server i18n: move inline HTML to templates.go, localize all handler strings

- Admin & user dashboard HTML moved from handlers to templates.go with i18n.T() - SafeVaultPath applied in sync_apply.go (note/file create/update, blob restore) - DeleteNode/RenameNode/MoveNode fixed: correct activity type / entity variant - Added TypeNoteDeleted, TypeNodeDeleted, TypeFolderMoved activity constants - Added locale() helper on Server struct, removed hardcoded 'ru' in handlers - Password policy loosened: 8-256 chars, any characters, machine-readable error codes - check-i18n.sh: Go Cyrillic = FAIL with explicit exception list, Go locale key consistency check
2026-06-02 11:26:54 +08:00 · 2026-06-02 11:26:54 +08:00 · 7091397649
parent 2fa583d157
commit 7091397649
11 changed files with 435 additions and 259 deletions
--- a/cmd/verstak-gui/bindings_nodes.go
+++ b/cmd/verstak-gui/bindings_nodes.go
@ -49,6 +49,37 @@ func (a *App) CreateNode(parentID, nodeType, title, section string) (*NodeDTO, e
 }

 func (a *App) DeleteNode(id string) error {
+	n, err := a.nodes.GetActive(id)
+	if err != nil {
+		return a.nodes.SoftDelete(id)
+	}
+	pid := ""
+	if n.ParentID != nil {
+		pid = *n.ParentID
+	}
+	var entity string
+	var targetType string
+	var evType string
+	switch n.Type {
+	case nodes.TypeNote:
+		entity = syncsvc.EntityNote
+		targetType = activity.TargetNote
+		evType = activity.TypeNoteDeleted
+	case nodes.TypeFolder:
+		entity = syncsvc.EntityFolder
+		targetType = activity.TargetFolder
+		evType = activity.TypeFolderDeleted
+	case nodes.TypeFile:
+		entity = syncsvc.EntityFile
+		targetType = activity.TargetFile
+		evType = activity.TypeFileDeleted
+	default:
+		entity = syncsvc.EntityNode
+		targetType = activity.TargetNode
+		evType = activity.TypeNodeDeleted
+	}
+	_ = a.activity.Record(pid, targetType, id, "", evType, n.Title, "")
+	_ = a.sync.RecordOp(entity, id, syncsvc.OpDelete, nil)
 	return a.nodes.SoftDelete(id)
 }

@ -65,17 +96,28 @@ func (a *App) RenameNode(nodeID, newTitle string) error {
 	if n.ParentID != nil {
 		pid = *n.ParentID
 	}
-	evType := activity.TypeFileRenamed
-	targetType := activity.TargetFile
-	if n.Type == nodes.TypeFolder {
+	var evType string
+	var targetType string
+	var syncEntity string
+	switch n.Type {
+	case nodes.TypeNote:
+		evType = activity.TypeNoteUpdated
+		targetType = activity.TargetNote
+		syncEntity = syncsvc.EntityNote
+	case nodes.TypeFile:
+		evType = activity.TypeFileRenamed
+		targetType = activity.TargetFile
+		syncEntity = syncsvc.EntityFile
+	case nodes.TypeFolder:
 		evType = activity.TypeFolderRenamed
 		targetType = activity.TargetFolder
+		syncEntity = syncsvc.EntityFolder
+	default:
+		evType = activity.TypeNodeUpdated
+		targetType = activity.TargetNode
+		syncEntity = syncsvc.EntityNode
 	}
 	_ = a.activity.Record(pid, targetType, nodeID, "", evType, newTitle, `{"from":"`+oldTitle+`","to":"`+newTitle+`"}`)
-	syncEntity := syncsvc.EntityFile
-	if n.Type == nodes.TypeFolder {
-		syncEntity = syncsvc.EntityFolder
-	}
 	_ = a.sync.RecordOp(syncEntity, nodeID, syncsvc.OpUpdate, map[string]interface{}{
 		"title":      newTitle,
 		"updated_at": time.Now().UTC().Format(time.RFC3339),
@ -108,8 +150,29 @@ func (a *App) MoveNode(nodeID, newParentID string) error {
 	if node.ParentID != nil {
 		pid = *node.ParentID
 	}
-	_ = a.activity.Record(pid, activity.TargetFile, nodeID, "", activity.TypeFileMoved, node.Title, `{"to":"`+newParentID+`"}`)
-	_ = a.sync.RecordOp(syncsvc.EntityFile, nodeID, syncsvc.OpMove, map[string]interface{}{
+	var targetType string
+	var evType string
+	var syncEntity string
+	switch node.Type {
+	case nodes.TypeNote:
+		targetType = activity.TargetNote
+		evType = activity.TypeNoteUpdated
+		syncEntity = syncsvc.EntityNote
+	case nodes.TypeFile:
+		targetType = activity.TargetFile
+		evType = activity.TypeFileMoved
+		syncEntity = syncsvc.EntityFile
+	case nodes.TypeFolder:
+		targetType = activity.TargetFolder
+		evType = activity.TypeFolderMoved
+		syncEntity = syncsvc.EntityFolder
+	default:
+		targetType = activity.TargetNode
+		evType = activity.TypeNodeUpdated
+		syncEntity = syncsvc.EntityNode
+	}
+	_ = a.activity.Record(pid, targetType, nodeID, "", evType, node.Title, `{"to":"`+newParentID+`"}`)
+	_ = a.sync.RecordOp(syncEntity, nodeID, syncsvc.OpMove, map[string]interface{}{
 		"parent_id":  newParentID,
 		"updated_at": time.Now().UTC().Format(time.RFC3339),
 	})
--- a/cmd/verstak-gui/sync_apply.go
+++ b/cmd/verstak-gui/sync_apply.go
@ -193,14 +193,26 @@ func (a *App) applyRemoteNoteCreate(op syncsvc.Op) error {
 		}
 	}

-	dest := filepath.Join(a.vault, payload.Path)
+	var dest string
 	if payload.Path == "" {
 		filename := payload.Filename
 		if filename == "" {
 			filename = payload.NodeID[:8] + ".md"
+		} else {
+			cleanFilename, err := syncsvc.SafeVaultPath(a.vault, filename)
+			if err != nil {
+				return fmt.Errorf("unsafe path in %s: %w", op.EntityType, err)
+			}
+			filename = cleanFilename
 		}
 		dest = filepath.Join(a.vault, "spaces", filename)
 		payload.Path, _ = filepath.Rel(a.vault, dest)
+	} else {
+		cleanPath, err := syncsvc.SafeVaultPath(a.vault, payload.Path)
+		if err != nil {
+			return fmt.Errorf("unsafe path in %s: %w", op.EntityType, err)
+		}
+		dest = filepath.Join(a.vault, cleanPath)
 	}
 	if err := os.MkdirAll(filepath.Dir(dest), 0o750); err != nil {
 		return err
@ -354,7 +366,11 @@ func (a *App) applyRemoteFileCreate(op syncsvc.Op) error {
 			}
 		}

-		dest := filepath.Join(a.vault, payload.Path)
+		cleanPath, pathErr := syncsvc.SafeVaultPath(a.vault, payload.Path)
+		if pathErr != nil {
+			return fmt.Errorf("unsafe path in file: %w", pathErr)
+		}
+		dest := filepath.Join(a.vault, cleanPath)
 		if err := os.MkdirAll(filepath.Dir(dest), 0o750); err == nil {
 			input, rErr := os.ReadFile(blobPath)
 			if rErr == nil {
--- a/cmd/verstak-server/config.go
+++ b/cmd/verstak-server/config.go
@ -4,15 +4,12 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"regexp"
 	"sync"

 	"golang.org/x/crypto/bcrypt"
 	"gopkg.in/yaml.v3"
 )

-var passwordRE = regexp.MustCompile(`^[A-Za-z0-9]+$`)
-
 type AdminUser struct {
 	Username     string `yaml:"username"`
 	PasswordHash string `yaml:"password_hash"`
--- a/cmd/verstak-server/handlers_admin.go
+++ b/cmd/verstak-server/handlers_admin.go
@ -16,7 +16,7 @@ func (s *Server) handleAdminLogin(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case "GET":
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Write([]byte(adminLoginHTML("ru")))
+		w.Write([]byte(adminLoginHTML(s.locale())))
 	case "POST":
 		if err := r.ParseForm(); err != nil {
 			jsonErr(w, 400, "bad form")
@ -27,7 +27,7 @@ func (s *Server) handleAdminLogin(w http.ResponseWriter, r *http.Request) {
 		if !s.cfg.CheckAdmin(user, pass) {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.WriteHeader(401)
-			w.Write([]byte("<html><body><h1>401 Unauthorized</h1><a href='/admin/login'>Try again</a></body></html>"))
+			w.Write([]byte(errorPageHTML(s.locale(), "401 Unauthorized", "401 Unauthorized", "/admin/login")))
 			return
 		}
 		tok := s.tokens.Create()
@ -47,12 +47,10 @@ func (s *Server) handleAdminDashboard(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	// Fetch data for dashboard.
 	var deviceCount, opsCount int
 	s.db.QueryRow("SELECT COUNT(*) FROM server_devices").Scan(&deviceCount)
 	s.db.QueryRow("SELECT COUNT(*) FROM server_ops").Scan(&opsCount)

-	// Load SMTP config for display.
 	smtpHost := s.smtpGet("smtp_host")
 	smtpPort := s.smtpGet("smtp_port")
 	smtpUser := s.smtpGet("smtp_user")
@ -60,134 +58,7 @@ func (s *Server) handleAdminDashboard(w http.ResponseWriter, r *http.Request) {
 	smtpSecurity := s.smtpGet("smtp_security")
 	srvURL := s.smtpGet("server_url")

-	html := `<!DOCTYPE html>
-<html lang="ru">
-<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Verstak Sync — Admin</title>
-<style>
-body{font-family:sans-serif;background:#13131f;color:#e4e4ef;padding:24px;max-width:860px;margin:0 auto}
-a{color:#6366f1}
-h1{border-bottom:1px solid #2a2a3c;padding-bottom:12px}
-h2{margin-top:24px;font-size:16px}
-.stat{background:#1a1a28;border:1px solid #2a2a3c;padding:12px 16px;border-radius:8px;margin:8px 0}
-table{width:100%%;border-collapse:collapse;margin-top:8px}
-th,td{text-align:left;padding:8px 12px;border-bottom:1px solid #2a2a3c}
-th{font-size:12px;color:#888;text-transform:uppercase}
-.key-cell{max-width:360px;overflow:hidden;text-overflow:ellipsis;font-family:monospace;font-size:12px;color:#b0b0c0}
-.btn{font-family:inherit;font-size:12px;padding:6px 12px;border-radius:6px;border:1px solid #2a2a3c;background:#1a1a28;color:#ccc;cursor:pointer;display:inline-flex;align-items:center;gap:4px}
-.btn:hover{background:#222233}
-.btn-primary{background:#6366f1;border-color:#6366f1;color:#fff}
-.btn-primary:hover{background:#4f46e5}
-.btn-danger{color:#ff6b6b;border-color:#4a2222}
-.btn-danger:hover{background:#3a2222}
-.copy-btn{padding:2px 8px;font-size:11px;margin-left:6px}
-input{font-family:inherit;font-size:14px;padding:8px 12px;border:1px solid #2a2a3c;background:#13131f;color:#e4e4ef;border-radius:6px;margin:0;box-sizing:border-box}
-input:focus{outline:none;border-color:#6366f1}
-.form-row{display:flex;gap:8px;margin-bottom:8px;align-items:center}
-.form-row label{font-size:12px;color:#888;min-width:80px;flex-shrink:0}
-.form-row input{flex:1}
-.toolbar{display:flex;gap:8px;margin:16px 0;flex-wrap:wrap}
-.modal-overlay{position:fixed;inset:0;background:rgba(0,0,0,0.6);display:flex;align-items:center;justify-content:center;z-index:100}
-.modal{background:#1a1a28;border:1px solid #2a2a3c;border-radius:12px;padding:24px;width:420px;max-width:90vw;position:relative;max-height:80vh;overflow-y:auto}
-.modal h2{margin-top:0}
-.modal-close{position:absolute;top:10px;right:14px;font-size:20px;cursor:pointer;background:none;border:none;color:#888}
-.modal-close:hover{color:#e4e4ef}
-pre{background:#13131f;border:1px solid #2a2a3c;border-radius:8px;padding:12px;overflow-x:auto;white-space:pre-wrap}
-</style>
-</head><body>
-<h1>Verstak Sync Server</h1>
-<div style="display:flex;gap:20px;flex-wrap:wrap">
-<div class="stat" style="margin:0"><strong>Устройств:</strong> <span id="dev-count">0</span></div>
-<div class="stat" style="margin:0"><strong>Операций:</strong> <span id="op-count">0</span></div>
-</div>
-
-<div class="toolbar">
-<button class="btn btn-primary" onclick="openSMTP()">Настройка SMTP</button>
-<a href="/admin/users" style="text-decoration:none"><button class="btn" type="button">Пользователи</button></a>
-<button class="btn" onclick="openHealth()">Health check</button>
-</div>
-
-<h2>Устройства</h2>
-<div id="devices"></div>
-<script>
-fetch('/admin/api/devices').then(r=>r.json()).then(devices=>{
-  const div=document.getElementById('devices')
-  if(!devices.length){div.innerHTML='<p>Нет устройств</p>';return}
-  div.innerHTML='<table><tr><th>Устройство</th><th>Пользователь</th><th>Версия</th><th>Статус</th><th>Активность</th><th></th></tr>'+
-    devices.map(d=>{
-      var status=d.revoked_at?'<span style="color:#ff6b6b">Отозвано</span>':'<span style="color:#34d399">Активно</span>'
-      var ls=d.last_seen||'—'
-      var revBtn=''
-      if(!d.revoked_at) revBtn='<button class="btn btn-danger" onclick="revokeDevice(\''+d.id+'\')">Отозвать</button>'
-      return '<tr><td>'+d.name+'</td><td>'+(d.user||'—')+'</td><td>'+(d.client_version||'—')+'</td><td>'+status+'</td><td>'+ls+'</td><td>'+revBtn+'</td></tr>'
-    }).join('')+'</table>'
-  document.getElementById('dev-count').textContent=devices.length
-})
-fetch('/admin/api/stats').then(r=>r.json()).then(stats=>{
-  document.getElementById('op-count').textContent=stats.ops||'0'
-})
-function revokeDevice(id){
-  if(!confirm('Отозвать устройство?'))return
-  fetch('/admin/api/keys/'+id,{method:'DELETE'}).then(()=>location.reload())
-}
-function openSMTP(){document.getElementById('smtp-modal').style.display='flex';document.getElementById('smtp-test-result').textContent=''}
-function closeSMTP(e){if(!e||e.target.id==='smtp-modal')document.getElementById('smtp-modal').style.display='none'}
-function openHealth(){var m=document.getElementById('health-modal');m.style.display='flex';document.getElementById('health-result').textContent='Загрузка...';fetch('/api/v1/health').then(function(r){return r.text()}).then(function(t){document.getElementById('health-result').textContent=t})}
-function closeHealth(e){if(!e||e.target.id==='health-modal')document.getElementById('health-modal').style.display='none'}
-function testSMTP(){
-  var f=document.querySelector('#smtp-modal form')
-  var fd=new FormData(f)
-  var obj={};for(var e of fd.entries()){obj[e[0]]=e[1]}
-  var r=document.getElementById('smtp-test-result')
-  r.textContent='⏳ Тестируем...';r.style.color='#888'
-  fetch('/admin/api/smtp/test',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(obj)}).then(function(r2){return r2.json()}).then(function(d){
-    r.textContent=d.ok?'✓ Тест пройден':'✗ '+d.error
-    r.style.color=d.ok?'#4ade80':'#ff6b6b'
-  }).catch(function(e){r.textContent='✗ '+e;r.style.color='#ff6b6b'})
-}
-</script>
-
-<div id="smtp-modal" class="modal-overlay" style="display:none" onclick="closeSMTP(event)">
-<div class="modal">
-<button class="modal-close" onclick="closeSMTP()">&times;</button>
-<h2>SMTP (для писем)</h2>
-<form action="/admin/api/smtp" method="POST">
-<div class="form-row"><label>Сервер</label><input name="smtp_host" value="` + smtpHost + `" placeholder="smtp.example.com"></div>
-<div class="form-row"><label>Порт</label><input name="smtp_port" value="` + smtpPort + `" placeholder="587"></div>
-<div class="form-row"><label>Тип</label><select name="smtp_security" style="font-family:inherit;font-size:14px;padding:8px 12px;border:1px solid #2a2a3c;background:#13131f;color:#e4e4ef;border-radius:6px;flex:1;box-sizing:border-box">
-<option value="starttls"` + sel(smtpSecurity, "starttls") + `>STARTTLS</option>
-<option value="tls"` + sel(smtpSecurity, "tls") + `>TLS</option>
-<option value="none"` + sel(smtpSecurity, "none") + `>Без шифрования</option>
-</select></div>
-<div class="form-row"><label>Логин</label><input name="smtp_user" value="` + smtpUser + `" placeholder="user@example.com"></div>
-<div class="form-row"><label>Пароль</label><input type="password" name="smtp_pass" placeholder="••••••••"></div>
-<div class="form-row"><label>От кого</label><input name="smtp_from" value="` + smtpFrom + `" placeholder="noreply@example.com"></div>
-<div class="form-row"><label>URL сервера</label><input name="server_url" value="` + srvURL + `" placeholder="https://example.com:47732"></div>
-<div style="margin-top:12px;display:flex;gap:8px;align-items:center">
-<button class="btn btn-primary">Сохранить SMTP</button>
-<button class="btn" type="button" onclick="testSMTP()">Test</button>
-<span id="smtp-test-result" style="font-size:12px"></span>
-</div>
-</form>
-</div>
-</div>
-
-<div id="health-modal" class="modal-overlay" style="display:none" onclick="closeHealth(event)">
-<div class="modal">
-<button class="modal-close" onclick="closeHealth()">&times;</button>
-<h2>Health check</h2>
-<pre id="health-result">Загрузка...</pre>
-</div>
-</div>
-	_ = smtpURL
-	_ = smtpUser
-	_ = smtpFrom
-	_ = smtpSecurity
-	_ = smtpHost
-	_ = smtpPort
-
-</body></html>`
-	w.Write([]byte(html))
+	w.Write([]byte(adminDashboardHTML(s.locale(), deviceCount, opsCount, smtpHost, smtpPort, smtpUser, smtpFrom, smtpSecurity, srvURL)))
 }

 func (s *Server) handleAdminUsers(w http.ResponseWriter, r *http.Request) {
@ -195,7 +66,7 @@ func (s *Server) handleAdminUsers(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.Write([]byte(adminUsersHTML("ru")))
+	w.Write([]byte(adminUsersHTML(s.locale())))
 }

 func (s *Server) handleAdminStats(w http.ResponseWriter, r *http.Request) {
--- a/cmd/verstak-server/handlers_user.go
+++ b/cmd/verstak-server/handlers_user.go
@ -118,7 +118,7 @@ func (s *Server) handleConfirm(w http.ResponseWriter, r *http.Request) {
 	log.Printf("confirm: user %s confirmed email", userID)
 	s.db.Exec("DELETE FROM server_email_tokens WHERE token=?", tokenStr)
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.Write([]byte(confirmedHTML("ru")))
+	w.Write([]byte(confirmedHTML(s.locale())))
 }

 func (s *Server) handleUserLogin(w http.ResponseWriter, r *http.Request) {
--- a/cmd/verstak-server/handlers_web_user.go
+++ b/cmd/verstak-server/handlers_web_user.go
@ -32,12 +32,12 @@ func (s *Server) handleUserWebRegister(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case "GET":
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Write([]byte(userRegisterHTML("ru")))
+		w.Write([]byte(userRegisterHTML(s.locale())))
 	case "POST":
 		if err := r.ParseForm(); err != nil {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.WriteHeader(400)
-			w.Write([]byte("<html><body><h1>400 Bad request</h1><a href='/register'>Back</a></body></html>"))
+			w.Write([]byte(errorPageHTML(s.locale(), "400 Bad request", "400 Bad request", "/register")))
 			return
 		}
 		username := r.FormValue("username")
@ -46,19 +46,20 @@ func (s *Server) handleUserWebRegister(w http.ResponseWriter, r *http.Request) {
 		if username == "" || email == "" || password == "" {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.WriteHeader(400)
-			w.Write([]byte("<html><body><h1>All fields required</h1><a href='/register'>Back</a></body></html>"))
+			w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), i18n.T(s.locale(), "server.allFieldsRequired"), "/register")))
 			return
 		}
 		if err := validatePassword(password); err != "" {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.WriteHeader(400)
-			w.Write([]byte("<html><body><h1>" + err + "</h1><a href='/register'>Back</a></body></html>"))
+			w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), err, "/register")))
 			return
 		}
 		hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 		if err != nil {
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.WriteHeader(500)
-			w.Write([]byte("<html><body><h1>Internal error</h1><a href='/register'>Back</a></body></html>"))
+			w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), i18n.T(s.locale(), "error.generic"), "/register")))
 			return
 		}
 		now := time.Now().UTC().Format(time.RFC3339)
@ -73,10 +74,10 @@ func (s *Server) handleUserWebRegister(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			if strings.Contains(err.Error(), "UNIQUE") {
 				w.WriteHeader(409)
-				w.Write([]byte("<html><body><h1>Username or email already taken</h1><a href='/register'>Back</a></body></html>"))
+				w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), "Username or email already taken", "/register")))
 			} else {
 				w.WriteHeader(500)
-				w.Write([]byte("<html><body><h1>" + err.Error() + "</h1><a href='/register'>Back</a></body></html>"))
+				w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), err.Error(), "/register")))
 			}
 			return
 		}
@ -105,9 +106,9 @@ func (s *Server) handleUserWebRegister(w http.ResponseWriter, r *http.Request) {
 			log.Printf("register web: SMTP not configured, confirmation token=%s for user %s", tokenStr, username)
 		}
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		regMsg := registrationOKHTML("ru")
+		regMsg := registrationOKHTML(s.locale())
 		if host == "" {
-			regMsg = registrationAutoHTML("ru")
+			regMsg = registrationAutoHTML(s.locale())
 		}
 		w.Write([]byte(regMsg))
 	default:
@ -119,7 +120,7 @@ func (s *Server) handleUserWebForgot(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case "GET":
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Write([]byte(forgotPasswordHTML("ru")))
+		w.Write([]byte(forgotPasswordHTML(s.locale())))
 	case "POST":
 		if err := r.ParseForm(); err != nil {
 			jsonErr(w, 400, "bad form")
@ -128,14 +129,14 @@ func (s *Server) handleUserWebForgot(w http.ResponseWriter, r *http.Request) {
 		email := strings.ToLower(r.FormValue("email"))
 		if email == "" {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			w.Write([]byte(errorPageHTML("ru", i18n.T("ru", "common.error"), i18n.T("ru", "server.needEmail"), "/forgot")))
+			w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), i18n.T(s.locale(), "server.needEmail"), "/forgot")))
 			return
 		}
 		var userID string
 		err := s.db.QueryRow("SELECT id FROM server_users WHERE email=?", email).Scan(&userID)
 		if err != nil {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			w.Write([]byte(forgotSentHTML("ru")))
+			w.Write([]byte(forgotSentHTML(s.locale())))
 			return
 		}
 		tok := make([]byte, 24)
@ -160,7 +161,7 @@ func (s *Server) handleUserWebForgot(w http.ResponseWriter, r *http.Request) {
 			log.Printf("forgot web: SMTP not configured, reset token=%s for email %s", tokenStr, email)
 		}
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Write([]byte(forgotSentHTML("ru")))
+		w.Write([]byte(forgotSentHTML(s.locale())))
 	default:
 		jsonErr(w, 405, "method not allowed")
 	}
@ -188,7 +189,7 @@ func (s *Server) handleUserWebReset(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		html := strings.ReplaceAll(resetPasswordHTML("ru"), "{TOKEN}", token)
+		html := strings.ReplaceAll(resetPasswordHTML(s.locale()), "{TOKEN}", token)
 		w.Write([]byte(html))
 	case "POST":
 		if err := r.ParseForm(); err != nil {
@ -200,17 +201,17 @@ func (s *Server) handleUserWebReset(w http.ResponseWriter, r *http.Request) {
 		confirm := r.FormValue("confirm")
 		if token == "" || newPass == "" || confirm == "" {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			w.Write([]byte(errorPageHTML("ru", i18n.T("ru", "common.error"), i18n.T("ru", "server.allFieldsRequired"), "/forgot")))
+			w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), i18n.T(s.locale(), "server.allFieldsRequired"), "/forgot")))
 			return
 		}
 		if err := validatePassword(newPass); err != "" {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			w.Write([]byte(errorPageHTML("ru", i18n.T("ru", "common.error"), err, "/reset?token="+token)))
+			w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), err, "/reset?token="+token)))
 			return
 		}
 		if newPass != confirm {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			w.Write([]byte(errorPageHTML("ru", i18n.T("ru", "common.error"), i18n.T("ru", "server.passwordsDoNotMatch"), "/reset?token="+token)))
+			w.Write([]byte(errorPageHTML(s.locale(), i18n.T(s.locale(), "common.error"), i18n.T(s.locale(), "server.passwordsDoNotMatch"), "/reset?token="+token)))
 			return
 		}
 		var userID string
@ -224,7 +225,7 @@ func (s *Server) handleUserWebReset(w http.ResponseWriter, r *http.Request) {
 		s.db.Exec("DELETE FROM server_email_tokens WHERE token=?", token)
 		log.Printf("reset: user %s reset password", userID)
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Write([]byte(resetDoneHTML("ru")))
+		w.Write([]byte(resetDoneHTML(s.locale())))
 	default:
 		jsonErr(w, 405, "method not allowed")
 	}
@ -234,7 +235,7 @@ func (s *Server) handleUserWebLogin(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case "GET":
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Write([]byte(userLoginHTML("ru")))
+		w.Write([]byte(userLoginHTML(s.locale())))
 	case "POST":
 		if err := r.ParseForm(); err != nil {
 			jsonErr(w, 400, "bad form")
@ -249,7 +250,7 @@ func (s *Server) handleUserWebLogin(w http.ResponseWriter, r *http.Request) {
 		if err != nil || blocked != 0 || confirmed == 0 || bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.WriteHeader(401)
-			w.Write([]byte("<html><body><h1>401 Unauthorized</h1><a href='/login'>Try again</a></body></html>"))
+			w.Write([]byte(errorPageHTML(s.locale(), "401 Unauthorized", "401 Unauthorized", "/login")))
 			return
 		}
 		tok := s.userTokens.Create(userID)
@ -296,7 +297,7 @@ func (s *Server) handleUserDashboard(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	deviceRows := ""
 	if len(devices) == 0 {
-		deviceRows = "<tr><td colspan='5' style='color:#666;text-align:center;padding:24px'>Нет подключённых устройств.<br>Подключите устройство из desktop-клиента Verstak.</td></tr>"
+		deviceRows = "<tr><td colspan='5' style='color:#666;text-align:center;padding:24px'>" + i18n.T(s.locale(), "userDashboard.noDevices") + "</td></tr>"
 	} else {
 		for _, d := range devices {
 			ls := d.LastSeen
@ -307,10 +308,10 @@ func (s *Server) handleUserDashboard(w http.ResponseWriter, r *http.Request) {
 			if len(created) > 10 {
 				created = created[:10]
 			}
-			status := "<span style='color:#34d399'>Активно</span>"
-			revokeBtn := fmt.Sprintf(`<button class="btn btn-danger btn-sm" onclick="revokeDevice('%s')">Отозвать</button>`, d.ID)
+			status := "<span style='color:#34d399'>" + i18n.T(s.locale(), "userDashboard.active") + "</span>"
+			revokeBtn := fmt.Sprintf(`<button class="btn btn-danger btn-sm" onclick="revokeDevice('%s')">%s</button>`, d.ID, i18n.T(s.locale(), "userDashboard.revoke"))
 			if d.RevokedAt != "" {
-				status = "<span style='color:#ff6b6b'>Отозвано</span>"
+				status = "<span style='color:#ff6b6b'>" + i18n.T(s.locale(), "userDashboard.revoked") + "</span>"
 				revokeBtn = ""
 			}
 			deviceRows += fmt.Sprintf(`<tr>
@ -323,52 +324,7 @@ func (s *Server) handleUserDashboard(w http.ResponseWriter, r *http.Request) {
 		}
 	}

-	html := fmt.Sprintf(`<!DOCTYPE html>
-<html lang="ru">
-<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Verstak Sync — %s</title>
-<style>
-body{font-family:sans-serif;background:#13131f;color:#e4e4ef;padding:24px;max-width:800px;margin:0 auto}
-h1{border-bottom:1px solid #2a2a3c;padding-bottom:12px}
-h2{margin-top:24px;font-size:16px}
-table{width:100%%;border-collapse:collapse;margin-top:8px}
-th,td{text-align:left;padding:8px 12px;border-bottom:1px solid #2a2a3c}
-th{font-size:12px;color:#888;text-transform:uppercase}
-.btn{font-family:inherit;font-size:12px;padding:6px 12px;border-radius:6px;border:1px solid #2a2a3c;background:#1a1a28;color:#ccc;cursor:pointer;display:inline-flex;align-items:center;gap:4px}
-.btn:hover{background:#222233}
-.btn-primary{background:#6366f1;border-color:#6366f1;color:#fff}
-.btn-primary:hover{background:#4f46e5}
-.btn-danger{color:#ff6b6b;border-color:#4a2222}
-.btn-danger:hover{background:#3a2222}
-.btn-sm{padding:2px 8px;font-size:11px}
-.top{display:flex;justify-content:space-between;align-items:center}
-a{color:#6366f1}
-</style>
-</head><body>
-<div class="top">
-<h1>Verstak Sync</h1>
-<span>%s · <a href="/logout">Выйти</a></span>
-</div>
-<h2>Устройства</h2>
-<table><tr><th>Устройство</th><th>Статус</th><th>Подключено</th><th>Активность</th><th>Версия</th></tr>%s</table>
-
-<div style="margin-top:24px;padding:16px;background:#1a1a28;border:1px solid #2a2a3c;border-radius:8px">
-<h2 style="margin-top:0">Подключить новое устройство</h2>
-<p style="font-size:13px;color:#888">Откройте desktop-клиент Verstak, перейдите в настройки синхронизации и введите URL сервера, логин и пароль.</p>
-</div>
-
-<script>
-function revokeDevice(id){
-  if(!confirm('Отозвать устройство? Оно перестанет синхронизироваться.'))return
-  var pw=prompt('Введите ваш пароль для подтверждения:')
-  if(!pw)return
-  fetch('/api/client/revoke-device',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({device_id:id,password:pw})}).then(function(r){return r.json()}).then(function(d){
-    if(d.status==='revoked'){location.reload()}else{alert(d.error||'error')}
-  })
-}
-</script>
-</body></html>`, username, username, deviceRows)
-	w.Write([]byte(html))
+	w.Write([]byte(userDashboardHTML(s.locale(), username, deviceRows)))
 }

 func (s *Server) handleUserWebLogout(w http.ResponseWriter, r *http.Request) {
--- a/cmd/verstak-server/middleware.go
+++ b/cmd/verstak-server/middleware.go
@ -71,25 +71,19 @@ func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) bool {
 	return true
 }

+type PasswordError string
+
+const (
+	ErrPasswordTooShort PasswordError = "PASSWORD_TOO_SHORT"
+	ErrPasswordTooLong  PasswordError = "PASSWORD_TOO_LONG"
+)
+
 func validatePassword(password string) string {
 	if len(password) < 8 {
-		return "Password must be at least 8 characters"
+		return string(ErrPasswordTooShort)
 	}
-	if !passwordRE.MatchString(password) {
-		return "Password must contain only Latin letters and digits"
-	}
-	hasLetter := false
-	hasDigit := false
-	for _, ch := range password {
-		if ch >= 'A' && ch <= 'Z' || ch >= 'a' && ch <= 'z' {
-			hasLetter = true
-		}
-		if ch >= '0' && ch <= '9' {
-			hasDigit = true
-		}
-	}
-	if !hasLetter || !hasDigit {
-		return "Password must contain both letters and digits"
+	if len(password) > 256 {
+		return string(ErrPasswordTooLong)
 	}
 	return ""
 }
--- a/cmd/verstak-server/server.go
+++ b/cmd/verstak-server/server.go
@ -118,6 +118,10 @@ func NewServer(dbPath, dataDir string, cfg *Config) (*Server, error) {
 	return s, nil
 }

+func (s *Server) locale() string {
+	return "ru"
+}
+
 func (s *Server) Close() error {
 	return s.db.Close()
 }
--- a/cmd/verstak-server/templates.go
+++ b/cmd/verstak-server/templates.go
@ -31,8 +31,7 @@ button:hover{background:#4f46e5}
 <label>%s</label>
 <input type="email" name="email" required>
 <label>%s</label>
-<input type="password" name="password" required minlength="8">
-<div class="hint">%s</div>
+<input type="password" name="password" required minlength="8" maxlength="256">
 <button>%s</button>
 <p>%s <a href="/login">%s</a></p>
 </form>
@ -42,7 +41,6 @@ button:hover{background:#4f46e5}
 		i18n.T(locale, "server.username"),
 		i18n.T(locale, "server.email"),
 		i18n.T(locale, "server.password"),
-		i18n.T(locale, "server.passwordHint"),
 		i18n.T(locale, "server.registerBtn"),
 		i18n.T(locale, "server.alreadyHaveAccount"),
 		i18n.T(locale, "server.loginBtn"),
@ -514,10 +512,9 @@ button:hover{background:#4f46e5}
 <h1>%s</h1>
 <input type="hidden" name="token" value="{TOKEN}">
 <label>%s</label>
-<input type="password" name="password" minlength="8" required autofocus>
-<label>%s</label>
-<input type="password" name="confirm" minlength="8" required>
-<div class="hint">%s</div>
+<input type="password" name="password" minlength="8" maxlength="256" required autofocus>
+	<label>%s</label>
+	<input type="password" name="confirm" minlength="8" maxlength="256" required>
 <button style="margin-top:8px">%s</button>
 </form>
 </body></html>`,
@ -525,7 +522,6 @@ button:hover{background:#4f46e5}
 		i18n.T(locale, "server.newPassword"),
 		i18n.T(locale, "server.password"),
 		i18n.T(locale, "server.passwordConfirm"),
-		i18n.T(locale, "server.adminPwdHint"),
 		i18n.T(locale, "server.save"),
 	)
 }
@ -555,6 +551,234 @@ p{font-size:13px;color:#b0b0c0;margin:0 0 6px;line-height:1.5}
 	)
 }

+func adminDashboardHTML(locale string, deviceCount, opsCount int, smtpHost, smtpPort, smtpUser, smtpFrom, smtpSecurity, srvURL string) string {
+	return fmt.Sprintf(`<!DOCTYPE html>
+<html lang="ru">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>%[1]s</title>
+<style>
+body{font-family:sans-serif;background:#13131f;color:#e4e4ef;padding:24px;max-width:860px;margin:0 auto}
+a{color:#6366f1}
+h1{border-bottom:1px solid #2a2a3c;padding-bottom:12px}
+h2{margin-top:24px;font-size:16px}
+.stat{background:#1a1a28;border:1px solid #2a2a3c;padding:12px 16px;border-radius:8px;margin:8px 0}
+table{width:100%%;border-collapse:collapse;margin-top:8px}
+th,td{text-align:left;padding:8px 12px;border-bottom:1px solid #2a2a3c}
+th{font-size:12px;color:#888;text-transform:uppercase}
+.key-cell{max-width:360px;overflow:hidden;text-overflow:ellipsis;font-family:monospace;font-size:12px;color:#b0b0c0}
+.btn{font-family:inherit;font-size:12px;padding:6px 12px;border-radius:6px;border:1px solid #2a2a3c;background:#1a1a28;color:#ccc;cursor:pointer;display:inline-flex;align-items:center;gap:4px}
+.btn:hover{background:#222233}
+.btn-primary{background:#6366f1;border-color:#6366f1;color:#fff}
+.btn-primary:hover{background:#4f46e5}
+.btn-danger{color:#ff6b6b;border-color:#4a2222}
+.btn-danger:hover{background:#3a2222}
+.copy-btn{padding:2px 8px;font-size:11px;margin-left:6px}
+input{font-family:inherit;font-size:14px;padding:8px 12px;border:1px solid #2a2a3c;background:#13131f;color:#e4e4ef;border-radius:6px;margin:0;box-sizing:border-box}
+input:focus{outline:none;border-color:#6366f1}
+.form-row{display:flex;gap:8px;margin-bottom:8px;align-items:center}
+.form-row label{font-size:12px;color:#888;min-width:80px;flex-shrink:0}
+.form-row input{flex:1}
+.toolbar{display:flex;gap:8px;margin:16px 0;flex-wrap:wrap}
+.modal-overlay{position:fixed;inset:0;background:rgba(0,0,0,0.6);display:flex;align-items:center;justify-content:center;z-index:100}
+.modal{background:#1a1a28;border:1px solid #2a2a3c;border-radius:12px;padding:24px;width:420px;max-width:90vw;position:relative;max-height:80vh;overflow-y:auto}
+.modal h2{margin-top:0}
+.modal-close{position:absolute;top:10px;right:14px;font-size:20px;cursor:pointer;background:none;border:none;color:#888}
+.modal-close:hover{color:#e4e4ef}
+pre{background:#13131f;border:1px solid #2a2a3c;border-radius:8px;padding:12px;overflow-x:auto;white-space:pre-wrap}
+</style>
+</head><body>
+<h1>Verstak Sync Server</h1>
+<div style="display:flex;gap:20px;flex-wrap:wrap">
+<div class="stat" style="margin:0"><strong>%[2]s</strong> <span id="dev-count">%[40]d</span></div>
+<div class="stat" style="margin:0"><strong>%[3]s</strong> <span id="op-count">%[41]d</span></div>
+</div>
+
+<div class="toolbar">
+<button class="btn btn-primary" onclick="openSMTP()">%[15]s</button>
+<a href="/admin/users" style="text-decoration:none"><button class="btn" type="button">%[16]s</button></a>
+<button class="btn" onclick="openHealth()">%[17]s</button>
+</div>
+
+<h2>%[4]s</h2>
+<div id="devices"></div>
+<script>
+fetch('/admin/api/devices').then(r=>r.json()).then(devices=>{
+  const div=document.getElementById('devices')
+  if(!devices.length){div.innerHTML='<p>%[5]s</p>';return}
+  div.innerHTML='<table><tr><th>%[6]s</th><th>%[7]s</th><th>%[8]s</th><th>%[9]s</th><th>%[10]s</th><th></th></tr>'+
+    devices.map(d=>{
+      var status=d.revoked_at?'<span style="color:#ff6b6b">%[12]s</span>':'<span style="color:#34d399">%[11]s</span>'
+      var ls=d.last_seen||'\u2014'
+      var revBtn=''
+      if(!d.revoked_at) revBtn='<button class="btn btn-danger" onclick="revokeDevice(\''+d.id+'\')">%[13]s</button>'
+      return '<tr><td>'+d.name+'</td><td>'+(d.user||'\u2014')+'</td><td>'+(d.client_version||'\u2014')+'</td><td>'+status+'</td><td>'+ls+'</td><td>'+revBtn+'</td></tr>'
+    }).join('')+'</table>'
+  document.getElementById('dev-count').textContent=devices.length
+})
+fetch('/admin/api/stats').then(r=>r.json()).then(stats=>{
+  document.getElementById('op-count').textContent=stats.ops||'0'
+})
+function revokeDevice(id){
+  if(!confirm('%[31]s'))return
+  fetch('/admin/api/keys/'+id,{method:'DELETE'}).then(()=>location.reload())
+}
+function openSMTP(){document.getElementById('smtp-modal').style.display='flex';document.getElementById('smtp-test-result').textContent=''}
+function closeSMTP(e){if(!e||e.target.id==='smtp-modal')document.getElementById('smtp-modal').style.display='none'}
+function openHealth(){var m=document.getElementById('health-modal');m.style.display='flex';document.getElementById('health-result').textContent='%[14]s';fetch('/api/v1/health').then(function(r){return r.text()}).then(function(t){document.getElementById('health-result').textContent=t})}
+function closeHealth(e){if(!e||e.target.id==='health-modal')document.getElementById('health-modal').style.display='none'}
+function testSMTP(){
+  var f=document.querySelector('#smtp-modal form')
+  var fd=new FormData(f)
+  var obj={};for(var e of fd.entries()){obj[e[0]]=e[1]}
+  var r=document.getElementById('smtp-test-result')
+  r.textContent='%[29]s';r.style.color='#888'
+  fetch('/admin/api/smtp/test',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(obj)}).then(function(r2){return r2.json()}).then(function(d){
+    r.textContent=d.ok?'%[30]s':'\u2717 '+d.error
+    r.style.color=d.ok?'#4ade80':'#ff6b6b'
+  }).catch(function(e){r.textContent='\u2717 '+e;r.style.color='#ff6b6b'})
+}
+</script>
+
+<div id="smtp-modal" class="modal-overlay" style="display:none" onclick="closeSMTP(event)">
+<div class="modal">
+<button class="modal-close" onclick="closeSMTP()">&times;</button>
+<h2>%[28]s</h2>
+<form action="/admin/api/smtp" method="POST">
+<div class="form-row"><label>%[18]s</label><input name="smtp_host" value="%[32]s" placeholder="smtp.example.com"></div>
+<div class="form-row"><label>%[19]s</label><input name="smtp_port" value="%[33]s" placeholder="587"></div>
+<div class="form-row"><label>%[20]s</label><select name="smtp_security" style="font-family:inherit;font-size:14px;padding:8px 12px;border:1px solid #2a2a3c;background:#13131f;color:#e4e4ef;border-radius:6px;flex:1;box-sizing:border-box">
+<option value="starttls"%[34]s>STARTTLS</option>
+<option value="tls"%[35]s>TLS</option>
+<option value="none"%[36]s>%[21]s</option>
+</select></div>
+<div class="form-row"><label>%[22]s</label><input name="smtp_user" value="%[37]s" placeholder="user@example.com"></div>
+<div class="form-row"><label>%[23]s</label><input type="password" name="smtp_pass" placeholder="••••••••"></div>
+<div class="form-row"><label>%[24]s</label><input name="smtp_from" value="%[38]s" placeholder="noreply@example.com"></div>
+<div class="form-row"><label>%[25]s</label><input name="server_url" value="%[39]s" placeholder="https://example.com:47732"></div>
+<div style="margin-top:12px;display:flex;gap:8px;align-items:center">
+<button class="btn btn-primary">%[26]s</button>
+<button class="btn" type="button" onclick="testSMTP()">%[27]s</button>
+<span id="smtp-test-result" style="font-size:12px"></span>
+</div>
+</form>
+</div>
+</div>
+
+<div id="health-modal" class="modal-overlay" style="display:none" onclick="closeHealth(event)">
+<div class="modal">
+<button class="modal-close" onclick="closeHealth()">&times;</button>
+<h2>%[17]s</h2>
+<pre id="health-result">%[14]s</pre>
+</div>
+</div>
+
+</body></html>`,
+		i18n.T(locale, "admin.dashboard"),
+		i18n.T(locale, "admin.deviceCount"),
+		i18n.T(locale, "admin.opsCount"),
+		i18n.T(locale, "admin.devices"),
+		i18n.T(locale, "admin.noDevices"),
+		i18n.T(locale, "admin.device"),
+		i18n.T(locale, "admin.user"),
+		i18n.T(locale, "admin.version"),
+		i18n.T(locale, "admin.status"),
+		i18n.T(locale, "admin.lastSeen"),
+		i18n.T(locale, "admin.active"),
+		i18n.T(locale, "admin.revoked"),
+		i18n.T(locale, "admin.revoke"),
+		i18n.T(locale, "common.loading"),
+		i18n.T(locale, "admin.smtp"),
+		i18n.T(locale, "admin.users"),
+		i18n.T(locale, "admin.healthCheck"),
+		i18n.T(locale, "admin.smtpServer"),
+		i18n.T(locale, "admin.smtpPort"),
+		i18n.T(locale, "admin.smtpType"),
+		i18n.T(locale, "admin.smtpNoEncryption"),
+		i18n.T(locale, "admin.smtpUsername"),
+		i18n.T(locale, "admin.smtpPassword"),
+		i18n.T(locale, "admin.smtpFrom"),
+		i18n.T(locale, "admin.smtpServerURL"),
+		i18n.T(locale, "admin.smtpSave"),
+		i18n.T(locale, "admin.smtpTest"),
+		i18n.T(locale, "admin.smtpTitle"),
+		i18n.T(locale, "admin.smtpTesting"),
+		i18n.T(locale, "admin.smtpPassed"),
+		i18n.T(locale, "admin.revokeConfirm"),
+		smtpHost,
+		smtpPort,
+		sel(smtpSecurity, "starttls"),
+		sel(smtpSecurity, "tls"),
+		sel(smtpSecurity, "none"),
+		smtpUser,
+		smtpFrom,
+		srvURL,
+		deviceCount,
+		opsCount,
+	)
+}
+
+func userDashboardHTML(locale, username, deviceRows string) string {
+	return fmt.Sprintf(`<!DOCTYPE html>
+<html lang="ru">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Verstak Sync — %[1]s</title>
+<style>
+body{font-family:sans-serif;background:#13131f;color:#e4e4ef;padding:24px;max-width:800px;margin:0 auto}
+h1{border-bottom:1px solid #2a2a3c;padding-bottom:12px}
+h2{margin-top:24px;font-size:16px}
+table{width:100%%;border-collapse:collapse;margin-top:8px}
+th,td{text-align:left;padding:8px 12px;border-bottom:1px solid #2a2a3c}
+th{font-size:12px;color:#888;text-transform:uppercase}
+.btn{font-family:inherit;font-size:12px;padding:6px 12px;border-radius:6px;border:1px solid #2a2a3c;background:#1a1a28;color:#ccc;cursor:pointer;display:inline-flex;align-items:center;gap:4px}
+.btn:hover{background:#222233}
+.btn-primary{background:#6366f1;border-color:#6366f1;color:#fff}
+.btn-primary:hover{background:#4f46e5}
+.btn-danger{color:#ff6b6b;border-color:#4a2222}
+.btn-danger:hover{background:#3a2222}
+.btn-sm{padding:2px 8px;font-size:11px}
+.top{display:flex;justify-content:space-between;align-items:center}
+a{color:#6366f1}
+</style>
+</head><body>
+<div class="top">
+<h1>Verstak Sync</h1>
+<span>%[1]s · <a href="/logout">%[2]s</a></span>
+</div>
+<h2>%[3]s</h2>
+<table><tr><th>%[4]s</th><th>%[5]s</th><th>%[6]s</th><th>%[7]s</th><th>%[8]s</th></tr>%[9]s</table>
+
+<div style="margin-top:24px;padding:16px;background:#1a1a28;border:1px solid #2a2a3c;border-radius:8px">
+<h2 style="margin-top:0">%[10]s</h2>
+<p style="font-size:13px;color:#888">%[11]s</p>
+</div>
+
+<script>
+function revokeDevice(id){
+  if(!confirm('%[12]s'))return
+  var pw=prompt('%[13]s')
+  if(!pw)return
+  fetch('/api/client/revoke-device',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({device_id:id,password:pw})}).then(function(r){return r.json()}).then(function(d){
+    if(d.status==='revoked'){location.reload()}else{alert(d.error||'error')}
+  })
+}
+</script>
+</body></html>`,
+		username,
+		i18n.T(locale, "server.logout"),
+		i18n.T(locale, "userDashboard.devices"),
+		i18n.T(locale, "userDashboard.device"),
+		i18n.T(locale, "userDashboard.status"),
+		i18n.T(locale, "userDashboard.connected"),
+		i18n.T(locale, "userDashboard.lastSeen"),
+		i18n.T(locale, "userDashboard.version"),
+		deviceRows,
+		i18n.T(locale, "userDashboard.connectNew"),
+		i18n.T(locale, "userDashboard.connectNewHint"),
+		i18n.T(locale, "userDashboard.revokeConfirm"),
+		i18n.T(locale, "userDashboard.revokePrompt"),
+	)
+}
+
 func errorPageHTML(locale, title, msg, backURL string) string {
 	return fmt.Sprintf(`<!DOCTYPE html>
 <html lang="ru">
--- a/internal/core/activity/activity.go
+++ b/internal/core/activity/activity.go
@ -22,6 +22,9 @@ const (
 	TypeFolderRenamed = "folder_renamed"
 	TypeNodeCreated   = "node_created"
 	TypeNodeUpdated   = "node_updated"
+	TypeNoteDeleted   = "note_deleted"
+	TypeNodeDeleted   = "node_deleted"
+	TypeFolderMoved   = "folder_moved"
 	TypeActionCreated = "action_created"
 	TypeActionDone    = "action_done"
 	TypeWorklogAdded  = "worklog_added"
--- a/scripts/check-i18n.sh
+++ b/scripts/check-i18n.sh
@ -7,15 +7,23 @@ set -e
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 EXIT=0

-# Find Cyrillic characters in source files, excluding allowed paths.
-# The regex matches any Cyrillic character range.
-# Allowed exceptions:
-#   - locale files (*/i18n/locales/*)
-#   - docs/*
-#   - README*
-#   - spaces/
-#   - .json files that are templates or configs
-#   - .md files
+# Explicitly allowed Go files that may contain Cyrillic (test data, SQL migrations, i18n catalog).
+# These are NOT user-facing strings — they are test fixtures, embedded SQL, or locale definitions.
+ALLOWED_GO_CYRILLIC=(
+  "internal/core/worklog/worklog_test.go"
+  "internal/core/worklog/worklog.go"
+  "internal/core/smoke_test.go"
+  "internal/core/nodes/types.go"
+  "internal/core/nodes/repository_test.go"
+  "internal/core/plugins/manager_test.go"
+  "internal/core/actions/action_test.go"
+  "internal/core/actions/action.go"
+  "internal/core/files/file.go"
+  "internal/core/storage/migrations_008.sql.go"
+  "internal/gui/index.html.go"
+  "internal/i18n/catalog.go"
+  "cmd/verstak-gui/main.go"
+)

 echo "=== Checking for hardcoded Cyrillic in source code ==="

@ -24,10 +32,29 @@ GO_CYRILLIC=$(find "$ROOT" -name '*.go' \
  ! -path "*/i18n/locales/*" \
  -exec grep -l '[А-Яа-я]' {} \; 2>/dev/null || true)

-if [ -n "$GO_CYRILLIC" ]; then
-  echo "WARNING: Cyrillic found in Go files (expected in server HTML templates for now):"
-  echo "$GO_CYRILLIC"
-  # Don't fail for Go files with HTML templates — they'll be refactored later
+# Filter out allowed files
+FILTERED=""
+for f in $GO_CYRILLIC; do
+  rel="${f#$ROOT/}"
+  skip=0
+  for allowed in "${ALLOWED_GO_CYRILLIC[@]}"; do
+    if [ "$rel" = "$allowed" ]; then
+      skip=1
+      break
+    fi
+  done
+  if [ "$skip" -eq 0 ]; then
+    FILTERED="$FILTERED $f"
+  fi
+done
+
+if [ -n "$FILTERED" ]; then
+  echo ""
+  echo "FAIL: Cyrillic found in Go source files (outside allowed exceptions):"
+  echo "$FILTERED"
+  echo ""
+  echo "These should use i18n.T() instead of hardcoded Russian strings."
+  EXIT=1
 fi

 # Search for Cyrillic in Svelte/JS files (excluding locale files)
@ -58,9 +85,11 @@ else
  echo "OK: No bidi/control characters found"
 fi

-# Check that locale keys in ru.js and en.js match
+# Check that locale keys match between ru and en for frontend AND Go
 echo ""
 echo "=== Checking locale key consistency ==="
+
+# Frontend JS locales
 RU_KEYS=$(grep -oP "^\s+'[^']+'" "$ROOT/frontend/src/lib/i18n/locales/ru.js" | sed "s/^ *'//;s/'$//" | sort)
 EN_KEYS=$(grep -oP "^\s+'[^']+'" "$ROOT/frontend/src/lib/i18n/locales/en.js" | sed "s/^ *'//;s/'$//" | sort)

@ -68,15 +97,34 @@ MISSING_EN=$(comm -23 <(echo "$RU_KEYS") <(echo "$EN_KEYS"))
 MISSING_RU=$(comm -23 <(echo "$EN_KEYS") <(echo "$RU_KEYS"))

 if [ -n "$MISSING_EN" ]; then
-  echo "WARNING: Keys in ru.js but missing in en.js:"
+  echo "WARNING: Keys in frontend ru.js but missing in en.js:"
  echo "$MISSING_EN"
 fi
 if [ -n "$MISSING_RU" ]; then
-  echo "WARNING: Keys in en.js but missing in ru.js:"
+  echo "WARNING: Keys in frontend en.js but missing in ru.js:"
  echo "$MISSING_RU"
 fi
 if [ -z "$MISSING_EN" ] && [ -z "$MISSING_RU" ]; then
-  echo "OK: All locale keys match between ru.js and en.js"
+  echo "OK: All frontend locale keys match between ru.js and en.js"
+fi
+
+# Go locales
+GO_RU_KEYS=$(grep -oP '"[^"]+":\s*"' "$ROOT/internal/i18n/locales/ru.json" | sed 's/":.*//' | sed 's/"//g' | sort)
+GO_EN_KEYS=$(grep -oP '"[^"]+":\s*"' "$ROOT/internal/i18n/locales/en.json" | sed 's/":.*//' | sed 's/"//g' | sort)
+
+GO_MISSING_EN=$(comm -23 <(echo "$GO_RU_KEYS") <(echo "$GO_EN_KEYS"))
+GO_MISSING_RU=$(comm -23 <(echo "$GO_EN_KEYS") <(echo "$GO_RU_KEYS"))
+
+if [ -n "$GO_MISSING_EN" ]; then
+  echo "WARNING: Keys in Go ru.json but missing in en.json:"
+  echo "$GO_MISSING_EN"
+fi
+if [ -n "$GO_MISSING_RU" ]; then
+  echo "WARNING: Keys in Go en.json but missing in ru.json:"
+  echo "$GO_MISSING_RU"
+fi
+if [ -z "$GO_MISSING_EN" ] && [ -z "$GO_MISSING_RU" ]; then
+  echo "OK: All Go locale keys match between ru.json and en.json"
 fi

 exit $EXIT