": "https://registry.npmjs.org/@js-joda/core/-/core-5.7.0.tgz",
+      "integrity": "sha512-WBu4ULVVxySLLzK1Ppq+OdfP+adRS4ntmDQT915rzDJ++i95gc2jZkM5B6LWEAwN3lGXpfie3yPABozdD3K3Vg==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@tediousjs/connection-string": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@tediousjs/connection-string/-/connection-string-1.1.0.tgz",
+      "integrity": "sha512-z9ZBWEG+8pIB5V1zYzlRPXx0oRJ5H7coPnMQK8EZOw03UTPI9Umn6viL36f5w+CuqkKsnCM50RVStpjZmR0Bng==",
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "25.9.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.0.tgz",
+      "integrity": "sha512-AOQwYUNolgy3VosiRqXrACUXTN8nJUtPl7FJXMqZVyxiiCLhQuG3jXKvCS1ALr+Y2OmZhzzLVlYPEqJaiqkaJQ==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": ">=7.24.0 <7.24.7"
+      }
+    },
+    "node_modules/@types/readable-stream": {
+      "version": "4.0.23",
+      "resolved": "https://registry.npmjs.org/@types/readable-stream/-/readable-stream-4.0.23.tgz",
+      "integrity": "sha512-wwXrtQvbMHxCbBgjHaMGEmImFTQxxpfMOR/ZoQnXxB1woqkUbdLGFDgauo00Py9IudiaqSeiBiulSV9i6XIPig==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@typespec/ts-http-runtime": {
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.5.tgz",
+      "integrity": "sha512-yURCknZhvywvQItHMMmFSo+fq5arCUIyz/CVk7jD89MSai7dkaX8ufjCWp3NttLojoTVbcE72ri+be/TnEbMHw==",
+      "license": "MIT",
+      "dependencies": {
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
+      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
+      "license": "MIT",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/append-field": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/append-field/-/append-field-1.0.0.tgz",
+      "integrity": "sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==",
+      "license": "MIT"
+    },
+    "node_modules/array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+      "license": "MIT"
+    },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
+      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "license": "MIT"
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "license": "MIT"
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/bl": {
+      "version": "6.1.6",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-6.1.6.tgz",
+      "integrity": "sha512-jLsPgN/YSvPUg9UX0Kd73CXpm2Psg9FxMeCSXnk3WBO3CMT10JMwijubhGfHCnFu6TPn1ei3b975dxv7K2pWVg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/readable-stream": "^4.0.0",
+        "buffer": "^6.0.3",
+        "inherits": "^2.0.4",
+        "readable-stream": "^4.2.0"
+      }
+    },
+    "node_modules/bl/node_modules/readable-stream": {
+      "version": "4.7.0",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.7.0.tgz",
+      "integrity": "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==",
+      "license": "MIT",
+      "dependencies": {
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/body-parser": {
+      "version": "1.20.5",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
+      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "content-type": "~1.0.5",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.15.1",
+        "raw-body": "~2.5.3",
+        "type-is": "~1.6.18",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/buffer": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "node_modules/buffer-equal-constant-time": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+      "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "license": "MIT"
+    },
+    "node_modules/bundle-name": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bundle-name/-/bundle-name-4.1.0.tgz",
+      "integrity": "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "run-applescript": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/busboy": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
+      "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
+      "dependencies": {
+        "streamsearch": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=10.16.0"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/commander": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
+      "integrity": "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/concat-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-2.0.0.tgz",
+      "integrity": "sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==",
+      "engines": [
+        "node >= 6.0"
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.0.2",
+        "typedarray": "^0.0.6"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
+      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
+      "license": "MIT"
+    },
+    "node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/default-browser": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-5.5.0.tgz",
+      "integrity": "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==",
+      "license": "MIT",
+      "dependencies": {
+        "bundle-name": "^4.1.0",
+        "default-browser-id": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/default-browser-id": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/default-browser-id/-/default-browser-id-5.0.1.tgz",
+      "integrity": "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/define-lazy-prop": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
+      "integrity": "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/dotenv": {
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ecdsa-sig-formatter": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
+      "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/ejs": {
+      "version": "3.1.10",
+      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
+      "integrity": "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "jake": "^10.8.5"
+      },
+      "bin": {
+        "ejs": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
+      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/events": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.x"
+      }
+    },
+    "node_modules/express": {
+      "version": "4.22.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
+      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "~1.3.8",
+        "array-flatten": "1.1.1",
+        "body-parser": "~1.20.5",
+        "content-disposition": "~0.5.4",
+        "content-type": "~1.0.4",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
+        "merge-descriptors": "1.0.3",
+        "methods": "~1.1.2",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "~0.1.12",
+        "proxy-addr": "~2.0.7",
+        "qs": "~6.15.1",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.2.1",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
+        "setprototypeof": "1.2.0",
+        "statuses": "~2.0.1",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/filelist": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
+      "integrity": "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "minimatch": "^5.0.1"
+      }
+    },
+    "node_modules/finalhandler": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
+      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "statuses": "~2.0.2",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/http-proxy-agent/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/http-proxy-agent/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/https-proxy-agent/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/is-docker": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz",
+      "integrity": "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==",
+      "license": "MIT",
+      "bin": {
+        "is-docker": "cli.js"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-inside-container": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
+      "integrity": "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==",
+      "license": "MIT",
+      "dependencies": {
+        "is-docker": "^3.0.0"
+      },
+      "bin": {
+        "is-inside-container": "cli.js"
+      },
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-wsl": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
+      "integrity": "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==",
+      "license": "MIT",
+      "dependencies": {
+        "is-inside-container": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jake": {
+      "version": "10.9.4",
+      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.4.tgz",
+      "integrity": "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "async": "^3.2.6",
+        "filelist": "^1.0.4",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "jake": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/js-md4": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/js-md4/-/js-md4-0.3.2.tgz",
+      "integrity": "sha512-/GDnfQYsltsjRswQhN9fhv3EMw2sCpUdrdxyWDOUK7eyD++r3gRhzgiQgc/x4MAv2i1iuQ4lxO5mvqM3vj4bwA==",
+      "license": "MIT"
+    },
+    "node_modules/jsonwebtoken": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
+      "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+      "license": "MIT",
+      "dependencies": {
+        "jws": "^4.0.1",
+        "lodash.includes": "^4.3.0",
+        "lodash.isboolean": "^3.0.3",
+        "lodash.isinteger": "^4.0.4",
+        "lodash.isnumber": "^3.0.3",
+        "lodash.isplainobject": "^4.0.6",
+        "lodash.isstring": "^4.0.1",
+        "lodash.once": "^4.0.0",
+        "ms": "^2.1.1",
+        "semver": "^7.5.4"
+      },
+      "engines": {
+        "node": ">=12",
+        "npm": ">=6"
+      }
+    },
+    "node_modules/jsonwebtoken/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/jwa": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
+      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-equal-constant-time": "^1.0.1",
+        "ecdsa-sig-formatter": "1.0.11",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/jws": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
+      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+      "license": "MIT",
+      "dependencies": {
+        "jwa": "^2.0.1",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/lodash.includes": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
+      "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isboolean": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
+      "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isinteger": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
+      "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isnumber": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
+      "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isplainobject": {
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
+      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isstring": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
+      "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.once": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
+      "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
+      "license": "MIT"
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "license": "MIT"
+    },
+    "node_modules/mssql": {
+      "version": "12.5.4",
+      "resolved": "https://registry.npmjs.org/mssql/-/mssql-12.5.4.tgz",
+      "integrity": "sha512-f8UzhpO1STCYhxBybEgT4kaPa2Pda+nucQcMMad7RqOmmTZu3tjkvpPeI9h0RdSK//eua4ybRsLcalz/ttagwQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tediousjs/connection-string": "^1.0.0",
+        "commander": "^11.0.0",
+        "debug": "^4.3.3",
+        "tarn": "^3.0.2",
+        "tedious": "^19.0.0"
+      },
+      "bin": {
+        "mssql": "bin/mssql"
+      },
+      "engines": {
+        "node": ">=18.19.0"
+      }
+    },
+    "node_modules/mssql/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/mssql/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/multer": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.1.1.tgz",
+      "integrity": "sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==",
+      "license": "MIT",
+      "dependencies": {
+        "append-field": "^1.0.0",
+        "busboy": "^1.6.0",
+        "concat-stream": "^2.0.0",
+        "type-is": "^1.6.18"
+      },
+      "engines": {
+        "node": ">= 10.16.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/native-duplexpair": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/native-duplexpair/-/native-duplexpair-1.0.0.tgz",
+      "integrity": "sha512-E7QQoM+3jvNtlmyfqRZ0/U75VFgCls+fSkbml2MpgWkWyz3ox8Y58gNhfuziuQYGNNQAbFZJQck55LHCnCK6CA==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/nodemailer": {
+      "version": "8.0.7",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.7.tgz",
+      "integrity": "sha512-pkjE4mkBzQjdJT4/UmlKl3pX0rC9fZmjh7c6C9o7lv66Ac6w9WCnzPzhbPNxwZAzlF4mdq4CSWB5+FbK6FWCow==",
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/notiflix": {
+      "version": "3.2.8",
+      "resolved": "https://registry.npmjs.org/notiflix/-/notiflix-3.2.8.tgz",
+      "integrity": "sha512-BNBGr3qNIBNt6NZYvch0OLF9DEEgWKcjYzISMH9eECKwfsUaINb5K/RA21hy5kmfOtdbdAdODrqxts+0xp+xwA==",
+      "license": "MIT"
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/open": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
+      "integrity": "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA==",
+      "license": "MIT",
+      "dependencies": {
+        "default-browser": "^5.2.1",
+        "define-lazy-prop": "^3.0.0",
+        "is-inside-container": "^1.0.0",
+        "wsl-utils": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "license": "ISC"
+    },
+    "node_modules/process": {
+      "version": "0.11.10",
+      "resolved": "https://registry.npmjs.org/process/-/process-0.11.10.tgz",
+      "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.15.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/run-applescript": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-7.1.0.tgz",
+      "integrity": "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/send": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
+      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
+        "mime": "1.6.0",
+        "ms": "2.1.3",
+        "on-finished": "~2.4.1",
+        "range-parser": "~1.2.1",
+        "statuses": "~2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/send/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/serve-static": {
+      "version": "1.16.3",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
+      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "~0.19.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
+      "integrity": "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/streamsearch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
+      "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/tarn": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/tarn/-/tarn-3.0.2.tgz",
+      "integrity": "sha512-51LAVKUSZSVfI05vjPESNc5vwqqZpbXCsU+/+wxlOrUjk2SnFTt97v9ZgQrD4YmxYW1Px6w2KjaDitCfkvgxMQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/tedious": {
+      "version": "19.2.1",
+      "resolved": "https://registry.npmjs.org/tedious/-/tedious-19.2.1.tgz",
+      "integrity": "sha512-pk1Q16Yl62iocuQB+RWbg6rFUFkIyzqOFQ6NfysCltRvQqKwfurgj8v/f2X+CKvDhSL4IJ0cCOfCHDg9PWEEYA==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/core-auth": "^1.7.2",
+        "@azure/identity": "^4.2.1",
+        "@azure/keyvault-keys": "^4.4.0",
+        "@js-joda/core": "^5.6.5",
+        "@types/node": ">=18",
+        "bl": "^6.1.4",
+        "iconv-lite": "^0.7.0",
+        "js-md4": "^0.3.2",
+        "native-duplexpair": "^1.0.0",
+        "sprintf-js": "^1.1.3"
+      },
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
+    "node_modules/tedious/node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/typedarray": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/typedarray/-/typedarray-0.0.6.tgz",
+      "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==",
+      "license": "MIT"
+    },
+    "node_modules/undici-types": {
+      "version": "7.24.6",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
+      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "license": "MIT"
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/wsl-utils": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/wsl-utils/-/wsl-utils-0.1.0.tgz",
+      "integrity": "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw==",
+      "license": "MIT",
+      "dependencies": {
+        "is-wsl": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    }
+  }
+}
diff --git a/web-server/package.json b/web-server/package.json
new file mode 100644
index 0000000..35b8a57
--- /dev/null
+++ b/web-server/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "robot-installer-web-server",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Robot Installer package management web server UI",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js",
+    "dev": "node server.js"
+  },
+  "dependencies": {
+    "dotenv": "^17.4.2",
+    "ejs": "^3.1.10",
+    "express": "^4.19.2",
+    "mssql": "^12.5.4",
+    "multer": "^2.1.1",
+    "nodemailer": "^8.0.7",
+    "notiflix": "^3.2.8"
+  }
+}
diff --git a/web-server/public/css/styles.css b/web-server/public/css/styles.css
new file mode 100644
index 0000000..b0ac33b
--- /dev/null
+++ b/web-server/public/css/styles.css
@@ -0,0 +1,1489 @@
+:root {
+  --primary: #3755c3;
+  --primary-dim: #2848b7;
+  --primary-container: #dde1ff;
+  --on-primary: #f8f7ff;
+  --background: #f7f9fb;
+  --surface-lowest: #ffffff;
+  --surface-low: #f0f4f7;
+  --surface: #e8eff3;
+  --surface-high: #e1e9ee;
+  --on-surface: #2a3439;
+  --on-surface-variant: #566166;
+  --outline: #717c82;
+  --outline-variant: #a9b4b9;
+  --danger: #b42318;
+  --danger-bg: #fee4e2;
+  --success: #067647;
+  --success-bg: #dcfae6;
+  --warning: #b54708;
+  --warning-bg: #fef0c7;
+  --info: #175cd3;
+  --info-bg: #d1e9ff;
+  --radius: 8px;
+  --shadow-sm: 0 1px 2px rgba(15, 23, 42, 0.06);
+  --shadow-lg: 0 24px 60px rgba(15, 23, 42, 0.18);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body {
+  width: 100%;
+  height: 100%;
+}
+
+body {
+  margin: 0;
+  background: var(--background);
+  color: var(--on-surface);
+  font-family: "Inter", Arial, sans-serif;
+  font-size: 14px;
+  overflow: hidden;
+}
+
+h1,
+h2,
+h3,
+.brand-copy strong {
+  font-family: "Manrope", Arial, sans-serif;
+}
+
+h1,
+h2,
+h3,
+p {
+  margin: 0;
+}
+
+a {
+  color: inherit;
+  text-decoration: none;
+}
+
+button,
+input,
+select,
+textarea {
+  font: inherit;
+}
+
+button {
+  cursor: pointer;
+}
+
+button:disabled {
+  cursor: not-allowed;
+  opacity: 0.5;
+}
+
+.material-symbols-outlined {
+  direction: ltr;
+  display: inline-flex;
+  font-family: "Material Symbols Outlined";
+  font-size: 1.25rem;
+  font-style: normal;
+  font-variation-settings: "FILL" 0, "wght" 400, "GRAD" 0, "opsz" 20;
+  letter-spacing: 0;
+  line-height: 1;
+  text-transform: none;
+  white-space: nowrap;
+}
+
+.app-shell {
+  display: flex;
+  height: 100vh;
+  width: 100vw;
+}
+
+.sidebar {
+  background: #f1f5f9;
+  border-right: 1px solid rgba(169, 180, 185, 0.25);
+  display: flex;
+  flex-direction: column;
+  flex-shrink: 0;
+  height: 100vh;
+  width: 224px;
+}
+
+.brand-block {
+  align-items: center;
+  display: flex;
+  gap: 10px;
+  min-height: 64px;
+  padding: 14px;
+}
+
+.brand-mark {
+  align-items: center;
+  background: var(--primary);
+  border-radius: var(--radius);
+  color: var(--on-primary);
+  display: inline-flex;
+  height: 38px;
+  justify-content: center;
+  width: 38px;
+}
+
+.brand-copy {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 0;
+}
+
+.brand-copy strong {
+  color: #111827;
+  font-size: 14px;
+  font-weight: 800;
+}
+
+.brand-copy span,
+.profile-meta span,
+.sidebar-status span {
+  color: var(--on-surface-variant);
+  font-size: 11px;
+}
+
+.nav-section {
+  display: flex;
+  flex: 1;
+  flex-direction: column;
+  gap: 4px;
+  padding: 8px 10px;
+}
+
+.nav-label,
+.filter-field span,
+.form-field span,
+.metric-card > span,
+.detail-list dt {
+  color: var(--on-surface-variant);
+  font-size: 10px;
+  font-weight: 800;
+  letter-spacing: 0;
+  text-transform: uppercase;
+}
+
+.nav-label {
+  padding: 8px 10px;
+}
+
+.nav-item {
+  align-items: center;
+  border-left: 4px solid transparent;
+  border-radius: 0 var(--radius) var(--radius) 0;
+  color: #475569;
+  display: flex;
+  gap: 10px;
+  min-height: 40px;
+  padding: 9px 10px;
+  transition: background 0.16s ease, color 0.16s ease;
+}
+
+.nav-item:hover {
+  background: rgba(226, 232, 240, 0.72);
+  color: #0f172a;
+}
+
+.nav-item.active {
+  background: rgba(226, 232, 240, 0.88);
+  border-left-color: var(--primary);
+  color: #0f172a;
+  font-weight: 800;
+}
+
+.sidebar-status {
+  align-items: center;
+  background: rgba(255, 255, 255, 0.62);
+  border: 1px solid rgba(169, 180, 185, 0.32);
+  border-radius: var(--radius);
+  display: flex;
+  gap: 9px;
+  margin: 12px;
+  padding: 10px;
+}
+
+.sidebar-status strong {
+  display: block;
+  font-size: 12px;
+}
+
+.status-dot {
+  background: #12b76a;
+  border-radius: 999px;
+  box-shadow: 0 0 0 4px rgba(18, 183, 106, 0.15);
+  display: inline-flex;
+  height: 8px;
+  width: 8px;
+}
+
+#sidebarBackdrop,
+#mobileMenuBtn {
+  display: none;
+}
+
+.main-shell {
+  display: flex;
+  flex: 1;
+  flex-direction: column;
+  height: 100vh;
+  min-width: 0;
+}
+
+.topbar {
+  align-items: center;
+  background: rgba(248, 250, 252, 0.92);
+  border-bottom: 1px solid rgba(169, 180, 185, 0.22);
+  display: flex;
+  flex-shrink: 0;
+  height: 56px;
+  justify-content: space-between;
+  padding: 0 24px;
+}
+
+.topbar-left,
+.topbar-actions,
+.page-actions {
+  align-items: center;
+  display: flex;
+  gap: 10px;
+}
+
+.page-actions form {
+  display: inline-flex;
+  margin: 0;
+}
+
+.profile-chip {
+  align-items: center;
+  background: transparent;
+  border: 1px solid transparent;
+  border-radius: var(--radius);
+  color: inherit;
+  display: flex;
+  gap: 9px;
+  min-height: 38px;
+  padding: 2px 6px 2px 4px;
+}
+
+.profile-chip-button {
+  cursor: pointer;
+  transition: background 0.16s ease, border-color 0.16s ease, transform 0.16s ease;
+}
+
+.profile-chip-button:hover,
+.profile-chip-button:focus-visible {
+  background: #ffffff;
+  border-color: #dbe3ea;
+}
+
+.profile-chip-button:focus-visible {
+  box-shadow: 0 0 0 3px rgba(55, 85, 195, 0.14);
+  outline: 0;
+}
+
+.profile-chip-button:active {
+  transform: scale(0.98);
+}
+
+.profile-avatar {
+  align-items: center;
+  background: var(--primary-container);
+  border-radius: var(--radius);
+  color: var(--primary);
+  display: inline-flex;
+  font-weight: 800;
+  height: 34px;
+  justify-content: center;
+  width: 34px;
+}
+
+.profile-meta {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+}
+
+.profile-meta strong {
+  color: #111827;
+  font-size: 12px;
+}
+
+.main-content {
+  flex: 1;
+  min-height: 0;
+  overflow: hidden;
+}
+
+.page {
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+  min-height: 0;
+  overflow: hidden;
+  padding: 24px;
+}
+
+.page-header {
+  align-items: flex-start;
+  display: flex;
+  flex-shrink: 0;
+  gap: 16px;
+  justify-content: space-between;
+  margin-bottom: 20px;
+}
+
+.page-header h1 {
+  color: #111827;
+  font-size: 24px;
+  font-weight: 800;
+  line-height: 1.2;
+}
+
+.page-header p,
+.panel-header p {
+  color: var(--on-surface-variant);
+  font-size: 13px;
+  line-height: 1.5;
+  margin-top: 4px;
+}
+
+.btn {
+  align-items: center;
+  border: 1px solid transparent;
+  border-radius: var(--radius);
+  display: inline-flex;
+  font-size: 12px;
+  font-weight: 800;
+  gap: 6px;
+  justify-content: center;
+  min-height: 36px;
+  padding: 8px 12px;
+  transition: background 0.16s ease, border-color 0.16s ease, color 0.16s ease, transform 0.16s ease;
+  white-space: nowrap;
+}
+
+.btn:active,
+.icon-button:active {
+  transform: scale(0.98);
+}
+
+.btn-primary {
+  background: var(--primary);
+  color: var(--on-primary);
+}
+
+.btn-primary:hover {
+  background: var(--primary-dim);
+}
+
+.btn-secondary {
+  background: #ffffff;
+  border-color: #cbd5e1;
+  color: #334155;
+}
+
+.btn-secondary:hover {
+  background: #f1f5f9;
+}
+
+.btn-danger {
+  background: #dc2626;
+  color: #ffffff;
+}
+
+.btn-danger:hover {
+  background: #b91c1c;
+}
+
+.icon-button {
+  align-items: center;
+  background: #ffffff;
+  border: 1px solid #dbe3ea;
+  border-radius: var(--radius);
+  color: #475569;
+  display: inline-flex;
+  height: 34px;
+  justify-content: center;
+  padding: 0;
+  transition: background 0.16s ease, color 0.16s ease, transform 0.16s ease;
+  width: 34px;
+}
+
+.icon-button:hover,
+.icon-button.subtle:hover {
+  background: #eef2ff;
+  color: var(--primary);
+}
+
+.icon-button.subtle {
+  background: transparent;
+  border-color: transparent;
+  color: #64748b;
+}
+
+.icon-button.danger {
+  background: transparent;
+  border-color: transparent;
+  color: #ef4444;
+}
+
+.icon-button.danger:hover {
+  background: var(--danger-bg);
+  color: var(--danger);
+}
+
+.dashboard-stats {
+  display: grid;
+  flex-shrink: 0;
+  gap: 14px;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  margin-bottom: 16px;
+}
+
+.metric-card,
+.panel,
+.table-panel {
+  background: var(--surface-lowest);
+  border: 1px solid rgba(169, 180, 185, 0.4);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-sm);
+}
+
+.metric-card {
+  display: flex;
+  flex-direction: column;
+  min-height: 96px;
+  padding: 15px;
+}
+
+.metric-card div {
+  align-items: baseline;
+  display: flex;
+  justify-content: space-between;
+  margin-top: auto;
+}
+
+.metric-card strong {
+  color: #111827;
+  font-family: "Manrope", Arial, sans-serif;
+  font-size: 28px;
+  font-weight: 800;
+}
+
+.metric-card small {
+  color: var(--on-surface-variant);
+  font-size: 11px;
+  font-weight: 700;
+}
+
+.dashboard-grid {
+  display: grid;
+  flex: 1;
+  gap: 16px;
+  grid-template-columns: minmax(0, 1.25fr) minmax(320px, 0.75fr);
+  min-height: 0;
+}
+
+.panel,
+.table-panel {
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+  overflow: hidden;
+}
+
+.panel-header {
+  align-items: flex-start;
+  border-bottom: 1px solid #eef2f7;
+  display: flex;
+  flex-shrink: 0;
+  gap: 14px;
+  justify-content: space-between;
+  padding: 16px;
+}
+
+.panel-header h2 {
+  color: #111827;
+  font-size: 15px;
+  font-weight: 800;
+}
+
+.text-link {
+  color: var(--primary);
+  font-size: 12px;
+  font-weight: 800;
+  white-space: nowrap;
+}
+
+.page-filters {
+  align-items: center;
+  display: flex;
+  flex-shrink: 0;
+  gap: 12px;
+  margin-bottom: 14px;
+}
+
+.page-filters.inline {
+  margin: 0;
+  padding: 14px 16px;
+}
+
+.filter-field,
+.form-field {
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+}
+
+.filter-field.wide,
+.form-field.full {
+  flex: 1;
+}
+
+.filter-field input,
+.filter-field select,
+.form-field input,
+.form-field select,
+.form-field textarea,
+.mini-select {
+  background: var(--surface-low);
+  border: 1px solid #d8e1e8;
+  border-radius: var(--radius);
+  color: var(--on-surface);
+  min-height: 34px;
+  outline: 0;
+  padding: 7px 10px;
+  width: 100%;
+}
+
+.filter-field input:focus,
+.filter-field select:focus,
+.form-field input:focus,
+.form-field select:focus,
+.form-field textarea:focus,
+.mini-select:focus {
+  border-color: var(--primary);
+  box-shadow: 0 0 0 3px rgba(55, 85, 195, 0.14);
+}
+
+.form-field textarea {
+  min-height: 86px;
+  resize: vertical;
+}
+
+.table-panel {
+  flex: 1;
+}
+
+.table-wrap {
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+}
+
+.table-wrap.compact {
+  flex: 1;
+}
+
+table {
+  border-collapse: collapse;
+  min-width: 860px;
+  text-align: left;
+  width: 100%;
+}
+
+.compact table {
+  min-width: 640px;
+}
+
+.builder-table table {
+  min-width: 740px;
+}
+
+thead {
+  background: #f8fafc;
+  border-bottom: 1px solid #e2e8f0;
+  position: sticky;
+  top: 0;
+  z-index: 5;
+}
+
+th {
+  color: #64748b;
+  font-size: 10px;
+  font-weight: 800;
+  letter-spacing: 0;
+  padding: 10px 16px;
+  text-transform: uppercase;
+  white-space: nowrap;
+}
+
+td {
+  color: #475569;
+  font-size: 13px;
+  padding: 12px 16px;
+  vertical-align: middle;
+}
+
+tbody tr {
+  border-bottom: 1px solid #f1f5f9;
+  transition: background 0.16s ease;
+}
+
+tbody tr:hover {
+  background: #f8fafc;
+}
+
+.table-title {
+  color: #172033;
+  display: block;
+  font-weight: 800;
+  line-height: 1.35;
+}
+
+.table-title:hover {
+  color: var(--primary);
+}
+
+.table-subtitle {
+  color: #64748b;
+  display: block;
+  font-size: 11px;
+  line-height: 1.45;
+  margin-top: 2px;
+}
+
+.table-empty {
+  color: #64748b;
+  font-size: 13px;
+  font-weight: 700;
+  padding: 22px 16px;
+  text-align: center;
+}
+
+.notes-cell {
+  max-width: 280px;
+  white-space: normal;
+}
+
+.action-col {
+  position: sticky;
+  right: 0;
+  text-align: right;
+  white-space: nowrap;
+}
+
+td.action-col {
+  background: #ffffff;
+  box-shadow: -10px 0 12px -14px rgba(15, 23, 42, 0.45);
+}
+
+tbody tr:hover td.action-col {
+  background: #f8fafc;
+}
+
+.action-group {
+  align-items: center;
+  display: inline-flex;
+  gap: 6px;
+  justify-content: flex-end;
+}
+
+.action-group form {
+  display: inline-flex;
+  margin: 0;
+}
+
+.badge {
+  border-radius: 6px;
+  display: inline-flex;
+  font-size: 11px;
+  font-weight: 800;
+  line-height: 1;
+  padding: 6px 8px;
+  white-space: nowrap;
+}
+
+.badge-primary {
+  background: var(--primary-container);
+  color: var(--primary);
+}
+
+.badge-success {
+  background: var(--success-bg);
+  color: var(--success);
+}
+
+.badge-warning {
+  background: var(--warning-bg);
+  color: var(--warning);
+}
+
+.badge-danger {
+  background: var(--danger-bg);
+  color: var(--danger);
+}
+
+.badge-info {
+  background: var(--info-bg);
+  color: var(--info);
+}
+
+.badge-muted {
+  background: #e2e8f0;
+  color: #475569;
+}
+
+.page-pager {
+  align-items: center;
+  background: #f8fafc;
+  border-top: 1px solid #e2e8f0;
+  color: #64748b;
+  display: flex;
+  flex-shrink: 0;
+  font-size: 12px;
+  justify-content: space-between;
+  padding: 10px 14px;
+}
+
+.page-pager div {
+  align-items: center;
+  display: flex;
+  gap: 8px;
+}
+
+.page-pager button {
+  background: #ffffff;
+  border: 1px solid #dbe3ea;
+  border-radius: 6px;
+  color: #475569;
+  font-size: 12px;
+  min-height: 28px;
+  padding: 4px 9px;
+}
+
+.activity-list {
+  display: flex;
+  flex-direction: column;
+  overflow: auto;
+  padding: 8px;
+}
+
+.activity-item {
+  align-items: center;
+  border-radius: var(--radius);
+  display: grid;
+  gap: 12px;
+  grid-template-columns: 34px minmax(0, 1fr) auto;
+  padding: 10px 8px;
+}
+
+.activity-item:hover {
+  background: #f8fafc;
+}
+
+.activity-icon {
+  align-items: center;
+  background: var(--surface-low);
+  border-radius: var(--radius);
+  color: var(--primary);
+  display: inline-flex;
+  height: 34px;
+  justify-content: center;
+  width: 34px;
+}
+
+.activity-item strong,
+.activity-item span {
+  display: block;
+}
+
+.activity-item strong {
+  color: #172033;
+  font-size: 13px;
+}
+
+.activity-item span,
+.activity-item time {
+  color: #64748b;
+  font-size: 12px;
+}
+
+.breadcrumb {
+  align-items: center;
+  color: #64748b;
+  display: flex;
+  font-size: 12px;
+  font-weight: 700;
+  gap: 8px;
+  margin-bottom: 8px;
+}
+
+.breadcrumb a {
+  color: var(--primary);
+}
+
+.detail-grid,
+.builder-layout {
+  display: grid;
+  flex: 1;
+  gap: 16px;
+  grid-template-columns: 360px minmax(0, 1fr);
+  min-height: 0;
+}
+
+.wide-panel {
+  min-width: 0;
+}
+
+.detail-list {
+  display: flex;
+  flex-direction: column;
+  gap: 0;
+  margin: 0;
+  overflow: auto;
+  padding: 4px 16px 16px;
+}
+
+.detail-list div {
+  border-bottom: 1px solid #eef2f7;
+  display: grid;
+  gap: 10px;
+  grid-template-columns: 112px minmax(0, 1fr);
+  padding: 12px 0;
+}
+
+.detail-list dt,
+.detail-list dd {
+  margin: 0;
+}
+
+.detail-list dd {
+  color: #172033;
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+
+.mono {
+  font-family: Consolas, "Liberation Mono", monospace;
+  font-size: 12px;
+}
+
+.form-grid {
+  display: grid;
+  gap: 14px;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+
+.form-stack {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+
+.builder-layout .panel {
+  overflow: auto;
+}
+
+.builder-layout .panel .form-grid,
+.builder-layout .panel .form-stack {
+  padding: 16px;
+}
+
+.checkbox {
+  accent-color: var(--primary);
+  height: 16px;
+  width: 16px;
+}
+
+.mini-select {
+  min-height: 30px;
+  min-width: 116px;
+  padding: 5px 8px;
+}
+
+.file-input {
+  height: 1px;
+  opacity: 0;
+  pointer-events: none;
+  position: absolute;
+  width: 1px;
+}
+
+.file-dropzone {
+  background: #f8fafc;
+  border: 1px dashed #a9b4b9;
+  border-radius: var(--radius);
+  color: #475569;
+  min-height: 148px;
+  padding: 12px;
+  position: relative;
+  transition: background 0.16s ease, border-color 0.16s ease, box-shadow 0.16s ease;
+}
+
+.file-dropzone:hover,
+.file-dropzone.dragover {
+  background: #eef2ff;
+  border-color: var(--primary);
+  box-shadow: 0 0 0 3px rgba(55, 85, 195, 0.12);
+}
+
+.file-dropzone-content {
+  align-items: center;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  justify-content: center;
+  min-height: 122px;
+  text-align: center;
+}
+
+.file-dropzone-content > .material-symbols-outlined {
+  color: var(--primary);
+  font-size: 34px;
+}
+
+.file-dropzone-content strong {
+  color: #172033;
+  font-size: 13px;
+}
+
+.file-dropzone-content small,
+.file-preview small {
+  color: #64748b;
+  font-size: 11px;
+  line-height: 1.45;
+}
+
+.file-preview {
+  align-items: center;
+  background: #ffffff;
+  border: 1px solid #dbe3ea;
+  border-radius: var(--radius);
+  display: grid;
+  gap: 10px;
+  grid-template-columns: 34px minmax(0, 1fr) 34px;
+  margin-top: 10px;
+  padding: 10px;
+}
+
+.file-preview > .material-symbols-outlined {
+  align-items: center;
+  background: var(--primary-container);
+  border-radius: var(--radius);
+  color: var(--primary);
+  display: inline-flex;
+  height: 34px;
+  justify-content: center;
+  width: 34px;
+}
+
+.file-preview strong {
+  color: #172033;
+  display: block;
+  font-size: 13px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.modal-backdrop {
+  align-items: center;
+  background: rgba(15, 23, 42, 0.42);
+  display: flex;
+  inset: 0;
+  justify-content: center;
+  opacity: 0;
+  pointer-events: none;
+  position: fixed;
+  transition: opacity 0.18s ease;
+  z-index: 100;
+}
+
+.modal-backdrop.open {
+  opacity: 1;
+  pointer-events: auto;
+}
+
+.modal-content {
+  background: #ffffff;
+  border: 1px solid rgba(226, 232, 240, 0.9);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-lg);
+  max-height: min(86vh, 720px);
+  overflow: hidden;
+  transform: scale(0.97);
+  transition: transform 0.18s ease;
+  width: min(560px, calc(100vw - 32px));
+}
+
+.modal-content.wide {
+  width: min(760px, calc(100vw - 32px));
+}
+
+.modal-backdrop.open .modal-content {
+  transform: scale(1);
+}
+
+.modal-header {
+  align-items: center;
+  background: #f8fafc;
+  border-bottom: 1px solid #eef2f7;
+  display: flex;
+  justify-content: space-between;
+  padding: 14px 18px;
+}
+
+.modal-header h3 {
+  color: #111827;
+  font-size: 16px;
+  font-weight: 800;
+}
+
+.modal-form {
+  max-height: calc(86vh - 60px);
+  overflow: auto;
+  padding: 18px;
+}
+
+.modal-actions {
+  display: flex;
+  gap: 10px;
+  justify-content: flex-end;
+  padding-top: 18px;
+}
+
+.modal-actions .btn {
+  min-width: 112px;
+}
+
+.profile-summary {
+  align-items: center;
+  background: #f8fafc;
+  border: 1px solid #e2e8f0;
+  border-radius: var(--radius);
+  display: flex;
+  gap: 10px;
+  margin-bottom: 16px;
+  padding: 12px;
+}
+
+.profile-summary > div > strong,
+.profile-summary > div > span {
+  display: block;
+}
+
+.profile-summary > div > strong {
+  color: #172033;
+  font-size: 13px;
+  font-weight: 800;
+}
+
+.profile-summary > div > span {
+  color: #64748b;
+  font-size: 12px;
+  margin-top: 2px;
+}
+
+.modal-mini-table {
+  border: 1px solid #e2e8f0;
+  border-radius: var(--radius);
+  display: flex;
+  flex-direction: column;
+  gap: 0;
+  margin-top: 14px;
+  overflow: hidden;
+}
+
+.modal-mini-table label {
+  align-items: center;
+  border-bottom: 1px solid #eef2f7;
+  display: grid;
+  gap: 10px;
+  grid-template-columns: auto minmax(0, 1fr) 140px;
+  padding: 10px;
+}
+
+.modal-mini-table label:last-child {
+  border-bottom: 0;
+}
+
+.modal-mini-table strong,
+.modal-mini-table small {
+  display: block;
+}
+
+.modal-mini-table small {
+  color: #64748b;
+  font-size: 11px;
+  margin-top: 2px;
+}
+
+.modal-mini-table .mini-select:disabled {
+  opacity: 0.55;
+}
+
+.toast {
+  background: #111827;
+  border-radius: var(--radius);
+  bottom: 20px;
+  box-shadow: 0 14px 32px rgba(15, 23, 42, 0.24);
+  color: #ffffff;
+  font-size: 13px;
+  font-weight: 700;
+  max-width: min(420px, calc(100vw - 32px));
+  opacity: 0;
+  padding: 12px 14px;
+  pointer-events: none;
+  position: fixed;
+  right: 20px;
+  transform: translateY(10px);
+  transition: opacity 0.18s ease, transform 0.18s ease;
+  z-index: 120;
+}
+
+.toast.open {
+  opacity: 1;
+  transform: translateY(0);
+}
+
+.empty-state {
+  align-items: center;
+  background: #ffffff;
+  border: 1px solid #e2e8f0;
+  border-radius: var(--radius);
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  margin: auto;
+  max-width: 460px;
+  padding: 28px;
+  text-align: center;
+}
+
+.empty-state .material-symbols-outlined {
+  color: var(--primary);
+  font-size: 42px;
+}
+
+.empty-state h1 {
+  font-size: 22px;
+}
+
+.empty-state p {
+  color: var(--on-surface-variant);
+  line-height: 1.5;
+}
+
+.center-page {
+  align-items: center;
+  justify-content: center;
+}
+
+.logout-form {
+  margin: 0;
+}
+
+.auth-shell {
+  background:
+    linear-gradient(135deg, rgba(55, 85, 195, 0.08), rgba(6, 118, 71, 0.08)),
+    var(--background);
+  display: block;
+  min-height: 100vh;
+  overflow: auto;
+}
+
+.auth-page {
+  align-items: center;
+  display: flex;
+  justify-content: center;
+  min-height: 100vh;
+  padding: 24px;
+}
+
+.auth-panel {
+  background: var(--surface-lowest);
+  border: 1px solid rgba(169, 180, 185, 0.42);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-lg);
+  display: flex;
+  flex-direction: column;
+  gap: 20px;
+  width: min(460px, 100%);
+  padding: 24px;
+}
+
+.auth-brand {
+  align-items: center;
+  display: flex;
+  gap: 10px;
+}
+
+.auth-heading {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.auth-heading h1 {
+  color: #111827;
+  font-size: 26px;
+  font-weight: 800;
+}
+
+.auth-heading p,
+.auth-switch {
+  color: var(--on-surface-variant);
+  line-height: 1.5;
+}
+
+.auth-confirm-icon {
+  align-items: center;
+  background: var(--primary-container);
+  border-radius: var(--radius);
+  color: var(--primary);
+  display: inline-flex;
+  height: 46px;
+  justify-content: center;
+  width: 46px;
+}
+
+.auth-confirm-icon .material-symbols-outlined {
+  font-size: 28px;
+}
+
+.auth-form {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+
+.field-feedback {
+  color: var(--on-surface-variant);
+  display: none;
+  font-size: 11px;
+  font-weight: 700;
+  line-height: 1.4;
+}
+
+.form-field.has-error input {
+  border-color: var(--danger);
+  box-shadow: 0 0 0 3px rgba(180, 35, 24, 0.12);
+}
+
+.form-field.has-success input {
+  border-color: var(--success);
+}
+
+.form-field.has-error .field-feedback {
+  color: var(--danger);
+  display: block;
+}
+
+.form-field.has-success .field-feedback {
+  color: var(--success);
+  display: block;
+}
+
+.auth-submit {
+  width: 100%;
+}
+
+.auth-switch {
+  font-size: 13px;
+  text-align: center;
+}
+
+.auth-switch a {
+  color: var(--primary);
+  font-weight: 800;
+}
+
+.users-layout {
+  display: grid;
+  flex: 1;
+  gap: 16px;
+  grid-template-columns: 360px minmax(0, 1fr);
+  min-height: 0;
+}
+
+.user-create-form {
+  overflow: auto;
+  padding: 16px;
+}
+
+.access-form {
+  align-items: center;
+  display: inline-flex;
+  gap: 8px;
+  justify-content: flex-end;
+}
+
+.user-actions {
+  align-items: center;
+  display: inline-flex;
+  gap: 6px;
+  justify-content: flex-end;
+}
+
+.user-actions form {
+  margin: 0;
+}
+
+.edit-active-toggle {
+  padding-top: 2px;
+}
+
+.user-detail-list {
+  padding: 0;
+}
+
+.inline-checkbox {
+  align-items: center;
+  color: #475569;
+  display: inline-flex;
+  font-size: 12px;
+  font-weight: 800;
+  gap: 5px;
+  white-space: nowrap;
+}
+
+.users-table {
+  min-width: 980px;
+}
+
+@media (max-width: 1100px) {
+  .dashboard-grid,
+  .detail-grid,
+  .builder-layout,
+  .users-layout {
+    grid-template-columns: 1fr;
+  }
+
+  .dashboard-stats {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .detail-grid,
+  .builder-layout,
+  .users-layout {
+    overflow: auto;
+  }
+}
+
+@media (max-width: 900px) {
+  body.app-shell {
+    height: 100dvh;
+    min-height: 100dvh;
+    overflow: hidden;
+    position: relative;
+  }
+
+  #mobileMenuBtn {
+    display: inline-flex;
+  }
+
+  #sidebarBackdrop {
+    background: rgba(15, 23, 42, 0.45);
+    display: block;
+    inset: 0;
+    opacity: 0;
+    pointer-events: none;
+    position: fixed;
+    transition: opacity 0.18s ease;
+    z-index: 70;
+  }
+
+  .sidebar {
+    box-shadow: 0 20px 45px rgba(15, 23, 42, 0.34);
+    height: 100dvh;
+    inset: 0 auto 0 0;
+    position: fixed;
+    transform: translateX(-100%);
+    transition: transform 0.18s ease;
+    width: min(82vw, 256px);
+    z-index: 80;
+  }
+
+  body.mobile-nav-open #sidebarBackdrop {
+    opacity: 1;
+    pointer-events: auto;
+  }
+
+  body.mobile-nav-open .sidebar {
+    transform: translateX(0);
+  }
+
+  .topbar {
+    padding: 0 14px;
+  }
+
+  .profile-meta {
+    display: none;
+  }
+
+  .page {
+    padding: 16px;
+  }
+
+  .page-header,
+  .page-filters {
+    align-items: stretch;
+    flex-direction: column;
+  }
+
+  .page-actions {
+    flex-wrap: wrap;
+  }
+
+  .page-actions .btn {
+    flex: 1;
+  }
+
+  .table-wrap table {
+    min-width: 760px;
+  }
+
+  .page-pager {
+    align-items: flex-start;
+    flex-direction: column;
+    gap: 8px;
+  }
+
+  .modal-backdrop {
+    align-items: flex-end;
+  }
+
+  .modal-content,
+  .modal-content.wide {
+    border-radius: var(--radius);
+    margin: 8px;
+    max-height: min(88dvh, 720px);
+    width: calc(100% - 16px);
+  }
+}
+
+@media (max-width: 560px) {
+  .dashboard-stats,
+  .form-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .page-header h1 {
+    font-size: 22px;
+  }
+
+  .modal-mini-table label {
+    align-items: stretch;
+    grid-template-columns: auto minmax(0, 1fr);
+  }
+
+  .modal-mini-table .mini-select {
+    grid-column: 1 / -1;
+    width: 100%;
+  }
+}
diff --git a/web-server/public/js/app.js b/web-server/public/js/app.js
new file mode 100644
index 0000000..2744dd9
--- /dev/null
+++ b/web-server/public/js/app.js
@@ -0,0 +1,719 @@
+(function () {
+  const body = document.body;
+  const menuButton = document.getElementById('mobileMenuBtn');
+  const sidebarBackdrop = document.getElementById('sidebarBackdrop');
+
+  function initNotiflix() {
+    if (!window.Notiflix) return;
+
+    window.Notiflix.Notify.init({
+      width: '320px',
+      position: 'right-top',
+      distance: '16px',
+      timeout: 2600,
+      borderRadius: '8px',
+      fontFamily: 'Inter, sans-serif',
+      fontSize: '13px',
+      messageMaxLength: 180,
+      clickToClose: true,
+      pauseOnHover: true,
+      cssAnimationStyle: 'from-right',
+      useIcon: true,
+      zindex: 5000,
+      success: {
+        background: '#067647',
+        textColor: '#ffffff'
+      },
+      failure: {
+        background: '#b42318',
+        textColor: '#ffffff'
+      },
+      warning: {
+        background: '#b54708',
+        textColor: '#ffffff'
+      },
+      info: {
+        background: '#3755c3',
+        textColor: '#ffffff'
+      }
+    });
+
+    window.Notiflix.Confirm.init({
+      width: '360px',
+      borderRadius: '8px',
+      fontFamily: 'Inter, sans-serif',
+      titleColor: '#111827',
+      titleFontSize: '16px',
+      messageColor: '#475569',
+      messageFontSize: '13px',
+      okButtonBackground: '#3755c3',
+      okButtonColor: '#ffffff',
+      cancelButtonBackground: '#e2e8f0',
+      cancelButtonColor: '#334155',
+      backOverlayColor: 'rgba(15, 23, 42, 0.42)',
+      zindex: 5001,
+      cssAnimationStyle: 'zoom'
+    });
+  }
+
+  function notify(type, message) {
+    if (!message) return;
+
+    if (!window.Notiflix) {
+      console.info(message);
+      return;
+    }
+
+    const Notify = window.Notiflix.Notify;
+
+    if (type === 'success') {
+      Notify.success(message);
+      return;
+    }
+
+    if (type === 'failure') {
+      Notify.failure(message);
+      return;
+    }
+
+    if (type === 'warning') {
+      Notify.warning(message);
+      return;
+    }
+
+    Notify.info(message);
+  }
+
+  function confirmAction(message, onConfirm) {
+    if (!window.Notiflix) {
+      if (window.confirm(message || 'Xác nhận thao tác?') && typeof onConfirm === 'function') {
+        onConfirm();
+      }
+      return;
+    }
+
+    window.Notiflix.Confirm.show(
+      'Xác nhận thao tác',
+      message,
+      'Xác nhận',
+      'Hủy',
+      () => {
+        if (typeof onConfirm === 'function') {
+        onConfirm();
+        return;
+      }
+      notify('success', 'Đã xác nhận thao tác');
+      },
+      () => {
+        notify('info', 'Đã hủy thao tác');
+      }
+    );
+  }
+
+  function setMobileNav(open) {
+    body.classList.toggle('mobile-nav-open', open);
+    if (menuButton) {
+      menuButton.setAttribute('aria-expanded', open ? 'true' : 'false');
+    }
+  }
+
+  function openModal(id) {
+    const modal = document.getElementById(id);
+    if (!modal) return;
+
+    modal.classList.add('open');
+    const focusTarget = modal.querySelector('input, select, textarea, button');
+    if (focusTarget) {
+      window.setTimeout(() => focusTarget.focus(), 60);
+    }
+  }
+
+  function closeModal(modal) {
+    if (!modal) return;
+    modal.classList.remove('open');
+  }
+
+  function applyTableFilters(tableId) {
+    const table = document.getElementById(tableId);
+    if (!table) return;
+
+    const searchInput = document.querySelector(`[data-table-search="${tableId}"]`);
+    const query = searchInput ? searchInput.value.trim().toLowerCase() : '';
+    const selects = document.querySelectorAll(`[data-filter-select][data-filter-table="${tableId}"]`);
+
+    table.querySelectorAll('tbody tr').forEach((row) => {
+      const matchesSearch = !query || (row.dataset.search || '').includes(query);
+      let matchesSelects = true;
+
+      selects.forEach((select) => {
+        const column = select.dataset.filterColumn;
+        const value = select.value;
+        if (value && row.dataset[column] !== value) {
+          matchesSelects = false;
+        }
+      });
+
+      row.hidden = !(matchesSearch && matchesSelects);
+    });
+  }
+
+  function formatFileSize(bytes) {
+    if (!Number.isFinite(bytes) || bytes <= 0) return '0 B';
+
+    const units = ['B', 'KB', 'MB', 'GB'];
+    const index = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1);
+    const value = bytes / Math.pow(1024, index);
+
+    return `${value.toFixed(value >= 10 || index === 0 ? 0 : 1)} ${units[index]}`;
+  }
+
+  function isAllowedPackageFile(file) {
+    if (!file) return false;
+
+    const name = file.name.toLowerCase();
+    const allowedExtensions = ['.deb', '.tar', '.tar.gz', '.tgz', '.zip', '.gz'];
+
+    return allowedExtensions.some((extension) => name.endsWith(extension));
+  }
+
+  function renderSelectedFile(zone, file) {
+    const preview = zone.querySelector('[data-file-preview]');
+    const fileName = zone.querySelector('[data-file-name]');
+    const fileMeta = zone.querySelector('[data-file-meta]');
+
+    if (!preview || !fileName || !fileMeta) return;
+
+    if (!file) {
+      preview.hidden = true;
+      fileName.textContent = 'Chưa chọn file';
+      fileMeta.textContent = '';
+      zone.classList.remove('has-file');
+      return;
+    }
+
+    fileName.textContent = file.name;
+    fileMeta.textContent = `${formatFileSize(file.size)} • ${file.type || 'package file'}`;
+    preview.hidden = false;
+    zone.classList.add('has-file');
+    notify('success', `Đã chọn file: ${file.name}`);
+  }
+
+  function setInputFiles(input, files) {
+    try {
+      input.files = files;
+    } catch (error) {
+      console.info('Browser does not allow assigning dropped files to input.files.', error);
+    }
+  }
+
+  function handlePackageFiles(zone, files) {
+    const input = zone.querySelector('[data-file-input]');
+    const file = files && files[0];
+
+    if (!input || !file) return;
+
+    if (!isAllowedPackageFile(file)) {
+      notify('warning', 'File chưa đúng định dạng. Vui lòng chọn .deb, .tar, .tgz, .zip hoặc .gz.');
+      return;
+    }
+
+    setInputFiles(input, files);
+    renderSelectedFile(zone, file);
+  }
+
+  function initFileDropzones() {
+    document.querySelectorAll('[data-file-dropzone]').forEach((zone) => {
+      const input = zone.querySelector('[data-file-input]');
+      const browseButton = zone.querySelector('[data-file-browse]');
+      const clearButton = zone.querySelector('[data-file-clear]');
+
+      if (!input) return;
+
+      if (browseButton) {
+        browseButton.addEventListener('click', () => input.click());
+      }
+
+      if (clearButton) {
+        clearButton.addEventListener('click', () => {
+          input.value = '';
+          renderSelectedFile(zone, null);
+          notify('info', 'Đã bỏ file đã chọn');
+        });
+      }
+
+      input.addEventListener('change', () => {
+        handlePackageFiles(zone, input.files);
+      });
+
+      ['dragenter', 'dragover'].forEach((eventName) => {
+        zone.addEventListener(eventName, (event) => {
+          event.preventDefault();
+          event.stopPropagation();
+          zone.classList.add('dragover');
+        });
+      });
+
+      ['dragleave', 'drop'].forEach((eventName) => {
+        zone.addEventListener(eventName, (event) => {
+          event.preventDefault();
+          event.stopPropagation();
+          zone.classList.remove('dragover');
+        });
+      });
+
+      zone.addEventListener('drop', (event) => {
+        handlePackageFiles(zone, event.dataTransfer.files);
+      });
+    });
+  }
+
+  function updateRegisterSubmit(form) {
+    const submitButton = form.querySelector('[data-register-submit]');
+    if (!submitButton) return;
+
+    const uniqueInputs = form.querySelectorAll('[data-unique-check]');
+    const isBlocked = Array.from(uniqueInputs).some((input) => (
+      input.dataset.uniqueStatus === 'error' || input.dataset.uniqueStatus === 'checking'
+    ));
+
+    submitButton.disabled = isBlocked;
+  }
+
+  function setUniqueState(input, state, message) {
+    const field = input.closest('.form-field');
+    const form = input.closest('[data-register-form]');
+    const feedback = form
+      ? form.querySelector(`[data-unique-feedback="${input.dataset.uniqueCheck}"]`)
+      : null;
+
+    input.dataset.uniqueStatus = state;
+
+    if (field) {
+      field.classList.toggle('has-error', state === 'error');
+      field.classList.toggle('has-success', state === 'success');
+    }
+
+    if (feedback) {
+      feedback.textContent = message || '';
+      feedback.style.display = message ? 'block' : '';
+    }
+
+    input.setCustomValidity(state === 'error' ? message : '');
+
+    if (form) {
+      updateRegisterSubmit(form);
+    }
+  }
+
+  function checkUniqueInput(input) {
+    const field = input.dataset.uniqueCheck;
+    const value = input.value.trim();
+
+    if (!field || !value) {
+      setUniqueState(input, 'idle', '');
+      return;
+    }
+
+    if (field === 'email' && !input.validity.valid) {
+      setUniqueState(input, 'idle', '');
+      return;
+    }
+
+    const requestId = String(Date.now());
+    input.dataset.uniqueRequestId = requestId;
+    setUniqueState(input, 'checking', 'Đang kiểm tra...');
+
+    fetch(`/register/check?field=${encodeURIComponent(field)}&value=${encodeURIComponent(value)}`, {
+      headers: {
+        Accept: 'application/json'
+      }
+    })
+      .then((response) => response.ok ? response.json() : Promise.reject(new Error('Cannot check field')))
+      .then((data) => {
+        if (input.dataset.uniqueRequestId !== requestId) return;
+
+        setUniqueState(
+          input,
+          data.available ? 'success' : 'error',
+          data.message || (data.available ? 'Có thể sử dụng.' : 'Đã tồn tại.')
+        );
+      })
+      .catch((error) => {
+        console.info('Cannot check registration field:', error);
+        if (input.dataset.uniqueRequestId === requestId) {
+          setUniqueState(input, 'idle', '');
+        }
+      });
+  }
+
+  function initRegistrationUniqueChecks() {
+    document.querySelectorAll('[data-register-form]').forEach((form) => {
+      const timers = new Map();
+
+      form.querySelectorAll('[data-unique-check]').forEach((input) => {
+        input.addEventListener('input', () => {
+          window.clearTimeout(timers.get(input));
+          setUniqueState(input, 'idle', '');
+          timers.set(input, window.setTimeout(() => checkUniqueInput(input), 450));
+        });
+
+        input.addEventListener('blur', () => {
+          window.clearTimeout(timers.get(input));
+          checkUniqueInput(input);
+        });
+
+        if (input.value.trim()) {
+          checkUniqueInput(input);
+        }
+      });
+
+      form.addEventListener('submit', (event) => {
+        const blockedInput = form.querySelector('[data-unique-status="error"], [data-unique-status="checking"]');
+        if (!blockedInput) return;
+
+        event.preventDefault();
+        notify('warning', blockedInput.dataset.uniqueStatus === 'checking'
+          ? 'Đang kiểm tra username/email, vui lòng chờ một chút.'
+          : 'Vui lòng đổi username/email đang bị trùng.');
+        blockedInput.focus();
+      });
+    });
+  }
+
+  function getUserDataFromRow(row) {
+    return {
+      id: row.dataset.userId || '',
+      name: row.dataset.userName || '',
+      username: row.dataset.userUsername || '',
+      email: row.dataset.userEmail || '',
+      fullName: row.dataset.userFullName || '',
+      role: row.dataset.userRole || 'User',
+      status: row.dataset.userStatus || '',
+      isActive: row.dataset.userActive === 'true',
+      createdAt: row.dataset.userCreatedAt || '',
+      updatedAt: row.dataset.userUpdatedAt || '',
+      packageCount: row.dataset.userPackageCount || '0',
+      applicationCount: row.dataset.userApplicationCount || '0'
+    };
+  }
+
+  function parseJsonAttribute(value, fallback) {
+    try {
+      return JSON.parse(value || '');
+    } catch (error) {
+      return fallback;
+    }
+  }
+
+  function getAppDataFromTrigger(trigger) {
+    return {
+      id: trigger.dataset.appId || '',
+      code: trigger.dataset.appCode || '',
+      name: trigger.dataset.appName || '',
+      version: trigger.dataset.appVersion || '',
+      status: trigger.dataset.appStatus || 'Draft',
+      notes: trigger.dataset.appNotes || '',
+      packages: parseJsonAttribute(trigger.dataset.appPackages, [])
+    };
+  }
+
+  function findEditAppVersionSelect(form, packageId) {
+    return Array.from(form.querySelectorAll('[data-edit-app-version]'))
+      .find((select) => select.dataset.editAppVersion === packageId);
+  }
+
+  function setEditAppPackageEnabled(form, checkbox) {
+    const select = findEditAppVersionSelect(form, checkbox.dataset.editAppPackage);
+    if (select) {
+      select.disabled = !checkbox.checked;
+    }
+  }
+
+  function setEditAppField(form, field, value) {
+    const input = form.querySelector(`[data-edit-app-field="${field}"]`);
+    if (input) {
+      input.value = value || '';
+    }
+  }
+
+  function openAppEdit(trigger) {
+    const app = getAppDataFromTrigger(trigger);
+    const form = document.getElementById('editAppForm');
+    if (!form || !app.id) return;
+
+    form.action = `/applications/${encodeURIComponent(app.id)}/edit`;
+    setEditAppField(form, 'appCode', app.code);
+    setEditAppField(form, 'appName', app.name);
+    setEditAppField(form, 'appVersion', app.version);
+    setEditAppField(form, 'status', app.status);
+    setEditAppField(form, 'notes', app.notes);
+
+    form.querySelectorAll('[data-edit-app-package]').forEach((checkbox) => {
+      checkbox.checked = false;
+      setEditAppPackageEnabled(form, checkbox);
+    });
+
+    app.packages.forEach((packageItem) => {
+      const packageId = packageItem.packageId || '';
+      const checkbox = Array.from(form.querySelectorAll('[data-edit-app-package]'))
+        .find((input) => input.dataset.editAppPackage === packageId);
+      const select = findEditAppVersionSelect(form, packageId);
+
+      if (checkbox) {
+        checkbox.checked = true;
+      }
+
+      if (select) {
+        select.disabled = false;
+        select.value = packageItem.selectedVersionId || '';
+      }
+    });
+
+    openModal('editAppModal');
+  }
+
+  function openPackageUpdate(packageId) {
+    const modalId = 'updatePackageModal';
+    const modal = document.getElementById(modalId);
+    const packageSelect = modal ? modal.querySelector('select[name="packageId"]') : null;
+
+    if (packageSelect && packageId) {
+      packageSelect.value = packageId;
+    }
+
+    openModal(modalId);
+  }
+
+  function setText(selector, value) {
+    const element = document.querySelector(selector);
+    if (element) {
+      element.textContent = value || '';
+    }
+  }
+
+  function openUserDetail(row) {
+    const user = getUserDataFromRow(row);
+
+    setText('[data-user-detail="name"]', user.name);
+    setText('[data-user-detail="username"]', user.username);
+    setText('[data-user-detail="email"]', user.email);
+    setText('[data-user-detail="role"]', user.role);
+    setText('[data-user-detail="status"]', user.status);
+    setText('[data-user-detail="createdAt"]', user.createdAt);
+    setText('[data-user-detail="updatedAt"]', user.updatedAt || 'Chưa cập nhật');
+    setText('[data-user-detail="ownedData"]', `${user.packageCount} packages, ${user.applicationCount} apps`);
+
+    openModal('userDetailModal');
+  }
+
+  function openUserEdit(row) {
+    const user = getUserDataFromRow(row);
+    const form = document.getElementById('editUserForm');
+    if (!form) return;
+
+    form.action = `/users/${encodeURIComponent(user.id)}/edit`;
+    form.querySelector('[data-edit-user-field="username"]').value = user.username;
+    form.querySelector('[data-edit-user-field="fullName"]').value = user.fullName;
+    form.querySelector('[data-edit-user-field="email"]').value = user.email;
+    form.querySelector('[data-edit-user-field="role"]').value = user.role;
+    form.querySelector('[data-edit-user-field="isActive"]').checked = user.isActive;
+    form.querySelector('[data-edit-user-field="newPassword"]').value = '';
+    form.querySelector('[data-edit-user-field="confirmPassword"]').value = '';
+
+    openModal('editUserModal');
+  }
+
+  function validateProfileForm(form, shouldNotify) {
+    const email = form.querySelector('[data-profile-email]');
+    const confirmEmail = form.querySelector('[data-profile-confirm-email]');
+    const newPassword = form.querySelector('[data-profile-new-password]');
+    const confirmPassword = form.querySelector('[data-profile-confirm-password]');
+    const emailFeedback = form.querySelector('[data-profile-feedback="email"]');
+    const passwordFeedback = form.querySelector('[data-profile-feedback="password"]');
+
+    const emailMismatch = Boolean(email && confirmEmail
+      && email.value.trim().toLowerCase() !== confirmEmail.value.trim().toLowerCase());
+    const passwordMismatch = Boolean(newPassword && confirmPassword
+      && (newPassword.value || confirmPassword.value)
+      && newPassword.value !== confirmPassword.value);
+
+    if (confirmEmail) {
+      confirmEmail.setCustomValidity(emailMismatch ? 'Confirm email mới chưa khớp.' : '');
+      const field = confirmEmail.closest('.form-field');
+      if (field) {
+        field.classList.toggle('has-error', emailMismatch);
+      }
+    }
+
+    if (emailFeedback) {
+      emailFeedback.textContent = emailMismatch ? 'Confirm email mới chưa khớp.' : '';
+      emailFeedback.style.display = emailMismatch ? 'block' : '';
+    }
+
+    if (confirmPassword) {
+      confirmPassword.setCustomValidity(passwordMismatch ? 'Xác nhận mật khẩu mới chưa khớp.' : '');
+      const field = confirmPassword.closest('.form-field');
+      if (field) {
+        field.classList.toggle('has-error', passwordMismatch);
+      }
+    }
+
+    if (passwordFeedback) {
+      passwordFeedback.textContent = passwordMismatch ? 'Xác nhận mật khẩu mới chưa khớp.' : '';
+      passwordFeedback.style.display = passwordMismatch ? 'block' : '';
+    }
+
+    if (shouldNotify && emailMismatch) {
+      notify('warning', 'Confirm email mới chưa khớp.');
+    } else if (shouldNotify && passwordMismatch) {
+      notify('warning', 'Xác nhận mật khẩu mới chưa khớp.');
+    }
+
+    return !emailMismatch && !passwordMismatch;
+  }
+
+  function initProfileForms() {
+    document.querySelectorAll('[data-profile-form]').forEach((form) => {
+      form.querySelectorAll('input').forEach((input) => {
+        input.addEventListener('input', () => validateProfileForm(form, false));
+      });
+
+      form.addEventListener('submit', (event) => {
+        if (!validateProfileForm(form, true)) {
+          event.preventDefault();
+        }
+      });
+    });
+  }
+
+  function initEditAppForms() {
+    document.querySelectorAll('#editAppForm [data-edit-app-package]').forEach((checkbox) => {
+      const form = checkbox.closest('form');
+      setEditAppPackageEnabled(form, checkbox);
+      checkbox.addEventListener('change', () => setEditAppPackageEnabled(form, checkbox));
+    });
+  }
+
+  initNotiflix();
+  initFileDropzones();
+  initRegistrationUniqueChecks();
+  initProfileForms();
+  initEditAppForms();
+
+  if (body.dataset.notice) {
+    notify(body.dataset.noticeType || 'info', body.dataset.notice);
+    const url = new URL(window.location.href);
+    if (url.searchParams.has('notice') || url.searchParams.has('noticeType')) {
+      url.searchParams.delete('notice');
+      url.searchParams.delete('noticeType');
+      window.history.replaceState({}, document.title, `${url.pathname}${url.search}${url.hash}`);
+    }
+    delete body.dataset.notice;
+    delete body.dataset.noticeType;
+  }
+
+  if (menuButton) {
+    menuButton.addEventListener('click', () => {
+      setMobileNav(!body.classList.contains('mobile-nav-open'));
+    });
+  }
+
+  if (sidebarBackdrop) {
+    sidebarBackdrop.addEventListener('click', () => setMobileNav(false));
+  }
+
+  document.querySelectorAll('[data-table-search]').forEach((input) => {
+    input.addEventListener('input', () => applyTableFilters(input.dataset.tableSearch));
+  });
+
+  document.querySelectorAll('[data-filter-select]').forEach((select) => {
+    select.addEventListener('change', () => applyTableFilters(select.dataset.filterTable));
+  });
+
+  document.addEventListener('click', (event) => {
+    const appEditButton = event.target.closest('[data-app-edit]');
+    if (appEditButton) {
+      openAppEdit(appEditButton);
+      return;
+    }
+
+    const packageUpdateButton = event.target.closest('[data-package-update]');
+    if (packageUpdateButton) {
+      openPackageUpdate(packageUpdateButton.dataset.packageUpdate);
+      return;
+    }
+
+    const refreshButton = event.target.closest('[data-refresh-page]');
+    if (refreshButton) {
+      window.location.reload();
+      return;
+    }
+
+    const userViewButton = event.target.closest('[data-user-view]');
+    if (userViewButton) {
+      const row = userViewButton.closest('tr');
+      if (row) {
+        openUserDetail(row);
+      }
+      return;
+    }
+
+    const userEditButton = event.target.closest('[data-user-edit]');
+    if (userEditButton) {
+      const row = userEditButton.closest('tr');
+      if (row) {
+        openUserEdit(row);
+      }
+      return;
+    }
+
+    const modalOpenButton = event.target.closest('[data-modal-open]');
+    if (modalOpenButton) {
+      openModal(modalOpenButton.dataset.modalOpen);
+      return;
+    }
+
+    const modalCloseButton = event.target.closest('[data-modal-close]');
+    if (modalCloseButton) {
+      closeModal(modalCloseButton.closest('.modal-backdrop'));
+    }
+
+    const modalBackdrop = event.target.classList.contains('modal-backdrop') ? event.target : null;
+    if (modalBackdrop) {
+      closeModal(modalBackdrop);
+    }
+
+    const toastButton = event.target.closest('[data-toast]');
+    if (toastButton) {
+      notify(toastButton.dataset.toastType || 'info', toastButton.dataset.toast);
+    }
+
+    const confirmButton = event.target.closest('[data-confirm]');
+    if (confirmButton) {
+      confirmAction(confirmButton.dataset.confirm);
+    }
+  });
+
+  document.addEventListener('submit', (event) => {
+    const form = event.target.closest('form[data-confirm-submit]');
+    if (!form || form.dataset.confirmed === 'true') return;
+
+    event.preventDefault();
+    confirmAction(form.dataset.confirmSubmit, () => {
+      form.dataset.confirmed = 'true';
+      form.submit();
+    });
+  });
+
+  document.addEventListener('keydown', (event) => {
+    if (event.key !== 'Escape') return;
+
+    const openModalNode = document.querySelector('.modal-backdrop.open');
+    if (openModalNode) {
+      closeModal(openModalNode);
+      return;
+    }
+
+    setMobileNav(false);
+  });
+})();
diff --git a/web-server/server.js b/web-server/server.js
new file mode 100644
index 0000000..61d20eb
--- /dev/null
+++ b/web-server/server.js
@@ -0,0 +1,1205 @@
+require('dotenv').config({ quiet: true });
+
+const crypto = require('crypto');
+const fs = require('fs');
+const fsp = require('fs/promises');
+const path = require('path');
+const express = require('express');
+const multer = require('multer');
+const repository = require('./src/repository');
+const mailer = require('./src/mailer');
+const { closePool } = require('./src/db');
+const notiflixVersion = require('notiflix/package.json').version;
+
+const app = express();
+const port = Number(process.env.PORT || 3000);
+const uploadDir = path.join(__dirname, 'uploads', 'packages');
+const authCookieName = 'robot_installer_session';
+const sessionMaxAgeMs = Number(process.env.SESSION_MAX_AGE_MS || 1000 * 60 * 60 * 8);
+const authSecret = process.env.AUTH_SECRET || process.env.SESSION_SECRET || 'robot-installer-dev-secret';
+
+fs.mkdirSync(uploadDir, { recursive: true });
+
+const navItems = [
+  { id: 'dashboard', label: 'Tổng quan', href: '/', icon: 'dashboard' },
+  { id: 'packages', label: 'Packages', href: '/packages', icon: 'inventory_2' },
+  { id: 'applications', label: 'Applications', href: '/applications', icon: 'apps' },
+  { id: 'builder', label: 'Đóng gói App', href: '/builder', icon: 'deployed_code' },
+  { id: 'users', label: 'Users', href: '/users', icon: 'group', adminOnly: true }
+];
+
+const statusClassMap = {
+  Active: 'badge-success',
+  Latest: 'badge-primary',
+  Stable: 'badge-info',
+  Testing: 'badge-warning',
+  Draft: 'badge-warning',
+  Released: 'badge-success',
+  Archived: 'badge-muted',
+  Deprecated: 'badge-danger',
+  Inactive: 'badge-muted',
+  Admin: 'badge-primary',
+  User: 'badge-info'
+};
+
+const storage = multer.diskStorage({
+  destination: uploadDir,
+  filename(req, file, callback) {
+    const safeName = file.originalname
+      .normalize('NFD')
+      .replace(/[\u0300-\u036f]/g, '')
+      .replace(/[^a-zA-Z0-9._-]/g, '-')
+      .replace(/-+/g, '-')
+      .toLowerCase();
+    const suffix = `${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
+
+    callback(null, `${suffix}-${safeName}`);
+  }
+});
+
+const upload = multer({
+  storage,
+  limits: {
+    fileSize: Number(process.env.MAX_UPLOAD_BYTES || 1024 * 1024 * 1024)
+  }
+});
+
+app.set('view engine', 'ejs');
+app.set('views', path.join(__dirname, 'views'));
+
+app.use(express.urlencoded({ extended: true }));
+app.use(express.static(path.join(__dirname, 'public')));
+app.use('/vendor/notiflix', express.static(path.join(__dirname, 'node_modules/notiflix/dist')));
+app.use(loadCurrentUser);
+
+function helpers() {
+  return {
+    statusClass(status) {
+      return statusClassMap[status] || 'badge-muted';
+    },
+    packageTypeLabel(type) {
+      return type === 'docker' ? 'Docker' : '.deb';
+    },
+    packageTypeClass(type) {
+      return type === 'docker' ? 'badge-info' : 'badge-primary';
+    }
+  };
+}
+
+function getVisibleNavItems(user) {
+  return navItems.filter((item) => !item.adminOnly || (user && user.role === 'Admin'));
+}
+
+function getNotice(req) {
+  if (!req.query.notice) return null;
+
+  return {
+    type: req.query.noticeType || 'info',
+    message: req.query.notice
+  };
+}
+
+function getCurrentPath(req) {
+  const url = new URL(req.originalUrl || '/', 'http://robot-installer.local');
+  url.searchParams.delete('notice');
+  url.searchParams.delete('noticeType');
+
+  return `${url.pathname}${url.search}` || '/';
+}
+
+function viewModel(req, active, title, pageData, extra = {}) {
+  const currentUser = pageData.currentUser || req.currentUser;
+
+  return {
+    active,
+    title,
+    navItems: getVisibleNavItems(currentUser),
+    currentUser,
+    stats: pageData.stats,
+    packages: pageData.packages,
+    applications: pageData.applications,
+    activity: pageData.activity,
+    notiflixVersion,
+    notice: getNotice(req),
+    currentPath: getCurrentPath(req),
+    helpers: helpers(),
+    ...extra
+  };
+}
+
+function authViewModel(req, mode, values = {}) {
+  const formValues = mode === 'register'
+    ? {
+      username: values.username || String(req.query.username || ''),
+      email: values.email || String(req.query.email || ''),
+      fullName: values.fullName || String(req.query.fullName || ''),
+      notice: values.notice
+    }
+    : values;
+
+  return {
+    title: mode === 'register' ? 'Đăng ký' : 'Đăng nhập',
+    mode,
+    notiflixVersion,
+    notice: values.notice || getNotice(req),
+    values: formValues,
+    returnTo: sanitizeReturnTo(req.query.returnTo)
+  };
+}
+
+function confirmEmailViewModel(req, email = '') {
+  return {
+    title: 'Xác nhận email',
+    notiflixVersion,
+    notice: getNotice(req),
+    email
+  };
+}
+
+function renderRegisterWithNotice(req, res, type, message) {
+  const query = new URLSearchParams();
+  const body = req.body || {};
+
+  if (body.username) query.set('username', String(body.username).trim());
+  if (body.email) query.set('email', String(body.email).trim());
+  if (body.fullName) query.set('fullName', String(body.fullName).trim());
+
+  const url = query.toString() ? `/register?${query.toString()}` : '/register';
+  redirectWithNotice(res, url, type, message);
+}
+
+function asyncRoute(handler) {
+  return (req, res, next) => {
+    Promise.resolve(handler(req, res, next)).catch(next);
+  };
+}
+
+function redirectWithNotice(res, url, type, message) {
+  const separator = url.includes('?') ? '&' : '?';
+  res.redirect(`${url}${separator}noticeType=${encodeURIComponent(type)}&notice=${encodeURIComponent(message)}`);
+}
+
+function parseCookies(cookieHeader) {
+  if (!cookieHeader) return {};
+
+  return cookieHeader.split(';').reduce((cookies, pair) => {
+    const index = pair.indexOf('=');
+    if (index === -1) return cookies;
+
+    const key = pair.slice(0, index).trim();
+    const value = pair.slice(index + 1).trim();
+    try {
+      cookies[key] = decodeURIComponent(value);
+    } catch (error) {
+      cookies[key] = value;
+    }
+    return cookies;
+  }, {});
+}
+
+function signSessionPayload(payload) {
+  return crypto
+    .createHmac('sha256', authSecret)
+    .update(payload)
+    .digest('base64url');
+}
+
+function createSessionToken(user) {
+  const payload = Buffer
+    .from(JSON.stringify({
+      sub: user.id,
+      exp: Date.now() + sessionMaxAgeMs
+    }))
+    .toString('base64url');
+  const signature = signSessionPayload(payload);
+
+  return `${payload}.${signature}`;
+}
+
+function verifySessionToken(token) {
+  if (!token || !token.includes('.')) return null;
+
+  const [payload, signature] = token.split('.');
+  const expectedSignature = signSessionPayload(payload);
+  const signatureBuffer = Buffer.from(signature);
+  const expectedSignatureBuffer = Buffer.from(expectedSignature);
+
+  if (
+    signatureBuffer.length !== expectedSignatureBuffer.length
+    || !crypto.timingSafeEqual(signatureBuffer, expectedSignatureBuffer)
+  ) {
+    return null;
+  }
+
+  try {
+    const session = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    if (!session.sub || Number(session.exp) < Date.now()) return null;
+    return session;
+  } catch (error) {
+    return null;
+  }
+}
+
+function setAuthCookie(res, user) {
+  res.cookie(authCookieName, createSessionToken(user), {
+    httpOnly: true,
+    maxAge: sessionMaxAgeMs,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production'
+  });
+}
+
+function clearAuthCookie(res) {
+  res.clearCookie(authCookieName, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production'
+  });
+}
+
+function sanitizeReturnTo(value) {
+  const fallback = '/';
+  if (!value || typeof value !== 'string') return fallback;
+  if (!value.startsWith('/') || value.startsWith('//')) return fallback;
+
+  const [pathname] = value.split('?');
+  if (pathname === '/login' || pathname === '/register') return fallback;
+
+  return value;
+}
+
+function getBaseUrl(req) {
+  if (process.env.APP_BASE_URL) {
+    return process.env.APP_BASE_URL.replace(/\/+$/, '');
+  }
+
+  const forwardedProtocol = req.headers['x-forwarded-proto'];
+  const protocol = forwardedProtocol
+    ? String(forwardedProtocol).split(',')[0].trim()
+    : req.protocol;
+
+  return `${protocol}://${req.get('host')}`;
+}
+
+async function loadCurrentUser(req, res, next) {
+  try {
+    const cookies = parseCookies(req.headers.cookie);
+    const session = verifySessionToken(cookies[authCookieName]);
+
+    if (session) {
+      const user = await repository.getUserById(session.sub);
+      if (user && user.isActive) {
+        req.currentUser = user;
+        res.locals.currentUser = user;
+      } else {
+        clearAuthCookie(res);
+      }
+    }
+
+    next();
+  } catch (error) {
+    next(error);
+  }
+}
+
+function requireAuthenticated(req, res, next) {
+  if (req.currentUser) {
+    next();
+    return;
+  }
+
+  redirectWithNotice(
+    res,
+    `/login?returnTo=${encodeURIComponent(req.originalUrl || '/')}`,
+    'warning',
+    'Vui lòng đăng nhập để tiếp tục.'
+  );
+}
+
+function requireAdmin(req, res, next) {
+  if (req.currentUser && req.currentUser.role === 'Admin') {
+    next();
+    return;
+  }
+
+  redirectWithNotice(res, '/', 'failure', 'Bạn cần quyền Admin để quản lý user.');
+}
+
+function normalizePackageType(value) {
+  return String(value || 'deb').toLowerCase() === 'docker' ? 'docker' : 'deb';
+}
+
+function normalizeApplicationStatus(value) {
+  return ['Draft', 'Released', 'Archived'].includes(value) ? value : 'Draft';
+}
+
+function getArrayField(value) {
+  if (Array.isArray(value)) return value;
+  if (value) return [value];
+  return [];
+}
+
+function getSelectedApplicationPackages(body) {
+  const seenPackageIds = new Set();
+
+  return getArrayField(body.packageIds)
+    .map((packageId) => String(packageId || '').trim())
+    .filter(Boolean)
+    .filter((packageId) => {
+      if (seenPackageIds.has(packageId)) return false;
+      seenPackageIds.add(packageId);
+      return true;
+    })
+    .map((packageId) => ({
+      packageId,
+      selectedVersionId: String(body[`version_${packageId}`] || '').trim() || null
+    }));
+}
+
+function csvCell(value) {
+  const text = String(value ?? '');
+  if (!/[",\r\n]/.test(text)) return text;
+  return `"${text.replace(/"/g, '""')}"`;
+}
+
+function sendCsv(res, filename, rows) {
+  const csv = rows
+    .map((row) => row.map(csvCell).join(','))
+    .join('\r\n');
+
+  res.setHeader('Content-Type', 'text/csv; charset=utf-8');
+  res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+  res.send(`\uFEFF${csv}\r\n`);
+}
+
+async function checksumFile(filePath) {
+  const hash = crypto.createHash('sha256');
+  const stream = fs.createReadStream(filePath);
+
+  for await (const chunk of stream) {
+    hash.update(chunk);
+  }
+
+  return hash.digest('hex');
+}
+
+async function removeUploadedFile(file) {
+  if (!file) return;
+
+  try {
+    await fsp.unlink(file.path);
+  } catch (error) {
+    if (error.code !== 'ENOENT') {
+      console.warn(`Cannot remove uploaded file ${file.path}:`, error.message);
+    }
+  }
+}
+
+async function getArtifactFromUpload(file) {
+  if (!file) {
+    return {
+      filePath: null,
+      checksum: null,
+      fileSizeBytes: null
+    };
+  }
+
+  return {
+    filePath: `/uploads/packages/${file.filename}`,
+    checksum: await checksumFile(file.path),
+    fileSizeBytes: file.size
+  };
+}
+
+async function sendEmailConfirmation(req, user) {
+  const token = await repository.createEmailConfirmationToken(user.id);
+  const confirmUrl = `${getBaseUrl(req)}/confirm-email?token=${encodeURIComponent(token)}`;
+
+  try {
+    return await mailer.sendConfirmationEmail({
+      to: user.email,
+      name: user.name,
+      confirmUrl
+    });
+  } catch (emailError) {
+    console.error('Cannot send confirmation email:', emailError);
+    console.warn(`Email confirmation link for ${user.email}: ${confirmUrl}`);
+    return { sent: false, reason: 'SMTP_SEND_FAILED' };
+  }
+}
+
+app.get('/login', (req, res) => {
+  if (req.currentUser) {
+    res.redirect(sanitizeReturnTo(req.query.returnTo));
+    return;
+  }
+
+  res.render('auth', authViewModel(req, 'login'));
+});
+
+app.post('/login', asyncRoute(async (req, res) => {
+  const returnTo = sanitizeReturnTo(req.body.returnTo);
+  const identifier = String(req.body.identifier || '').trim();
+  const password = String(req.body.password || '');
+
+  if (!identifier || !password) {
+    redirectWithNotice(res, `/login?returnTo=${encodeURIComponent(returnTo)}`, 'warning', 'Vui lòng nhập tài khoản và mật khẩu.');
+    return;
+  }
+
+  const user = await repository.authenticateUser(identifier, password);
+  if (!user) {
+    redirectWithNotice(res, `/login?returnTo=${encodeURIComponent(returnTo)}`, 'failure', 'Tài khoản hoặc mật khẩu không đúng.');
+    return;
+  }
+
+  setAuthCookie(res, user);
+  res.redirect(returnTo);
+}));
+
+app.get('/register', (req, res) => {
+  if (req.currentUser) {
+    res.redirect('/');
+    return;
+  }
+
+  res.render('auth', authViewModel(req, 'register'));
+});
+
+app.get('/register/check', asyncRoute(async (req, res) => {
+  const field = String(req.query.field || '').trim();
+  const value = String(req.query.value || '').trim();
+
+  if (!['username', 'email'].includes(field) || !value) {
+    res.json({
+      available: true,
+      status: 'empty',
+      message: ''
+    });
+    return;
+  }
+
+  const conflict = await repository.getRegistrationConflict({
+    username: field === 'username' ? value : '',
+    email: field === 'email' ? value : ''
+  });
+
+  if (!conflict) {
+    res.json({
+      available: true,
+      status: 'available',
+      message: field === 'email' ? 'Email này có thể sử dụng.' : 'Username này có thể sử dụng.'
+    });
+    return;
+  }
+
+  if (field === 'email' && !conflict.user.isActive) {
+    res.json({
+      available: false,
+      status: 'pending',
+      message: 'Email này đã đăng ký nhưng chưa xác nhận.',
+      resendUrl: `/confirm-email-sent?email=${encodeURIComponent(conflict.user.email)}`
+    });
+    return;
+  }
+
+  res.json({
+    available: false,
+    status: 'taken',
+    message: field === 'email'
+      ? 'Email này đã được sử dụng.'
+      : 'Username này đã được sử dụng.'
+  });
+}));
+
+app.post('/register', asyncRoute(async (req, res) => {
+  if (req.currentUser) {
+    res.redirect('/');
+    return;
+  }
+
+  const username = String(req.body.username || '').trim();
+  const email = String(req.body.email || '').trim();
+  const fullName = String(req.body.fullName || '').trim();
+  const password = String(req.body.password || '');
+  const confirmPassword = String(req.body.confirmPassword || '');
+
+  if (!username || !email || !password) {
+    renderRegisterWithNotice(req, res, 'warning', 'Vui lòng nhập username, email và mật khẩu.');
+    return;
+  }
+
+  if (password.length < 8) {
+    renderRegisterWithNotice(req, res, 'warning', 'Mật khẩu cần tối thiểu 8 ký tự.');
+    return;
+  }
+
+  if (password !== confirmPassword) {
+    renderRegisterWithNotice(req, res, 'warning', 'Xác nhận mật khẩu chưa khớp.');
+    return;
+  }
+
+  try {
+    const conflict = await repository.getRegistrationConflict({ username, email });
+
+    if (conflict) {
+      if (conflict.field === 'email' && !conflict.user.isActive) {
+        redirectWithNotice(
+          res,
+          `/confirm-email-sent?email=${encodeURIComponent(conflict.user.email)}`,
+          'warning',
+          'Email này đã đăng ký nhưng chưa xác nhận. Bạn có thể gửi lại email confirm.'
+        );
+        return;
+      }
+
+      renderRegisterWithNotice(
+        req,
+        res,
+        'warning',
+        conflict.field === 'email'
+          ? 'Email này đã được sử dụng. Vui lòng dùng email khác.'
+          : 'Username này đã được sử dụng. Vui lòng chọn username khác.'
+      );
+      return;
+    }
+
+    const user = await repository.createUser({
+      username,
+      email,
+      fullName,
+      password,
+      isActive: false
+    });
+    const emailResult = await sendEmailConfirmation(req, user);
+    const sentUrl = `/confirm-email-sent?email=${encodeURIComponent(user.email)}`;
+
+    if (!emailResult.sent) {
+      redirectWithNotice(res, sentUrl, 'warning', 'Đã tạo tài khoản nhưng chưa gửi được email xác nhận. Bạn có thể gửi lại email hoặc kiểm tra log server.');
+      return;
+    }
+
+    redirectWithNotice(res, sentUrl, 'success', 'Đăng ký thành công. Vui lòng kiểm tra email để xác nhận tài khoản.');
+  } catch (error) {
+    if (error.code === 'DUPLICATE_USER') {
+      renderRegisterWithNotice(req, res, 'warning', 'Username hoặc email đã tồn tại.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.get('/confirm-email-sent', (req, res) => {
+  if (req.currentUser) {
+    res.redirect('/');
+    return;
+  }
+
+  res.render('confirm-email-sent', confirmEmailViewModel(req, String(req.query.email || '').trim()));
+});
+
+app.post('/resend-confirmation', asyncRoute(async (req, res) => {
+  if (req.currentUser) {
+    res.redirect('/');
+    return;
+  }
+
+  const email = String(req.body.email || '').trim();
+  const sentUrl = `/confirm-email-sent?email=${encodeURIComponent(email)}`;
+
+  if (!email) {
+    redirectWithNotice(res, '/confirm-email-sent', 'warning', 'Vui lòng nhập email đã đăng ký.');
+    return;
+  }
+
+  const pendingUser = await repository.getPendingUserByEmail(email);
+
+  if (!pendingUser) {
+    redirectWithNotice(res, sentUrl, 'warning', 'Email này không có tài khoản đang chờ xác nhận hoặc tài khoản đã active.');
+    return;
+  }
+
+  const emailResult = await sendEmailConfirmation(req, pendingUser);
+  if (!emailResult.sent) {
+    redirectWithNotice(res, sentUrl, 'warning', 'Chưa gửi được email xác nhận. Vui lòng thử lại sau.');
+    return;
+  }
+
+  redirectWithNotice(res, sentUrl, 'success', 'Đã gửi lại email xác nhận. Vui lòng kiểm tra Inbox hoặc Spam.');
+}));
+
+app.get('/confirm-email', asyncRoute(async (req, res) => {
+  const token = String(req.query.token || '').trim();
+
+  if (!token) {
+    redirectWithNotice(res, '/login', 'warning', 'Link xác nhận email không hợp lệ.');
+    return;
+  }
+
+  const user = await repository.confirmEmailToken(token);
+  if (!user) {
+    redirectWithNotice(res, '/login', 'failure', 'Link xác nhận email không hợp lệ hoặc đã hết hạn.');
+    return;
+  }
+
+  setAuthCookie(res, user);
+  redirectWithNotice(res, '/', 'success', 'Email đã được xác nhận. Tài khoản đã được kích hoạt.');
+}));
+
+app.post('/logout', (req, res) => {
+  clearAuthCookie(res);
+  redirectWithNotice(res, '/login', 'success', 'Đã đăng xuất.');
+});
+
+app.use(requireAuthenticated);
+app.use('/uploads', express.static(path.join(__dirname, 'uploads')));
+
+app.post('/profile', asyncRoute(async (req, res) => {
+  const returnTo = sanitizeReturnTo(req.body.returnTo);
+  const fullName = String(req.body.fullName || '').trim();
+  const email = String(req.body.email || '').trim();
+  const confirmEmail = String(req.body.confirmEmail || '').trim();
+  const newPassword = String(req.body.newPassword || '');
+  const confirmPassword = String(req.body.confirmPassword || '');
+  const emailChanged = email.toLowerCase() !== String(req.currentUser.email || '').trim().toLowerCase();
+
+  if (!email) {
+    redirectWithNotice(res, returnTo, 'warning', 'Vui lòng nhập email mới.');
+    return;
+  }
+
+  if (email.toLowerCase() !== confirmEmail.toLowerCase()) {
+    redirectWithNotice(res, returnTo, 'warning', 'Confirm email mới chưa khớp.');
+    return;
+  }
+
+  if ((newPassword || confirmPassword) && newPassword !== confirmPassword) {
+    redirectWithNotice(res, returnTo, 'warning', 'Xác nhận mật khẩu mới chưa khớp.');
+    return;
+  }
+
+  if (newPassword && newPassword.length < 8) {
+    redirectWithNotice(res, returnTo, 'warning', 'Mật khẩu mới cần tối thiểu 8 ký tự.');
+    return;
+  }
+
+  try {
+    const updatedUser = await repository.updateUser({
+      userId: req.currentUser.id,
+      username: req.currentUser.username,
+      email,
+      fullName,
+      role: req.currentUser.role,
+      isActive: emailChanged ? false : req.currentUser.isActive,
+      password: newPassword || null
+    });
+
+    if (emailChanged) {
+      const sentUrl = `/confirm-email-sent?email=${encodeURIComponent(updatedUser.email)}`;
+      const emailResult = await sendEmailConfirmation(req, updatedUser);
+      clearAuthCookie(res);
+
+      if (!emailResult.sent) {
+        redirectWithNotice(res, sentUrl, 'warning', 'Đã cập nhật email mới nhưng chưa gửi được email xác nhận. Bạn có thể gửi lại email hoặc kiểm tra log server.');
+        return;
+      }
+
+      redirectWithNotice(res, sentUrl, 'success', 'Đã cập nhật email mới. Vui lòng kiểm tra email để xác nhận lại tài khoản.');
+      return;
+    }
+
+    redirectWithNotice(
+      res,
+      returnTo,
+      'success',
+      newPassword ? 'Đã cập nhật thông tin cá nhân và mật khẩu.' : 'Đã cập nhật thông tin cá nhân.'
+    );
+  } catch (error) {
+    if (error.code === 'DUPLICATE_USER') {
+      redirectWithNotice(res, returnTo, 'warning', 'Email này đã được sử dụng. Vui lòng dùng email khác.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.get('/', asyncRoute(async (req, res) => {
+  const pageData = await repository.getPageData(req.currentUser);
+  res.render('dashboard', viewModel(req, 'dashboard', 'Tổng quan', pageData));
+}));
+
+app.get('/packages', asyncRoute(async (req, res) => {
+  const pageData = await repository.getPageData(req.currentUser);
+  res.render('packages', viewModel(req, 'packages', 'Packages', pageData));
+}));
+
+app.get('/packages/export.csv', asyncRoute(async (req, res) => {
+  const packages = await repository.listPackages();
+  const rows = [
+    ['PackageCode', 'PackageName', 'PackageType', 'LatestVersion', 'LatestReleaseDate', 'Status', 'Owner', 'Description', 'Artifact'],
+    ...packages.map((packageItem) => [
+      packageItem.code,
+      packageItem.name,
+      packageItem.type,
+      packageItem.latestVersion,
+      packageItem.latestReleaseDate,
+      packageItem.status,
+      packageItem.owner,
+      packageItem.description,
+      packageItem.artifact
+    ])
+  ];
+
+  sendCsv(res, 'packages.csv', rows);
+}));
+
+app.post('/packages', upload.single('packageFile'), asyncRoute(async (req, res) => {
+  try {
+    const artifact = await getArtifactFromUpload(req.file);
+    const packageType = normalizePackageType(req.body.packageType);
+
+    if (!req.body.packageCode || !req.body.packageName || !req.body.version) {
+      await removeUploadedFile(req.file);
+      redirectWithNotice(res, '/packages', 'warning', 'Vui lòng nhập Package code, Package name và Version.');
+      return;
+    }
+
+    await repository.createPackageWithVersion({
+      packageCode: req.body.packageCode.trim(),
+      packageName: req.body.packageName.trim(),
+      packageType,
+      description: req.body.description,
+      version: req.body.version.trim(),
+      releaseDate: req.body.releaseDate,
+      filePath: artifact.filePath,
+      dockerImage: req.body.dockerImage && req.body.dockerImage.trim(),
+      fileSizeBytes: artifact.fileSizeBytes,
+      checksum: artifact.checksum,
+      changeLog: req.body.changeLog,
+      createdByUserId: req.currentUser.id
+    });
+
+    redirectWithNotice(res, '/packages', 'success', 'Đã upload package và lưu vào database.');
+  } catch (error) {
+    await removeUploadedFile(req.file);
+    if (error.code === 'DUPLICATE_PACKAGE') {
+      redirectWithNotice(res, '/packages', 'warning', 'Package code hoặc version đã tồn tại.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.post('/package-versions', upload.single('packageFile'), asyncRoute(async (req, res) => {
+  try {
+    const artifact = await getArtifactFromUpload(req.file);
+
+    if (!req.body.packageId || !req.body.version) {
+      await removeUploadedFile(req.file);
+      redirectWithNotice(res, '/packages', 'warning', 'Vui lòng chọn package và nhập version mới.');
+      return;
+    }
+
+    await repository.addPackageVersion({
+      packageId: req.body.packageId,
+      version: req.body.version.trim(),
+      releaseDate: req.body.releaseDate,
+      filePath: artifact.filePath,
+      dockerImage: req.body.dockerImage && req.body.dockerImage.trim(),
+      fileSizeBytes: artifact.fileSizeBytes,
+      checksum: artifact.checksum,
+      changeLog: req.body.changeLog
+    });
+
+    redirectWithNotice(res, `/packages/${req.body.packageId}`, 'success', 'Đã cập nhật version mới và đặt làm latest.');
+  } catch (error) {
+    await removeUploadedFile(req.file);
+    if (error.code === 'DUPLICATE_PACKAGE') {
+      redirectWithNotice(res, `/packages/${req.body.packageId || ''}`, 'warning', 'Version này đã tồn tại trong package.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.post('/packages/:id/delete', asyncRoute(async (req, res) => {
+  const deleted = await repository.deletePackage(req.params.id);
+
+  redirectWithNotice(
+    res,
+    '/packages',
+    deleted ? 'success' : 'warning',
+    deleted ? 'Đã xóa package và các liên kết database.' : 'Không tìm thấy package cần xóa.'
+  );
+}));
+
+app.post('/package-versions/:id/latest', asyncRoute(async (req, res) => {
+  const returnTo = sanitizeReturnTo(req.body.returnTo || '/packages');
+
+  await repository.setLatestPackageVersion(req.params.id);
+  redirectWithNotice(res, returnTo, 'success', 'Đã đặt version là latest trong database.');
+}));
+
+app.post('/package-versions/:id/delete', asyncRoute(async (req, res) => {
+  const returnTo = sanitizeReturnTo(req.body.returnTo || '/packages');
+  const result = await repository.deletePackageVersion(req.params.id);
+
+  redirectWithNotice(
+    res,
+    result.packageId ? `/packages/${result.packageId}` : returnTo,
+    result.deleted ? 'success' : 'warning',
+    result.deleted ? 'Đã xóa version và các liên kết app đang dùng version đó.' : 'Không tìm thấy version cần xóa.'
+  );
+}));
+
+app.get('/packages/:id', asyncRoute(async (req, res) => {
+  const pageData = await repository.getPageData(req.currentUser);
+  const packageItem = await repository.getPackageById(req.params.id);
+
+  if (!packageItem) {
+    res.status(404).render('not-found', viewModel(req, 'packages', 'Không tìm thấy', pageData));
+    return;
+  }
+
+  res.render(
+    'package-detail',
+    viewModel(req, 'packages', packageItem.name, pageData, { packageItem })
+  );
+}));
+
+app.get('/applications', asyncRoute(async (req, res) => {
+  const pageData = await repository.getPageData(req.currentUser);
+  res.render('applications', viewModel(req, 'applications', 'Applications', pageData));
+}));
+
+app.get('/applications/export.csv', asyncRoute(async (req, res) => {
+  const applications = await repository.listApplications();
+  const rows = [
+    ['AppCode', 'AppName', 'AppVersion', 'Status', 'CreatedAt', 'CreatedBy', 'PackageCount', 'Packages', 'Notes'],
+    ...applications.map((application) => [
+      application.code,
+      application.name,
+      application.version,
+      application.status,
+      application.createdAt,
+      application.createdBy,
+      application.packageCount,
+      application.packages.map((packageItem) => `${packageItem.code}@${packageItem.selectedVersion}`).join('; '),
+      application.notes
+    ])
+  ];
+
+  sendCsv(res, 'applications.csv', rows);
+}));
+
+app.post('/applications', asyncRoute(async (req, res) => {
+  if (!req.body.appCode || !req.body.appName || !req.body.appVersion) {
+    redirectWithNotice(res, '/builder', 'warning', 'Vui lòng nhập App code, App name và App version.');
+    return;
+  }
+
+  try {
+    const applicationId = await repository.createApplication({
+      appCode: req.body.appCode.trim(),
+      appName: req.body.appName.trim(),
+      appVersion: req.body.appVersion.trim(),
+      notes: req.body.notes,
+      status: normalizeApplicationStatus(req.body.status),
+      createdByUserId: req.currentUser.id,
+      packages: getSelectedApplicationPackages(req.body)
+    });
+
+    redirectWithNotice(res, `/applications/${applicationId}`, 'success', 'Đã tạo app và lưu package đã chọn vào database.');
+  } catch (error) {
+    if (error.code === 'DUPLICATE_APPLICATION') {
+      redirectWithNotice(res, '/builder', 'warning', 'App code đã tồn tại.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.post('/applications/:id/edit', asyncRoute(async (req, res) => {
+  const applicationId = String(req.params.id || '').trim();
+  const returnTo = sanitizeReturnTo(req.body.returnTo || `/applications/${applicationId}`);
+
+  if (!req.body.appCode || !req.body.appName || !req.body.appVersion) {
+    redirectWithNotice(res, returnTo, 'warning', 'Vui lòng nhập App code, App name và App version.');
+    return;
+  }
+
+  try {
+    const updatedApplication = await repository.updateApplication({
+      applicationId,
+      appCode: req.body.appCode.trim(),
+      appName: req.body.appName.trim(),
+      appVersion: req.body.appVersion.trim(),
+      notes: req.body.notes,
+      status: normalizeApplicationStatus(req.body.status),
+      packages: getSelectedApplicationPackages(req.body)
+    });
+
+    redirectWithNotice(
+      res,
+      updatedApplication ? returnTo : '/applications',
+      updatedApplication ? 'success' : 'warning',
+      updatedApplication ? 'Đã cập nhật application trong database.' : 'Không tìm thấy app cần cập nhật.'
+    );
+  } catch (error) {
+    if (error.code === 'DUPLICATE_APPLICATION') {
+      redirectWithNotice(res, returnTo, 'warning', 'App code đã tồn tại.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.post('/applications/:id/release', asyncRoute(async (req, res) => {
+  const applicationId = String(req.params.id || '').trim();
+  const returnTo = sanitizeReturnTo(req.body.returnTo || `/applications/${applicationId}`);
+  const updated = await repository.updateApplicationStatus(applicationId, 'Released');
+
+  redirectWithNotice(
+    res,
+    returnTo,
+    updated ? 'success' : 'warning',
+    updated ? 'Đã chuyển application sang Released trong database.' : 'Không tìm thấy app cần release.'
+  );
+}));
+
+app.post('/applications/:id/delete', asyncRoute(async (req, res) => {
+  const deleted = await repository.deleteApplication(req.params.id);
+
+  redirectWithNotice(
+    res,
+    '/applications',
+    deleted ? 'success' : 'warning',
+    deleted ? 'Đã xóa application và các package link.' : 'Không tìm thấy app cần xóa.'
+  );
+}));
+
+app.post('/applications/:id/packages/:packageId/delete', asyncRoute(async (req, res) => {
+  const applicationId = String(req.params.id || '').trim();
+  const removed = await repository.removeApplicationPackage(applicationId, req.params.packageId);
+
+  redirectWithNotice(
+    res,
+    `/applications/${applicationId}`,
+    removed ? 'success' : 'warning',
+    removed ? 'Đã gỡ package khỏi application.' : 'Không tìm thấy package link cần gỡ.'
+  );
+}));
+
+app.get('/applications/:id', asyncRoute(async (req, res) => {
+  const pageData = await repository.getPageData(req.currentUser);
+  const application = await repository.getApplicationById(req.params.id);
+
+  if (!application) {
+    res.status(404).render('not-found', viewModel(req, 'applications', 'Không tìm thấy', pageData));
+    return;
+  }
+
+  res.render(
+    'application-detail',
+    viewModel(req, 'applications', application.name, pageData, { application })
+  );
+}));
+
+app.get('/users', requireAdmin, asyncRoute(async (req, res) => {
+  const [pageData, users] = await Promise.all([
+    repository.getPageData(req.currentUser),
+    repository.listUsers()
+  ]);
+
+  res.render('users', viewModel(req, 'users', 'Users', pageData, { users }));
+}));
+
+app.post('/users', requireAdmin, asyncRoute(async (req, res) => {
+  const username = String(req.body.username || '').trim();
+  const email = String(req.body.email || '').trim();
+  const fullName = String(req.body.fullName || '').trim();
+  const password = String(req.body.password || '');
+  const role = String(req.body.role || 'User') === 'Admin' ? 'Admin' : 'User';
+
+  if (!username || !email || !password) {
+    redirectWithNotice(res, '/users', 'warning', 'Vui lòng nhập username, email và mật khẩu.');
+    return;
+  }
+
+  if (password.length < 8) {
+    redirectWithNotice(res, '/users', 'warning', 'Mật khẩu cần tối thiểu 8 ký tự.');
+    return;
+  }
+
+  try {
+    await repository.createUser({
+      username,
+      email,
+      fullName,
+      password,
+      role
+    });
+
+    redirectWithNotice(res, '/users', 'success', 'Đã tạo user mới.');
+  } catch (error) {
+    if (error.code === 'DUPLICATE_USER') {
+      redirectWithNotice(res, '/users', 'warning', 'Username hoặc email đã tồn tại.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.post('/users/:id', requireAdmin, asyncRoute(async (req, res) => {
+  const userId = String(req.params.id || '').trim();
+  const role = String(req.body.role || 'User') === 'Admin' ? 'Admin' : 'User';
+  const isActive = req.body.isActive === 'on';
+
+  if (userId === req.currentUser.id && (!isActive || role !== 'Admin')) {
+    redirectWithNotice(res, '/users', 'warning', 'Bạn không thể tự hạ quyền hoặc khóa tài khoản Admin đang đăng nhập.');
+    return;
+  }
+
+  await repository.updateUserAccess({
+    userId,
+    role,
+    isActive
+  });
+
+  redirectWithNotice(res, '/users', 'success', 'Đã cập nhật quyền user.');
+}));
+
+app.post('/users/:id/edit', requireAdmin, asyncRoute(async (req, res) => {
+  const userId = String(req.params.id || '').trim();
+  const role = String(req.body.role || 'User') === 'Admin' ? 'Admin' : 'User';
+  const isActive = req.body.isActive === 'on';
+  const newPassword = String(req.body.newPassword || '');
+  const confirmPassword = String(req.body.confirmPassword || '');
+
+  if (!req.body.username || !req.body.email) {
+    redirectWithNotice(res, '/users', 'warning', 'Vui lòng nhập username và email.');
+    return;
+  }
+
+  if (userId === req.currentUser.id && (!isActive || role !== 'Admin')) {
+    redirectWithNotice(res, '/users', 'warning', 'Bạn không thể tự hạ quyền hoặc khóa tài khoản Admin đang đăng nhập.');
+    return;
+  }
+
+  if ((newPassword || confirmPassword) && newPassword !== confirmPassword) {
+    redirectWithNotice(res, '/users', 'warning', 'Xác nhận mật khẩu mới chưa khớp.');
+    return;
+  }
+
+  if (newPassword && newPassword.length < 8) {
+    redirectWithNotice(res, '/users', 'warning', 'Mật khẩu mới cần tối thiểu 8 ký tự.');
+    return;
+  }
+
+  try {
+    await repository.updateUser({
+      userId,
+      username: req.body.username,
+      email: req.body.email,
+      fullName: req.body.fullName,
+      role,
+      isActive,
+      password: newPassword || null
+    });
+
+    redirectWithNotice(
+      res,
+      '/users',
+      'success',
+      newPassword ? 'Đã cập nhật thông tin user và mật khẩu.' : 'Đã cập nhật thông tin user.'
+    );
+  } catch (error) {
+    if (error.code === 'DUPLICATE_USER') {
+      redirectWithNotice(res, '/users', 'warning', 'Username hoặc email đã tồn tại.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.post('/users/:id/delete', requireAdmin, asyncRoute(async (req, res) => {
+  const userId = String(req.params.id || '').trim();
+
+  if (userId === req.currentUser.id) {
+    redirectWithNotice(res, '/users', 'warning', 'Bạn không thể xóa tài khoản đang đăng nhập.');
+    return;
+  }
+
+  try {
+    const deleted = await repository.deleteUser(userId);
+
+    redirectWithNotice(
+      res,
+      '/users',
+      deleted ? 'success' : 'warning',
+      deleted ? 'Đã xóa user.' : 'Không tìm thấy user cần xóa.'
+    );
+  } catch (error) {
+    if (error.code === 'USER_HAS_OWNED_DATA') {
+      redirectWithNotice(res, '/users', 'warning', 'Không thể xóa user đang sở hữu package hoặc application. Hãy khóa tài khoản nếu cần.');
+      return;
+    }
+
+    throw error;
+  }
+}));
+
+app.get('/builder', asyncRoute(async (req, res) => {
+  const pageData = await repository.getPageData(req.currentUser);
+  res.render('builder', viewModel(req, 'builder', 'Đóng gói App', pageData));
+}));
+
+app.use(async (error, req, res, next) => {
+  console.error(error);
+
+  const pageData = await repository.getPageData(req.currentUser).catch(() => ({
+    currentUser: req.currentUser || { name: 'Guest', role: 'Guest', email: '' },
+    stats: {
+      totalPackages: 0,
+      activePackages: 0,
+      totalVersions: 0,
+      totalApplications: 0,
+      releasedApplications: 0
+    },
+    packages: [],
+    applications: [],
+    activity: []
+  }));
+
+  res.status(500).render(
+    'not-found',
+    viewModel(req, 'dashboard', 'Có lỗi xảy ra', pageData, {
+      notice: {
+        type: 'failure',
+        message: 'Không thể xử lý thao tác. Kiểm tra log server để xem chi tiết.'
+      }
+    })
+  );
+});
+
+const server = app.listen(port, () => {
+  console.log(`Robot Installer UI is running at http://localhost:${port}`);
+});
+
+async function shutdown() {
+  server.close(async () => {
+    await closePool();
+    process.exit(0);
+  });
+}
+
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);
diff --git a/web-server/src/db.js b/web-server/src/db.js
new file mode 100644
index 0000000..6846a86
--- /dev/null
+++ b/web-server/src/db.js
@@ -0,0 +1,49 @@
+const sql = require('mssql');
+
+let poolPromise;
+
+function boolFromEnv(value, fallback) {
+  if (value === undefined || value === null || value === '') return fallback;
+  return ['1', 'true', 'yes'].includes(String(value).toLowerCase());
+}
+
+function getConfig() {
+  return {
+    server: process.env.SQLSERVER_HOST || 'localhost',
+    port: Number(process.env.SQLSERVER_PORT || 1433),
+    database: process.env.SQLSERVER_DATABASE || 'RobotInstaller',
+    user: process.env.SQLSERVER_USER,
+    password: process.env.SQLSERVER_PASSWORD,
+    options: {
+      encrypt: boolFromEnv(process.env.SQLSERVER_ENCRYPT, false),
+      trustServerCertificate: boolFromEnv(process.env.SQLSERVER_TRUST_SERVER_CERTIFICATE, true)
+    },
+    pool: {
+      max: 10,
+      min: 0,
+      idleTimeoutMillis: 30000
+    }
+  };
+}
+
+async function getPool() {
+  if (!poolPromise) {
+    poolPromise = sql.connect(getConfig());
+  }
+
+  return poolPromise;
+}
+
+async function closePool() {
+  if (!poolPromise) return;
+
+  const pool = await poolPromise;
+  await pool.close();
+  poolPromise = undefined;
+}
+
+module.exports = {
+  sql,
+  getPool,
+  closePool
+};
diff --git a/web-server/src/mailer.js b/web-server/src/mailer.js
new file mode 100644
index 0000000..b04c7b0
--- /dev/null
+++ b/web-server/src/mailer.js
@@ -0,0 +1,100 @@
+const nodemailer = require('nodemailer');
+
+let transporter;
+
+function boolFromEnv(value, fallback) {
+  if (value === undefined || value === null || value === '') return fallback;
+  return ['1', 'true', 'yes'].includes(String(value).toLowerCase());
+}
+
+function isConfigured() {
+  return Boolean(process.env.SMTP_HOST && process.env.SMTP_USER);
+}
+
+function escapeHtml(value) {
+  return String(value || '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
+function getSenderAddress() {
+  return process.env.MAIL_FROM || process.env.SMTP_USER;
+}
+
+function getTransporter() {
+  if (!isConfigured()) return null;
+
+  if (!transporter) {
+    const port = Number(process.env.SMTP_PORT || 587);
+
+    transporter = nodemailer.createTransport({
+      host: process.env.SMTP_HOST,
+      port,
+      secure: boolFromEnv(process.env.SMTP_SECURE, port === 465),
+      auth: {
+        user: process.env.SMTP_USER,
+        pass: process.env.SMTP_PASSWORD || ''
+      }
+    });
+  }
+
+  return transporter;
+}
+
+async function sendConfirmationEmail({ to, name, confirmUrl }) {
+  const mailTransporter = getTransporter();
+  const safeName = escapeHtml(name || to);
+  const safeConfirmUrl = escapeHtml(confirmUrl);
+
+  if (process.env.NODE_ENV !== 'production') {
+    console.info(`Email confirmation link for ${to}: ${confirmUrl}`);
+  }
+
+  if (!mailTransporter) {
+    console.warn(`SMTP is not configured. Email confirmation link for ${to}: ${confirmUrl}`);
+    return { sent: false, reason: 'SMTP_NOT_CONFIGURED' };
+  }
+
+  const result = await mailTransporter.sendMail({
+    from: getSenderAddress(),
+    to,
+    subject: 'Xác nhận tài khoản Robot Installer',
+    text: [
+      `Xin chào ${name || to},`,
+      '',
+      'Bạn vừa đăng ký tài khoản hoặc cập nhật email Robot Installer.',
+      `Bấm link sau để xác nhận email và kích hoạt tài khoản: ${confirmUrl}`,
+      '',
+      'Nếu bạn không thực hiện đăng ký này, hãy bỏ qua email.'
+    ].join('\n'),
+    html: `
+      <div style="font-family: Arial, sans-serif; color: #172033; line-height: 1.5;">
+        <h2 style="margin: 0 0 12px;">Xác nhận tài khoản Robot Installer</h2>
+        <p>Xin chào ${safeName},</p>
+        <p>Bạn vừa đăng ký tài khoản hoặc cập nhật email Robot Installer. Bấm nút bên dưới để xác nhận email và kích hoạt tài khoản.</p>
+        <p>
+          <a href="${safeConfirmUrl}" style="background: #3755c3; border-radius: 8px; color: #ffffff; display: inline-block; font-weight: 700; padding: 10px 14px; text-decoration: none;">
+            Xác nhận email
+          </a>
+        </p>
+        <p style="color: #566166; font-size: 13px;">Nếu nút không mở được, copy link này vào trình duyệt:<br>${safeConfirmUrl}</p>
+      </div>
+    `
+  });
+
+  console.info('Confirmation email sent:', {
+    to,
+    messageId: result.messageId,
+    accepted: result.accepted,
+    rejected: result.rejected
+  });
+
+  return { sent: true };
+}
+
+module.exports = {
+  sendConfirmationEmail
+};
diff --git a/web-server/src/mock-data.js b/web-server/src/mock-data.js
new file mode 100644
index 0000000..b2b76fb
--- /dev/null
+++ b/web-server/src/mock-data.js
@@ -0,0 +1,137 @@
+const packages = [
+  {
+    id: 'navigation-stack',
+    code: 'NAV-STACK',
+    name: 'Navigation Stack',
+    type: 'deb',
+    latestVersion: '2.4.1',
+    latestReleaseDate: '2026-05-17',
+    status: 'Active',
+    owner: 'Dũng Tào',
+    description: 'Core navigation package for robot route planning and localization.',
+    artifact: '/packages/navigation-stack_2.4.1_amd64.deb',
+    versions: [
+      { version: '2.4.1', releaseDate: '2026-05-17', uploadedBy: 'Dũng Tào', status: 'Latest', size: '84.2 MB', changeLog: 'Improve recovery flow and map alignment.' },
+      { version: '2.4.0', releaseDate: '2026-05-10', uploadedBy: 'Dũng Tào', status: 'Stable', size: '83.8 MB', changeLog: 'Add obstacle avoidance tuning profile.' },
+      { version: '2.3.8', releaseDate: '2026-04-28', uploadedBy: 'QA Robot', status: 'Deprecated', size: '81.6 MB', changeLog: 'Legacy build kept for rollback.' }
+    ]
+  },
+  {
+    id: 'fleet-agent',
+    code: 'FLEET-AGENT',
+    name: 'Fleet Agent',
+    type: 'docker',
+    latestVersion: '1.9.0',
+    latestReleaseDate: '2026-05-16',
+    status: 'Active',
+    owner: 'Minh Anh',
+    description: 'Docker service that connects robot clients to Fleet Manager.',
+    artifact: 'registry.local/robot/fleet-agent:1.9.0',
+    versions: [
+      { version: '1.9.0', releaseDate: '2026-05-16', uploadedBy: 'Minh Anh', status: 'Latest', size: '412 MB', changeLog: 'Add heartbeat metrics and websocket retry.' },
+      { version: '1.8.2', releaseDate: '2026-05-01', uploadedBy: 'Minh Anh', status: 'Stable', size: '405 MB', changeLog: 'Fix token renewal after sleep.' }
+    ]
+  },
+  {
+    id: 'map-sync',
+    code: 'MAP-SYNC',
+    name: 'Map Sync Service',
+    type: 'docker',
+    latestVersion: '3.1.2',
+    latestReleaseDate: '2026-05-12',
+    status: 'Active',
+    owner: 'Hải Nam',
+    description: 'Synchronizes robot map revisions between web server and edge clients.',
+    artifact: 'registry.local/robot/map-sync:3.1.2',
+    versions: [
+      { version: '3.1.2', releaseDate: '2026-05-12', uploadedBy: 'Hải Nam', status: 'Latest', size: '268 MB', changeLog: 'Compress map snapshot before upload.' },
+      { version: '3.0.5', releaseDate: '2026-04-22', uploadedBy: 'Hải Nam', status: 'Stable', size: '251 MB', changeLog: 'Improve checksum validation.' }
+    ]
+  },
+  {
+    id: 'ui-kiosk',
+    code: 'UI-KIOSK',
+    name: 'Robot Kiosk UI',
+    type: 'deb',
+    latestVersion: '0.8.6',
+    latestReleaseDate: '2026-05-08',
+    status: 'Testing',
+    owner: 'Linh Phạm',
+    description: 'Touch-screen UI package for robot kiosk mode.',
+    artifact: '/packages/robot-kiosk-ui_0.8.6_amd64.deb',
+    versions: [
+      { version: '0.8.6', releaseDate: '2026-05-08', uploadedBy: 'Linh Phạm', status: 'Latest', size: '62.4 MB', changeLog: 'Refine operator handoff screens.' },
+      { version: '0.8.3', releaseDate: '2026-04-19', uploadedBy: 'Linh Phạm', status: 'Deprecated', size: '59.9 MB', changeLog: 'Initial kiosk dashboard.' }
+    ]
+  }
+];
+
+const applications = [
+  {
+    id: 'warehouse-basic',
+    code: 'APP-WH-BASIC',
+    name: 'Warehouse Basic',
+    version: '1.2.0',
+    status: 'Released',
+    createdAt: '2026-05-18',
+    createdBy: 'Dũng Tào',
+    notes: 'Base package set for warehouse robots.',
+    packages: [
+      { code: 'NAV-STACK', name: 'Navigation Stack', type: 'deb', selectedVersion: '2.4.1' },
+      { code: 'FLEET-AGENT', name: 'Fleet Agent', type: 'docker', selectedVersion: '1.9.0' },
+      { code: 'MAP-SYNC', name: 'Map Sync Service', type: 'docker', selectedVersion: '3.1.2' }
+    ]
+  },
+  {
+    id: 'kiosk-demo',
+    code: 'APP-KIOSK-DEMO',
+    name: 'Kiosk Demo',
+    version: '0.4.0',
+    status: 'Draft',
+    createdAt: '2026-05-16',
+    createdBy: 'Linh Phạm',
+    notes: 'Demo bundle for touch kiosk testing.',
+    packages: [
+      { code: 'UI-KIOSK', name: 'Robot Kiosk UI', type: 'deb', selectedVersion: '0.8.6' },
+      { code: 'NAV-STACK', name: 'Navigation Stack', type: 'deb', selectedVersion: '2.4.0' }
+    ]
+  },
+  {
+    id: 'fleet-edge',
+    code: 'APP-FLEET-EDGE',
+    name: 'Fleet Edge',
+    version: '2.0.1',
+    status: 'Released',
+    createdAt: '2026-05-11',
+    createdBy: 'Minh Anh',
+    notes: 'Fleet manager edge runtime.',
+    packages: [
+      { code: 'FLEET-AGENT', name: 'Fleet Agent', type: 'docker', selectedVersion: '1.9.0' },
+      { code: 'MAP-SYNC', name: 'Map Sync Service', type: 'docker', selectedVersion: '3.0.5' }
+    ]
+  }
+];
+
+const activity = [
+  { title: 'Upload version 2.4.1', detail: 'Navigation Stack được đặt là latest', time: '09:25', icon: 'upload_file' },
+  { title: 'Release Warehouse Basic', detail: 'App version 1.2.0 đã sẵn sàng đóng gói', time: 'Hôm qua', icon: 'task_alt' },
+  { title: 'Update Fleet Agent', detail: 'Thêm heartbeat metrics cho Docker image', time: '16/05', icon: 'sync' }
+];
+
+module.exports = {
+  currentUser: {
+    name: 'Dũng Tào',
+    role: 'Admin',
+    email: 'admin@robotics.local'
+  },
+  packages,
+  applications,
+  activity,
+  stats: {
+    totalPackages: packages.length,
+    activePackages: packages.filter((item) => item.status === 'Active').length,
+    totalVersions: packages.reduce((total, item) => total + item.versions.length, 0),
+    totalApplications: applications.length,
+    releasedApplications: applications.filter((item) => item.status === 'Released').length
+  }
+};
diff --git a/web-server/src/repository.js b/web-server/src/repository.js
new file mode 100644
index 0000000..07b5658
--- /dev/null
+++ b/web-server/src/repository.js
@@ -0,0 +1,1231 @@
+const crypto = require('crypto');
+const { sql, getPool } = require('./db');
+
+const PASSWORD_HASH_PREFIX = 'pbkdf2';
+const PASSWORD_HASH_ITERATIONS = 120000;
+const PASSWORD_HASH_KEY_LENGTH = 32;
+const PASSWORD_HASH_DIGEST = 'sha256';
+const PLACEHOLDER_PASSWORD_HASH = 'ui-placeholder-password-hash';
+const EMAIL_CONFIRMATION_EXPIRES_MS = Number(process.env.EMAIL_CONFIRMATION_EXPIRES_MS || 1000 * 60 * 60 * 24);
+
+let emailConfirmationSchemaPromise;
+
+function toDateInputValue(value) {
+  const date = value ? new Date(value) : new Date();
+  if (Number.isNaN(date.getTime())) return new Date().toISOString().slice(0, 10);
+  return date.toISOString().slice(0, 10);
+}
+
+function formatDate(value) {
+  if (!value) return '';
+  return toDateInputValue(value);
+}
+
+function formatFileSize(bytes) {
+  if (!Number.isFinite(Number(bytes)) || Number(bytes) <= 0) return '';
+
+  const numericBytes = Number(bytes);
+  const units = ['B', 'KB', 'MB', 'GB'];
+  const index = Math.min(Math.floor(Math.log(numericBytes) / Math.log(1024)), units.length - 1);
+  const value = numericBytes / Math.pow(1024, index);
+
+  return `${value.toFixed(value >= 10 || index === 0 ? 0 : 1)} ${units[index]}`;
+}
+
+function normalizeRole(role) {
+  return role === 'Admin' ? 'Admin' : 'User';
+}
+
+function normalizeEmail(email) {
+  return String(email || '').trim().toLowerCase();
+}
+
+function isPasswordHashUsable(passwordHash) {
+  return String(passwordHash || '').startsWith(`${PASSWORD_HASH_PREFIX}$`);
+}
+
+function hashPassword(password) {
+  const salt = crypto.randomBytes(16).toString('base64url');
+  const hash = crypto.pbkdf2Sync(
+    password,
+    salt,
+    PASSWORD_HASH_ITERATIONS,
+    PASSWORD_HASH_KEY_LENGTH,
+    PASSWORD_HASH_DIGEST
+  ).toString('base64url');
+
+  return `${PASSWORD_HASH_PREFIX}$${PASSWORD_HASH_DIGEST}$${PASSWORD_HASH_ITERATIONS}$${salt}$${hash}`;
+}
+
+function verifyPassword(password, storedHash) {
+  if (!isPasswordHashUsable(storedHash)) return false;
+
+  const [prefix, digest, iterationsText, salt, expectedHash] = String(storedHash).split('$');
+  const iterations = Number(iterationsText);
+
+  if (prefix !== PASSWORD_HASH_PREFIX || !digest || !iterations || !salt || !expectedHash) {
+    return false;
+  }
+
+  try {
+    const actualHash = crypto.pbkdf2Sync(
+      password,
+      salt,
+      iterations,
+      Buffer.from(expectedHash, 'base64url').length,
+      digest
+    ).toString('base64url');
+    const actualBuffer = Buffer.from(actualHash);
+    const expectedBuffer = Buffer.from(expectedHash);
+
+    return actualBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(actualBuffer, expectedBuffer);
+  } catch (error) {
+    return false;
+  }
+}
+
+function mapCurrentUserRow(row) {
+  if (!row) return null;
+
+  return {
+    id: String(row.Id),
+    username: row.Username,
+    email: row.Email,
+    name: row.FullName || row.Username,
+    fullName: row.FullName || '',
+    role: row.Role,
+    isActive: Boolean(row.IsActive)
+  };
+}
+
+function mapUserRow(row) {
+  return {
+    ...mapCurrentUserRow(row),
+    status: row.IsActive ? 'Active' : 'Inactive',
+    createdAt: formatDate(row.CreatedAt),
+    updatedAt: formatDate(row.UpdatedAt),
+    packageCount: Number(row.PackageCount || 0),
+    applicationCount: Number(row.ApplicationCount || 0)
+  };
+}
+
+function duplicateUserError() {
+  const error = new Error('Username or email already exists.');
+  error.code = 'DUPLICATE_USER';
+  return error;
+}
+
+function duplicatePackageError() {
+  const error = new Error('Package code or version already exists.');
+  error.code = 'DUPLICATE_PACKAGE';
+  return error;
+}
+
+function duplicateApplicationError() {
+  const error = new Error('Application code already exists.');
+  error.code = 'DUPLICATE_APPLICATION';
+  return error;
+}
+
+function userHasOwnedDataError() {
+  const error = new Error('User owns packages or applications.');
+  error.code = 'USER_HAS_OWNED_DATA';
+  return error;
+}
+
+function hashEmailToken(token) {
+  return crypto.createHash('sha256').update(String(token || '')).digest('hex');
+}
+
+async function ensureEmailConfirmationSchema() {
+  if (!emailConfirmationSchemaPromise) {
+    emailConfirmationSchemaPromise = getPool().then((pool) => pool.request().query(`
+      IF OBJECT_ID(N'dbo.EmailConfirmationTokens', N'U') IS NULL
+      BEGIN
+        CREATE TABLE dbo.EmailConfirmationTokens
+        (
+          Id UNIQUEIDENTIFIER NOT NULL
+            CONSTRAINT PK_EmailConfirmationTokens PRIMARY KEY CLUSTERED
+            CONSTRAINT DF_EmailConfirmationTokens_Id DEFAULT NEWSEQUENTIALID(),
+          UserId UNIQUEIDENTIFIER NOT NULL,
+          TokenHash CHAR(64) NOT NULL,
+          ExpiresAt DATETIME2(3) NOT NULL,
+          ConfirmedAt DATETIME2(3) NULL,
+          CreatedAt DATETIME2(3) NOT NULL
+            CONSTRAINT DF_EmailConfirmationTokens_CreatedAt DEFAULT SYSUTCDATETIME(),
+          CONSTRAINT FK_EmailConfirmationTokens_User
+            FOREIGN KEY (UserId) REFERENCES dbo.Users(Id) ON DELETE CASCADE
+        );
+      END;
+
+      IF NOT EXISTS (
+        SELECT 1
+        FROM sys.indexes
+        WHERE name = N'UX_EmailConfirmationTokens_TokenHash'
+          AND object_id = OBJECT_ID(N'dbo.EmailConfirmationTokens')
+      )
+      BEGIN
+        CREATE UNIQUE INDEX UX_EmailConfirmationTokens_TokenHash
+        ON dbo.EmailConfirmationTokens(TokenHash);
+      END;
+
+      IF NOT EXISTS (
+        SELECT 1
+        FROM sys.indexes
+        WHERE name = N'IX_EmailConfirmationTokens_UserId'
+          AND object_id = OBJECT_ID(N'dbo.EmailConfirmationTokens')
+      )
+      BEGIN
+        CREATE INDEX IX_EmailConfirmationTokens_UserId
+        ON dbo.EmailConfirmationTokens(UserId);
+      END;
+    `));
+  }
+
+  return emailConfirmationSchemaPromise;
+}
+
+function normalizePackageStatus(isActive) {
+  return isActive ? 'Active' : 'Archived';
+}
+
+function normalizeApplicationStatus(status) {
+  return ['Draft', 'Released', 'Archived'].includes(status) ? status : 'Draft';
+}
+
+function normalizeVersionStatus(row) {
+  if (row.IsLatest) return 'Latest';
+  if (row.IsDeprecated) return 'Deprecated';
+  return 'Stable';
+}
+
+function mapPackageRow(row) {
+  return {
+    id: String(row.Id),
+    code: row.PackageCode,
+    name: row.PackageName,
+    type: row.PackageType,
+    latestVersion: row.LatestVersion || '',
+    latestReleaseDate: formatDate(row.LatestReleaseDate),
+    status: normalizePackageStatus(row.IsActive),
+    owner: row.CreatedByUsername || '',
+    description: row.Description || '',
+    artifact: row.LatestFilePath || row.LatestDockerImage || '',
+    versionCount: Number(row.VersionCount || 0),
+    versions: []
+  };
+}
+
+function mapVersionRow(row) {
+  return {
+    id: String(row.Id),
+    packageId: String(row.PackageId),
+    version: row.Version,
+    releaseDate: formatDate(row.ReleaseDate),
+    uploadedBy: row.UploadedBy || '',
+    status: normalizeVersionStatus(row),
+    size: formatFileSize(row.FileSizeBytes),
+    changeLog: row.ChangeLog || '',
+    filePath: row.FilePath || '',
+    dockerImage: row.DockerImage || '',
+    checksum: row.FileChecksumSha256 || ''
+  };
+}
+
+function mapApplicationRow(row) {
+  return {
+    id: String(row.Id),
+    code: row.AppCode,
+    name: row.AppName,
+    version: row.AppVersion,
+    status: row.Status,
+    createdAt: formatDate(row.CreatedAt),
+    createdBy: row.CreatedByUsername || '',
+    notes: row.Notes || row.Description || '',
+    packageCount: Number(row.PackageCount || 0),
+    packages: []
+  };
+}
+
+function mapApplicationPackageRow(row) {
+  return {
+    id: String(row.Id),
+    applicationId: String(row.ApplicationId),
+    packageId: String(row.PackageId),
+    code: row.PackageCode,
+    name: row.PackageName,
+    type: row.PackageType,
+    selectedVersionId: row.SelectedVersionId ? String(row.SelectedVersionId) : '',
+    selectedVersion: row.SelectedVersion || '',
+    filePath: row.FilePath || '',
+    dockerImage: row.DockerImage || ''
+  };
+}
+
+async function getUserById(id) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('Id', sql.NVarChar(100), id)
+    .query(`
+      SELECT TOP (1) Id, Username, Email, FullName, Role, IsActive
+      FROM dbo.Users
+      WHERE CONVERT(NVARCHAR(36), Id) = @Id;
+    `);
+
+  return mapCurrentUserRow(result.recordset[0]);
+}
+
+async function getUserOwnershipCounts(userId) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('UserId', sql.UniqueIdentifier, userId)
+    .query(`
+      SELECT
+        (SELECT COUNT_BIG(*) FROM dbo.Packages WHERE CreatedByUserId = @UserId) AS PackageCount,
+        (SELECT COUNT_BIG(*) FROM dbo.Applications WHERE CreatedByUserId = @UserId) AS ApplicationCount;
+    `);
+  const row = result.recordset[0];
+
+  return {
+    packageCount: Number(row.PackageCount || 0),
+    applicationCount: Number(row.ApplicationCount || 0)
+  };
+}
+
+async function listUsers() {
+  const pool = await getPool();
+  const result = await pool.request().query(`
+    SELECT
+      u.Id,
+      u.Username,
+      u.Email,
+      u.FullName,
+      u.Role,
+      u.IsActive,
+      u.CreatedAt,
+      u.UpdatedAt,
+      package_count.PackageCount,
+      application_count.ApplicationCount
+    FROM dbo.Users AS u
+    OUTER APPLY (
+      SELECT COUNT_BIG(*) AS PackageCount
+      FROM dbo.Packages AS p
+      WHERE p.CreatedByUserId = u.Id
+    ) AS package_count
+    OUTER APPLY (
+      SELECT COUNT_BIG(*) AS ApplicationCount
+      FROM dbo.Applications AS a
+      WHERE a.CreatedByUserId = u.Id
+    ) AS application_count
+    ORDER BY u.CreatedAt DESC, u.Username ASC;
+  `);
+
+  return result.recordset.map(mapUserRow);
+}
+
+async function countUsableUsers() {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('PasswordHashPrefix', sql.NVarChar(50), `${PASSWORD_HASH_PREFIX}$%`)
+    .query(`
+      SELECT COUNT_BIG(*) AS Total
+      FROM dbo.Users
+      WHERE PasswordHash LIKE @PasswordHashPrefix;
+    `);
+
+  return Number(result.recordset[0].Total || 0);
+}
+
+async function findUserAccountByIdentifier(identifier) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('Identifier', sql.NVarChar(255), String(identifier || '').trim())
+    .query(`
+      SELECT TOP (1) Id, Username, Email, PasswordHash, FullName, Role, IsActive
+      FROM dbo.Users
+      WHERE Username = @Identifier OR Email = @Identifier;
+    `);
+
+  return result.recordset[0] || null;
+}
+
+async function getPendingUserByEmail(email) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('Email', sql.NVarChar(255), normalizeEmail(email))
+    .input('PasswordHashPrefix', sql.NVarChar(50), `${PASSWORD_HASH_PREFIX}$%`)
+    .query(`
+      SELECT TOP (1) Id, Username, Email, FullName, Role, IsActive
+      FROM dbo.Users
+      WHERE Email = @Email
+        AND IsActive = 0
+        AND PasswordHash LIKE @PasswordHashPrefix;
+    `);
+
+  return mapCurrentUserRow(result.recordset[0]);
+}
+
+async function getRegistrationConflict({ username, email }) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('Username', sql.NVarChar(100), String(username || '').trim())
+    .input('Email', sql.NVarChar(255), normalizeEmail(email))
+    .query(`
+      SELECT TOP (1) Id, Username, Email, FullName, Role, IsActive
+      FROM dbo.Users
+      WHERE Username = @Username OR Email = @Email
+      ORDER BY
+        CASE
+          WHEN Email = @Email THEN 0
+          WHEN Username = @Username THEN 1
+          ELSE 2
+        END,
+        CreatedAt ASC;
+    `);
+  const user = mapCurrentUserRow(result.recordset[0]);
+
+  if (!user) return null;
+
+  return {
+    user,
+    field: normalizeEmail(user.email) === normalizeEmail(email) ? 'email' : 'username'
+  };
+}
+
+async function authenticateUser(identifier, password) {
+  const row = await findUserAccountByIdentifier(identifier);
+  if (!row || !row.IsActive) return null;
+  if (!verifyPassword(String(password || ''), row.PasswordHash)) return null;
+
+  return mapCurrentUserRow(row);
+}
+
+async function createUser(input) {
+  const pool = await getPool();
+  const username = String(input.username || '').trim();
+  const email = normalizeEmail(input.email);
+  const fullName = String(input.fullName || '').trim() || null;
+  const passwordHash = hashPassword(String(input.password || ''));
+  const usableUserCount = await countUsableUsers();
+  const role = input.role ? normalizeRole(input.role) : (usableUserCount === 0 ? 'Admin' : 'User');
+  const isActive = input.isActive === undefined ? true : Boolean(input.isActive);
+
+  const existingResult = await pool.request()
+    .input('Username', sql.NVarChar(100), username)
+    .input('Email', sql.NVarChar(255), email)
+    .query(`
+      SELECT TOP (1) Id, PasswordHash
+      FROM dbo.Users
+      WHERE Username = @Username OR Email = @Email;
+    `);
+  const existing = existingResult.recordset[0];
+
+  if (existing) {
+    if (usableUserCount === 0 && existing.PasswordHash === PLACEHOLDER_PASSWORD_HASH) {
+      const updateResult = await pool.request()
+        .input('Id', sql.UniqueIdentifier, existing.Id)
+        .input('Username', sql.NVarChar(100), username)
+        .input('Email', sql.NVarChar(255), email)
+        .input('PasswordHash', sql.NVarChar(500), passwordHash)
+        .input('FullName', sql.NVarChar(200), fullName)
+        .input('Role', sql.NVarChar(50), role)
+        .input('IsActive', sql.Bit, isActive ? 1 : 0)
+        .query(`
+          UPDATE dbo.Users
+          SET Username = @Username,
+              Email = @Email,
+              PasswordHash = @PasswordHash,
+              FullName = @FullName,
+              Role = @Role,
+              IsActive = @IsActive,
+              UpdatedAt = SYSUTCDATETIME()
+          OUTPUT inserted.Id, inserted.Username, inserted.Email, inserted.FullName, inserted.Role, inserted.IsActive
+          WHERE Id = @Id;
+        `);
+
+      return mapCurrentUserRow(updateResult.recordset[0]);
+    }
+
+    throw duplicateUserError();
+  }
+
+  if (usableUserCount === 0) {
+    const placeholderResult = await pool.request()
+      .input('PasswordHash', sql.NVarChar(500), PLACEHOLDER_PASSWORD_HASH)
+      .query(`
+        SELECT TOP (1) Id
+        FROM dbo.Users
+        WHERE PasswordHash = @PasswordHash
+        ORDER BY CreatedAt ASC;
+      `);
+    const placeholder = placeholderResult.recordset[0];
+
+    if (placeholder) {
+      const updateResult = await pool.request()
+        .input('Id', sql.UniqueIdentifier, placeholder.Id)
+        .input('Username', sql.NVarChar(100), username)
+        .input('Email', sql.NVarChar(255), email)
+        .input('PasswordHash', sql.NVarChar(500), passwordHash)
+        .input('FullName', sql.NVarChar(200), fullName)
+        .input('Role', sql.NVarChar(50), role)
+        .input('IsActive', sql.Bit, isActive ? 1 : 0)
+        .query(`
+          UPDATE dbo.Users
+          SET Username = @Username,
+              Email = @Email,
+              PasswordHash = @PasswordHash,
+              FullName = @FullName,
+              Role = @Role,
+              IsActive = @IsActive,
+              UpdatedAt = SYSUTCDATETIME()
+          OUTPUT inserted.Id, inserted.Username, inserted.Email, inserted.FullName, inserted.Role, inserted.IsActive
+          WHERE Id = @Id;
+        `);
+
+      return mapCurrentUserRow(updateResult.recordset[0]);
+    }
+  }
+
+  try {
+    const result = await pool.request()
+      .input('Username', sql.NVarChar(100), username)
+      .input('Email', sql.NVarChar(255), email)
+      .input('PasswordHash', sql.NVarChar(500), passwordHash)
+      .input('FullName', sql.NVarChar(200), fullName)
+      .input('Role', sql.NVarChar(50), role)
+      .input('IsActive', sql.Bit, isActive ? 1 : 0)
+      .query(`
+        INSERT dbo.Users (Username, Email, PasswordHash, FullName, Role, IsActive)
+        OUTPUT inserted.Id, inserted.Username, inserted.Email, inserted.FullName, inserted.Role, inserted.IsActive
+        VALUES (@Username, @Email, @PasswordHash, @FullName, @Role, @IsActive);
+      `);
+
+    return mapCurrentUserRow(result.recordset[0]);
+  } catch (error) {
+    if (error.number === 2601 || error.number === 2627) {
+      throw duplicateUserError();
+    }
+
+    throw error;
+  }
+}
+
+async function createEmailConfirmationToken(userId) {
+  await ensureEmailConfirmationSchema();
+
+  const pool = await getPool();
+  const token = crypto.randomBytes(32).toString('base64url');
+  const tokenHash = hashEmailToken(token);
+  const expiresAt = new Date(Date.now() + EMAIL_CONFIRMATION_EXPIRES_MS);
+
+  await pool.request()
+    .input('UserId', sql.UniqueIdentifier, userId)
+    .input('TokenHash', sql.Char(64), tokenHash)
+    .input('ExpiresAt', sql.DateTime2, expiresAt)
+    .query(`
+      DELETE FROM dbo.EmailConfirmationTokens
+      WHERE UserId = @UserId
+        AND ConfirmedAt IS NULL;
+
+      INSERT dbo.EmailConfirmationTokens (UserId, TokenHash, ExpiresAt)
+      VALUES (@UserId, @TokenHash, @ExpiresAt);
+    `);
+
+  return token;
+}
+
+async function confirmEmailToken(token) {
+  await ensureEmailConfirmationSchema();
+
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('TokenHash', sql.Char(64), hashEmailToken(token))
+    .query(`
+      SET NOCOUNT ON;
+      SET XACT_ABORT ON;
+
+      BEGIN TRANSACTION;
+
+      DECLARE @TokenId UNIQUEIDENTIFIER;
+      DECLARE @UserId UNIQUEIDENTIFIER;
+
+      SELECT TOP (1)
+        @TokenId = Id,
+        @UserId = UserId
+      FROM dbo.EmailConfirmationTokens WITH (UPDLOCK, HOLDLOCK)
+      WHERE TokenHash = @TokenHash
+        AND ConfirmedAt IS NULL
+        AND ExpiresAt >= SYSUTCDATETIME();
+
+      IF @TokenId IS NULL
+      BEGIN
+        COMMIT TRANSACTION;
+        SELECT TOP (0) Id, Username, Email, FullName, Role, IsActive
+        FROM dbo.Users;
+        RETURN;
+      END;
+
+      UPDATE dbo.EmailConfirmationTokens
+      SET ConfirmedAt = SYSUTCDATETIME()
+      WHERE Id = @TokenId;
+
+      UPDATE dbo.Users
+      SET IsActive = 1,
+          UpdatedAt = SYSUTCDATETIME()
+      OUTPUT inserted.Id, inserted.Username, inserted.Email, inserted.FullName, inserted.Role, inserted.IsActive
+      WHERE Id = @UserId;
+
+      COMMIT TRANSACTION;
+    `);
+
+  return mapCurrentUserRow(result.recordset[0]);
+}
+
+async function updateUserAccess(input) {
+  const pool = await getPool();
+  await pool.request()
+    .input('Id', sql.UniqueIdentifier, input.userId)
+    .input('Role', sql.NVarChar(50), normalizeRole(input.role))
+    .input('IsActive', sql.Bit, input.isActive ? 1 : 0)
+    .query(`
+      UPDATE dbo.Users
+      SET Role = @Role,
+          IsActive = @IsActive,
+          UpdatedAt = SYSUTCDATETIME()
+      WHERE Id = @Id;
+    `);
+}
+
+async function updateUser(input) {
+  const pool = await getPool();
+  const username = String(input.username || '').trim();
+  const email = normalizeEmail(input.email);
+  const fullName = String(input.fullName || '').trim() || null;
+  const role = normalizeRole(input.role);
+  const isActive = input.isActive ? 1 : 0;
+  const passwordHash = input.password ? hashPassword(String(input.password)) : null;
+
+  const existingResult = await pool.request()
+    .input('Id', sql.UniqueIdentifier, input.userId)
+    .input('Username', sql.NVarChar(100), username)
+    .input('Email', sql.NVarChar(255), email)
+    .query(`
+      SELECT TOP (1) Id
+      FROM dbo.Users
+      WHERE (Username = @Username OR Email = @Email)
+        AND Id <> @Id;
+    `);
+
+  if (existingResult.recordset.length > 0) {
+    throw duplicateUserError();
+  }
+
+  const result = await pool.request()
+    .input('Id', sql.UniqueIdentifier, input.userId)
+    .input('Username', sql.NVarChar(100), username)
+    .input('Email', sql.NVarChar(255), email)
+    .input('FullName', sql.NVarChar(200), fullName)
+    .input('Role', sql.NVarChar(50), role)
+    .input('IsActive', sql.Bit, isActive)
+    .input('PasswordHash', sql.NVarChar(500), passwordHash)
+    .query(`
+      UPDATE dbo.Users
+      SET Username = @Username,
+          Email = @Email,
+          FullName = @FullName,
+          Role = @Role,
+          IsActive = @IsActive,
+          PasswordHash = COALESCE(@PasswordHash, PasswordHash),
+          UpdatedAt = SYSUTCDATETIME()
+      OUTPUT inserted.Id, inserted.Username, inserted.Email, inserted.FullName, inserted.Role, inserted.IsActive
+      WHERE Id = @Id;
+    `);
+
+  return mapCurrentUserRow(result.recordset[0]);
+}
+
+async function deleteUser(userId) {
+  const counts = await getUserOwnershipCounts(userId);
+
+  if (counts.packageCount > 0 || counts.applicationCount > 0) {
+    throw userHasOwnedDataError();
+  }
+
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('Id', sql.UniqueIdentifier, userId)
+    .query(`
+      DELETE FROM dbo.Users
+      OUTPUT deleted.Id
+      WHERE Id = @Id;
+    `);
+
+  return result.recordset.length > 0;
+}
+
+async function listPackages() {
+  const pool = await getPool();
+  const result = await pool.request().query(`
+    SELECT *
+    FROM dbo.vw_PackageList
+    ORDER BY CreatedAt DESC, PackageName ASC;
+  `);
+
+  return result.recordset.map(mapPackageRow);
+}
+
+async function listPackageVersions() {
+  const pool = await getPool();
+  const result = await pool.request().query(`
+    SELECT *
+    FROM dbo.vw_PackageVersionList
+    ORDER BY PackageId, IsLatest DESC, ReleaseDate DESC, UploadedAt DESC;
+  `);
+
+  return result.recordset.map(mapVersionRow);
+}
+
+async function attachPackageVersions(packages) {
+  if (packages.length === 0) return packages;
+
+  const versions = await listPackageVersions();
+  const versionsByPackageId = new Map();
+
+  versions.forEach((version) => {
+    if (!versionsByPackageId.has(version.packageId)) {
+      versionsByPackageId.set(version.packageId, []);
+    }
+
+    versionsByPackageId.get(version.packageId).push(version);
+  });
+
+  return packages.map((packageItem) => ({
+    ...packageItem,
+    versions: versionsByPackageId.get(packageItem.id) || []
+  }));
+}
+
+async function getPackageById(id) {
+  const pool = await getPool();
+  const packageResult = await pool.request()
+    .input('Id', sql.NVarChar(100), id)
+    .query(`
+      SELECT TOP (1) *
+      FROM dbo.vw_PackageList
+      WHERE CONVERT(NVARCHAR(36), Id) = @Id OR PackageCode = @Id;
+    `);
+
+  if (packageResult.recordset.length === 0) return null;
+
+  const packageItem = mapPackageRow(packageResult.recordset[0]);
+  const versions = await pool.request()
+    .input('PackageId', sql.UniqueIdentifier, packageItem.id)
+    .query(`
+      SELECT *
+      FROM dbo.vw_PackageVersionList
+      WHERE PackageId = @PackageId
+      ORDER BY IsLatest DESC, ReleaseDate DESC, UploadedAt DESC;
+    `);
+
+  packageItem.versions = versions.recordset.map(mapVersionRow);
+  return packageItem;
+}
+
+async function listApplications() {
+  const pool = await getPool();
+  const result = await pool.request().query(`
+    SELECT *
+    FROM dbo.vw_ApplicationList
+    ORDER BY CreatedAt DESC, AppName ASC;
+  `);
+
+  const applications = result.recordset.map(mapApplicationRow);
+  return attachApplicationPackages(applications);
+}
+
+async function listApplicationPackages(applicationId) {
+  const pool = await getPool();
+  const request = pool.request();
+  let whereClause = '';
+
+  if (applicationId) {
+    request.input('ApplicationId', sql.UniqueIdentifier, applicationId);
+    whereClause = 'WHERE ApplicationId = @ApplicationId';
+  }
+
+  const result = await request.query(`
+    SELECT *
+    FROM dbo.vw_ApplicationPackageDetails
+    ${whereClause}
+    ORDER BY AppName ASC, PackageName ASC;
+  `);
+
+  return result.recordset.map(mapApplicationPackageRow);
+}
+
+async function attachApplicationPackages(applications) {
+  if (applications.length === 0) return applications;
+
+  const applicationPackages = await listApplicationPackages();
+  const packagesByApplicationId = new Map();
+
+  applicationPackages.forEach((packageItem) => {
+    if (!packagesByApplicationId.has(packageItem.applicationId)) {
+      packagesByApplicationId.set(packageItem.applicationId, []);
+    }
+
+    packagesByApplicationId.get(packageItem.applicationId).push(packageItem);
+  });
+
+  return applications.map((application) => {
+    const packages = packagesByApplicationId.get(application.id) || [];
+
+    return {
+      ...application,
+      packageCount: packages.length,
+      packages
+    };
+  });
+}
+
+async function getApplicationById(id) {
+  const pool = await getPool();
+  const appResult = await pool.request()
+    .input('Id', sql.NVarChar(100), id)
+    .query(`
+      SELECT TOP (1) *
+      FROM dbo.vw_ApplicationList
+      WHERE CONVERT(NVARCHAR(36), Id) = @Id OR AppCode = @Id;
+    `);
+
+  if (appResult.recordset.length === 0) return null;
+
+  const application = mapApplicationRow(appResult.recordset[0]);
+  application.packages = await listApplicationPackages(application.id);
+  application.packageCount = application.packages.length;
+  return application;
+}
+
+async function getStats() {
+  const pool = await getPool();
+  const result = await pool.request().query(`
+    SELECT
+      (SELECT COUNT_BIG(*) FROM dbo.Packages) AS TotalPackages,
+      (SELECT COUNT_BIG(*) FROM dbo.Packages WHERE IsActive = 1) AS ActivePackages,
+      (SELECT COUNT_BIG(*) FROM dbo.PackageVersions) AS TotalVersions,
+      (SELECT COUNT_BIG(*) FROM dbo.Applications) AS TotalApplications,
+      (SELECT COUNT_BIG(*) FROM dbo.Applications WHERE Status = N'Released') AS ReleasedApplications;
+  `);
+
+  const row = result.recordset[0];
+
+  return {
+    totalPackages: Number(row.TotalPackages || 0),
+    activePackages: Number(row.ActivePackages || 0),
+    totalVersions: Number(row.TotalVersions || 0),
+    totalApplications: Number(row.TotalApplications || 0),
+    releasedApplications: Number(row.ReleasedApplications || 0)
+  };
+}
+
+async function getActivity() {
+  const pool = await getPool();
+  const result = await pool.request().query(`
+    SELECT TOP (6)
+      p.PackageName,
+      p.PackageCode,
+      pv.Version,
+      pv.UploadedAt,
+      pv.IsLatest
+    FROM dbo.PackageVersions AS pv
+    INNER JOIN dbo.Packages AS p
+      ON p.Id = pv.PackageId
+    ORDER BY pv.UploadedAt DESC;
+  `);
+
+  return result.recordset.map((row) => ({
+    title: `${row.IsLatest ? 'Latest' : 'Upload'} ${row.Version}`,
+    detail: `${row.PackageName} (${row.PackageCode})`,
+    time: formatDate(row.UploadedAt),
+    icon: row.IsLatest ? 'stars' : 'upload_file'
+  }));
+}
+
+async function createPackageWithVersion(input) {
+  const pool = await getPool();
+  const transaction = new sql.Transaction(pool);
+
+  await transaction.begin();
+
+  try {
+    const packageResult = await new sql.Request(transaction)
+      .input('PackageCode', sql.NVarChar(100), input.packageCode)
+      .input('PackageName', sql.NVarChar(200), input.packageName)
+      .input('PackageType', sql.NVarChar(20), input.packageType)
+      .input('Description', sql.NVarChar(sql.MAX), input.description || null)
+      .input('CreatedByUserId', sql.UniqueIdentifier, input.createdByUserId)
+      .query(`
+        INSERT dbo.Packages (PackageCode, PackageName, PackageType, Description, CreatedByUserId)
+        OUTPUT inserted.Id
+        VALUES (@PackageCode, @PackageName, @PackageType, @Description, @CreatedByUserId);
+      `);
+
+    const packageId = String(packageResult.recordset[0].Id);
+    const versionResult = await new sql.Request(transaction)
+      .input('PackageId', sql.UniqueIdentifier, packageId)
+      .input('Version', sql.NVarChar(50), input.version)
+      .input('FilePath', sql.NVarChar(1000), input.filePath || null)
+      .input('DockerImage', sql.NVarChar(500), input.dockerImage || null)
+      .input('FileChecksumSha256', sql.Char(64), input.checksum || null)
+      .input('FileSizeBytes', sql.BigInt, input.fileSizeBytes || null)
+      .input('ChangeLog', sql.NVarChar(sql.MAX), input.changeLog || null)
+      .input('ReleaseDate', sql.DateTime2, input.releaseDate ? new Date(input.releaseDate) : new Date())
+      .query(`
+        INSERT dbo.PackageVersions (
+          PackageId, Version, FilePath, DockerImage, FileChecksumSha256,
+          FileSizeBytes, ChangeLog, ReleaseDate, IsLatest
+        )
+        OUTPUT inserted.Id
+        VALUES (
+          @PackageId, @Version, @FilePath, @DockerImage, @FileChecksumSha256,
+          @FileSizeBytes, @ChangeLog, @ReleaseDate, 1
+        );
+      `);
+
+    await transaction.commit();
+
+    return {
+      packageId,
+      versionId: String(versionResult.recordset[0].Id)
+    };
+  } catch (error) {
+    await transaction.rollback();
+    if (error.number === 2601 || error.number === 2627) {
+      throw duplicatePackageError();
+    }
+
+    throw error;
+  }
+}
+
+async function addPackageVersion(input) {
+  const pool = await getPool();
+  let insertResult;
+
+  try {
+    insertResult = await pool.request()
+      .input('PackageId', sql.UniqueIdentifier, input.packageId)
+      .input('Version', sql.NVarChar(50), input.version)
+      .input('FilePath', sql.NVarChar(1000), input.filePath || null)
+      .input('DockerImage', sql.NVarChar(500), input.dockerImage || null)
+      .input('FileChecksumSha256', sql.Char(64), input.checksum || null)
+      .input('FileSizeBytes', sql.BigInt, input.fileSizeBytes || null)
+      .input('ChangeLog', sql.NVarChar(sql.MAX), input.changeLog || null)
+      .input('ReleaseDate', sql.DateTime2, input.releaseDate ? new Date(input.releaseDate) : new Date())
+      .query(`
+        INSERT dbo.PackageVersions (
+          PackageId, Version, FilePath, DockerImage, FileChecksumSha256,
+          FileSizeBytes, ChangeLog, ReleaseDate
+        )
+        OUTPUT inserted.Id
+        VALUES (
+          @PackageId, @Version, @FilePath, @DockerImage, @FileChecksumSha256,
+          @FileSizeBytes, @ChangeLog, @ReleaseDate
+        );
+      `);
+  } catch (error) {
+    if (error.number === 2601 || error.number === 2627) {
+      throw duplicatePackageError();
+    }
+
+    throw error;
+  }
+
+  const versionId = String(insertResult.recordset[0].Id);
+  await pool.request()
+    .input('PackageVersionId', sql.UniqueIdentifier, versionId)
+    .execute('dbo.SetLatestPackageVersion');
+
+  return versionId;
+}
+
+async function deletePackage(packageId) {
+  const pool = await getPool();
+  const transaction = new sql.Transaction(pool);
+
+  await transaction.begin();
+
+  try {
+    await new sql.Request(transaction)
+      .input('Id', sql.UniqueIdentifier, packageId)
+      .query(`
+        DELETE FROM dbo.ApplicationPackages
+        WHERE PackageId = @Id;
+      `);
+
+    const result = await new sql.Request(transaction)
+      .input('Id', sql.UniqueIdentifier, packageId)
+      .query(`
+        DELETE FROM dbo.Packages
+        OUTPUT deleted.Id
+        WHERE Id = @Id;
+      `);
+
+    await transaction.commit();
+    return result.recordset.length > 0;
+  } catch (error) {
+    await transaction.rollback();
+    throw error;
+  }
+}
+
+async function setLatestPackageVersion(packageVersionId) {
+  const pool = await getPool();
+  await pool.request()
+    .input('PackageVersionId', sql.UniqueIdentifier, packageVersionId)
+    .execute('dbo.SetLatestPackageVersion');
+}
+
+async function deletePackageVersion(packageVersionId) {
+  const pool = await getPool();
+  const versionResult = await pool.request()
+    .input('Id', sql.UniqueIdentifier, packageVersionId)
+    .query(`
+      SELECT TOP (1) PackageId
+      FROM dbo.PackageVersions
+      WHERE Id = @Id;
+    `);
+
+  const version = versionResult.recordset[0];
+  if (!version) {
+    return {
+      deleted: false,
+      packageId: null
+    };
+  }
+
+  await pool.request()
+    .input('PackageVersionId', sql.UniqueIdentifier, packageVersionId)
+    .execute('dbo.DeletePackageVersion');
+
+  return {
+    deleted: true,
+    packageId: String(version.PackageId)
+  };
+}
+
+async function createApplication(input) {
+  const pool = await getPool();
+  const transaction = new sql.Transaction(pool);
+
+  await transaction.begin();
+
+  try {
+    const appResult = await new sql.Request(transaction)
+      .input('AppCode', sql.NVarChar(100), input.appCode)
+      .input('AppName', sql.NVarChar(200), input.appName)
+      .input('AppVersion', sql.NVarChar(50), input.appVersion)
+      .input('Notes', sql.NVarChar(500), input.notes || null)
+      .input('CreatedByUserId', sql.UniqueIdentifier, input.createdByUserId)
+      .input('Status', sql.NVarChar(50), normalizeApplicationStatus(input.status))
+      .query(`
+        INSERT dbo.Applications (AppCode, AppName, AppVersion, Notes, CreatedByUserId, Status)
+        OUTPUT inserted.Id
+        VALUES (@AppCode, @AppName, @AppVersion, @Notes, @CreatedByUserId, @Status);
+      `);
+
+    const applicationId = String(appResult.recordset[0].Id);
+
+    for (const packageItem of input.packages) {
+      await new sql.Request(transaction)
+        .input('ApplicationId', sql.UniqueIdentifier, applicationId)
+        .input('PackageId', sql.UniqueIdentifier, packageItem.packageId)
+        .input('SelectedVersionId', sql.UniqueIdentifier, packageItem.selectedVersionId || null)
+        .query(`
+          INSERT dbo.ApplicationPackages (ApplicationId, PackageId, SelectedVersionId)
+          VALUES (@ApplicationId, @PackageId, @SelectedVersionId);
+        `);
+    }
+
+    await transaction.commit();
+    return applicationId;
+  } catch (error) {
+    await transaction.rollback();
+    if (error.number === 2601 || error.number === 2627) {
+      throw duplicateApplicationError();
+    }
+
+    throw error;
+  }
+}
+
+async function updateApplication(input) {
+  const pool = await getPool();
+  const transaction = new sql.Transaction(pool);
+
+  await transaction.begin();
+
+  try {
+    const conflictResult = await new sql.Request(transaction)
+      .input('ApplicationId', sql.UniqueIdentifier, input.applicationId)
+      .input('AppCode', sql.NVarChar(100), input.appCode)
+      .query(`
+        SELECT TOP (1) Id
+        FROM dbo.Applications
+        WHERE AppCode = @AppCode
+          AND Id <> @ApplicationId;
+      `);
+
+    if (conflictResult.recordset.length > 0) {
+      throw duplicateApplicationError();
+    }
+
+    const appResult = await new sql.Request(transaction)
+      .input('ApplicationId', sql.UniqueIdentifier, input.applicationId)
+      .input('AppCode', sql.NVarChar(100), input.appCode)
+      .input('AppName', sql.NVarChar(200), input.appName)
+      .input('AppVersion', sql.NVarChar(50), input.appVersion)
+      .input('Notes', sql.NVarChar(500), input.notes || null)
+      .input('Status', sql.NVarChar(50), normalizeApplicationStatus(input.status))
+      .query(`
+        UPDATE dbo.Applications
+        SET AppCode = @AppCode,
+            AppName = @AppName,
+            AppVersion = @AppVersion,
+            Notes = @Notes,
+            Status = @Status,
+            UpdatedAt = SYSUTCDATETIME()
+        OUTPUT inserted.Id
+        WHERE Id = @ApplicationId;
+      `);
+
+    if (appResult.recordset.length === 0) {
+      await transaction.commit();
+      return null;
+    }
+
+    await new sql.Request(transaction)
+      .input('ApplicationId', sql.UniqueIdentifier, input.applicationId)
+      .query(`
+        DELETE FROM dbo.ApplicationPackages
+        WHERE ApplicationId = @ApplicationId;
+      `);
+
+    for (const packageItem of input.packages) {
+      await new sql.Request(transaction)
+        .input('ApplicationId', sql.UniqueIdentifier, input.applicationId)
+        .input('PackageId', sql.UniqueIdentifier, packageItem.packageId)
+        .input('SelectedVersionId', sql.UniqueIdentifier, packageItem.selectedVersionId || null)
+        .query(`
+          INSERT dbo.ApplicationPackages (ApplicationId, PackageId, SelectedVersionId)
+          VALUES (@ApplicationId, @PackageId, @SelectedVersionId);
+        `);
+    }
+
+    await transaction.commit();
+  } catch (error) {
+    await transaction.rollback();
+    if (error.code === 'DUPLICATE_APPLICATION') {
+      throw error;
+    }
+
+    if (error.number === 2601 || error.number === 2627) {
+      throw duplicateApplicationError();
+    }
+
+    throw error;
+  }
+
+  return getApplicationById(input.applicationId);
+}
+
+async function updateApplicationStatus(applicationId, status) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('ApplicationId', sql.UniqueIdentifier, applicationId)
+    .input('Status', sql.NVarChar(50), normalizeApplicationStatus(status))
+    .query(`
+      UPDATE dbo.Applications
+      SET Status = @Status,
+          UpdatedAt = SYSUTCDATETIME()
+      OUTPUT inserted.Id
+      WHERE Id = @ApplicationId;
+    `);
+
+  return result.recordset.length > 0;
+}
+
+async function deleteApplication(applicationId) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('ApplicationId', sql.UniqueIdentifier, applicationId)
+    .query(`
+      DELETE FROM dbo.Applications
+      OUTPUT deleted.Id
+      WHERE Id = @ApplicationId;
+    `);
+
+  return result.recordset.length > 0;
+}
+
+async function removeApplicationPackage(applicationId, packageId) {
+  const pool = await getPool();
+  const result = await pool.request()
+    .input('ApplicationId', sql.UniqueIdentifier, applicationId)
+    .input('PackageId', sql.UniqueIdentifier, packageId)
+    .query(`
+      DELETE FROM dbo.ApplicationPackages
+      OUTPUT deleted.Id
+      WHERE ApplicationId = @ApplicationId
+        AND PackageId = @PackageId;
+    `);
+
+  return result.recordset.length > 0;
+}
+
+async function getPageData(currentUser) {
+  const [stats, packageRows, applications, activity] = await Promise.all([
+    getStats(),
+    listPackages(),
+    listApplications(),
+    getActivity()
+  ]);
+  const packages = await attachPackageVersions(packageRows);
+
+  return {
+    currentUser,
+    stats,
+    packages,
+    applications,
+    activity
+  };
+}
+
+module.exports = {
+  authenticateUser,
+  confirmEmailToken,
+  createEmailConfirmationToken,
+  createUser,
+  deleteUser,
+  getUserById,
+  getPendingUserByEmail,
+  getRegistrationConflict,
+  listUsers,
+  updateUser,
+  updateUserAccess,
+  getPageData,
+  listPackages,
+  listApplications,
+  getPackageById,
+  getApplicationById,
+  createPackageWithVersion,
+  addPackageVersion,
+  deletePackage,
+  setLatestPackageVersion,
+  deletePackageVersion,
+  createApplication,
+  updateApplication,
+  updateApplicationStatus,
+  deleteApplication,
+  removeApplicationPackage
+};
diff --git a/web-server/views/application-detail.ejs b/web-server/views/application-detail.ejs
new file mode 100644
index 0000000..d0aca5a
--- /dev/null
+++ b/web-server/views/application-detail.ejs
@@ -0,0 +1,120 @@
+<%- include('partials/page-start') %>
+
+<section class="page">
+  <div class="page-header">
+    <div>
+      <div class="breadcrumb"><a href="/applications">Applications</a><span>/</span><span><%= application.code %></span></div>
+      <h1><%= application.name %></h1>
+      <p><%= application.notes %></p>
+    </div>
+    <div class="page-actions">
+      <button
+        class="btn btn-secondary"
+        type="button"
+        data-app-edit
+        data-app-id="<%= application.id %>"
+        data-app-code="<%= application.code %>"
+        data-app-name="<%= application.name %>"
+        data-app-version="<%= application.version %>"
+        data-app-status="<%= application.status %>"
+        data-app-notes="<%= application.notes %>"
+        data-app-packages="<%= JSON.stringify(application.packages.map((pkg) => ({ packageId: pkg.packageId, selectedVersionId: pkg.selectedVersionId }))) %>"
+      >
+        <span class="material-symbols-outlined">edit</span>
+        Sửa App
+      </button>
+      <form method="post" action="/applications/<%= application.id %>/release" data-confirm-submit="Chuyển app <%= application.code %> sang Released?">
+        <input type="hidden" name="returnTo" value="<%= currentPath %>">
+        <button class="btn btn-primary" type="submit" <%= application.status === 'Released' ? 'disabled' : '' %>>
+          <span class="material-symbols-outlined">archive</span>
+          Đóng gói
+        </button>
+      </form>
+      <form method="post" action="/applications/<%= application.id %>/delete" data-confirm-submit="Xóa app <%= application.code %> khỏi hệ thống?">
+        <button class="btn btn-danger" type="submit">
+          <span class="material-symbols-outlined">delete</span>
+          Xóa
+        </button>
+      </form>
+    </div>
+  </div>
+
+  <div class="detail-grid">
+    <section class="panel">
+      <div class="panel-header">
+        <div>
+          <h2>Thông tin App</h2>
+          <p>Thông tin dùng ở danh sách và pipeline đóng gói.</p>
+        </div>
+      </div>
+      <dl class="detail-list">
+        <div><dt>Code</dt><dd><%= application.code %></dd></div>
+        <div><dt>Version</dt><dd><strong><%= application.version %></strong></dd></div>
+        <div><dt>Package count</dt><dd><%= application.packageCount %></dd></div>
+        <div><dt>Created date</dt><dd><%= application.createdAt %></dd></div>
+        <div><dt>Created by</dt><dd><%= application.createdBy %></dd></div>
+        <div><dt>Status</dt><dd><span class="badge <%= helpers.statusClass(application.status) %>"><%= application.status %></span></dd></div>
+      </dl>
+    </section>
+
+    <section class="panel wide-panel">
+      <div class="panel-header">
+        <div>
+          <h2>Package trong App</h2>
+          <p>Mỗi package có thể chọn version cụ thể cho app này.</p>
+        </div>
+      </div>
+      <div class="table-wrap compact">
+        <table>
+          <thead>
+            <tr>
+              <th>Package</th>
+              <th>Type</th>
+              <th>Selected version</th>
+              <th class="action-col">Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            <% application.packages.forEach((pkg) => { %>
+              <tr>
+                <td>
+                  <strong><%= pkg.name %></strong>
+                  <span class="table-subtitle"><%= pkg.code %></span>
+                </td>
+                <td><span class="badge <%= helpers.packageTypeClass(pkg.type) %>"><%= helpers.packageTypeLabel(pkg.type) %></span></td>
+                <td><%= pkg.selectedVersion %></td>
+                <td class="action-col">
+                  <div class="action-group">
+                    <button
+                      class="icon-button subtle"
+                      type="button"
+                      title="Đổi version"
+                      data-app-edit
+                      data-app-id="<%= application.id %>"
+                      data-app-code="<%= application.code %>"
+                      data-app-name="<%= application.name %>"
+                      data-app-version="<%= application.version %>"
+                      data-app-status="<%= application.status %>"
+                      data-app-notes="<%= application.notes %>"
+                      data-app-packages="<%= JSON.stringify(application.packages.map((item) => ({ packageId: item.packageId, selectedVersionId: item.selectedVersionId }))) %>"
+                    >
+                      <span class="material-symbols-outlined">swap_horiz</span>
+                    </button>
+                    <form method="post" action="/applications/<%= application.id %>/packages/<%= pkg.packageId %>/delete" data-confirm-submit="Gỡ package <%= pkg.code %> khỏi app?">
+                      <button class="icon-button danger" type="submit" title="Gỡ package" aria-label="Gỡ package <%= pkg.name %>">
+                        <span class="material-symbols-outlined">link_off</span>
+                      </button>
+                    </form>
+                  </div>
+                </td>
+              </tr>
+            <% }) %>
+          </tbody>
+        </table>
+      </div>
+    </section>
+  </div>
+</section>
+
+<%- include('partials/edit-app-modal') %>
+<%- include('partials/page-end') %>
diff --git a/web-server/views/applications.ejs b/web-server/views/applications.ejs
new file mode 100644
index 0000000..998c6c0
--- /dev/null
+++ b/web-server/views/applications.ejs
@@ -0,0 +1,114 @@
+<%- include('partials/page-start') %>
+
+<section class="page">
+  <div class="page-header">
+    <div>
+      <h1>Applications</h1>
+      <p>Danh sách app được tạo từ các package đã chọn, kèm version và ghi chú đóng gói.</p>
+    </div>
+    <div class="page-actions">
+      <a class="btn btn-secondary" href="/applications/export.csv">
+        <span class="material-symbols-outlined">download</span>
+        Export
+      </a>
+      <a class="btn btn-primary" href="/builder">
+        <span class="material-symbols-outlined">add</span>
+        Tạo App
+      </a>
+    </div>
+  </div>
+
+  <div class="page-filters">
+    <label class="filter-field">
+      <span>Status</span>
+      <select data-filter-select data-filter-column="status" data-filter-table="applicationsTable">
+        <option value="">Tất cả</option>
+        <option value="Draft">Draft</option>
+        <option value="Released">Released</option>
+        <option value="Archived">Archived</option>
+      </select>
+    </label>
+    <label class="filter-field wide">
+      <span>Search</span>
+      <input type="search" placeholder="Tìm theo tên app, code, người tạo..." data-table-search="applicationsTable">
+    </label>
+  </div>
+
+  <section class="table-panel">
+    <div class="table-wrap">
+      <table id="applicationsTable" class="data-table">
+        <thead>
+          <tr>
+            <th>Application</th>
+            <th>Version</th>
+            <th>Packages</th>
+            <th>Created date</th>
+            <th>Created by</th>
+            <th>Status</th>
+            <th>Notes</th>
+            <th class="action-col">Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <% if (applications.length === 0) { %>
+            <tr>
+              <td colspan="8" class="table-empty">Chưa có app trong database. Tạo app sau khi đã upload package.</td>
+            </tr>
+          <% } %>
+          <% applications.forEach((item) => { %>
+            <tr data-search="<%= `${item.name} ${item.code} ${item.version} ${item.createdBy} ${item.notes}`.toLowerCase() %>" data-status="<%= item.status %>">
+              <td>
+                <a class="table-title" href="/applications/<%= item.id %>"><%= item.name %></a>
+                <span class="table-subtitle"><%= item.code %></span>
+              </td>
+              <td><strong><%= item.version %></strong></td>
+              <td><%= item.packageCount %></td>
+              <td><%= item.createdAt %></td>
+              <td><%= item.createdBy %></td>
+              <td><span class="badge <%= helpers.statusClass(item.status) %>"><%= item.status %></span></td>
+              <td class="notes-cell"><%= item.notes %></td>
+              <td class="action-col">
+                <div class="action-group">
+                  <a class="icon-button subtle" href="/applications/<%= item.id %>" title="Xem chi tiết" aria-label="Xem chi tiết <%= item.name %>">
+                    <span class="material-symbols-outlined">visibility</span>
+                  </a>
+                  <button
+                    class="icon-button subtle"
+                    type="button"
+                    title="Sửa app"
+                    data-app-edit
+                    data-app-id="<%= item.id %>"
+                    data-app-code="<%= item.code %>"
+                    data-app-name="<%= item.name %>"
+                    data-app-version="<%= item.version %>"
+                    data-app-status="<%= item.status %>"
+                    data-app-notes="<%= item.notes %>"
+                    data-app-packages="<%= JSON.stringify(item.packages.map((pkg) => ({ packageId: pkg.packageId, selectedVersionId: pkg.selectedVersionId }))) %>"
+                  >
+                    <span class="material-symbols-outlined">edit</span>
+                  </button>
+                  <form method="post" action="/applications/<%= item.id %>/delete" data-confirm-submit="Xóa app <%= item.code %>? Thao tác này sẽ xóa thông tin đóng gói của app.">
+                    <button class="icon-button danger" type="submit" title="Xóa app" aria-label="Xóa app <%= item.name %>">
+                      <span class="material-symbols-outlined">delete</span>
+                    </button>
+                  </form>
+                </div>
+              </td>
+            </tr>
+          <% }) %>
+        </tbody>
+      </table>
+    </div>
+    <div class="page-pager">
+      <span>Showing 1-<%= applications.length %> of <%= applications.length %></span>
+      <div>
+        <button type="button" disabled>Prev</button>
+        <span>Page 1 / 1</span>
+        <button type="button" disabled>Next</button>
+      </div>
+    </div>
+  </section>
+</section>
+
+<%- include('partials/edit-app-modal') %>
+<%- include('partials/page-end') %>
diff --git a/web-server/views/auth.ejs b/web-server/views/auth.ejs
new file mode 100644
index 0000000..eddbcf2
--- /dev/null
+++ b/web-server/views/auth.ejs
@@ -0,0 +1,97 @@
+<!doctype html>
+<html lang="vi">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title><%= title %> | Robot Installer</title>
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600;700;800&family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+  <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/vendor/notiflix/notiflix-<%= notiflixVersion %>.min.css">
+  <link rel="stylesheet" href="/css/styles.css">
+</head>
+<body class="auth-shell" <% if (notice) { %>data-notice-type="<%= notice.type %>" data-notice="<%= notice.message %>"<% } %>>
+  <main class="auth-page">
+    <section class="auth-panel">
+      <div class="auth-brand">
+        <div class="brand-mark">
+          <span class="material-symbols-outlined">precision_manufacturing</span>
+        </div>
+        <div class="brand-copy">
+          <strong>Robot Installer</strong>
+          <span>User Access</span>
+        </div>
+      </div>
+
+      <% if (mode === 'login') { %>
+        <div class="auth-heading">
+          <h1>Đăng nhập</h1>
+          <p>Truy cập console quản lý package và app.</p>
+        </div>
+
+        <form class="auth-form" method="post" action="/login">
+          <input type="hidden" name="returnTo" value="<%= returnTo %>">
+          <label class="form-field">
+            <span>Username hoặc email</span>
+            <input type="text" name="identifier" autocomplete="username" required autofocus>
+          </label>
+          <label class="form-field">
+            <span>Mật khẩu</span>
+            <input type="password" name="password" autocomplete="current-password" required>
+          </label>
+          <button class="btn btn-primary auth-submit" type="submit">
+            <span class="material-symbols-outlined">login</span>
+            Đăng nhập
+          </button>
+        </form>
+
+        <p class="auth-switch">Chưa có tài khoản? <a href="/register">Đăng ký</a></p>
+      <% } else { %>
+        <div class="auth-heading">
+          <h1>Đăng ký</h1>
+          <p>App sẽ gửi email xác nhận để kích hoạt tài khoản.</p>
+        </div>
+
+        <form class="auth-form" method="post" action="/register" data-register-form>
+          <div class="form-grid">
+            <label class="form-field">
+              <span>Username</span>
+              <input type="text" name="username" value="<%= values.username || '' %>" autocomplete="username" required autofocus data-unique-check="username">
+              <small class="field-feedback" data-unique-feedback="username"></small>
+            </label>
+            <label class="form-field">
+              <span>Họ tên</span>
+              <input type="text" name="fullName" value="<%= values.fullName || '' %>" autocomplete="name">
+            </label>
+          </div>
+          <label class="form-field">
+            <span>Email</span>
+            <input type="email" name="email" value="<%= values.email || '' %>" autocomplete="email" required data-unique-check="email">
+            <small class="field-feedback" data-unique-feedback="email"></small>
+          </label>
+          <div class="form-grid">
+            <label class="form-field">
+              <span>Mật khẩu</span>
+              <input type="password" name="password" autocomplete="new-password" minlength="8" required>
+            </label>
+            <label class="form-field">
+              <span>Xác nhận mật khẩu</span>
+              <input type="password" name="confirmPassword" autocomplete="new-password" minlength="8" required>
+            </label>
+          </div>
+          <button class="btn btn-primary auth-submit" type="submit" data-register-submit>
+            <span class="material-symbols-outlined">person_add</span>
+            Tạo tài khoản
+          </button>
+        </form>
+
+        <p class="auth-switch">Đã có tài khoản? <a href="/login">Đăng nhập</a></p>
+      <% } %>
+    </section>
+  </main>
+
+  <script src="/vendor/notiflix/notiflix-<%= notiflixVersion %>.min.js"></script>
+  <script src="/js/app.js"></script>
+</body>
+</html>
diff --git a/web-server/views/builder.ejs b/web-server/views/builder.ejs
new file mode 100644
index 0000000..6c952bf
--- /dev/null
+++ b/web-server/views/builder.ejs
@@ -0,0 +1,105 @@
+<%- include('partials/page-start') %>
+
+<section class="page">
+  <div class="page-header">
+    <div>
+      <h1>Đóng gói App</h1>
+      <p>Tạo app bằng cách chọn package `.deb` hoặc Docker và gán version cụ thể.</p>
+    </div>
+    <div class="page-actions">
+      <button class="btn btn-secondary" type="submit" form="builderForm" name="status" value="Draft">
+        <span class="material-symbols-outlined">draft</span>
+        Lưu nháp
+      </button>
+      <button class="btn btn-primary" type="submit" form="builderForm">
+        <span class="material-symbols-outlined">save</span>
+        Tạo App
+      </button>
+    </div>
+  </div>
+
+  <div class="builder-layout">
+    <section class="panel">
+      <div class="panel-header">
+        <div>
+          <h2>Thông tin App</h2>
+        </div>
+      </div>
+      <form id="builderForm" class="form-stack" action="/applications" method="post">
+        <label class="form-field">
+          <span>App code</span>
+          <input type="text" name="appCode" required>
+        </label>
+        <label class="form-field">
+          <span>App version</span>
+          <input type="text" name="appVersion" required>
+        </label>
+        <label class="form-field full">
+          <span>App name</span>
+          <input type="text" name="appName" required>
+        </label>
+        <label class="form-field full">
+          <span>Notes</span>
+          <textarea name="notes"></textarea>
+        </label>
+      </form>
+    </section>
+
+    <section class="table-panel builder-table">
+      <div class="panel-header">
+        <div>
+          <h2>Chọn package</h2>
+          <p>Có thể dùng chung `.deb` và Docker trong một app.</p>
+        </div>
+      </div>
+      <div class="page-filters inline">
+        <label class="filter-field wide">
+          <span>Search</span>
+          <input type="search" placeholder="Tìm package..." data-table-search="builderPackagesTable">
+        </label>
+      </div>
+      <div class="table-wrap">
+        <table id="builderPackagesTable" class="data-table">
+          <thead>
+            <tr>
+              <th>Use</th>
+              <th>Package</th>
+              <th>Type</th>
+              <th>Version</th>
+              <th>Status</th>
+            </tr>
+          </thead>
+          <tbody>
+            <% if (packages.length === 0) { %>
+              <tr>
+                <td colspan="5" class="table-empty">Chưa có package để đóng gói. Hãy upload package trước.</td>
+              </tr>
+            <% } %>
+            <% packages.forEach((item, index) => { %>
+              <tr data-search="<%= `${item.name} ${item.code} ${item.latestVersion}`.toLowerCase() %>">
+                <td>
+                  <input class="checkbox" form="builderForm" type="checkbox" name="packageIds" value="<%= item.id %>" <%= index < 3 ? 'checked' : '' %> aria-label="Chọn <%= item.name %>">
+                </td>
+                <td>
+                  <strong><%= item.name %></strong>
+                  <span class="table-subtitle"><%= item.code %></span>
+                </td>
+                <td><span class="badge <%= helpers.packageTypeClass(item.type) %>"><%= helpers.packageTypeLabel(item.type) %></span></td>
+                <td>
+                  <select class="mini-select" form="builderForm" name="version_<%= item.id %>" aria-label="Version của <%= item.name %>">
+                    <% item.versions.forEach((version) => { %>
+                      <option value="<%= version.id %>"><%= version.version %></option>
+                    <% }) %>
+                  </select>
+                </td>
+                <td><span class="badge <%= helpers.statusClass(item.status) %>"><%= item.status %></span></td>
+              </tr>
+            <% }) %>
+          </tbody>
+        </table>
+      </div>
+    </section>
+  </div>
+</section>
+
+<%- include('partials/page-end') %>
diff --git a/web-server/views/confirm-email-sent.ejs b/web-server/views/confirm-email-sent.ejs
new file mode 100644
index 0000000..69f553a
--- /dev/null
+++ b/web-server/views/confirm-email-sent.ejs
@@ -0,0 +1,54 @@
+<!doctype html>
+<html lang="vi">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title><%= title %> | Robot Installer</title>
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600;700;800&family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+  <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/vendor/notiflix/notiflix-<%= notiflixVersion %>.min.css">
+  <link rel="stylesheet" href="/css/styles.css">
+</head>
+<body class="auth-shell" <% if (notice) { %>data-notice-type="<%= notice.type %>" data-notice="<%= notice.message %>"<% } %>>
+  <main class="auth-page">
+    <section class="auth-panel">
+      <div class="auth-brand">
+        <div class="brand-mark">
+          <span class="material-symbols-outlined">precision_manufacturing</span>
+        </div>
+        <div class="brand-copy">
+          <strong>Robot Installer</strong>
+          <span>Email Confirmation</span>
+        </div>
+      </div>
+
+      <div class="auth-confirm-icon">
+        <span class="material-symbols-outlined">mark_email_unread</span>
+      </div>
+
+      <div class="auth-heading">
+        <h1>Kiểm tra email</h1>
+        <p>Chúng tôi đã gửi link xác nhận tới email đăng ký. Tài khoản chỉ được kích hoạt sau khi bạn bấm link confirm.</p>
+      </div>
+
+      <form class="auth-form" method="post" action="/resend-confirmation">
+        <label class="form-field">
+          <span>Email đăng ký</span>
+          <input type="email" name="email" value="<%= email %>" autocomplete="email" required>
+        </label>
+        <button class="btn btn-secondary auth-submit" type="submit">
+          <span class="material-symbols-outlined">forward_to_inbox</span>
+          Gửi lại email xác nhận
+        </button>
+      </form>
+
+      <p class="auth-switch">Đã xác nhận? <a href="/login">Đăng nhập</a></p>
+    </section>
+  </main>
+
+  <script src="/vendor/notiflix/notiflix-<%= notiflixVersion %>.min.js"></script>
+  <script src="/js/app.js"></script>
+</body>
+</html>
diff --git a/web-server/views/dashboard.ejs b/web-server/views/dashboard.ejs
new file mode 100644
index 0000000..94b659f
--- /dev/null
+++ b/web-server/views/dashboard.ejs
@@ -0,0 +1,122 @@
+<%- include('partials/page-start') %>
+
+<section class="page">
+  <div class="page-header">
+    <div>
+      <h1>Tổng quan</h1>
+      <p>Theo dõi nhanh package, version mới nhất và các app đang được đóng gói.</p>
+    </div>
+    <div class="page-actions">
+      <button class="btn btn-secondary" type="button" data-modal-open="uploadPackageModal">
+        <span class="material-symbols-outlined">upload_file</span>
+        Upload package
+      </button>
+      <a class="btn btn-primary" href="/builder">
+        <span class="material-symbols-outlined">add_box</span>
+        Tạo App
+      </a>
+    </div>
+  </div>
+
+  <div class="dashboard-stats">
+    <article class="metric-card">
+      <span>Packages</span>
+      <div>
+        <strong><%= stats.totalPackages %></strong>
+        <small><%= stats.activePackages %> active</small>
+      </div>
+    </article>
+    <article class="metric-card">
+      <span>Versions</span>
+      <div>
+        <strong><%= stats.totalVersions %></strong>
+        <small>latest tracking</small>
+      </div>
+    </article>
+    <article class="metric-card">
+      <span>Applications</span>
+      <div>
+        <strong><%= stats.totalApplications %></strong>
+        <small><%= stats.releasedApplications %> released</small>
+      </div>
+    </article>
+    <article class="metric-card">
+      <span>Package types</span>
+      <div>
+        <strong>2</strong>
+        <small>.deb + docker</small>
+      </div>
+    </article>
+  </div>
+
+  <div class="dashboard-grid">
+    <section class="panel">
+      <div class="panel-header">
+        <div>
+          <h2>Package mới cập nhật</h2>
+          <p>Hiển thị version mới nhất cho từng package.</p>
+        </div>
+        <a href="/packages" class="text-link">Xem tất cả</a>
+      </div>
+      <div class="table-wrap compact">
+        <table>
+          <thead>
+            <tr>
+              <th>Package</th>
+              <th>Type</th>
+              <th>Latest</th>
+              <th>Status</th>
+            </tr>
+          </thead>
+          <tbody>
+            <% if (packages.length === 0) { %>
+              <tr>
+                <td colspan="4" class="table-empty">Chưa có package nào. Bấm Upload package để thêm dữ liệu đầu tiên.</td>
+              </tr>
+            <% } %>
+            <% packages.slice(0, 4).forEach((item) => { %>
+              <tr>
+                <td>
+                  <a class="table-title" href="/packages/<%= item.id %>"><%= item.name %></a>
+                  <span class="table-subtitle"><%= item.code %></span>
+                </td>
+                <td><span class="badge <%= helpers.packageTypeClass(item.type) %>"><%= helpers.packageTypeLabel(item.type) %></span></td>
+                <td><%= item.latestVersion %></td>
+                <td><span class="badge <%= helpers.statusClass(item.status) %>"><%= item.status %></span></td>
+              </tr>
+            <% }) %>
+          </tbody>
+        </table>
+      </div>
+    </section>
+
+    <section class="panel">
+      <div class="panel-header">
+        <div>
+          <h2>Hoạt động gần đây</h2>
+          <p>Các thay đổi chính trong package/app.</p>
+        </div>
+      </div>
+      <div class="activity-list">
+        <% if (activity.length === 0) { %>
+          <div class="table-empty">Chưa có hoạt động upload/update package.</div>
+        <% } %>
+        <% activity.forEach((item) => { %>
+          <div class="activity-item">
+            <div class="activity-icon">
+              <span class="material-symbols-outlined"><%= item.icon %></span>
+            </div>
+            <div>
+              <strong><%= item.title %></strong>
+              <span><%= item.detail %></span>
+            </div>
+            <time><%= item.time %></time>
+          </div>
+        <% }) %>
+      </div>
+    </section>
+  </div>
+</section>
+
+<%- include('partials/package-modal') %>
+<%- include('partials/page-end') %>
diff --git a/web-server/views/not-found.ejs b/web-server/views/not-found.ejs
new file mode 100644
index 0000000..d9f9a80
--- /dev/null
+++ b/web-server/views/not-found.ejs
@@ -0,0 +1,15 @@
+<%- include('partials/page-start') %>
+
+<section class="page center-page">
+  <div class="empty-state">
+    <span class="material-symbols-outlined">search_off</span>
+    <h1>Không tìm thấy dữ liệu</h1>
+    <p>Trang hoặc bản ghi bạn mở không tồn tại trong dữ liệu hiện tại.</p>
+    <a class="btn btn-primary" href="/">
+      <span class="material-symbols-outlined">dashboard</span>
+      Về tổng quan
+    </a>
+  </div>
+</section>
+
+<%- include('partials/page-end') %>
diff --git a/web-server/views/package-detail.ejs b/web-server/views/package-detail.ejs
new file mode 100644
index 0000000..eb5508a
--- /dev/null
+++ b/web-server/views/package-detail.ejs
@@ -0,0 +1,98 @@
+<%- include('partials/page-start') %>
+
+<section class="page">
+  <div class="page-header">
+    <div>
+      <div class="breadcrumb"><a href="/packages">Packages</a><span>/</span><span><%= packageItem.code %></span></div>
+      <h1><%= packageItem.name %></h1>
+      <p><%= packageItem.description %></p>
+    </div>
+    <div class="page-actions">
+      <button class="btn btn-secondary" type="button" data-modal-open="updatePackageModal" data-package-update="<%= packageItem.id %>">
+        <span class="material-symbols-outlined">upgrade</span>
+        Update version
+      </button>
+      <form method="post" action="/packages/<%= packageItem.id %>/delete" data-confirm-submit="Xóa package <%= packageItem.code %>? Thao tác này sẽ xóa mọi version và liên kết app liên quan.">
+        <button class="btn btn-danger" type="submit">
+          <span class="material-symbols-outlined">delete</span>
+          Xóa package
+        </button>
+      </form>
+    </div>
+  </div>
+
+  <div class="detail-grid">
+    <section class="panel">
+      <div class="panel-header">
+        <div>
+          <h2>Thông tin package</h2>
+          <p>Metadata chính dùng cho web server và API.</p>
+        </div>
+      </div>
+      <dl class="detail-list">
+        <div><dt>Code</dt><dd><%= packageItem.code %></dd></div>
+        <div><dt>Type</dt><dd><span class="badge <%= helpers.packageTypeClass(packageItem.type) %>"><%= helpers.packageTypeLabel(packageItem.type) %></span></dd></div>
+        <div><dt>Latest</dt><dd><strong><%= packageItem.latestVersion %></strong></dd></div>
+        <div><dt>Artifact</dt><dd class="mono"><%= packageItem.artifact %></dd></div>
+        <div><dt>Owner</dt><dd><%= packageItem.owner %></dd></div>
+        <div><dt>Status</dt><dd><span class="badge <%= helpers.statusClass(packageItem.status) %>"><%= packageItem.status %></span></dd></div>
+      </dl>
+    </section>
+
+    <section class="panel wide-panel">
+      <div class="panel-header">
+        <div>
+          <h2>Version history</h2>
+          <p>Mỗi version có ngày upload, changelog và trạng thái.</p>
+        </div>
+      </div>
+      <div class="table-wrap compact">
+        <table>
+          <thead>
+            <tr>
+              <th>Version</th>
+              <th>Release date</th>
+              <th>Uploaded by</th>
+              <th>Size</th>
+              <th>Status</th>
+              <th class="action-col">Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            <% packageItem.versions.forEach((version) => { %>
+              <tr>
+                <td>
+                  <strong><%= version.version %></strong>
+                  <span class="table-subtitle"><%= version.changeLog %></span>
+                </td>
+                <td><%= version.releaseDate %></td>
+                <td><%= version.uploadedBy %></td>
+                <td><%= version.size %></td>
+                <td><span class="badge <%= helpers.statusClass(version.status) %>"><%= version.status %></span></td>
+                <td class="action-col">
+                  <div class="action-group">
+                    <form method="post" action="/package-versions/<%= version.id %>/latest">
+                      <input type="hidden" name="returnTo" value="<%= currentPath %>">
+                      <button class="icon-button subtle" type="submit" title="Đặt latest" aria-label="Đặt latest <%= version.version %>" <%= version.status === 'Latest' ? 'disabled' : '' %>>
+                        <span class="material-symbols-outlined">stars</span>
+                      </button>
+                    </form>
+                    <form method="post" action="/package-versions/<%= version.id %>/delete" data-confirm-submit="Xóa version <%= version.version %> khỏi package?">
+                      <input type="hidden" name="returnTo" value="<%= currentPath %>">
+                      <button class="icon-button danger" type="submit" title="Xóa version" aria-label="Xóa version <%= version.version %>">
+                        <span class="material-symbols-outlined">delete</span>
+                      </button>
+                    </form>
+                  </div>
+                </td>
+              </tr>
+            <% }) %>
+          </tbody>
+        </table>
+      </div>
+    </section>
+  </div>
+</section>
+
+<%- include('partials/update-package-modal') %>
+<%- include('partials/page-end') %>
diff --git a/web-server/views/packages.ejs b/web-server/views/packages.ejs
new file mode 100644
index 0000000..43c829b
--- /dev/null
+++ b/web-server/views/packages.ejs
@@ -0,0 +1,108 @@
+<%- include('partials/page-start') %>
+
+<section class="page">
+  <div class="page-header">
+    <div>
+      <h1>Packages</h1>
+      <p>Quản lý package `.deb`, Docker image, version và trạng thái latest.</p>
+    </div>
+    <div class="page-actions">
+      <a class="btn btn-secondary" href="/packages/export.csv">
+        <span class="material-symbols-outlined">download</span>
+        Export
+      </a>
+      <button class="btn btn-primary" type="button" data-modal-open="uploadPackageModal">
+        <span class="material-symbols-outlined">upload_file</span>
+        Upload package
+      </button>
+    </div>
+  </div>
+
+  <div class="page-filters">
+    <label class="filter-field">
+      <span>Type</span>
+      <select data-filter-select data-filter-column="type" data-filter-table="packagesTable">
+        <option value="">Tất cả</option>
+        <option value="deb">.deb</option>
+        <option value="docker">Docker</option>
+      </select>
+    </label>
+    <label class="filter-field">
+      <span>Status</span>
+      <select data-filter-select data-filter-column="status" data-filter-table="packagesTable">
+        <option value="">Tất cả</option>
+        <option value="Active">Active</option>
+        <option value="Archived">Archived</option>
+      </select>
+    </label>
+    <label class="filter-field wide">
+      <span>Search</span>
+      <input type="search" placeholder="Tìm theo tên, code, owner..." data-table-search="packagesTable">
+    </label>
+  </div>
+
+  <section class="table-panel">
+    <div class="table-wrap">
+      <table id="packagesTable" class="data-table">
+        <thead>
+          <tr>
+            <th>Package</th>
+            <th>Type</th>
+            <th>Latest version</th>
+            <th>Release date</th>
+            <th>Owner</th>
+            <th>Status</th>
+            <th class="action-col">Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <% if (packages.length === 0) { %>
+            <tr>
+              <td colspan="7" class="table-empty">Chưa có package trong database. Bấm Upload package để tạo package đầu tiên.</td>
+            </tr>
+          <% } %>
+          <% packages.forEach((item) => { %>
+            <tr data-search="<%= `${item.name} ${item.code} ${item.owner} ${item.latestVersion}`.toLowerCase() %>" data-type="<%= item.type %>" data-status="<%= item.status %>">
+              <td>
+                <a class="table-title" href="/packages/<%= item.id %>"><%= item.name %></a>
+                <span class="table-subtitle"><%= item.code %></span>
+              </td>
+              <td><span class="badge <%= helpers.packageTypeClass(item.type) %>"><%= helpers.packageTypeLabel(item.type) %></span></td>
+              <td><strong><%= item.latestVersion %></strong></td>
+              <td><%= item.latestReleaseDate %></td>
+              <td><%= item.owner %></td>
+              <td><span class="badge <%= helpers.statusClass(item.status) %>"><%= item.status %></span></td>
+              <td class="action-col">
+                <div class="action-group">
+                  <a class="icon-button subtle" href="/packages/<%= item.id %>" title="Xem chi tiết" aria-label="Xem chi tiết <%= item.name %>">
+                    <span class="material-symbols-outlined">visibility</span>
+                  </a>
+                  <button class="icon-button subtle" type="button" title="Update version" data-modal-open="updatePackageModal" data-package-update="<%= item.id %>">
+                    <span class="material-symbols-outlined">upgrade</span>
+                  </button>
+                  <form method="post" action="/packages/<%= item.id %>/delete" data-confirm-submit="Xóa package <%= item.code %>? Thao tác này sẽ xóa cả version và liên kết app liên quan.">
+                    <button class="icon-button danger" type="submit" title="Xóa package" aria-label="Xóa package <%= item.name %>">
+                      <span class="material-symbols-outlined">delete</span>
+                    </button>
+                  </form>
+                </div>
+              </td>
+            </tr>
+          <% }) %>
+        </tbody>
+      </table>
+    </div>
+    <div class="page-pager">
+      <span>Showing 1-<%= packages.length %> of <%= packages.length %></span>
+      <div>
+        <button type="button" disabled>Prev</button>
+        <span>Page 1 / 1</span>
+        <button type="button" disabled>Next</button>
+      </div>
+    </div>
+  </section>
+</section>
+
+<%- include('partials/package-modal') %>
+<%- include('partials/update-package-modal') %>
+<%- include('partials/page-end') %>
diff --git a/web-server/views/partials/edit-app-modal.ejs b/web-server/views/partials/edit-app-modal.ejs
new file mode 100644
index 0000000..f2a4ce6
--- /dev/null
+++ b/web-server/views/partials/edit-app-modal.ejs
@@ -0,0 +1,63 @@
+<div class="modal-backdrop" id="editAppModal" role="dialog" aria-modal="true" aria-labelledby="editAppTitle">
+  <div class="modal-content wide">
+    <div class="modal-header">
+      <h3 id="editAppTitle">Sửa Application</h3>
+      <button class="icon-button subtle" type="button" aria-label="Đóng modal" data-modal-close>
+        <span class="material-symbols-outlined">close</span>
+      </button>
+    </div>
+    <form id="editAppForm" class="modal-form" method="post" action="/applications">
+      <input type="hidden" name="returnTo" value="<%= currentPath || '/applications' %>">
+      <div class="form-grid">
+        <label class="form-field">
+          <span>App code</span>
+          <input type="text" name="appCode" required data-edit-app-field="appCode">
+        </label>
+        <label class="form-field">
+          <span>Version</span>
+          <input type="text" name="appVersion" required data-edit-app-field="appVersion">
+        </label>
+        <label class="form-field">
+          <span>Status</span>
+          <select name="status" data-edit-app-field="status">
+            <option value="Draft">Draft</option>
+            <option value="Released">Released</option>
+            <option value="Archived">Archived</option>
+          </select>
+        </label>
+        <label class="form-field full">
+          <span>App name</span>
+          <input type="text" name="appName" required data-edit-app-field="appName">
+        </label>
+        <label class="form-field full">
+          <span>Notes</span>
+          <textarea name="notes" data-edit-app-field="notes"></textarea>
+        </label>
+      </div>
+      <div class="modal-mini-table">
+        <% packages.forEach((item) => { %>
+          <label>
+            <input class="checkbox" type="checkbox" name="packageIds" value="<%= item.id %>" data-edit-app-package="<%= item.id %>">
+            <span>
+              <strong><%= item.name %></strong>
+              <small><%= item.code %></small>
+            </span>
+            <select class="mini-select" name="version_<%= item.id %>" data-edit-app-version="<%= item.id %>">
+              <option value="">Latest/default</option>
+              <% item.versions.forEach((version) => { %>
+                <option value="<%= version.id %>"><%= version.version %></option>
+              <% }) %>
+            </select>
+          </label>
+        <% }) %>
+      </div>
+      <div class="modal-actions">
+        <button class="btn btn-secondary" type="button" data-modal-close>Hủy</button>
+        <button class="btn btn-primary" type="submit">
+          <span class="material-symbols-outlined">save</span>
+          Lưu
+        </button>
+      </div>
+    </form>
+  </div>
+</div>
diff --git a/web-server/views/partials/package-modal.ejs b/web-server/views/partials/package-modal.ejs
new file mode 100644
index 0000000..6c8ad80
--- /dev/null
+++ b/web-server/views/partials/package-modal.ejs
@@ -0,0 +1,78 @@
+<div class="modal-backdrop" id="uploadPackageModal" role="dialog" aria-modal="true" aria-labelledby="uploadPackageTitle">
+  <div class="modal-content">
+    <div class="modal-header">
+      <h3 id="uploadPackageTitle">Upload package</h3>
+      <button class="icon-button subtle" type="button" aria-label="Đóng modal" data-modal-close>
+        <span class="material-symbols-outlined">close</span>
+      </button>
+    </div>
+    <form class="modal-form" action="/packages" method="post" enctype="multipart/form-data">
+      <div class="form-grid">
+        <label class="form-field">
+          <span>Package code</span>
+          <input type="text" name="packageCode" placeholder="NAV-STACK" required>
+        </label>
+        <label class="form-field">
+          <span>Package type</span>
+          <select name="packageType">
+            <option value="deb">.deb</option>
+            <option value="docker">Docker</option>
+          </select>
+        </label>
+        <label class="form-field full">
+          <span>Package name</span>
+          <input type="text" name="packageName" placeholder="Navigation Stack" required>
+        </label>
+        <label class="form-field full">
+          <span>Description</span>
+          <input type="text" name="description" placeholder="Mô tả ngắn về package">
+        </label>
+        <label class="form-field">
+          <span>Version</span>
+          <input type="text" name="version" placeholder="1.0.0" required>
+        </label>
+        <label class="form-field">
+          <span>Release date</span>
+          <input type="date" name="releaseDate" value="2026-05-19">
+        </label>
+        <div class="form-field full">
+          <span>Package file</span>
+          <div class="file-dropzone" data-file-dropzone>
+            <input class="file-input" type="file" name="packageFile" accept=".deb,.tar,.tar.gz,.tgz,.zip,.gz" data-file-input>
+            <div class="file-dropzone-content">
+              <span class="material-symbols-outlined">upload_file</span>
+              <strong>Kéo file vào đây hoặc chọn từ máy</strong>
+              <small>Hỗ trợ .deb, .tar, .tgz, .zip cho package hoặc Docker image export</small>
+              <button class="btn btn-secondary" type="button" data-file-browse>
+                <span class="material-symbols-outlined">attach_file</span>
+                Chọn file
+              </button>
+            </div>
+            <div class="file-preview" data-file-preview hidden>
+              <span class="material-symbols-outlined">draft</span>
+              <div>
+                <strong data-file-name>Chưa chọn file</strong>
+                <small data-file-meta></small>
+              </div>
+              <button class="icon-button subtle" type="button" title="Bỏ file" aria-label="Bỏ file đã chọn" data-file-clear>
+                <span class="material-symbols-outlined">close</span>
+              </button>
+            </div>
+          </div>
+        </div>
+        <label class="form-field full">
+          <span>Docker image/tag</span>
+          <input type="text" name="dockerImage" placeholder="registry.local/robot/fleet-agent:1.9.0">
+        </label>
+        <label class="form-field full">
+          <span>Change log</span>
+          <textarea name="changeLog" placeholder="Ghi chú thay đổi"></textarea>
+        </label>
+      </div>
+      <div class="modal-actions">
+        <button class="btn btn-secondary" type="button" data-modal-close>Hủy</button>
+        <button class="btn btn-primary" type="submit">Upload</button>
+      </div>
+    </form>
+  </div>
+</div>
diff --git a/web-server/views/partials/page-end.ejs b/web-server/views/partials/page-end.ejs
new file mode 100644
index 0000000..7c7c0b4
--- /dev/null
+++ b/web-server/views/partials/page-end.ejs
@@ -0,0 +1,61 @@
+    </div>
+  </main>
+
+  <% if (currentUser && currentUser.role === 'User') { %>
+    <div id="profileModal" class="modal-backdrop" role="dialog" aria-modal="true" aria-labelledby="profileModalTitle">
+      <div class="modal-content">
+        <div class="modal-header">
+          <h3 id="profileModalTitle">Thông tin cá nhân</h3>
+          <button class="icon-button subtle" type="button" data-modal-close aria-label="Đóng">
+            <span class="material-symbols-outlined">close</span>
+          </button>
+        </div>
+        <form class="modal-form" method="post" action="/profile" data-profile-form>
+          <input type="hidden" name="returnTo" value="<%= currentPath || '/' %>">
+          <div class="profile-summary">
+            <div class="profile-avatar"><%= currentUser.name.charAt(0) %></div>
+            <div>
+              <strong><%= currentUser.name %></strong>
+              <span><%= currentUser.username %></span>
+            </div>
+          </div>
+          <div class="form-stack">
+            <label class="form-field">
+              <span>Fullname</span>
+              <input type="text" name="fullName" value="<%= currentUser.fullName || '' %>" autocomplete="name">
+            </label>
+            <label class="form-field">
+              <span>Email mới</span>
+              <input type="email" name="email" value="<%= currentUser.email || '' %>" autocomplete="email" required data-profile-email>
+            </label>
+            <label class="form-field">
+              <span>Confirm email mới</span>
+              <input type="email" name="confirmEmail" value="<%= currentUser.email || '' %>" autocomplete="email" required data-profile-confirm-email>
+              <small class="field-feedback" data-profile-feedback="email"></small>
+            </label>
+            <label class="form-field">
+              <span>Mật khẩu mới</span>
+              <input type="password" name="newPassword" minlength="8" autocomplete="new-password" data-profile-new-password>
+            </label>
+            <label class="form-field">
+              <span>Xác nhận mật khẩu mới</span>
+              <input type="password" name="confirmPassword" minlength="8" autocomplete="new-password" data-profile-confirm-password>
+              <small class="field-feedback" data-profile-feedback="password"></small>
+            </label>
+          </div>
+          <div class="modal-actions">
+            <button class="btn btn-secondary" type="button" data-modal-close>Hủy</button>
+            <button class="btn btn-primary" type="submit">
+              <span class="material-symbols-outlined">save</span>
+              Lưu
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  <% } %>
+
+  <script src="/vendor/notiflix/notiflix-<%= notiflixVersion %>.min.js"></script>
+  <script src="/js/app.js"></script>
+</body>
+</html>
diff --git a/web-server/views/partials/page-start.ejs b/web-server/views/partials/page-start.ejs
new file mode 100644
index 0000000..aad0350
--- /dev/null
+++ b/web-server/views/partials/page-start.ejs
@@ -0,0 +1,87 @@
+<!doctype html>
+<html lang="vi">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title><%= title %> | Robot Installer</title>
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600;700;800&family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+  <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/vendor/notiflix/notiflix-<%= notiflixVersion %>.min.css">
+  <link rel="stylesheet" href="/css/styles.css">
+</head>
+<body class="app-shell" <% if (notice) { %>data-notice-type="<%= notice.type %>" data-notice="<%= notice.message %>"<% } %>>
+  <aside id="appSidebar" class="sidebar" aria-label="Main navigation">
+    <div class="brand-block">
+      <div class="brand-mark">
+        <span class="material-symbols-outlined">precision_manufacturing</span>
+      </div>
+      <div class="brand-copy">
+        <strong>Robot Installer</strong>
+        <span>Package Console</span>
+      </div>
+    </div>
+
+    <nav class="nav-section" aria-label="Workspace">
+      <span class="nav-label">Workspace</span>
+      <% navItems.forEach((item) => { %>
+        <a href="<%= item.href %>" class="nav-item <%= active === item.id ? 'active' : '' %>">
+          <span class="material-symbols-outlined"><%= item.icon %></span>
+          <span><%= item.label %></span>
+        </a>
+      <% }) %>
+    </nav>
+
+    <div class="sidebar-status">
+      <span class="status-dot"></span>
+      <div>
+        <strong>SQL Server</strong>
+        <span>172.20.235.176</span>
+      </div>
+    </div>
+  </aside>
+
+  <button id="sidebarBackdrop" type="button" aria-label="Đóng menu"></button>
+
+  <main id="appMain" class="main-shell">
+    <header class="topbar">
+      <div class="topbar-left">
+        <button id="mobileMenuBtn" class="icon-button" type="button" aria-label="Mở menu" aria-expanded="false">
+          <span class="material-symbols-outlined">menu</span>
+        </button>
+      </div>
+
+      <div class="topbar-actions">
+        <button class="icon-button" type="button" title="Đồng bộ dữ liệu" data-refresh-page>
+          <span class="material-symbols-outlined">sync</span>
+        </button>
+        <button class="icon-button" type="button" title="Thông báo" data-toast="Chưa có thông báo mới">
+          <span class="material-symbols-outlined">notifications</span>
+        </button>
+        <% if (currentUser.role === 'User') { %>
+          <button class="profile-chip profile-chip-button" type="button" title="Cập nhật thông tin cá nhân" aria-label="Cập nhật thông tin cá nhân" data-modal-open="profileModal">
+            <span class="profile-avatar"><%= currentUser.name.charAt(0) %></span>
+            <span class="profile-meta">
+              <strong><%= currentUser.name %></strong>
+              <span><%= currentUser.role %></span>
+            </span>
+          </button>
+        <% } else { %>
+          <div class="profile-chip">
+            <span class="profile-avatar"><%= currentUser.name.charAt(0) %></span>
+            <span class="profile-meta">
+              <strong><%= currentUser.name %></strong>
+              <span><%= currentUser.role %></span>
+            </span>
+          </div>
+        <% } %>
+        <form class="logout-form" method="post" action="/logout">
+          <button class="icon-button" type="submit" title="Đăng xuất" aria-label="Đăng xuất">
+            <span class="material-symbols-outlined">logout</span>
+          </button>
+        </form>
+      </div>
+    </header>
+
+    <div id="mainContent" class="main-content">
diff --git a/web-server/views/partials/update-package-modal.ejs b/web-server/views/partials/update-package-modal.ejs
new file mode 100644
index 0000000..97d4ec1
--- /dev/null
+++ b/web-server/views/partials/update-package-modal.ejs
@@ -0,0 +1,67 @@
+<div class="modal-backdrop" id="updatePackageModal" role="dialog" aria-modal="true" aria-labelledby="updatePackageTitle">
+  <div class="modal-content">
+    <div class="modal-header">
+      <h3 id="updatePackageTitle">Update package version</h3>
+      <button class="icon-button subtle" type="button" aria-label="Đóng modal" data-modal-close>
+        <span class="material-symbols-outlined">close</span>
+      </button>
+    </div>
+    <form class="modal-form" action="/package-versions" method="post" enctype="multipart/form-data">
+      <div class="form-grid">
+        <label class="form-field full">
+          <span>Package</span>
+          <select name="packageId" required>
+            <% packages.forEach((item) => { %>
+              <option value="<%= item.id %>" <%= typeof packageItem !== 'undefined' && packageItem.id === item.id ? 'selected' : '' %>><%= item.code %> - <%= item.name %></option>
+            <% }) %>
+          </select>
+        </label>
+        <label class="form-field">
+          <span>New version</span>
+          <input type="text" name="version" placeholder="2.5.0" required>
+        </label>
+        <label class="form-field">
+          <span>Release date</span>
+          <input type="date" name="releaseDate" value="2026-05-19">
+        </label>
+        <div class="form-field full">
+          <span>Package file</span>
+          <div class="file-dropzone" data-file-dropzone>
+            <input class="file-input" type="file" name="packageFile" accept=".deb,.tar,.tar.gz,.tgz,.zip,.gz" data-file-input>
+            <div class="file-dropzone-content">
+              <span class="material-symbols-outlined">upload_file</span>
+              <strong>Kéo version mới vào đây hoặc chọn file</strong>
+              <small>File .deb hoặc archive Docker export đều dùng được</small>
+              <button class="btn btn-secondary" type="button" data-file-browse>
+                <span class="material-symbols-outlined">attach_file</span>
+                Chọn file
+              </button>
+            </div>
+            <div class="file-preview" data-file-preview hidden>
+              <span class="material-symbols-outlined">draft</span>
+              <div>
+                <strong data-file-name>Chưa chọn file</strong>
+                <small data-file-meta></small>
+              </div>
+              <button class="icon-button subtle" type="button" title="Bỏ file" aria-label="Bỏ file đã chọn" data-file-clear>
+                <span class="material-symbols-outlined">close</span>
+              </button>
+            </div>
+          </div>
+        </div>
+        <label class="form-field full">
+          <span>Docker image/tag</span>
+          <input type="text" name="dockerImage" placeholder="registry.local/robot/fleet-agent:2.0.0">
+        </label>
+        <label class="form-field full">
+          <span>Change log</span>
+          <textarea name="changeLog" placeholder="Mô tả thay đổi trong version này"></textarea>
+        </label>
+      </div>
+      <div class="modal-actions">
+        <button class="btn btn-secondary" type="button" data-modal-close>Hủy</button>
+        <button class="btn btn-primary" type="submit">Cập nhật</button>
+      </div>
+    </form>
+  </div>
+</div>
diff --git a/web-server/views/users.ejs b/web-server/views/users.ejs
new file mode 100644
index 0000000..65bfbd4
--- /dev/null
+++ b/web-server/views/users.ejs
@@ -0,0 +1,275 @@
+<%- include('partials/page-start') %>
+
+<section class="page">
+  <div class="page-header">
+    <div>
+      <h1>Users</h1>
+      <p>Quản lý tài khoản đăng nhập, quyền Admin/User và trạng thái hoạt động.</p>
+    </div>
+    <div class="page-actions">
+      <span class="badge badge-info"><%= users.length %> users</span>
+    </div>
+  </div>
+
+  <div class="users-layout">
+    <section class="panel">
+      <div class="panel-header">
+        <div>
+          <h2>Tạo user mới</h2>
+        </div>
+      </div>
+      <form class="user-create-form" method="post" action="/users">
+        <div class="form-stack">
+          <label class="form-field">
+            <span>Username</span>
+            <input type="text" name="username" autocomplete="off" required>
+          </label>
+          <label class="form-field">
+            <span>Họ tên</span>
+            <input type="text" name="fullName" autocomplete="off">
+          </label>
+          <label class="form-field">
+            <span>Email</span>
+            <input type="email" name="email" autocomplete="off" required>
+          </label>
+          <label class="form-field">
+            <span>Role</span>
+            <select name="role">
+              <option value="User">User</option>
+              <option value="Admin">Admin</option>
+            </select>
+          </label>
+          <label class="form-field full">
+            <span>Mật khẩu tạm</span>
+            <input type="password" name="password" minlength="8" autocomplete="new-password" required>
+          </label>
+        </div>
+        <div class="modal-actions">
+          <button class="btn btn-primary" type="submit">
+            <span class="material-symbols-outlined">person_add</span>
+            Tạo user
+          </button>
+        </div>
+      </form>
+    </section>
+
+    <section class="table-panel">
+      <div class="page-filters inline">
+        <label class="filter-field">
+          <span>Role</span>
+          <select data-filter-select data-filter-column="role" data-filter-table="usersTable">
+            <option value="">Tất cả</option>
+            <option value="Admin">Admin</option>
+            <option value="User">User</option>
+          </select>
+        </label>
+        <label class="filter-field">
+          <span>Status</span>
+          <select data-filter-select data-filter-column="status" data-filter-table="usersTable">
+            <option value="">Tất cả</option>
+            <option value="Active">Active</option>
+            <option value="Inactive">Inactive</option>
+          </select>
+        </label>
+        <label class="filter-field wide">
+          <span>Search</span>
+          <input type="search" placeholder="Tìm theo username, email, họ tên..." data-table-search="usersTable">
+        </label>
+      </div>
+
+      <div class="table-wrap">
+        <table id="usersTable" class="data-table users-table">
+          <thead>
+            <tr>
+              <th>User</th>
+              <th>Email</th>
+              <th>Role</th>
+              <th>Status</th>
+              <th>Created</th>
+              <th>Owned data</th>
+              <th>Session</th>
+              <th class="action-col">Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            <% if (users.length === 0) { %>
+              <tr>
+                <td colspan="8" class="table-empty">Chưa có user nào.</td>
+              </tr>
+            <% } %>
+            <% users.forEach((user) => { %>
+              <tr
+                data-search="<%= `${user.username} ${user.email} ${user.fullName}`.toLowerCase() %>"
+                data-role="<%= user.role %>"
+                data-status="<%= user.status %>"
+                data-user-id="<%= user.id %>"
+                data-user-name="<%= user.name %>"
+                data-user-username="<%= user.username %>"
+                data-user-email="<%= user.email %>"
+                data-user-full-name="<%= user.fullName %>"
+                data-user-role="<%= user.role %>"
+                data-user-status="<%= user.status %>"
+                data-user-active="<%= user.isActive ? 'true' : 'false' %>"
+                data-user-created-at="<%= user.createdAt %>"
+                data-user-updated-at="<%= user.updatedAt %>"
+                data-user-package-count="<%= user.packageCount %>"
+                data-user-application-count="<%= user.applicationCount %>"
+              >
+                <td>
+                  <span class="table-title"><%= user.name %></span>
+                  <span class="table-subtitle"><%= user.username %></span>
+                </td>
+                <td><%= user.email %></td>
+                <td><span class="badge <%= helpers.statusClass(user.role) %>"><%= user.role %></span></td>
+                <td><span class="badge <%= helpers.statusClass(user.status) %>"><%= user.status %></span></td>
+                <td><%= user.createdAt %></td>
+                <td>
+                  <span class="table-subtitle"><%= user.packageCount %> packages</span>
+                  <span class="table-subtitle"><%= user.applicationCount %> apps</span>
+                </td>
+                <td>
+                  <% if (user.id === currentUser.id) { %>
+                    <span class="badge badge-muted">Đang đăng nhập</span>
+                  <% } else { %>
+                    <span class="table-subtitle">-</span>
+                  <% } %>
+                </td>
+                <td class="action-col">
+                  <div class="user-actions">
+                    <button class="icon-button subtle" type="button" title="Xem user" aria-label="Xem user <%= user.username %>" data-user-view>
+                      <span class="material-symbols-outlined">visibility</span>
+                    </button>
+                    <button class="icon-button subtle" type="button" title="Sửa user" aria-label="Sửa user <%= user.username %>" data-user-edit <%= user.id === currentUser.id ? 'data-current-user="true"' : '' %>>
+                      <span class="material-symbols-outlined">edit</span>
+                    </button>
+                    <% if (user.id !== currentUser.id) { %>
+                      <form method="post" action="/users/<%= user.id %>/delete" data-confirm-submit="Xóa user <%= user.username %>? Thao tác này không thể hoàn tác.">
+                        <button class="icon-button danger" type="submit" title="Xóa user" aria-label="Xóa user <%= user.username %>">
+                          <span class="material-symbols-outlined">delete</span>
+                        </button>
+                      </form>
+                    <% } %>
+                  </div>
+                </td>
+              </tr>
+            <% }) %>
+          </tbody>
+        </table>
+      </div>
+      <div class="page-pager">
+        <span>Showing 1-<%= users.length %> of <%= users.length %></span>
+        <div>
+          <button type="button" disabled>Prev</button>
+          <span>Page 1 / 1</span>
+          <button type="button" disabled>Next</button>
+        </div>
+      </div>
+    </section>
+  </div>
+</section>
+
+<div id="userDetailModal" class="modal-backdrop" role="dialog" aria-modal="true" aria-labelledby="userDetailTitle">
+  <div class="modal-content">
+    <div class="modal-header">
+      <h3 id="userDetailTitle">Thông tin user</h3>
+      <button class="icon-button subtle" type="button" data-modal-close aria-label="Đóng">
+        <span class="material-symbols-outlined">close</span>
+      </button>
+    </div>
+    <div class="modal-form">
+      <dl class="detail-list user-detail-list">
+        <div>
+          <dt>Họ tên</dt>
+          <dd data-user-detail="name"></dd>
+        </div>
+        <div>
+          <dt>Username</dt>
+          <dd data-user-detail="username"></dd>
+        </div>
+        <div>
+          <dt>Email</dt>
+          <dd data-user-detail="email"></dd>
+        </div>
+        <div>
+          <dt>Mật khẩu</dt>
+          <dd>Không hiển thị. Có thể đặt lại trong phần Sửa user.</dd>
+        </div>
+        <div>
+          <dt>Role</dt>
+          <dd data-user-detail="role"></dd>
+        </div>
+        <div>
+          <dt>Status</dt>
+          <dd data-user-detail="status"></dd>
+        </div>
+        <div>
+          <dt>Created</dt>
+          <dd data-user-detail="createdAt"></dd>
+        </div>
+        <div>
+          <dt>Updated</dt>
+          <dd data-user-detail="updatedAt"></dd>
+        </div>
+        <div>
+          <dt>Owned data</dt>
+          <dd data-user-detail="ownedData"></dd>
+        </div>
+      </dl>
+    </div>
+  </div>
+</div>
+
+<div id="editUserModal" class="modal-backdrop" role="dialog" aria-modal="true" aria-labelledby="editUserTitle">
+  <div class="modal-content">
+    <div class="modal-header">
+      <h3 id="editUserTitle">Sửa user</h3>
+      <button class="icon-button subtle" type="button" data-modal-close aria-label="Đóng">
+        <span class="material-symbols-outlined">close</span>
+      </button>
+    </div>
+    <form id="editUserForm" class="modal-form" method="post" action="/users">
+      <div class="form-stack">
+        <label class="form-field">
+          <span>Username</span>
+          <input type="text" name="username" required data-edit-user-field="username">
+        </label>
+        <label class="form-field">
+          <span>Họ tên</span>
+          <input type="text" name="fullName" data-edit-user-field="fullName">
+        </label>
+        <label class="form-field">
+          <span>Email</span>
+          <input type="email" name="email" required data-edit-user-field="email">
+        </label>
+        <label class="form-field">
+          <span>Role</span>
+          <select name="role" data-edit-user-field="role">
+            <option value="User">User</option>
+            <option value="Admin">Admin</option>
+          </select>
+        </label>
+        <label class="form-field">
+          <span>Mật khẩu mới</span>
+          <input type="password" name="newPassword" minlength="8" autocomplete="new-password" data-edit-user-field="newPassword">
+        </label>
+        <label class="form-field">
+          <span>Xác nhận mật khẩu mới</span>
+          <input type="password" name="confirmPassword" minlength="8" autocomplete="new-password" data-edit-user-field="confirmPassword">
+        </label>
+        <label class="inline-checkbox edit-active-toggle">
+          <input class="checkbox" type="checkbox" name="isActive" data-edit-user-field="isActive">
+          Active
+        </label>
+      </div>
+      <div class="modal-actions">
+        <button class="btn btn-secondary" type="button" data-modal-close>Hủy</button>
+        <button class="btn btn-primary" type="submit">
+          <span class="material-symbols-outlined">save</span>
+          Lưu
+        </button>
+      </div>
+    </form>
+  </div>
+</div>
+
+<%- include('partials/page-end') %>