diff --git a/.env.example b/.env.example
index ca10aa7..1d6a3db 100644
--- a/.env.example
+++ b/.env.example
@@ -1,19 +1,51 @@
-PG__DBNAME=db
-PG__HOST=127.0.0.1
-PG__PORT=5432
 RUST_LOG="INFO"
 BUILD_MODE=debug
-ENABLE_REGISTRATION=true
-SMTP_HOST=smtp.example.com
-SMTP_USER=user
-SMTP_PASS=password
-SMTP_FROM=noreply@example.com
-COOKIE_SECRET=supersecretkeymustbeatleast64byteslongforsecurityreasons1234567890
-FRONTEND_URL=http://localhost:3000
-MINIO_ACCESS_KEY=minioadmin
-MINIO_SECRET_KEY=minioadmin
-MINIO_URL=http://localhost:9000/
-S3_BUCKET_NAME=memory-map
-SERVER_HOST=127.0.0.1
-SERVER_PORT=8000
-CORS_ALLOWED_ORIGINS=http://127.0.0.1:3000
+
+MEMORY_MAP__PG__DBNAME=db
+MEMORY_MAP__PG__HOST=127.0.0.1
+MEMORY_MAP__PG__PORT=5432
+
+MEMORY_MAP__SERVER__HOST=127.0.0.1
+MEMORY_MAP__SERVER__PORT=8000
+
+MEMORY_MAP__SMTP__HOST=smtp.example.com
+MEMORY_MAP__SMTP__USER=user
+MEMORY_MAP__SMTP__PASS=password
+MEMORY_MAP__SMTP__FROM=noreply@example.com
+
+MEMORY_MAP__AUTH__COOKIE_SECRET=supersecretkeymustbeatleast64byteslongforsecurityreasons1234567890
+MEMORY_MAP__AUTH__ENABLE_REGISTRATION=true
+
+MEMORY_MAP__FRONTEND__URL=http://localhost:3000
+
+MEMORY_MAP__CORS__ALLOWED_ORIGINS=http://127.0.0.1:3000
+
+MEMORY_MAP__STORAGE__ENDPOINT_URL=http://127.0.0.1:9000/
+MEMORY_MAP__STORAGE__PUBLIC_ENDPOINT_URL=http://127.0.0.1:9000/
+MEMORY_MAP__STORAGE__ACCESS_KEY=memorymapdev
+MEMORY_MAP__STORAGE__SECRET_KEY=memorymapdevsecret
+MEMORY_MAP__STORAGE__BUCKET_NAME=memory-map
+MEMORY_MAP__STORAGE__REGION=us-east-1
+MEMORY_MAP__STORAGE__FORCE_PATH_STYLE=true
+MEMORY_MAP__STORAGE__PRESIGNED_URL_TTL_SECONDS=604800
+
+MEMORY_MAP__OBJECT_LIFECYCLE__PENDING_UPLOAD_TIMEOUT_SECONDS=3600
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_MAX_FILE_SIZE_BYTES=1073741824
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_PART_SIZE_BYTES=8388608
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_MAX_PART_COUNT=10000
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_TTL_SECONDS=3600
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_RETRY_SECONDS=60
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_LEASE_SECONDS=300
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_MAX_ATTEMPTS=10
+MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_BATCH_SIZE=1000
+MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_RETRY_SECONDS=60
+MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_LEASE_SECONDS=300
+MEMORY_MAP__OBJECT_LIFECYCLE__MAINTENANCE_INTERVAL_SECONDS=30
+MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_BATCH_SIZE=1000
+MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_MAX_ATTEMPTS=10
+
+MEMORY_MAP__EMAIL_OUTBOX__RETRY_SECONDS=60
+MEMORY_MAP__EMAIL_OUTBOX__LEASE_SECONDS=300
+MEMORY_MAP__EMAIL_OUTBOX__WORKER_INTERVAL_SECONDS=30
+MEMORY_MAP__EMAIL_OUTBOX__BATCH_SIZE=100
+MEMORY_MAP__EMAIL_OUTBOX__MAX_ATTEMPTS=10
diff --git a/.github/actions/free-runner-space/action.yml b/.github/actions/free-runner-space/action.yml
new file mode 100644
index 0000000..9440434
--- /dev/null
+++ b/.github/actions/free-runner-space/action.yml
@@ -0,0 +1,12 @@
+name: Free runner disk space
+description: Remove unused hosted-runner tool caches before disk-heavy CI jobs.
+runs:
+  using: composite
+  steps:
+    - name: Free runner disk space
+      shell: bash
+      run: |
+        df -h
+        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+        docker system prune --all --force || true
+        df -h
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d2f62fc..bdf5470 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   SKIP_DIRENV: "1"
@@ -22,6 +25,9 @@ jobs:
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
       - run: cd devenv && nix fmt -- --ci
 
   check:
@@ -31,6 +37,9 @@ jobs:
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
       - run: nix develop ./devenv/ --command just check
 
   clippy:
@@ -40,6 +49,9 @@ jobs:
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
       - run: nix develop ./devenv/ --command just clippy
 
   test:
@@ -49,6 +61,9 @@ jobs:
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
       - run: nix develop ./devenv/ --command just test
 
   doc:
@@ -58,6 +73,9 @@ jobs:
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
       - run: nix develop ./devenv/ --command just doc
 
   deny:
@@ -67,6 +85,9 @@ jobs:
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
       - run: nix develop ./devenv/ --command just deny
 
   frontend:
@@ -76,4 +97,75 @@ jobs:
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
+      - run: nix develop ./devenv/ --command just frontend-config
       - run: nix develop ./devenv/ --command just frontend-build
+
+  storage-integration:
+    name: Storage Integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/free-runner-space
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
+      - run: nix develop ./devenv/ --command just storage-ci
+      - name: Upload process-compose log
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: process-compose-log
+          path: process-compose.log
+          if-no-files-found: ignore
+
+  backend-integration:
+    name: Backend Integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/free-runner-space
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
+      - run: nix develop ./devenv/ --command just backend-integration
+      - name: Upload backend integration logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: backend-integration-logs
+          path: backend-integration-logs/
+          if-no-files-found: ignore
+
+  e2e:
+    name: E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/free-runner-space
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-flakehub: false
+          use-gha-cache: true
+      - run: nix develop ./devenv/ --command just e2e
+      - name: Upload E2E logs and artifacts
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: e2e-artifacts
+          path: |
+            e2e-logs/
+            frontend/playwright-report/
+            frontend/test-results/
+            frontend/blob-report/
+          if-no-files-found: ignore
diff --git a/.github/workflows/update-cargo-deps.yml b/.github/workflows/update-cargo-deps.yml
index 244296a..df42a5c 100644
--- a/.github/workflows/update-cargo-deps.yml
+++ b/.github/workflows/update-cargo-deps.yml
@@ -15,6 +15,13 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
@@ -22,10 +29,24 @@ jobs:
       - name: Update Cargo dependencies
         run: nix develop ./devenv/ --command cargo update
 
+      - name: Check for changes
+        id: diff
+        run: |
+          if git diff --quiet Cargo.lock; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Disable git hooks
+        if: steps.diff.outputs.changed == 'true'
+        run: git config --unset core.hooksPath || true
+
       - name: Create pull request
+        if: steps.diff.outputs.changed == 'true'
         uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           commit-message: "chore: update Cargo dependencies"
           branch: update-cargo-deps
           title: "chore: update Cargo dependencies"
diff --git a/.github/workflows/update-nixpkgs.yml b/.github/workflows/update-nixpkgs.yml
index 6703edc..b90acab 100644
--- a/.github/workflows/update-nixpkgs.yml
+++ b/.github/workflows/update-nixpkgs.yml
@@ -1,4 +1,4 @@
-name: Update nixpkgs
+name: Update Nix flake inputs
 
 on:
   schedule:
@@ -12,19 +12,40 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v6
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
 
-      - name: Update nixpkgs input
-        run: nix flake update nixpkgs --flake ./devenv/
+      - name: Update Nix flake inputs
+        run: nix flake update --flake ./devenv/
+
+      - name: Check for changes
+        id: diff
+        run: |
+          if git diff --quiet devenv/flake.lock; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Disable git hooks
+        if: steps.diff.outputs.changed == 'true'
+        run: git config --unset core.hooksPath || true
 
       - name: Create pull request
+        if: steps.diff.outputs.changed == 'true'
         uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: update nixpkgs input"
-          branch: update-nixpkgs
-          title: "chore: update nixpkgs input"
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "chore: update Nix flake inputs"
+          branch: update-nix-flake-inputs
+          title: "chore: update Nix flake inputs"
           body: |
-            Automated weekly update of the `nixpkgs` flake input.
+            Automated weekly update of moving Nix flake inputs.
diff --git a/.gitignore b/.gitignore
index 5a3e99a..093bb9a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,24 @@
 target/
-data/
+data/minio1/
+data/pg1/
+data/postgres/
+data/rustfs/
 .env
+config.toml
+config.local.toml
+frontend/public/config.json
 .direnv/
-.cache/test-output/
+/result
+/result-*
+process-compose.log
+backend-integration-logs/
+e2e-logs/
+frontend/playwright-report/
+frontend/test-results/
+frontend/blob-report/
 .claude/worktrees/
 .codex/worktrees/
 .pre-commit-config.yaml
 .playwright-mcp/
+.cargo-deny/
+*.code-workspace
diff --git a/AGENTS.md b/AGENTS.md
index 5e84eaf..e1006b6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -18,17 +18,41 @@ just deny
 just doc
 just test
 just frontend-build
+just verify-fast
 just verify
 ```
 
-Use `just filtered <recipe> <rg-filter> [args...]` for noisy verification output.
+### Filtered Output
+
+Use `just filtered` when a `just` recipe is expected to produce noisy output.
+Prefer it over hand-written shell pipelines such as `2>&1 | rg ...` because it
+preserves the selected recipe's exit status, rejects unsupported recipes and
+unsafe forwarded arguments, caps filtered matches, and prints the last captured
+lines when a failing command has no filter matches.
+
+Examples:
+
+```sh
+just filtered check '^(error|warning|[[:space:]]*-->)'
+just filtered test '^(test .* \.\.\. FAILED|failures:|error)'
+just filtered verify '^(Recipe|error|warning|failures:|FAILED|test result:)'
+```
+
+The first argument is the recipe, the second argument is the `rg` regex, and any
+remaining arguments are forwarded to the selected recipe. Continue using
+targeted `sed` ranges, `git diff --stat`, `git diff --name-only`, or
+command-specific quiet flags for non-`just` output. Avoid dumping full logs,
+full diffs, or broad command output unless explicitly requested.
 
 ## Project Shape
 
-- `backend/` contains the Axum, GraphQL, PostgreSQL, MinIO, and Casbin backend.
+- `backend/` contains the Axum, GraphQL, PostgreSQL, RustFS, and Casbin backend.
 - `frontend/` contains the Leptos CSR application built by Trunk.
 - `shared/` contains Rust code shared by the workspace crates.
 - `devenv/` contains the Nix development environment and service definitions.
+- `docs/` contains long-form documentation (e.g. `deployment.md`).
+- `scripts/` contains shared shell helpers used by `justfile` recipes
+  (e.g. `e2e-env.sh`, `service-graph.sh`).
 
 ## Editing Guidelines
 
@@ -43,5 +67,8 @@ Use `just filtered <recipe> <rg-filter> [args...]` for noisy verification output
 ## Verification
 
 After changes, run the narrowest useful command first, then run `just verify`
-before final handoff when feasible. If a command fails because dependencies or
-network access are unavailable, report that directly.
+before final handoff when feasible. `just verify` runs the full suite, including
+the service-backed storage, backend-integration, and e2e tests that stand up the
+local Postgres + RustFS service graph; use `just verify-fast` for a quick gate
+when the service graph is unavailable or for fast iteration. If a command fails
+because dependencies or network access are unavailable, report that directly.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 75ccc74..84fcc54 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -28,18 +28,30 @@ just check           # Run cargo check
 just clippy          # Run Clippy with warnings as errors
 just deny            # Check dependency licenses and advisories
 just doc             # Build docs and run ASCII/link checks
-just test            # Run tests with cached output
+just test            # Run tests
 just frontend-build  # Build the Trunk frontend
-just verify          # Run the full verification suite
+just verify-fast     # Fast checks; skips the service-backed suites
+just verify          # Full suite, incl. service-backed integration and e2e
 ```
 
-## Tests
+### Filtered Command Output
 
-`just test` caches command output under `.cache/test-output/`. The cache key is
-based on tracked file contents and the test arguments.
+When a `just` recipe is expected to produce a large amount of output, use
+`just filtered` instead of writing an ad-hoc shell pipeline. The first argument
+is the `just` recipe to run, the second argument is a ripgrep regex used to
+select output lines, and the remaining arguments are forwarded to the selected
+recipe.
 
-After creating a new source or test file, run `git add <file>` once so the cache
-can see it. Use `just clean` to clear build artifacts and cached test output.
+```sh
+just filtered check '^(error|warning|[[:space:]]*-->)'
+just filtered test '^(test .* \.\.\. FAILED|failures:|error)'
+just filtered verify '^(Recipe|error|warning|failures:|FAILED|test result:)'
+```
+
+`just filtered` preserves the selected recipe's exit status, rejects unsupported
+recipes and unsafe forwarded arguments, limits filtered matches so accidental
+broad filters do not dump full logs, and prints the last captured lines when a
+failing command has no filter matches.
 
 ## Documentation And Text
 
@@ -54,5 +66,10 @@ Before opening a pull request, run:
 just verify
 ```
 
+This runs the full suite, including the service-backed storage,
+backend-integration, and e2e tests, which stand up the local Postgres + RustFS
+service graph and take several minutes. For faster iteration while developing,
+`just verify-fast` runs everything except those service-backed suites.
+
 Include tests for behavior changes. Avoid public API or user-visible behavior
 changes unless the issue or pull request explicitly calls for them.
diff --git a/Cargo.lock b/Cargo.lock
index 70fb8b1..271889b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -14,7 +14,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.6",
  "generic-array",
 ]
 
@@ -26,7 +26,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -66,6 +66,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -75,56 +81,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "anstream"
-version = "0.6.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
-
-[[package]]
-name = "anstyle-parse"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "any_spawner"
 version = "0.3.0"
@@ -132,15 +88,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1384d3fe1eecb464229fcf6eebb72306591c56bf27b373561489458a7c73027d"
 dependencies = [
  "futures",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "wasm-bindgen-futures",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "approx"
@@ -159,7 +115,7 @@ checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
  "base64ct",
  "blake2",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "password-hash",
 ]
 
@@ -189,23 +145,23 @@ checksum = "71938f30533e4d95a6d17aa530939da3842c2ab6f4f84b9dae68447e4129f74a"
 
 [[package]]
 name = "async-graphql"
-version = "7.1.0"
+version = "7.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31b75c5a43a58890d6dcc02d03952456570671332bb0a5a947b1f09c699912a5"
+checksum = "1057a9f7ccf2404d94571dec3451ade1cb524790df6f1ada0d19c2a49f6b0f40"
 dependencies = [
  "async-graphql-derive",
  "async-graphql-parser",
  "async-graphql-value",
+ "async-io",
  "async-trait",
  "asynk-strim",
  "base64",
  "bytes",
  "fast_chemail",
  "fnv",
- "futures-timer",
  "futures-util",
  "handlebars",
- "http",
+ "http 1.4.1",
  "indexmap",
  "mime",
  "multer",
@@ -217,14 +173,14 @@ dependencies = [
  "serde_urlencoded",
  "static_assertions_next",
  "tempfile",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "async-graphql-axum"
-version = "7.1.0"
+version = "7.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "599e663e170f69baa0b9f18f52cdfd701e01ade0ac1baef2c4bc488cb68e35c1"
+checksum = "a1e37c5532e4b686acf45e7162bc93da91fc2c702fb0d465efc2c20c8f973795"
 dependencies = [
  "async-graphql",
  "axum",
@@ -239,9 +195,9 @@ dependencies = [
 
 [[package]]
 name = "async-graphql-derive"
-version = "7.1.0"
+version = "7.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c266ec9a094bbf2d088e016f71aa8d3be7f18c7343b2f0fe6d0e6c1e78977ea"
+checksum = "2e6cbeadc8515e66450fba0985ce722192e28443697799988265d86304d7cc68"
 dependencies = [
  "Inflector",
  "async-graphql-parser",
@@ -250,15 +206,15 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strum",
- "syn 2.0.111",
- "thiserror 2.0.17",
+ "syn",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "async-graphql-parser"
-version = "7.1.0"
+version = "7.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67e2188d3f1299087aa02cfb281f12414905ce63f425dbcfe7b589773468d771"
+checksum = "e64ef70f77a1c689111e52076da1cd18f91834bcb847de0a9171f83624b07fbf"
 dependencies = [
  "async-graphql-value",
  "pest",
@@ -268,9 +224,9 @@ dependencies = [
 
 [[package]]
 name = "async-graphql-value"
-version = "7.1.0"
+version = "7.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "527a4c6022fc4dac57b4f03f12395e9a391512e85ba98230b93315f8f45f27fc"
+checksum = "3e3ef112905abea9dea592fc868a6873b10ebd3f983e83308f995d6284e9ba41"
 dependencies = [
  "bytes",
  "indexmap",
@@ -278,11 +234,29 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "async-io"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite",
+ "parking",
+ "polling",
+ "rustix",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "async-lock"
-version = "3.4.1"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fd03604047cee9b6ce9de9f70c6cd540a0520c813cbd49bae61f33ab80ed1dc"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
 dependencies = [
  "event-listener",
  "event-listener-strategy",
@@ -295,17 +269,6 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288f83726785267c6f2ef073a3d83dc3f9b81464e9f99898240cced85fce35a"
 
-[[package]]
-name = "async-recursion"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -314,7 +277,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -344,7 +307,7 @@ dependencies = [
  "manyhow",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -360,14 +323,26 @@ dependencies = [
  "proc-macro2",
  "quote",
  "quote-use",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-credential-types"
+version = "1.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f20799b373a1be121fe3005fba0c2090af9411573878f224df44b42727fcaf7"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "zeroize",
+]
 
 [[package]]
 name = "aws-lc-rs"
@@ -391,19 +366,334 @@ dependencies = [
  "fs_extra",
 ]
 
+[[package]]
+name = "aws-runtime"
+version = "1.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ed8e8c52d2dc2390ad9f15647fe663f71e9780b4262c190fbb823a32721566"
+dependencies = [
+ "aws-credential-types",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "bytes-utils",
+ "fastrand",
+ "http 0.2.12",
+ "http 1.4.1",
+ "http-body 0.4.6",
+ "http-body 1.0.1",
+ "percent-encoding",
+ "pin-project-lite",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "aws-sdk-s3"
+version = "1.133.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "237aba2985e3c0a83e199cc7aa9a64a16c599875bc98170f00932f6199f19922"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-checksums",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-observability",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "hex",
+ "hmac 0.13.0",
+ "http 0.2.12",
+ "http 1.4.1",
+ "http-body 1.0.1",
+ "lru",
+ "percent-encoding",
+ "regex-lite",
+ "sha2 0.11.0",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "aws-sigv4"
+version = "1.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7083fb918b38474ac65ffbf8a69fc8792d36879f4ac5f1667b43aec61efe9a5"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "crypto-bigint",
+ "form_urlencoded",
+ "hex",
+ "hmac 0.13.0",
+ "http 0.2.12",
+ "http 1.4.1",
+ "p256",
+ "percent-encoding",
+ "sha2 0.11.0",
+ "subtle",
+ "time",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-smithy-async"
+version = "1.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ffcaf626bdda484571968400c326a244598634dc75fd451325a54ad1a59acfc"
+dependencies = [
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "aws-smithy-checksums"
+version = "0.64.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e8e65f4f81fcccdeb6c3eca2af17ac21d421a1786a26a394aecf421d616d3a"
+dependencies = [
+ "aws-smithy-http",
+ "aws-smithy-types",
+ "bytes",
+ "crc-fast",
+ "hex",
+ "http 1.4.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "md-5",
+ "pin-project-lite",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-eventstream"
+version = "0.60.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf09d74e5e32f76b8762da505a3cd59303e367a664ca67295387baa8c1d7548"
+dependencies = [
+ "aws-smithy-types",
+ "bytes",
+ "crc32fast",
+]
+
+[[package]]
+name = "aws-smithy-http"
+version = "0.63.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba1ab2dc1c2c3749ead27180d333c42f11be8b0e934058fb4b2258ee8dbe5231"
+dependencies = [
+ "aws-smithy-eventstream",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "futures-util",
+ "http 1.4.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "percent-encoding",
+ "pin-project-lite",
+ "pin-utils",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-http-client"
+version = "1.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a2f165a7feee6f263028b899d0a181987f4fa7179a6411a32a439fba7c5f769"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "h2",
+ "http 1.4.1",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "pin-project-lite",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-json"
+version = "0.62.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "517089205f18ab4adc5a3e02888cb139bbbbb2e168eac9f396216925d1fbeaf5"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+]
+
+[[package]]
+name = "aws-smithy-observability"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06c2315d173edbf1920da8ba3a7189695827002e4c0fc961973ab1c54abca9c"
+dependencies = [
+ "aws-smithy-runtime-api",
+]
+
+[[package]]
+name = "aws-smithy-runtime"
+version = "1.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e6f5caf6fea86f8c2206541ab5857cfcda9013426cdbe8fa0098b9e2d32182"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-http-client",
+ "aws-smithy-observability",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "bytes",
+ "fastrand",
+ "http 0.2.12",
+ "http 1.4.1",
+ "http-body 0.4.6",
+ "http-body 1.0.1",
+ "http-body-util",
+ "pin-project-lite",
+ "pin-utils",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-runtime-api"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc117c179ecf39a62a0a3f49f600e9ac26a7ad7dd172177999f83933af776c32"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api-macros",
+ "aws-smithy-types",
+ "bytes",
+ "http 0.2.12",
+ "http 1.4.1",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-smithy-runtime-api-macros"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d7396fd9500589e62e460e987ecb671bad374934e55ec3b5f498cc7a8a8a7b7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "aws-smithy-schema"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7442cb268338f0eb8278140a107c046756aa01093d8ef5e99628d34ae09c94f5"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "http 1.4.1",
+]
+
+[[package]]
+name = "aws-smithy-types"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "056b66dbce2f81cc0c1e2b05bb402eb58f8a3530479d650efadd5bbae9a4050b"
+dependencies = [
+ "base64-simd",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "http 0.2.12",
+ "http 1.4.1",
+ "http-body 0.4.6",
+ "http-body 1.0.1",
+ "http-body-util",
+ "itoa",
+ "num-integer",
+ "pin-project-lite",
+ "pin-utils",
+ "ryu",
+ "serde",
+ "time",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "aws-smithy-xml"
+version = "0.60.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce02add1aa3677d022f8adf81dcbe3046a95f17a1b1e8979c145cd21d3d22b3"
+dependencies = [
+ "xmlparser",
+]
+
+[[package]]
+name = "aws-types"
+version = "1.3.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16bf10b03a3c01e6b3b7d47cd964e873ffe9e7d4e80fad16bd4c077cb068531"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "rustc_version",
+ "tracing",
+]
+
 [[package]]
 name = "axum"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
  "base64",
  "bytes",
  "form_urlencoded",
  "futures-util",
- "http",
- "http-body",
+ "http 1.4.1",
+ "http-body 1.0.1",
  "http-body-util",
  "hyper",
  "hyper-util",
@@ -411,14 +701,13 @@ dependencies = [
  "matchit",
  "memchr",
  "mime",
- "multer",
  "percent-encoding",
  "pin-project-lite",
  "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sha1",
+ "sha1 0.10.6",
  "sync_wrapper",
  "tokio",
  "tokio-tungstenite",
@@ -430,14 +719,14 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.5.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59446ce19cd142f8833f856eb31f3eb097812d1479ab224f54d72428ca21ea22"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http",
- "http-body",
+ "http 1.4.1",
+ "http-body 1.0.1",
  "http-body-util",
  "mime",
  "pin-project-lite",
@@ -449,9 +738,9 @@ dependencies = [
 
 [[package]]
 name = "axum-extra"
-version = "0.12.5"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fef252edff26ddba56bbcdf2ee3307b8129acb86f5749b68990c168a6fcc9c76"
+checksum = "be44683b41ccb9ab2d23a5230015c9c3c55be97a25e4428366de8873103f7970"
 dependencies = [
  "axum",
  "axum-core",
@@ -459,8 +748,8 @@ dependencies = [
  "cookie",
  "futures-core",
  "futures-util",
- "http",
- "http-body",
+ "http 1.4.1",
+ "http-body 1.0.1",
  "http-body-util",
  "mime",
  "pin-project-lite",
@@ -469,17 +758,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "axum-macros"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "604fde5e028fea851ce1d8570bbdc034bec850d157f7569d10f347d06808c05c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "backend"
 version = "0.1.0"
@@ -488,9 +766,10 @@ dependencies = [
  "argon2",
  "async-graphql",
  "async-graphql-axum",
+ "aws-credential-types",
+ "aws-sdk-s3",
  "axum",
  "axum-extra",
- "axum-macros",
  "blake3",
  "casbin",
  "config",
@@ -503,15 +782,16 @@ dependencies = [
  "hex",
  "jiff",
  "lettre",
- "minio",
  "moka",
+ "parking_lot",
  "postgres-types",
- "rand 0.8.6",
+ "rand 0.10.1",
  "refinery",
+ "reqwest",
  "serde",
  "serde_json",
  "shared",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "time",
  "tokio",
  "tokio-postgres",
@@ -527,23 +807,39 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d27c3610c36aee21ce8ac510e6224498de4228ad772a171ed65643a24693a5a8"
 
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
+dependencies = [
+ "outref",
+ "vsimd",
+]
+
 [[package]]
 name = "base64ct"
-version = "1.8.1"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e050f626429857a27ddccb31e0aca21356bfa709c04041aefddac081a8f068a"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 dependencies = [
  "serde_core",
 ]
@@ -554,20 +850,21 @@ version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
 name = "blake3"
-version = "1.8.2"
+version = "1.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3888aaa89e4b2a40fca9848e400f6a658a5a3978de7be858e209cafa8be9a4a0"
+checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce"
 dependencies = [
  "arrayref",
  "arrayvec",
  "cc",
  "cfg-if",
  "constant_time_eq",
+ "cpufeatures 0.3.0",
 ]
 
 [[package]]
@@ -579,11 +876,20 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "bumpalo"
-version = "3.19.0"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "by_address"
@@ -606,17 +912,27 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bytes-utils"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dafe3a8757b027e2be6e4e5601ed563c55989fcf1546e933c66c8eb3a058d35"
+dependencies = [
+ "bytes",
+ "either",
+]
+
 [[package]]
 name = "camino"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "276a59bf2b2c967788139340c9f0c5b12d7fd6630315c15c217e559de85d2609"
+checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48"
 
 [[package]]
 name = "casbin"
-version = "2.19.0"
+version = "2.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b12705127ab9fcf4fbc22a0c93f441514fe7bd7a7248ce443e4bf531c54b7ee"
+checksum = "c53f7476c2d0d9cd7ccc88c16ffc5c7889a0497b3462b10b12b5329adde69665"
 dependencies = [
  "async-trait",
  "fixedbitset",
@@ -645,9 +961,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.49"
+version = "1.2.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90583009037521a116abf44494efecd645ba48b6622457080f080b85544e2215"
+checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -655,12 +971,6 @@ dependencies = [
  "shlex",
 ]
 
-[[package]]
-name = "cesu8"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
-
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
@@ -673,11 +983,22 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chrono"
-version = "0.4.42"
+version = "0.4.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -692,19 +1013,25 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.6",
  "inout",
 ]
 
 [[package]]
 name = "cmake"
-version = "0.1.57"
+version = "0.1.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75443c44cd6b379beb8c5b45d85d0773baf31cce901fe7bb252f4eff3008ef7d"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
 dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
+
 [[package]]
 name = "codee"
 version = "0.3.5"
@@ -713,7 +1040,7 @@ checksum = "a9dbbdc4b4d349732bc6690de10a9de952bd39ba6a065c586e26600b6b0b91f5"
 dependencies = [
  "serde",
  "serde_json",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -722,12 +1049,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2550f75b8cfac212855f6b1885455df8eaee8fe8e246b647d69146142e016084"
 
-[[package]]
-name = "colorchoice"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
-
 [[package]]
 name = "combine"
 version = "4.6.7"
@@ -749,9 +1070,9 @@ dependencies = [
 
 [[package]]
 name = "config"
-version = "0.15.19"
+version = "0.15.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30fa8254caad766fc03cb0ccae691e14bf3bd72bfff27f72802ce729551b3d6"
+checksum = "f316c6237b2d38be61949ecd15268a4c6ca32570079394a2444d9ce2c72a72d8"
 dependencies = [
  "async-trait",
  "convert_case 0.6.0",
@@ -762,8 +1083,8 @@ dependencies = [
  "serde-untagged",
  "serde_core",
  "serde_json",
- "toml 0.9.8",
- "winnow",
+ "toml 1.1.2+spec-1.1.0",
+ "winnow 1.0.3",
  "yaml-rust2",
 ]
 
@@ -787,6 +1108,18 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -802,24 +1135,25 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "once_cell",
  "tiny-keccak",
 ]
 
 [[package]]
 name = "const-str"
-version = "0.6.4"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "451d0640545a0553814b4c646eb549343561618838e9b42495f466131fe3ad49"
+checksum = "18f12cc9948ed9604230cdddc7c86e270f9401ccbe3c2e98a4378c5e7632212f"
 
 [[package]]
 name = "const_format"
-version = "0.2.35"
+version = "0.2.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7faa7469a93a566e9ccc1c73fe783b4a65c274c5ace346038dca9c39fe0030ad"
+checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e"
 dependencies = [
  "const_format_proc_macros",
+ "konst",
 ]
 
 [[package]]
@@ -841,9 +1175,9 @@ checksum = "f67855af358fcb20fac58f9d714c94e2b228fe5694c1c9b4ead4a366343eda1b"
 
 [[package]]
 name = "constant_time_eq"
-version = "0.3.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 
 [[package]]
 name = "convert_case"
@@ -863,6 +1197,24 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "convert_case"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "affbf0190ed2caf063e3def54ff444b449371d55c58e513a95ab98eca50adb49"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "convert_case_extras"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589c70f0faf8aa9d17787557d5eae854d7755cac50f5c3d12c81d3d57661cebb"
+dependencies = [
+ "convert_case 0.11.0",
+]
+
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -871,10 +1223,10 @@ checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
 dependencies = [
  "aes-gcm",
  "base64",
- "hmac",
+ "hmac 0.12.1",
  "percent-encoding",
  "rand 0.8.6",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
  "time",
  "version_check",
@@ -916,19 +1268,32 @@ dependencies = [
 ]
 
 [[package]]
-name = "crc"
-version = "3.4.0"
+name = "cpufeatures"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
 dependencies = [
- "crc-catalog",
+ "libc",
 ]
 
 [[package]]
-name = "crc-catalog"
-version = "2.4.0"
+name = "crc-fast"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
+checksum = "e75b2483e97a5a7da73ac68a05b629f9c53cff58d8ed1c77866079e18b00dba5"
+dependencies = [
+ "digest 0.10.7",
+ "spin 0.10.0",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
 
 [[package]]
 name = "crossbeam-channel"
@@ -960,17 +1325,38 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
-version = "0.1.7"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
  "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "ctr"
 version = "0.9.2"
@@ -980,6 +1366,15 @@ dependencies = [
  "cipher",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "darling"
 version = "0.20.11"
@@ -1011,7 +1406,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1024,7 +1419,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1035,7 +1430,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core 0.20.11",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1046,14 +1441,14 @@ checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
  "darling_core 0.23.0",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "dashmap"
-version = "6.1.0"
+version = "6.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -1065,9 +1460,9 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.9.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
 name = "deadpool"
@@ -1090,7 +1485,7 @@ checksum = "3d697d376cbfa018c23eb4caab1fd1883dd9c906a8c034e8d9a3cb06a7e0bef9"
 dependencies = [
  "async-trait",
  "deadpool",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "serde",
  "tokio",
  "tokio-postgres",
@@ -1107,35 +1502,35 @@ dependencies = [
 ]
 
 [[package]]
-name = "deranged"
-version = "0.5.5"
+name = "der"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "powerfmt",
- "serde_core",
+ "const-oid 0.9.6",
+ "pem-rfc7468",
+ "zeroize",
 ]
 
 [[package]]
-name = "derivative"
-version = "2.2.0"
+name = "deranged"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
+ "powerfmt",
+ "serde_core",
 ]
 
 [[package]]
 name = "derive-where"
-version = "1.6.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef941ded77d15ca19b40374869ac6000af1c9f2a4c0f3d4c70926287e6364a8f"
+checksum = "d08b3a0bcc0d079199cd476b2cae8435016ec11d1c0986c6901c5ac223041534"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1156,7 +1551,7 @@ dependencies = [
  "darling 0.20.11",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1166,7 +1561,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1175,11 +1570,24 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.6",
  "subtle",
 ]
 
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.0",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -1188,7 +1596,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1218,22 +1626,56 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest 0.10.7",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "either_of"
-version = "0.1.6"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216d23e0ec69759a17f05e1c553f3a6870e5ec73420fbb07807a6f34d5d1d5a4"
+checksum = "5060e0a4cbf26a87550792688ade88e6b8aec9208613631a7a363bda7bc2d4cd"
 dependencies = [
  "paste",
  "pin-project-lite",
 ]
 
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest 0.10.7",
+ "ff",
+ "generic-array",
+ "group",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "email-encoding"
 version = "0.4.1"
@@ -1262,29 +1704,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "env_filter"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bf3c259d255ca70051b30e2e95b5446cdb8949ac4cd22c0d7fd634d89f568e2"
-dependencies = [
- "log",
- "regex",
-]
-
-[[package]]
-name = "env_logger"
-version = "0.11.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
-dependencies = [
- "anstream",
- "anstyle",
- "env_filter",
- "jiff",
- "log",
-]
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1308,9 +1727,9 @@ dependencies = [
 
 [[package]]
 name = "erased-serde"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e8918065695684b2b0702da20382d5ae6065cf3327bc2d6436bd49a71ce9f3"
+checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
 dependencies = [
  "serde",
  "serde_core",
@@ -1371,15 +1790,25 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "ff"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.5"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "fixedbitset"
@@ -1399,6 +1828,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -1439,12 +1874,12 @@ dependencies = [
  "log",
  "lucide-leptos",
  "mime",
- "reqwest 0.13.1",
+ "reqwest",
  "serde",
  "serde_json",
  "shared",
  "thaw",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tokio",
  "wasm-bindgen",
  "wasm-bindgen-futures",
@@ -1460,9 +1895,9 @@ checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1475,9 +1910,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1485,62 +1920,65 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
 dependencies = [
  "futures-core",
  "futures-task",
  "futures-util",
- "num_cpus",
 ]
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-lite"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
-
-[[package]]
-name = "futures-timer"
-version = "3.0.3"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1550,30 +1988,30 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
 [[package]]
 name = "generic-array"
-version = "0.14.7"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
@@ -1586,8 +2024,24 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "r-efi",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
  "wasip2",
+ "wasip3",
  "wasm-bindgen",
 ]
 
@@ -1600,7 +2054,7 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -1623,7 +2077,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "gloo-utils",
- "http",
+ "http 1.4.1",
  "js-sys",
  "pin-project",
  "serde",
@@ -1668,9 +2122,9 @@ dependencies = [
 
 [[package]]
 name = "graphql_client"
-version = "0.15.0"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83ce10ae0a8ba29e295f9296a4a400a5222b1aa0e65a72d66c5e489ed17fa217"
+checksum = "b0f04840854efa7b06377d86fab117f598f5f5c95727067463417ccaf8aa7635"
 dependencies = [
  "graphql_query_derive",
  "serde",
@@ -1679,30 +2133,40 @@ dependencies = [
 
 [[package]]
 name = "graphql_client_codegen"
-version = "0.15.0"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61d9d9d96a7397130da7ce3664851f51ce850137e62b030ac78c8a529661151a"
+checksum = "aa0141e66c8d0302f8a586df12ad5d0cf87c0fa8c391f2f5b5dc296312dce569"
 dependencies = [
  "graphql-introspection-query",
  "graphql-parser",
  "heck",
- "lazy_static",
  "proc-macro2",
  "quote",
  "serde",
  "serde_json",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "graphql_query_derive"
-version = "0.15.0"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b684c77d1b5f9c6006068852e0e0e80c6df3ef85c24fe81ef26fbadbd595af77"
+checksum = "e16ecf9bb87a6760cf5227f66cbe48bad7b89505aeb002aa9439ea090e6038a3"
 dependencies = [
  "graphql_client_codegen",
  "proc-macro2",
- "syn 2.0.111",
+ "syn",
+]
+
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
 ]
 
 [[package]]
@@ -1713,16 +2177,16 @@ checksum = "17e2ac29387b1aa07a1e448f7bb4f35b500787971e965b02842b900afa5c8f6f"
 
 [[package]]
 name = "h2"
-version = "0.4.12"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
 dependencies = [
  "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http",
+ "http 1.4.1",
  "indexmap",
  "slab",
  "tokio",
@@ -1732,9 +2196,9 @@ dependencies = [
 
 [[package]]
 name = "handlebars"
-version = "6.4.0"
+version = "6.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b3f9296c208515b87bd915a2f5d1163d4b3f863ba83337d7713cf478055948e"
+checksum = "d43ccdfe15a81ab0a8af639e90254227c9a46afd9c5f5b6ec7efaa345c4b0f00"
 dependencies = [
  "derive_builder",
  "log",
@@ -1743,7 +2207,7 @@ dependencies = [
  "pest_derive",
  "serde",
  "serde_json",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -1761,7 +2225,7 @@ version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
- "foldhash",
+ "foldhash 0.1.5",
 ]
 
 [[package]]
@@ -1769,6 +2233,17 @@ name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
 name = "hashlink"
@@ -1781,11 +2256,11 @@ dependencies = [
 
 [[package]]
 name = "hashlink"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+checksum = "ea0b22561a9c04a7cb1a302c013e0259cd3b4bb619f145b32f72b8b4bcbed230"
 dependencies = [
- "hashbrown 0.15.5",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -1812,7 +2287,16 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -1837,14 +2321,36 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
 dependencies = [
  "bytes",
  "itoa",
 ]
 
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "http-body"
 version = "1.0.1"
@@ -1852,7 +2358,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http",
+ "http 1.4.1",
 ]
 
 [[package]]
@@ -1863,8 +2369,8 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http",
- "http-body",
+ "http 1.4.1",
+ "http-body 1.0.1",
  "pin-project-lite",
 ]
 
@@ -1880,6 +2386,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9155a582abd142abc056962c29e3ce5ff2ad5469f4246b537ed42c5deba857da"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hydration_context"
 version = "0.3.0"
@@ -1896,22 +2411,21 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
 dependencies = [
  "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
  "h2",
- "http",
- "http-body",
+ "http 1.4.1",
+ "http-body 1.0.1",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -1919,49 +2433,32 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.7"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http",
+ "http 1.4.1",
  "hyper",
  "hyper-util",
  "rustls",
- "rustls-pki-types",
+ "rustls-native-certs",
  "tokio",
  "tokio-rustls",
  "tower-service",
 ]
 
-[[package]]
-name = "hyper-tls"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
-dependencies = [
- "bytes",
- "http-body-util",
- "hyper",
- "hyper-util",
- "native-tls",
- "tokio",
- "tokio-native-tls",
- "tower-service",
-]
-
 [[package]]
 name = "hyper-util"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
  "base64",
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
- "http",
- "http-body",
+ "http 1.4.1",
+ "http-body 1.0.1",
  "hyper",
  "ipnet",
  "libc",
@@ -1977,9 +2474,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.64"
+version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -2016,12 +2513,13 @@ checksum = "6c97be924215abd5e630d84e95a47c710138a6559b4c55039f4f33aa897fa859"
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -2029,9 +2527,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -2042,9 +2540,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -2056,15 +2554,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -2076,15 +2574,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -2095,6 +2593,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -2114,9 +2618,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -2124,12 +2628,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.12.1"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
  "serde",
  "serde_core",
 ]
@@ -2143,15 +2647,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "instant"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "interpolator"
 version = "0.5.0"
@@ -2160,19 +2655,9 @@ checksum = "71dd52191aae121e8611f1e8dc3e324dd0dd1dee1e6dd91d10ee07a3cfb4d9d8"
 
 [[package]]
 name = "ipnet"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
-
-[[package]]
-name = "iri-string"
-version = "0.7.9"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f867b9d1d896b67beb18518eda36fdb77a32ea590de864f1325b294a6d14397"
-dependencies = [
- "memchr",
- "serde",
-]
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "is-terminal"
@@ -2185,12 +2670,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -2202,15 +2681,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jiff"
-version = "0.2.16"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49cce2b81f2098e7e3efc35bc2e0a6b7abec9d34128283d7a26fa8f32a6dbb35"
+checksum = "392c70591e8749fe235ddaf513e6f58b26bce3dcc16524cecc8936f75afa161e"
 dependencies = [
  "jiff-static",
  "jiff-tzdb-platform",
@@ -2218,25 +2697,25 @@ dependencies = [
  "portable-atomic",
  "portable-atomic-util",
  "serde_core",
- "windows-sys 0.61.2",
+ "windows-link",
 ]
 
 [[package]]
 name = "jiff-static"
-version = "0.2.16"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "980af8b43c3ad5d8d349ace167ec8170839f753a42d233ba19e08afe1850fa69"
+checksum = "47b605b0c050d845fc355bb11eb3f9a8deddc218ea60c76e61aa1f2adfb2c96a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "jiff-tzdb"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68971ebff725b9e2ca27a601c5eb38a4c5d64422c4cbab0c535f248087eda5c2"
+checksum = "c900ef84826f1338a557697dc8fc601df9ca9af4ac137c7fb61d4c6f2dfd3076"
 
 [[package]]
 name = "jiff-tzdb-platform"
@@ -2249,25 +2728,52 @@ dependencies = [
 
 [[package]]
 name = "jni"
-version = "0.21.1"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
 dependencies = [
- "cesu8",
  "cfg-if",
  "combine",
+ "jni-macros",
  "jni-sys",
  "log",
- "thiserror 1.0.69",
+ "simd_cesu8",
+ "thiserror 2.0.18",
  "walkdir",
- "windows-sys 0.45.0",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn",
 ]
 
 [[package]]
 name = "jni-sys"
-version = "0.3.0"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
 
 [[package]]
 name = "jobserver"
@@ -2281,10 +2787,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.83"
+version = "0.3.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8"
+checksum = "2964e92d1d9dc3364cae4d718d93f227e3abb088e747d92e0395bfdedf1c12ca"
 dependencies = [
+ "cfg-if",
+ "futures-util",
  "once_cell",
  "wasm-bindgen",
 ]
@@ -2300,6 +2808,21 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "konst"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "128133ed7824fcd73d6e7b17957c5eb7bacb885649bd8c69708b2331a10bcefb"
+dependencies = [
+ "konst_macro_rules",
+]
+
+[[package]]
+name = "konst_macro_rules"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -2319,17 +2842,23 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
 [[package]]
 name = "leptos"
-version = "0.8.14"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c98f6d751e524ff425ad9d63d53e120ed68311ffbc22bbd9c0b3c4005a421e"
+checksum = "efa3982e7fe36c1de68f91f3c9083124f389a975523881f3d7e3363362feda41"
 dependencies = [
  "any_spawner",
  "cfg-if",
  "either_of",
  "futures",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "hydration_context",
  "leptos_config",
  "leptos_dom",
@@ -2349,10 +2878,10 @@ dependencies = [
  "server_fn",
  "slotmap",
  "tachys",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "throw_error",
- "typed-builder 0.22.0",
- "typed-builder-macro 0.22.0",
+ "typed-builder",
+ "typed-builder-macro",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "wasm_split_helpers",
@@ -2378,22 +2907,22 @@ dependencies = [
 
 [[package]]
 name = "leptos_config"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071fc40aeb9fcab885965bad1887990477253ad51f926cd19068f45a44c59e89"
+checksum = "0c06f751315bccc0d193fab302ac01d25bcfcd97474d4676440e7e3250dc3fc3"
 dependencies = [
  "config",
  "regex",
  "serde",
- "thiserror 2.0.17",
- "typed-builder 0.21.2",
+ "thiserror 2.0.18",
+ "typed-builder",
 ]
 
 [[package]]
 name = "leptos_dom"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78f4330c88694c5575e0bfe4eecf81b045d14e76a4f8b00d5fd2a63f8779f895"
+checksum = "35742e9ed8f8aaf9e549b454c68a7ac0992536e06856365639b111f72ab07884"
 dependencies = [
  "js-sys",
  "or_poisoned",
@@ -2406,31 +2935,32 @@ dependencies = [
 
 [[package]]
 name = "leptos_hot_reload"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d61ec3e1ff8aaee8c5151688550c0363f85bc37845450764c31ff7584a33f38"
+checksum = "9d2a0f220c8a5ef3c51199dfb9cdd702bc0eb80d52fbe70c7890adfaaae8a4b1"
 dependencies = [
  "anyhow",
  "camino",
  "indexmap",
- "parking_lot",
+ "or_poisoned",
  "proc-macro2",
  "quote",
  "rstml",
  "serde",
- "syn 2.0.111",
+ "syn",
  "walkdir",
 ]
 
 [[package]]
 name = "leptos_macro"
-version = "0.8.12"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d199fafe14b7925fd392764fdd851215909604955acfda7c0263b8722d57c23"
+checksum = "9360df573fb57582384a8b7640a3de94ce6501d49be3b69f637cf11a42da484b"
 dependencies = [
  "attribute-derive",
  "cfg-if",
- "convert_case 0.8.0",
+ "convert_case 0.11.0",
+ "convert_case_extras",
  "html-escape",
  "itertools",
  "leptos_hot_reload",
@@ -2441,15 +2971,15 @@ dependencies = [
  "rstml",
  "rustc_version",
  "server_fn_macro",
- "syn 2.0.111",
+ "syn",
  "uuid",
 ]
 
 [[package]]
 name = "leptos_meta"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d489e38d3f541e9e43ecc2e3a815527840345a2afca629b3e23fcc1dd254578"
+checksum = "6c3efe657b4c55ed2e078922786ffe20acfb71767c3dd913767b09a35c75c890"
 dependencies = [
  "futures",
  "indexmap",
@@ -2462,9 +2992,9 @@ dependencies = [
 
 [[package]]
 name = "leptos_router"
-version = "0.8.10"
+version = "0.8.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b824cae28db1551b71f8c2a45eab7bb98d61407f5adcc368cfe7b671e4a71d"
+checksum = "c15158449162e099e2273442f7fd9b924f5cefd935d52af5755ec62aa819fa52"
 dependencies = [
  "any_spawner",
  "either_of",
@@ -2478,7 +3008,7 @@ dependencies = [
  "rustc_version",
  "send_wrapper",
  "tachys",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "url",
  "wasm-bindgen",
  "web-sys",
@@ -2493,14 +3023,14 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "leptos_server"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbf1045af93050bf3388d1c138426393fc131f6d9e46a65519da884c033ed730"
+checksum = "da974775c5ccbb6bd64be7f53f75e8321542e28f21563a416574dbe4d5447eae"
 dependencies = [
  "any_spawner",
  "base64",
@@ -2556,44 +3086,36 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.178"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37c93d8daa9d8a012fd8ab92f088405fb202ea0b6ab73ee2482ae66af4f42091"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libm"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
-version = "0.1.10"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
+checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
 dependencies = [
- "bitflags",
  "libc",
- "redox_syscall",
 ]
 
-[[package]]
-name = "linear-map"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfae20f6b19ad527b550c223fddc3077a547fc70cda94b9b566575423fd303ee"
-
 [[package]]
 name = "linux-raw-sys"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "lock_api"
@@ -2606,9 +3128,18 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
+
+[[package]]
+name = "lru"
+version = "0.16.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
+dependencies = [
+ "hashbrown 0.16.1",
+]
 
 [[package]]
 name = "lru-slab"
@@ -2618,9 +3149,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
 [[package]]
 name = "lucide-leptos"
-version = "2.562.0"
+version = "3.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b9d26634ee1f15a7c025695f109b33fa6a7bd5d8727c8890bf2e0f0049b70e1"
+checksum = "36daed62ba36289baeb7eb4690a71909f465155ec3b3a9dc3ca2daf143c333cd"
 dependencies = [
  "leptos",
 ]
@@ -2634,7 +3165,7 @@ dependencies = [
  "manyhow-macros",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -2665,25 +3196,19 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "md-5"
-version = "0.10.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
 dependencies = [
  "cfg-if",
- "digest",
+ "digest 0.11.3",
 ]
 
-[[package]]
-name = "md5"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
-
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "mime"
@@ -2692,71 +3217,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
-name = "minicov"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4869b6a491569605d66d3952bcdf03df789e5b536e5f0cf7758a7f08a55ae24d"
-dependencies = [
- "cc",
- "walkdir",
-]
-
-[[package]]
-name = "minio"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3824101357fa899d01c729e4a245776e20a03f2f6645979e86b9d3d5d9c42741"
-dependencies = [
- "async-recursion",
- "async-trait",
- "base64",
- "byteorder",
- "bytes",
- "chrono",
- "crc",
- "dashmap",
- "derivative",
- "env_logger",
- "futures",
- "futures-util",
- "hex",
- "hmac",
- "http",
- "hyper",
- "lazy_static",
- "log",
- "md5",
- "multimap",
- "percent-encoding",
- "rand 0.8.6",
- "regex",
- "reqwest 0.12.25",
- "serde",
- "serde_json",
- "sha2",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "urlencoding",
- "xmltree",
+name = "minicov"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4869b6a491569605d66d3952bcdf03df789e5b536e5f0cf7758a7f08a55ae24d"
+dependencies = [
+ "cc",
+ "walkdir",
 ]
 
 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
- "wasi",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "moka"
-version = "0.12.12"
+version = "0.12.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3dec6bd31b08944e08b58fd99373893a6c17054d6f3ea5006cc894f4f4eee2a"
+checksum = "957228ad12042ee839f93c8f257b62b4c0ab5eaae1d4fa60de53b27c9d7c5046"
 dependencies = [
  "async-lock",
  "crossbeam-channel",
@@ -2781,7 +3266,7 @@ dependencies = [
  "bytes",
  "encoding_rs",
  "futures-util",
- "http",
+ "http 1.4.1",
  "httparse",
  "memchr",
  "mime",
@@ -2789,28 +3274,19 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "multimap"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "native-tls"
-version = "0.2.14"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
 dependencies = [
  "libc",
  "log",
  "openssl",
- "openssl-probe 0.1.6",
+ "openssl-probe",
  "openssl-sys",
  "schannel",
- "security-framework 2.11.1",
+ "security-framework",
  "security-framework-sys",
  "tempfile",
 ]
@@ -2850,9 +3326,18 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.2.0"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
 
 [[package]]
 name = "num-modular"
@@ -2889,6 +3374,24 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "oco_ref"
 version = "0.2.1"
@@ -2896,24 +3399,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed0423ff9973dea4d6bd075934fdda86ebb8c05bdf9d6b0507067d4a1226371d"
 dependencies = [
  "serde",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 dependencies = [
  "portable-atomic",
 ]
 
-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-
 [[package]]
 name = "oorandom"
 version = "11.1.5"
@@ -2948,20 +3445,14 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "openssl-probe"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
-
-[[package]]
-name = "openssl-probe"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f50d9b3dabb09ecd771ad0aa242ca6894994c130308ca3d7684634df8037391"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-sys"
@@ -2991,6 +3482,24 @@ dependencies = [
  "hashbrown 0.14.5",
 ]
 
+[[package]]
+name = "outref"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
+
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "palette"
 version = "0.7.6"
@@ -3012,7 +3521,7 @@ dependencies = [
  "by_address",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -3067,6 +3576,15 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -3075,9 +3593,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbcfd20a6d4eeba40179f05735784ad32bdaef05ce8e8af05f180d45bb3e7e22"
+checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
 dependencies = [
  "memchr",
  "ucd-trie",
@@ -3085,9 +3603,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f72981ade67b1ca6adc26ec221be9f463f2b5839c7508998daa17c23d94d7f"
+checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
 dependencies = [
  "pest",
  "pest_generator",
@@ -3095,25 +3613,25 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee9efd8cdb50d719a80088b76f81aec7c41ed6d522ee750178f83883d271625"
+checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf1d70880e76bdc13ba52eafa6239ce793d85c8e43896507e43dd8984ff05b82"
+checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
 dependencies = [
  "pest",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -3166,7 +3684,7 @@ dependencies = [
  "phf_shared 0.11.3",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -3189,29 +3707,29 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pin-utils"
@@ -3219,11 +3737,35 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
-version = "0.3.32"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "polling"
+version = "3.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix",
+ "windows-sys 0.61.2",
+]
 
 [[package]]
 name = "polyval"
@@ -3232,43 +3774,43 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "portable-atomic-util"
-version = "0.2.4"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
 dependencies = [
  "portable-atomic",
 ]
 
 [[package]]
 name = "postgres-derive"
-version = "0.4.7"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56df96f5394370d1b20e49de146f9e6c25aa9ae750f449c9d665eafecb3ccae6"
+checksum = "ca1dad89d9ffdbf78502fde418eeede499b87772d88be780478f7f76dc8d471f"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "postgres-native-tls"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac73153d92e4bde922bd6f1dfba7f1ab8132266c031153b55e20a1521cd36d49"
+checksum = "fef4de47bb81477e0c3deaf153a1b10ae176484713ff1640969f4cb96b653ebc"
 dependencies = [
  "native-tls",
  "tokio",
@@ -3278,27 +3820,27 @@ dependencies = [
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.9"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbef655056b916eb868048276cfd5d6a7dea4f81560dfd047f97c8c6fe3fcfd4"
+checksum = "56201207dac53e2f38e848e31b4b91616a6bb6e0c7205b77718994a7f49e70fc"
 dependencies = [
  "base64",
  "byteorder",
  "bytes",
  "fallible-iterator",
- "hmac",
+ "hmac 0.13.0",
  "md-5",
  "memchr",
- "rand 0.9.4",
- "sha2",
+ "rand 0.10.1",
+ "sha2 0.11.0",
  "stringprep",
 ]
 
 [[package]]
 name = "postgres-types"
-version = "0.2.11"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef4605b7c057056dd35baeb6ac0c0338e4975b1f2bef0f65da953285eb007095"
+checksum = "8dc729a129e682e8d24170cd30ae1aa01b336b096cbb56df6d534ffec133d186"
 dependencies = [
  "bytes",
  "fallible-iterator",
@@ -3309,9 +3851,9 @@ dependencies = [
 
 [[package]]
 name = "potential_utf"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -3338,16 +3880,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2",
- "syn 2.0.111",
+ "syn",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
 ]
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.23.9",
+ "toml_edit 0.25.11+spec-1.1.0",
 ]
 
 [[package]]
@@ -3369,7 +3920,7 @@ dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -3385,9 +3936,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.103"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
@@ -3400,7 +3951,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
  "version_check",
  "yansi",
 ]
@@ -3419,7 +3970,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "web-time",
@@ -3441,7 +3992,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tinyvec",
  "tracing",
  "web-time",
@@ -3463,9 +4014,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.42"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -3489,14 +4040,14 @@ dependencies = [
  "proc-macro-utils",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "quoted_printable"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "640c9bd8497b02465aeef5375144c26062e0dcd5939dfcbb0f5db76cb8c17c73"
+checksum = "478e0585659a122aa407eb7e3c0e1fa51b1d8a870038bd29f0cf4a8551eea972"
 
 [[package]]
 name = "r-efi"
@@ -3504,6 +4055,12 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
 version = "0.8.6"
@@ -3522,7 +4079,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.2",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -3542,7 +4110,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -3551,23 +4119,29 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.9.3"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
 dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "reactive_graph"
-version = "0.2.11"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4043190442021086719fb9183daacb050f44d4ed8d3a1c8534e366d45dd95c29"
+checksum = "00c5a025366836190c7030e883cc2bcd9e384ff555336e3c7954741ca411b177"
 dependencies = [
  "any_spawner",
  "async-lock",
@@ -3583,7 +4157,7 @@ dependencies = [
  "send_wrapper",
  "serde",
  "slotmap",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "web-sys",
 ]
 
@@ -3599,24 +4173,24 @@ dependencies = [
  "or_poisoned",
  "paste",
  "reactive_graph",
- "reactive_stores_macro",
+ "reactive_stores_macro 0.2.6",
  "rustc-hash",
  "send_wrapper",
 ]
 
 [[package]]
 name = "reactive_stores"
-version = "0.3.0"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25b73d94139821e0a2f31fb4e0eaf6ebbcf4d15c5e2fb353dc3babd4f6d35674"
+checksum = "c30fd35b7d299c591293bb69fed47a703eb2703b1cff0493e78b16ed007e5382"
 dependencies = [
- "dashmap",
  "guardian",
+ "indexmap",
  "itertools",
  "or_poisoned",
  "paste",
  "reactive_graph",
- "reactive_stores_macro",
+ "reactive_stores_macro 0.4.2",
  "rustc-hash",
  "send_wrapper",
 ]
@@ -3631,7 +4205,20 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
+]
+
+[[package]]
+name = "reactive_stores_macro"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d8e790a5ae5ddf9b7fa380c728375b06858e0cca7d063a73b3408320c523e1"
+dependencies = [
+ "convert_case 0.11.0",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -3645,9 +4232,9 @@ dependencies = [
 
 [[package]]
 name = "refinery"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c427f2572afe5c6cbfa2b1bf40071c89bf1a8539e958ea582842f6f38dcfae"
+checksum = "ee5133e5b207e5703c2a4a9dc9bd8c8f2cc74c4ac04ca5510acaa907012c77ac"
 dependencies = [
  "refinery-core",
  "refinery-macros",
@@ -3655,9 +4242,9 @@ dependencies = [
 
 [[package]]
 name = "refinery-core"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702655abfc67f93a6f735e9fa4ace7d2e580633f8961f28acbfd7583ddce936c"
+checksum = "023a2a96d959c9b5b5da78e965bfdb1363b365bf5e84531a67d0eee827a702a3"
 dependencies = [
  "async-trait",
  "cfg-if",
@@ -3667,7 +4254,7 @@ dependencies = [
  "regex",
  "serde",
  "siphasher",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "time",
  "tokio",
  "tokio-postgres",
@@ -3678,22 +4265,22 @@ dependencies = [
 
 [[package]]
 name = "refinery-macros"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5145756cdf293b5089dc6b4f103f1a1229cc55d67082c866f8c8289531c4b983"
+checksum = "c56c2e960c8e47c7c5c30ad334afea8b5502da796a59e34d640d6239d876d924"
 dependencies = [
  "proc-macro2",
  "quote",
  "refinery-core",
  "regex",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.2"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3703,9 +4290,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3713,63 +4300,30 @@ dependencies = [
 ]
 
 [[package]]
-name = "regex-syntax"
-version = "0.8.8"
+name = "regex-lite"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
 
 [[package]]
-name = "reqwest"
-version = "0.12.25"
+name = "regex-syntax"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6eff9328d40131d43bd911d42d79eb6a47312002a4daefc9e37f17e74a7701a"
-dependencies = [
- "base64",
- "bytes",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-tls",
- "hyper-util",
- "js-sys",
- "log",
- "native-tls",
- "percent-encoding",
- "pin-project-lite",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-native-tls",
- "tokio-util",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams",
- "web-sys",
-]
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "reqwest"
-version = "0.13.1"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04e9018c9d814e5f30cc16a0f03271aeab3571e609612d9fe78c1aa8d11c2f62"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
  "h2",
- "http",
- "http-body",
+ "http 1.4.1",
+ "http-body 1.0.1",
  "http-body-util",
  "hyper",
  "hyper-rustls",
@@ -3797,15 +4351,24 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac 0.12.1",
+ "subtle",
+]
+
 [[package]]
 name = "rhai"
-version = "1.23.6"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4e35aaaa439a5bda2f8d15251bc375e4edfac75f9865734644782c9701b5709"
+checksum = "5cdc552c1c198f0565e1deb9d85d380caedcc488e6ac3cb6f947c7ae77041e08"
 dependencies = [
  "ahash",
  "bitflags",
- "instant",
  "no-std-compat",
  "num-traits",
  "once_cell",
@@ -3814,17 +4377,18 @@ dependencies = [
  "smallvec",
  "smartstring",
  "thin-vec",
+ "web-time",
 ]
 
 [[package]]
 name = "rhai_codegen"
-version = "3.1.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4322a2a4e8cf30771dd9f27f7f37ca9ac8fe812dddd811096a98483080dabe6"
+checksum = "3cd3a7535e50bf36857e7be7bec276d334e8c2dfa469c2201226fd01638ea5ca"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -3835,7 +4399,7 @@ checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libc",
  "untrusted",
  "windows-sys 0.52.0",
@@ -3843,9 +4407,9 @@ dependencies = [
 
 [[package]]
 name = "ron"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd490c5b18261893f14449cbd28cb9c0b637aebf161cd77900bfdedaff21ec32"
+checksum = "4147b952f3f819eca0e99527022f7d6a8d05f111aeb0a62960c74eb283bec8fc"
 dependencies = [
  "bitflags",
  "once_cell",
@@ -3865,9 +4429,9 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.111",
+ "syn",
  "syn_derive",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -3882,9 +4446,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 
 [[package]]
 name = "rustc_version"
@@ -3897,9 +4461,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.2"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags",
  "errno",
@@ -3928,17 +4492,17 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
 dependencies = [
- "openssl-probe 0.2.0",
+ "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.5.1",
+ "security-framework",
 ]
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.13.1"
+version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "708c0f9d5f54ba0272468c1d306a52c495b31fa155e91bc25371e6df7996908c"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
 dependencies = [
  "web-time",
  "zeroize",
@@ -3946,9 +4510,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.6.2"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
  "core-foundation 0.10.1",
  "core-foundation-sys",
@@ -3959,7 +4523,7 @@ dependencies = [
  "rustls-native-certs",
  "rustls-platform-verifier-android",
  "rustls-webpki",
- "security-framework 3.5.1",
+ "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
  "windows-sys 0.61.2",
@@ -3991,9 +4555,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "same-file"
@@ -4006,9 +4570,9 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.28"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
  "windows-sys 0.61.2",
 ]
@@ -4020,23 +4584,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
-name = "security-framework"
-version = "2.11.1"
+name = "sec1"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "bitflags",
- "core-foundation 0.9.4",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
 name = "security-framework"
-version = "3.5.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
  "bitflags",
  "core-foundation 0.10.1",
@@ -4047,9 +4612,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.15.0"
+version = "2.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -4057,9 +4622,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "send_wrapper"
@@ -4086,7 +4651,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9faf48a4a2d2693be24c6289dbe26552776eb7737074e6722891fadbe6c5058"
 dependencies = [
- "erased-serde 0.4.9",
+ "erased-serde 0.4.10",
  "serde",
  "serde_core",
  "typeid",
@@ -4120,20 +4685,20 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
  "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -4155,7 +4720,7 @@ checksum = "f3faaf9e727533a19351a43cc5a8de957372163c7d35cc48c90b75cdda13c352"
 dependencies = [
  "percent-encoding",
  "serde",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -4169,9 +4734,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.3"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
  "serde_core",
 ]
@@ -4190,19 +4755,19 @@ dependencies = [
 
 [[package]]
 name = "server_fn"
-version = "0.8.8"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdc30228718f62d80a376964baf990edbcb5e97688fdc71183a8ef3d44cb6c89"
+checksum = "5d60e4c1dfccd91fe0990141f69f1d5cf5679797ad53aa1b45e5bd658eb119f0"
 dependencies = [
  "base64",
  "bytes",
  "const-str",
  "const_format",
- "dashmap",
  "futures",
  "gloo-net",
- "http",
+ "http 1.4.1",
  "js-sys",
+ "or_poisoned",
  "pin-project-lite",
  "rustc_version",
  "rustversion",
@@ -4211,7 +4776,7 @@ dependencies = [
  "serde_json",
  "serde_qs",
  "server_fn_macro_default",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "throw_error",
  "url",
  "wasm-bindgen",
@@ -4223,16 +4788,16 @@ dependencies = [
 
 [[package]]
 name = "server_fn_macro"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "950b8cfc9ff5f39ca879c5a7c5e640de2695a199e18e424c3289d0964cabe642"
+checksum = "1295b54815397d30d986b63f93cfd515fa86d5e528e0bb589ce9d530502f9e0f"
 dependencies = [
  "const_format",
- "convert_case 0.8.0",
+ "convert_case 0.11.0",
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.111",
+ "syn",
  "xxhash-rust",
 ]
 
@@ -4243,7 +4808,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63eb08f80db903d3c42f64e60ebb3875e0305be502bdc064ec0a0eab42207f00"
 dependencies = [
  "server_fn_macro",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -4253,8 +4818,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -4264,8 +4840,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -4289,24 +4876,51 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.7"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest 0.10.7",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7664a098b8e616bdfcc2dc0e9ac44eb231eedf41db4e9fe95d8d32ec728dedad"
-dependencies = [
- "libc",
-]
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "siphasher"
-version = "1.0.1"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "slog"
@@ -4378,12 +4992,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4398,6 +5012,22 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
+[[package]]
+name = "spin"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -4451,7 +5081,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -4462,20 +5092,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.111"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4491,7 +5110,7 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -4511,14 +5130,14 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "system-configuration"
-version = "0.6.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
  "bitflags",
  "core-foundation 0.9.4",
@@ -4537,9 +5156,9 @@ dependencies = [
 
 [[package]]
 name = "tachys"
-version = "0.2.11"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b2db11e455f7e84e2cc3e76f8a3f3843f7956096265d5ecff781eabe235077"
+checksum = "2989c94c59db8497727875aa561d4d0daa3cc79b5774d5ced48263f7091beff1"
 dependencies = [
  "any_spawner",
  "async-trait",
@@ -4552,14 +5171,12 @@ dependencies = [
  "indexmap",
  "itertools",
  "js-sys",
- "linear-map",
  "next_tuple",
  "oco_ref",
  "or_poisoned",
- "parking_lot",
  "paste",
  "reactive_graph",
- "reactive_stores 0.3.0",
+ "reactive_stores 0.4.3",
  "rustc-hash",
  "rustc_version",
  "send_wrapper",
@@ -4583,12 +5200,12 @@ checksum = "f764005d11ee5f36500a149ace24e00e3da98b0158b3e2d53a7495660d3f4d60"
 
 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -4650,7 +5267,7 @@ checksum = "5af50a5123e480e7ee8961e6456f63530816875d0a19cb73060b8e61dd2a95fb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -4670,9 +5287,9 @@ dependencies = [
 
 [[package]]
 name = "thin-vec"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "259cdf8ed4e4aca6f1e9d011e10bd53f524a2d0637d7b28450f6c64ac298c4c6"
+checksum = "b0f7e269b48f0a7dd0146680fa24b50cc67fc0373f086a5b2f99bd084639b482"
 dependencies = [
  "serde",
 ]
@@ -4688,11 +5305,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.17",
+ "thiserror-impl 2.0.18",
 ]
 
 [[package]]
@@ -4703,18 +5320,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -4777,9 +5394,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -4787,9 +5404,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -4802,9 +5419,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
  "bytes",
  "libc",
@@ -4819,13 +5436,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -4840,9 +5457,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-postgres"
-version = "0.7.15"
+version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b40d66d9b2cfe04b628173409368e58247e8eddbbd3b0e6c6ba1d09f20f6c9e"
+checksum = "4dd8df5ef180f6364759a6f00f7aadda4fbbac86cdee37480826a6ff9f3574ce"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -4857,7 +5474,7 @@ dependencies = [
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand 0.9.4",
+ "rand 0.10.1",
  "socket2",
  "tokio",
  "tokio-util",
@@ -4876,9 +5493,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -4887,9 +5504,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
 dependencies = [
  "futures-util",
  "log",
@@ -4899,9 +5516,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.17"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
  "bytes",
  "futures-core",
@@ -4925,15 +5542,15 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.8"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
+checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
 dependencies = [
  "serde_core",
- "serde_spanned 1.0.3",
- "toml_datetime 0.7.3",
+ "serde_spanned 1.1.1",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow",
+ "winnow 1.0.3",
 ]
 
 [[package]]
@@ -4947,9 +5564,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.3"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
  "serde_core",
 ]
@@ -4965,28 +5582,28 @@ dependencies = [
  "serde_spanned 0.6.9",
  "toml_datetime 0.6.11",
  "toml_write",
- "winnow",
+ "winnow 0.7.15",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.23.9"
+version = "0.25.11+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d7cbc3b4b49633d57a0509303158ca50de80ae32c265093b24c414705807832"
+checksum = "0b59c4d22ed448339746c59b905d24568fcbb3ab65a500494f7b8c3e97739f2b"
 dependencies = [
  "indexmap",
- "toml_datetime 0.7.3",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow",
+ "winnow 1.0.3",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
- "winnow",
+ "winnow 1.0.3",
 ]
 
 [[package]]
@@ -4997,9 +5614,9 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "tower"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
@@ -5013,20 +5630,21 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.8"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags",
  "bytes",
  "futures-util",
- "http",
- "http-body",
- "iri-string",
+ "http 1.4.1",
+ "http-body 1.0.1",
+ "http-body-util",
  "pin-project-lite",
  "tower",
  "tower-layer",
  "tower-service",
+ "url",
 ]
 
 [[package]]
@@ -5043,9 +5661,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.43"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d15d90a0b5c19378952d479dc858407149d7bb45a14de0142f6c534b16fc647"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "log",
  "pin-project-lite",
@@ -5061,14 +5679,14 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.35"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a04e24fab5c89c6a36eb8558c9656f30d81de51dfa4d3b45f26b21d61fa0a6c"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
  "valuable",
@@ -5087,9 +5705,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.22"
+version = "0.3.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f30143827ddab0d256fd843b7a66d164e9f271cfa0dde49142c5ca0ca291f1e"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -5111,59 +5729,38 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "tungstenite"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
 dependencies = [
  "bytes",
  "data-encoding",
- "http",
+ "http 1.4.1",
  "httparse",
  "log",
  "rand 0.9.4",
- "sha1",
- "thiserror 2.0.17",
- "utf-8",
-]
-
-[[package]]
-name = "typed-builder"
-version = "0.21.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fef81aec2ca29576f9f6ae8755108640d0a86dd3161b2e8bca6cfa554e98f77d"
-dependencies = [
- "typed-builder-macro 0.21.2",
+ "sha1 0.10.6",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "typed-builder"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "398a3a3c918c96de527dc11e6e846cd549d4508030b8a33e1da12789c856b81a"
-dependencies = [
- "typed-builder-macro 0.22.0",
-]
-
-[[package]]
-name = "typed-builder-macro"
-version = "0.21.2"
+version = "0.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecb9ecf7799210407c14a8cfdfe0173365780968dc57973ed082211958e0b18"
+checksum = "31aa81521b70f94402501d848ccc0ecaa8f93c8eb6999eb9747e72287757ffda"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
+ "typed-builder-macro",
 ]
 
 [[package]]
 name = "typed-builder-macro"
-version = "0.22.0"
+version = "0.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e48cea23f68d1f78eb7bc092881b6bb88d3d6b5b7e6234f6f9c911da1ffb221"
+checksum = "076a02dc54dd46795c2e9c8282ed40bcfb1e22747e955de9389a1de28190fb26"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -5174,9 +5771,9 @@ checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
 [[package]]
 name = "ucd-trie"
@@ -5192,9 +5789,9 @@ checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-normalization"
@@ -5213,9 +5810,9 @@ checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
 
 [[package]]
 name = "unicode-xid"
@@ -5229,7 +5826,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.6",
  "subtle",
 ]
 
@@ -5241,9 +5838,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.7"
+version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -5251,18 +5848,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "urlencoding"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
-
-[[package]]
-name = "utf-8"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
-
 [[package]]
 name = "utf8-width"
 version = "0.1.8"
@@ -5275,19 +5860,13 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
 [[package]]
 name = "uuid"
-version = "1.19.0"
+version = "1.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
+checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "js-sys",
  "wasm-bindgen",
 ]
@@ -5310,6 +5889,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "vsimd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -5335,26 +5920,47 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasi"
+version = "0.14.7+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
+dependencies = [
+ "wasip2",
+]
+
 [[package]]
 name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
 name = "wasite"
-version = "0.1.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
+dependencies = [
+ "wasi 0.14.7+wasi-0.2.4",
+]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.106"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd"
+checksum = "0bf938a0bacb0469e83c1e148908bd7d5a6010354cf4fb73279b7447422e3a89"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -5365,22 +5971,19 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.56"
+version = "0.4.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836d9622d604feee9e5de25ac10e3ea5f2d65b41eac0d9ce72eb5deae707ce7c"
+checksum = "f371d383f2fb139252e0bfac3b81b265689bf45b6874af544ffa4c975ac1ebf8"
 dependencies = [
- "cfg-if",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.106"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3"
+checksum = "eeff24f84126c0ec2db7a449f0c2ec963c6a49efe0698c4242929da037ca28ed"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -5388,31 +5991,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.106"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40"
+checksum = "9d08065faf983b2b80a79fd87d8254c409281cf7de75fc4b773019824196c904"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.106"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4"
+checksum = "5fd04d9e306f1907bd13c6361b5c6bfc7b3b3c095ed3f8a9246390f8dbdee129"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "wasm-bindgen-test"
-version = "0.3.56"
+version = "0.3.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e90e66d265d3a1efc0e72a54809ab90b9c0c515915c67cdf658689d2c22c6c"
+checksum = "6bb55e2540ad1c56eec35fd63e2aea15f83b11ce487fd2de9ad11578dfc047ea"
 dependencies = [
  "async-trait",
  "cast",
@@ -5427,24 +6030,53 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "wasm-bindgen-test-macro",
+ "wasm-bindgen-test-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-test-macro"
-version = "0.3.56"
+version = "0.3.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7150335716dce6028bead2b848e72f47b45e7b9422f64cccdc23bedca89affc1"
+checksum = "caf0ca1bd612b988616bac1ab34c4e4290ef18f7148a1d8b7f31c150080e9295"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
+]
+
+[[package]]
+name = "wasm-bindgen-test-shared"
+version = "0.2.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23cda5ecc67248c48d3e705d3e03e00af905769b78b9d2a1678b663b8b9d4472"
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
 ]
 
 [[package]]
 name = "wasm-streams"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
 dependencies = [
  "futures-util",
  "js-sys",
@@ -5455,9 +6087,9 @@ dependencies = [
 
 [[package]]
 name = "wasm_split_helpers"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a114b3073258dd5de3d812cdd048cca6842342755e828a14dbf15f843f2d1b84"
+checksum = "d0cb6d1008be3c4c5abc31a407bfb8c8449ae14efc8561c1db821f79b9614b0a"
 dependencies = [
  "async-once-cell",
  "wasm_split_macros",
@@ -5465,21 +6097,33 @@ dependencies = [
 
 [[package]]
 name = "wasm_split_macros"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56481f8ed1a9f9ae97ea7b08a5e2b12e8adf9a7818a6ba952b918e09c7be8bf0"
+checksum = "d0a659ffe5c7f4538aa6357c07e3d73221cc61eba03bd9a081e14bc91ed09b8c"
 dependencies = [
  "base16",
  "quote",
- "sha2",
- "syn 2.0.111",
+ "sha2 0.10.9",
+ "syn",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.83"
+version = "0.3.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b32828d774c412041098d182a8b38b16ea816958e07cf40eec2bc080ae137ac"
+checksum = "4f2dfbb17949fa2088e5d39408c48368947b86f7834484e87b73de55bc14d97d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -5497,20 +6141,22 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.5"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36a29fc0408b113f68cf32637857ab740edfafdf460c326cd2afaa2d84cc05dc"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "whoami"
-version = "1.6.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
 dependencies = [
+ "libc",
  "libredox",
+ "objc2-system-configuration",
  "wasite",
  "web-sys",
 ]
@@ -5545,7 +6191,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -5556,7 +6202,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
@@ -5594,15 +6240,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -5630,21 +6267,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -5678,12 +6300,6 @@ dependencies = [
  "windows_x86_64_msvc 0.53.1",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
@@ -5696,12 +6312,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
@@ -5714,12 +6324,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -5744,12 +6348,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
@@ -5762,12 +6360,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
@@ -5780,12 +6372,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
@@ -5798,12 +6384,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -5818,40 +6398,128 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "wit-bindgen"
-version = "0.46.0"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
 
 [[package]]
-name = "writeable"
-version = "0.6.2"
+name = "wit-bindgen"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
-name = "xml-rs"
-version = "0.8.28"
+name = "wit-bindgen-core"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
 
 [[package]]
-name = "xmltree"
-version = "0.11.0"
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b619f8c85654798007fb10afa5125590b43b088c225a25fc2fec100a9fad0fc6"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
 dependencies = [
- "xml-rs",
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
 ]
 
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "xmlparser"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
+
 [[package]]
 name = "xxhash-rust"
 version = "0.8.15"
@@ -5860,13 +6528,13 @@ checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
 
 [[package]]
 name = "yaml-rust2"
-version = "0.10.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2462ea039c445496d8793d052e13787f2b90e750b833afee748e601c17621ed9"
+checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
 dependencies = [
  "arraydeque",
  "encoding_rs",
- "hashlink 0.10.0",
+ "hashlink 0.11.0",
 ]
 
 [[package]]
@@ -5877,9 +6545,9 @@ checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -5888,54 +6556,54 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.31"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd74ec98b9250adb3ca554bdde269adf631549f51d8a8f8f0a10b50f1cb298c3"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.31"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8a8d209fdf45cf5138cbb5a506f6b52522a25afccc534d1475dad8e31105c6a"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
  "synstructure",
 ]
 
@@ -5947,9 +6615,9 @@ checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -5958,9 +6626,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -5969,11 +6637,17 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/README.md b/README.md
index d8a8c0c..c8196d2 100644
--- a/README.md
+++ b/README.md
@@ -53,16 +53,37 @@ cd memory-map
 
 ```sh
 cp .env.example .env
+just frontend-config
 direnv allow
 ```
 
 This installs all dependencies and auto-loads the development shell whenever you enter the directory.
 
+`just frontend-config` creates the ignored local runtime config at
+`frontend/public/config.json` from `frontend/config.example.json`.
+
 You can optionally configure the build mode and other settings by editing `.env`:
 
 - `BUILD_MODE="debug"` (default): Faster compilation, includes debug info.
 - `BUILD_MODE="release"`: Optimised build, smaller binaries, slower compilation.
 - Database, SMTP, and S3 storage configurations.
+- All backend environment variables share the `MEMORY_MAP__` prefix, with `__`
+  as the nested-path separator (e.g.
+  `MEMORY_MAP__STORAGE__ENDPOINT_URL`). See `docs/deployment.md` for the full
+  list.
+- Local storage settings are `MEMORY_MAP__STORAGE__ENDPOINT_URL`,
+  `MEMORY_MAP__STORAGE__ACCESS_KEY`, `MEMORY_MAP__STORAGE__SECRET_KEY`,
+  `MEMORY_MAP__STORAGE__BUCKET_NAME`, `MEMORY_MAP__STORAGE__REGION`,
+  `MEMORY_MAP__STORAGE__FORCE_PATH_STYLE`, and
+  `MEMORY_MAP__STORAGE__PRESIGNED_URL_TTL_SECONDS`.
+- The default local S3 API endpoint is `http://127.0.0.1:9000/`, with region
+  `us-east-1`, bucket `memory-map`, and path-style addressing enabled for
+  RustFS. Presigned media URLs default to a seven-day lifetime.
+- Object storage cleanup settings live under
+  `MEMORY_MAP__OBJECT_LIFECYCLE__*`, including
+  `PENDING_UPLOAD_TIMEOUT_SECONDS`, `STORAGE_DELETION_RETRY_SECONDS`,
+  `STORAGE_DELETION_LEASE_SECONDS`, `MAINTENANCE_INTERVAL_SECONDS`,
+  `STORAGE_DELETION_BATCH_SIZE`, and `STORAGE_DELETION_MAX_ATTEMPTS`.
 
 ### 4. Start database & storage
 
@@ -70,10 +91,10 @@ You can optionally configure the build mode and other settings by editing `.env`
 just servers
 ```
 
-MinIO object storage becomes available at: [http://localhost:9001/login](http://localhost:9001/login)
+RustFS S3-compatible storage becomes available at: [http://localhost:9001/login](http://localhost:9001/login)
 
-- **Username:** `minioadmin`
-- **Password:** `minioadmin`
+- **Username:** `memorymapdev`
+- **Password:** `memorymapdevsecret`
 
 ### 5. Start backend
 
@@ -99,20 +120,34 @@ Frontend app: [http://localhost:3000/](http://localhost:3000/)
 
 The project uses [Just](https://github.com/casey/just) as a task runner.
 
-- `just servers`: Start PostgreSQL and MinIO via Nix.
+- `just servers`: Start PostgreSQL and RustFS via Nix.
+- `just clean-service-state`: Remove local PostgreSQL and storage service state.
 - `just backend`: Start the Axum backend with hot-reloading (via Bacon).
+- `just frontend-config`: Create local frontend runtime config when missing.
 - `just frontend`: Start the Leptos frontend (via Trunk).
 - `just fmt`: Format Rust, Nix, Markdown, YAML, and TOML files.
 - `just check`: Run `cargo check` for the workspace.
 - `just clippy`: Run Clippy with warnings treated as errors.
 - `just deny`: Check Rust dependencies with `cargo-deny`.
 - `just doc`: Build documentation with warnings treated as errors and run ASCII/link checks.
-- `just test`: Run the workspace test suite with cached output.
-- `just frontend-build`: Build the frontend with Trunk.
-- `just verify`: Run the full verification suite before submitting a PR.
+- `just test`: Run the workspace test suite.
+- `just storage-test`: Run ignored storage integration tests against the
+  configured S3-compatible endpoint. Missing local storage skips by default; set
+  `BACKEND_TEST_REQUIRE_SERVICE=true` to fail instead.
+- `just frontend-build`: Build the frontend with Trunk using the existing
+  `frontend/public/config.json` runtime config.
+- `just verify-fast`: Run every check that does not need the local service graph.
+- `just verify`: Run the full verification suite (adds the service-backed storage,
+  backend-integration, and e2e tests) before submitting a PR.
 - `just regenerate-schema`: Introspect the backend and update the frontend GraphQL schema.
 - `just scan-hardcoded`: Scan the codebase for hardcoded secrets or values.
 
+## Production Deployment
+
+Production uses real PostgreSQL, SMTP, S3-compatible storage, runtime secrets,
+and a deployment-supplied frontend `/config.json`. See
+[Production Deployment](docs/deployment.md).
+
 ## Tech Stack
 
 | Layer                   | Technology                                                |
@@ -121,7 +156,7 @@ The project uses [Just](https://github.com/casey/just) as a task runner.
 |                         | [UnoCSS](https://unocss.dev/)                             |
 | Backend                 | [Axum](https://github.com/tokio-rs/axum)                  |
 |                         | [GraphQL](https://graphql.org)                            |
-| Storage                 | [MinIO](https://min.io)                                   |
+| Storage                 | [RustFS](https://rustfs.com/)                             |
 | Database                | [PostgreSQL](https://www.postgresql.org)                  |
 | Development Environment | [Nix package manager](https://nixos.org)                  |
 |                         | [nix-direnv](https://github.com/nix-community/nix-direnv) |
@@ -131,17 +166,23 @@ The project uses [Just](https://github.com/casey/just) as a task runner.
 
 ```
 memory-map/
-|-- .direnv/         # Direnv environment cache
-|-- backend/         # Axum and GraphQL backend
-|-- data/            # Database and storage volumes
-|-- devenv/          # Nix development environment
-|-- frontend/        # Leptos and UnoCSS frontend
-|-- shared/          # Shared utilities and types
-|-- .env.example     # Environment configuration template
-|-- justfile         # Development commands
-|-- Cargo.toml       # Rust workspace configuration
-|-- Cargo.lock       # Rust dependency lock file
-`-- README.md        # Project documentation
+|-- backend/             # Axum and GraphQL backend
+|-- data/                # Database and storage volumes
+|-- devenv/              # Nix development environment
+|-- docs/                # Long-form documentation
+|-- frontend/            # Leptos and UnoCSS frontend
+|-- screenshots/         # README image assets
+|-- scripts/             # Shared shell helpers for justfile recipes
+|-- shared/              # Shared utilities and types
+|-- .env.example         # Environment configuration template
+|-- AGENTS.md            # AI coding assistant guidance
+|-- Cargo.lock           # Rust dependency lock file
+|-- Cargo.toml           # Rust workspace configuration
+|-- config.example.toml  # Optional TOML configuration template
+|-- CONTRIBUTING.md      # Contributor documentation
+|-- justfile             # Development commands
+|-- LICENSE              # Project license
+`-- README.md            # Project documentation
 ```
 
 ## Contributing
@@ -160,6 +201,10 @@ This command will:
 - Generate documentation
 - Run tests
 - Build the frontend
+- Run the service-backed storage, backend-integration, and Playwright e2e suites
+  against the local Postgres + RustFS service graph
+
+For faster iteration that skips the service-backed suites, use `just verify-fast`.
 
 ## License
 
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 858f1d3..c8bcbdc 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -7,17 +7,23 @@ license = "BlueOak-1.0.0"
 [dependencies]
 anyhow = "1.0"
 argon2 = "0.5"
-async-graphql = "7.1"
-async-graphql-axum = "7.1"
-axum = { version = "0.8", features = ["multipart"] }
+async-graphql = "7.2"
+async-graphql-axum = "7.2"
+aws-credential-types = "1.2.14"
+aws-sdk-s3 = { version = "1.133.0", default-features = false, features = [
+	"default-https-client",
+	"http-1x",
+	"rt-tokio",
+	"sigv4a"
+] }
+axum = "0.8"
 axum-extra = { version = "0.12", features = [
 	"cookie",
 	"cookie-private",
 	"cookie-signed"
 ] }
-axum-macros = "0.5"
 blake3 = "1.8"
-casbin = { version = "2.19", features = ["logging", "runtime-tokio"] }
+casbin = { version = "2.20", features = ["logging", "runtime-tokio"] }
 config = "0.15"
 deadpool = "0.12"
 deadpool-postgres = { version = "0.14", features = ["rt_tokio_1", "serde"] }
@@ -32,20 +38,21 @@ lettre = { version = "0.11", features = [
 	"tokio1",
 	"tokio1-native-tls"
 ] }
-minio = "0.3"
 moka = { version = "0.12", features = ["future"] }
+parking_lot = "0.12"
 postgres-types = { version = "0.2", features = ["derive"] }
-rand = "0.8"
+rand = "0.10"
 refinery = { version = "0.9", features = ["tokio-postgres"] }
+reqwest = { version = "0.13", default-features = false, features = ["rustls"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 shared = { path = "../shared" }
 thiserror = "2.0"
 time = "0.3"
-tokio = { version = "1.49", features = ["full"] }
+tokio = { version = "1.52", features = ["full"] }
 tokio-postgres = { version = "0.7", features = ["with-jiff-0_2"] }
 tower = { version = "0.5", features = ["util"] }
-tower-http = { version = "0.6", features = ["cors"] }
+tower-http = { version = "0.6", features = ["cors", "limit"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
diff --git a/backend/migrations/V10__add_object_upload_sessions.sql b/backend/migrations/V10__add_object_upload_sessions.sql
new file mode 100644
index 0000000..5b68187
--- /dev/null
+++ b/backend/migrations/V10__add_object_upload_sessions.sql
@@ -0,0 +1,21 @@
+CREATE TABLE object_upload_sessions (
+	object_id BIGINT PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+	storage_key TEXT NOT NULL UNIQUE CHECK (storage_key <> ''),
+	upload_id TEXT NOT NULL CHECK (upload_id <> ''),
+	content_type TEXT NOT NULL CHECK (content_type <> ''),
+	file_size BIGINT NOT NULL CHECK (file_size > 0),
+	part_size_bytes BIGINT NOT NULL CHECK (part_size_bytes >= 5 * 1024 * 1024),
+	expires_at timestamptz NOT NULL,
+	cleanup_attempts INTEGER NOT NULL DEFAULT 0 CHECK (cleanup_attempts >= 0),
+	cleanup_last_attempt_at timestamptz,
+	cleanup_next_attempt_at timestamptz NOT NULL DEFAULT now(),
+	cleanup_last_error TEXT,
+	created_at timestamptz NOT NULL DEFAULT now(),
+	CHECK (expires_at > created_at)
+);
+
+CREATE INDEX object_upload_sessions_created_at_idx
+	ON object_upload_sessions (created_at);
+
+CREATE INDEX object_upload_sessions_cleanup_idx
+	ON object_upload_sessions (expires_at, cleanup_next_attempt_at, created_at);
diff --git a/backend/migrations/V11__add_available_objects_view.sql b/backend/migrations/V11__add_available_objects_view.sql
new file mode 100644
index 0000000..1e65c37
--- /dev/null
+++ b/backend/migrations/V11__add_available_objects_view.sql
@@ -0,0 +1,17 @@
+CREATE VIEW available_objects_with_users AS
+SELECT
+	o.id,
+	o.name,
+	o.storage_key,
+	o.content_type,
+	o.made_on,
+	ST_Y(o.location::geometry) AS latitude,
+	ST_X(o.location::geometry) AS longitude,
+	o.user_id,
+	o.publicity,
+	COALESCE(array_agg(u.email) FILTER (WHERE u.email IS NOT NULL), '{}') AS allowed_users
+FROM objects o
+LEFT JOIN object_allowed_users oau ON o.id = oau.object_id
+LEFT JOIN users u ON oau.user_id = u.id
+WHERE o.storage_state = 'available'
+GROUP BY o.id;
diff --git a/backend/migrations/V12__add_email_outbox.sql b/backend/migrations/V12__add_email_outbox.sql
new file mode 100644
index 0000000..997af5d
--- /dev/null
+++ b/backend/migrations/V12__add_email_outbox.sql
@@ -0,0 +1,13 @@
+CREATE TABLE email_outbox (
+	id BIGSERIAL PRIMARY KEY,
+	kind TEXT NOT NULL CHECK (kind <> ''),
+	payload JSONB NOT NULL,
+	created_at timestamptz NOT NULL DEFAULT now(),
+	attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+	last_attempt_at timestamptz,
+	next_attempt_at timestamptz NOT NULL DEFAULT now(),
+	last_error TEXT
+);
+
+CREATE INDEX email_outbox_claim_idx
+	ON email_outbox (next_attempt_at, created_at);
diff --git a/backend/migrations/V8__add_object_storage_deletions.sql b/backend/migrations/V8__add_object_storage_deletions.sql
new file mode 100644
index 0000000..153ecfb
--- /dev/null
+++ b/backend/migrations/V8__add_object_storage_deletions.sql
@@ -0,0 +1,58 @@
+CREATE TYPE object_storage_state AS ENUM ('pending_upload', 'available', 'delete_pending');
+
+ALTER TABLE objects ADD COLUMN storage_key TEXT;
+UPDATE objects SET storage_key = name;
+ALTER TABLE objects ALTER COLUMN storage_key SET NOT NULL;
+ALTER TABLE objects ADD CONSTRAINT objects_storage_key_key UNIQUE (storage_key);
+
+ALTER TABLE objects ADD COLUMN content_type TEXT;
+UPDATE objects
+SET content_type = CASE
+	WHEN lower(name) LIKE '%.png' THEN 'image/png'
+	WHEN lower(name) LIKE '%.jpg' OR lower(name) LIKE '%.jpeg' THEN 'image/jpeg'
+	WHEN lower(name) LIKE '%.gif' THEN 'image/gif'
+	WHEN lower(name) LIKE '%.webp' THEN 'image/webp'
+	WHEN lower(name) LIKE '%.svg' THEN 'image/svg+xml'
+	WHEN lower(name) LIKE '%.avif' THEN 'image/avif'
+	WHEN lower(name) LIKE '%.apng' THEN 'image/apng'
+	WHEN lower(name) LIKE '%.mp4' THEN 'video/mp4'
+	WHEN lower(name) LIKE '%.webm' THEN 'video/webm'
+	WHEN lower(name) LIKE '%.ogv' OR lower(name) LIKE '%.ogg' THEN 'video/ogg'
+	WHEN lower(name) LIKE '%.mp3' THEN 'audio/mpeg'
+	WHEN lower(name) LIKE '%.wav' THEN 'audio/wav'
+	WHEN lower(name) LIKE '%.oga' THEN 'audio/ogg'
+	WHEN lower(name) LIKE '%.flac' THEN 'audio/flac'
+	WHEN lower(name) LIKE '%.aac' THEN 'audio/aac'
+	WHEN lower(name) LIKE '%.m4a' THEN 'audio/mp4'
+	ELSE 'application/octet-stream'
+END;
+ALTER TABLE objects ALTER COLUMN content_type SET NOT NULL;
+
+ALTER TABLE objects
+	ADD COLUMN storage_state object_storage_state NOT NULL DEFAULT 'available',
+	ADD COLUMN storage_state_updated_at timestamptz NOT NULL DEFAULT now();
+
+ALTER TABLE objects DROP CONSTRAINT objects_name_key;
+CREATE UNIQUE INDEX objects_active_name_key
+	ON objects (name)
+	WHERE storage_state <> 'delete_pending';
+
+CREATE TABLE object_storage_deletions (
+	storage_key TEXT PRIMARY KEY,
+	object_id BIGINT,
+	created_at timestamptz NOT NULL DEFAULT now(),
+	attempts INTEGER NOT NULL DEFAULT 0,
+	last_attempt_at timestamptz,
+	next_attempt_at timestamptz NOT NULL DEFAULT now(),
+	last_error TEXT
+);
+
+CREATE INDEX object_storage_deletions_claim_idx
+	ON object_storage_deletions (next_attempt_at, created_at);
+
+CREATE INDEX objects_pending_upload_age_idx
+	ON objects (storage_state_updated_at)
+	WHERE storage_state = 'pending_upload';
+
+CREATE INDEX objects_user_state_idx
+	ON objects (user_id, storage_state);
diff --git a/backend/migrations/V9__add_password_reset_token_created_at.sql b/backend/migrations/V9__add_password_reset_token_created_at.sql
new file mode 100644
index 0000000..2c06dde
--- /dev/null
+++ b/backend/migrations/V9__add_password_reset_token_created_at.sql
@@ -0,0 +1,4 @@
+ALTER TABLE password_reset_tokens
+	ADD COLUMN created_at timestamptz NOT NULL DEFAULT now();
+
+CREATE INDEX password_reset_tokens_user_id_idx ON password_reset_tokens (user_id);
diff --git a/backend/src/app.rs b/backend/src/app.rs
new file mode 100644
index 0000000..a4d4999
--- /dev/null
+++ b/backend/src/app.rs
@@ -0,0 +1,569 @@
+use {
+	crate::{
+		AppState,
+		CachedGraphqlResponse,
+		CallerIdentity,
+		CasbinUser,
+		Config,
+		GraphqlMutationCacheEffect,
+		GraphqlResponseCacheKey,
+		SharedState,
+		constants::{
+			GRAPHQL_BODY_LIMIT_BYTES,
+			GRAPHQL_RESPONSE_CACHE_MAX_CAPACITY_BYTES,
+			GRAPHQL_RESPONSE_CACHE_TTL_SECONDS,
+		},
+		db::queries::SELECT_USER_BY_ID_QUERY,
+		errors::AppError,
+		graphiql,
+		graphql::queries::{
+			mutation::Mutation,
+			query::Query,
+		},
+		storage::StorageClient,
+	},
+	async_graphql::{
+		BatchResponse,
+		EmptySubscription,
+		Request as GraphqlRequestInner,
+		Response as GraphqlResponseBody,
+		Schema,
+		parser::types::{
+			DocumentOperations,
+			OperationType,
+			Selection,
+		},
+	},
+	async_graphql_axum::GraphQLRequest,
+	axum::{
+		Router,
+		body::{
+			Body,
+			Bytes,
+		},
+		extract::{
+			Extension,
+			State,
+		},
+		http::{
+			HeaderMap,
+			HeaderValue,
+			Method,
+			StatusCode,
+			header,
+			request::Parts,
+		},
+		response::{
+			IntoResponse,
+			Response,
+		},
+		routing::{
+			get,
+			post,
+		},
+	},
+	axum_extra::extract::cookie::{
+		Cookie,
+		Key,
+		PrivateCookieJar,
+	},
+	casbin::Enforcer,
+	deadpool::managed::{
+		Object,
+		Pool,
+	},
+	deadpool_postgres::Manager,
+	moka::future::Cache,
+	std::{
+		sync::{
+			Arc,
+			atomic::AtomicU64,
+		},
+		time::Duration,
+	},
+	tokio::sync::RwLock,
+	tower_http::{
+		cors::{
+			AllowOrigin,
+			CorsLayer,
+		},
+		limit::RequestBodyLimitLayer,
+	},
+};
+
+type BackendState = AppState<Manager, Object<Manager>>;
+type BackendSharedState = SharedState<Manager, Object<Manager>>;
+type BackendSchema = Schema<Query, Mutation, EmptySubscription>;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct GraphqlRequestOperationDetails {
+	operation_type: OperationType,
+	mutation_root_field_count: Option<usize>,
+}
+
+pub fn build_shared_state(
+	cfg: Config,
+	pool: Pool<Manager>,
+	storage: StorageClient,
+	enforcer: Arc<RwLock<Enforcer>>,
+) -> Arc<BackendSharedState> {
+	let graphql_response_cache = Cache::builder()
+		.max_capacity(GRAPHQL_RESPONSE_CACHE_MAX_CAPACITY_BYTES)
+		.weigher(|_key, value: &CachedGraphqlResponse| value.weight())
+		.time_to_live(Duration::from_secs(GRAPHQL_RESPONSE_CACHE_TTL_SECONDS))
+		.build();
+	let key = Key::from(cfg.auth.cookie_secret.as_bytes());
+
+	Arc::new(SharedState {
+		pool,
+		storage,
+		graphql_response_cache_epoch: AtomicU64::new(0),
+		graphql_response_cache,
+		key,
+		config: cfg,
+		enforcer,
+	})
+}
+
+pub fn build_app(shared_state: Arc<BackendSharedState>) -> Router {
+	let app_state = AppState {
+		inner: shared_state.clone(),
+	};
+	let schema = build_schema(shared_state.clone());
+	let cors = cors_layer(&shared_state.config);
+	let key = shared_state.key.clone();
+
+	Router::new()
+		.route("/", get(graphiql))
+		.route(
+			"/",
+			post(graphql_handler)
+				.route_layer(RequestBodyLimitLayer::new(GRAPHQL_BODY_LIMIT_BYTES))
+				.with_state(app_state.clone()),
+		)
+		.layer(Extension(schema))
+		.layer(Extension(key))
+		.route_layer(cors)
+}
+
+fn build_schema(shared_state: Arc<BackendSharedState>) -> BackendSchema {
+	Schema::build(Query, Mutation, EmptySubscription)
+		.data(shared_state.key.clone())
+		.data(shared_state)
+		.finish()
+}
+
+fn cors_layer(config: &Config) -> CorsLayer {
+	let frontend_url = config.frontend.url.clone();
+	let cors_allowed_origins = config.cors.allowed_origins.clone();
+
+	CorsLayer::new()
+		.allow_origin(AllowOrigin::predicate(
+			move |origin: &HeaderValue, _request_parts: &Parts| {
+				let origin_bytes = origin.as_bytes();
+				origin_bytes == frontend_url.as_bytes() ||
+					origin_bytes == cors_allowed_origins.as_bytes()
+			},
+		))
+		.allow_methods([Method::GET, Method::POST])
+		.allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION])
+		.allow_credentials(true)
+}
+
+async fn authenticated_caller_identity(
+	state: &BackendState,
+	jar: &PrivateCookieJar,
+) -> Result<Option<CallerIdentity>, AppError> {
+	let Some(user_id) = jar.get("auth_token").and_then(|cookie| cookie.value().parse::<i64>().ok())
+	else {
+		return Ok(None);
+	};
+	let client = state.inner.pool.get().await?;
+	let statement = client.prepare_cached(SELECT_USER_BY_ID_QUERY).await?;
+	let Some(row) = client.query_opt(&statement, &[&user_id]).await? else {
+		return Ok(None);
+	};
+	let role = row.try_get("role")?;
+	Ok(Some(CallerIdentity {
+		user_id,
+		casbin_user: CasbinUser {
+			id: user_id,
+			role,
+		},
+	}))
+}
+
+fn graphql_request_operation_details(
+	request: &mut GraphqlRequestInner
+) -> Option<GraphqlRequestOperationDetails> {
+	let operation_name = request.operation_name.clone();
+	let document = request.parsed_query().ok()?;
+
+	let operation = match &document.operations {
+		DocumentOperations::Single(operation) => operation,
+		DocumentOperations::Multiple(operations) => {
+			let operation_name = operation_name?;
+			operations.get(operation_name.as_str())?
+		}
+	};
+	let operation_type = operation.node.ty;
+	let mutation_root_field_count = if matches!(operation_type, OperationType::Mutation) {
+		mutation_root_field_count(operation)
+	} else {
+		None
+	};
+
+	Some(GraphqlRequestOperationDetails {
+		operation_type,
+		mutation_root_field_count,
+	})
+}
+
+#[cfg(test)]
+fn graphql_request_operation_type(request: &mut GraphqlRequestInner) -> Option<OperationType> {
+	graphql_request_operation_details(request).map(|details| details.operation_type)
+}
+
+fn mutation_root_field_count(
+	operation: &async_graphql::Positioned<async_graphql::parser::types::OperationDefinition>
+) -> Option<usize> {
+	let mut field_count = 0;
+	for selection in &operation.node.selection_set.node.items {
+		match &selection.node {
+			Selection::Field(_) => {
+				field_count += 1;
+			}
+			Selection::FragmentSpread(_) | Selection::InlineFragment(_) => return None,
+		}
+	}
+	Some(field_count)
+}
+
+fn graphql_mutation_should_invalidate_cache(
+	operation_type: Option<OperationType>,
+	mutation_root_field_count: Option<usize>,
+	cache_effect: &GraphqlMutationCacheEffect,
+) -> bool {
+	if !matches!(operation_type, Some(OperationType::Mutation)) {
+		return false;
+	}
+
+	!matches!(
+		mutation_root_field_count,
+		Some(field_count)
+			if field_count > 0 && cache_effect.non_invalidating_field_count() == field_count
+	)
+}
+
+fn hash_cache_component(
+	hasher: &mut blake3::Hasher,
+	bytes: &[u8],
+) {
+	hasher.update(&(bytes.len() as u64).to_le_bytes());
+	hasher.update(bytes);
+}
+
+fn graphql_response_cache_key(
+	request: &GraphqlRequestInner,
+	user_id: Option<i64>,
+	authorization: Option<&HeaderValue>,
+	cache_epoch: u64,
+) -> Option<GraphqlResponseCacheKey> {
+	if !request.uploads.is_empty() || !request.extensions.is_empty() {
+		return None;
+	}
+
+	let mut hasher = blake3::Hasher::new();
+	hash_cache_component(&mut hasher, b"memory-map/graphql-response-cache/v1");
+	hasher.update(&cache_epoch.to_le_bytes());
+
+	match user_id {
+		Some(user_id) => {
+			hasher.update(&[1]);
+			hasher.update(&user_id.to_le_bytes());
+		}
+		None => {
+			hasher.update(&[0]);
+		}
+	};
+	if let Some(authorization) = authorization {
+		hasher.update(&[1]);
+		hash_cache_component(&mut hasher, authorization.as_bytes());
+	} else {
+		hasher.update(&[0]);
+	}
+
+	hash_cache_component(&mut hasher, request.query.as_bytes());
+	if let Some(operation_name) = &request.operation_name {
+		hasher.update(&[1]);
+		hash_cache_component(&mut hasher, operation_name.as_bytes());
+	} else {
+		hasher.update(&[0]);
+	}
+	let variables = serde_json::to_vec(&request.variables).ok()?;
+	hash_cache_component(&mut hasher, &variables);
+
+	let mut bytes = [0; 32];
+	bytes.copy_from_slice(hasher.finalize().as_bytes());
+	Some(GraphqlResponseCacheKey::new(bytes))
+}
+
+fn graphql_response_to_cache_entry(
+	response: GraphqlResponseBody
+) -> Result<CachedGraphqlResponse, serde_json::Error> {
+	let batch_response = BatchResponse::from(response);
+	let mut headers = HeaderMap::new();
+	headers.insert(
+		header::CONTENT_TYPE,
+		HeaderValue::from_static("application/graphql-response+json"),
+	);
+	if batch_response.is_ok() &&
+		let Some(cache_control) = batch_response.cache_control().value() &&
+		let Ok(value) = HeaderValue::from_str(&cache_control)
+	{
+		headers.insert(header::CACHE_CONTROL, value);
+	}
+	headers.extend(batch_response.http_headers());
+	let bytes = Bytes::from(serde_json::to_vec(&batch_response)?);
+
+	Ok(CachedGraphqlResponse {
+		status: StatusCode::OK,
+		headers,
+		bytes,
+	})
+}
+
+fn cache_entry_to_response(cached: CachedGraphqlResponse) -> Response {
+	let mut response = Response::new(Body::from(cached.bytes));
+	*response.status_mut() = cached.status;
+	*response.headers_mut() = cached.headers;
+	response
+}
+
+async fn graphql_handler(
+	State(state): State<BackendState>,
+	Extension(schema): Extension<BackendSchema>,
+	headers: HeaderMap,
+	jar: PrivateCookieJar,
+	req: GraphQLRequest,
+) -> (PrivateCookieJar, Response) {
+	let mut req = req.into_inner();
+
+	let caller_identity = match authenticated_caller_identity(&state, &jar).await {
+		Ok(caller_identity) => caller_identity,
+		Err(error) => return (jar, error.into_response()),
+	};
+	let user_id = caller_identity.as_ref().map(|identity| identity.user_id);
+	if let Some(caller_identity) = caller_identity {
+		req = req.data(caller_identity);
+	}
+
+	let operation_details = graphql_request_operation_details(&mut req);
+	let operation_type = operation_details.map(|details| details.operation_type);
+	let mutation_root_field_count =
+		operation_details.and_then(|details| details.mutation_root_field_count);
+	let cache_epoch = state.inner.graphql_response_cache_epoch();
+	let cache_key = if matches!(operation_type, Some(OperationType::Query)) {
+		graphql_response_cache_key(&req, user_id, headers.get(header::AUTHORIZATION), cache_epoch)
+	} else {
+		None
+	};
+	if let Some(cache_key) = &cache_key &&
+		let Some(cached_response) = state.inner.graphql_response_cache.get(cache_key).await
+	{
+		return (jar, cache_entry_to_response(cached_response));
+	}
+
+	// parking_lot::Mutex has no poisoning and is held only briefly around a vector
+	// push during resolver execution, so the lock acquisition is infallible.
+	let cookies = Arc::new(parking_lot::Mutex::new(Vec::<Cookie<'static>>::new()));
+	req = req.data(cookies.clone());
+	let mutation_cache_effect = Arc::new(GraphqlMutationCacheEffect::default());
+	req = req.data(mutation_cache_effect.clone());
+
+	let response = schema.execute(req).await;
+	let response_is_ok = response.is_ok();
+	let cached_response = match graphql_response_to_cache_entry(response) {
+		Ok(cached_response) => cached_response,
+		Err(error) => {
+			tracing::error!("Failed to serialize GraphQL response: {:?}", error);
+			return (jar, StatusCode::INTERNAL_SERVER_ERROR.into_response());
+		}
+	};
+
+	if graphql_mutation_should_invalidate_cache(
+		operation_type,
+		mutation_root_field_count,
+		&mutation_cache_effect,
+	) {
+		state.inner.invalidate_graphql_response_cache();
+	}
+
+	let mut jar = jar;
+	let issued_cookies = cookies.lock().clone();
+	for cookie in &issued_cookies {
+		jar = jar.add(cookie.clone());
+	}
+
+	if let Some(cache_key) = cache_key &&
+		response_is_ok &&
+		issued_cookies.is_empty() &&
+		!cached_response.headers.contains_key(header::SET_COOKIE) &&
+		state.inner.graphql_response_cache_epoch() == cache_epoch
+	{
+		state.inner.graphql_response_cache.insert(cache_key, cached_response.clone()).await;
+	}
+
+	(jar, cache_entry_to_response(cached_response))
+}
+
+#[cfg(test)]
+mod tests {
+	use {
+		super::*,
+		async_graphql::{
+			Value,
+			Variables,
+		},
+		serde_json::json,
+	};
+
+	fn request_with_variable(id: i64) -> GraphqlRequestInner {
+		GraphqlRequestInner::new("query Object($id: Int!) { s3ObjectById(id: $id) { id } }")
+			.variables(Variables::from_json(json!({ "id": id })))
+	}
+
+	fn cache_key(
+		request: &GraphqlRequestInner,
+		user_id: Option<i64>,
+		cache_epoch: u64,
+	) -> anyhow::Result<GraphqlResponseCacheKey> {
+		graphql_response_cache_key(request, user_id, None, cache_epoch)
+			.ok_or_else(|| anyhow::anyhow!("request should be cacheable"))
+	}
+
+	#[test]
+	fn graphql_operation_type_uses_selected_named_operation() {
+		let mut query = GraphqlRequestInner::new(
+			"query Read { config { enableRegistration } } mutation Write { logout }",
+		)
+		.operation_name("Read");
+		assert_eq!(graphql_request_operation_type(&mut query), Some(OperationType::Query));
+
+		let mut mutation = GraphqlRequestInner::new(
+			"query Read { config { enableRegistration } } mutation Write { logout }",
+		)
+		.operation_name("Write");
+		assert_eq!(graphql_request_operation_type(&mut mutation), Some(OperationType::Mutation));
+	}
+
+	#[test]
+	fn graphql_operation_type_skips_ambiguous_multi_operation_documents() {
+		let mut request = GraphqlRequestInner::new(
+			"query Read { config { enableRegistration } } mutation Write { logout }",
+		);
+		assert_eq!(graphql_request_operation_type(&mut request), None);
+	}
+
+	#[test]
+	fn graphql_operation_details_count_mutation_root_fields() {
+		let mut request = GraphqlRequestInner::new("mutation { a: logout b: logout }");
+
+		assert_eq!(
+			graphql_request_operation_details(&mut request),
+			Some(GraphqlRequestOperationDetails {
+				operation_type: OperationType::Mutation,
+				mutation_root_field_count: Some(2),
+			})
+		);
+	}
+
+	#[test]
+	fn graphql_operation_details_treat_fragment_root_mutation_selection_as_uncountable() {
+		let mut request = GraphqlRequestInner::new(
+			"mutation { ...WriteFields } fragment WriteFields on Mutation { logout }",
+		);
+
+		assert_eq!(
+			graphql_request_operation_details(&mut request),
+			Some(GraphqlRequestOperationDetails {
+				operation_type: OperationType::Mutation,
+				mutation_root_field_count: None,
+			})
+		);
+	}
+
+	#[test]
+	fn graphql_mutation_cache_effect_only_suppresses_when_all_root_fields_marked() {
+		let cache_effect = GraphqlMutationCacheEffect::default();
+		assert!(!graphql_mutation_should_invalidate_cache(
+			Some(OperationType::Query),
+			None,
+			&cache_effect,
+		));
+		assert!(graphql_mutation_should_invalidate_cache(
+			Some(OperationType::Mutation),
+			Some(2),
+			&cache_effect,
+		));
+
+		cache_effect.mark_non_invalidating_field();
+		assert!(graphql_mutation_should_invalidate_cache(
+			Some(OperationType::Mutation),
+			Some(2),
+			&cache_effect,
+		));
+
+		cache_effect.mark_non_invalidating_field();
+		assert!(!graphql_mutation_should_invalidate_cache(
+			Some(OperationType::Mutation),
+			Some(2),
+			&cache_effect,
+		));
+		assert!(graphql_mutation_should_invalidate_cache(
+			Some(OperationType::Mutation),
+			None,
+			&cache_effect,
+		));
+	}
+
+	#[test]
+	fn graphql_response_cache_key_scopes_by_actor_variables_and_epoch() -> anyhow::Result<()> {
+		let key = cache_key(&request_with_variable(1), Some(10), 0)?;
+		assert_eq!(cache_key(&request_with_variable(1), Some(10), 0)?, key);
+		assert_ne!(cache_key(&request_with_variable(1), Some(11), 0)?, key);
+		assert_ne!(cache_key(&request_with_variable(2), Some(10), 0)?, key);
+		assert_ne!(cache_key(&request_with_variable(1), Some(10), 1)?, key);
+		Ok(())
+	}
+
+	#[test]
+	fn graphql_response_cache_key_skips_requests_with_extensions() {
+		let mut request = request_with_variable(1);
+		request.extensions.insert("cacheBypass".to_string(), Value::Boolean(true));
+		assert!(graphql_response_cache_key(&request, Some(10), None, 0).is_none());
+	}
+
+	#[test]
+	fn graphql_response_cache_key_scopes_by_authorization_header() -> anyhow::Result<()> {
+		let request = request_with_variable(1);
+		let bearer_a = HeaderValue::from_static("Bearer a");
+		let bearer_b = HeaderValue::from_static("Bearer b");
+
+		let key = graphql_response_cache_key(&request, Some(10), Some(&bearer_a), 0)
+			.ok_or_else(|| anyhow::anyhow!("request should be cacheable"))?;
+
+		assert_eq!(
+			graphql_response_cache_key(&request, Some(10), Some(&bearer_a), 0)
+				.ok_or_else(|| anyhow::anyhow!("request should be cacheable"))?,
+			key
+		);
+		assert_ne!(
+			graphql_response_cache_key(&request, Some(10), Some(&bearer_b), 0)
+				.ok_or_else(|| anyhow::anyhow!("request should be cacheable"))?,
+			key
+		);
+		assert_ne!(cache_key(&request, Some(10), 0)?, key);
+		Ok(())
+	}
+}
diff --git a/backend/src/bin/memory-map-storage-bootstrap.rs b/backend/src/bin/memory-map-storage-bootstrap.rs
new file mode 100644
index 0000000..8769d7e
--- /dev/null
+++ b/backend/src/bin/memory-map-storage-bootstrap.rs
@@ -0,0 +1,125 @@
+use {
+	anyhow::Context,
+	backend::{
+		CorsConfig,
+		FrontendConfig,
+		storage::{
+			StorageClient,
+			StorageConfig,
+		},
+	},
+	serde::Deserialize,
+	std::collections::BTreeSet,
+};
+
+const STORAGE_READY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+	let config =
+		StorageBootstrapConfig::from_env().context("Failed to read storage bootstrap config")?;
+	let storage = StorageClient::from_storage_config(&config.storage)
+		.context("Failed to build storage client")?;
+	storage
+		.wait_until_ready(STORAGE_READY_TIMEOUT)
+		.await
+		.context("Failed to wait for S3-compatible storage readiness")?;
+	storage.ensure_bucket_exists().await.context("Failed to ensure S3 bucket exists")?;
+	let cors_allowed_origins = config.upload_cors_allowed_origins();
+	if !cors_allowed_origins.is_empty() {
+		storage
+			.configure_upload_cors(&cors_allowed_origins)
+			.await
+			.context("Failed to configure bucket CORS for browser uploads")?;
+	}
+	Ok(())
+}
+
+#[derive(Deserialize)]
+struct StorageBootstrapConfig {
+	storage: StorageConfig,
+	#[serde(default)]
+	frontend: Option<FrontendConfig>,
+	#[serde(default)]
+	cors: Option<CorsConfig>,
+}
+
+impl StorageBootstrapConfig {
+	fn from_env() -> anyhow::Result<Self> {
+		let raw = config::Config::builder()
+			.add_source(
+				config::Environment::with_prefix("MEMORY_MAP")
+					.prefix_separator("__")
+					.separator("__"),
+			)
+			.build()
+			.context("Failed to read config from environment")?;
+		let config: StorageBootstrapConfig = raw
+			.try_deserialize()
+			.context("Failed to deserialize storage bootstrap config from environment")?;
+		config.storage.validate()?;
+		Ok(config)
+	}
+
+	fn upload_cors_allowed_origins(&self) -> Vec<String> {
+		let mut origins = BTreeSet::new();
+		if let Some(frontend) = &self.frontend {
+			insert_origin(&mut origins, &frontend.url);
+		}
+		if let Some(cors) = &self.cors {
+			for origin in cors.allowed_origins.split(',') {
+				insert_origin(&mut origins, origin);
+			}
+		}
+		origins.into_iter().collect()
+	}
+}
+
+fn insert_origin(
+	origins: &mut BTreeSet<String>,
+	origin: &str,
+) {
+	let origin = origin.trim();
+	if !origin.is_empty() {
+		origins.insert(origin.to_string());
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use {
+		super::StorageBootstrapConfig,
+		backend::{
+			CorsConfig,
+			FrontendConfig,
+			storage::StorageConfig,
+		},
+	};
+
+	#[test]
+	fn upload_cors_allowed_origins_combines_frontend_and_cors_config() {
+		let config = StorageBootstrapConfig {
+			storage: StorageConfig {
+				endpoint_url: "http://127.0.0.1:9000".to_string(),
+				public_endpoint_url: None,
+				access_key: "access".to_string(),
+				secret_key: "secret".to_string(),
+				bucket_name: "memory-map".to_string(),
+				region: "us-east-1".to_string(),
+				force_path_style: true,
+				presigned_url_ttl_seconds: 60,
+			},
+			frontend: Some(FrontendConfig {
+				url: "http://127.0.0.1:3000".to_string(),
+			}),
+			cors: Some(CorsConfig {
+				allowed_origins: "http://127.0.0.1:3000, http://localhost:3000".to_string(),
+			}),
+		};
+
+		assert_eq!(
+			config.upload_cors_allowed_origins(),
+			vec!["http://127.0.0.1:3000".to_string(), "http://localhost:3000".to_string(),]
+		);
+	}
+}
diff --git a/backend/src/constants.rs b/backend/src/constants.rs
index 070422a..46fc1b8 100644
--- a/backend/src/constants.rs
+++ b/backend/src/constants.rs
@@ -1,37 +1,14 @@
-// Amount of bytes to cache.
-pub const CACHE_MAX_CAPACITY: u64 = 10_000;
-// Cache time-to-live duration in seconds. Currently 10 minutes.
-pub const CACHE_TTL_SECONDS: u64 = 600;
-// Max body size for GraphQL queries (1MB).
+// Total bytes the GraphQL response cache may hold across all entries, enforced
+// through a per-entry weigher. Keeps memory predictable independent of how many
+// distinct query/user pairs are cached.
+pub const GRAPHQL_RESPONSE_CACHE_MAX_CAPACITY_BYTES: u64 = 64 * 1024 * 1024;
+// Cache time-to-live duration in seconds. A short TTL is a backstop for changes
+// made outside this process; in-process writes invalidate the cache explicitly.
+pub const GRAPHQL_RESPONSE_CACHE_TTL_SECONDS: u64 = 600;
+// Max body size for GraphQL requests (1MB).
 pub const GRAPHQL_BODY_LIMIT_BYTES: usize = 1024 * 1024;
 
-// 1GB.
-pub const BODY_MAX_SIZE_LIMIT_BYTES: usize = 1_073_741_824;
-
-// Errors
-pub const ERR_INTERNAL_SERVER: &str = "Internal server error";
-pub const ERR_UNAUTHORIZED: &str = "Unauthorized";
-pub const ERR_FORBIDDEN: &str = "Forbidden";
-pub const ERR_NOT_FOUND: &str = "Not found: ";
-pub const ERR_VALIDATION: &str = "Validation error: ";
-pub const ERR_MULTIPART_MISSING_NAME: &str = "Multipart field missing name";
-pub const ERR_MULTIPART_MISSING_FILENAME: &str = "Multipart field missing filename";
-pub const ERR_MULTIPART_MISSING_CONTENT_TYPE: &str = "Multipart field missing content type";
-pub const ERR_UNSUPPORTED_FILE_TYPE: &str = "Unsupported file type: ";
-pub const ERR_FAILED_READ_BYTES: &str = "Failed to read bytes: ";
-pub const ERR_UPLOAD_MINIO: &str = "Failed to upload file to MinIO";
-pub const ERR_DB_CLIENT: &str = "Failed to get database client from pool";
-pub const ERR_HASHING: &str = "Hashing error: ";
-pub const ERR_EMAIL: &str = "Email error: ";
-pub const ERR_EMAIL_ADDRESS: &str = "Email address error: ";
-pub const ERR_SMTP: &str = "SMTP error: ";
-pub const ERR_INVALID_NUMBER: &str = "Invalid number format: ";
-pub const ERR_CREATE_POOL: &str = "Failed to create pool: ";
-pub const ERR_POOL: &str = "Pool error: ";
-pub const ERR_DB: &str = "Database error: ";
-pub const ERR_MULTIPART: &str = "Multipart error: ";
-pub const ERR_CASBIN: &str = "Casbin error: ";
-pub const ERR_CONFIG: &str = "Config error: ";
-pub const ERR_MIGRATION: &str = "Migration error: ";
-pub const ERR_SYSTEM_TIME: &str = "System time error: ";
-pub const ERR_IO: &str = "IO error: ";
+// Minimum seconds between password reset token issuances per user.
+// Prevents bursts of password-reset emails to a single account, without
+// causing user enumeration: throttled requests still return success.
+pub const PASSWORD_RESET_RATE_LIMIT_SECONDS: i64 = 60;
diff --git a/backend/src/controllers.rs b/backend/src/controllers.rs
deleted file mode 100644
index e5fdf85..0000000
--- a/backend/src/controllers.rs
+++ /dev/null
@@ -1 +0,0 @@
-pub mod api;
diff --git a/backend/src/controllers/api.rs b/backend/src/controllers/api.rs
deleted file mode 100644
index 8b41094..0000000
--- a/backend/src/controllers/api.rs
+++ /dev/null
@@ -1 +0,0 @@
-pub mod locations;
diff --git a/backend/src/controllers/api/locations.rs b/backend/src/controllers/api/locations.rs
deleted file mode 100644
index 6438064..0000000
--- a/backend/src/controllers/api/locations.rs
+++ /dev/null
@@ -1,185 +0,0 @@
-use {
-	crate::{
-		AppState,
-		constants::{
-			ERR_DB_CLIENT,
-			ERR_FAILED_READ_BYTES,
-			ERR_MULTIPART_MISSING_CONTENT_TYPE,
-			ERR_MULTIPART_MISSING_FILENAME,
-			ERR_MULTIPART_MISSING_NAME,
-			ERR_UNSUPPORTED_FILE_TYPE,
-			ERR_UPLOAD_MINIO,
-		},
-		errors::AppError,
-		graphql::{
-			objects::{
-				location::Location,
-				s3_object::PublicityOverride,
-			},
-			queries::mutation::Mutation,
-		},
-	},
-	anyhow::Context,
-	axum::{
-		Json,
-		body::Bytes,
-		extract::{
-			Multipart,
-			State,
-		},
-		response::IntoResponse,
-	},
-	axum_extra::extract::cookie::PrivateCookieJar,
-	axum_macros::debug_handler,
-	deadpool::managed::Object,
-	deadpool_postgres::Manager,
-	shared::ALLOWED_MIME_TYPES,
-};
-
-#[derive(Debug)]
-struct FileData {
-	filename: String,
-	content_type: String,
-	bytes: Bytes,
-}
-
-#[debug_handler]
-pub async fn post(
-	State(state): State<AppState<Manager, Object<Manager>>>,
-	jar: PrivateCookieJar,
-	mut multipart: Multipart,
-) -> Result<impl IntoResponse, AppError> {
-	let user_id = if let Some(cookie) = jar.get("auth_token") &&
-		let Ok(id) = cookie.value().parse::<i64>()
-	{
-		id
-	} else {
-		return Err(AppError::Unauthorized);
-	};
-
-	let mut latitude: Option<f64> = None;
-	let mut longitude: Option<f64> = None;
-	let mut made_on: Option<String> = None;
-	let mut files: Vec<FileData> = Vec::new();
-
-	while let Some(field) = multipart.next_field().await? {
-		let name = field
-			.name()
-			.ok_or_else(|| AppError::Validation(ERR_MULTIPART_MISSING_NAME.to_string()))?
-			.to_string();
-
-		match name.as_str() {
-			"latitude" => {
-				if let Ok(txt) = field.text().await &&
-					let Ok(val) = txt.parse::<f64>()
-				{
-					latitude = Some(val);
-				}
-			}
-			"longitude" => {
-				if let Ok(txt) = field.text().await &&
-					let Ok(val) = txt.parse::<f64>()
-				{
-					longitude = Some(val);
-				}
-			}
-			"made_on" => {
-				if let Ok(txt) = field.text().await &&
-					!txt.is_empty()
-				{
-					// Store the ISO 8601 UTC timestamp string
-					made_on = Some(txt);
-				}
-			}
-			"files" => {
-				let filename = field
-					.file_name()
-					.ok_or_else(|| {
-						AppError::Validation(ERR_MULTIPART_MISSING_FILENAME.to_string())
-					})?
-					.to_string();
-				let content_type = field
-					.content_type()
-					.ok_or_else(|| {
-						AppError::Validation(ERR_MULTIPART_MISSING_CONTENT_TYPE.to_string())
-					})?
-					.to_string();
-
-				if !ALLOWED_MIME_TYPES.contains(&content_type.as_str()) {
-					return Err(AppError::Validation(format!(
-						"{}{}",
-						ERR_UNSUPPORTED_FILE_TYPE, content_type
-					)));
-				}
-
-				let bytes = field
-					.bytes()
-					.await
-					.map_err(|e| AppError::Validation(format!("{}{}", ERR_FAILED_READ_BYTES, e)))?;
-				files.push(FileData {
-					filename,
-					content_type,
-					bytes,
-				});
-			}
-			_ => {}
-		}
-	}
-
-	tracing::debug!("Received Location:");
-	tracing::debug!("Latitude: {:?}", latitude);
-	tracing::debug!("Longitude: {:?}", longitude);
-	tracing::debug!("Files: {} uploaded", files.len());
-
-	let mut uploaded_objects = Vec::new();
-
-	for file in files {
-		tracing::debug!(
-			" - Name: {}, Type: {}, Size: {} bytes",
-			file.filename,
-			file.content_type,
-			file.bytes.len()
-		);
-
-		state
-			.inner
-			.minio_client
-			.put_object_content(&state.inner.bucket_name, &file.filename, file.bytes)
-			.content_type(file.content_type)
-			.send()
-			.await
-			.context(ERR_UPLOAD_MINIO)?;
-
-		let client = state.inner.pool.get().await.context(ERR_DB_CLIENT)?;
-		let location = if let (Some(latitude), Some(longitude)) = (latitude, longitude) {
-			Some(Location {
-				latitude,
-				longitude,
-			})
-		} else {
-			None
-		};
-
-		match Mutation::upsert_s3_object_worker(
-			&client,
-			file.filename,
-			made_on.clone(),
-			location,
-			user_id,
-			PublicityOverride::Default,
-			vec![],
-		)
-		.await
-		{
-			Ok(s3_object) => uploaded_objects.push(s3_object),
-			Err(e) => {
-				tracing::error!("Failed to upsert object: {:?}", e);
-				return Err(e);
-			}
-		}
-
-		state.inner.update_last_modified();
-	}
-
-	Ok(Json(uploaded_objects).into_response())
-}
diff --git a/backend/src/db/queries.rs b/backend/src/db/queries.rs
index 9bc2763..b50759e 100644
--- a/backend/src/db/queries.rs
+++ b/backend/src/db/queries.rs
@@ -1,75 +1,263 @@
-pub const DELETE_OBJECTS_QUERY: &str = "DELETE FROM objects WHERE id = ANY($1) RETURNING id, name, made_on, ST_Y(location::geometry) AS latitude, ST_X(location::geometry) AS longitude, user_id, publicity;";
+/// The `S3Object` column projection shared by the mutation queries that RETURN an
+/// object in a transitional state (and so cannot use the
+/// `available_objects_with_users` view). Single-sourced because every column must
+/// match `S3Object::try_from`'s by-name reads (especially the `latitude`/
+/// `longitude` aliases); a drifted copy would silently break decoding. Expands to
+/// a string literal so it composes into the query consts via `concat!`.
+macro_rules! object_returning_columns {
+	() => {
+		"id, name, storage_key, content_type, made_on, ST_Y(location::geometry) AS latitude, ST_X(location::geometry) AS longitude, user_id, publicity"
+	};
+}
+
+/// The `ObjectUploadSession` column projection, single-sourced because four
+/// queries (insert RETURNING, the two per-user SELECTs, and the expired-session
+/// claim RETURNING) must all match `ObjectUploadSession::try_from`'s by-name
+/// reads. Only the seven columns that `try_from` decodes are listed; the
+/// `cleanup_*`/`created_at` bookkeeping columns are read in WHERE/SET clauses but
+/// never projected into the struct. `$prefix` disambiguates `storage_key` (and
+/// the rest) in the JOIN queries, where the session table is aliased `session.`;
+/// the insert RETURNING passes an empty prefix. Expands to a string literal so it
+/// composes into the query consts via `concat!`.
+macro_rules! upload_session_columns {
+	($prefix:literal) => {
+		concat!(
+			$prefix,
+			"object_id, ",
+			$prefix,
+			"storage_key, ",
+			$prefix,
+			"upload_id, ",
+			$prefix,
+			"content_type, ",
+			$prefix,
+			"file_size, ",
+			$prefix,
+			"part_size_bytes, ",
+			$prefix,
+			"expires_at"
+		)
+	};
+}
+
+pub const MARK_OBJECTS_DELETE_PENDING_QUERY: &str = concat!(
+	"UPDATE objects
+SET storage_state = 'delete_pending', storage_state_updated_at = now()
+WHERE id = ANY($1) AND storage_state = 'available'
+RETURNING ",
+	object_returning_columns!(),
+	";"
+);
+
+pub const INSERT_OBJECT_QUERY: &str = concat!(
+	"INSERT INTO objects (name, storage_key, content_type, storage_state, made_on, location, user_id, publicity)
+VALUES ($1, $2, $3, 'pending_upload', $4::timestamptz, ST_GeomFromEWKT($5), $6, $7)
+RETURNING ",
+	object_returning_columns!(),
+	";"
+);
+
+pub const INSERT_OBJECT_UPLOAD_SESSION_QUERY: &str = concat!(
+	"INSERT INTO object_upload_sessions (
+	object_id,
+	storage_key,
+	upload_id,
+	content_type,
+	file_size,
+	part_size_bytes,
+	expires_at,
+	cleanup_next_attempt_at
+)
+VALUES ($1, $2, $3, $4, $5, $6, now() + ($7::BIGINT * interval '1 second'), now() + ($7::BIGINT * interval '1 second'))
+RETURNING ",
+	upload_session_columns!("")
+);
+
+pub const SELECT_ACTIVE_OBJECT_UPLOAD_SESSION_FOR_USER_QUERY: &str = concat!(
+	"SELECT ",
+	upload_session_columns!("session."),
+	"
+FROM object_upload_sessions session
+JOIN objects object ON object.id = session.object_id
+WHERE session.object_id = $1
+	AND object.user_id = $2
+	AND object.storage_state = 'pending_upload'
+	AND session.expires_at > now()"
+);
+
+pub const SELECT_OBJECT_UPLOAD_SESSION_FOR_USER_QUERY: &str = concat!(
+	"SELECT ",
+	upload_session_columns!("session."),
+	"
+FROM object_upload_sessions session
+JOIN objects object ON object.id = session.object_id
+WHERE session.object_id = $1
+	AND object.user_id = $2
+	AND object.storage_state = 'pending_upload'"
+);
+
+/// Claims up to `$1` expired upload sessions whose retry/lease time has arrived
+/// and which still have retry budget left. Rows past `$3::INTEGER` attempts are
+/// parked with their last error for operator triage.
+pub const CLAIM_EXPIRED_OBJECT_UPLOAD_SESSIONS_QUERY: &str = concat!(
+	"WITH claimed AS MATERIALIZED (
+	SELECT session.object_id
+	FROM object_upload_sessions session
+	JOIN objects object ON object.id = session.object_id
+	WHERE session.expires_at <= now()
+		AND session.cleanup_next_attempt_at <= now()
+		AND session.cleanup_attempts < $3::INTEGER
+		AND object.storage_state = 'pending_upload'
+	ORDER BY session.expires_at, session.cleanup_next_attempt_at, session.created_at
+	LIMIT $1
+	FOR UPDATE OF session SKIP LOCKED
+)
+UPDATE object_upload_sessions session
+SET cleanup_attempts = cleanup_attempts + 1,
+	cleanup_last_attempt_at = now(),
+	cleanup_next_attempt_at = now() + ($2::BIGINT * interval '1 second'),
+	cleanup_last_error = NULL
+FROM claimed
+WHERE session.object_id = claimed.object_id
+RETURNING ",
+	upload_session_columns!("session.")
+);
+
+pub const DELETE_OBJECT_UPLOAD_SESSION_QUERY: &str =
+	"DELETE FROM object_upload_sessions WHERE object_id = $1";
+
+pub const FINALIZE_OBJECT_UPLOAD_QUERY: &str = "WITH finalized AS (
+	UPDATE objects
+	SET storage_state = 'available', storage_state_updated_at = now()
+	WHERE id = $1 AND storage_key = $2 AND storage_state = 'pending_upload'
+	RETURNING id, name, storage_key, content_type, made_on, location, user_id, publicity
+)
+SELECT
+	finalized.id,
+	finalized.name,
+	finalized.storage_key,
+	finalized.content_type,
+	finalized.made_on,
+	ST_Y(finalized.location::geometry) AS latitude,
+	ST_X(finalized.location::geometry) AS longitude,
+	finalized.user_id,
+	finalized.publicity,
+	COALESCE((
+		SELECT array_agg(users.email)
+		FROM object_allowed_users allowed
+		JOIN users ON allowed.user_id = users.id
+		WHERE allowed.object_id = finalized.id
+	), '{}') AS allowed_users
+FROM finalized;";
+
+pub const SELECT_AVAILABLE_OBJECT_FOR_USER_QUERY: &str =
+	"SELECT * FROM available_objects_with_users WHERE id = $1 AND user_id = $2;";
+
+pub const DELETE_PENDING_OBJECT_UPLOAD_QUERY: &str = "DELETE FROM objects
+WHERE id = $1
+	AND storage_key = $2
+	AND user_id = $3
+	AND storage_state = 'pending_upload'";
+
+pub const DELETE_PENDING_OBJECT_UPLOAD_BY_SESSION_QUERY: &str = "DELETE FROM objects
+WHERE id = $1
+	AND storage_key = $2
+	AND storage_state = 'pending_upload'";
+
+pub const MARK_OBJECT_UPLOAD_SESSION_CLEANUP_FAILED_QUERY: &str = "UPDATE object_upload_sessions
+SET cleanup_next_attempt_at = now() + ($3::BIGINT * interval '1 second'),
+	cleanup_last_error = $2
+WHERE object_id = $1";
+
+/// Counts upload-session cleanups that have exhausted their retry budget
+/// (`cleanup_attempts >= $1`) and so will never be reclaimed by the cleanup
+/// claim. Used to surface a parked backlog to operators.
+pub const COUNT_PARKED_OBJECT_UPLOAD_SESSIONS_QUERY: &str =
+	"SELECT COUNT(*) FROM object_upload_sessions WHERE cleanup_attempts >= $1::INTEGER";
+
+pub const MARK_UPLOAD_DELETE_PENDING_QUERY: &str = concat!(
+	"UPDATE objects
+SET storage_state = 'delete_pending', storage_state_updated_at = now()
+WHERE id = $1 AND storage_key = $2 AND storage_state IN ('pending_upload', 'available')
+RETURNING ",
+	object_returning_columns!(),
+	";"
+);
+
+pub const MARK_STALE_UPLOADS_DELETE_PENDING_QUERY: &str = concat!(
+	"UPDATE objects
+SET storage_state = 'delete_pending', storage_state_updated_at = now()
+WHERE storage_state = 'pending_upload'
+	AND storage_state_updated_at < now() - ($1::BIGINT * interval '1 second')
+	AND NOT EXISTS (
+		SELECT 1 FROM object_upload_sessions session
+		WHERE session.object_id = objects.id
+	)
+RETURNING ",
+	object_returning_columns!(),
+	";"
+);
 
 /// Query to update an existing object in the database.
 /// It updates the name, made_on timestamp, and location based on the provided ID.
-pub const UPDATE_OBJECT_QUERY: &str = "UPDATE objects
+pub const UPDATE_OBJECT_QUERY: &str = concat!(
+	"UPDATE objects
 SET name = $2, made_on = $3::timestamptz, location = ST_GeomFromEWKT($4), publicity = $5
-WHERE id = $1
-RETURNING id, name, made_on, ST_Y(location::geometry) AS latitude, ST_X(location::geometry) AS longitude, user_id, publicity;";
-
-pub const UPSERT_OBJECT_QUERY: &str = "INSERT INTO objects (name, made_on, location, user_id, publicity)
-VALUES ($1, $2::timestamptz, ST_GeomFromEWKT($3), $4, $5)
-ON CONFLICT (name) DO UPDATE
-SET made_on = EXCLUDED.made_on, location = EXCLUDED.location, publicity = EXCLUDED.publicity
-RETURNING id, name, made_on, ST_Y(location::geometry) AS latitude, ST_X(location::geometry) AS longitude, user_id, publicity;";
-
-pub const SELECT_ALL_OBJECTS_QUERY: &str = "SELECT o.id, o.name, o.made_on, ST_Y(o.location::geometry) AS latitude, ST_X(o.location::geometry) AS longitude, o.user_id, o.publicity,
-COALESCE(array_agg(u.email) FILTER (WHERE u.email IS NOT NULL), '{}') AS allowed_users
-FROM objects o
-LEFT JOIN object_allowed_users oau ON o.id = oau.object_id
-LEFT JOIN users u ON oau.user_id = u.id
-GROUP BY o.id;";
-
-pub const SELECT_OBJECT_BY_ID_QUERY: &str = "SELECT o.id, o.name, o.made_on, ST_Y(o.location::geometry) AS latitude, ST_X(o.location::geometry) AS longitude, o.user_id, o.publicity,
-COALESCE(array_agg(u.email) FILTER (WHERE u.email IS NOT NULL), '{}') AS allowed_users
-FROM objects o
-LEFT JOIN object_allowed_users oau ON o.id = oau.object_id
-LEFT JOIN users u ON oau.user_id = u.id
-WHERE o.id = $1
-GROUP BY o.id;";
-
-pub const SELECT_OBJECT_BY_NAME_QUERY: &str = "SELECT o.id, o.name, o.made_on, ST_Y(o.location::geometry) AS latitude, ST_X(o.location::geometry) AS longitude, o.user_id, o.publicity,
-COALESCE(array_agg(u.email) FILTER (WHERE u.email IS NOT NULL), '{}') AS allowed_users
-FROM objects o
-LEFT JOIN object_allowed_users oau ON o.id = oau.object_id
-LEFT JOIN users u ON oau.user_id = u.id
-WHERE o.name = $1
-GROUP BY o.id;";
-
-pub const SELECT_OBJECTS_BY_IDS_QUERY: &str = "SELECT o.id, o.name, o.made_on, ST_Y(o.location::geometry) AS latitude, ST_X(o.location::geometry) AS longitude, o.user_id, o.publicity,
-COALESCE(array_agg(u.email) FILTER (WHERE u.email IS NOT NULL), '{}') AS allowed_users
-FROM objects o
-LEFT JOIN object_allowed_users oau ON o.id = oau.object_id
-LEFT JOIN users u ON oau.user_id = u.id
-WHERE o.id = ANY($1)
-GROUP BY o.id;";
-
-pub const SELECT_OBJECTS_BY_USER_ID_QUERY: &str = "SELECT o.id, o.name, o.made_on, ST_Y(o.location::geometry) AS latitude, ST_X(o.location::geometry) AS longitude, o.user_id, o.publicity,
-COALESCE(array_agg(u.email) FILTER (WHERE u.email IS NOT NULL), '{}') AS allowed_users
-FROM objects o
-LEFT JOIN object_allowed_users oau ON o.id = oau.object_id
-LEFT JOIN users u ON oau.user_id = u.id
-WHERE o.user_id = $1
-GROUP BY o.id;";
-
-pub const SELECT_VISIBLE_OBJECTS_QUERY: &str = "SELECT o.id, o.name, o.made_on, ST_Y(o.location::geometry) AS latitude, ST_X(o.location::geometry) AS longitude, o.user_id, o.publicity,
-COALESCE(array_agg(u_allowed.email) FILTER (WHERE u_allowed.email IS NOT NULL), '{}') AS allowed_users
-FROM objects o
-JOIN users u ON o.user_id = u.id
-LEFT JOIN object_allowed_users oau ON o.id = oau.object_id
-LEFT JOIN users u_allowed ON oau.user_id = u_allowed.id
+WHERE id = $1 AND storage_state = 'available'
+RETURNING ",
+	object_returning_columns!(),
+	";"
+);
+
+pub const SELECT_ALL_OBJECTS_QUERY: &str = "SELECT * FROM available_objects_with_users;";
+
+pub const SELECT_OBJECT_BY_ID_QUERY: &str =
+	"SELECT * FROM available_objects_with_users WHERE id = $1;";
+
+pub const SELECT_OBJECT_BY_NAME_QUERY: &str =
+	"SELECT * FROM available_objects_with_users WHERE name = $1;";
+
+pub const SELECT_OBJECTS_BY_IDS_QUERY: &str =
+	"SELECT * FROM available_objects_with_users WHERE id = ANY($1);";
+
+pub const SELECT_OBJECTS_BY_USER_ID_QUERY: &str =
+	"SELECT * FROM available_objects_with_users WHERE user_id = $1;";
+
+pub const SELECT_VISIBLE_OBJECTS_QUERY: &str = "SELECT v.*
+FROM available_objects_with_users v
+JOIN users owner ON owner.id = v.user_id
 WHERE
-	($1::BIGINT IS NOT NULL AND o.user_id = $1)
-	OR o.publicity = 'public'
-	OR (o.publicity = 'default' AND u.default_publicity = 'public')
-	OR (o.publicity = 'selected_users' AND $1::BIGINT IS NOT NULL AND $1 IN (SELECT user_id FROM object_allowed_users WHERE object_id = o.id))
-GROUP BY o.id;";
+	($1::BIGINT IS NOT NULL AND v.user_id = $1)
+	OR v.publicity = 'public'
+	OR (v.publicity = 'default' AND owner.default_publicity = 'public')
+	OR (
+		v.publicity = 'selected_users'
+		AND $1::BIGINT IS NOT NULL
+		AND EXISTS (
+			SELECT 1
+			FROM object_allowed_users allowed
+			WHERE allowed.object_id = v.id
+				AND allowed.user_id = $1
+		)
+	);";
 
 pub const DELETE_OBJECT_ALLOWED_USERS_QUERY: &str =
 	"DELETE FROM object_allowed_users WHERE object_id = $1";
 
-pub const INSERT_OBJECT_ALLOWED_USER_QUERY: &str =
-	"INSERT INTO object_allowed_users (object_id, user_id) VALUES ($1, $2)";
+pub const REPLACE_OBJECT_ALLOWED_USERS_QUERY: &str = "WITH valid AS (
+	SELECT id, email
+	FROM users
+	WHERE email = ANY($2)
+),
+inserted AS (
+	INSERT INTO object_allowed_users (object_id, user_id)
+	SELECT $1, id
+	FROM valid
+	RETURNING user_id
+)
+SELECT valid.email
+FROM valid
+JOIN inserted ON inserted.user_id = valid.id";
 
 pub const SELECT_ALL_USERS_QUERY: &str =
 	"SELECT id, email, role, created_at, updated_at, default_publicity FROM users";
@@ -80,9 +268,52 @@ pub const SELECT_USER_BY_ID_QUERY: &str =
 pub const SELECT_USER_BY_EMAIL_QUERY: &str =
 	"SELECT id, email, role, created_at, updated_at, default_publicity FROM users WHERE email = $1";
 
-pub const SELECT_USER_EXISTS_QUERY: &str = "SELECT 1 FROM users WHERE id = $1";
+pub const SELECT_USER_ID_BY_EMAIL_FOR_UPDATE_QUERY: &str =
+	"SELECT id FROM users WHERE email = $1 FOR UPDATE";
+
+pub const INSERT_OBJECT_STORAGE_DELETIONS_QUERY: &str =
+	"INSERT INTO object_storage_deletions (storage_key, object_id)
+SELECT UNNEST($1::TEXT[]), UNNEST($2::BIGINT[])
+ON CONFLICT (storage_key) DO NOTHING";
+
+/// Claims up to `$1` deletion rows whose scheduled retry/lease time has arrived
+/// and which still have retry budget left. Rows past `$3::INTEGER` attempts are parked: they remain
+/// in the table with `last_error` populated for operator triage, but are never
+/// reclaimed by the worker.
+pub const CLAIM_OBJECT_STORAGE_DELETIONS_QUERY: &str = "WITH claimed AS MATERIALIZED (
+	SELECT storage_key
+	FROM object_storage_deletions
+	WHERE attempts < $3::INTEGER
+		AND next_attempt_at <= now()
+	ORDER BY next_attempt_at, created_at
+	LIMIT $1
+	FOR UPDATE SKIP LOCKED
+)
+UPDATE object_storage_deletions deletion
+SET attempts = attempts + 1,
+	last_attempt_at = now(),
+	next_attempt_at = now() + ($2::BIGINT * interval '1 second'),
+	last_error = NULL
+FROM claimed
+WHERE deletion.storage_key = claimed.storage_key
+RETURNING deletion.storage_key";
 
-pub const SELECT_USERS_BY_EMAILS_QUERY: &str = "SELECT id, email FROM users WHERE email = ANY($1)";
+pub const DELETE_OBJECT_STORAGE_DELETIONS_QUERY: &str =
+	"DELETE FROM object_storage_deletions WHERE storage_key = ANY($1)";
+
+pub const DELETE_OBJECTS_BY_STORAGE_KEYS_QUERY: &str =
+	"DELETE FROM objects WHERE storage_key = ANY($1) AND storage_state = 'delete_pending'";
+
+pub const MARK_OBJECT_STORAGE_DELETIONS_FAILED_QUERY: &str = "UPDATE object_storage_deletions
+SET next_attempt_at = now() + ($3::BIGINT * interval '1 second'),
+	last_error = $2
+WHERE storage_key = ANY($1)";
+
+/// Counts storage deletions that have exhausted their retry budget
+/// (`attempts >= $1`) and so will never be reclaimed by the deletion claim. Used
+/// to surface a parked backlog to operators.
+pub const COUNT_PARKED_OBJECT_STORAGE_DELETIONS_QUERY: &str =
+	"SELECT COUNT(*) FROM object_storage_deletions WHERE attempts >= $1::INTEGER";
 
 pub const SELECT_USER_COUNT_BY_EMAIL_QUERY: &str = "SELECT COUNT(*) FROM users WHERE email = $1";
 
@@ -110,5 +341,50 @@ pub const INSERT_PASSWORD_RESET_TOKEN_QUERY: &str = "INSERT INTO password_reset_
 pub const SELECT_PASSWORD_RESET_TOKEN_QUERY: &str =
 	"SELECT user_id FROM password_reset_tokens WHERE token = $1 AND expires_at > now()";
 
-pub const DELETE_PASSWORD_RESET_TOKEN_QUERY: &str =
-	"DELETE FROM password_reset_tokens WHERE token = $1";
+/// Returns whether the user has any unconsumed token issued within the rate-limit window.
+///
+/// Used by `request_password_reset` to throttle issuance per user; the window is bound
+/// by the `$2::BIGINT` seconds parameter so callers control the policy.
+pub const RECENT_PASSWORD_RESET_TOKEN_EXISTS_QUERY: &str = "SELECT EXISTS (
+		SELECT 1 FROM password_reset_tokens
+		WHERE user_id = $1
+			AND created_at > now() - ($2::BIGINT * interval '1 second')
+	)";
+
+/// Invalidates all unconsumed reset tokens for a user.
+///
+/// Used at issuance time (replace siblings with the new token) and at consumption time
+/// (after a successful reset, kill any other outstanding tokens so the user has none).
+pub const DELETE_PASSWORD_RESET_TOKENS_BY_USER_QUERY: &str =
+	"DELETE FROM password_reset_tokens WHERE user_id = $1";
+
+pub const INSERT_EMAIL_OUTBOX_QUERY: &str =
+	"INSERT INTO email_outbox (kind, payload) VALUES ($1, $2::TEXT::jsonb)";
+
+/// Claims up to `$1` email rows whose scheduled retry/lease time has arrived
+/// and which still have retry budget left. Rows past `$3::INTEGER` attempts are
+/// parked with their last error for operator triage.
+pub const CLAIM_EMAIL_OUTBOX_QUERY: &str = "WITH claimed AS MATERIALIZED (
+	SELECT id
+	FROM email_outbox
+	WHERE attempts < $3::INTEGER
+		AND next_attempt_at <= now()
+	ORDER BY next_attempt_at, created_at
+	LIMIT $1
+	FOR UPDATE SKIP LOCKED
+)
+UPDATE email_outbox outbox
+SET attempts = attempts + 1,
+	last_attempt_at = now(),
+	next_attempt_at = now() + ($2::BIGINT * interval '1 second'),
+	last_error = NULL
+FROM claimed
+WHERE outbox.id = claimed.id
+RETURNING outbox.id, outbox.kind, outbox.payload::TEXT AS payload";
+
+pub const DELETE_EMAIL_OUTBOX_QUERY: &str = "DELETE FROM email_outbox WHERE id = ANY($1)";
+
+pub const MARK_EMAIL_OUTBOX_FAILED_QUERY: &str = "UPDATE email_outbox
+SET next_attempt_at = now() + ($3::BIGINT * interval '1 second'),
+	last_error = $2
+WHERE id = ANY($1)";
diff --git a/backend/src/email.rs b/backend/src/email.rs
index dca4098..249f292 100644
--- a/backend/src/email.rs
+++ b/backend/src/email.rs
@@ -16,19 +16,19 @@ pub async fn send_password_reset_email(
 	token: &str,
 ) -> anyhow::Result<()> {
 	let email = Message::builder()
-		.from(config.smtp_from.parse()?)
+		.from(config.smtp.from.parse()?)
 		.to(to_email.parse()?)
 		.subject("Password Reset Request")
 		.header(ContentType::TEXT_PLAIN)
 		.body(format!(
 			"Click the link below to reset your password:\n\n{}/reset-password?token={}\n\nThis link expires in 10 minutes.",
-			config.frontend_url, token
+			config.frontend.url, token
 		))?;
 
-	let creds = Credentials::new(config.smtp_user.clone(), config.smtp_pass.clone());
+	let creds = Credentials::new(config.smtp.user.clone(), config.smtp.pass.clone());
 
 	let mailer =
-		AsyncSmtpTransport::<Tokio1Executor>::relay(&config.smtp_host)?.credentials(creds).build();
+		AsyncSmtpTransport::<Tokio1Executor>::relay(&config.smtp.host)?.credentials(creds).build();
 
 	mailer.send(email).await?;
 
diff --git a/backend/src/email_worker.rs b/backend/src/email_worker.rs
new file mode 100644
index 0000000..b1f0a62
--- /dev/null
+++ b/backend/src/email_worker.rs
@@ -0,0 +1,434 @@
+use {
+	crate::{
+		Config,
+		db::queries::{
+			CLAIM_EMAIL_OUTBOX_QUERY,
+			DELETE_EMAIL_OUTBOX_QUERY,
+			INSERT_EMAIL_OUTBOX_QUERY,
+			MARK_EMAIL_OUTBOX_FAILED_QUERY,
+		},
+		email::send_password_reset_email,
+		errors::AppError,
+		outbox::{
+			DrainOutcome,
+			FailedGroup,
+			OutboxProcessor,
+			OutboxQueue,
+			OutboxRetryConfig,
+			drain_outbox,
+			ensure_positive,
+		},
+		worker::MaintenanceTask,
+	},
+	anyhow::Context,
+	deadpool::managed::Pool,
+	deadpool_postgres::{
+		Client,
+		Manager,
+	},
+	serde::{
+		Deserialize,
+		Serialize,
+	},
+	std::{
+		future::Future,
+		time::Duration,
+	},
+	tokio_postgres::{
+		Row,
+		Transaction,
+	},
+};
+
+pub const PASSWORD_RESET_EMAIL_KIND: &str = "password_reset";
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct EmailOutboxConfig {
+	#[serde(default = "EmailOutboxConfig::default_retry_seconds")]
+	pub retry_seconds: i64,
+	#[serde(default = "EmailOutboxConfig::default_lease_seconds")]
+	pub lease_seconds: i64,
+	#[serde(default = "EmailOutboxConfig::default_worker_interval_seconds")]
+	pub worker_interval_seconds: i64,
+	#[serde(default = "EmailOutboxConfig::default_batch_size")]
+	pub batch_size: i64,
+	#[serde(default = "EmailOutboxConfig::default_max_attempts")]
+	pub max_attempts: i32,
+}
+
+impl EmailOutboxConfig {
+	pub const fn default_retry_seconds() -> i64 {
+		60
+	}
+
+	pub const fn default_lease_seconds() -> i64 {
+		300
+	}
+
+	pub const fn default_worker_interval_seconds() -> i64 {
+		30
+	}
+
+	pub const fn default_batch_size() -> i64 {
+		100
+	}
+
+	pub const fn default_max_attempts() -> i32 {
+		10
+	}
+
+	pub fn validate(&self) -> anyhow::Result<()> {
+		self.retry().validate("email_outbox")?;
+		ensure_positive!(self, worker_interval_seconds);
+		Ok(())
+	}
+
+	/// Lease/retry policy for the email outbox, as a runtime view.
+	pub fn retry(&self) -> OutboxRetryConfig {
+		OutboxRetryConfig {
+			retry_seconds: self.retry_seconds,
+			lease_seconds: self.lease_seconds,
+			batch_size: self.batch_size,
+			max_attempts: self.max_attempts,
+		}
+	}
+
+	fn worker_interval(&self) -> Duration {
+		Duration::from_secs(self.worker_interval_seconds as u64)
+	}
+}
+
+impl Default for EmailOutboxConfig {
+	fn default() -> Self {
+		Self {
+			retry_seconds: Self::default_retry_seconds(),
+			lease_seconds: Self::default_lease_seconds(),
+			worker_interval_seconds: Self::default_worker_interval_seconds(),
+			batch_size: Self::default_batch_size(),
+			max_attempts: Self::default_max_attempts(),
+		}
+	}
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct PasswordResetEmailPayload {
+	pub email: String,
+	pub token: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EmailOutboxMessage {
+	pub id: i64,
+	pub kind: String,
+	pub payload: String,
+}
+
+impl TryFrom<Row> for EmailOutboxMessage {
+	type Error = AppError;
+
+	fn try_from(row: Row) -> Result<Self, Self::Error> {
+		Ok(Self {
+			id: row.try_get("id").context("Failed to read email outbox id")?,
+			kind: row.try_get("kind").context("Failed to read email outbox kind")?,
+			payload: row.try_get("payload").context("Failed to read email outbox payload")?,
+		})
+	}
+}
+
+/// Enqueues a password-reset email for asynchronous delivery by the outbox
+/// worker.
+///
+/// The payload deliberately carries the plaintext reset `token`: an outbox must
+/// hold everything the deferred side effect needs, and the email has to contain
+/// the usable token. This is a conscious trade-off, not an oversight. The
+/// exposure is small and bounded: the token of record is stored only as a hash
+/// in `password_reset_tokens`, the token expires in ten minutes, and this row is
+/// deleted as soon as the worker sends the email. Anyone able to read
+/// `email_outbox` already has the database access that defeats the auth system.
+/// If the threat model later admits an untrusted reader of the outbox (a read
+/// replica or a log pipeline), encrypt this payload at rest before considering
+/// the more invasive option of minting the token in the worker, which would
+/// spread the rate-limit and single-active-token invariant across request and
+/// worker paths.
+pub async fn enqueue_password_reset_email(
+	transaction: &Transaction<'_>,
+	email: &str,
+	token: &str,
+) -> Result<(), AppError> {
+	let payload = serde_json::to_string(&PasswordResetEmailPayload {
+		email: email.to_string(),
+		token: token.to_string(),
+	})
+	.context("Failed to serialize password reset email payload")?;
+	transaction
+		.execute(INSERT_EMAIL_OUTBOX_QUERY, &[&PASSWORD_RESET_EMAIL_KIND, &payload])
+		.await
+		.context("Failed to enqueue password reset email")?;
+	Ok(())
+}
+
+#[derive(Clone)]
+pub struct EmailWorker {
+	pool: Pool<Manager>,
+	sender: SmtpEmailSender,
+	config: EmailOutboxConfig,
+}
+
+impl EmailWorker {
+	pub fn new(
+		pool: Pool<Manager>,
+		config: Config,
+	) -> Self {
+		Self {
+			pool,
+			config: config.email_outbox.clone(),
+			sender: SmtpEmailSender {
+				config,
+			},
+		}
+	}
+}
+
+impl MaintenanceTask for EmailWorker {
+	fn name(&self) -> &'static str {
+		"email_outbox"
+	}
+
+	fn interval(&self) -> Duration {
+		self.config.worker_interval()
+	}
+
+	async fn run_once(&self) -> Result<(), AppError> {
+		let mut client = self.pool.get().await?;
+		let processor = EmailOutboxProcessor {
+			sender: &self.sender,
+		};
+		let mut queue = EmailOutboxQueue(&mut client);
+		drain_outbox(&mut queue, &processor, &self.config.retry()).await
+	}
+}
+
+#[derive(Clone)]
+struct SmtpEmailSender {
+	config: Config,
+}
+
+/// Sends one email. `send_password_reset` carries an explicit `Send` bound on its
+/// future so the generic `EmailOutboxProcessor` can compose it into the
+/// `Send`-bounded `OutboxProcessor::process` future (`drain_outbox` runs in a
+/// spawned worker task).
+trait EmailSender {
+	fn send_password_reset(
+		&self,
+		payload: &PasswordResetEmailPayload,
+	) -> impl Future<Output = anyhow::Result<()>> + Send;
+}
+
+impl EmailSender for SmtpEmailSender {
+	async fn send_password_reset(
+		&self,
+		payload: &PasswordResetEmailPayload,
+	) -> anyhow::Result<()> {
+		send_password_reset_email(&self.config, &payload.email, &payload.token).await
+	}
+}
+
+/// The email outbox as an [`OutboxQueue`]. `clear`/`mark_failed` operate on the
+/// message ids; the item carries the kind and payload the processor needs.
+struct EmailOutboxQueue<'a>(&'a mut Client);
+
+impl OutboxQueue for EmailOutboxQueue<'_> {
+	type Item = EmailOutboxMessage;
+
+	async fn claim(
+		&mut self,
+		retry: &OutboxRetryConfig,
+	) -> Result<Vec<EmailOutboxMessage>, AppError> {
+		let rows = self
+			.0
+			.query(
+				CLAIM_EMAIL_OUTBOX_QUERY,
+				&[&retry.batch_size, &retry.lease_seconds, &retry.max_attempts],
+			)
+			.await
+			.context("Failed to claim email outbox rows")?;
+		rows.into_iter().map(EmailOutboxMessage::try_from).collect()
+	}
+
+	async fn clear(
+		&mut self,
+		messages: &[EmailOutboxMessage],
+	) -> Result<(), AppError> {
+		if messages.is_empty() {
+			return Ok(());
+		}
+		let ids = messages.iter().map(|message| message.id).collect::<Vec<_>>();
+		self.0
+			.execute(DELETE_EMAIL_OUTBOX_QUERY, &[&ids])
+			.await
+			.context("Failed to clear delivered email outbox rows")?;
+		Ok(())
+	}
+
+	async fn mark_failed(
+		&mut self,
+		messages: &[EmailOutboxMessage],
+		error_message: &str,
+		retry_after_seconds: i64,
+	) -> Result<(), AppError> {
+		if messages.is_empty() {
+			return Ok(());
+		}
+		let ids = messages.iter().map(|message| message.id).collect::<Vec<_>>();
+		self.0
+			.execute(MARK_EMAIL_OUTBOX_FAILED_QUERY, &[&ids, &error_message, &retry_after_seconds])
+			.await
+			.context("Failed to record email outbox delivery failure")?;
+		Ok(())
+	}
+}
+
+/// Sends each claimed message independently, so one failed send does not fail the
+/// rest of the batch: successes clear, and each failure becomes its own
+/// `FailedGroup` to be marked for retry.
+struct EmailOutboxProcessor<'a, S> {
+	sender: &'a S,
+}
+
+impl<S: EmailSender + Sync> OutboxProcessor for EmailOutboxProcessor<'_, S> {
+	type Item = EmailOutboxMessage;
+
+	async fn process(
+		&self,
+		messages: Vec<EmailOutboxMessage>,
+	) -> DrainOutcome<EmailOutboxMessage> {
+		let mut cleared = Vec::new();
+		let mut failed = Vec::new();
+		for message in messages {
+			match send_email_message(self.sender, &message).await {
+				Ok(()) => cleared.push(message),
+				Err(error) => failed.push(FailedGroup {
+					items: vec![message],
+					error,
+				}),
+			}
+		}
+		DrainOutcome {
+			cleared,
+			failed,
+		}
+	}
+}
+
+async fn send_email_message(
+	sender: &impl EmailSender,
+	message: &EmailOutboxMessage,
+) -> anyhow::Result<()> {
+	match message.kind.as_str() {
+		PASSWORD_RESET_EMAIL_KIND => {
+			let payload = serde_json::from_str::<PasswordResetEmailPayload>(&message.payload)
+				.context("Failed to deserialize password reset email payload")?;
+			sender.send_password_reset(&payload).await
+		}
+		kind => anyhow::bail!("Unsupported email outbox kind: {kind}"),
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use {
+		super::{
+			EmailOutboxMessage,
+			EmailOutboxProcessor,
+			EmailSender,
+			PASSWORD_RESET_EMAIL_KIND,
+			PasswordResetEmailPayload,
+		},
+		crate::outbox::OutboxProcessor,
+		std::sync::Mutex,
+	};
+
+	#[derive(Default)]
+	struct FakeEmailSender {
+		sent: Mutex<Vec<PasswordResetEmailPayload>>,
+		fail: bool,
+	}
+
+	impl FakeEmailSender {
+		fn sent(&self) -> anyhow::Result<Vec<PasswordResetEmailPayload>> {
+			self.sent
+				.lock()
+				.map(|sent| sent.clone())
+				.map_err(|_| anyhow::anyhow!("sent mutex poisoned"))
+		}
+	}
+
+	impl EmailSender for FakeEmailSender {
+		async fn send_password_reset(
+			&self,
+			payload: &PasswordResetEmailPayload,
+		) -> anyhow::Result<()> {
+			if self.fail {
+				anyhow::bail!("smtp failed");
+			}
+			self.sent
+				.lock()
+				.map_err(|_| anyhow::anyhow!("sent mutex poisoned"))?
+				.push(payload.clone());
+			Ok(())
+		}
+	}
+
+	fn password_reset_message(id: i64) -> anyhow::Result<EmailOutboxMessage> {
+		Ok(EmailOutboxMessage {
+			id,
+			kind: PASSWORD_RESET_EMAIL_KIND.to_string(),
+			payload: serde_json::to_string(&PasswordResetEmailPayload {
+				email: "person@example.test".to_string(),
+				token: "reset-token".to_string(),
+			})?,
+		})
+	}
+
+	#[tokio::test]
+	async fn email_processor_sends_and_clears_password_reset_rows() -> anyhow::Result<()> {
+		let sender = FakeEmailSender::default();
+		let processor = EmailOutboxProcessor {
+			sender: &sender,
+		};
+
+		let outcome = processor.process(vec![password_reset_message(42)?]).await;
+
+		assert_eq!(outcome.cleared.iter().map(|message| message.id).collect::<Vec<_>>(), vec![42]);
+		assert!(outcome.failed.is_empty());
+		assert_eq!(
+			sender.sent()?,
+			vec![PasswordResetEmailPayload {
+				email: "person@example.test".to_string(),
+				token: "reset-token".to_string(),
+			}]
+		);
+		Ok(())
+	}
+
+	#[tokio::test]
+	async fn email_processor_isolates_send_failures_per_message() -> anyhow::Result<()> {
+		let sender = FakeEmailSender {
+			fail: true,
+			..FakeEmailSender::default()
+		};
+		let processor = EmailOutboxProcessor {
+			sender: &sender,
+		};
+
+		let outcome = processor.process(vec![password_reset_message(42)?]).await;
+
+		assert!(outcome.cleared.is_empty());
+		let [group] = outcome.failed.as_slice() else {
+			anyhow::bail!("expected exactly one failed group");
+		};
+		assert_eq!(group.items.iter().map(|message| message.id).collect::<Vec<_>>(), vec![42]);
+		assert!(group.error.to_string().contains("smtp failed"));
+		Ok(())
+	}
+}
diff --git a/backend/src/errors.rs b/backend/src/errors.rs
index f9b2bea..2a90ffb 100644
--- a/backend/src/errors.rs
+++ b/backend/src/errors.rs
@@ -1,25 +1,5 @@
 use {
-	crate::constants::{
-		ERR_CASBIN,
-		ERR_CONFIG,
-		ERR_CREATE_POOL,
-		ERR_DB,
-		ERR_EMAIL,
-		ERR_EMAIL_ADDRESS,
-		ERR_FORBIDDEN,
-		ERR_HASHING,
-		ERR_INTERNAL_SERVER,
-		ERR_INVALID_NUMBER,
-		ERR_IO,
-		ERR_MIGRATION,
-		ERR_MULTIPART,
-		ERR_NOT_FOUND,
-		ERR_POOL,
-		ERR_SMTP,
-		ERR_SYSTEM_TIME,
-		ERR_UNAUTHORIZED,
-		ERR_VALIDATION,
-	},
+	async_graphql::ErrorExtensions,
 	axum::{
 		http::StatusCode,
 		response::{
@@ -27,72 +7,116 @@ use {
 			Response,
 		},
 	},
-	std::fmt,
 };
 
-#[derive(Debug)]
+/// Application-level error categories that all backend operations funnel into.
+///
+/// Source-specific errors (database, S3, hashing, SMTP, config, casbin, etc.)
+/// all become `AppError::Internal` via `anyhow::Error`. Variants exist only for
+/// categories that the client needs to distinguish in the response. Site-specific
+/// detail belongs in `.context("Failed to ...")` chains at call sites; it is no
+/// longer baked into per-source-type prefix constants.
+#[derive(Debug, thiserror::Error)]
 pub enum AppError {
-	Internal(anyhow::Error),
+	#[error("Internal server error: {0}")]
+	Internal(#[from] anyhow::Error),
+	#[error("Unauthorized")]
 	Unauthorized,
+	#[error("Forbidden")]
 	Forbidden,
+	#[error("Not found: {0}")]
 	NotFound(String),
+	#[error("Validation error: {0}")]
 	Validation(String),
 }
 
-impl fmt::Display for AppError {
-	fn fmt(
-		&self,
-		f: &mut fmt::Formatter<'_>,
-	) -> fmt::Result {
-		match self {
-			AppError::Internal(e) => write!(f, "{}: {}", ERR_INTERNAL_SERVER, e),
-			AppError::Unauthorized => write!(f, "{}", ERR_UNAUTHORIZED),
-			AppError::Forbidden => write!(f, "{}", ERR_FORBIDDEN),
-			AppError::NotFound(msg) => write!(f, "{}{}", ERR_NOT_FOUND, msg),
-			AppError::Validation(msg) => write!(f, "{}{}", ERR_VALIDATION, msg),
-		}
-	}
+/// Stable, client-facing error categories surfaced via `extensions.code` on
+/// GraphQL errors and via HTTP status on the REST endpoint. Wire format
+/// uses SCREAMING_SNAKE_CASE strings so existing API consumers can match
+/// against literal codes without parsing message text.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ErrorCode {
+	Internal,
+	Unauthorized,
+	Forbidden,
+	NotFound,
+	Validation,
 }
 
-impl std::error::Error for AppError {
-	fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+impl ErrorCode {
+	pub fn as_str(self) -> &'static str {
 		match self {
-			AppError::Internal(e) => e.source(),
-			_ => None,
+			ErrorCode::Internal => "INTERNAL",
+			ErrorCode::Unauthorized => "UNAUTHORIZED",
+			ErrorCode::Forbidden => "FORBIDDEN",
+			ErrorCode::NotFound => "NOT_FOUND",
+			ErrorCode::Validation => "VALIDATION",
 		}
 	}
-}
 
-impl From<anyhow::Error> for AppError {
-	fn from(err: anyhow::Error) -> Self {
-		AppError::Internal(err)
+	pub fn parse(value: &str) -> Option<Self> {
+		Some(match value {
+			"INTERNAL" => ErrorCode::Internal,
+			"UNAUTHORIZED" => ErrorCode::Unauthorized,
+			"FORBIDDEN" => ErrorCode::Forbidden,
+			"NOT_FOUND" => ErrorCode::NotFound,
+			"VALIDATION" => ErrorCode::Validation,
+			_ => return None,
+		})
 	}
 }
 
 impl AppError {
 	pub fn status_code(&self) -> StatusCode {
+		match self.code() {
+			ErrorCode::Internal => StatusCode::INTERNAL_SERVER_ERROR,
+			ErrorCode::Unauthorized => StatusCode::UNAUTHORIZED,
+			ErrorCode::Forbidden => StatusCode::FORBIDDEN,
+			ErrorCode::NotFound => StatusCode::NOT_FOUND,
+			ErrorCode::Validation => StatusCode::BAD_REQUEST,
+		}
+	}
+
+	/// Stable category code that mirrors the HTTP status / GraphQL extension.
+	pub fn code(&self) -> ErrorCode {
 		match self {
-			AppError::Internal(_) => StatusCode::INTERNAL_SERVER_ERROR,
-			AppError::Unauthorized => StatusCode::UNAUTHORIZED,
-			AppError::Forbidden => StatusCode::FORBIDDEN,
-			AppError::NotFound(_) => StatusCode::NOT_FOUND,
-			AppError::Validation(_) => StatusCode::BAD_REQUEST,
+			AppError::Internal(_) => ErrorCode::Internal,
+			AppError::Unauthorized => ErrorCode::Unauthorized,
+			AppError::Forbidden => ErrorCode::Forbidden,
+			AppError::NotFound(_) => ErrorCode::NotFound,
+			AppError::Validation(_) => ErrorCode::Validation,
 		}
 	}
 
+	/// Message shown to clients. Internal errors are intentionally opaque to
+	/// avoid leaking internal details; the full source is in tracing logs.
 	pub fn client_message(&self) -> String {
 		match self {
-			AppError::Internal(_) => ERR_INTERNAL_SERVER.to_string(),
-			AppError::Unauthorized => ERR_UNAUTHORIZED.to_string(),
-			AppError::Forbidden => ERR_FORBIDDEN.to_string(),
+			AppError::Internal(_) => "Internal server error".to_string(),
+			AppError::Unauthorized => "Unauthorized".to_string(),
+			AppError::Forbidden => "Forbidden".to_string(),
 			AppError::NotFound(msg) => msg.clone(),
 			AppError::Validation(msg) => msg.clone(),
 		}
 	}
 
+	/// Wraps the error into an async-graphql Error, populating `extensions.code`
+	/// so clients can branch on the stable code instead of parsing the message.
 	pub fn extend_graphql(self) -> async_graphql::Error {
 		tracing::error!("GraphQL error: {:?}", self);
-		async_graphql::Error::new(self.to_string())
+		let code = self.code().as_str();
+		let message = self.client_message();
+		async_graphql::Error::new(message).extend_with(|_, extensions| {
+			extensions.set("code", code);
+		})
+	}
+
+	/// Central conversion point for resolver code.
+	///
+	/// Use this instead of `async_graphql::Error::from` so every `AppError`
+	/// reaches clients with the stable `extensions.code` field.
+	pub fn graphql(error: impl Into<Self>) -> async_graphql::Error {
+		error.into().extend_graphql()
 	}
 }
 
@@ -105,102 +129,67 @@ impl IntoResponse for AppError {
 
 impl From<async_graphql::Error> for AppError {
 	fn from(err: async_graphql::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!(err.message))
-	}
-}
-
-impl From<Box<dyn std::error::Error + Send + Sync>> for AppError {
-	fn from(err: Box<dyn std::error::Error + Send + Sync>) -> Self {
-		AppError::Internal(anyhow::anyhow!(err))
-	}
-}
-
-impl From<minio::s3::error::Error> for AppError {
-	fn from(err: minio::s3::error::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!(err))
+		let code = err
+			.extensions
+			.as_ref()
+			.and_then(|extensions| extensions.get("code"))
+			.and_then(|value| match value {
+				async_graphql::Value::String(string) => Some(string.as_str()),
+				_ => None,
+			})
+			.and_then(ErrorCode::parse);
+
+		match code {
+			Some(ErrorCode::Unauthorized) => AppError::Unauthorized,
+			Some(ErrorCode::Forbidden) => AppError::Forbidden,
+			Some(ErrorCode::NotFound) => AppError::NotFound(err.message),
+			Some(ErrorCode::Validation) => AppError::Validation(err.message),
+			Some(ErrorCode::Internal) | None => AppError::Internal(anyhow::anyhow!(err.message)),
+		}
 	}
 }
 
+// Bare `?` is convenient at call sites. Each source-specific error type that
+// the code hits routinely gets an explicit From impl that funnels into
+// AppError::Internal via anyhow. Per-type message prefixes are dropped:
+// site-specific context lives in `.context("Failed to ...")` chains.
+macro_rules! impl_into_internal {
+	($($ty:ty),* $(,)?) => {
+		$(
+			impl From<$ty> for AppError {
+				fn from(err: $ty) -> Self {
+					AppError::Internal(anyhow::Error::new(err))
+				}
+			}
+		)*
+	};
+}
+
+impl_into_internal!(
+	casbin::Error,
+	config::ConfigError,
+	deadpool_postgres::CreatePoolError,
+	deadpool_postgres::PoolError,
+	lettre::address::AddressError,
+	lettre::error::Error,
+	lettre::transport::smtp::Error,
+	refinery::error::Error,
+	std::io::Error,
+	std::num::ParseIntError,
+	std::time::SystemTimeError,
+	tokio_postgres::Error,
+);
+
+// argon2::password_hash::Error doesn't implement std::error::Error, so it goes
+// through Display rather than the std::error::Error blanket conversion.
 impl From<argon2::password_hash::Error> for AppError {
 	fn from(err: argon2::password_hash::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_HASHING, err))
-	}
-}
-
-impl From<lettre::error::Error> for AppError {
-	fn from(err: lettre::error::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_EMAIL, err))
-	}
-}
-
-impl From<lettre::address::AddressError> for AppError {
-	fn from(err: lettre::address::AddressError) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_EMAIL_ADDRESS, err))
-	}
-}
-
-impl From<lettre::transport::smtp::Error> for AppError {
-	fn from(err: lettre::transport::smtp::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_SMTP, err))
-	}
-}
-
-impl From<std::num::ParseIntError> for AppError {
-	fn from(err: std::num::ParseIntError) -> Self {
-		AppError::Validation(format!("{}{}", ERR_INVALID_NUMBER, err))
-	}
-}
-
-impl From<deadpool_postgres::CreatePoolError> for AppError {
-	fn from(err: deadpool_postgres::CreatePoolError) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_CREATE_POOL, err))
-	}
-}
-
-impl From<deadpool_postgres::PoolError> for AppError {
-	fn from(err: deadpool_postgres::PoolError) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_POOL, err))
-	}
-}
-
-impl From<tokio_postgres::Error> for AppError {
-	fn from(err: tokio_postgres::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_DB, err))
-	}
-}
-
-impl From<axum::extract::multipart::MultipartError> for AppError {
-	fn from(err: axum::extract::multipart::MultipartError) -> Self {
-		AppError::Validation(format!("{}{}", ERR_MULTIPART, err))
+		AppError::Internal(anyhow::anyhow!("{err}"))
 	}
 }
 
-impl From<casbin::Error> for AppError {
-	fn from(err: casbin::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_CASBIN, err))
-	}
-}
-
-impl From<config::ConfigError> for AppError {
-	fn from(err: config::ConfigError) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_CONFIG, err))
-	}
-}
-
-impl From<refinery::error::Error> for AppError {
-	fn from(err: refinery::error::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_MIGRATION, err))
-	}
-}
-
-impl From<std::time::SystemTimeError> for AppError {
-	fn from(err: std::time::SystemTimeError) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_SYSTEM_TIME, err))
-	}
-}
-
-impl From<std::io::Error> for AppError {
-	fn from(err: std::io::Error) -> Self {
-		AppError::Internal(anyhow::anyhow!("{}{}", ERR_IO, err))
+impl From<Box<dyn std::error::Error + Send + Sync>> for AppError {
+	fn from(err: Box<dyn std::error::Error + Send + Sync>) -> Self {
+		AppError::Internal(anyhow::anyhow!(err))
 	}
 }
diff --git a/backend/src/graphql/objects.rs b/backend/src/graphql/objects.rs
index c1633c4..947302f 100644
--- a/backend/src/graphql/objects.rs
+++ b/backend/src/graphql/objects.rs
@@ -6,6 +6,7 @@ use {
 pub mod config;
 pub mod location;
 pub mod s3_object;
+pub mod upload_session;
 pub mod user;
 
 pub struct RowContext<'a>(pub Row, pub Context<'a>);
diff --git a/backend/src/graphql/objects/location.rs b/backend/src/graphql/objects/location.rs
index 5c7dc39..5727298 100644
--- a/backend/src/graphql/objects/location.rs
+++ b/backend/src/graphql/objects/location.rs
@@ -1,5 +1,6 @@
 use {
 	crate::{
+		errors::AppError,
 		parse_latitude,
 		parse_longitude,
 	},
@@ -8,7 +9,6 @@ use {
 		SimpleObject,
 	},
 	serde::Serialize,
-	tokio_postgres::Row,
 };
 
 #[derive(SimpleObject, InputObject, Clone, Debug, Serialize)]
@@ -18,13 +18,74 @@ pub struct Location {
 	pub longitude: f64,
 }
 
-impl TryFrom<Row> for Location {
-	type Error = Box<dyn std::error::Error>;
-
-	fn try_from(value: Row) -> Result<Self, Self::Error> {
-		Ok(Location {
-			latitude: parse_latitude(value.try_get("latitude")?)?,
-			longitude: parse_longitude(value.try_get("longitude")?)?,
+impl Location {
+	pub fn validated(self) -> Result<Self, AppError> {
+		Ok(Self {
+			latitude: parse_latitude(self.latitude)?,
+			longitude: parse_longitude(self.longitude)?,
 		})
 	}
+
+	pub fn geometry(&self) -> Result<String, AppError> {
+		let latitude = parse_latitude(self.latitude)?;
+		let longitude = parse_longitude(self.longitude)?;
+		Ok(format!("SRID=4326;POINT({longitude} {latitude})"))
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use {
+		super::Location,
+		crate::errors::AppError,
+	};
+
+	#[test]
+	fn validated_accepts_boundary_coordinates() {
+		let result = Location {
+			latitude: -90.0,
+			longitude: 180.0,
+		}
+		.validated();
+
+		assert!(result.is_ok(), "valid coordinates were rejected: {:?}", result.as_ref().err());
+		if let Ok(location) = result {
+			assert_eq!(location.latitude, -90.0);
+			assert_eq!(location.longitude, 180.0);
+		}
+	}
+
+	#[test]
+	fn validated_rejects_out_of_range_coordinates() {
+		let location = Location {
+			latitude: 90.1,
+			longitude: 0.0,
+		};
+
+		assert!(matches!(location.validated(), Err(AppError::Validation(_))));
+	}
+
+	#[test]
+	fn geometry_validates_before_formatting() {
+		let location = Location {
+			latitude: 0.0,
+			longitude: 180.1,
+		};
+
+		assert!(matches!(location.geometry(), Err(AppError::Validation(_))));
+	}
+
+	#[test]
+	fn geometry_formats_valid_coordinates() {
+		let location = Location {
+			latitude: 12.5,
+			longitude: -45.25,
+		};
+		let result = location.geometry();
+
+		assert!(result.is_ok(), "valid coordinates were rejected: {:?}", result.as_ref().err());
+		if let Ok(geometry) = result {
+			assert_eq!(geometry, "SRID=4326;POINT(-45.25 12.5)");
+		}
+	}
 }
diff --git a/backend/src/graphql/objects/s3_object.rs b/backend/src/graphql/objects/s3_object.rs
index de29370..5de0321 100644
--- a/backend/src/graphql/objects/s3_object.rs
+++ b/backend/src/graphql/objects/s3_object.rs
@@ -1,7 +1,6 @@
 use {
 	crate::{
 		ContextWrapper,
-		SharedState,
 		db::queries::{
 			SELECT_ALL_OBJECTS_QUERY,
 			SELECT_OBJECT_BY_ID_QUERY,
@@ -10,8 +9,10 @@ use {
 			SELECT_OBJECTS_BY_USER_ID_QUERY,
 			SELECT_VISIBLE_OBJECTS_QUERY,
 		},
+		errors::AppError,
 		graphql::objects::location::Location,
 	},
+	anyhow::Context as AnyhowContext,
 	async_graphql::{
 		Context,
 		Enum,
@@ -19,11 +20,7 @@ use {
 		ID,
 		Object,
 	},
-	axum::http::Method,
-	deadpool_postgres::Manager,
-	futures::future::join_all,
 	jiff::Timestamp,
-	minio::s3::types::S3Api,
 	postgres_types::{
 		FromSql,
 		ToSql,
@@ -35,7 +32,6 @@ use {
 	std::{
 		fmt,
 		str::FromStr,
-		sync::Arc,
 	},
 	tokio_postgres::Row,
 };
@@ -93,10 +89,39 @@ where
 	}
 }
 
+/// Emits a 64-bit id as a JSON string.
+///
+/// Matches the GraphQL `ID` wire format and protects JavaScript clients from the
+/// `Number` precision ceiling at 2^53.
+fn serialize_i64_as_string<S>(
+	value: &i64,
+	serializer: S,
+) -> Result<S::Ok, S::Error>
+where
+	S: Serializer, {
+	serializer.collect_str(value)
+}
+
+/// Whether objects of this content type must be served as a download rather than
+/// rendered inline.
+///
+/// Script-capable types (currently only SVG) are forced to
+/// `Content-Disposition: attachment` on their presigned GET URL, so a direct
+/// top-level navigation downloads the file instead of executing embedded script
+/// in the storage origin. In-app `<img>`/`<video>` embedding ignores the header,
+/// so display is unaffected. A new script-capable type cannot enter the system
+/// without an `ALLOWED_MIME_TYPES` edit, which is the checkpoint to extend this.
+fn content_type_requires_attachment(content_type: &str) -> bool {
+	matches!(content_type, "image/svg+xml")
+}
+
 #[derive(Debug, Serialize)]
 pub struct S3Object {
-	pub id: ID,
+	#[serde(serialize_with = "serialize_i64_as_string")]
+	pub id: i64,
 	pub name: String,
+	pub storage_key: String,
+	pub content_type: String,
 	#[serde(serialize_with = "serialize_timestamp")]
 	pub made_on: Option<Timestamp>,
 	pub location: Option<Location>,
@@ -105,127 +130,119 @@ pub struct S3Object {
 	pub allowed_users: Vec<String>,
 }
 
-impl S3Object {
-	pub async fn try_from(row: Row) -> Result<Self, GraphQLError> {
-		let name: String = row.try_get("name")?;
-		let id: i64 = row.try_get("id")?;
-		let made_on: Option<Timestamp> = row.try_get("made_on")?;
-		let user_id: Option<i64> = row.try_get("user_id").ok();
-		let publicity: PublicityOverride = row.try_get("publicity")?;
-		// allowed_users might be null if no join, but we will ensure join
+impl TryFrom<Row> for S3Object {
+	type Error = AppError;
+
+	fn try_from(row: Row) -> Result<Self, Self::Error> {
+		let name: String = row.try_get("name").context("Failed to read object name")?;
+		let storage_key: String =
+			row.try_get("storage_key").context("Failed to read object storage_key")?;
+		let content_type: String =
+			row.try_get("content_type").context("Failed to read object content_type")?;
+		let id: i64 = row.try_get("id").context("Failed to read object id")?;
+		let made_on: Option<Timestamp> =
+			row.try_get("made_on").context("Failed to read object made_on")?;
+		let user_id: Option<i64> =
+			row.try_get("user_id").context("Failed to read object user_id")?;
+		let publicity: PublicityOverride =
+			row.try_get("publicity").context("Failed to read object publicity")?;
+		// Some lifecycle queries return partial object rows and fill allowed users later.
 		let allowed_users: Vec<String> = row.try_get("allowed_users").unwrap_or_default();
 
+		// Distinguish "no location set" (both NULL) from a decode failure.
+		// ST_Y/ST_X return NULL only when `location` is NULL, so a single-NULL pair
+		// signals a query shape regression and must propagate rather than be hidden.
+		let latitude: Option<f64> =
+			row.try_get("latitude").context("Failed to read object latitude")?;
+		let longitude: Option<f64> =
+			row.try_get("longitude").context("Failed to read object longitude")?;
+		let location = match (latitude, longitude) {
+			(Some(latitude), Some(longitude)) => Some(
+				Location {
+					latitude,
+					longitude,
+				}
+				.validated()?,
+			),
+			(None, None) => None,
+			_ => {
+				return Err(AppError::Internal(anyhow::anyhow!(
+					"Object row has only one of (latitude, longitude) set"
+				)));
+			}
+		};
+
 		Ok(S3Object {
-			id: id.into(),
+			id,
 			name,
+			storage_key,
+			content_type,
 			made_on,
-			location: Location::try_from(row).ok(),
+			location,
 			user_id,
 			publicity,
 			allowed_users,
 		})
 	}
+}
 
-	pub async fn all(ctx: &Context<'_>) -> Result<Vec<Self>, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+impl S3Object {
+	pub async fn all(ctx: &Context<'_>) -> Result<Vec<Self>, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_ALL_OBJECTS_QUERY).await?;
-		join_all(
-			client
-				.query(&statement, &[])
-				.await
-				.map_err(GraphQLError::from)?
-				.into_iter()
-				.map(Self::try_from)
-				.collect::<Vec<_>>(),
-		)
-		.await
-		.into_iter()
-		.collect::<Result<Vec<_>, _>>()
+		client.query(&statement, &[]).await?.into_iter().map(Self::try_from).collect()
 	}
 
 	pub async fn where_id(
 		ctx: &Context<'_>,
 		id: i64,
-	) -> Result<Self, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+	) -> Result<Self, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_OBJECT_BY_ID_QUERY).await?;
-		Self::try_from(client.query_one(&statement, &[&id]).await?).await
+		Self::try_from(client.query_one(&statement, &[&id]).await?)
 	}
 
 	pub async fn where_name(
 		ctx: &Context<'_>,
 		name: String,
-	) -> Result<Self, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+	) -> Result<Self, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_OBJECT_BY_NAME_QUERY).await?;
-		Self::try_from(client.query_one(&statement, &[&name]).await?).await
+		Self::try_from(client.query_one(&statement, &[&name]).await?)
 	}
 
 	pub async fn where_ids(
 		ctx: &Context<'_>,
 		ids: &[i64],
-	) -> Result<Vec<Self>, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+	) -> Result<Vec<Self>, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_OBJECTS_BY_IDS_QUERY).await?;
-		join_all(
-			client
-				.query(&statement, &[&ids])
-				.await
-				.map_err(GraphQLError::from)?
-				.into_iter()
-				.map(Self::try_from)
-				.collect::<Vec<_>>(),
-		)
-		.await
-		.into_iter()
-		.collect::<Result<Vec<_>, _>>()
+		client.query(&statement, &[&ids]).await?.into_iter().map(Self::try_from).collect()
 	}
 
 	pub async fn where_user_id(
 		ctx: &Context<'_>,
 		user_id: i64,
-	) -> Result<Vec<Self>, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+	) -> Result<Vec<Self>, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_OBJECTS_BY_USER_ID_QUERY).await?;
-		join_all(
-			client
-				.query(&statement, &[&user_id])
-				.await
-				.map_err(GraphQLError::from)?
-				.into_iter()
-				.map(Self::try_from)
-				.collect::<Vec<_>>(),
-		)
-		.await
-		.into_iter()
-		.collect::<Result<Vec<_>, _>>()
+		client.query(&statement, &[&user_id]).await?.into_iter().map(Self::try_from).collect()
 	}
 
 	pub async fn visible_to_user(
 		ctx: &Context<'_>,
 		user_id: Option<i64>,
-	) -> Result<Vec<Self>, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+	) -> Result<Vec<Self>, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_VISIBLE_OBJECTS_QUERY).await?;
-		join_all(
-			client
-				.query(&statement, &[&user_id])
-				.await
-				.map_err(GraphQLError::from)?
-				.into_iter()
-				.map(Self::try_from)
-				.collect::<Vec<_>>(),
-		)
-		.await
-		.into_iter()
-		.collect::<Result<Vec<_>, _>>()
+		client.query(&statement, &[&user_id]).await?.into_iter().map(Self::try_from).collect()
 	}
 }
 
 #[Object]
 impl S3Object {
 	async fn id(&self) -> ID {
-		self.id.clone()
+		self.id.into()
 	}
 
 	async fn name(&self) -> String {
@@ -252,28 +269,31 @@ impl S3Object {
 		&self,
 		ctx: &Context<'_>,
 	) -> Result<String, GraphQLError> {
-		let data = ctx.data::<Arc<SharedState<Manager, deadpool_postgres::Client>>>()?;
-		Ok(data
-			.minio_client
-			.get_presigned_object_url(&data.bucket_name, &self.name, Method::GET)
-			.send()
-			.await?
-			.url)
+		let wrapper = ContextWrapper::new(ctx)?;
+		let content_disposition =
+			content_type_requires_attachment(&self.content_type).then_some("attachment");
+		wrapper
+			.shared_state()
+			.storage
+			.presigned_get_url(&self.storage_key, content_disposition)
+			.await
+			.map_err(AppError::graphql)
 	}
 
-	async fn content_type(
-		&self,
-		ctx: &Context<'_>,
-	) -> Result<String, GraphQLError> {
-		let data = ctx.data::<Arc<SharedState<Manager, deadpool_postgres::Client>>>()?;
-		data.minio_client
-			.get_object(&data.bucket_name, &self.name)
-			.send()
-			.await?
-			.headers
-			.get("Content-Type")
-			.and_then(|content_type| content_type.to_str().ok())
-			.map(|s| s.to_string())
-			.ok_or_else(|| "Invalid Content-Type".into())
+	async fn content_type(&self) -> String {
+		self.content_type.clone()
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::content_type_requires_attachment;
+
+	#[test]
+	fn only_script_capable_types_force_attachment() {
+		assert!(content_type_requires_attachment("image/svg+xml"));
+		assert!(!content_type_requires_attachment("image/png"));
+		assert!(!content_type_requires_attachment("video/mp4"));
+		assert!(!content_type_requires_attachment("audio/mpeg"));
 	}
 }
diff --git a/backend/src/graphql/objects/upload_session.rs b/backend/src/graphql/objects/upload_session.rs
new file mode 100644
index 0000000..d86e247
--- /dev/null
+++ b/backend/src/graphql/objects/upload_session.rs
@@ -0,0 +1,127 @@
+use {
+	crate::{
+		object_lifecycle::{
+			CreatedObjectUploadSession as CreatedObjectUploadSessionInner,
+			PresignedObjectUploadPart as PresignedObjectUploadPartInner,
+		},
+		storage::PresignedHeader as PresignedHeaderInner,
+	},
+	async_graphql::{
+		ID,
+		Object,
+	},
+	jiff::Timestamp,
+};
+
+#[derive(Clone, Debug)]
+pub struct CreatedObjectUploadSession(pub CreatedObjectUploadSessionInner);
+
+#[Object]
+impl CreatedObjectUploadSession {
+	async fn object_id(&self) -> ID {
+		self.0.object_id.into()
+	}
+
+	async fn part_size_bytes(&self) -> i64 {
+		self.0.part_size_bytes
+	}
+
+	async fn total_parts(&self) -> i32 {
+		self.0.total_parts
+	}
+
+	async fn expires_at(&self) -> String {
+		self.0.expires_at.to_string()
+	}
+}
+
+impl From<CreatedObjectUploadSessionInner> for CreatedObjectUploadSession {
+	fn from(session: CreatedObjectUploadSessionInner) -> Self {
+		Self(session)
+	}
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct AbortedObjectUpload {
+	object_id: i64,
+}
+
+impl AbortedObjectUpload {
+	pub fn new(object_id: i64) -> Self {
+		Self {
+			object_id,
+		}
+	}
+}
+
+#[Object]
+impl AbortedObjectUpload {
+	async fn object_id(&self) -> ID {
+		self.object_id.into()
+	}
+}
+
+#[derive(Clone, Debug)]
+pub struct PresignedObjectUploadPart {
+	inner: PresignedObjectUploadPartInner,
+	url_expires_at: Timestamp,
+}
+
+impl PresignedObjectUploadPart {
+	pub fn new(
+		inner: PresignedObjectUploadPartInner,
+		url_expires_at: Timestamp,
+	) -> Self {
+		Self {
+			inner,
+			url_expires_at,
+		}
+	}
+}
+
+#[Object]
+impl PresignedObjectUploadPart {
+	async fn part_number(&self) -> i32 {
+		self.inner.part_number
+	}
+
+	async fn url(&self) -> &str {
+		&self.inner.url
+	}
+
+	async fn method(&self) -> &str {
+		&self.inner.method
+	}
+
+	async fn headers(&self) -> Vec<PresignedRequestHeader> {
+		self.inner.headers.iter().cloned().map(PresignedRequestHeader::from).collect()
+	}
+
+	async fn expected_content_length(&self) -> i64 {
+		self.inner.expected_content_length
+	}
+
+	async fn url_expires_at(&self) -> String {
+		self.url_expires_at.to_string()
+	}
+}
+
+#[derive(Clone, Debug)]
+pub struct PresignedRequestHeader(PresignedHeaderInner);
+
+impl From<PresignedHeaderInner> for PresignedRequestHeader {
+	fn from(header: PresignedHeaderInner) -> Self {
+		Self(header)
+	}
+}
+
+#[Object]
+impl PresignedRequestHeader {
+	async fn name(&self) -> &str {
+		&self.0.name
+	}
+
+	async fn value(&self) -> &str {
+		&self.0.value
+	}
+}
diff --git a/backend/src/graphql/objects/user.rs b/backend/src/graphql/objects/user.rs
index 7e7358a..53883e3 100644
--- a/backend/src/graphql/objects/user.rs
+++ b/backend/src/graphql/objects/user.rs
@@ -6,11 +6,12 @@ use {
 			SELECT_USER_BY_EMAIL_QUERY,
 			SELECT_USER_BY_ID_QUERY,
 		},
+		errors::AppError,
 	},
+	anyhow::Context as AnyhowContext,
 	async_graphql::{
 		Context,
 		Enum,
-		Error as GraphQLError,
 		ID,
 		Object,
 	},
@@ -99,23 +100,30 @@ pub struct User {
 	pub updated_at: Timestamp,
 }
 
-impl User {
-	pub fn try_from(row: Row) -> Result<Self, GraphQLError> {
-		let role_str: String = row.try_get("role")?;
-		let role = role_str.parse().map_err(|_| GraphQLError::new("Invalid role"))?;
-		let default_publicity: PublicityDefault = row.try_get("default_publicity")?;
+impl TryFrom<Row> for User {
+	type Error = AppError;
+
+	fn try_from(row: Row) -> Result<Self, Self::Error> {
+		let role_str: String = row.try_get("role").context("Failed to read user role")?;
+		let role = role_str
+			.parse()
+			.map_err(|_| AppError::Internal(anyhow::anyhow!("Invalid role in user row")))?;
+		let default_publicity: PublicityDefault =
+			row.try_get("default_publicity").context("Failed to read user default_publicity")?;
 		Ok(User {
-			id: Row::try_get::<_, i64>(&row, "id")?.into(),
-			email: row.try_get("email")?,
+			id: Row::try_get::<_, i64>(&row, "id").context("Failed to read user id")?.into(),
+			email: row.try_get("email").context("Failed to read user email")?,
 			role,
 			default_publicity,
-			created_at: row.try_get("created_at")?,
-			updated_at: row.try_get("updated_at")?,
+			created_at: row.try_get("created_at").context("Failed to read user created_at")?,
+			updated_at: row.try_get("updated_at").context("Failed to read user updated_at")?,
 		})
 	}
+}
 
-	pub async fn all(ctx: &Context<'_>) -> Result<Vec<Self>, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+impl User {
+	pub async fn all(ctx: &Context<'_>) -> Result<Vec<Self>, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_ALL_USERS_QUERY).await?;
 		client.query(&statement, &[]).await?.into_iter().map(Self::try_from).collect()
 	}
@@ -123,8 +131,8 @@ impl User {
 	pub async fn by_id(
 		ctx: &Context<'_>,
 		id: i64,
-	) -> Result<Option<Self>, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+	) -> Result<Option<Self>, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_USER_BY_ID_QUERY).await?;
 		match client.query_opt(&statement, &[&id]).await? {
 			Some(row) => Ok(Some(Self::try_from(row)?)),
@@ -135,8 +143,8 @@ impl User {
 	pub async fn by_email(
 		ctx: &Context<'_>,
 		email: &str,
-	) -> Result<Option<Self>, GraphQLError> {
-		let client = ContextWrapper(ctx).get_db_client().await?;
+	) -> Result<Option<Self>, AppError> {
+		let client = ContextWrapper::new(ctx)?.db_client().await?;
 		let statement = client.prepare_cached(SELECT_USER_BY_EMAIL_QUERY).await?;
 		match client.query_opt(&statement, &[&email]).await? {
 			Some(row) => Ok(Some(Self::try_from(row)?)),
diff --git a/backend/src/graphql/queries/mutation.rs b/backend/src/graphql/queries/mutation.rs
index f2619f0..6a08fca 100644
--- a/backend/src/graphql/queries/mutation.rs
+++ b/backend/src/graphql/queries/mutation.rs
@@ -1,31 +1,26 @@
 use {
 	crate::{
 		CasbinObject,
-		CasbinUser,
 		ContextWrapper,
-		SharedState,
-		UserId,
+		GraphqlMutationCacheEffect,
+		constants::PASSWORD_RESET_RATE_LIMIT_SECONDS,
 		db::queries::{
 			ADMIN_UPDATE_USER_QUERY,
-			DELETE_OBJECT_ALLOWED_USERS_QUERY,
-			DELETE_OBJECTS_QUERY,
-			DELETE_PASSWORD_RESET_TOKEN_QUERY,
-			INSERT_OBJECT_ALLOWED_USER_QUERY,
+			DELETE_PASSWORD_RESET_TOKENS_BY_USER_QUERY,
 			INSERT_PASSWORD_RESET_TOKEN_QUERY,
 			INSERT_USER_QUERY,
+			RECENT_PASSWORD_RESET_TOKEN_EXISTS_QUERY,
 			SELECT_PASSWORD_RESET_TOKEN_QUERY,
 			SELECT_USER_COUNT_BY_EMAIL_EXCLUDING_ID_QUERY,
 			SELECT_USER_COUNT_BY_EMAIL_QUERY,
+			SELECT_USER_ID_BY_EMAIL_FOR_UPDATE_QUERY,
 			SELECT_USER_PASSWORD_HASH_BY_ID_QUERY,
 			SELECT_USER_WITH_PASSWORD_BY_EMAIL_QUERY,
-			SELECT_USERS_BY_EMAILS_QUERY,
-			UPDATE_OBJECT_QUERY,
 			UPDATE_USER_EMAIL_QUERY,
 			UPDATE_USER_PASSWORD_QUERY,
 			UPDATE_USER_PUBLICITY_QUERY,
-			UPSERT_OBJECT_QUERY,
 		},
-		email::send_password_reset_email,
+		email_worker::enqueue_password_reset_email,
 		errors::AppError,
 		graphql::objects::{
 			location::Location,
@@ -33,11 +28,18 @@ use {
 				PublicityOverride,
 				S3Object,
 			},
+			upload_session::{
+				AbortedObjectUpload,
+				CreatedObjectUploadSession,
+				PresignedObjectUploadPart,
+			},
 			user::{
 				PublicityDefault,
 				User,
 			},
 		},
+		object_lifecycle::ObjectUploadSessionCreate,
+		storage::CompletedUploadPart,
 	},
 	anyhow::Context as AnyhowContext,
 	argon2::{
@@ -45,7 +47,10 @@ use {
 		PasswordHash,
 		PasswordHasher,
 		PasswordVerifier,
-		password_hash::SaltString,
+		password_hash::{
+			SaltString,
+			rand_core::OsRng,
+		},
 	},
 	async_graphql::{
 		Context,
@@ -58,30 +63,14 @@ use {
 		Cookie,
 		SameSite,
 	},
-	casbin::CoreApi,
-	deadpool_postgres::{
-		Client,
-		Manager,
-	},
 	email_address::EmailAddress,
-	futures::future::join_all,
 	jiff::Timestamp,
-	minio::s3::{
-		Client as MinioClient,
-		builders::ObjectToDelete,
-		types::S3Api,
-	},
 	rand::{
-		Rng,
-		distributions::Alphanumeric,
-		rngs::OsRng,
-	},
-	std::sync::{
-		Arc,
-		Mutex,
+		RngExt,
+		distr::Alphanumeric,
 	},
+	std::sync::Arc,
 	time::Duration,
-	tracing,
 };
 
 #[derive(InputObject)]
@@ -95,14 +84,22 @@ pub struct UpdateS3ObjectInput {
 }
 
 #[derive(InputObject)]
-pub struct UpsertS3ObjectInput {
+pub struct CreateObjectUploadSessionInput {
 	pub name: String,
+	pub content_type: String,
+	pub file_size_bytes: i64,
 	pub made_on: Option<String>,
 	pub location: Option<Location>,
 	pub publicity: PublicityOverride,
 	pub allowed_users: Option<Vec<String>>,
 }
 
+#[derive(InputObject)]
+pub struct CompletedObjectUploadPartInput {
+	pub part_number: i32,
+	pub e_tag: String,
+}
+
 fn validate_password(password: &str) -> Result<(), AppError> {
 	if password.len() < 8 {
 		return Err(AppError::Validation(
@@ -112,244 +109,169 @@ fn validate_password(password: &str) -> Result<(), AppError> {
 	Ok(())
 }
 
+/// Builds an auth cookie with attributes that must match between login and logout.
+///
+/// Browsers refuse to overwrite a cookie when the replacement uses different attributes,
+/// so both the login (set token) and logout (expire token) paths must agree on
+/// `Secure`, `HttpOnly`, `SameSite`, and `Path`.
+fn auth_cookie(
+	value: String,
+	max_age: Option<Duration>,
+	secure: bool,
+) -> Cookie<'static> {
+	let mut builder = Cookie::build(("auth_token", value))
+		.http_only(true)
+		.secure(secure)
+		.same_site(SameSite::Lax)
+		.path("/");
+	if let Some(max_age) = max_age {
+		builder = builder.max_age(max_age);
+	}
+	builder.build()
+}
+
+fn presigned_url_expires_at(config: &crate::Config) -> Result<Timestamp, GraphQLError> {
+	Timestamp::now()
+		.checked_add(std::time::Duration::from_secs(config.storage.presigned_url_ttl_seconds))
+		.context("Failed to calculate presigned URL expiry")
+		.map_err(AppError::graphql)
+}
+
 pub struct Mutation;
 
+#[Object]
 impl Mutation {
-	pub async fn delete_s3_objects_worker(
-		db_client: &Client,
-		minio_client: &MinioClient,
-		bucket_name: &str,
-		ids: &[i64],
-	) -> Result<Vec<S3Object>, AppError> {
-		tracing::debug!("IDs to delete: {:?}", ids);
-		let statement = db_client.prepare_cached(DELETE_OBJECTS_QUERY).await?;
-		tracing::debug!("Delete DB query: {:?}", statement);
-
-		let rows = db_client.query(&statement, &[&ids]).await?;
-
-		let objects = join_all(rows.into_iter().map(S3Object::try_from))
+	async fn create_object_upload_session(
+		&self,
+		ctx: &Context<'_>,
+		input: CreateObjectUploadSessionInput,
+	) -> Result<CreatedObjectUploadSession, GraphQLError> {
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id = wrapper.user_id()?;
+		let mut client = wrapper.db_client().await?;
+
+		let session = wrapper
+			.object_lifecycle_service(&mut client)
+			.create_upload_session(ObjectUploadSessionCreate {
+				name: input.name,
+				content_type: input.content_type,
+				file_size_bytes: input.file_size_bytes,
+				made_on: input.made_on,
+				location: input.location,
+				user_id,
+				publicity: input.publicity,
+				allowed_users: input.allowed_users.unwrap_or_default(),
+			})
 			.await
-			.into_iter()
-			.collect::<Result<Vec<_>, _>>()
-			.map_err(|e| {
-				AppError::Internal(anyhow::anyhow!(
-					"Failed to convert database rows to S3 objects: {}",
-					e.message
-				))
-			})?;
-
-		let objects_to_delete: Vec<ObjectToDelete> =
-			objects.iter().map(|object| ObjectToDelete::from(&object.name)).collect();
-
-		tracing::debug!("Objects to delete: {:?}", objects_to_delete);
-
-		if !objects_to_delete.is_empty() {
-			minio_client
-				.delete_objects::<_, ObjectToDelete>(bucket_name, objects_to_delete)
-				.send()
-				.await
-				.context("Failed to delete objects from MinIO")?;
-		}
+			.map_err(AppError::graphql)?;
 
-		Ok(objects)
+		Ok(session.into())
 	}
 
-	/// Worker function to execute the update S3 object query.
-	/// It parses the timestamp, formats the location geometry, and executes the SQL query.
-	pub async fn update_s3_object_worker(
-		client: &Client,
-		id: i64,
-		name: String,
-		made_on: Option<String>,
-		location: Option<Location>,
-		publicity: PublicityOverride,
-		allowed_users: Vec<String>,
-	) -> Result<S3Object, AppError> {
-		let parsed_made_on: Option<Timestamp> = match made_on {
-			Some(timestamp_string) => Some(
-				timestamp_string
-					.parse()
-					.map_err(|e| AppError::Validation(format!("Invalid timestamp format: {e}")))?,
-			),
-			None => None,
-		};
-		let location_geometry = location.map(|location| {
-			let location_geometry =
-				format!("SRID=4326;POINT({} {})", location.longitude, location.latitude);
-			tracing::debug!("Formatted location geometry: {}", location_geometry);
-			location_geometry
-		});
-		tracing::debug!(
-			"Executing update with: id={}, name={}, made_on={:?}, location={:?}, publicity={:?}",
-			id,
-			name,
-			parsed_made_on.as_ref().map(|ts| ts.to_string()),
-			location_geometry,
-			publicity
-		);
-		let mut s3_object = S3Object::try_from(
-			client
-				.query_one(
-					&client.prepare_cached(UPDATE_OBJECT_QUERY).await?,
-					&[&id, &name, &parsed_made_on, &location_geometry, &publicity],
-				)
-				.await?,
-		)
-		.await
-		.map_err(|e| {
-			anyhow::anyhow!("Failed to convert database row to S3 object: {}", e.message)
-		})?;
-
-		// Update allowed users
-		client
-			.execute(DELETE_OBJECT_ALLOWED_USERS_QUERY, &[&id])
+	async fn presign_object_upload_parts(
+		&self,
+		ctx: &Context<'_>,
+		object_id: ID,
+		part_numbers: Vec<i32>,
+	) -> Result<Vec<PresignedObjectUploadPart>, GraphQLError> {
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id = wrapper.user_id()?;
+		let object_id =
+			object_id.parse::<i64>().context("Invalid ID format").map_err(AppError::graphql)?;
+		let mut client = wrapper.db_client().await?;
+		let state = wrapper.shared_state();
+		let url_expires_at = presigned_url_expires_at(&state.config)?;
+
+		let parts = wrapper
+			.object_lifecycle_service(&mut client)
+			.presign_upload_parts(object_id, user_id, part_numbers)
 			.await
-			.context("Failed to delete object allowed users from database")?;
-
-		let mut valid_allowed_users = Vec::new();
-
-		if !allowed_users.is_empty() {
-			let rows = client.query(SELECT_USERS_BY_EMAILS_QUERY, &[&allowed_users]).await?;
-
-			for row in rows {
-				let user_id: i64 =
-					row.try_get("id").context("Failed to get user ID from database row")?;
-				let email: String =
-					row.try_get("email").context("Failed to get email from database row")?;
-				client
-					.execute(INSERT_OBJECT_ALLOWED_USER_QUERY, &[&id, &user_id])
-					.await
-					.context("Failed to insert object allowed user into database")?;
-				valid_allowed_users.push(email);
-			}
-		}
-		s3_object.allowed_users = valid_allowed_users;
-		Ok(s3_object)
+			.map_err(AppError::graphql)?;
+
+		ctx.data::<Arc<GraphqlMutationCacheEffect>>()
+			.map_err(|e| anyhow::anyhow!(e.message).context("Mutation cache effect not found"))
+			.map_err(AppError::graphql)?
+			.mark_non_invalidating_field();
+
+		Ok(parts
+			.into_iter()
+			.map(|part| PresignedObjectUploadPart::new(part, url_expires_at))
+			.collect())
 	}
 
-	pub async fn upsert_s3_object_worker(
-		client: &Client,
-		name: String,
-		made_on: Option<String>,
-		location: Option<Location>,
-		user_id: i64,
-		publicity: PublicityOverride,
-		allowed_users: Vec<String>,
-	) -> Result<S3Object, AppError> {
-		let parsed_made_on: Option<Timestamp> = match made_on {
-			Some(timestamp_string) => Some(
-				timestamp_string
-					.parse()
-					.map_err(|e| AppError::Validation(format!("Invalid timestamp format: {e}")))?,
-			),
-			None => None,
-		};
-		let location_geometry = location.map(|location| {
-			let location_geometry =
-				format!("SRID=4326;POINT({} {})", location.longitude, location.latitude);
-			tracing::debug!("Formatted location geometry: {}", location_geometry);
-			location_geometry
-		});
-		tracing::debug!(
-			"Executing upsert with: name={}, made_on={:?}, location={:?}, user_id={}, publicity={:?}",
-			name,
-			parsed_made_on.as_ref().map(|ts| ts.to_string()),
-			location_geometry,
-			user_id,
-			publicity
-		);
-		let mut s3_object = S3Object::try_from(
-			client
-				.query_one(
-					&client.prepare_cached(UPSERT_OBJECT_QUERY).await?,
-					&[&name, &parsed_made_on, &location_geometry, &user_id, &publicity],
-				)
-				.await?,
-		)
-		.await
-		.map_err(|e| {
-			anyhow::anyhow!("Failed to convert database row to S3 object: {}", e.message)
-		})?;
-
-		let id: i64 = s3_object.id.parse().map_err(|e| {
-			AppError::Internal(anyhow::anyhow!("Failed to parse S3 object ID: {e}"))
-		})?;
-
-		// Update allowed users
-		client
-			.execute(DELETE_OBJECT_ALLOWED_USERS_QUERY, &[&id])
+	async fn complete_object_upload(
+		&self,
+		ctx: &Context<'_>,
+		object_id: ID,
+		parts: Vec<CompletedObjectUploadPartInput>,
+	) -> Result<S3Object, GraphQLError> {
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id = wrapper.user_id()?;
+		let object_id =
+			object_id.parse::<i64>().context("Invalid ID format").map_err(AppError::graphql)?;
+		let mut client = wrapper.db_client().await?;
+		let completed_parts = parts
+			.into_iter()
+			.map(|part| CompletedUploadPart {
+				part_number: part.part_number,
+				e_tag: part.e_tag,
+			})
+			.collect();
+
+		wrapper
+			.object_lifecycle_service(&mut client)
+			.complete_upload(object_id, user_id, completed_parts)
 			.await
-			.context("Failed to delete object allowed users from database")?;
-
-		let mut valid_allowed_users = Vec::new();
-
-		if !allowed_users.is_empty() {
-			let rows = client.query(SELECT_USERS_BY_EMAILS_QUERY, &[&allowed_users]).await?;
-
-			for row in rows {
-				let user_id: i64 =
-					row.try_get("id").context("Failed to get user ID from database row")?;
-				let email: String =
-					row.try_get("email").context("Failed to get email from database row")?;
-				client
-					.execute(INSERT_OBJECT_ALLOWED_USER_QUERY, &[&id, &user_id])
-					.await
-					.context("Failed to insert object allowed user into database")?;
-				valid_allowed_users.push(email);
-			}
-		}
-		s3_object.allowed_users = valid_allowed_users;
-		Ok(s3_object)
+			.map_err(AppError::graphql)
+	}
+
+	async fn abort_object_upload(
+		&self,
+		ctx: &Context<'_>,
+		object_id: ID,
+	) -> Result<AbortedObjectUpload, GraphQLError> {
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id = wrapper.user_id()?;
+		let object_id =
+			object_id.parse::<i64>().context("Invalid ID format").map_err(AppError::graphql)?;
+		let mut client = wrapper.db_client().await?;
+
+		wrapper
+			.object_lifecycle_service(&mut client)
+			.abort_upload(object_id, user_id)
+			.await
+			.map_err(AppError::graphql)?;
+
+		Ok(AbortedObjectUpload::new(object_id))
 	}
-}
 
-#[Object]
-impl Mutation {
 	async fn delete_s3_objects(
 		&self,
 		ctx: &Context<'_>,
 		ids: Vec<ID>,
 	) -> Result<Vec<S3Object>, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?.0;
-		let wrapper = ContextWrapper(ctx);
-		let bucket_name = wrapper.get_bucket_name()?;
-		let minio_client = wrapper.get_minio_client()?;
-		let client = wrapper.get_db_client().await?;
+		let wrapper = ContextWrapper::new(ctx)?;
+		let mut client = wrapper.db_client().await?;
 		let ids: Vec<i64> = ids
 			.into_iter()
-			.map(|id| id.parse::<i64>().context("Invalid ID format").map_err(GraphQLError::from))
+			.map(|id| id.parse::<i64>().context("Invalid ID format").map_err(AppError::graphql))
 			.collect::<Result<Vec<i64>, _>>()?;
 
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))
-			.map_err(GraphQLError::from)?;
-		let enforcer = state.enforcer.read().await;
-		let user =
-			User::by_id(ctx, user_id).await?.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let casbin_user = CasbinUser {
-			id: user_id,
-			role: user.role.to_string(),
-		};
-
-		let objects = S3Object::where_ids(ctx, &ids).await?;
-		for obj in &objects {
-			let casbin_obj = CasbinObject {
-				user_id: obj.user_id.unwrap_or(0),
-			};
-			enforcer
-				.enforce((casbin_user.clone(), casbin_obj, "delete"))
-				.map_err(AppError::from)?
-				.then_some(())
-				.ok_or_else(|| GraphQLError::new("Forbidden"))?;
-		}
+		let objects = S3Object::where_ids(ctx, &ids).await.map_err(AppError::graphql)?;
+		wrapper
+			.require_permission_on_each(
+				"delete",
+				objects.iter().map(|obj| CasbinObject {
+					user_id: obj.user_id.unwrap_or(0),
+				}),
+			)
+			.await?;
 
-		let result = Self::delete_s3_objects_worker(&client, minio_client, bucket_name, &ids)
+		let result = wrapper
+			.object_lifecycle_service(&mut client)
+			.delete_objects(&ids)
 			.await
-			.map_err(GraphQLError::from)?;
-
-		state.update_last_modified();
+			.map_err(AppError::graphql)?;
 
 		Ok(result)
 	}
@@ -362,106 +284,35 @@ impl Mutation {
 		ctx: &Context<'_>,
 		input: UpdateS3ObjectInput,
 	) -> Result<S3Object, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?.0;
-		let client = ContextWrapper(ctx).get_db_client().await?;
+		let wrapper = ContextWrapper::new(ctx)?;
+		let mut client = wrapper.db_client().await?;
 		let id_int =
-			input.id.parse::<i64>().context("Invalid ID format").map_err(GraphQLError::from)?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))
-			.map_err(GraphQLError::from)?;
-		let enforcer = state.enforcer.read().await;
-		let user =
-			User::by_id(ctx, user_id).await?.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let casbin_user = CasbinUser {
-			id: user_id,
-			role: user.role.to_string(),
-		};
-
-		let obj = S3Object::where_id(ctx, id_int).await?;
-		let casbin_obj = CasbinObject {
-			user_id: obj.user_id.unwrap_or(0),
-		};
-		if !enforcer.enforce((casbin_user, casbin_obj, "update")).map_err(GraphQLError::from)? {
-			return Err(GraphQLError::new("Forbidden"));
-		}
-
-		let allowed_users = input.allowed_users.unwrap_or_default();
-
-		let result = Self::update_s3_object_worker(
-			&client,
-			id_int,
-			input.name,
-			input.made_on,
-			input.location,
-			input.publicity,
-			allowed_users,
-		)
-		.await
-		.map_err(GraphQLError::from)?;
-
-		state.update_last_modified();
-
-		Ok(result)
-	}
-
-	async fn upsert_s3_object(
-		&self,
-		ctx: &Context<'_>,
-		input: UpsertS3ObjectInput,
-	) -> Result<S3Object, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?.0;
-		let client = ContextWrapper(ctx).get_db_client().await?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))
-			.map_err(GraphQLError::from)?;
-		let enforcer = state.enforcer.read().await;
-		let user =
-			User::by_id(ctx, user_id).await?.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let casbin_user = CasbinUser {
-			id: user_id,
-			role: user.role.to_string(),
-		};
-
-		if let Ok(obj) = S3Object::where_name(ctx, input.name.clone()).await {
-			let casbin_obj = CasbinObject {
-				user_id: obj.user_id.unwrap_or(0),
-			};
-			if !enforcer
-				.enforce((casbin_user.clone(), casbin_obj, "update"))
-				.map_err(GraphQLError::from)?
-			{
-				return Err(GraphQLError::new("Forbidden"));
-			}
-		} else {
-			let casbin_obj = CasbinObject {
-				user_id,
-			};
-			if !enforcer.enforce((casbin_user, casbin_obj, "create")).map_err(GraphQLError::from)? {
-				return Err(GraphQLError::new("Forbidden"));
-			}
-		}
+			input.id.parse::<i64>().context("Invalid ID format").map_err(AppError::graphql)?;
+
+		let obj = S3Object::where_id(ctx, id_int).await.map_err(AppError::graphql)?;
+		wrapper
+			.require_permission(
+				"update",
+				CasbinObject {
+					user_id: obj.user_id.unwrap_or(0),
+				},
+			)
+			.await?;
 
 		let allowed_users = input.allowed_users.unwrap_or_default();
 
-		let result = Self::upsert_s3_object_worker(
-			&client,
-			input.name,
-			input.made_on,
-			input.location,
-			user_id,
-			input.publicity,
-			allowed_users,
-		)
-		.await
-		.map_err(GraphQLError::from)?;
-
-		state.update_last_modified();
+		let result = wrapper
+			.object_lifecycle_service(&mut client)
+			.update_object_metadata(
+				id_int,
+				input.name,
+				input.made_on,
+				input.location,
+				input.publicity,
+				allowed_users,
+			)
+			.await
+			.map_err(AppError::graphql)?;
 
 		Ok(result)
 	}
@@ -471,38 +322,24 @@ impl Mutation {
 		ctx: &Context<'_>,
 		default_publicity: PublicityDefault,
 	) -> Result<User, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?.0;
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))
-			.map_err(GraphQLError::from)?;
-		let enforcer = state.enforcer.read().await;
-		let user =
-			User::by_id(ctx, user_id).await?.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let casbin_user = CasbinUser {
-			id: user_id,
-			role: user.role.to_string(),
-		};
-		let casbin_obj = CasbinObject {
-			user_id,
-		};
-
-		if !enforcer.enforce((casbin_user, casbin_obj, "update")).map_err(GraphQLError::from)? {
-			return Err(GraphQLError::new("Forbidden"));
-		}
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id = wrapper.user_id()?;
+		wrapper
+			.require_permission(
+				"update",
+				CasbinObject {
+					user_id,
+				},
+			)
+			.await?;
+		let client = wrapper.db_client().await?;
 
 		let row = client
 			.query_one(UPDATE_USER_PUBLICITY_QUERY, &[&default_publicity, &user_id])
 			.await
 			.context("Failed to update user publicity in database")?;
 
-		User::try_from(row)
-			.map_err(|e| anyhow::anyhow!("Failed to convert database row to User: {}", e.message))
-			.map_err(GraphQLError::from)
+		User::try_from(row).map_err(AppError::graphql)
 	}
 
 	async fn register(
@@ -511,18 +348,18 @@ impl Mutation {
 		email: String,
 		password: String,
 	) -> Result<User, GraphQLError> {
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
-		let state = ctx.data::<Arc<SharedState<Manager, Client>>>()?;
+		let wrapper = ContextWrapper::new(ctx)?;
+		let client = wrapper.db_client().await?;
+		let state = wrapper.shared_state();
 
-		if !state.config.enable_registration {
-			return Err(GraphQLError::new("Registration is disabled"));
+		if !state.config.auth.enable_registration {
+			return Err(AppError::Forbidden.extend_graphql());
 		}
 
-		validate_password(&password).map_err(GraphQLError::from)?;
+		validate_password(&password).map_err(AppError::graphql)?;
 
 		if !EmailAddress::is_valid(&email) {
-			return Err(GraphQLError::new("Invalid email format"));
+			return Err(AppError::Validation("Invalid email format".to_string()).extend_graphql());
 		}
 
 		// Check if email is taken
@@ -533,7 +370,7 @@ impl Mutation {
 			.context("Failed to get user count from database")?;
 
 		if count > 0 {
-			return Err(GraphQLError::new("Email already in use"));
+			return Err(AppError::Validation("Email already in use".to_string()).extend_graphql());
 		}
 
 		let salt = SaltString::generate(&mut OsRng);
@@ -541,7 +378,7 @@ impl Mutation {
 		let password_hash = argon2
 			.hash_password(password.as_bytes(), &salt)
 			.map_err(|e| anyhow::anyhow!(e).context("Failed to hash password"))
-			.map_err(GraphQLError::from)?
+			.map_err(AppError::graphql)?
 			.to_string();
 
 		let statement = client.prepare_cached(INSERT_USER_QUERY).await?;
@@ -551,9 +388,7 @@ impl Mutation {
 			.await
 			.context("Failed to insert user into database")?;
 
-		User::try_from(row)
-			.map_err(|e| anyhow::anyhow!("Failed to convert database row to User: {}", e.message))
-			.map_err(GraphQLError::from)
+		User::try_from(row).map_err(AppError::graphql)
 	}
 
 	async fn login(
@@ -562,8 +397,8 @@ impl Mutation {
 		email: String,
 		password: String,
 	) -> Result<User, GraphQLError> {
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
+		let wrapper = ContextWrapper::new(ctx)?;
+		let client = wrapper.db_client().await?;
 
 		let statement = client.prepare_cached(SELECT_USER_WITH_PASSWORD_BY_EMAIL_QUERY).await?;
 
@@ -571,45 +406,30 @@ impl Mutation {
 			.query_opt(&statement, &[&email])
 			.await
 			.context("Failed to query user from database")?
-			.ok_or_else(|| GraphQLError::new("Invalid email or password"))?;
+			.ok_or_else(|| AppError::Unauthorized.extend_graphql())?;
 
 		let password_hash_str: String = row
 			.try_get("password_hash")
 			.context("Failed to get password hash from database row")?;
-		let user = User::try_from(row).map_err(|e| {
-			anyhow::anyhow!("Failed to convert database row to User: {}", e.message)
-		})?;
+		let user = User::try_from(row).map_err(AppError::graphql)?;
 
 		let parsed_hash = PasswordHash::new(&password_hash_str)
 			.map_err(|e| anyhow::anyhow!(e).context("Failed to parse password hash from database"))
-			.map_err(GraphQLError::from)?;
+			.map_err(AppError::graphql)?;
 
 		Argon2::default()
 			.verify_password(password.as_bytes(), &parsed_hash)
-			.map_err(|_| GraphQLError::new("Invalid email or password"))?;
+			.map_err(|_| AppError::Unauthorized.extend_graphql())?;
 
-		let state = ctx.data::<Arc<SharedState<Manager, Client>>>()?;
-		let secure_cookie = state.config.frontend_url.starts_with("https");
+		let state = wrapper.shared_state();
 
-		// Set cookie
-		let cookie = Cookie::build(("auth_token", user.id.to_string()))
-			.http_only(true)
-			.secure(secure_cookie)
-			.same_site(SameSite::Lax)
-			.path("/")
-			.build();
+		let cookie = auth_cookie(user.id.to_string(), None, state.config.cookie_secure());
 
 		let cookies = ctx
-			.data::<Arc<Mutex<Vec<Cookie<'static>>>>>()
+			.data::<Arc<parking_lot::Mutex<Vec<Cookie<'static>>>>>()
 			.map_err(|e| anyhow::anyhow!(e.message).context("Cookies not found in context"))
-			.map_err(GraphQLError::from)?;
-		cookies
-			.lock()
-			.map_err(|e| {
-				tracing::error!("Mutex poisoned: {}", e);
-				GraphQLError::new("Internal server error")
-			})?
-			.push(cookie);
+			.map_err(AppError::graphql)?;
+		cookies.lock().push(cookie);
 
 		Ok(user)
 	}
@@ -618,25 +438,16 @@ impl Mutation {
 		&self,
 		ctx: &Context<'_>,
 	) -> Result<bool, GraphQLError> {
-		let cookie = Cookie::build(("auth_token", ""))
-			.http_only(true)
-			.secure(true)
-			.same_site(SameSite::Lax)
-			.path("/")
-			.max_age(Duration::seconds(0))
-			.build();
+		let wrapper = ContextWrapper::new(ctx)?;
+		let state = wrapper.shared_state();
+		let cookie =
+			auth_cookie(String::new(), Some(Duration::seconds(0)), state.config.cookie_secure());
 
 		let cookies = ctx
-			.data::<Arc<Mutex<Vec<Cookie<'static>>>>>()
+			.data::<Arc<parking_lot::Mutex<Vec<Cookie<'static>>>>>()
 			.map_err(|e| anyhow::anyhow!(e.message).context("Cookies not found in context"))
-			.map_err(GraphQLError::from)?;
-		cookies
-			.lock()
-			.map_err(|e| {
-				tracing::error!("Mutex poisoned: {}", e);
-				GraphQLError::new("Internal server error")
-			})?
-			.push(cookie);
+			.map_err(AppError::graphql)?;
+		cookies.lock().push(cookie);
 
 		Ok(true)
 	}
@@ -647,56 +458,43 @@ impl Mutation {
 		old_password: String,
 		new_password: String,
 	) -> Result<bool, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?;
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))
-			.map_err(GraphQLError::from)?;
-		let enforcer = state.enforcer.read().await;
-		let user = User::by_id(ctx, user_id.0)
-			.await?
-			.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let casbin_user = CasbinUser {
-			id: user_id.0,
-			role: user.role.to_string(),
-		};
-		let casbin_obj = CasbinObject {
-			user_id: user_id.0,
-		};
-
-		if !enforcer.enforce((casbin_user, casbin_obj, "update")).map_err(GraphQLError::from)? {
-			return Err(GraphQLError::new("Forbidden"));
-		}
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id = wrapper.user_id()?;
+		wrapper
+			.require_permission(
+				"update",
+				CasbinObject {
+					user_id,
+				},
+			)
+			.await?;
+		let client = wrapper.db_client().await?;
 
-		validate_password(&new_password).map_err(GraphQLError::from)?;
+		validate_password(&new_password).map_err(AppError::graphql)?;
 
 		let password_hash_str: String = client
-			.query_one(SELECT_USER_PASSWORD_HASH_BY_ID_QUERY, &[&user_id.0])
+			.query_one(SELECT_USER_PASSWORD_HASH_BY_ID_QUERY, &[&user_id])
 			.await?
 			.try_get("password_hash")
 			.context("Failed to get password hash from database row")?;
 
 		let parsed_hash = PasswordHash::new(&password_hash_str)
 			.map_err(|e| anyhow::anyhow!(e).context("Failed to parse password hash from database"))
-			.map_err(GraphQLError::from)?;
+			.map_err(AppError::graphql)?;
 
 		Argon2::default()
 			.verify_password(old_password.as_bytes(), &parsed_hash)
-			.map_err(|_| GraphQLError::new("Invalid old password"))?;
+			.map_err(|_| AppError::Unauthorized.extend_graphql())?;
 
 		let salt = SaltString::generate(&mut OsRng);
 		let new_hash = Argon2::default()
 			.hash_password(new_password.as_bytes(), &salt)
 			.map_err(|e| anyhow::anyhow!(e).context("Failed to hash new password"))
-			.map_err(GraphQLError::from)?
+			.map_err(AppError::graphql)?
 			.to_string();
 
 		client
-			.execute(UPDATE_USER_PASSWORD_QUERY, &[&new_hash, &user_id.0])
+			.execute(UPDATE_USER_PASSWORD_QUERY, &[&new_hash, &user_id])
 			.await
 			.context("Failed to update user password in database")?;
 
@@ -708,54 +506,39 @@ impl Mutation {
 		ctx: &Context<'_>,
 		new_email: String,
 	) -> Result<User, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?;
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))
-			.map_err(GraphQLError::from)?;
-		let enforcer = state.enforcer.read().await;
-		let user = User::by_id(ctx, user_id.0)
-			.await?
-			.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let casbin_user = CasbinUser {
-			id: user_id.0,
-			role: user.role.to_string(),
-		};
-		let casbin_obj = CasbinObject {
-			user_id: user_id.0,
-		};
-
-		if !enforcer.enforce((casbin_user, casbin_obj, "update")).map_err(GraphQLError::from)? {
-			return Err(GraphQLError::new("Forbidden"));
-		}
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id = wrapper.user_id()?;
+		wrapper
+			.require_permission(
+				"update",
+				CasbinObject {
+					user_id,
+				},
+			)
+			.await?;
+		let client = wrapper.db_client().await?;
 
 		if !EmailAddress::is_valid(&new_email) {
-			return Err(GraphQLError::new("Invalid email format"));
+			return Err(AppError::Validation("Invalid email format".to_string()).extend_graphql());
 		}
 
 		// Check if email is taken
 		let count: i64 = client
-			.query_one(SELECT_USER_COUNT_BY_EMAIL_EXCLUDING_ID_QUERY, &[&new_email, &user_id.0])
+			.query_one(SELECT_USER_COUNT_BY_EMAIL_EXCLUDING_ID_QUERY, &[&new_email, &user_id])
 			.await?
 			.try_get(0)
 			.context("Failed to get user count from database")?;
 
 		if count > 0 {
-			return Err(GraphQLError::new("Email already in use"));
+			return Err(AppError::Validation("Email already in use".to_string()).extend_graphql());
 		}
 
 		let row = client
-			.query_one(UPDATE_USER_EMAIL_QUERY, &[&new_email, &user_id.0])
+			.query_one(UPDATE_USER_EMAIL_QUERY, &[&new_email, &user_id])
 			.await
 			.context("Failed to update user email in database")?;
 
-		User::try_from(row)
-			.map_err(|e| anyhow::anyhow!("Failed to convert database row to User: {}", e.message))
-			.map_err(GraphQLError::from)
+		User::try_from(row).map_err(AppError::graphql)
 	}
 
 	async fn request_password_reset(
@@ -763,39 +546,58 @@ impl Mutation {
 		ctx: &Context<'_>,
 		email: String,
 	) -> Result<bool, GraphQLError> {
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
-		let state = ctx.data::<Arc<SharedState<Manager, Client>>>()?;
-
-		let user_opt = User::by_email(ctx, &email).await?;
-		if let Some(user) = user_opt {
-			let token: String =
-				rand::thread_rng().sample_iter(&Alphanumeric).take(32).map(char::from).collect();
+		let wrapper = ContextWrapper::new(ctx)?;
+		let mut client = wrapper.db_client().await?;
+		let transaction = client.transaction().await?;
+		let user_id_int: Option<i64> = transaction
+			.query_opt(SELECT_USER_ID_BY_EMAIL_FOR_UPDATE_QUERY, &[&email])
+			.await
+			.context("Failed to lock password reset target user")?
+			.map(|row| row.try_get::<_, i64>("id"))
+			.transpose()
+			.context("Failed to read password reset target user id")?;
+		let Some(user_id_int) = user_id_int else {
+			// Always succeed to avoid user enumeration.
+			transaction.commit().await?;
+			return Ok(true);
+		};
 
-			let token_hash = blake3::hash(token.as_bytes()).to_string();
+		// Rate limit: skip silently if a recent token already exists. This check is
+		// inside the user-row lock so concurrent requests cannot enqueue duplicates.
+		let recent: bool = transaction
+			.query_one(
+				RECENT_PASSWORD_RESET_TOKEN_EXISTS_QUERY,
+				&[&user_id_int, &PASSWORD_RESET_RATE_LIMIT_SECONDS],
+			)
+			.await
+			.context("Failed to check recent password reset tokens")?
+			.try_get(0)
+			.context("Failed to read recent-token existence")?;
+		if recent {
+			transaction.commit().await?;
+			return Ok(true);
+		}
 
-			let user_id_int = user
-				.id
-				.parse::<i64>()
-				.context("Failed to parse user ID")
-				.map_err(GraphQLError::from)?;
+		let token: String =
+			rand::rng().sample_iter(Alphanumeric).take(32).map(char::from).collect();
+		let token_hash = blake3::hash(token.as_bytes()).to_string();
 
-			// Expires in 10 minutes
-			client
-				.execute(INSERT_PASSWORD_RESET_TOKEN_QUERY, &[&token_hash, &user_id_int])
-				.await
-				.context("Failed to insert password reset token into database")?;
+		// Invalidate sibling tokens, insert the new token, and enqueue the email in
+		// one DB transaction. SMTP happens later in the worker, outside request locks.
+		transaction
+			.execute(DELETE_PASSWORD_RESET_TOKENS_BY_USER_QUERY, &[&user_id_int])
+			.await
+			.context("Failed to invalidate existing password reset tokens")?;
+		transaction
+			.execute(INSERT_PASSWORD_RESET_TOKEN_QUERY, &[&token_hash, &user_id_int])
+			.await
+			.context("Failed to insert password reset token into database")?;
+		enqueue_password_reset_email(&transaction, &email, &token)
+			.await
+			.map_err(AppError::graphql)?;
 
-			// Send email
-			// We spawn this to not block the request, but we need to handle errors.
-			// For now, let's await it.
-			send_password_reset_email(&state.config, &email, &token)
-				.await
-				.context("Failed to send password reset email")
-				.map_err(|e| AppError::from(e).extend_graphql())?;
-		}
+		transaction.commit().await?;
 
-		// Always return true to prevent user enumeration
 		Ok(true)
 	}
 
@@ -805,10 +607,10 @@ impl Mutation {
 		token: String,
 		new_password: String,
 	) -> Result<bool, GraphQLError> {
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
+		let wrapper = ContextWrapper::new(ctx)?;
+		let client = wrapper.db_client().await?;
 
-		validate_password(&new_password).map_err(GraphQLError::from)?;
+		validate_password(&new_password).map_err(AppError::graphql)?;
 
 		let token_hash = blake3::hash(token.as_bytes()).to_string();
 
@@ -825,7 +627,7 @@ impl Mutation {
 			let new_hash = Argon2::default()
 				.hash_password(new_password.as_bytes(), &salt)
 				.map_err(|e| anyhow::anyhow!(e).context("Failed to hash new password"))
-				.map_err(GraphQLError::from)?
+				.map_err(AppError::graphql)?
 				.to_string();
 
 			client
@@ -833,15 +635,17 @@ impl Mutation {
 				.await
 				.context("Failed to update user password in database")?;
 
-			// Delete token
+			// Invalidate all outstanding reset tokens for this user, not just the consumed one.
+			// Prevents an attacker who triggered a second reset request from holding a working
+			// bypass after the legitimate user changes their password.
 			client
-				.execute(DELETE_PASSWORD_RESET_TOKEN_QUERY, &[&token_hash])
+				.execute(DELETE_PASSWORD_RESET_TOKENS_BY_USER_QUERY, &[&user_id])
 				.await
-				.context("Failed to delete password reset token from database")?;
+				.context("Failed to delete password reset tokens from database")?;
 
 			Ok(true)
 		} else {
-			Err(GraphQLError::new("Invalid or expired token"))
+			Err(AppError::Validation("Invalid or expired token".to_string()).extend_graphql())
 		}
 	}
 
@@ -852,44 +656,31 @@ impl Mutation {
 		role: Option<String>,
 		email: Option<String>,
 	) -> Result<User, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?;
-		let wrapper = ContextWrapper(ctx);
-		let client = wrapper.get_db_client().await?;
+		let wrapper = ContextWrapper::new(ctx)?;
+		let client = wrapper.db_client().await?;
 
 		let target_id =
-			id.parse::<i64>().context("Invalid ID format").map_err(GraphQLError::from)?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))
-			.map_err(GraphQLError::from)?;
-		let enforcer = state.enforcer.read().await;
-		let current_user = User::by_id(ctx, user_id.0)
-			.await?
-			.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let casbin_user = CasbinUser {
-			id: user_id.0,
-			role: current_user.role.to_string(),
-		};
-		let casbin_obj = CasbinObject {
-			user_id: target_id,
-		};
-
-		if !enforcer
-			.enforce((casbin_user, casbin_obj, "manage_user"))
-			.map_err(GraphQLError::from)?
-		{
-			return Err(GraphQLError::new("Forbidden"));
-		}
+			id.parse::<i64>().context("Invalid ID format").map_err(AppError::graphql)?;
+
+		wrapper
+			.require_permission(
+				"manage_user",
+				CasbinObject {
+					user_id: target_id,
+				},
+			)
+			.await?;
 
 		let mut target_user = User::by_id(ctx, target_id)
-			.await?
-			.ok_or_else(|| GraphQLError::new("User not found"))?;
+			.await
+			.map_err(AppError::graphql)?
+			.ok_or_else(|| AppError::NotFound("User not found".to_string()).extend_graphql())?;
 
 		if let Some(new_email) = email {
 			if !EmailAddress::is_valid(&new_email) {
-				return Err(GraphQLError::new("Invalid email format"));
+				return Err(
+					AppError::Validation("Invalid email format".to_string()).extend_graphql()
+				);
 			}
 
 			// Check email uniqueness if changed
@@ -900,13 +691,17 @@ impl Mutation {
 				.context("Failed to get user count from database")?;
 
 			if count > 0 {
-				return Err(GraphQLError::new("Email already in use"));
+				return Err(
+					AppError::Validation("Email already in use".to_string()).extend_graphql()
+				);
 			}
 			target_user.email = new_email;
 		}
 
 		if let Some(new_role_str) = role {
-			let new_role = new_role_str.parse().map_err(|_| GraphQLError::new("Invalid role"))?;
+			let new_role = new_role_str
+				.parse()
+				.map_err(|_| AppError::Validation("Invalid role".to_string()).extend_graphql())?;
 			target_user.role = new_role;
 		}
 
@@ -918,8 +713,6 @@ impl Mutation {
 			.await
 			.context("Failed to update user in database")?;
 
-		User::try_from(row)
-			.map_err(|e| anyhow::anyhow!("Failed to convert database row to User: {}", e.message))
-			.map_err(GraphQLError::from)
+		User::try_from(row).map_err(AppError::graphql)
 	}
 }
diff --git a/backend/src/graphql/queries/query.rs b/backend/src/graphql/queries/query.rs
index 5e4cb89..f7d7a86 100644
--- a/backend/src/graphql/queries/query.rs
+++ b/backend/src/graphql/queries/query.rs
@@ -1,9 +1,8 @@
 use {
 	crate::{
 		CasbinObject,
-		CasbinUser,
-		SharedState,
-		UserId,
+		ContextWrapper,
+		errors::AppError,
 		graphql::objects::{
 			config::PublicConfig,
 			s3_object::S3Object,
@@ -15,12 +14,6 @@ use {
 		Error as GraphQLError,
 		Object,
 	},
-	casbin::CoreApi,
-	deadpool_postgres::{
-		Client,
-		Manager,
-	},
-	std::sync::Arc,
 };
 
 pub struct Query;
@@ -31,11 +24,10 @@ impl Query {
 		&self,
 		ctx: &Context<'_>,
 	) -> Result<PublicConfig, GraphQLError> {
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))?;
+		let wrapper = ContextWrapper::new(ctx)?;
+		let state = wrapper.shared_state();
 		Ok(PublicConfig {
-			enable_registration: state.config.enable_registration,
+			enable_registration: state.config.auth.enable_registration,
 		})
 	}
 
@@ -43,8 +35,9 @@ impl Query {
 		&self,
 		ctx: &Context<'_>,
 	) -> Result<Option<User>, GraphQLError> {
-		if let Some(user_id) = ctx.data_opt::<UserId>() {
-			User::by_id(ctx, user_id.0).await
+		let wrapper = ContextWrapper::new(ctx)?;
+		if let Some(user_id) = wrapper.user_id_opt() {
+			User::by_id(ctx, user_id).await.map_err(AppError::graphql)
 		} else {
 			Ok(None)
 		}
@@ -54,33 +47,16 @@ impl Query {
 		&self,
 		ctx: &Context<'_>,
 	) -> Result<Vec<User>, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?.0;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))?;
-		let enforcer = state.enforcer.read().await;
-		let user =
-			User::by_id(ctx, user_id).await?.ok_or_else(|| GraphQLError::new("User not found"))?;
-
-		let casbin_user = CasbinUser {
-			id: user_id,
-			role: user.role.to_string(),
-		};
-		// Dummy object for system-level permission
-		let casbin_obj = CasbinObject {
-			user_id: 0,
-		};
-
-		if !enforcer
-			.enforce((casbin_user, casbin_obj, "read_all_users"))
-			.map_err(GraphQLError::from)?
-		{
-			return Err(GraphQLError::new("Forbidden"));
-		}
-
-		User::all(ctx).await
+		let wrapper = ContextWrapper::new(ctx)?;
+		wrapper
+			.require_permission(
+				"read_all_users",
+				CasbinObject {
+					user_id: 0,
+				},
+			)
+			.await?;
+		User::all(ctx).await.map_err(AppError::graphql)
 	}
 
 	async fn s3_object_by_id(
@@ -88,28 +64,16 @@ impl Query {
 		ctx: &Context<'_>,
 		id: i64,
 	) -> Result<S3Object, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?.0;
-		let user =
-			User::by_id(ctx, user_id).await?.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let object = S3Object::where_id(ctx, id).await?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))?;
-		let enforcer = state.enforcer.read().await;
-		let casbin_user = CasbinUser {
-			id: user_id,
-			role: user.role.to_string(),
-		};
-		let casbin_obj = CasbinObject {
-			user_id: object.user_id.unwrap_or(0),
-		};
-
-		if !enforcer.enforce((casbin_user, casbin_obj, "read")).map_err(GraphQLError::from)? {
-			return Err(GraphQLError::new("Forbidden"));
-		}
-
+		let wrapper = ContextWrapper::new(ctx)?;
+		let object = S3Object::where_id(ctx, id).await.map_err(AppError::graphql)?;
+		wrapper
+			.require_permission(
+				"read",
+				CasbinObject {
+					user_id: object.user_id.unwrap_or(0),
+				},
+			)
+			.await?;
 		Ok(object)
 	}
 
@@ -118,28 +82,16 @@ impl Query {
 		ctx: &Context<'_>,
 		name: String,
 	) -> Result<S3Object, GraphQLError> {
-		let user_id = ctx.data_opt::<UserId>().ok_or_else(|| GraphQLError::new("Unauthorized"))?.0;
-		let user =
-			User::by_id(ctx, user_id).await?.ok_or_else(|| GraphQLError::new("User not found"))?;
-		let object = S3Object::where_name(ctx, name).await?;
-
-		// Check permissions
-		let state = ctx
-			.data::<Arc<SharedState<Manager, Client>>>()
-			.map_err(|e| anyhow::anyhow!(e.message).context("Shared state not found in context"))?;
-		let enforcer = state.enforcer.read().await;
-		let casbin_user = CasbinUser {
-			id: user_id,
-			role: user.role.to_string(),
-		};
-		let casbin_obj = CasbinObject {
-			user_id: object.user_id.unwrap_or(0),
-		};
-
-		if !enforcer.enforce((casbin_user, casbin_obj, "read")).map_err(GraphQLError::from)? {
-			return Err(GraphQLError::new("Forbidden"));
-		}
-
+		let wrapper = ContextWrapper::new(ctx)?;
+		let object = S3Object::where_name(ctx, name).await.map_err(AppError::graphql)?;
+		wrapper
+			.require_permission(
+				"read",
+				CasbinObject {
+					user_id: object.user_id.unwrap_or(0),
+				},
+			)
+			.await?;
 		Ok(object)
 	}
 
@@ -147,34 +99,22 @@ impl Query {
 		&self,
 		ctx: &Context<'_>,
 	) -> Result<Vec<S3Object>, GraphQLError> {
-		let user_id_opt = ctx.data_opt::<UserId>().map(|u| u.0);
-
-		if let Some(user_id) = user_id_opt {
-			let user = User::by_id(ctx, user_id)
+		let wrapper = ContextWrapper::new(ctx)?;
+		let user_id_opt = wrapper.user_id_opt();
+
+		if wrapper.caller_identity_opt().is_some() &&
+			wrapper
+				.has_permission(
+					"read_all_s3_objects",
+					CasbinObject {
+						user_id: 0,
+					},
+				)
 				.await?
-				.ok_or_else(|| GraphQLError::new("User not found"))?;
-
-			// Check permissions
-			let state = ctx.data::<Arc<SharedState<Manager, Client>>>().map_err(|e| {
-				anyhow::anyhow!(e.message).context("Shared state not found in context")
-			})?;
-			let enforcer = state.enforcer.read().await;
-			let casbin_user = CasbinUser {
-				id: user_id,
-				role: user.role.to_string(),
-			};
-			let casbin_obj = CasbinObject {
-				user_id: 0,
-			}; // System level object
-
-			if enforcer
-				.enforce((casbin_user, casbin_obj, "read_all_s3_objects"))
-				.map_err(GraphQLError::from)?
-			{
-				return S3Object::all(ctx).await;
-			}
+		{
+			return S3Object::all(ctx).await.map_err(AppError::graphql);
 		}
 
-		S3Object::visible_to_user(ctx, user_id_opt).await
+		S3Object::visible_to_user(ctx, user_id_opt).await.map_err(AppError::graphql)
 	}
 }
diff --git a/backend/src/lib.rs b/backend/src/lib.rs
index 0755d90..9432f74 100644
--- a/backend/src/lib.rs
+++ b/backend/src/lib.rs
@@ -1,4 +1,3 @@
-// Force recompile
 use {
 	async_graphql::{
 		Context,
@@ -8,6 +7,10 @@ use {
 	axum::{
 		body::Bytes,
 		extract::FromRef,
+		http::{
+			HeaderMap,
+			StatusCode,
+		},
 		response::{
 			self,
 			IntoResponse,
@@ -21,68 +24,267 @@ use {
 		Pool,
 	},
 	deadpool_postgres::Manager,
-	minio::s3,
 	moka::future::Cache,
 	std::{
 		fmt,
 		sync::{
 			Arc,
-			atomic::AtomicU64,
-		},
-		time::{
-			SystemTime,
-			UNIX_EPOCH,
+			atomic::{
+				AtomicU64,
+				AtomicUsize,
+				Ordering,
+			},
 		},
 	},
 	tokio::sync::RwLock,
 };
 
+pub mod app;
 pub mod constants;
-pub mod controllers;
 pub mod db;
 pub mod email;
+pub mod email_worker;
 pub mod errors;
 pub mod graphql;
+pub mod object_lifecycle;
+pub mod outbox;
+pub mod storage;
+pub mod worker;
+
+use {
+	email_worker::EmailOutboxConfig,
+	object_lifecycle::{
+		ObjectLifecycleConfig,
+		ObjectLifecycleService,
+	},
+	serde::Deserialize,
+	storage::{
+		StorageClient,
+		StorageConfig,
+	},
+};
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct ServerConfig {
+	pub host: String,
+	pub port: u16,
+}
 
-#[derive(Debug, serde::Deserialize, Clone)]
+#[derive(Clone, Deserialize)]
+pub struct SmtpConfig {
+	pub host: String,
+	pub user: String,
+	pub pass: String,
+	pub from: String,
+}
+
+impl fmt::Debug for SmtpConfig {
+	fn fmt(
+		&self,
+		f: &mut fmt::Formatter<'_>,
+	) -> fmt::Result {
+		f.debug_struct("SmtpConfig")
+			.field("host", &self.host)
+			.field("user", &self.user)
+			.field("pass", &"<redacted>")
+			.field("from", &self.from)
+			.finish()
+	}
+}
+
+#[derive(Clone, Deserialize)]
+pub struct AuthConfig {
+	pub cookie_secret: String,
+	pub enable_registration: bool,
+	#[serde(default)]
+	pub cookie_secure: Option<bool>,
+}
+
+impl AuthConfig {
+	const MIN_COOKIE_SECRET_BYTES: usize = 64;
+
+	pub fn validate(&self) -> anyhow::Result<()> {
+		if self.cookie_secret.len() < Self::MIN_COOKIE_SECRET_BYTES {
+			anyhow::bail!(
+				"auth.cookie_secret must be at least {} bytes",
+				Self::MIN_COOKIE_SECRET_BYTES
+			);
+		}
+		Ok(())
+	}
+}
+
+impl fmt::Debug for AuthConfig {
+	fn fmt(
+		&self,
+		f: &mut fmt::Formatter<'_>,
+	) -> fmt::Result {
+		f.debug_struct("AuthConfig")
+			.field("cookie_secret", &"<redacted>")
+			.field("enable_registration", &self.enable_registration)
+			.field("cookie_secure", &self.cookie_secure)
+			.finish()
+	}
+}
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct FrontendConfig {
+	pub url: String,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct CorsConfig {
+	pub allowed_origins: String,
+}
+
+#[derive(Clone, Deserialize)]
 pub struct Config {
 	pub pg: deadpool_postgres::Config,
-	pub enable_registration: bool,
-	pub smtp_host: String,
-	pub smtp_user: String,
-	pub smtp_pass: String,
-	pub smtp_from: String,
-	pub cookie_secret: String,
-	pub frontend_url: String,
-	pub minio_access_key: String,
-	pub minio_secret_key: String,
-	pub minio_url: String,
-	pub s3_bucket_name: String,
-	pub server_host: String,
-	pub server_port: u16,
-	pub cors_allowed_origins: String,
+	pub server: ServerConfig,
+	pub smtp: SmtpConfig,
+	pub auth: AuthConfig,
+	pub frontend: FrontendConfig,
+	pub cors: CorsConfig,
+	pub storage: StorageConfig,
+	#[serde(default)]
+	pub object_lifecycle: ObjectLifecycleConfig,
+	#[serde(default)]
+	pub email_outbox: EmailOutboxConfig,
 }
 
 impl Config {
-	pub fn from_env() -> Result<Self, errors::AppError> {
-		let cfg = config::Config::builder()
-			.add_source(config::Environment::default().separator("__"))
+	/// Whether auth cookies should carry the `Secure` attribute.
+	///
+	/// Explicit config wins; otherwise derive from the frontend URL so login and
+	/// logout agree on the cookie shape. Without that the browser may refuse the
+	/// logout overwrite.
+	pub fn cookie_secure(&self) -> bool {
+		self.auth.cookie_secure.unwrap_or_else(|| self.frontend.url.starts_with("https"))
+	}
+
+	/// Loads, deserializes, and validates the configuration.
+	///
+	/// An optional TOML file (selected by the `MEMORY_MAP_CONFIG` env var) is read
+	/// first, then the environment is layered on top so env always wins. When
+	/// `MEMORY_MAP_CONFIG` is unset, no file source is added and loading is
+	/// pure-environment, identical to the previous env-only behaviour. Env vars
+	/// share the `MEMORY_MAP__` prefix with `__` as both the prefix and the
+	/// nested-path separator, so `MEMORY_MAP__STORAGE__ENDPOINT_URL` maps to
+	/// `config.storage.endpoint_url`.
+	pub fn load() -> Result<Self, errors::AppError> {
+		let mut builder = config::Config::builder();
+		// The file is opt-in and, when requested, required: a missing or unreadable
+		// path is a loud startup error rather than a silent fall-through to defaults.
+		if let Ok(path) = std::env::var("MEMORY_MAP_CONFIG") {
+			builder = builder
+				.add_source(config::File::new(&path, config::FileFormat::Toml).required(true));
+		}
+		let raw = builder
+			.add_source(
+				config::Environment::with_prefix("MEMORY_MAP")
+					.prefix_separator("__")
+					.separator("__"),
+			)
 			.build()
 			.map_err(errors::AppError::from)?;
-		cfg.try_deserialize().map_err(errors::AppError::from)
+		let config: Config = raw.try_deserialize().map_err(errors::AppError::from)?;
+		config.validated().map_err(errors::AppError::from)
+	}
+
+	/// Runs sub-config validation. Call after deserialization or struct construction.
+	pub fn validated(self) -> anyhow::Result<Self> {
+		self.auth.validate()?;
+		self.storage.validate()?;
+		self.object_lifecycle.validate()?;
+		self.email_outbox.validate()?;
+		Ok(self)
+	}
+}
+
+impl fmt::Debug for Config {
+	fn fmt(
+		&self,
+		f: &mut fmt::Formatter<'_>,
+	) -> fmt::Result {
+		f.debug_struct("Config")
+			.field("pg", &"<redacted>")
+			.field("server", &self.server)
+			.field("smtp", &self.smtp)
+			.field("auth", &self.auth)
+			.field("frontend", &self.frontend)
+			.field("cors", &self.cors)
+			.field("storage", &self.storage)
+			.field("object_lifecycle", &self.object_lifecycle)
+			.field("email_outbox", &self.email_outbox)
+			.finish()
 	}
 }
 
 refinery::embed_migrations!("migrations");
 
-pub struct UserId(pub i64);
+#[derive(Clone, Debug)]
+pub struct CallerIdentity {
+	pub user_id: i64,
+	pub casbin_user: CasbinUser,
+}
+
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
+pub struct GraphqlResponseCacheKey([u8; 32]);
+
+impl GraphqlResponseCacheKey {
+	pub fn new(bytes: [u8; 32]) -> Self {
+		Self(bytes)
+	}
+}
+
+/// A previously-computed GraphQL query response cached for replay.
+///
+/// The cache stores only successful query responses. Mutations never read from
+/// it, and successful writes invalidate it centrally.
+#[derive(Clone, Debug)]
+pub struct CachedGraphqlResponse {
+	pub status: StatusCode,
+	pub headers: HeaderMap,
+	pub bytes: Bytes,
+}
+
+impl CachedGraphqlResponse {
+	/// Byte cost of an entry, used by the response cache weigher.
+	pub fn weight(&self) -> u32 {
+		let header_bytes = self
+			.headers
+			.iter()
+			.map(|(name, value)| name.as_str().len().saturating_add(value.len()))
+			.sum::<usize>();
+		u32::try_from(self.bytes.len().saturating_add(header_bytes)).unwrap_or(u32::MAX)
+	}
+}
+
+/// Per-request mutation cache effect accounting.
+///
+/// Mutation resolvers that do not change query-visible state may mark their root
+/// field as non-invalidating. The handler suppresses global invalidation only
+/// when every root mutation field in the operation was marked this way.
+#[derive(Debug, Default)]
+pub struct GraphqlMutationCacheEffect {
+	non_invalidating_field_count: AtomicUsize,
+}
+
+impl GraphqlMutationCacheEffect {
+	pub fn mark_non_invalidating_field(&self) {
+		self.non_invalidating_field_count.fetch_add(1, Ordering::AcqRel);
+	}
+
+	pub fn non_invalidating_field_count(&self) -> usize {
+		self.non_invalidating_field_count.load(Ordering::Acquire)
+	}
+}
 
 pub struct SharedState<M: ManagedManager, W: From<Object<M>>> {
 	pub pool: Pool<M, W>,
-	pub minio_client: s3::Client,
-	pub bucket_name: String,
-	pub last_modified: AtomicU64,
-	pub response_cache: Cache<u64, Bytes>,
+	pub storage: StorageClient,
+	pub graphql_response_cache_epoch: AtomicU64,
+	pub graphql_response_cache: Cache<GraphqlResponseCacheKey, CachedGraphqlResponse>,
 	pub key: Key,
 	pub config: Config,
 	pub enforcer: Arc<RwLock<Enforcer>>,
@@ -95,16 +297,13 @@ impl<M: ManagedManager, W: From<Object<M>>> FromRef<SharedState<M, W>> for Key {
 }
 
 impl<M: ManagedManager, W: From<Object<M>>> SharedState<M, W> {
-	pub fn update_last_modified(&self) {
-		let now = SystemTime::now()
-			.duration_since(UNIX_EPOCH)
-			.map(|d| d.as_millis() as u64)
-			.unwrap_or_else(|e| {
-				tracing::error!("System time is before UNIX EPOCH: {}", e);
-				0
-			});
-		self.last_modified.store(now, std::sync::atomic::Ordering::Relaxed);
-		self.response_cache.invalidate_all();
+	pub fn graphql_response_cache_epoch(&self) -> u64 {
+		self.graphql_response_cache_epoch.load(Ordering::Acquire)
+	}
+
+	pub fn invalidate_graphql_response_cache(&self) {
+		self.graphql_response_cache_epoch.fetch_add(1, Ordering::AcqRel);
+		self.graphql_response_cache.invalidate_all();
 	}
 }
 
@@ -139,37 +338,124 @@ impl<M: ManagedManager, W: From<Object<M>>> fmt::Debug for SharedState<M, W> {
 	) -> fmt::Result {
 		f.debug_struct("SharedState")
 			.field("pool", &"Pool")
-			.field("minio_client", &self.minio_client)
-			.field("bucket_name", &self.bucket_name)
-			.field("last_modified", &self.last_modified)
-			.field("response_cache", &"Cache<u64, Bytes>")
+			.field("storage", &self.storage)
 			.field("enforcer", &"Enforcer")
 			.finish()
 	}
 }
 
-pub struct ContextWrapper<'a>(&'a Context<'a>);
+pub struct ContextWrapper<'a> {
+	state: &'a Arc<SharedState<Manager, deadpool_postgres::Client>>,
+	caller_identity: Option<&'a CallerIdentity>,
+}
 
 impl<'a> ContextWrapper<'a> {
-	pub async fn get_db_client(&self) -> Result<Object<Manager>, GraphQLError> {
-		let pool: &Pool<Manager> =
-			&self.0.data::<std::sync::Arc<SharedState<Manager, deadpool_postgres::Client>>>()?.pool;
-		Ok(pool.get().await?)
+	pub fn new(ctx: &'a Context<'a>) -> Result<Self, GraphQLError> {
+		let state = ctx
+			.data::<std::sync::Arc<SharedState<Manager, deadpool_postgres::Client>>>()
+			.map_err(|e| {
+				errors::AppError::Internal(anyhow::anyhow!(
+					"Shared state not found in context: {}",
+					e.message
+				))
+			})
+			.map_err(errors::AppError::graphql)?;
+		Ok(Self {
+			state,
+			caller_identity: ctx.data_opt::<CallerIdentity>(),
+		})
+	}
+
+	pub fn shared_state(&self) -> &'a Arc<SharedState<Manager, deadpool_postgres::Client>> {
+		self.state
 	}
 
-	pub fn get_minio_client(&self) -> Result<&s3::Client, GraphQLError> {
-		Ok(&self
-			.0
-			.data::<std::sync::Arc<SharedState<Manager, deadpool_postgres::Client>>>()?
-			.minio_client)
+	pub async fn db_client(&self) -> Result<Object<Manager>, GraphQLError> {
+		self.state.pool.get().await.map_err(errors::AppError::graphql)
 	}
 
-	pub fn get_bucket_name(&self) -> Result<&str, GraphQLError> {
-		Ok(self
-			.0
-			.data::<std::sync::Arc<SharedState<Manager, deadpool_postgres::Client>>>()?
-			.bucket_name
-			.as_str())
+	pub fn storage_client(&self) -> &StorageClient {
+		&self.state.storage
+	}
+
+	/// Builds an [`ObjectLifecycleService`] borrowing this request's storage client
+	/// and lifecycle config, over the caller-provided database client. Centralises
+	/// the wiring (and the config clone) the object-lifecycle mutations all repeat.
+	pub fn object_lifecycle_service<'c>(
+		&'c self,
+		client: &'c mut Object<Manager>,
+	) -> ObjectLifecycleService<'c> {
+		ObjectLifecycleService::new(
+			client,
+			&self.state.storage,
+			self.state.config.object_lifecycle.clone(),
+		)
+	}
+
+	pub fn caller_identity(&self) -> Result<&CallerIdentity, GraphQLError> {
+		self.caller_identity.ok_or_else(|| errors::AppError::Unauthorized.extend_graphql())
+	}
+
+	pub fn caller_identity_opt(&self) -> Option<&CallerIdentity> {
+		self.caller_identity
+	}
+
+	pub fn user_id(&self) -> Result<i64, GraphQLError> {
+		Ok(self.caller_identity()?.user_id)
+	}
+
+	pub fn user_id_opt(&self) -> Option<i64> {
+		self.caller_identity.map(|identity| identity.user_id)
+	}
+
+	pub async fn has_permission(
+		&self,
+		action: &str,
+		target: CasbinObject,
+	) -> Result<bool, GraphQLError> {
+		use {
+			casbin::CoreApi,
+			errors::AppError,
+		};
+
+		let caller_identity = self.caller_identity()?;
+		let enforcer = self.state.enforcer.read().await;
+		enforcer
+			.enforce((caller_identity.casbin_user.clone(), target, action))
+			.map_err(AppError::graphql)
+	}
+
+	pub async fn require_permission(
+		&self,
+		action: &str,
+		target: CasbinObject,
+	) -> Result<(), GraphQLError> {
+		self.require_permission_on_each(action, [target]).await
+	}
+
+	pub async fn require_permission_on_each<I>(
+		&self,
+		action: &str,
+		targets: I,
+	) -> Result<(), GraphQLError>
+	where
+		I: IntoIterator<Item = CasbinObject>, {
+		use {
+			casbin::CoreApi,
+			errors::AppError,
+		};
+
+		let caller_identity = self.caller_identity()?;
+		let enforcer = self.state.enforcer.read().await;
+		for target in targets {
+			if !enforcer
+				.enforce((caller_identity.casbin_user.clone(), target, action))
+				.map_err(AppError::graphql)?
+			{
+				return Err(AppError::Forbidden.extend_graphql());
+			}
+		}
+		Ok(())
 	}
 }
 
@@ -191,25 +477,87 @@ pub fn parse_longitude(longitude: f64) -> Result<f64, errors::AppError> {
 	Err(errors::AppError::Validation(format!("{longitude} is not a valid longitude value.")))
 }
 
-#[derive(Clone, serde::Serialize, Hash, Eq, PartialEq)]
+#[derive(Clone, Debug, serde::Serialize, Hash, Eq, PartialEq)]
 pub struct CasbinUser {
 	pub id: i64,
 	pub role: String,
 }
 
-#[derive(Clone, serde::Serialize, Hash, Eq, PartialEq)]
+#[derive(Clone, Debug, serde::Serialize, Hash, Eq, PartialEq)]
 pub struct CasbinObject {
 	pub user_id: i64,
 }
 
 #[cfg(test)]
 mod tests {
-	use super::{
-		errors::AppError,
-		parse_latitude,
-		parse_longitude,
+	use {
+		super::{
+			AuthConfig,
+			Config,
+			CorsConfig,
+			FrontendConfig,
+			ServerConfig,
+			SmtpConfig,
+			email_worker::EmailOutboxConfig,
+			errors::AppError,
+			object_lifecycle::ObjectLifecycleConfig,
+			parse_latitude,
+			parse_longitude,
+			storage::StorageConfig,
+		},
+		deadpool_postgres::Config as PostgresConfig,
 	};
 
+	#[test]
+	fn config_example_toml_deserializes_into_config() {
+		// Guards against drift between config.example.toml and the Config structs:
+		// a renamed or removed field there fails to deserialize here. Only the
+		// structural mapping is checked; validation is not run because the example
+		// intentionally leaves secrets blank.
+		let parsed = config::Config::builder()
+			.add_source(config::File::from_str(
+				include_str!("../../config.example.toml"),
+				config::FileFormat::Toml,
+			))
+			.build()
+			.and_then(|raw| raw.try_deserialize::<Config>());
+		assert!(parsed.is_ok(), "config.example.toml should map onto Config: {parsed:?}");
+	}
+
+	#[test]
+	fn env_example_deserializes_into_config() {
+		// The `.env.example` counterpart of the TOML drift guard above. The
+		// `MEMORY_MAP__*` pairs are fed through the same `config::Environment`
+		// source `Config::load` uses (same prefix and `__` separators), so a
+		// renamed or removed key, or a new required field missing from the example,
+		// fails to deserialize here. Non-prefixed entries (e.g. RUST_LOG,
+		// BUILD_MODE) are ignored by the prefix filter. Only the structural mapping
+		// is checked; validation is not run because the placeholder secrets are not
+		// meant to pass `validate`.
+		let source: std::collections::HashMap<String, String> = include_str!("../../.env.example")
+			.lines()
+			.filter_map(|line| {
+				let line = line.trim();
+				if line.is_empty() || line.starts_with('#') {
+					return None;
+				}
+				let (key, value) = line.split_once('=')?;
+				Some((key.trim().to_string(), value.trim().trim_matches('"').to_string()))
+			})
+			.collect();
+
+		let parsed = config::Config::builder()
+			.add_source(
+				config::Environment::with_prefix("MEMORY_MAP")
+					.prefix_separator("__")
+					.separator("__")
+					.source(Some(source)),
+			)
+			.build()
+			.and_then(|raw| raw.try_deserialize::<Config>());
+		assert!(parsed.is_ok(), ".env.example should map onto Config: {parsed:?}");
+	}
+
 	#[test]
 	fn parse_latitude_accepts_boundary_values() {
 		assert!(parse_latitude(-90.0).is_ok());
@@ -235,4 +583,191 @@ mod tests {
 		assert!(matches!(parse_longitude(-180.1), Err(AppError::Validation(_))));
 		assert!(matches!(parse_longitude(180.1), Err(AppError::Validation(_))));
 	}
+
+	#[test]
+	fn app_config_debug_redacts_secrets() {
+		let config = Config {
+			pg: PostgresConfig::new(),
+			server: ServerConfig {
+				host: "127.0.0.1".to_string(),
+				port: 8000,
+			},
+			smtp: SmtpConfig {
+				host: "smtp.example.test".to_string(),
+				user: "debug-smtp-user".to_string(),
+				pass: "debug-smtp-pass-secret".to_string(),
+				from: "noreply@example.test".to_string(),
+			},
+			auth: AuthConfig {
+				cookie_secret: "debug-cookie-secret".to_string(),
+				enable_registration: true,
+				cookie_secure: None,
+			},
+			frontend: FrontendConfig {
+				url: "https://memory-map.example.test".to_string(),
+			},
+			cors: CorsConfig {
+				allowed_origins: "https://memory-map.example.test".to_string(),
+			},
+			storage: StorageConfig {
+				endpoint_url: "https://s3.example.test".to_string(),
+				public_endpoint_url: Some("https://public-s3.example.test".to_string()),
+				access_key: "debug-storage-access-secret".to_string(),
+				secret_key: "debug-storage-secret-secret".to_string(),
+				bucket_name: "memory-map".to_string(),
+				region: "us-east-1".to_string(),
+				force_path_style: false,
+				presigned_url_ttl_seconds: 60,
+			},
+			object_lifecycle: ObjectLifecycleConfig::default(),
+			email_outbox: EmailOutboxConfig::default(),
+		};
+
+		let debug = format!("{config:?}");
+
+		assert!(debug.contains("Config"));
+		assert!(debug.contains("smtp.example.test"));
+		assert!(debug.contains("https://s3.example.test"));
+		assert!(debug.contains("https://public-s3.example.test"));
+		assert!(debug.contains("<redacted>"));
+		assert!(!debug.contains("debug-smtp-pass-secret"));
+		assert!(!debug.contains("debug-cookie-secret"));
+		assert!(!debug.contains("debug-storage-access-secret"));
+		assert!(!debug.contains("debug-storage-secret-secret"));
+	}
+
+	#[test]
+	fn auth_config_validate_accepts_cookie_secret_boundary_length() {
+		let config = AuthConfig {
+			cookie_secret: "a".repeat(64),
+			enable_registration: true,
+			cookie_secure: None,
+		};
+
+		assert!(config.validate().is_ok());
+	}
+
+	#[test]
+	fn auth_config_validate_rejects_short_cookie_secret() {
+		let config = AuthConfig {
+			cookie_secret: "a".repeat(63),
+			enable_registration: true,
+			cookie_secure: None,
+		};
+
+		let error = config.validate().err();
+		assert!(
+			error.as_ref().is_some_and(|error| error.to_string().contains("at least 64 bytes"))
+		);
+	}
+
+	#[test]
+	fn config_deserialization_defaults_missing_object_lifecycle_section() -> anyhow::Result<()> {
+		let config: Config = serde_json::from_value(serde_json::json!({
+			"pg": {},
+			"server": {
+				"host": "127.0.0.1",
+				"port": 8000
+			},
+			"smtp": {
+				"host": "smtp.example.test",
+				"user": "smtp-user",
+				"pass": "smtp-pass",
+				"from": "noreply@example.test"
+			},
+			"auth": {
+				"cookie_secret": "cookie-secret",
+				"enable_registration": true
+			},
+			"frontend": {
+				"url": "http://127.0.0.1:3000"
+			},
+			"cors": {
+				"allowed_origins": "http://127.0.0.1:3000"
+			},
+			"storage": {
+				"endpoint_url": "http://127.0.0.1:9000/",
+				"access_key": "storage-access",
+				"secret_key": "storage-secret",
+				"bucket_name": "memory-map",
+				"region": "us-east-1",
+				"force_path_style": true,
+				"presigned_url_ttl_seconds": 60
+			}
+		}))?;
+
+		let default = ObjectLifecycleConfig::default();
+		assert_eq!(
+			config.object_lifecycle.pending_upload_timeout_seconds,
+			default.pending_upload_timeout_seconds
+		);
+		assert_eq!(
+			config.object_lifecycle.storage_deletion_max_attempts,
+			default.storage_deletion_max_attempts
+		);
+		assert_eq!(
+			config.email_outbox.worker_interval_seconds,
+			EmailOutboxConfig::default().worker_interval_seconds
+		);
+		Ok(())
+	}
+
+	#[test]
+	fn config_cookie_secure_defaults_from_frontend_url() {
+		let mut config = test_config_with_frontend_url("https://memory-map.example.test");
+		assert!(config.cookie_secure());
+
+		config.frontend.url = "http://memory-map.example.test".to_string();
+		assert!(!config.cookie_secure());
+	}
+
+	#[test]
+	fn config_cookie_secure_uses_explicit_auth_override() {
+		let mut config = test_config_with_frontend_url("http://memory-map.example.test");
+		config.auth.cookie_secure = Some(true);
+		assert!(config.cookie_secure());
+
+		config.frontend.url = "https://memory-map.example.test".to_string();
+		config.auth.cookie_secure = Some(false);
+		assert!(!config.cookie_secure());
+	}
+
+	fn test_config_with_frontend_url(frontend_url: &str) -> Config {
+		Config {
+			pg: PostgresConfig::new(),
+			server: ServerConfig {
+				host: "127.0.0.1".to_string(),
+				port: 8000,
+			},
+			smtp: SmtpConfig {
+				host: "smtp.example.test".to_string(),
+				user: "smtp-user".to_string(),
+				pass: "smtp-pass".to_string(),
+				from: "noreply@example.test".to_string(),
+			},
+			auth: AuthConfig {
+				cookie_secret: "a".repeat(64),
+				enable_registration: true,
+				cookie_secure: None,
+			},
+			frontend: FrontendConfig {
+				url: frontend_url.to_string(),
+			},
+			cors: CorsConfig {
+				allowed_origins: frontend_url.to_string(),
+			},
+			storage: StorageConfig {
+				endpoint_url: "http://127.0.0.1:9000/".to_string(),
+				public_endpoint_url: None,
+				access_key: "storage-access".to_string(),
+				secret_key: "storage-secret".to_string(),
+				bucket_name: "memory-map".to_string(),
+				region: "us-east-1".to_string(),
+				force_path_style: true,
+				presigned_url_ttl_seconds: 60,
+			},
+			object_lifecycle: ObjectLifecycleConfig::default(),
+			email_outbox: EmailOutboxConfig::default(),
+		}
+	}
 }
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 115da50..0cf2765 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -1,235 +1,35 @@
 use {
 	anyhow::Context,
-	async_graphql::{
-		EmptySubscription,
-		Schema,
-	},
-	async_graphql_axum::{
-		GraphQLRequest,
-		GraphQLResponse,
-	},
-	axum::{
-		Router,
-		body::{
-			Body,
-			to_bytes,
-		},
-		extract::{
-			DefaultBodyLimit,
-			Extension,
-			State,
-		},
-		http::{
-			HeaderMap,
-			HeaderValue,
-			Method,
-			Request,
-			StatusCode,
-			header,
-			request::Parts,
-		},
-		middleware::{
-			self,
-			Next,
-		},
-		response::IntoResponse,
-		routing::{
-			get,
-			post,
-		},
-	},
-	axum_extra::extract::cookie::{
-		Cookie,
-		Key,
-		PrivateCookieJar,
-	},
 	backend::{
-		AppState,
 		Config,
-		SharedState,
-		UserId,
-		constants::{
-			BODY_MAX_SIZE_LIMIT_BYTES,
-			CACHE_MAX_CAPACITY,
-			CACHE_TTL_SECONDS,
-			GRAPHQL_BODY_LIMIT_BYTES,
-		},
-		controllers::api::locations::post as post_locations,
-		db::queries::SELECT_USER_EXISTS_QUERY,
-		graphiql,
-		graphql::queries::{
-			mutation::Mutation,
-			query::Query,
+		app::{
+			build_app,
+			build_shared_state,
 		},
+		email_worker::EmailWorker,
 		migrations,
+		object_lifecycle::ObjectLifecycleWorker,
+		storage::StorageClient,
+		worker,
 	},
 	casbin::{
 		CoreApi,
 		Enforcer,
 	},
-	deadpool::managed::Object,
-	deadpool_postgres::{
-		Manager,
-		Runtime,
-	},
+	deadpool_postgres::Runtime,
 	dotenvy::dotenv,
-	minio::s3::{
-		ClientBuilder,
-		creds::StaticProvider,
-		http::BaseUrl,
-	},
-	moka::future::Cache,
 	std::{
-		collections::hash_map::DefaultHasher,
-		hash::{
-			Hash,
-			Hasher,
-		},
 		ops::DerefMut,
-		sync::{
-			Arc,
-			Mutex,
-			atomic::{
-				AtomicU64,
-				Ordering,
-			},
-		},
-		time::{
-			Duration,
-			SystemTime,
-			UNIX_EPOCH,
-		},
+		sync::Arc,
 	},
 	tokio::{
 		net::TcpListener,
 		sync::RwLock,
 	},
 	tokio_postgres::NoTls,
-	tower_http::cors::{
-		AllowOrigin,
-		CorsLayer,
-	},
 	tracing_subscriber::EnvFilter,
 };
 
-async fn caching_middleware(
-	State(state): State<AppState<Manager, Object<Manager>>>,
-	_headers: HeaderMap,
-	request: Request<Body>,
-	next: Next,
-) -> axum::response::Result<impl IntoResponse> {
-	// 1. Read body
-	let (parts, body) = request.into_parts();
-	// Limit body size to avoid DoS.
-	let bytes = match to_bytes(body, GRAPHQL_BODY_LIMIT_BYTES).await {
-		Ok(b) => b,
-		Err(_) => return Ok(StatusCode::PAYLOAD_TOO_LARGE.into_response()),
-	};
-
-	// Return early if it's a mutation.
-	// Mutations change state and should not be cached. Caching them would prevent
-	// the server from executing the mutation on subsequent requests.
-	if let Ok(json) = serde_json::from_slice::<serde_json::Value>(&bytes) &&
-		let Some(query) = json.get("query").and_then(|q| q.as_str()) &&
-		query.trim().to_lowercase().starts_with("mutation")
-	{
-		let req = Request::from_parts(parts, Body::from(bytes));
-		return Ok(next.run(req).await.into_response());
-	}
-
-	// 2. Hash body
-	let mut hasher = DefaultHasher::new();
-	bytes.hash(&mut hasher);
-	if let Some(auth_header) = parts.headers.get("Authorization") {
-		auth_header.hash(&mut hasher);
-	}
-	if let Some(cookie_header) = parts.headers.get(header::COOKIE) {
-		cookie_header.hash(&mut hasher);
-	}
-	let hash = hasher.finish();
-
-	// 3. Check cache
-	if let Some(cached_response) = state.inner.response_cache.get(&hash).await {
-		tracing::info!("Cache hit for hash: {}", hash);
-		let mut response = axum::response::Response::new(Body::from(cached_response));
-		response.headers_mut().insert("Content-Type", HeaderValue::from_static("application/json"));
-
-		let last_modified = state.inner.last_modified.load(Ordering::Relaxed);
-		let etag = format!("\"{last_modified}\"");
-		response.headers_mut().insert(
-			"ETag",
-			HeaderValue::from_str(&etag).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?,
-		);
-
-		return Ok(response);
-	}
-
-	// 4. Process request
-	let req = Request::from_parts(parts, Body::from(bytes));
-	let response = next.run(req).await;
-
-	// 5. Cache response
-	let (parts, body) = response.into_parts();
-	let bytes = match to_bytes(body, BODY_MAX_SIZE_LIMIT_BYTES).await {
-		Ok(b) => b,
-		Err(_) => return Ok(StatusCode::INTERNAL_SERVER_ERROR.into_response()),
-	};
-
-	state.inner.response_cache.insert(hash, bytes.clone()).await;
-
-	let mut response = axum::response::Response::from_parts(parts, Body::from(bytes));
-
-	let last_modified = state.inner.last_modified.load(Ordering::Relaxed);
-	let etag = format!("\"{last_modified}\"");
-	response.headers_mut().insert(
-		"ETag",
-		HeaderValue::from_str(&etag).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?,
-	);
-
-	Ok(response)
-}
-
-async fn graphql_handler(
-	State(state): State<AppState<Manager, Object<Manager>>>,
-	Extension(schema): Extension<Schema<Query, Mutation, EmptySubscription>>,
-	jar: PrivateCookieJar,
-	req: GraphQLRequest,
-) -> (PrivateCookieJar, GraphQLResponse) {
-	let mut req = req.into_inner();
-
-	if let Some(cookie) = jar.get("auth_token") &&
-		let Ok(user_id) = cookie.value().parse::<i64>()
-	{
-		// Verify user exists in database
-		let user_exists = if let Ok(client) = state.inner.pool.get().await {
-			match client.prepare_cached(SELECT_USER_EXISTS_QUERY).await {
-				Ok(stmt) => matches!(client.query_opt(&stmt, &[&user_id]).await, Ok(Some(_))),
-				Err(_) => false,
-			}
-		} else {
-			false
-		};
-
-		if user_exists {
-			req = req.data(UserId(user_id));
-		}
-	}
-
-	let cookies = Arc::new(Mutex::new(Vec::<Cookie<'static>>::new()));
-	req = req.data(cookies.clone());
-
-	let response = schema.execute(req).await;
-
-	let mut jar = jar;
-	if let Ok(cookies) = cookies.lock() {
-		for cookie in cookies.iter() {
-			jar = jar.add(cookie.clone());
-		}
-	}
-
-	(jar, response.into())
-}
-
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
 	// Initialise logging
@@ -237,9 +37,7 @@ async fn main() -> anyhow::Result<()> {
 
 	// Read and parse dotenv config
 	dotenv().ok();
-	let cfg = Config::from_env().context("Failed to load configuration from environment")?;
-	let frontend_url = cfg.frontend_url.clone();
-	let cors_allowed_origins = cfg.cors_allowed_origins.clone();
+	let cfg = Config::load().context("Failed to load configuration")?;
 
 	// Connect to DB
 	let pool = cfg
@@ -259,88 +57,31 @@ async fn main() -> anyhow::Result<()> {
 			.context("Failed to run database migrations")?;
 	}
 
-	// Initialise minio client
-	let base_url = cfg.minio_url.parse::<BaseUrl>().context("Failed to parse MinIO URL")?;
-	tracing::info!("Trying to connect to MinIO at: `{:?}`", base_url);
-
-	let static_provider = StaticProvider::new(&cfg.minio_access_key, &cfg.minio_secret_key, None);
-
-	let minio_client = ClientBuilder::new(base_url)
-		.provider(Some(Box::new(static_provider)))
-		.build()
-		.context("Failed to build MinIO client")?;
-
-	let bucket_name = cfg.s3_bucket_name.clone();
-
-	let last_modified = AtomicU64::new(
-		SystemTime::now()
-			.duration_since(UNIX_EPOCH)
-			.context("System time is before UNIX EPOCH")?
-			.as_millis() as u64,
+	// Initialise S3 storage client
+	tracing::info!(
+		"S3 endpoint configured: {} (region: {}, force path-style: {})",
+		cfg.storage.endpoint_url,
+		cfg.storage.region,
+		cfg.storage.force_path_style
 	);
+	let storage = StorageClient::from_config(&cfg).context("Failed to build S3 storage client")?;
+	storage.verify_bucket_ready().await.context("Failed to verify S3 bucket readiness")?;
 
-	let response_cache = Cache::builder()
-		.max_capacity(CACHE_MAX_CAPACITY)
-		.time_to_live(Duration::from_secs(CACHE_TTL_SECONDS))
-		.build();
+	let _object_lifecycle_worker = worker::spawn(ObjectLifecycleWorker::new(
+		pool.clone(),
+		storage.clone(),
+		cfg.object_lifecycle.clone(),
+	));
+	let _email_worker = worker::spawn(EmailWorker::new(pool.clone(), cfg.clone()));
 
 	// Initialise Casbin Enforcer
 	let enforcer = Enforcer::new("authz_model.conf", "authz_policy.csv").await?;
 	let enforcer = Arc::new(RwLock::new(enforcer));
 
-	// Set up GraphQL
-	let key = Key::from(cfg.cookie_secret.as_bytes());
-	let shared_state = Arc::new(SharedState {
-		pool,
-		minio_client,
-		bucket_name,
-		last_modified,
-		response_cache,
-		key: key.clone(),
-		config: cfg.clone(),
-		enforcer,
-	});
-
-	let app_state = AppState {
-		inner: shared_state.clone(),
-	};
-
-	let schema = Schema::build(Query, Mutation, EmptySubscription)
-		.data(shared_state.clone())
-		.data(key.clone())
-		.finish();
-
-	let cors = CorsLayer::new()
-		.allow_origin(AllowOrigin::predicate(
-			move |origin: &HeaderValue, _request_parts: &Parts| {
-				let origin_bytes = origin.as_bytes();
-				origin_bytes == frontend_url.as_bytes() ||
-					origin_bytes == cors_allowed_origins.as_bytes()
-			},
-		))
-		.allow_methods([Method::GET, Method::POST])
-		.allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION])
-		.allow_credentials(true);
-
-	let app = Router::new()
-		.route("/", get(graphiql))
-		.route(
-			"/",
-			post(graphql_handler)
-				.with_state(app_state.clone())
-				.layer(middleware::from_fn_with_state(app_state.clone(), caching_middleware)),
-		)
-		.route(
-			"/api/locations/",
-			post(post_locations)
-				.route_layer(DefaultBodyLimit::max(BODY_MAX_SIZE_LIMIT_BYTES))
-				.with_state(app_state.clone()),
-		)
-		.layer(Extension(schema))
-		.layer(Extension(key))
-		.route_layer(cors);
+	let bind_addr = format!("{}:{}", cfg.server.host, cfg.server.port);
+	let shared_state = build_shared_state(cfg, pool, storage, enforcer);
+	let app = build_app(shared_state);
 
-	let bind_addr = format!("{}:{}", cfg.server_host, cfg.server_port);
 	println!("GraphiQL IDE: http://{bind_addr}");
 
 	axum::serve(TcpListener::bind(bind_addr).await.context("Failed to bind to address")?, app)
diff --git a/backend/src/object_lifecycle.rs b/backend/src/object_lifecycle.rs
new file mode 100644
index 0000000..9f51233
--- /dev/null
+++ b/backend/src/object_lifecycle.rs
@@ -0,0 +1,23 @@
+//! Object storage lifecycle: upload sessions, completion and abort, the
+//! storage-deletion outbox, and the periodic maintenance worker.
+//!
+//! Split by altitude across submodules: `config` holds the policy knobs and
+//! part math, `service` the request-time operations and maintenance routines,
+//! `worker` the periodic driver, and `deletion` the storage-deletion outbox
+//! queue and processor.
+
+mod config;
+mod deletion;
+mod service;
+mod worker;
+
+pub use {
+	config::ObjectLifecycleConfig,
+	service::{
+		CreatedObjectUploadSession,
+		ObjectLifecycleService,
+		ObjectUploadSessionCreate,
+		PresignedObjectUploadPart,
+	},
+	worker::ObjectLifecycleWorker,
+};
diff --git a/backend/src/object_lifecycle/config.rs b/backend/src/object_lifecycle/config.rs
new file mode 100644
index 0000000..0a3315b
--- /dev/null
+++ b/backend/src/object_lifecycle/config.rs
@@ -0,0 +1,363 @@
+use {
+	crate::outbox::{
+		OutboxRetryConfig,
+		ensure_positive,
+	},
+	anyhow::Context,
+	serde::Deserialize,
+	std::time::Duration,
+};
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct ObjectLifecycleConfig {
+	#[serde(default = "ObjectLifecycleConfig::default_pending_upload_timeout_seconds")]
+	pub pending_upload_timeout_seconds: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_max_file_size_bytes")]
+	pub upload_max_file_size_bytes: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_part_size_bytes")]
+	pub upload_part_size_bytes: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_max_part_count")]
+	pub upload_max_part_count: i32,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_session_ttl_seconds")]
+	pub upload_session_ttl_seconds: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_session_cleanup_retry_seconds")]
+	pub upload_session_cleanup_retry_seconds: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_session_cleanup_lease_seconds")]
+	pub upload_session_cleanup_lease_seconds: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_session_cleanup_max_attempts")]
+	pub upload_session_cleanup_max_attempts: i32,
+	#[serde(default = "ObjectLifecycleConfig::default_upload_session_cleanup_batch_size")]
+	pub upload_session_cleanup_batch_size: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_storage_deletion_retry_seconds")]
+	pub storage_deletion_retry_seconds: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_storage_deletion_lease_seconds")]
+	pub storage_deletion_lease_seconds: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_maintenance_interval_seconds")]
+	pub maintenance_interval_seconds: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_storage_deletion_batch_size")]
+	pub storage_deletion_batch_size: i64,
+	#[serde(default = "ObjectLifecycleConfig::default_storage_deletion_max_attempts")]
+	pub storage_deletion_max_attempts: i32,
+}
+
+impl ObjectLifecycleConfig {
+	pub const S3_MAX_MULTIPART_PART_COUNT: i32 = 10_000;
+	pub const S3_MAX_OBJECT_SIZE_BYTES: i64 = 5 * 1024 * 1024 * 1024 * 1024;
+	pub const S3_MIN_MULTIPART_PART_SIZE_BYTES: i64 = 5 * 1024 * 1024;
+
+	pub const fn default_pending_upload_timeout_seconds() -> i64 {
+		3600
+	}
+
+	pub const fn default_upload_max_file_size_bytes() -> i64 {
+		1024 * 1024 * 1024
+	}
+
+	pub const fn default_upload_part_size_bytes() -> i64 {
+		8 * 1024 * 1024
+	}
+
+	pub const fn default_upload_max_part_count() -> i32 {
+		Self::S3_MAX_MULTIPART_PART_COUNT
+	}
+
+	pub const fn default_upload_session_ttl_seconds() -> i64 {
+		3600
+	}
+
+	pub const fn default_upload_session_cleanup_retry_seconds() -> i64 {
+		60
+	}
+
+	pub const fn default_upload_session_cleanup_lease_seconds() -> i64 {
+		300
+	}
+
+	pub const fn default_upload_session_cleanup_max_attempts() -> i32 {
+		10
+	}
+
+	pub const fn default_upload_session_cleanup_batch_size() -> i64 {
+		1000
+	}
+
+	pub const fn default_storage_deletion_retry_seconds() -> i64 {
+		60
+	}
+
+	pub const fn default_storage_deletion_lease_seconds() -> i64 {
+		300
+	}
+
+	pub const fn default_maintenance_interval_seconds() -> i64 {
+		30
+	}
+
+	/// Default claim size. The storage layer owns S3's per-request multi-delete limit
+	/// and chunks internally; this can be any positive value, and 1000 happens to match
+	/// S3's cap so a typical claim fires exactly one storage request.
+	pub const fn default_storage_deletion_batch_size() -> i64 {
+		1000
+	}
+
+	pub const fn default_storage_deletion_max_attempts() -> i32 {
+		10
+	}
+
+	pub fn validate(&self) -> anyhow::Result<()> {
+		ensure_positive!(self, pending_upload_timeout_seconds);
+		if self.upload_max_file_size_bytes <= 0 {
+			anyhow::bail!("upload_max_file_size_bytes must be greater than 0");
+		}
+		if self.upload_max_file_size_bytes > Self::S3_MAX_OBJECT_SIZE_BYTES {
+			anyhow::bail!(
+				"upload_max_file_size_bytes must be at most {}",
+				Self::S3_MAX_OBJECT_SIZE_BYTES
+			);
+		}
+		if self.upload_part_size_bytes < Self::S3_MIN_MULTIPART_PART_SIZE_BYTES {
+			anyhow::bail!(
+				"upload_part_size_bytes must be at least {}",
+				Self::S3_MIN_MULTIPART_PART_SIZE_BYTES
+			);
+		}
+		ensure_positive!(self, upload_max_part_count);
+		if self.upload_max_part_count > Self::S3_MAX_MULTIPART_PART_COUNT {
+			anyhow::bail!(
+				"upload_max_part_count must be at most {}",
+				Self::S3_MAX_MULTIPART_PART_COUNT
+			);
+		}
+		ensure_positive!(self, upload_session_ttl_seconds);
+		self.upload_session_cleanup().validate("upload_session_cleanup")?;
+		self.upload_session_total_parts(self.upload_max_file_size_bytes)?;
+		ensure_positive!(self, maintenance_interval_seconds);
+		self.storage_deletion().validate("storage_deletion")?;
+		Ok(())
+	}
+
+	/// Lease/retry policy for the storage-deletion outbox, as a runtime view.
+	pub fn storage_deletion(&self) -> OutboxRetryConfig {
+		OutboxRetryConfig {
+			retry_seconds: self.storage_deletion_retry_seconds,
+			lease_seconds: self.storage_deletion_lease_seconds,
+			batch_size: self.storage_deletion_batch_size,
+			max_attempts: self.storage_deletion_max_attempts,
+		}
+	}
+
+	/// Lease/retry policy for the expired-upload-session cleanup, as a runtime view.
+	pub fn upload_session_cleanup(&self) -> OutboxRetryConfig {
+		OutboxRetryConfig {
+			retry_seconds: self.upload_session_cleanup_retry_seconds,
+			lease_seconds: self.upload_session_cleanup_lease_seconds,
+			batch_size: self.upload_session_cleanup_batch_size,
+			max_attempts: self.upload_session_cleanup_max_attempts,
+		}
+	}
+
+	pub fn upload_session_total_parts(
+		&self,
+		file_size_bytes: i64,
+	) -> anyhow::Result<i32> {
+		if file_size_bytes <= 0 {
+			anyhow::bail!("file_size_bytes must be greater than 0");
+		}
+		if file_size_bytes > self.upload_max_file_size_bytes {
+			anyhow::bail!("file_size_bytes must be at most {}", self.upload_max_file_size_bytes);
+		}
+		let count = part_count(file_size_bytes, self.upload_part_size_bytes);
+		if count > i64::from(self.upload_max_part_count) {
+			anyhow::bail!(
+				"file_size_bytes requires {count} parts, exceeding upload_max_part_count {}",
+				self.upload_max_part_count
+			);
+		}
+		i32::try_from(count).context("upload part count exceeds i32 range")
+	}
+
+	pub fn upload_session_expected_part_size_bytes(
+		&self,
+		file_size_bytes: i64,
+		part_number: i32,
+	) -> anyhow::Result<i64> {
+		let total_parts = self.upload_session_total_parts(file_size_bytes)?;
+		if !(1 ..= total_parts).contains(&part_number) {
+			anyhow::bail!("part_number must be between 1 and {total_parts}");
+		}
+		Ok(part_length(file_size_bytes, self.upload_part_size_bytes, part_number))
+	}
+
+	/// Returns Self if `validate` succeeds; convenient for builder-style construction.
+	pub fn validated(self) -> anyhow::Result<Self> {
+		self.validate()?;
+		Ok(self)
+	}
+
+	pub(super) fn worker_interval(&self) -> Duration {
+		Duration::from_secs(self.maintenance_interval_seconds as u64)
+	}
+}
+
+impl Default for ObjectLifecycleConfig {
+	fn default() -> Self {
+		Self {
+			pending_upload_timeout_seconds: Self::default_pending_upload_timeout_seconds(),
+			upload_max_file_size_bytes: Self::default_upload_max_file_size_bytes(),
+			upload_part_size_bytes: Self::default_upload_part_size_bytes(),
+			upload_max_part_count: Self::default_upload_max_part_count(),
+			upload_session_ttl_seconds: Self::default_upload_session_ttl_seconds(),
+			upload_session_cleanup_retry_seconds:
+				Self::default_upload_session_cleanup_retry_seconds(),
+			upload_session_cleanup_lease_seconds:
+				Self::default_upload_session_cleanup_lease_seconds(),
+			upload_session_cleanup_max_attempts: Self::default_upload_session_cleanup_max_attempts(
+			),
+			upload_session_cleanup_batch_size: Self::default_upload_session_cleanup_batch_size(),
+			storage_deletion_retry_seconds: Self::default_storage_deletion_retry_seconds(),
+			storage_deletion_lease_seconds: Self::default_storage_deletion_lease_seconds(),
+			maintenance_interval_seconds: Self::default_maintenance_interval_seconds(),
+			storage_deletion_batch_size: Self::default_storage_deletion_batch_size(),
+			storage_deletion_max_attempts: Self::default_storage_deletion_max_attempts(),
+		}
+	}
+}
+
+/// Number of equal parts (the last possibly shorter) needed to cover
+/// `file_size_bytes` at `part_size_bytes`. Both must be positive.
+///
+/// The two callers layer their own part-count cap on top, and the caps differ
+/// intentionally: the config enforces the operator's `upload_max_part_count` at
+/// session creation, while the session-based path enforces the immutable S3
+/// limit at completion (the session was already validated against the config).
+pub(super) fn part_count(
+	file_size_bytes: i64,
+	part_size_bytes: i64,
+) -> i64 {
+	((file_size_bytes - 1) / part_size_bytes) + 1
+}
+
+/// Byte length of the 1-based `part_number` for a `file_size_bytes` upload split
+/// at `part_size_bytes` (the final part is whatever remains). `part_number` must
+/// be in range.
+pub(super) fn part_length(
+	file_size_bytes: i64,
+	part_size_bytes: i64,
+	part_number: i32,
+) -> i64 {
+	let part_start = i64::from(part_number - 1) * part_size_bytes;
+	part_size_bytes.min(file_size_bytes - part_start)
+}
+
+#[cfg(test)]
+mod tests {
+	use super::ObjectLifecycleConfig;
+
+	#[test]
+	fn object_lifecycle_config_rejects_invalid_values() {
+		let valid = ObjectLifecycleConfig::default();
+		assert!(valid.clone().validated().is_ok());
+
+		// Each second-valued field must be > 0; zero or negative fails validate().
+		for invalid in [
+			ObjectLifecycleConfig {
+				pending_upload_timeout_seconds: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_max_file_size_bytes: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_max_file_size_bytes: ObjectLifecycleConfig::S3_MAX_OBJECT_SIZE_BYTES + 1,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_part_size_bytes: ObjectLifecycleConfig::S3_MIN_MULTIPART_PART_SIZE_BYTES - 1,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_max_part_count: ObjectLifecycleConfig::S3_MAX_MULTIPART_PART_COUNT + 1,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_session_ttl_seconds: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_session_cleanup_retry_seconds: -1,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_session_cleanup_lease_seconds: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_session_cleanup_max_attempts: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_session_cleanup_batch_size: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				upload_max_file_size_bytes: (i64::from(valid.upload_max_part_count) *
+					valid.upload_part_size_bytes) +
+					1,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				storage_deletion_retry_seconds: -1,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				storage_deletion_lease_seconds: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				maintenance_interval_seconds: -5,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				storage_deletion_batch_size: 0,
+				..valid.clone()
+			},
+			ObjectLifecycleConfig {
+				storage_deletion_max_attempts: 0,
+				..valid.clone()
+			},
+		] {
+			assert!(invalid.validate().is_err());
+		}
+
+		// A very large positive value is valid.
+		let extreme = ObjectLifecycleConfig {
+			pending_upload_timeout_seconds: i64::MAX,
+			..valid
+		};
+		assert!(extreme.validate().is_ok());
+	}
+
+	#[test]
+	fn upload_session_policy_calculates_part_counts_and_lengths() -> anyhow::Result<()> {
+		let part_size = ObjectLifecycleConfig::S3_MIN_MULTIPART_PART_SIZE_BYTES;
+		let config = ObjectLifecycleConfig {
+			upload_max_file_size_bytes: part_size * 4,
+			upload_part_size_bytes: part_size,
+			upload_max_part_count: 4,
+			..ObjectLifecycleConfig::default()
+		};
+		let file_size = (part_size * 2) + 7;
+
+		assert_eq!(config.upload_session_total_parts(1)?, 1);
+		assert_eq!(config.upload_session_total_parts(part_size)?, 1);
+		assert_eq!(config.upload_session_total_parts(file_size)?, 3);
+		assert_eq!(config.upload_session_expected_part_size_bytes(file_size, 1)?, part_size);
+		assert_eq!(config.upload_session_expected_part_size_bytes(file_size, 2)?, part_size);
+		assert_eq!(config.upload_session_expected_part_size_bytes(file_size, 3)?, 7);
+		assert!(config.upload_session_total_parts(0).is_err());
+		assert!(config.upload_session_expected_part_size_bytes(file_size, 4).is_err());
+
+		Ok(())
+	}
+}
diff --git a/backend/src/object_lifecycle/deletion.rs b/backend/src/object_lifecycle/deletion.rs
new file mode 100644
index 0000000..44af2a6
--- /dev/null
+++ b/backend/src/object_lifecycle/deletion.rs
@@ -0,0 +1,102 @@
+use {
+	crate::{
+		db::queries::{
+			CLAIM_OBJECT_STORAGE_DELETIONS_QUERY,
+			DELETE_OBJECT_STORAGE_DELETIONS_QUERY,
+			DELETE_OBJECTS_BY_STORAGE_KEYS_QUERY,
+			MARK_OBJECT_STORAGE_DELETIONS_FAILED_QUERY,
+		},
+		errors::AppError,
+		outbox::{
+			DrainOutcome,
+			OutboxProcessor,
+			OutboxQueue,
+			OutboxRetryConfig,
+		},
+		storage::StorageClient,
+	},
+	anyhow::Context,
+	deadpool_postgres::Client,
+};
+
+/// The object-storage-deletion outbox as an [`OutboxQueue`]. `clear` is a
+/// two-statement transaction because a finished deletion removes both the queue
+/// row and the object-metadata row it points at.
+pub(super) struct StorageDeletionQueue<'a>(pub(super) &'a mut Client);
+
+impl OutboxQueue for StorageDeletionQueue<'_> {
+	type Item = String;
+
+	async fn claim(
+		&mut self,
+		retry: &OutboxRetryConfig,
+	) -> Result<Vec<String>, AppError> {
+		let rows = self
+			.0
+			.query(
+				CLAIM_OBJECT_STORAGE_DELETIONS_QUERY,
+				&[&retry.batch_size, &retry.lease_seconds, &retry.max_attempts],
+			)
+			.await
+			.context("Failed to claim pending object storage deletions")?;
+		rows.into_iter()
+			.map(|row| row.try_get("storage_key"))
+			.collect::<Result<Vec<_>, _>>()
+			.context("Failed to read claimed object storage deletion row")
+			.map_err(AppError::from)
+	}
+
+	async fn clear(
+		&mut self,
+		storage_keys: &[String],
+	) -> Result<(), AppError> {
+		let transaction = self.0.transaction().await?;
+		transaction
+			.execute(DELETE_OBJECTS_BY_STORAGE_KEYS_QUERY, &[&storage_keys])
+			.await
+			.context("Failed to delete completed object metadata rows")?;
+		transaction
+			.execute(DELETE_OBJECT_STORAGE_DELETIONS_QUERY, &[&storage_keys])
+			.await
+			.context("Failed to clear completed object storage deletions")?;
+		transaction.commit().await?;
+		Ok(())
+	}
+
+	async fn mark_failed(
+		&mut self,
+		storage_keys: &[String],
+		error_message: &str,
+		retry_after_seconds: i64,
+	) -> Result<(), AppError> {
+		self.0
+			.execute(
+				MARK_OBJECT_STORAGE_DELETIONS_FAILED_QUERY,
+				&[&storage_keys, &error_message, &retry_after_seconds],
+			)
+			.await
+			.context("Failed to record object storage deletion failure")?;
+		Ok(())
+	}
+}
+
+/// Deletes a claimed batch of storage keys in one S3 multi-delete request. The
+/// request is all-or-nothing, so the whole batch clears or the whole batch is
+/// marked failed.
+pub(super) struct StorageDeletionProcessor<'a> {
+	pub(super) storage: &'a StorageClient,
+}
+
+impl OutboxProcessor for StorageDeletionProcessor<'_> {
+	type Item = String;
+
+	async fn process(
+		&self,
+		storage_keys: Vec<String>,
+	) -> DrainOutcome<String> {
+		match self.storage.delete_objects(&storage_keys).await {
+			Ok(()) => DrainOutcome::all_cleared(storage_keys),
+			Err(error) => DrainOutcome::whole_batch_failed(storage_keys, error),
+		}
+	}
+}
diff --git a/backend/src/object_lifecycle/service.rs b/backend/src/object_lifecycle/service.rs
new file mode 100644
index 0000000..d186cbf
--- /dev/null
+++ b/backend/src/object_lifecycle/service.rs
@@ -0,0 +1,1075 @@
+use {
+	super::{
+		config::{
+			ObjectLifecycleConfig,
+			part_count,
+			part_length,
+		},
+		deletion::{
+			StorageDeletionProcessor,
+			StorageDeletionQueue,
+		},
+	},
+	crate::{
+		db::queries::{
+			CLAIM_EXPIRED_OBJECT_UPLOAD_SESSIONS_QUERY,
+			COUNT_PARKED_OBJECT_STORAGE_DELETIONS_QUERY,
+			COUNT_PARKED_OBJECT_UPLOAD_SESSIONS_QUERY,
+			DELETE_OBJECT_ALLOWED_USERS_QUERY,
+			DELETE_OBJECT_UPLOAD_SESSION_QUERY,
+			DELETE_PENDING_OBJECT_UPLOAD_BY_SESSION_QUERY,
+			DELETE_PENDING_OBJECT_UPLOAD_QUERY,
+			FINALIZE_OBJECT_UPLOAD_QUERY,
+			INSERT_OBJECT_QUERY,
+			INSERT_OBJECT_STORAGE_DELETIONS_QUERY,
+			INSERT_OBJECT_UPLOAD_SESSION_QUERY,
+			MARK_OBJECT_UPLOAD_SESSION_CLEANUP_FAILED_QUERY,
+			MARK_OBJECTS_DELETE_PENDING_QUERY,
+			MARK_STALE_UPLOADS_DELETE_PENDING_QUERY,
+			MARK_UPLOAD_DELETE_PENDING_QUERY,
+			REPLACE_OBJECT_ALLOWED_USERS_QUERY,
+			SELECT_ACTIVE_OBJECT_UPLOAD_SESSION_FOR_USER_QUERY,
+			SELECT_AVAILABLE_OBJECT_FOR_USER_QUERY,
+			SELECT_OBJECT_UPLOAD_SESSION_FOR_USER_QUERY,
+			UPDATE_OBJECT_QUERY,
+		},
+		errors::AppError,
+		graphql::objects::{
+			location::Location,
+			s3_object::{
+				PublicityOverride,
+				S3Object,
+			},
+		},
+		outbox::drain_outbox,
+		storage::{
+			CompletedUploadPart,
+			MultipartUploadAbortOutcome,
+			MultipartUploadCompleteOutcome,
+			PresignedHeader,
+			StorageClient,
+			StoredObjectMetadata,
+		},
+	},
+	anyhow::Context,
+	deadpool_postgres::Client,
+	jiff::Timestamp,
+	rand::{
+		RngExt,
+		distr::Alphanumeric,
+	},
+	shared::{
+		ALLOWED_MIME_TYPES,
+		MAX_PRESIGN_PARTS_PER_REQUEST,
+	},
+	std::collections::BTreeSet,
+	tokio_postgres::{
+		Row,
+		Transaction,
+		error::SqlState,
+	},
+};
+
+pub struct ObjectLifecycleService<'a> {
+	db_client: &'a mut Client,
+	storage: &'a StorageClient,
+	config: ObjectLifecycleConfig,
+}
+
+pub struct ObjectUploadSessionCreate {
+	pub name: String,
+	pub content_type: String,
+	pub file_size_bytes: i64,
+	pub made_on: Option<String>,
+	pub location: Option<Location>,
+	pub user_id: i64,
+	pub publicity: PublicityOverride,
+	pub allowed_users: Vec<String>,
+}
+
+#[derive(Clone, Debug)]
+pub struct CreatedObjectUploadSession {
+	pub object_id: i64,
+	pub part_size_bytes: i64,
+	pub total_parts: i32,
+	pub expires_at: Timestamp,
+}
+
+#[derive(Clone, Debug)]
+struct ObjectUploadSession {
+	object_id: i64,
+	storage_key: String,
+	upload_id: String,
+	content_type: String,
+	file_size_bytes: i64,
+	part_size_bytes: i64,
+	expires_at: Timestamp,
+}
+
+#[derive(Clone, Debug)]
+pub struct PresignedObjectUploadPart {
+	pub part_number: i32,
+	pub url: String,
+	pub method: String,
+	pub headers: Vec<PresignedHeader>,
+	pub expected_content_length: i64,
+}
+
+impl TryFrom<Row> for ObjectUploadSession {
+	type Error = AppError;
+
+	fn try_from(row: Row) -> Result<Self, Self::Error> {
+		Ok(Self {
+			object_id: row
+				.try_get("object_id")
+				.context("Failed to read upload session object_id")?,
+			storage_key: row
+				.try_get("storage_key")
+				.context("Failed to read upload session storage_key")?,
+			upload_id: row
+				.try_get("upload_id")
+				.context("Failed to read upload session upload_id")?,
+			content_type: row
+				.try_get("content_type")
+				.context("Failed to read upload session content_type")?,
+			file_size_bytes: row
+				.try_get("file_size")
+				.context("Failed to read upload session file_size")?,
+			part_size_bytes: row
+				.try_get("part_size_bytes")
+				.context("Failed to read upload session part_size_bytes")?,
+			expires_at: row
+				.try_get("expires_at")
+				.context("Failed to read upload session expires_at")?,
+		})
+	}
+}
+
+impl<'a> ObjectLifecycleService<'a> {
+	pub fn new(
+		db_client: &'a mut Client,
+		storage: &'a StorageClient,
+		config: ObjectLifecycleConfig,
+	) -> Self {
+		Self {
+			db_client,
+			storage,
+			config,
+		}
+	}
+
+	pub async fn create_upload_session(
+		&mut self,
+		upload: ObjectUploadSessionCreate,
+	) -> Result<CreatedObjectUploadSession, AppError> {
+		validate_upload_name(&upload.name)?;
+		validate_upload_content_type(&upload.content_type)?;
+		let parsed_made_on = parse_made_on(upload.made_on.clone())?;
+		let location_geometry = location_geometry(upload.location.as_ref())?;
+		let total_parts = self.config.upload_session_total_parts(upload.file_size_bytes)?;
+		let part_size_bytes = self.config.upload_part_size_bytes;
+		let session_ttl_seconds = self.config.upload_session_ttl_seconds;
+		let allowed_users = upload.allowed_users.clone();
+		let storage_key = generate_storage_key();
+		let upload_id = self
+			.storage
+			.create_multipart_upload(&storage_key, &upload.content_type)
+			.await
+			.context("Failed to create object upload session in storage")?;
+
+		let session_result = async {
+			let transaction = self.db_client.transaction().await?;
+			let object_id = insert_pending_upload_object(
+				&transaction,
+				&upload,
+				&storage_key,
+				&parsed_made_on,
+				&location_geometry,
+			)
+			.await?;
+			replace_allowed_users(&transaction, object_id, allowed_users).await?;
+			let session = insert_object_upload_session(
+				&transaction,
+				object_id,
+				&storage_key,
+				&upload_id,
+				&upload,
+				part_size_bytes,
+				session_ttl_seconds,
+			)
+			.await?;
+			transaction.commit().await?;
+			Ok::<_, AppError>(session)
+		}
+		.await;
+		let session = match session_result {
+			Ok(session) => session,
+			Err(error) => {
+				abort_created_multipart_upload(self.storage, &storage_key, &upload_id, &error)
+					.await;
+				return Err(error);
+			}
+		};
+
+		Ok(CreatedObjectUploadSession {
+			object_id: session.object_id,
+			part_size_bytes: session.part_size_bytes,
+			total_parts,
+			expires_at: session.expires_at,
+		})
+	}
+
+	pub async fn presign_upload_parts(
+		&mut self,
+		object_id: i64,
+		user_id: i64,
+		part_numbers: Vec<i32>,
+	) -> Result<Vec<PresignedObjectUploadPart>, AppError> {
+		let session = self.active_upload_session_for_user(object_id, user_id).await?;
+		validate_part_numbers(&session, &part_numbers)?;
+
+		let mut presigned_parts = Vec::with_capacity(part_numbers.len());
+		for part_number in part_numbers {
+			let expected_content_length = upload_session_part_size(&session, part_number)?;
+			let presigned = self
+				.storage
+				.presigned_upload_part_url(
+					&session.storage_key,
+					&session.upload_id,
+					part_number,
+					expected_content_length,
+				)
+				.await
+				.context("Failed to presign object upload part")?;
+			presigned_parts.push(PresignedObjectUploadPart {
+				part_number,
+				url: presigned.url,
+				method: presigned.method,
+				headers: presigned.headers,
+				expected_content_length: presigned.expected_content_length,
+			});
+		}
+
+		Ok(presigned_parts)
+	}
+
+	pub async fn complete_upload(
+		&mut self,
+		object_id: i64,
+		user_id: i64,
+		completed_parts: Vec<CompletedUploadPart>,
+	) -> Result<S3Object, AppError> {
+		if let Some(object) = self.available_object_for_user(object_id, user_id).await? {
+			return Ok(object);
+		}
+
+		let session = self.active_upload_session_for_user(object_id, user_id).await?;
+		let completed_parts = validate_completed_parts(&session, completed_parts)?;
+
+		match self
+			.storage
+			.complete_multipart_upload(&session.storage_key, &session.upload_id, &completed_parts)
+			.await?
+		{
+			MultipartUploadCompleteOutcome::Completed => {}
+			MultipartUploadCompleteOutcome::UploadNotFound =>
+				return match self.storage.head_object_opt(&session.storage_key).await.context(
+					"Failed to check completed object after multipart upload was missing",
+				)? {
+					Some(metadata) =>
+						self.finalize_verified_upload_session(&session, user_id, metadata).await,
+					None => Err(AppError::NotFound("Multipart upload not found".to_string())),
+				},
+		}
+
+		let metadata = self
+			.storage
+			.head_object(&session.storage_key)
+			.await
+			.context("Failed to verify completed object metadata")?;
+		self.finalize_verified_upload_session(&session, user_id, metadata).await
+	}
+
+	pub async fn abort_upload(
+		&mut self,
+		object_id: i64,
+		user_id: i64,
+	) -> Result<(), AppError> {
+		let session = self.upload_session_for_user(object_id, user_id).await?;
+
+		match self.storage.abort_multipart_upload(&session.storage_key, &session.upload_id).await? {
+			MultipartUploadAbortOutcome::Aborted =>
+				self.delete_pending_upload_metadata(&session, user_id).await,
+			MultipartUploadAbortOutcome::UploadNotFound => match self
+				.storage
+				.head_object_opt(&session.storage_key)
+				.await
+				.context("Failed to check object after multipart upload was missing")?
+			{
+				Some(_) => self.enqueue_completed_upload_cleanup(&session).await,
+				None => self.delete_pending_upload_metadata(&session, user_id).await,
+			},
+		}
+	}
+
+	pub async fn delete_objects(
+		&mut self,
+		ids: &[i64],
+	) -> Result<Vec<S3Object>, AppError> {
+		tracing::debug!("IDs to delete: {:?}", ids);
+		let transaction = self.db_client.transaction().await?;
+		let rows = transaction.query(MARK_OBJECTS_DELETE_PENDING_QUERY, &[&ids]).await?;
+		let objects = collect_s3_objects(rows)?;
+		enqueue_storage_deletions(&transaction, &objects).await?;
+
+		transaction.commit().await?;
+
+		Ok(objects)
+	}
+
+	/// Runs maintenance stages in sequence, surfacing the first failure if any.
+	///
+	/// Each stage logs its own outcome (success count or error) so operators can tell
+	/// from logs which stage struggled even when the composite returns Ok. `.and()`
+	/// gives the desired "first-failure" semantics without the bookkeeping the
+	/// previous shape required.
+	pub async fn run_storage_maintenance(&mut self) -> Result<(), AppError> {
+		let reconcile = self.reconcile_expired_upload_sessions().await;
+		let reap = self.reap_stale_pending_uploads().await;
+		let drain = self.drain_storage_deletions().await;
+
+		match &reconcile {
+			Ok(reconciled_uploads) if *reconciled_uploads > 0 => tracing::info!(
+				count = reconciled_uploads,
+				"Reconciled expired object upload sessions"
+			),
+			Ok(_) => {}
+			Err(error) => tracing::warn!(
+				error = ?error,
+				"Failed to reconcile expired object upload sessions"
+			),
+		}
+		match &reap {
+			Ok(stale_uploads) if !stale_uploads.is_empty() => tracing::info!(
+				count = stale_uploads.len(),
+				"Marked stale pending uploads for storage cleanup"
+			),
+			Ok(_) => {}
+			Err(error) => tracing::warn!(
+				error = ?error,
+				"Failed to mark stale pending uploads for storage cleanup"
+			),
+		}
+		if let Err(error) = &drain {
+			tracing::warn!(error = ?error, "Failed to drain object storage deletions");
+		}
+
+		let backlog = self.report_parked_backlog().await;
+		if let Err(error) = &backlog {
+			tracing::warn!(error = ?error, "Failed to report parked object storage backlog");
+		}
+
+		// `.and(backlog)` last so a backlog-query failure is surfaced but never
+		// masks an earlier stage's error.
+		reconcile.map(|_| ()).and(reap.map(|_| ())).and(drain).and(backlog)
+	}
+
+	/// Logs a warning summarising cleanups and deletions that have exhausted their
+	/// retry budget and so will never be reclaimed by their claim queries. This
+	/// makes a permanently-parked row visible to operators (who must intervene)
+	/// instead of leaving it silent after its final per-attempt warning. Runs
+	/// every maintenance pass; a persistent backlog is a persistent fault that
+	/// warrants a persistent signal.
+	async fn report_parked_backlog(&mut self) -> Result<(), AppError> {
+		let session_max_attempts = self.config.upload_session_cleanup().max_attempts;
+		let deletion_max_attempts = self.config.storage_deletion().max_attempts;
+		let parked_sessions: i64 = self
+			.db_client
+			.query_one(COUNT_PARKED_OBJECT_UPLOAD_SESSIONS_QUERY, &[&session_max_attempts])
+			.await
+			.context("Failed to count parked object upload sessions")?
+			.try_get(0)
+			.context("Failed to read parked object upload session count")?;
+		let parked_deletions: i64 = self
+			.db_client
+			.query_one(COUNT_PARKED_OBJECT_STORAGE_DELETIONS_QUERY, &[&deletion_max_attempts])
+			.await
+			.context("Failed to count parked object storage deletions")?
+			.try_get(0)
+			.context("Failed to read parked object storage deletion count")?;
+		if parked_sessions > 0 || parked_deletions > 0 {
+			tracing::warn!(
+				parked_upload_sessions = parked_sessions,
+				parked_storage_deletions = parked_deletions,
+				"Object storage maintenance has rows that exhausted their retry budget; manual intervention required"
+			);
+		}
+		Ok(())
+	}
+
+	pub async fn reconcile_expired_upload_sessions(&mut self) -> Result<usize, AppError> {
+		let mut reconciled_count = 0;
+		let mut first_error: Option<AppError> = None;
+
+		loop {
+			let sessions = self.claim_expired_upload_sessions().await?;
+			if sessions.is_empty() {
+				break;
+			}
+
+			for session in sessions {
+				match self.reconcile_expired_upload_session(&session).await {
+					Ok(()) => reconciled_count += 1,
+					Err(error) => {
+						let error_message = error.to_string();
+						if let Err(mark_error) = self
+							.mark_upload_session_cleanup_failed(session.object_id, &error_message)
+							.await
+						{
+							if first_error.is_none() {
+								first_error = Some(mark_error);
+							}
+							continue;
+						}
+						if first_error.is_none() {
+							first_error = Some(error);
+						}
+					}
+				}
+			}
+		}
+
+		match first_error {
+			Some(error) => Err(error),
+			None => Ok(reconciled_count),
+		}
+	}
+
+	pub async fn reap_stale_pending_uploads(&mut self) -> Result<Vec<S3Object>, AppError> {
+		let transaction = self.db_client.transaction().await?;
+		let rows = transaction
+			.query(
+				MARK_STALE_UPLOADS_DELETE_PENDING_QUERY,
+				&[&self.config.pending_upload_timeout_seconds],
+			)
+			.await
+			.context("Failed to mark stale pending uploads for cleanup")?;
+		let objects = collect_s3_objects(rows)?;
+		enqueue_storage_deletions(&transaction, &objects).await?;
+		transaction.commit().await?;
+		Ok(objects)
+	}
+
+	pub async fn drain_storage_deletions(&mut self) -> Result<(), AppError> {
+		let processor = StorageDeletionProcessor {
+			storage: self.storage,
+		};
+		let mut queue = StorageDeletionQueue(&mut *self.db_client);
+		drain_outbox(&mut queue, &processor, &self.config.storage_deletion()).await
+	}
+
+	// This reconcile is deliberately NOT a `drain_outbox`: it reconciles a primary
+	// record (`object_upload_sessions`) with storage and fans out INTO the deletion
+	// queue, rather than draining a queue of jobs. Its claim query also joins
+	// `objects` and filters `storage_state`, so it is queue-specific. It shares
+	// only the lease/retry policy, read here as the `upload_session_cleanup` view.
+	async fn claim_expired_upload_sessions(
+		&mut self
+	) -> Result<Vec<ObjectUploadSession>, AppError> {
+		let cleanup = self.config.upload_session_cleanup();
+		let rows = self
+			.db_client
+			.query(
+				CLAIM_EXPIRED_OBJECT_UPLOAD_SESSIONS_QUERY,
+				&[&cleanup.batch_size, &cleanup.lease_seconds, &cleanup.max_attempts],
+			)
+			.await
+			.context("Failed to claim expired object upload sessions")?;
+		rows.into_iter().map(ObjectUploadSession::try_from).collect()
+	}
+
+	async fn reconcile_expired_upload_session(
+		&mut self,
+		session: &ObjectUploadSession,
+	) -> Result<(), AppError> {
+		match self
+			.storage
+			.abort_multipart_upload(&session.storage_key, &session.upload_id)
+			.await
+			.context("Failed to abort expired multipart upload")?
+		{
+			MultipartUploadAbortOutcome::Aborted =>
+				self.delete_pending_upload_metadata_for_cleanup(session).await,
+			MultipartUploadAbortOutcome::UploadNotFound => match self
+				.storage
+				.head_object_opt(&session.storage_key)
+				.await
+				.context("Failed to check object after expired multipart upload was missing")?
+			{
+				Some(_) => self.enqueue_completed_upload_cleanup(session).await,
+				None => self.delete_pending_upload_metadata_for_cleanup(session).await,
+			},
+		}
+	}
+
+	async fn mark_upload_session_cleanup_failed(
+		&mut self,
+		object_id: i64,
+		error_message: &str,
+	) -> Result<(), AppError> {
+		let retry_seconds = self.config.upload_session_cleanup().retry_seconds;
+		self.db_client
+			.execute(
+				MARK_OBJECT_UPLOAD_SESSION_CLEANUP_FAILED_QUERY,
+				&[&object_id, &error_message, &retry_seconds],
+			)
+			.await
+			.context("Failed to record object upload session cleanup failure")?;
+		Ok(())
+	}
+
+	pub async fn update_object_metadata(
+		&mut self,
+		id: i64,
+		name: String,
+		made_on: Option<String>,
+		location: Option<Location>,
+		publicity: PublicityOverride,
+		allowed_users: Vec<String>,
+	) -> Result<S3Object, AppError> {
+		let parsed_made_on = parse_made_on(made_on)?;
+		let location_geometry = location_geometry(location.as_ref())?;
+		// Log only the object id and whether a location was supplied; object name,
+		// timestamp, and coordinates are user data and are re-queryable by id.
+		tracing::debug!(id, has_location = location_geometry.is_some(), "Updating object metadata");
+
+		let transaction = self.db_client.transaction().await?;
+		let mut s3_object = S3Object::try_from(
+			transaction
+				.query_one(
+					UPDATE_OBJECT_QUERY,
+					&[&id, &name, &parsed_made_on, &location_geometry, &publicity],
+				)
+				.await?,
+		)?;
+
+		s3_object.allowed_users = replace_allowed_users(&transaction, id, allowed_users).await?;
+		transaction.commit().await?;
+		Ok(s3_object)
+	}
+
+	async fn active_upload_session_for_user(
+		&mut self,
+		object_id: i64,
+		user_id: i64,
+	) -> Result<ObjectUploadSession, AppError> {
+		self.db_client
+			.query_opt(SELECT_ACTIVE_OBJECT_UPLOAD_SESSION_FOR_USER_QUERY, &[&object_id, &user_id])
+			.await
+			.context("Failed to load active object upload session")?
+			.map(ObjectUploadSession::try_from)
+			.transpose()?
+			.ok_or_else(|| AppError::NotFound("Upload session not found".to_string()))
+	}
+
+	async fn upload_session_for_user(
+		&mut self,
+		object_id: i64,
+		user_id: i64,
+	) -> Result<ObjectUploadSession, AppError> {
+		self.db_client
+			.query_opt(SELECT_OBJECT_UPLOAD_SESSION_FOR_USER_QUERY, &[&object_id, &user_id])
+			.await
+			.context("Failed to load object upload session")?
+			.map(ObjectUploadSession::try_from)
+			.transpose()?
+			.ok_or_else(|| AppError::NotFound("Upload session not found".to_string()))
+	}
+
+	async fn available_object_for_user(
+		&mut self,
+		object_id: i64,
+		user_id: i64,
+	) -> Result<Option<S3Object>, AppError> {
+		self.db_client
+			.query_opt(SELECT_AVAILABLE_OBJECT_FOR_USER_QUERY, &[&object_id, &user_id])
+			.await
+			.context("Failed to load available object")?
+			.map(S3Object::try_from)
+			.transpose()
+	}
+
+	async fn finalize_verified_upload_session(
+		&mut self,
+		session: &ObjectUploadSession,
+		user_id: i64,
+		metadata: StoredObjectMetadata,
+	) -> Result<S3Object, AppError> {
+		if let Some(error_message) = completed_upload_metadata_error(session, &metadata) {
+			self.enqueue_completed_upload_cleanup(session).await?;
+			return Err(AppError::Validation(error_message));
+		}
+
+		self.finalize_upload_session(session, user_id).await
+	}
+
+	async fn finalize_upload_session(
+		&mut self,
+		session: &ObjectUploadSession,
+		user_id: i64,
+	) -> Result<S3Object, AppError> {
+		let transaction = self.db_client.transaction().await?;
+		let finalized = transaction
+			.query_opt(FINALIZE_OBJECT_UPLOAD_QUERY, &[&session.object_id, &session.storage_key])
+			.await
+			.context("Failed to finalize object upload")?;
+		let Some(finalized) = finalized else {
+			drop(transaction);
+			return self
+				.available_object_for_user(session.object_id, user_id)
+				.await?
+				.ok_or_else(|| AppError::NotFound("Upload session not found".to_string()));
+		};
+		transaction
+			.execute(DELETE_OBJECT_UPLOAD_SESSION_QUERY, &[&session.object_id])
+			.await
+			.context("Failed to delete finalized object upload session")?;
+		transaction.commit().await?;
+		S3Object::try_from(finalized)
+	}
+
+	async fn delete_pending_upload_metadata(
+		&mut self,
+		session: &ObjectUploadSession,
+		user_id: i64,
+	) -> Result<(), AppError> {
+		self.db_client
+			.execute(
+				DELETE_PENDING_OBJECT_UPLOAD_QUERY,
+				&[&session.object_id, &session.storage_key, &user_id],
+			)
+			.await
+			.context("Failed to delete aborted object upload metadata")?;
+		Ok(())
+	}
+
+	async fn delete_pending_upload_metadata_for_cleanup(
+		&mut self,
+		session: &ObjectUploadSession,
+	) -> Result<(), AppError> {
+		self.db_client
+			.execute(
+				DELETE_PENDING_OBJECT_UPLOAD_BY_SESSION_QUERY,
+				&[&session.object_id, &session.storage_key],
+			)
+			.await
+			.context("Failed to delete expired object upload metadata")?;
+		Ok(())
+	}
+
+	async fn enqueue_completed_upload_cleanup(
+		&mut self,
+		session: &ObjectUploadSession,
+	) -> Result<(), AppError> {
+		let transaction = self.db_client.transaction().await?;
+		let object = S3Object::try_from(
+			transaction
+				.query_one(
+					MARK_UPLOAD_DELETE_PENDING_QUERY,
+					&[&session.object_id, &session.storage_key],
+				)
+				.await
+				.context("Failed to mark completed upload for storage cleanup")?,
+		)?;
+		transaction
+			.execute(DELETE_OBJECT_UPLOAD_SESSION_QUERY, &[&session.object_id])
+			.await
+			.context("Failed to delete object upload session queued for cleanup")?;
+		enqueue_storage_deletions(&transaction, &[object]).await?;
+		transaction.commit().await?;
+		Ok(())
+	}
+}
+
+async fn abort_created_multipart_upload(
+	storage: &StorageClient,
+	storage_key: &str,
+	upload_id: &str,
+	source_error: &AppError,
+) {
+	if let Err(abort_error) = storage.abort_multipart_upload(storage_key, upload_id).await {
+		tracing::error!(
+			storage_key = %storage_key,
+			upload_id = %upload_id,
+			source_error = ?source_error,
+			error = ?abort_error,
+			"Failed to abort multipart upload after upload-session creation failed"
+		);
+	}
+}
+
+fn parse_made_on(made_on: Option<String>) -> Result<Option<Timestamp>, AppError> {
+	match made_on {
+		Some(timestamp_string) => Ok(Some(
+			timestamp_string
+				.parse()
+				.map_err(|e| AppError::Validation(format!("Invalid timestamp format: {e}")))?,
+		)),
+		None => Ok(None),
+	}
+}
+
+fn location_geometry(location: Option<&Location>) -> Result<Option<String>, AppError> {
+	location.map(Location::geometry).transpose()
+}
+
+async fn insert_pending_upload_object(
+	transaction: &Transaction<'_>,
+	upload: &ObjectUploadSessionCreate,
+	storage_key: &str,
+	parsed_made_on: &Option<Timestamp>,
+	location_geometry: &Option<String>,
+) -> Result<i64, AppError> {
+	let row = transaction
+		.query_one(
+			INSERT_OBJECT_QUERY,
+			&[
+				&upload.name,
+				&storage_key,
+				&upload.content_type,
+				&parsed_made_on,
+				&location_geometry,
+				&upload.user_id,
+				&upload.publicity,
+			],
+		)
+		.await
+		.map_err(|error| insert_object_error(error, &upload.name))?;
+	row.try_get("id").context("Failed to read inserted object id").map_err(AppError::from)
+}
+
+async fn insert_object_upload_session(
+	transaction: &Transaction<'_>,
+	object_id: i64,
+	storage_key: &str,
+	upload_id: &str,
+	upload: &ObjectUploadSessionCreate,
+	part_size_bytes: i64,
+	session_ttl_seconds: i64,
+) -> Result<ObjectUploadSession, AppError> {
+	let row = transaction
+		.query_one(
+			INSERT_OBJECT_UPLOAD_SESSION_QUERY,
+			&[
+				&object_id,
+				&storage_key,
+				&upload_id,
+				&upload.content_type,
+				&upload.file_size_bytes,
+				&part_size_bytes,
+				&session_ttl_seconds,
+			],
+		)
+		.await
+		.context("Failed to insert object upload session")?;
+	ObjectUploadSession::try_from(row)
+}
+
+fn validate_upload_name(name: &str) -> Result<(), AppError> {
+	if name.trim().is_empty() {
+		return Err(AppError::Validation("Object name must not be empty".to_string()));
+	}
+	Ok(())
+}
+
+fn validate_upload_content_type(content_type: &str) -> Result<(), AppError> {
+	if ALLOWED_MIME_TYPES.contains(&content_type) {
+		return Ok(());
+	}
+	Err(AppError::Validation(format!("Unsupported file type: {content_type}")))
+}
+
+fn validate_part_numbers(
+	session: &ObjectUploadSession,
+	part_numbers: &[i32],
+) -> Result<(), AppError> {
+	if part_numbers.is_empty() {
+		return Err(AppError::Validation("part_numbers must not be empty".to_string()));
+	}
+	if part_numbers.len() > MAX_PRESIGN_PARTS_PER_REQUEST {
+		return Err(AppError::Validation(format!(
+			"part_numbers may contain at most {MAX_PRESIGN_PARTS_PER_REQUEST} entries"
+		)));
+	}
+
+	let total_parts = upload_session_total_parts(session)?;
+	let mut seen = BTreeSet::new();
+	for part_number in part_numbers {
+		if !(1 ..= total_parts).contains(part_number) {
+			return Err(AppError::Validation(format!(
+				"part_number must be between 1 and {total_parts}"
+			)));
+		}
+		if !seen.insert(*part_number) {
+			return Err(AppError::Validation(format!(
+				"part_number {part_number} was requested more than once"
+			)));
+		}
+	}
+
+	Ok(())
+}
+
+fn upload_session_total_parts(session: &ObjectUploadSession) -> Result<i32, AppError> {
+	let count = part_count(session.file_size_bytes, session.part_size_bytes);
+	if count > i64::from(ObjectLifecycleConfig::S3_MAX_MULTIPART_PART_COUNT) {
+		return Err(AppError::Validation(format!(
+			"upload session requires {count} parts, exceeding S3 multipart limit {}",
+			ObjectLifecycleConfig::S3_MAX_MULTIPART_PART_COUNT
+		)));
+	}
+	i32::try_from(count)
+		.context("upload session part count exceeds i32 range")
+		.map_err(AppError::from)
+}
+
+fn upload_session_part_size(
+	session: &ObjectUploadSession,
+	part_number: i32,
+) -> Result<i64, AppError> {
+	let total_parts = upload_session_total_parts(session)?;
+	if !(1 ..= total_parts).contains(&part_number) {
+		return Err(AppError::Validation(format!(
+			"part_number must be between 1 and {total_parts}"
+		)));
+	}
+	Ok(part_length(session.file_size_bytes, session.part_size_bytes, part_number))
+}
+
+fn validate_completed_parts(
+	session: &ObjectUploadSession,
+	mut completed_parts: Vec<CompletedUploadPart>,
+) -> Result<Vec<CompletedUploadPart>, AppError> {
+	let total_parts = upload_session_total_parts(session)?;
+	if completed_parts.len() != total_parts as usize {
+		return Err(AppError::Validation(format!(
+			"completed parts must contain exactly {total_parts} entries"
+		)));
+	}
+
+	completed_parts.sort_by_key(|part| part.part_number);
+	for (index, part) in completed_parts.iter().enumerate() {
+		if part.e_tag.trim().is_empty() {
+			return Err(AppError::Validation(format!(
+				"completed part {} must include a non-empty ETag",
+				part.part_number
+			)));
+		}
+		let expected_part_number = i32::try_from(index + 1)
+			.context("completed part index exceeds i32 range")
+			.map_err(AppError::from)?;
+		if part.part_number != expected_part_number {
+			return Err(AppError::Validation(format!(
+				"completed parts must include every part number from 1 to {total_parts} exactly once"
+			)));
+		}
+	}
+
+	Ok(completed_parts)
+}
+
+fn completed_upload_metadata_error(
+	session: &ObjectUploadSession,
+	metadata: &StoredObjectMetadata,
+) -> Option<String> {
+	if metadata.content_length != session.file_size_bytes {
+		return Some("Completed upload size did not match declared file size".to_string());
+	}
+	if metadata.content_type != session.content_type {
+		return Some(
+			"Completed upload content type did not match declared content type".to_string(),
+		);
+	}
+	None
+}
+
+async fn enqueue_storage_deletions(
+	transaction: &Transaction<'_>,
+	objects: &[S3Object],
+) -> Result<(), AppError> {
+	if objects.is_empty() {
+		return Ok(());
+	}
+
+	let storage_keys = objects.iter().map(|object| object.storage_key.clone()).collect::<Vec<_>>();
+	let object_ids = objects.iter().map(|object| object.id).collect::<Vec<_>>();
+	transaction
+		.execute(INSERT_OBJECT_STORAGE_DELETIONS_QUERY, &[&storage_keys, &object_ids])
+		.await
+		.context("Failed to enqueue object storage deletions")?;
+	Ok(())
+}
+
+fn collect_s3_objects(rows: Vec<Row>) -> Result<Vec<S3Object>, AppError> {
+	rows.into_iter().map(S3Object::try_from).collect()
+}
+
+async fn replace_allowed_users(
+	transaction: &Transaction<'_>,
+	object_id: i64,
+	allowed_users: Vec<String>,
+) -> Result<Vec<String>, AppError> {
+	transaction
+		.execute(DELETE_OBJECT_ALLOWED_USERS_QUERY, &[&object_id])
+		.await
+		.context("Failed to delete object allowed users from database")?;
+
+	if allowed_users.is_empty() {
+		return Ok(Vec::new());
+	}
+
+	transaction
+		.query(REPLACE_OBJECT_ALLOWED_USERS_QUERY, &[&object_id, &allowed_users])
+		.await
+		.context("Failed to replace object allowed users in database")?
+		.into_iter()
+		.map(|row| row.try_get("email").context("Failed to get email from database row"))
+		.collect::<Result<Vec<_>, _>>()
+		.map_err(AppError::from)
+}
+
+/// Generates an unguessable storage key used directly in presigned S3 URLs.
+///
+/// MUST use a cryptographically secure RNG. `rand::rng()` (the default
+/// `ThreadRng`) is documented as a CSPRNG; do not switch to `SmallRng`,
+/// `StdRng::from_seed` with a guessable seed, or any non-cryptographic
+/// generator, or presigned URLs become enumerable.
+fn generate_storage_key() -> String {
+	let key: String = rand::rng().sample_iter(Alphanumeric).take(40).map(char::from).collect();
+	format!("objects/{key}")
+}
+
+fn insert_object_error(
+	error: tokio_postgres::Error,
+	name: &str,
+) -> AppError {
+	if error.as_db_error().is_some_and(|db_error| {
+		db_error.code() == &SqlState::UNIQUE_VIOLATION &&
+			matches!(db_error.constraint(), Some("objects_active_name_key" | "objects_name_key"))
+	}) {
+		return AppError::Validation(format!("Object named '{name}' already exists"));
+	}
+
+	AppError::from(error)
+}
+
+#[cfg(test)]
+mod tests {
+	use {
+		super::{
+			ObjectLifecycleConfig,
+			ObjectUploadSession,
+			completed_upload_metadata_error,
+			validate_completed_parts,
+		},
+		crate::storage::{
+			CompletedUploadPart,
+			StoredObjectMetadata,
+		},
+		jiff::Timestamp,
+	};
+
+	#[test]
+	fn completed_parts_validation_requires_exact_sequential_parts() -> anyhow::Result<()> {
+		let session = upload_session_for_test(
+			(ObjectLifecycleConfig::S3_MIN_MULTIPART_PART_SIZE_BYTES * 2) - 1,
+			ObjectLifecycleConfig::S3_MIN_MULTIPART_PART_SIZE_BYTES,
+		);
+
+		let sorted = validate_completed_parts(
+			&session,
+			vec![completed_part(2, "etag-2"), completed_part(1, "etag-1")],
+		)?;
+
+		assert_eq!(sorted.iter().map(|part| part.part_number).collect::<Vec<_>>(), vec![1, 2]);
+		assert!(validate_completed_parts(&session, vec![completed_part(1, "etag-1")]).is_err());
+		assert!(
+			validate_completed_parts(
+				&session,
+				vec![completed_part(1, "etag-1"), completed_part(1, "etag-duplicate")]
+			)
+			.is_err()
+		);
+		assert!(
+			validate_completed_parts(
+				&session,
+				vec![completed_part(1, "etag-1"), completed_part(2, " ")]
+			)
+			.is_err()
+		);
+
+		Ok(())
+	}
+
+	#[test]
+	fn completed_upload_metadata_must_match_session_policy() {
+		let session =
+			upload_session_for_test(10, ObjectLifecycleConfig::S3_MIN_MULTIPART_PART_SIZE_BYTES);
+
+		assert_eq!(
+			completed_upload_metadata_error(
+				&session,
+				&StoredObjectMetadata {
+					content_length: 10,
+					content_type: "image/png".to_string(),
+				}
+			),
+			None
+		);
+		assert!(
+			completed_upload_metadata_error(
+				&session,
+				&StoredObjectMetadata {
+					content_length: 11,
+					content_type: "image/png".to_string(),
+				}
+			)
+			.is_some()
+		);
+		assert!(
+			completed_upload_metadata_error(
+				&session,
+				&StoredObjectMetadata {
+					content_length: 10,
+					content_type: "image/jpeg".to_string(),
+				}
+			)
+			.is_some()
+		);
+	}
+
+	fn completed_part(
+		part_number: i32,
+		e_tag: &str,
+	) -> CompletedUploadPart {
+		CompletedUploadPart {
+			part_number,
+			e_tag: e_tag.to_string(),
+		}
+	}
+
+	fn upload_session_for_test(
+		file_size_bytes: i64,
+		part_size_bytes: i64,
+	) -> ObjectUploadSession {
+		ObjectUploadSession {
+			object_id: 1,
+			storage_key: "objects/test".to_string(),
+			upload_id: "upload-id".to_string(),
+			content_type: "image/png".to_string(),
+			file_size_bytes,
+			part_size_bytes,
+			expires_at: Timestamp::now(),
+		}
+	}
+}
diff --git a/backend/src/object_lifecycle/worker.rs b/backend/src/object_lifecycle/worker.rs
new file mode 100644
index 0000000..c868172
--- /dev/null
+++ b/backend/src/object_lifecycle/worker.rs
@@ -0,0 +1,52 @@
+use {
+	super::{
+		ObjectLifecycleConfig,
+		ObjectLifecycleService,
+	},
+	crate::{
+		errors::AppError,
+		storage::StorageClient,
+		worker::MaintenanceTask,
+	},
+	deadpool::managed::Pool,
+	deadpool_postgres::Manager,
+	std::time::Duration,
+};
+
+#[derive(Clone)]
+pub struct ObjectLifecycleWorker {
+	pool: Pool<Manager>,
+	storage: StorageClient,
+	config: ObjectLifecycleConfig,
+}
+
+impl ObjectLifecycleWorker {
+	pub fn new(
+		pool: Pool<Manager>,
+		storage: StorageClient,
+		config: ObjectLifecycleConfig,
+	) -> Self {
+		Self {
+			pool,
+			storage,
+			config,
+		}
+	}
+}
+
+impl MaintenanceTask for ObjectLifecycleWorker {
+	fn name(&self) -> &'static str {
+		"object_storage_lifecycle"
+	}
+
+	fn interval(&self) -> Duration {
+		self.config.worker_interval()
+	}
+
+	async fn run_once(&self) -> Result<(), AppError> {
+		let mut client = self.pool.get().await?;
+		let mut object_lifecycle =
+			ObjectLifecycleService::new(&mut client, &self.storage, self.config.clone());
+		object_lifecycle.run_storage_maintenance().await
+	}
+}
diff --git a/backend/src/outbox.rs b/backend/src/outbox.rs
new file mode 100644
index 0000000..e2ae135
--- /dev/null
+++ b/backend/src/outbox.rs
@@ -0,0 +1,321 @@
+//! Shared primitives for the transactional outbox / lease-retry pattern used by
+//! the storage-deletion and email-outbox workers.
+
+use {
+	crate::errors::AppError,
+	std::future::Future,
+};
+
+/// Bails with an `anyhow` error if a config field is not strictly positive,
+/// naming the field in the message via `stringify!`. This removes the repetitive
+/// per-field `if x <= 0 { bail!("x must be greater than 0") }` blocks (and the
+/// copy-paste hazard of a check naming the wrong field).
+macro_rules! ensure_positive {
+	($obj:expr, $field:ident) => {
+		if $obj.$field <= 0 {
+			::anyhow::bail!("{} must be greater than 0", ::core::stringify!($field));
+		}
+	};
+}
+pub(crate) use ensure_positive;
+
+/// Runtime view of one outbox's lease/retry policy.
+///
+/// This is deliberately NOT a deserialized config struct: each owning config
+/// (storage deletion, upload-session cleanup, email outbox) keeps its own flat
+/// fields so their genuinely different defaults stay correct (e.g. `batch_size`
+/// defaults to 1000 for storage, matching S3's multi-delete cap, but 100 for
+/// email). The owners build this view via accessors; the drain loop and claim
+/// queries consume it.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct OutboxRetryConfig {
+	pub retry_seconds: i64,
+	pub lease_seconds: i64,
+	pub batch_size: i64,
+	pub max_attempts: i32,
+}
+
+impl OutboxRetryConfig {
+	/// Validates that every knob is strictly positive, prefixing the field name
+	/// with `label` (the owning group, e.g. `storage_deletion`) so operator-facing
+	/// errors stay specific.
+	pub fn validate(
+		&self,
+		label: &str,
+	) -> anyhow::Result<()> {
+		if self.retry_seconds <= 0 {
+			anyhow::bail!("{label}.retry_seconds must be greater than 0");
+		}
+		if self.lease_seconds <= 0 {
+			anyhow::bail!("{label}.lease_seconds must be greater than 0");
+		}
+		if self.batch_size <= 0 {
+			anyhow::bail!("{label}.batch_size must be greater than 0");
+		}
+		if self.max_attempts <= 0 {
+			anyhow::bail!("{label}.max_attempts must be greater than 0");
+		}
+		Ok(())
+	}
+}
+
+/// A claimed batch that failed processing, paired with the error to record and
+/// surface.
+pub struct FailedGroup<Item> {
+	pub items: Vec<Item>,
+	pub error: anyhow::Error,
+}
+
+/// The partition of one processed batch into items to clear (done) and groups to
+/// mark failed (to retry later).
+pub struct DrainOutcome<Item> {
+	pub cleared: Vec<Item>,
+	pub failed: Vec<FailedGroup<Item>>,
+}
+
+impl<Item> DrainOutcome<Item> {
+	/// Every item in the batch succeeded.
+	pub fn all_cleared(items: Vec<Item>) -> Self {
+		Self {
+			cleared: items,
+			failed: Vec::new(),
+		}
+	}
+
+	/// The whole batch failed with a single error (the all-or-nothing case, e.g.
+	/// one S3 multi-delete request).
+	pub fn whole_batch_failed(
+		items: Vec<Item>,
+		error: anyhow::Error,
+	) -> Self {
+		Self {
+			cleared: Vec::new(),
+			failed: vec![FailedGroup {
+				items,
+				error,
+			}],
+		}
+	}
+}
+
+/// A transactional outbox table: a set of claimable job rows under a lease/retry
+/// policy. `claim` leases a batch (bumping attempts and the next-attempt time),
+/// `clear` removes finished rows, and `mark_failed` records an error and
+/// reschedules.
+///
+/// The methods return futures with an explicit `Send` bound because
+/// `drain_outbox` is awaited inside a `tokio::spawn`ed worker task (the same
+/// reason as `worker::MaintenanceTask`); a bare async-fn-in-trait could not
+/// express that bound at the generic call site.
+pub trait OutboxQueue {
+	type Item: Send;
+
+	fn claim(
+		&mut self,
+		retry: &OutboxRetryConfig,
+	) -> impl Future<Output = Result<Vec<Self::Item>, AppError>> + Send;
+
+	fn clear(
+		&mut self,
+		items: &[Self::Item],
+	) -> impl Future<Output = Result<(), AppError>> + Send;
+
+	fn mark_failed(
+		&mut self,
+		items: &[Self::Item],
+		error_message: &str,
+		retry_after_seconds: i64,
+	) -> impl Future<Output = Result<(), AppError>> + Send;
+}
+
+/// The side-effecting work for one claimed batch (delete objects from storage,
+/// send emails). Returning a [`DrainOutcome`] lets the all-or-nothing shape
+/// (storage: one request for the whole batch) and the per-item shape (email: one
+/// send per message) both be expressed without `drain_outbox` knowing which is
+/// which.
+pub trait OutboxProcessor {
+	type Item;
+
+	fn process(
+		&self,
+		items: Vec<Self::Item>,
+	) -> impl Future<Output = DrainOutcome<Self::Item>> + Send;
+}
+
+/// Drains an outbox to completion.
+///
+/// Claims a batch, processes it, clears the successes, and marks each failed
+/// group for retry. A failure does not abort the drain: the loop keeps claiming
+/// (rows just marked failed are rescheduled past `now()`, so they are not
+/// re-claimed this pass), and the first error is surfaced once the queue empties
+/// so the worker still records that something went wrong. Bounded by the queue's
+/// `max_attempts`: a permanently broken row stops being claimable, so the loop
+/// cannot spin forever.
+pub async fn drain_outbox<Q, P>(
+	queue: &mut Q,
+	processor: &P,
+	retry: &OutboxRetryConfig,
+) -> Result<(), AppError>
+where
+	Q: OutboxQueue,
+	P: OutboxProcessor<Item = Q::Item>, {
+	let mut first_error: Option<AppError> = None;
+	loop {
+		let items = queue.claim(retry).await?;
+		if items.is_empty() {
+			break;
+		}
+
+		let DrainOutcome {
+			cleared,
+			failed,
+		} = processor.process(items).await;
+		if !cleared.is_empty() {
+			queue.clear(&cleared).await?;
+		}
+		for group in failed {
+			let error_message = group.error.to_string();
+			queue.mark_failed(&group.items, &error_message, retry.retry_seconds).await?;
+			if first_error.is_none() {
+				first_error = Some(AppError::Internal(group.error));
+			}
+		}
+	}
+
+	match first_error {
+		Some(error) => Err(error),
+		None => Ok(()),
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use {
+		super::{
+			DrainOutcome,
+			OutboxProcessor,
+			OutboxQueue,
+			OutboxRetryConfig,
+			drain_outbox,
+		},
+		crate::errors::AppError,
+		std::collections::VecDeque,
+	};
+
+	fn retry() -> OutboxRetryConfig {
+		OutboxRetryConfig {
+			retry_seconds: 17,
+			lease_seconds: 300,
+			batch_size: 1000,
+			max_attempts: 10,
+		}
+	}
+
+	#[derive(Default)]
+	struct FakeQueue {
+		pending: VecDeque<Vec<String>>,
+		claims: Vec<OutboxRetryConfig>,
+		cleared: Vec<Vec<String>>,
+		failed: Vec<(Vec<String>, String, i64)>,
+	}
+
+	impl OutboxQueue for FakeQueue {
+		type Item = String;
+
+		async fn claim(
+			&mut self,
+			retry: &OutboxRetryConfig,
+		) -> Result<Vec<String>, AppError> {
+			self.claims.push(*retry);
+			Ok(self.pending.pop_front().unwrap_or_default())
+		}
+
+		async fn clear(
+			&mut self,
+			items: &[String],
+		) -> Result<(), AppError> {
+			self.cleared.push(items.to_vec());
+			Ok(())
+		}
+
+		async fn mark_failed(
+			&mut self,
+			items: &[String],
+			error_message: &str,
+			retry_after_seconds: i64,
+		) -> Result<(), AppError> {
+			self.failed.push((items.to_vec(), error_message.to_string(), retry_after_seconds));
+			Ok(())
+		}
+	}
+
+	/// Processor that succeeds on the whole batch.
+	struct ClearAll;
+
+	impl OutboxProcessor for ClearAll {
+		type Item = String;
+
+		async fn process(
+			&self,
+			items: Vec<String>,
+		) -> DrainOutcome<String> {
+			DrainOutcome::all_cleared(items)
+		}
+	}
+
+	/// Processor that fails the whole batch with a fixed message.
+	struct FailAll(&'static str);
+
+	impl OutboxProcessor for FailAll {
+		type Item = String;
+
+		async fn process(
+			&self,
+			items: Vec<String>,
+		) -> DrainOutcome<String> {
+			DrainOutcome::whole_batch_failed(items, anyhow::anyhow!(self.0))
+		}
+	}
+
+	#[tokio::test]
+	async fn drain_outbox_clears_all_pending_batches() -> anyhow::Result<()> {
+		let mut queue = FakeQueue {
+			pending: vec![vec!["a".to_string(), "b".to_string()], vec!["c".to_string()]].into(),
+			..FakeQueue::default()
+		};
+
+		drain_outbox(&mut queue, &ClearAll, &retry()).await?;
+
+		assert_eq!(
+			queue.cleared,
+			vec![vec!["a".to_string(), "b".to_string()], vec!["c".to_string()]]
+		);
+		assert!(queue.failed.is_empty());
+		// Two batches plus the empty claim that ends the loop, all with the same policy.
+		assert_eq!(queue.claims, vec![retry(), retry(), retry()]);
+		Ok(())
+	}
+
+	#[tokio::test]
+	async fn drain_outbox_marks_failures_and_surfaces_first_error() -> anyhow::Result<()> {
+		let mut queue = FakeQueue {
+			pending: vec![vec!["x".to_string(), "y".to_string()]].into(),
+			..FakeQueue::default()
+		};
+
+		let Err(error) = drain_outbox(&mut queue, &FailAll("boom"), &retry()).await else {
+			anyhow::bail!("a processing failure should surface as an error");
+		};
+
+		assert!(matches!(error, AppError::Internal(_)));
+		assert!(queue.cleared.is_empty());
+		assert_eq!(
+			queue.failed,
+			vec![(vec!["x".to_string(), "y".to_string()], "boom".to_string(), 17)]
+		);
+		// One claim returns the failing batch, a second returns empty and ends the
+		// drain: failures are rescheduled, not retried in the same pass.
+		assert_eq!(queue.claims.len(), 2);
+		Ok(())
+	}
+}
diff --git a/backend/src/storage.rs b/backend/src/storage.rs
new file mode 100644
index 0000000..474727c
--- /dev/null
+++ b/backend/src/storage.rs
@@ -0,0 +1,726 @@
+use {
+	crate::Config,
+	anyhow::Context,
+	aws_credential_types::Credentials,
+	aws_sdk_s3::{
+		Client,
+		config::{
+			BehaviorVersion,
+			Region,
+		},
+		error::{
+			ProvideErrorMetadata,
+			SdkError,
+		},
+		operation::{
+			abort_multipart_upload::AbortMultipartUploadError,
+			complete_multipart_upload::CompleteMultipartUploadError,
+			create_bucket::CreateBucketError,
+			head_bucket::HeadBucketError,
+			head_object::HeadObjectError,
+		},
+		presigning::PresigningConfig,
+		primitives::ByteStream,
+		types::{
+			CompletedMultipartUpload,
+			CompletedPart,
+			CorsConfiguration,
+			CorsRule,
+			Delete,
+			ObjectIdentifier,
+		},
+	},
+	serde::Deserialize,
+	std::{
+		fmt,
+		time::Duration,
+	},
+	tokio::time::{
+		Instant,
+		sleep,
+	},
+};
+
+#[derive(Clone, Deserialize)]
+pub struct StorageConfig {
+	pub endpoint_url: String,
+	#[serde(default)]
+	pub public_endpoint_url: Option<String>,
+	pub access_key: String,
+	pub secret_key: String,
+	pub bucket_name: String,
+	#[serde(default = "StorageConfig::default_region")]
+	pub region: String,
+	#[serde(default = "StorageConfig::default_force_path_style")]
+	pub force_path_style: bool,
+	#[serde(default = "StorageConfig::default_presigned_url_ttl_seconds")]
+	pub presigned_url_ttl_seconds: u64,
+}
+
+impl fmt::Debug for StorageConfig {
+	fn fmt(
+		&self,
+		f: &mut fmt::Formatter<'_>,
+	) -> fmt::Result {
+		f.debug_struct("StorageConfig")
+			.field("endpoint_url", &self.endpoint_url)
+			.field("public_endpoint_url", &self.public_endpoint_url)
+			.field("access_key", &"<redacted>")
+			.field("secret_key", &"<redacted>")
+			.field("bucket_name", &self.bucket_name)
+			.field("region", &self.region)
+			.field("force_path_style", &self.force_path_style)
+			.field("presigned_url_ttl_seconds", &self.presigned_url_ttl_seconds)
+			.finish()
+	}
+}
+
+impl StorageConfig {
+	pub const MAX_PRESIGNED_URL_TTL_SECONDS: u64 = 604_800;
+
+	pub fn default_region() -> String {
+		"us-east-1".to_string()
+	}
+
+	pub const fn default_force_path_style() -> bool {
+		true
+	}
+
+	pub const fn default_presigned_url_ttl_seconds() -> u64 {
+		604_800
+	}
+
+	/// Loads just the storage section from the environment for binaries that don't
+	/// need the rest of the config (e.g. the storage bootstrap binary). Uses the same
+	/// `MEMORY_MAP__STORAGE__*` keys as the main config.
+	pub fn from_env() -> anyhow::Result<Self> {
+		let raw = config::Config::builder()
+			.add_source(
+				config::Environment::with_prefix("MEMORY_MAP__STORAGE")
+					.prefix_separator("__")
+					.separator("__"),
+			)
+			.build()
+			.context("Failed to read storage config from environment")?;
+		let config: StorageConfig = raw
+			.try_deserialize()
+			.context("Failed to deserialize storage config from environment")?;
+		config.validate()?;
+		Ok(config)
+	}
+
+	pub fn validate(&self) -> anyhow::Result<()> {
+		if let Some(public_endpoint_url) = &self.public_endpoint_url &&
+			public_endpoint_url.trim().is_empty()
+		{
+			anyhow::bail!("storage.public_endpoint_url must not be empty when configured");
+		}
+		if !(1 ..= Self::MAX_PRESIGNED_URL_TTL_SECONDS).contains(&self.presigned_url_ttl_seconds) {
+			anyhow::bail!(
+				"s3_presigned_url_ttl_seconds must be between 1 and {}",
+				Self::MAX_PRESIGNED_URL_TTL_SECONDS
+			);
+		}
+		Ok(())
+	}
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PresignedHeader {
+	pub name: String,
+	pub value: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PresignedUploadPart {
+	pub url: String,
+	pub method: String,
+	pub headers: Vec<PresignedHeader>,
+	pub expected_content_length: i64,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct CompletedUploadPart {
+	pub part_number: i32,
+	pub e_tag: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct StoredObjectMetadata {
+	pub content_length: i64,
+	pub content_type: String,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum MultipartUploadCompleteOutcome {
+	Completed,
+	UploadNotFound,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum MultipartUploadAbortOutcome {
+	Aborted,
+	UploadNotFound,
+}
+
+#[derive(Clone)]
+pub struct StorageClient {
+	client: Client,
+	presigning_client: Client,
+	bucket_name: String,
+	presigning_config: PresigningConfig,
+}
+
+impl StorageClient {
+	/// S3 caps multi-object delete requests at 1000 keys per call. This is an internal
+	/// concern of the storage layer; higher levels pass arbitrary key counts and the
+	/// chunking happens inside `delete_objects`.
+	const MAX_DELETE_OBJECTS_PER_REQUEST: usize = 1000;
+
+	pub fn from_config(config: &Config) -> anyhow::Result<Self> {
+		Self::from_storage_config(&config.storage)
+	}
+
+	pub fn from_storage_config(config: &StorageConfig) -> anyhow::Result<Self> {
+		config.validate()?;
+		let client_config = s3_client_config(config, &config.endpoint_url);
+		let presigning_endpoint_url =
+			config.public_endpoint_url.as_deref().unwrap_or(&config.endpoint_url);
+		let presigning_client_config = s3_client_config(config, presigning_endpoint_url);
+		let presigning_config =
+			PresigningConfig::expires_in(Duration::from_secs(config.presigned_url_ttl_seconds))
+				.context("Failed to configure S3 presigned URL expiry")?;
+
+		Ok(Self {
+			client: Client::from_conf(client_config),
+			presigning_client: Client::from_conf(presigning_client_config),
+			bucket_name: config.bucket_name.clone(),
+			presigning_config,
+		})
+	}
+
+	/// Uploads an object directly. Now exercised only by the integration tests
+	/// (the production upload path is presigned multipart, driven by the client);
+	/// kept as a public storage primitive and test seam.
+	pub async fn upload_object(
+		&self,
+		storage_key: &str,
+		bytes: impl Into<ByteStream>,
+		content_type: impl Into<String>,
+	) -> anyhow::Result<()> {
+		self.client
+			.put_object()
+			.bucket(&self.bucket_name)
+			.key(storage_key)
+			.body(bytes.into())
+			.content_type(content_type.into())
+			.send()
+			.await
+			.context("Failed to upload object to S3 storage")?;
+		Ok(())
+	}
+
+	/// Reads a stored object's content type. Now exercised only by the integration
+	/// tests (production reads metadata via [`Self::head_object`]); kept as a public
+	/// storage primitive and test seam.
+	pub async fn object_content_type(
+		&self,
+		storage_key: &str,
+	) -> anyhow::Result<String> {
+		Ok(self.head_object(storage_key).await?.content_type)
+	}
+
+	/// Presigns a GET for `storage_key`. When `content_disposition` is set it is
+	/// signed into the URL as `response-content-disposition`, so the storage
+	/// response carries that header (used to force `attachment` for script-capable
+	/// types like SVG; see the object resolver).
+	pub async fn presigned_get_url(
+		&self,
+		storage_key: &str,
+		content_disposition: Option<&str>,
+	) -> anyhow::Result<String> {
+		let request = self
+			.presigning_client
+			.get_object()
+			.bucket(&self.bucket_name)
+			.key(storage_key)
+			.set_response_content_disposition(content_disposition.map(str::to_string))
+			.presigned(self.presigning_config.clone())
+			.await
+			.context("Failed to generate S3 presigned GET URL")?;
+		Ok(request.uri().to_string())
+	}
+
+	pub async fn create_multipart_upload(
+		&self,
+		storage_key: &str,
+		content_type: &str,
+	) -> anyhow::Result<String> {
+		let output = self
+			.client
+			.create_multipart_upload()
+			.bucket(&self.bucket_name)
+			.key(storage_key)
+			.content_type(content_type)
+			.send()
+			.await
+			.context("Failed to create S3 multipart upload")?;
+		output
+			.upload_id()
+			.map(str::to_string)
+			.context("S3 multipart upload response did not include an upload id")
+	}
+
+	pub async fn presigned_upload_part_url(
+		&self,
+		storage_key: &str,
+		upload_id: &str,
+		part_number: i32,
+		expected_content_length: i64,
+	) -> anyhow::Result<PresignedUploadPart> {
+		let request = self
+			.presigning_client
+			.upload_part()
+			.bucket(&self.bucket_name)
+			.key(storage_key)
+			.upload_id(upload_id)
+			.part_number(part_number)
+			.content_length(expected_content_length)
+			.presigned(self.presigning_config.clone())
+			.await
+			.context("Failed to generate S3 presigned upload-part URL")?;
+		let headers = request
+			.headers()
+			.filter(|(name, _value)| browser_can_set_header(name))
+			.map(|(name, value)| PresignedHeader {
+				name: name.to_string(),
+				value: value.to_string(),
+			})
+			.collect();
+
+		Ok(PresignedUploadPart {
+			url: request.uri().to_string(),
+			method: request.method().to_string(),
+			headers,
+			expected_content_length,
+		})
+	}
+
+	pub async fn complete_multipart_upload(
+		&self,
+		storage_key: &str,
+		upload_id: &str,
+		completed_parts: &[CompletedUploadPart],
+	) -> anyhow::Result<MultipartUploadCompleteOutcome> {
+		let completed_parts = completed_parts
+			.iter()
+			.map(|part| {
+				CompletedPart::builder()
+					.part_number(part.part_number)
+					.e_tag(part.e_tag.clone())
+					.build()
+			})
+			.collect::<Vec<_>>();
+		let upload = CompletedMultipartUpload::builder().set_parts(Some(completed_parts)).build();
+
+		match self
+			.client
+			.complete_multipart_upload()
+			.bucket(&self.bucket_name)
+			.key(storage_key)
+			.upload_id(upload_id)
+			.multipart_upload(upload)
+			.send()
+			.await
+		{
+			Ok(_) => Ok(MultipartUploadCompleteOutcome::Completed),
+			Err(error) if complete_multipart_upload_error_is_no_such_upload(&error) =>
+				Ok(MultipartUploadCompleteOutcome::UploadNotFound),
+			Err(error) => Err(error).context("Failed to complete S3 multipart upload"),
+		}
+	}
+
+	pub async fn abort_multipart_upload(
+		&self,
+		storage_key: &str,
+		upload_id: &str,
+	) -> anyhow::Result<MultipartUploadAbortOutcome> {
+		match self
+			.client
+			.abort_multipart_upload()
+			.bucket(&self.bucket_name)
+			.key(storage_key)
+			.upload_id(upload_id)
+			.send()
+			.await
+		{
+			Ok(_) => Ok(MultipartUploadAbortOutcome::Aborted),
+			Err(error) if abort_multipart_upload_error_is_no_such_upload(&error) =>
+				Ok(MultipartUploadAbortOutcome::UploadNotFound),
+			Err(error) => Err(error).context("Failed to abort S3 multipart upload"),
+		}
+	}
+
+	pub async fn head_object(
+		&self,
+		storage_key: &str,
+	) -> anyhow::Result<StoredObjectMetadata> {
+		self.head_object_opt(storage_key)
+			.await?
+			.with_context(|| format!("S3 object not found: {storage_key}"))
+	}
+
+	pub async fn head_object_opt(
+		&self,
+		storage_key: &str,
+	) -> anyhow::Result<Option<StoredObjectMetadata>> {
+		let output =
+			match self.client.head_object().bucket(&self.bucket_name).key(storage_key).send().await
+			{
+				Ok(output) => output,
+				Err(error) if head_object_error_is_not_found(&error) => return Ok(None),
+				Err(error) => return Err(error).context("Failed to read S3 object metadata"),
+			};
+		let content_length =
+			output.content_length().context("S3 object response did not include Content-Length")?;
+		let content_type = output
+			.content_type()
+			.map(str::to_string)
+			.context("S3 object response did not include Content-Type")?;
+
+		Ok(Some(StoredObjectMetadata {
+			content_length,
+			content_type,
+		}))
+	}
+
+	pub async fn delete_objects(
+		&self,
+		storage_keys: &[String],
+	) -> anyhow::Result<()> {
+		for storage_keys in storage_key_delete_batches(storage_keys) {
+			self.delete_object_batch(storage_keys).await?;
+		}
+		Ok(())
+	}
+
+	async fn delete_object_batch(
+		&self,
+		storage_keys: &[String],
+	) -> anyhow::Result<()> {
+		let mut objects = Vec::with_capacity(storage_keys.len());
+		for storage_key in storage_keys {
+			objects.push(
+				ObjectIdentifier::builder()
+					.key(storage_key)
+					.build()
+					.context("Failed to build S3 delete object identifier")?,
+			);
+		}
+		let delete = Delete::builder()
+			.set_objects(Some(objects))
+			.build()
+			.context("Failed to build S3 delete request")?;
+
+		let output = self
+			.client
+			.delete_objects()
+			.bucket(&self.bucket_name)
+			.delete(delete)
+			.send()
+			.await
+			.context("Failed to delete objects from S3 storage")?;
+		let errors = output.errors();
+		if !errors.is_empty() {
+			let details = errors
+				.iter()
+				.take(3)
+				.map(|error| {
+					let message =
+						error.message().map(|message| format!(" ({message})")).unwrap_or_default();
+					format!(
+						"{}: {}{}",
+						error.key().unwrap_or("<unknown key>"),
+						error.code().unwrap_or("unknown error"),
+						message
+					)
+				})
+				.collect::<Vec<_>>()
+				.join("; ");
+			anyhow::bail!("S3 reported {} failed object delete(s): {}", errors.len(), details);
+		}
+		Ok(())
+	}
+
+	pub async fn verify_bucket_ready(&self) -> anyhow::Result<()> {
+		self.client
+			.head_bucket()
+			.bucket(&self.bucket_name)
+			.send()
+			.await
+			.context("Failed to verify S3 bucket readiness")?;
+		Ok(())
+	}
+
+	pub async fn wait_until_ready(
+		&self,
+		timeout: Duration,
+	) -> anyhow::Result<()> {
+		let started_at = Instant::now();
+		let mut retry_delay = Duration::from_millis(250);
+
+		let error = loop {
+			match self.head_bucket().await {
+				Ok(_) => return Ok(()),
+				Err(error) => {
+					let elapsed = started_at.elapsed();
+					if elapsed >= timeout {
+						break error;
+					}
+
+					let remaining = timeout.saturating_sub(elapsed);
+					sleep(retry_delay.min(remaining)).await;
+					retry_delay = retry_delay.saturating_mul(2).min(Duration::from_secs(5));
+				}
+			}
+		};
+
+		Err(error).with_context(|| format!("S3 storage did not become ready within {timeout:?}"))
+	}
+
+	pub async fn ensure_bucket_exists(&self) -> anyhow::Result<()> {
+		if self.head_bucket().await? {
+			return Ok(());
+		}
+
+		match self.client.create_bucket().bucket(&self.bucket_name).send().await {
+			Ok(_) => {}
+			Err(error) if create_bucket_error_means_existing_bucket(&error) => {}
+			Err(error) => {
+				return Err(error).context("Failed to create S3 bucket");
+			}
+		}
+
+		self.verify_bucket_ready().await.context("Failed to verify S3 bucket after creation")?;
+		Ok(())
+	}
+
+	pub async fn configure_upload_cors(
+		&self,
+		allowed_origins: &[String],
+	) -> anyhow::Result<()> {
+		if allowed_origins.is_empty() {
+			anyhow::bail!("At least one CORS allowed origin is required");
+		}
+
+		let upload_rule = CorsRule::builder()
+			.set_allowed_origins(Some(allowed_origins.to_vec()))
+			.set_allowed_methods(Some(vec!["PUT".to_string()]))
+			.set_allowed_headers(Some(vec!["*".to_string()]))
+			.set_expose_headers(Some(vec!["ETag".to_string()]))
+			.max_age_seconds(3000)
+			.build()
+			.context("Failed to build S3 upload CORS rule")?;
+		let cors = CorsConfiguration::builder()
+			.cors_rules(upload_rule)
+			.build()
+			.context("Failed to build S3 CORS configuration")?;
+
+		self.client
+			.put_bucket_cors()
+			.bucket(&self.bucket_name)
+			.cors_configuration(cors)
+			.send()
+			.await
+			.context("Failed to configure S3 bucket CORS")?;
+		Ok(())
+	}
+
+	async fn head_bucket(&self) -> anyhow::Result<bool> {
+		match self.client.head_bucket().bucket(&self.bucket_name).send().await {
+			Ok(_) => Ok(true),
+			Err(error) if head_bucket_error_is_not_found(&error) => Ok(false),
+			Err(error) => Err(error).context("Failed to check S3 bucket readiness"),
+		}
+	}
+}
+
+impl fmt::Debug for StorageClient {
+	fn fmt(
+		&self,
+		f: &mut fmt::Formatter<'_>,
+	) -> fmt::Result {
+		f.debug_struct("StorageClient")
+			.field("bucket_name", &self.bucket_name)
+			.field("presigning_config", &self.presigning_config)
+			.finish_non_exhaustive()
+	}
+}
+
+fn head_bucket_error_is_not_found(error: &SdkError<HeadBucketError>) -> bool {
+	error.as_service_error().is_some_and(HeadBucketError::is_not_found)
+}
+
+fn head_object_error_is_not_found(error: &SdkError<HeadObjectError>) -> bool {
+	error.as_service_error().is_some_and(HeadObjectError::is_not_found)
+}
+
+fn abort_multipart_upload_error_is_no_such_upload(
+	error: &SdkError<AbortMultipartUploadError>
+) -> bool {
+	error
+		.as_service_error()
+		.is_some_and(|error| error.is_no_such_upload() || error.code() == Some("NoSuchUpload"))
+}
+
+fn complete_multipart_upload_error_is_no_such_upload(
+	error: &SdkError<CompleteMultipartUploadError>
+) -> bool {
+	error.as_service_error().is_some_and(|error| error.code() == Some("NoSuchUpload"))
+}
+
+fn create_bucket_error_means_existing_bucket(error: &SdkError<CreateBucketError>) -> bool {
+	error.as_service_error().is_some_and(|error| {
+		error.is_bucket_already_exists() || error.is_bucket_already_owned_by_you()
+	})
+}
+
+fn s3_client_config(
+	config: &StorageConfig,
+	endpoint_url: &str,
+) -> aws_sdk_s3::Config {
+	let credentials = Credentials::new(
+		config.access_key.clone(),
+		config.secret_key.clone(),
+		None,
+		None,
+		"memory-map",
+	);
+	aws_sdk_s3::Config::builder()
+		.behavior_version(BehaviorVersion::latest())
+		.region(Region::new(config.region.clone()))
+		.credentials_provider(credentials)
+		.endpoint_url(endpoint_url)
+		.force_path_style(config.force_path_style)
+		.build()
+}
+
+fn browser_can_set_header(name: &str) -> bool {
+	let name = name.to_ascii_lowercase();
+	if name.starts_with("proxy-") || name.starts_with("sec-") {
+		return false;
+	}
+
+	!matches!(
+		name.as_str(),
+		"accept-charset" |
+			"accept-encoding" |
+			"access-control-request-headers" |
+			"access-control-request-method" |
+			"connection" |
+			"content-length" |
+			"cookie" | "date" |
+			"dnt" | "expect" |
+			"host" | "keep-alive" |
+			"origin" | "permissions-policy" |
+			"referer" | "te" |
+			"trailer" | "transfer-encoding" |
+			"upgrade" | "user-agent" |
+			"via"
+	)
+}
+
+fn storage_key_delete_batches(storage_keys: &[String]) -> impl Iterator<Item = &[String]> {
+	storage_keys.chunks(StorageClient::MAX_DELETE_OBJECTS_PER_REQUEST)
+}
+
+#[cfg(test)]
+mod tests {
+	use super::{
+		StorageClient,
+		StorageConfig,
+		browser_can_set_header,
+		storage_key_delete_batches,
+	};
+
+	fn storage_config_with_ttl(presigned_url_ttl_seconds: u64) -> StorageConfig {
+		StorageConfig {
+			endpoint_url: "http://127.0.0.1:9000/".to_string(),
+			public_endpoint_url: None,
+			access_key: "memorymapdev".to_string(),
+			secret_key: "memorymapdevsecret".to_string(),
+			bucket_name: "memory-map".to_string(),
+			region: "us-east-1".to_string(),
+			force_path_style: true,
+			presigned_url_ttl_seconds,
+		}
+	}
+
+	#[test]
+	fn storage_config_accepts_presigned_url_ttl_boundaries() {
+		assert!(storage_config_with_ttl(1).validate().is_ok());
+		assert!(
+			storage_config_with_ttl(StorageConfig::MAX_PRESIGNED_URL_TTL_SECONDS)
+				.validate()
+				.is_ok()
+		);
+	}
+
+	#[test]
+	fn storage_config_rejects_presigned_url_ttl_outside_allowed_range() {
+		assert!(storage_config_with_ttl(0).validate().is_err());
+		assert!(
+			storage_config_with_ttl(StorageConfig::MAX_PRESIGNED_URL_TTL_SECONDS + 1)
+				.validate()
+				.is_err()
+		);
+	}
+
+	#[test]
+	fn storage_config_debug_redacts_credentials() {
+		let mut config = storage_config_with_ttl(60);
+		config.public_endpoint_url = Some("https://public-s3.example.test".to_string());
+		config.access_key = "debug-access-key-secret".to_string();
+		config.secret_key = "debug-secret-key-secret".to_string();
+
+		let debug = format!("{config:?}");
+
+		assert!(debug.contains("StorageConfig"));
+		assert!(debug.contains("http://127.0.0.1:9000/"));
+		assert!(debug.contains("https://public-s3.example.test"));
+		assert!(debug.contains("<redacted>"));
+		assert!(!debug.contains("debug-access-key-secret"));
+		assert!(!debug.contains("debug-secret-key-secret"));
+	}
+
+	#[test]
+	fn storage_config_rejects_empty_public_endpoint_url() {
+		let mut config = storage_config_with_ttl(60);
+		config.public_endpoint_url = Some(" ".to_string());
+
+		let error = config.validate().err();
+		assert!(
+			error.as_ref().is_some_and(|error| error.to_string().contains("public_endpoint_url"))
+		);
+	}
+
+	#[test]
+	fn presigned_upload_headers_skip_browser_forbidden_headers() {
+		assert!(browser_can_set_header("x-amz-checksum-crc32"));
+		assert!(!browser_can_set_header("host"));
+		assert!(!browser_can_set_header("content-length"));
+		assert!(!browser_can_set_header("proxy-authorization"));
+		assert!(!browser_can_set_header("sec-fetch-mode"));
+	}
+
+	#[test]
+	fn delete_object_batches_respect_s3_multi_delete_limit() {
+		let storage_keys = (0 .. StorageClient::MAX_DELETE_OBJECTS_PER_REQUEST + 1)
+			.map(|index| format!("object-{index}"))
+			.collect::<Vec<_>>();
+		let batch_lengths =
+			storage_key_delete_batches(&storage_keys).map(<[String]>::len).collect::<Vec<_>>();
+
+		assert_eq!(batch_lengths, vec![StorageClient::MAX_DELETE_OBJECTS_PER_REQUEST, 1]);
+	}
+}
diff --git a/backend/src/worker.rs b/backend/src/worker.rs
new file mode 100644
index 0000000..575eafb
--- /dev/null
+++ b/backend/src/worker.rs
@@ -0,0 +1,54 @@
+use {
+	crate::errors::AppError,
+	std::{
+		future::Future,
+		time::Duration,
+	},
+	tokio::{
+		task::JoinHandle,
+		time::{
+			MissedTickBehavior,
+			interval,
+		},
+	},
+};
+
+/// A unit of periodic background work driven by [`spawn`].
+///
+/// `run_once` is declared with an explicit `Send` bound on its returned future
+/// (rather than as a bare `async fn`) because [`spawn`] runs it inside a
+/// `tokio::spawn`ed task, which requires the future to be `Send`. A plain
+/// async-fn-in-trait cannot express that bound at the call site. Implementors
+/// may still write the method body as an ordinary `async fn`.
+pub trait MaintenanceTask: Send + Sync + 'static {
+	/// Stable identifier used as log context when a pass fails.
+	fn name(&self) -> &'static str;
+
+	/// Delay between maintenance passes.
+	fn interval(&self) -> Duration;
+
+	/// Runs a single maintenance pass. Errors are logged by the driver and do
+	/// not stop the loop.
+	fn run_once(&self) -> impl Future<Output = Result<(), AppError>> + Send;
+}
+
+/// Spawns `task` on a periodic loop using missed-tick delay semantics, logging
+/// (but not propagating) any per-pass error so a transient failure does not
+/// stop future passes.
+pub fn spawn<T: MaintenanceTask>(task: T) -> JoinHandle<()> {
+	tokio::spawn(async move {
+		let mut ticker = interval(task.interval());
+		ticker.set_missed_tick_behavior(MissedTickBehavior::Delay);
+
+		loop {
+			ticker.tick().await;
+			if let Err(error) = task.run_once().await {
+				tracing::warn!(
+					error = ?error,
+					task = task.name(),
+					"Background maintenance task failed"
+				);
+			}
+		}
+	})
+}
diff --git a/backend/tests/api_auth.rs b/backend/tests/api_auth.rs
new file mode 100644
index 0000000..9c29627
--- /dev/null
+++ b/backend/tests/api_auth.rs
@@ -0,0 +1,1459 @@
+mod common;
+
+use {
+	anyhow::Context,
+	aws_sdk_s3::primitives::ByteStream,
+	axum::{
+		Router,
+		body::{
+			Body,
+			Bytes,
+			to_bytes,
+		},
+		http::{
+			HeaderMap,
+			Request,
+			StatusCode,
+			header,
+		},
+	},
+	backend::{
+		Config,
+		SharedState,
+		app::{
+			build_app,
+			build_shared_state,
+		},
+		db::queries::{
+			CLAIM_OBJECT_STORAGE_DELETIONS_QUERY,
+			MARK_OBJECT_STORAGE_DELETIONS_FAILED_QUERY,
+		},
+		email_worker::EmailOutboxConfig,
+		migrations,
+		object_lifecycle::{
+			ObjectLifecycleConfig,
+			ObjectLifecycleWorker,
+		},
+		storage::{
+			CompletedUploadPart,
+			MultipartUploadCompleteOutcome,
+			StorageClient,
+			StorageConfig,
+		},
+		worker::MaintenanceTask,
+	},
+	casbin::{
+		CoreApi,
+		DefaultModel,
+		Enforcer,
+		FileAdapter,
+	},
+	common::{
+		endpoint_is_reachable,
+		env_or_default,
+		parse_bool_env,
+		skip_or_fail,
+		tcp_endpoint_is_reachable,
+		unique_suffix,
+	},
+	deadpool::managed::{
+		Object,
+		Pool,
+	},
+	deadpool_postgres::{
+		Manager,
+		Runtime,
+	},
+	serde_json::{
+		Value,
+		json,
+	},
+	std::{
+		ops::DerefMut,
+		path::Path,
+		sync::Arc,
+	},
+	tokio::sync::RwLock,
+	tokio_postgres::NoTls,
+	tower::ServiceExt,
+};
+
+const TEST_RESPONSE_BODY_LIMIT_BYTES: usize = 1024 * 1024;
+
+struct TestApp {
+	app: Router,
+	state: Arc<SharedState<Manager, Object<Manager>>>,
+}
+
+struct TestResponse {
+	status: StatusCode,
+	headers: HeaderMap,
+	body: Bytes,
+}
+
+struct DirectUploadResult {
+	object: Value,
+	object_id: String,
+	completed_parts: Vec<Value>,
+}
+
+struct PreparedDirectUpload {
+	object_id: String,
+	completed_parts: Vec<Value>,
+}
+
+struct UploadSessionStorage {
+	storage_key: String,
+	upload_id: String,
+}
+
+struct DirectUploadRequest<'a> {
+	object_name: &'a str,
+	location: Option<Value>,
+	made_on: Option<&'a str>,
+	content_type: &'a str,
+	body: &'a [u8],
+}
+
+impl<'a> DirectUploadRequest<'a> {
+	fn svg(
+		object_name: &'a str,
+		latitude: f64,
+		longitude: f64,
+		body: &'a [u8],
+	) -> Self {
+		Self {
+			object_name,
+			location: Some(json!({
+				"latitude": latitude,
+				"longitude": longitude,
+			})),
+			made_on: Some("2026-05-31T12:00:00Z"),
+			content_type: "image/svg+xml",
+			body,
+		}
+	}
+
+	fn svg_without_location(
+		object_name: &'a str,
+		body: &'a [u8],
+	) -> Self {
+		Self {
+			object_name,
+			location: None,
+			made_on: Some("2026-05-31T12:00:00Z"),
+			content_type: "image/svg+xml",
+			body,
+		}
+	}
+
+	fn with_location(
+		mut self,
+		location: Option<Value>,
+	) -> Self {
+		self.location = location;
+		self
+	}
+
+	fn with_made_on(
+		mut self,
+		made_on: &'a str,
+	) -> Self {
+		self.made_on = Some(made_on);
+		self
+	}
+
+	fn with_content_type(
+		mut self,
+		content_type: &'a str,
+	) -> Self {
+		self.content_type = content_type;
+		self
+	}
+}
+
+impl TestResponse {
+	fn json(&self) -> anyhow::Result<Value> {
+		serde_json::from_slice(&self.body).context("response body is not valid JSON")
+	}
+}
+
+impl TestApp {
+	async fn new() -> anyhow::Result<Option<Self>> {
+		let cfg = test_config()?;
+
+		if !postgres_is_reachable(&cfg).await? {
+			return skip_or_fail(
+				"backend integration test",
+				"PostgreSQL is not reachable".to_string(),
+				None,
+			);
+		}
+		if !endpoint_is_reachable(&cfg.storage.endpoint_url).await? {
+			return skip_or_fail(
+				"backend integration test",
+				format!("storage endpoint is not reachable: {}", cfg.storage.endpoint_url),
+				None,
+			);
+		}
+
+		let pool = cfg.pg.create_pool(Some(Runtime::Tokio1), NoTls)?;
+		run_migrations(&pool).await?;
+
+		let storage = StorageClient::from_config(&cfg)?;
+		storage.ensure_bucket_exists().await?;
+
+		let enforcer = test_enforcer().await?;
+		let shared_state = build_shared_state(cfg, pool, storage, Arc::new(RwLock::new(enforcer)));
+		let app = build_app(shared_state.clone());
+
+		Ok(Some(Self {
+			app,
+			state: shared_state,
+		}))
+	}
+
+	async fn request(
+		&self,
+		request: Request<Body>,
+	) -> anyhow::Result<TestResponse> {
+		let response = self
+			.app
+			.clone()
+			.oneshot(request)
+			.await
+			.map_err(|err| anyhow::anyhow!("router request failed: {err}"))?;
+		let (parts, body) = response.into_parts();
+		let body = to_bytes(body, TEST_RESPONSE_BODY_LIMIT_BYTES).await?;
+
+		Ok(TestResponse {
+			status: parts.status,
+			headers: parts.headers,
+			body,
+		})
+	}
+
+	async fn graphql(
+		&self,
+		query: &str,
+		variables: Value,
+		cookie: Option<&str>,
+	) -> anyhow::Result<TestResponse> {
+		let body = json!({
+			"query": query,
+			"variables": variables,
+		});
+		let mut request = Request::builder()
+			.method("POST")
+			.uri("/")
+			.header(header::CONTENT_TYPE, "application/json");
+
+		if let Some(cookie) = cookie {
+			request = request.header(header::COOKIE, cookie);
+		}
+
+		self.request(request.body(Body::from(body.to_string()))?).await
+	}
+
+	async fn create_object_upload_session(
+		&self,
+		cookie: Option<&str>,
+		upload: &DirectUploadRequest<'_>,
+	) -> anyhow::Result<TestResponse> {
+		self.graphql(
+			"mutation CreateObjectUploadSession($input: CreateObjectUploadSessionInput!) {
+				createObjectUploadSession(input: $input) {
+					objectId
+					partSizeBytes
+					totalParts
+				}
+			}",
+			json!({
+				"input": {
+					"name": upload.object_name,
+					"contentType": upload.content_type,
+					"fileSizeBytes": upload.body.len() as i64,
+					"madeOn": upload.made_on,
+					"location": upload.location,
+					"publicity": "DEFAULT",
+					"allowedUsers": [],
+				},
+			}),
+			cookie,
+		)
+		.await
+	}
+
+	async fn direct_upload_object(
+		&self,
+		cookie: &str,
+		upload: &DirectUploadRequest<'_>,
+	) -> anyhow::Result<Value> {
+		Ok(self.direct_upload_object_with_result(cookie, upload).await?.object)
+	}
+
+	async fn direct_upload_object_with_result(
+		&self,
+		cookie: &str,
+		upload: &DirectUploadRequest<'_>,
+	) -> anyhow::Result<DirectUploadResult> {
+		let prepared = self.prepare_direct_upload(cookie, upload).await?;
+		let complete = self
+			.complete_object_upload(cookie, &prepared.object_id, prepared.completed_parts.clone())
+			.await?;
+		assert_eq!(complete.status, StatusCode::OK);
+		let complete = complete.json()?;
+		assert_graphql_success(&complete)?;
+		let object = json_path(&complete, &["data", "completeObjectUpload"])?.clone();
+		Ok(DirectUploadResult {
+			object,
+			object_id: prepared.object_id,
+			completed_parts: prepared.completed_parts,
+		})
+	}
+
+	async fn prepare_direct_upload(
+		&self,
+		cookie: &str,
+		upload: &DirectUploadRequest<'_>,
+	) -> anyhow::Result<PreparedDirectUpload> {
+		let create = self.create_object_upload_session(Some(cookie), upload).await?;
+		assert_eq!(create.status, StatusCode::OK);
+		let create = create.json()?;
+		assert_graphql_success(&create)?;
+		let session = json_path(&create, &["data", "createObjectUploadSession"])?;
+		let object_id = json_path(session, &["objectId"])?
+			.as_str()
+			.context("createObjectUploadSession.objectId is not a string")?
+			.to_string();
+		let part_size_bytes = json_path(session, &["partSizeBytes"])?
+			.as_i64()
+			.context("createObjectUploadSession.partSizeBytes is not an integer")?;
+		let total_parts = json_path(session, &["totalParts"])?
+			.as_i64()
+			.context("createObjectUploadSession.totalParts is not an integer")?;
+
+		let mut completed_parts = Vec::with_capacity(total_parts as usize);
+		let http = reqwest::Client::new();
+		for part_number in 1 ..= total_parts {
+			let presign = self
+				.graphql(
+					"mutation PresignObjectUploadParts($objectId: ID!, $partNumbers: [Int!]!) {
+						presignObjectUploadParts(objectId: $objectId, partNumbers: $partNumbers) {
+							partNumber
+							url
+							method
+							headers { name value }
+							expectedContentLength
+						}
+					}",
+					json!({
+						"objectId": object_id,
+						"partNumbers": [part_number],
+					}),
+					Some(cookie),
+				)
+				.await?;
+			assert_eq!(presign.status, StatusCode::OK);
+			let presign = presign.json()?;
+			assert_graphql_success(&presign)?;
+			let parts = json_path(&presign, &["data", "presignObjectUploadParts"])?
+				.as_array()
+				.context("presignObjectUploadParts response is not an array")?;
+			let part = parts.first().context("presignObjectUploadParts response is empty")?;
+			let expected_content_length = json_path(part, &["expectedContentLength"])?
+				.as_i64()
+				.context("expectedContentLength is not an integer")?;
+			let start = ((part_number - 1) * part_size_bytes) as usize;
+			let end = start + expected_content_length as usize;
+			let chunk = upload
+				.body
+				.get(start .. end)
+				.with_context(|| format!("part {part_number} byte range was out of bounds"))?;
+			assert_eq!(chunk.len(), expected_content_length as usize);
+
+			let method = json_path(part, &["method"])?
+				.as_str()
+				.context("presigned part method is not a string")?
+				.parse::<reqwest::Method>()?;
+			let url = json_path(part, &["url"])?
+				.as_str()
+				.context("presigned part URL is not a string")?;
+			let mut request = http.request(method, url).body(chunk.to_vec());
+			for header in json_path(part, &["headers"])?
+				.as_array()
+				.context("presigned part headers is not an array")?
+			{
+				let name = json_path(header, &["name"])?
+					.as_str()
+					.context("presigned header name is not a string")?
+					.parse::<reqwest::header::HeaderName>()?;
+				let value = json_path(header, &["value"])?
+					.as_str()
+					.context("presigned header value is not a string")?
+					.parse::<reqwest::header::HeaderValue>()?;
+				request = request.header(name, value);
+			}
+			let response = request.send().await?;
+			let status = response.status();
+			assert!(status.is_success(), "part upload failed with {status}");
+			let e_tag = response
+				.headers()
+				.get(reqwest::header::ETAG)
+				.with_context(|| format!("part {part_number} upload did not return ETag"))?
+				.to_str()?
+				.to_string();
+			completed_parts.push(json!({
+				"partNumber": part_number,
+				"eTag": e_tag,
+			}));
+		}
+
+		Ok(PreparedDirectUpload {
+			object_id,
+			completed_parts,
+		})
+	}
+
+	async fn complete_object_upload(
+		&self,
+		cookie: &str,
+		object_id: &str,
+		completed_parts: Vec<Value>,
+	) -> anyhow::Result<TestResponse> {
+		self.graphql(
+			"mutation CompleteObjectUpload($objectId: ID!, $parts: [CompletedObjectUploadPartInput!]!) {
+				completeObjectUpload(objectId: $objectId, parts: $parts) {
+					id
+					name
+					location { latitude longitude }
+					contentType
+				}
+			}",
+			json!({
+				"objectId": object_id,
+				"parts": completed_parts,
+			}),
+			Some(cookie),
+		)
+		.await
+	}
+
+	async fn object_count(
+		&self,
+		object_name: &str,
+	) -> anyhow::Result<i64> {
+		let client = self.state.pool.get().await?;
+		let count = client
+			.query_one("SELECT COUNT(*) FROM objects WHERE name = $1", &[&object_name])
+			.await?
+			.get(0);
+		Ok(count)
+	}
+
+	async fn object_storage_key(
+		&self,
+		object_name: &str,
+	) -> anyhow::Result<String> {
+		let client = self.state.pool.get().await?;
+		let storage_key = client
+			.query_one("SELECT storage_key FROM objects WHERE name = $1", &[&object_name])
+			.await?
+			.get(0);
+		Ok(storage_key)
+	}
+
+	async fn object_content_type(
+		&self,
+		object_name: &str,
+	) -> anyhow::Result<String> {
+		let client = self.state.pool.get().await?;
+		let content_type = client
+			.query_one("SELECT content_type FROM objects WHERE name = $1", &[&object_name])
+			.await?
+			.get(0);
+		Ok(content_type)
+	}
+
+	async fn password_reset_token_count(
+		&self,
+		email: &str,
+	) -> anyhow::Result<i64> {
+		let client = self.state.pool.get().await?;
+		let count = client
+			.query_one(
+				"SELECT COUNT(*)
+				FROM password_reset_tokens token
+				JOIN users user_account ON user_account.id = token.user_id
+				WHERE user_account.email = $1
+					AND token.expires_at > now()",
+				&[&email],
+			)
+			.await?
+			.get(0);
+		Ok(count)
+	}
+
+	async fn password_reset_email_outbox_count(
+		&self,
+		email: &str,
+	) -> anyhow::Result<i64> {
+		let client = self.state.pool.get().await?;
+		let count = client
+			.query_one(
+				"SELECT COUNT(*)
+				FROM email_outbox
+				WHERE kind = 'password_reset'
+					AND payload->>'email' = $1",
+				&[&email],
+			)
+			.await?
+			.get(0);
+		Ok(count)
+	}
+
+	async fn upload_session_storage(
+		&self,
+		object_id: &str,
+	) -> anyhow::Result<UploadSessionStorage> {
+		let object_id = object_id.parse::<i64>()?;
+		let client = self.state.pool.get().await?;
+		let row = client
+			.query_one(
+				"SELECT storage_key, upload_id FROM object_upload_sessions WHERE object_id = $1",
+				&[&object_id],
+			)
+			.await?;
+		Ok(UploadSessionStorage {
+			storage_key: row.get("storage_key"),
+			upload_id: row.get("upload_id"),
+		})
+	}
+
+	async fn expire_upload_session(
+		&self,
+		object_id: &str,
+	) -> anyhow::Result<()> {
+		let object_id = object_id.parse::<i64>()?;
+		let client = self.state.pool.get().await?;
+		client
+			.execute(
+				"UPDATE object_upload_sessions
+				SET created_at = now() - interval '2 seconds',
+					expires_at = now() - interval '1 second',
+					cleanup_next_attempt_at = now() - interval '1 second'
+				WHERE object_id = $1",
+				&[&object_id],
+			)
+			.await?;
+		Ok(())
+	}
+
+	async fn upload_session_count(
+		&self,
+		object_name: &str,
+	) -> anyhow::Result<i64> {
+		let client = self.state.pool.get().await?;
+		let count = client
+			.query_one(
+				"SELECT COUNT(*)
+				FROM object_upload_sessions session
+				JOIN objects object ON object.id = session.object_id
+				WHERE object.name = $1",
+				&[&object_name],
+			)
+			.await?
+			.get(0);
+		Ok(count)
+	}
+
+	async fn storage_deletion_outbox_count_for_key(
+		&self,
+		storage_key: &str,
+	) -> anyhow::Result<i64> {
+		let client = self.state.pool.get().await?;
+		let count = client
+			.query_one(
+				"SELECT COUNT(*) FROM object_storage_deletions WHERE storage_key = $1",
+				&[&storage_key],
+			)
+			.await?
+			.get(0);
+		Ok(count)
+	}
+
+	async fn run_object_lifecycle_maintenance(
+		&self,
+		config: ObjectLifecycleConfig,
+	) -> anyhow::Result<()> {
+		ObjectLifecycleWorker::new(self.state.pool.clone(), self.state.storage.clone(), config)
+			.run_once()
+			.await
+			.map_err(Into::into)
+	}
+}
+
+struct TestUser {
+	email: String,
+	cookie: String,
+}
+
+async fn register_and_login(app: &TestApp) -> anyhow::Result<TestUser> {
+	let email = format!("api-auth-{}@example.test", unique_suffix()?);
+	let password = "memory-map-test-password";
+
+	let register = app
+		.graphql(
+			"mutation Register($email: String!, $password: String!) {
+				register(email: $email, password: $password) { id email role }
+			}",
+			json!({
+				"email": email,
+				"password": password,
+			}),
+			None,
+		)
+		.await?;
+	assert_eq!(register.status, StatusCode::OK);
+	assert_graphql_success(&register.json()?)?;
+
+	let login = app
+		.graphql(
+			"mutation Login($email: String!, $password: String!) {
+				login(email: $email, password: $password) { id email role }
+			}",
+			json!({
+				"email": email,
+				"password": password,
+			}),
+			None,
+		)
+		.await?;
+	assert_eq!(login.status, StatusCode::OK);
+	assert_graphql_success(&login.json()?)?;
+	let cookie = auth_cookie(&login.headers)?;
+
+	Ok(TestUser {
+		email,
+		cookie,
+	})
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn unauthenticated_upload_is_rejected() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let object_name = format!("unauthenticated-upload-{}.svg", unique_suffix()?);
+	let upload = DirectUploadRequest::svg(
+		&object_name,
+		12.5,
+		-45.25,
+		b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+	);
+
+	let response = app.create_object_upload_session(None, &upload).await?;
+
+	assert_eq!(response.status, StatusCode::OK);
+	assert_graphql_error_contains(&response.json()?, "Unauthorized")?;
+	assert_eq!(app.object_count(&object_name).await?, 0);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn login_cookie_authenticates_graphql_requests() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+
+	let me = app.graphql("query Me { me { email } }", json!({}), Some(&user.cookie)).await?;
+	assert_eq!(me.status, StatusCode::OK);
+	let me = me.json()?;
+	assert_graphql_success(&me)?;
+	assert_eq!(json_path(&me, &["data", "me", "email"])?.as_str(), Some(user.email.as_str()));
+
+	let anonymous_me = app.graphql("query Me { me { email } }", json!({}), None).await?;
+	assert_eq!(anonymous_me.status, StatusCode::OK);
+	let anonymous_me = anonymous_me.json()?;
+	assert_graphql_success(&anonymous_me)?;
+	assert!(json_path(&anonymous_me, &["data", "me"])?.is_null());
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn authenticated_query_auth_db_error_returns_500_without_cache_write() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	assert_eq!(app.state.graphql_response_cache.entry_count(), 0);
+
+	app.state.pool.close();
+	let response = app
+		.graphql("query Config { config { enableRegistration } }", json!({}), Some(&user.cookie))
+		.await?;
+
+	assert_eq!(response.status, StatusCode::INTERNAL_SERVER_ERROR);
+	assert_eq!(app.state.graphql_response_cache.entry_count(), 0);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn password_reset_request_enqueues_one_email_inside_rate_limit() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+
+	for _ in 0 .. 2 {
+		let response = app
+			.graphql(
+				"mutation RequestPasswordReset($email: String!) {
+					requestPasswordReset(email: $email)
+				}",
+				json!({
+					"email": user.email.clone(),
+				}),
+				None,
+			)
+			.await?;
+		assert_eq!(response.status, StatusCode::OK);
+		let response = response.json()?;
+		assert_graphql_success(&response)?;
+		assert_eq!(json_path(&response, &["data", "requestPasswordReset"])?.as_bool(), Some(true));
+	}
+
+	assert_eq!(app.password_reset_token_count(&user.email).await?, 1);
+	assert_eq!(app.password_reset_email_outbox_count(&user.email).await?, 1);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn authenticated_upload_preserves_content_type_and_delete_cleans_up() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("authenticated-upload-{}.svg", unique_suffix()?);
+	let body = b"<svg xmlns=\"http://www.w3.org/2000/svg\"><rect width=\"1\" height=\"1\" /></svg>";
+	let upload = DirectUploadRequest::svg(&object_name, 12.5, -45.25, body);
+
+	let upload_result = app.direct_upload_object_with_result(&user.cookie, &upload).await?;
+	let uploaded_object = upload_result.object;
+	let object_id = json_path(&uploaded_object, &["id"])?
+		.as_str()
+		.context("upload response is missing object id")?;
+	assert_eq!(json_path(&uploaded_object, &["name"])?.as_str(), Some(object_name.as_str()));
+
+	let retry_complete = app
+		.complete_object_upload(
+			&user.cookie,
+			&upload_result.object_id,
+			upload_result.completed_parts.clone(),
+		)
+		.await?;
+	assert_eq!(retry_complete.status, StatusCode::OK);
+	let retry_complete = retry_complete.json()?;
+	assert_graphql_success(&retry_complete)?;
+	assert_eq!(
+		json_path(&retry_complete, &["data", "completeObjectUpload", "id"])?.as_str(),
+		Some(object_id)
+	);
+
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	assert_eq!(app.object_content_type(&object_name).await?, "image/svg+xml");
+	let storage_key = app.object_storage_key(&object_name).await?;
+	assert_eq!(app.state.storage.object_content_type(&storage_key).await?, "image/svg+xml");
+
+	let protected_query = app
+		.graphql(
+			"query ObjectByName($name: String!) {
+				s3ObjectByName(name: $name) { id name }
+			}",
+			json!({
+				"name": object_name,
+			}),
+			None,
+		)
+		.await?;
+	assert_eq!(protected_query.status, StatusCode::OK);
+	assert_graphql_error_contains(&protected_query.json()?, "Unauthorized")?;
+
+	let visible_objects = app
+		.graphql(
+			"query Objects { s3Objects { id name contentType } }",
+			json!({}),
+			Some(&user.cookie),
+		)
+		.await?;
+	assert_eq!(visible_objects.status, StatusCode::OK);
+	let visible_objects = visible_objects.json()?;
+	assert_graphql_success(&visible_objects)?;
+	let object = json_path(&visible_objects, &["data", "s3Objects"])?
+		.as_array()
+		.context("s3Objects response is not an array")?
+		.iter()
+		.find(|object| {
+			json_path(object, &["name"])
+				.and_then(|name| name.as_str().context("object name is not a string"))
+				.is_ok_and(|name| name == object_name)
+		})
+		.context("uploaded object is missing from s3Objects")?;
+	assert_eq!(json_path(object, &["contentType"])?.as_str(), Some("image/svg+xml"));
+
+	let delete = app
+		.graphql(
+			"mutation Delete($ids: [ID!]!) {
+				deleteS3Objects(ids: $ids) { id name }
+			}",
+			json!({
+				"ids": [object_id],
+			}),
+			Some(&user.cookie),
+		)
+		.await?;
+	assert_eq!(delete.status, StatusCode::OK);
+	assert_graphql_success(&delete.json()?)?;
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	assert_eq!(app.storage_deletion_outbox_count_for_key(&storage_key).await?, 1);
+
+	let visible_objects = app
+		.graphql(
+			"query Objects { s3Objects { id name contentType } }",
+			json!({}),
+			Some(&user.cookie),
+		)
+		.await?;
+	assert_eq!(visible_objects.status, StatusCode::OK);
+	let visible_objects = visible_objects.json()?;
+	assert_graphql_success(&visible_objects)?;
+	let still_visible = json_path(&visible_objects, &["data", "s3Objects"])?
+		.as_array()
+		.context("s3Objects response is not an array")?
+		.iter()
+		.any(|object| {
+			json_path(object, &["name"])
+				.and_then(|name| name.as_str().context("object name is not a string"))
+				.is_ok_and(|name| name == object_name)
+		});
+	assert!(!still_visible);
+
+	app.run_object_lifecycle_maintenance(ObjectLifecycleConfig::default()).await?;
+	assert_eq!(app.object_count(&object_name).await?, 0);
+	assert!(app.state.storage.object_content_type(&storage_key).await.is_err());
+	assert_eq!(app.storage_deletion_outbox_count_for_key(&storage_key).await?, 0);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn direct_upload_accepts_multiple_parts() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("multipart-upload-{}.svg", unique_suffix()?);
+	let part_size = app.state.config.object_lifecycle.upload_part_size_bytes as usize;
+	let body = vec![b'x'; part_size + 17];
+	let upload = DirectUploadRequest::svg(&object_name, 12.5, -45.25, &body);
+
+	let uploaded_object = app.direct_upload_object(&user.cookie, &upload).await?;
+	assert_eq!(json_path(&uploaded_object, &["name"])?.as_str(), Some(object_name.as_str()));
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	let storage_key = app.object_storage_key(&object_name).await?;
+	let metadata = app.state.storage.head_object(&storage_key).await?;
+	assert_eq!(metadata.content_length, body.len() as i64);
+	assert_eq!(metadata.content_type, "image/svg+xml");
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn invalid_upload_coordinates_do_not_leave_side_effects() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+
+	for (label, latitude, longitude, expected_error) in [
+		("latitude", 90.1, -45.25, "not a valid latitude value"),
+		("longitude", 12.5, -180.1, "not a valid longitude value"),
+	] {
+		let object_name = format!("invalid-{label}-upload-{}.svg", unique_suffix()?);
+		let upload = DirectUploadRequest::svg(
+			&object_name,
+			latitude,
+			longitude,
+			b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+		);
+
+		let response = app.create_object_upload_session(Some(&user.cookie), &upload).await?;
+
+		assert_eq!(response.status, StatusCode::OK);
+		assert_graphql_error_contains(&response.json()?, expected_error)?;
+		assert_eq!(app.object_count(&object_name).await?, 0);
+	}
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn upload_without_coordinates_stores_no_location() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("no-location-upload-{}.svg", unique_suffix()?);
+	let upload = DirectUploadRequest::svg_without_location(
+		&object_name,
+		b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+	);
+
+	let uploaded_object = app.direct_upload_object(&user.cookie, &upload).await?;
+	assert!(json_path(&uploaded_object, &["location"])?.is_null());
+	assert_eq!(app.object_count(&object_name).await?, 1);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn partial_upload_coordinates_do_not_leave_side_effects() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+
+	for (label, location, expected_error) in [
+		("latitude-only", json!({ "latitude": 12.5 }), "longitude"),
+		("longitude-only", json!({ "longitude": -45.25 }), "latitude"),
+	] {
+		let object_name = format!("partial-{label}-upload-{}.svg", unique_suffix()?);
+		let upload = DirectUploadRequest::svg_without_location(
+			&object_name,
+			b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+		)
+		.with_location(Some(location));
+
+		let response = app.create_object_upload_session(Some(&user.cookie), &upload).await?;
+
+		assert_eq!(response.status, StatusCode::OK);
+		assert_graphql_error_contains(&response.json()?, expected_error)?;
+		assert_eq!(app.object_count(&object_name).await?, 0);
+	}
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn invalid_upload_timestamp_does_not_leave_side_effects() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("invalid-timestamp-upload-{}.svg", unique_suffix()?);
+	let upload = DirectUploadRequest::svg(
+		&object_name,
+		12.5,
+		-45.25,
+		b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+	)
+	.with_made_on("not-a-timestamp");
+
+	let response = app.create_object_upload_session(Some(&user.cookie), &upload).await?;
+
+	assert_eq!(response.status, StatusCode::OK);
+	assert_graphql_error_contains(&response.json()?, "Invalid timestamp format")?;
+	assert_eq!(app.object_count(&object_name).await?, 0);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn duplicate_upload_name_does_not_overwrite_existing_object() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("duplicate-upload-{}.svg", unique_suffix()?);
+	let upload = DirectUploadRequest::svg(
+		&object_name,
+		12.5,
+		-45.25,
+		b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+	);
+
+	app.direct_upload_object(&user.cookie, &upload).await?;
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	assert_eq!(app.object_content_type(&object_name).await?, "image/svg+xml");
+	let storage_key = app.object_storage_key(&object_name).await?;
+	assert_eq!(app.state.storage.object_content_type(&storage_key).await?, "image/svg+xml");
+
+	let duplicate = DirectUploadRequest::svg(&object_name, 12.5, -45.25, b"not really a jpeg")
+		.with_content_type("image/jpeg");
+	let duplicate_upload = app.create_object_upload_session(Some(&user.cookie), &duplicate).await?;
+
+	assert_eq!(duplicate_upload.status, StatusCode::OK);
+	assert_graphql_error_contains(&duplicate_upload.json()?, "already exists")?;
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	assert_eq!(app.object_storage_key(&object_name).await?, storage_key);
+	assert_eq!(app.object_content_type(&object_name).await?, "image/svg+xml");
+	assert_eq!(app.state.storage.object_content_type(&storage_key).await?, "image/svg+xml");
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn stale_pending_upload_cleanup_removes_blob_metadata_and_releases_name() -> anyhow::Result<()>
+{
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("stale-pending-upload-{}.svg", unique_suffix()?);
+	let storage_key = format!("objects/stale-pending-upload-{}", unique_suffix()?);
+	let body = b"<svg xmlns=\"http://www.w3.org/2000/svg\" />";
+
+	app.state
+		.storage
+		.upload_object(&storage_key, ByteStream::from_static(body), "image/svg+xml")
+		.await?;
+
+	let client = app.state.pool.get().await?;
+	let user_id: i64 =
+		client.query_one("SELECT id FROM users WHERE email = $1", &[&user.email]).await?.get(0);
+	client
+		.execute(
+			"INSERT INTO objects (
+				name,
+				storage_key,
+				content_type,
+				storage_state,
+				storage_state_updated_at,
+				user_id,
+				publicity
+			)
+			VALUES ($1, $2, 'image/svg+xml', 'pending_upload', now() - interval '2 hours', $3, 'default')",
+			&[&object_name, &storage_key, &user_id],
+		)
+		.await?;
+	drop(client);
+
+	let lifecycle_config = ObjectLifecycleConfig {
+		pending_upload_timeout_seconds: 1,
+		storage_deletion_retry_seconds: 1,
+		storage_deletion_lease_seconds: 30,
+		maintenance_interval_seconds: 1,
+		storage_deletion_batch_size: 1000,
+		storage_deletion_max_attempts: 10,
+		..ObjectLifecycleConfig::default()
+	}
+	.validated()?;
+	app.run_object_lifecycle_maintenance(lifecycle_config).await?;
+
+	assert_eq!(app.object_count(&object_name).await?, 0);
+	assert!(app.state.storage.object_content_type(&storage_key).await.is_err());
+
+	let upload = DirectUploadRequest::svg(&object_name, 12.5, -45.25, body);
+	app.direct_upload_object(&user.cookie, &upload).await?;
+	assert_eq!(app.object_count(&object_name).await?, 1);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn expired_incomplete_upload_session_cleanup_removes_metadata() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("expired-upload-session-{}.svg", unique_suffix()?);
+	let upload = DirectUploadRequest::svg(
+		&object_name,
+		12.5,
+		-45.25,
+		b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+	);
+
+	let create = app.create_object_upload_session(Some(&user.cookie), &upload).await?;
+	assert_eq!(create.status, StatusCode::OK);
+	let create = create.json()?;
+	assert_graphql_success(&create)?;
+	let object_id = json_path(&create, &["data", "createObjectUploadSession", "objectId"])?
+		.as_str()
+		.context("createObjectUploadSession.objectId is not a string")?
+		.to_string();
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	assert_eq!(app.upload_session_count(&object_name).await?, 1);
+
+	app.expire_upload_session(&object_id).await?;
+
+	let lifecycle_config = ObjectLifecycleConfig {
+		upload_session_cleanup_retry_seconds: 1,
+		upload_session_cleanup_lease_seconds: 30,
+		upload_session_cleanup_max_attempts: 10,
+		upload_session_cleanup_batch_size: 100,
+		..ObjectLifecycleConfig::default()
+	}
+	.validated()?;
+	app.run_object_lifecycle_maintenance(lifecycle_config).await?;
+
+	assert_eq!(app.object_count(&object_name).await?, 0);
+	assert_eq!(app.upload_session_count(&object_name).await?, 0);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn expired_completed_upload_session_cleanup_removes_completed_orphan() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("expired-completed-upload-{}.svg", unique_suffix()?);
+	let upload = DirectUploadRequest::svg(
+		&object_name,
+		12.5,
+		-45.25,
+		b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+	);
+	let prepared = app.prepare_direct_upload(&user.cookie, &upload).await?;
+	let session = app.upload_session_storage(&prepared.object_id).await?;
+	let completed_parts = completed_upload_parts(&prepared.completed_parts)?;
+
+	assert_eq!(
+		app.state
+			.storage
+			.complete_multipart_upload(&session.storage_key, &session.upload_id, &completed_parts)
+			.await?,
+		MultipartUploadCompleteOutcome::Completed
+	);
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	assert_eq!(app.upload_session_count(&object_name).await?, 1);
+
+	app.expire_upload_session(&prepared.object_id).await?;
+	app.run_object_lifecycle_maintenance(ObjectLifecycleConfig::default()).await?;
+
+	assert_eq!(app.object_count(&object_name).await?, 0);
+	assert_eq!(app.upload_session_count(&object_name).await?, 0);
+	assert!(app.state.storage.object_content_type(&session.storage_key).await.is_err());
+	assert_eq!(app.storage_deletion_outbox_count_for_key(&session.storage_key).await?, 0);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn completed_upload_metadata_mismatch_queues_completed_object_cleanup() -> anyhow::Result<()>
+{
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let user = register_and_login(&app).await?;
+	let object_name = format!("metadata-mismatch-upload-{}.svg", unique_suffix()?);
+	let upload = DirectUploadRequest::svg(
+		&object_name,
+		12.5,
+		-45.25,
+		b"<svg xmlns=\"http://www.w3.org/2000/svg\" />",
+	);
+
+	let create = app.create_object_upload_session(Some(&user.cookie), &upload).await?;
+	assert_eq!(create.status, StatusCode::OK);
+	let create = create.json()?;
+	assert_graphql_success(&create)?;
+	let object_id = json_path(&create, &["data", "createObjectUploadSession", "objectId"])?
+		.as_str()
+		.context("createObjectUploadSession.objectId is not a string")?
+		.to_string();
+	let session = app.upload_session_storage(&object_id).await?;
+	app.state.storage.abort_multipart_upload(&session.storage_key, &session.upload_id).await?;
+	app.state
+		.storage
+		.upload_object(&session.storage_key, ByteStream::from_static(b"wrong-size"), "image/jpeg")
+		.await?;
+
+	let complete = app
+		.complete_object_upload(
+			&user.cookie,
+			&object_id,
+			vec![json!({
+				"partNumber": 1,
+				"eTag": "orphan-etag",
+			})],
+		)
+		.await?;
+	assert_eq!(complete.status, StatusCode::OK);
+	assert_graphql_error_contains(
+		&complete.json()?,
+		"Completed upload size did not match declared file size",
+	)?;
+	assert_eq!(app.object_count(&object_name).await?, 1);
+	assert_eq!(app.upload_session_count(&object_name).await?, 0);
+	assert_eq!(app.storage_deletion_outbox_count_for_key(&session.storage_key).await?, 1);
+
+	app.run_object_lifecycle_maintenance(ObjectLifecycleConfig::default()).await?;
+
+	assert_eq!(app.object_count(&object_name).await?, 0);
+	assert!(app.state.storage.object_content_type(&session.storage_key).await.is_err());
+	assert_eq!(app.storage_deletion_outbox_count_for_key(&session.storage_key).await?, 0);
+
+	Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the local PostgreSQL and RustFS service graph"]
+async fn object_storage_deletion_claims_respect_lease_and_retry() -> anyhow::Result<()> {
+	let Some(app) = TestApp::new().await? else {
+		return Ok(());
+	};
+	let first_key = format!("objects/claim-lease-first-{}", unique_suffix()?);
+	let second_key = format!("objects/claim-lease-second-{}", unique_suffix()?);
+
+	let mut client = app.state.pool.get().await?;
+	let transaction = client.transaction().await?;
+	transaction
+		.execute(
+			"UPDATE object_storage_deletions
+			SET next_attempt_at = now() + interval '1 hour'",
+			&[],
+		)
+		.await?;
+	transaction
+		.execute(
+			"INSERT INTO object_storage_deletions (storage_key) VALUES ($1), ($2)",
+			&[&first_key, &second_key],
+		)
+		.await?;
+
+	let first_claim = claim_keys(&transaction, 1, 600, 10).await?;
+	assert_eq!(first_claim.len(), 1);
+	let first_claimed_key =
+		first_claim.into_iter().next().context("first object storage deletion claim was empty")?;
+	let remaining_key =
+		if first_claimed_key == first_key { second_key.clone() } else { first_key.clone() };
+
+	assert_eq!(claim_keys(&transaction, 10, 600, 10).await?, vec![remaining_key.clone()]);
+	assert!(claim_keys(&transaction, 10, 600, 10).await?.is_empty());
+
+	transaction
+		.execute(
+			MARK_OBJECT_STORAGE_DELETIONS_FAILED_QUERY,
+			&[&vec![first_claimed_key.clone()], &"simulated storage failure", &60_i64],
+		)
+		.await?;
+	assert!(claim_keys(&transaction, 10, 600, 10).await?.is_empty());
+
+	transaction
+		.execute(
+			"UPDATE object_storage_deletions
+			SET next_attempt_at = now() - interval '1 second'
+			WHERE storage_key = $1",
+			&[&first_claimed_key],
+		)
+		.await?;
+	assert_eq!(claim_keys(&transaction, 10, 600, 10).await?, vec![first_claimed_key.clone()]);
+
+	let first_attempts: i32 = transaction
+		.query_one(
+			"SELECT attempts FROM object_storage_deletions WHERE storage_key = $1",
+			&[&first_claimed_key],
+		)
+		.await?
+		.get(0);
+	assert_eq!(first_attempts, 2);
+
+	transaction.rollback().await?;
+
+	Ok(())
+}
+
+async fn claim_keys(
+	client: &impl deadpool_postgres::GenericClient,
+	limit: i64,
+	lease_seconds: i64,
+	max_attempts: i32,
+) -> Result<Vec<String>, tokio_postgres::Error> {
+	client
+		.query(CLAIM_OBJECT_STORAGE_DELETIONS_QUERY, &[&limit, &lease_seconds, &max_attempts])
+		.await
+		.map(|rows| {
+			rows.into_iter().map(|row| row.get::<_, String>("storage_key")).collect::<Vec<_>>()
+		})
+}
+
+fn completed_upload_parts(parts: &[Value]) -> anyhow::Result<Vec<CompletedUploadPart>> {
+	parts
+		.iter()
+		.map(|part| {
+			let part_number = json_path(part, &["partNumber"])?
+				.as_i64()
+				.context("completed part number is not an integer")
+				.and_then(|part_number| {
+					i32::try_from(part_number).context("completed part number exceeds i32 range")
+				})?;
+			let e_tag = json_path(part, &["eTag"])?
+				.as_str()
+				.context("completed part ETag is not a string")?
+				.to_string();
+			Ok(CompletedUploadPart {
+				part_number,
+				e_tag,
+			})
+		})
+		.collect()
+}
+
+fn test_config() -> anyhow::Result<Config> {
+	let pg = deadpool_postgres::Config {
+		dbname: Some(env_or_default("MEMORY_MAP__PG__DBNAME", "db")),
+		host: Some(env_or_default("MEMORY_MAP__PG__HOST", "127.0.0.1")),
+		port: Some(env_or_default("MEMORY_MAP__PG__PORT", "5432").parse()?),
+		..Default::default()
+	};
+
+	let frontend_url = env_or_default("MEMORY_MAP__FRONTEND__URL", "http://127.0.0.1:3000");
+
+	let config = Config {
+		pg,
+		server: backend::ServerConfig {
+			host: "127.0.0.1".to_string(),
+			port: 8000,
+		},
+		smtp: backend::SmtpConfig {
+			host: "smtp.example.test".to_string(),
+			user: "memory-map-test".to_string(),
+			pass: "memory-map-test-password".to_string(),
+			from: "noreply@example.test".to_string(),
+		},
+		auth: backend::AuthConfig {
+			cookie_secret: env_or_default(
+				"MEMORY_MAP__AUTH__COOKIE_SECRET",
+				"memory-map-local-test-cookie-secret-at-least-64-bytes-long-0001-extra",
+			),
+			enable_registration: true,
+			cookie_secure: None,
+		},
+		frontend: backend::FrontendConfig {
+			url: frontend_url.clone(),
+		},
+		cors: backend::CorsConfig {
+			allowed_origins: env_or_default("MEMORY_MAP__CORS__ALLOWED_ORIGINS", &frontend_url),
+		},
+		storage: StorageConfig {
+			endpoint_url: env_or_default(
+				"MEMORY_MAP__STORAGE__ENDPOINT_URL",
+				"http://127.0.0.1:9000/",
+			),
+			public_endpoint_url: std::env::var("MEMORY_MAP__STORAGE__PUBLIC_ENDPOINT_URL").ok(),
+			access_key: env_or_default("MEMORY_MAP__STORAGE__ACCESS_KEY", "memorymapdev"),
+			secret_key: env_or_default("MEMORY_MAP__STORAGE__SECRET_KEY", "memorymapdevsecret"),
+			bucket_name: env_or_default("MEMORY_MAP__STORAGE__BUCKET_NAME", "memory-map"),
+			region: env_or_default("MEMORY_MAP__STORAGE__REGION", &StorageConfig::default_region()),
+			force_path_style: parse_bool_env(
+				"MEMORY_MAP__STORAGE__FORCE_PATH_STYLE",
+				StorageConfig::default_force_path_style(),
+			)?,
+			presigned_url_ttl_seconds: env_or_default(
+				"MEMORY_MAP__STORAGE__PRESIGNED_URL_TTL_SECONDS",
+				&StorageConfig::default_presigned_url_ttl_seconds().to_string(),
+			)
+			.parse()?,
+		},
+		object_lifecycle: ObjectLifecycleConfig::default(),
+		email_outbox: EmailOutboxConfig::default(),
+	};
+	config.validated()
+}
+
+async fn run_migrations(pool: &Pool<Manager>) -> anyhow::Result<()> {
+	let mut postgresql_connection = pool.get().await?;
+	let postgresql_client = postgresql_connection.deref_mut().deref_mut();
+	migrations::runner().run_async(postgresql_client).await?;
+	Ok(())
+}
+
+async fn test_enforcer() -> anyhow::Result<Enforcer> {
+	let manifest_dir = Path::new(env!("CARGO_MANIFEST_DIR"));
+	let model = DefaultModel::from_file(manifest_dir.join("authz_model.conf")).await?;
+	let policy = FileAdapter::new(manifest_dir.join("authz_policy.csv"));
+	Ok(Enforcer::new(model, policy).await?)
+}
+
+async fn postgres_is_reachable(config: &Config) -> anyhow::Result<bool> {
+	let host = config.pg.host.as_deref().unwrap_or("127.0.0.1");
+	let port = config.pg.port.unwrap_or(5432);
+	tcp_endpoint_is_reachable(host, port).await
+}
+
+fn auth_cookie(headers: &HeaderMap) -> anyhow::Result<String> {
+	let set_cookie = headers
+		.get_all(header::SET_COOKIE)
+		.iter()
+		.find_map(|value| value.to_str().ok().filter(|value| value.starts_with("auth_token=")))
+		.context("login response did not set auth_token cookie")?;
+	assert!(set_cookie.contains("HttpOnly"));
+	assert!(set_cookie.contains("SameSite=Lax"));
+	assert!(set_cookie.contains("Path=/"));
+	assert!(!set_cookie.contains("Secure"));
+	Ok(set_cookie.split(';').next().context("Set-Cookie header is empty")?.to_string())
+}
+
+fn assert_graphql_success(value: &Value) -> anyhow::Result<()> {
+	if let Some(errors) = value.get("errors") {
+		anyhow::bail!("GraphQL response contained errors: {errors}");
+	}
+	Ok(())
+}
+
+fn json_path<'a>(
+	value: &'a Value,
+	path: &[&str],
+) -> anyhow::Result<&'a Value> {
+	let mut current = value;
+	for key in path {
+		current =
+			current.get(*key).with_context(|| format!("JSON response is missing field {key}"))?;
+	}
+	Ok(current)
+}
+
+fn assert_graphql_error_contains(
+	value: &Value,
+	expected: &str,
+) -> anyhow::Result<()> {
+	let errors = value
+		.get("errors")
+		.and_then(Value::as_array)
+		.context("GraphQL response did not contain errors")?;
+	let has_expected_error = errors.iter().any(|error| {
+		error
+			.get("message")
+			.and_then(Value::as_str)
+			.is_some_and(|message| message.contains(expected))
+	});
+
+	if !has_expected_error {
+		anyhow::bail!("GraphQL errors did not contain {expected:?}: {errors:?}");
+	}
+
+	Ok(())
+}
diff --git a/backend/tests/common.rs b/backend/tests/common.rs
new file mode 100644
index 0000000..d3d6d5f
--- /dev/null
+++ b/backend/tests/common.rs
@@ -0,0 +1,86 @@
+#![allow(dead_code)]
+
+use {
+	std::{
+		env,
+		sync::atomic::{
+			AtomicU64,
+			Ordering,
+		},
+		time::{
+			Duration,
+			SystemTime,
+			UNIX_EPOCH,
+		},
+	},
+	tokio::{
+		net::TcpStream,
+		time::timeout,
+	},
+};
+
+const REQUIRE_SERVICE_ENV: &str = "BACKEND_TEST_REQUIRE_SERVICE";
+
+pub(crate) fn env_or_default(
+	name: &str,
+	default: &str,
+) -> String {
+	env::var(name).unwrap_or_else(|_| default.to_string())
+}
+
+pub(crate) fn parse_bool_env(
+	name: &str,
+	default: bool,
+) -> anyhow::Result<bool> {
+	let value = env_or_default(name, if default { "true" } else { "false" });
+	match value.to_ascii_lowercase().as_str() {
+		"1" | "true" | "yes" | "on" => Ok(true),
+		"0" | "false" | "no" | "off" => Ok(false),
+		_ => anyhow::bail!("{name} must be a boolean"),
+	}
+}
+
+pub(crate) async fn tcp_endpoint_is_reachable(
+	host: &str,
+	port: u16,
+) -> anyhow::Result<bool> {
+	Ok(matches!(timeout(Duration::from_secs(2), TcpStream::connect((host, port))).await, Ok(Ok(_))))
+}
+
+pub(crate) async fn endpoint_is_reachable(endpoint_url: &str) -> anyhow::Result<bool> {
+	let url = reqwest::Url::parse(endpoint_url)?;
+	let host =
+		url.host_str().ok_or_else(|| anyhow::anyhow!("S3 endpoint URL is missing a host"))?;
+	let port = url
+		.port_or_known_default()
+		.ok_or_else(|| anyhow::anyhow!("S3 endpoint URL is missing a port"))?;
+	tcp_endpoint_is_reachable(host, port).await
+}
+
+pub(crate) fn skip_or_fail<T>(
+	test_name: &str,
+	message: String,
+	skipped: T,
+) -> anyhow::Result<T> {
+	if backend_test_service_required() {
+		anyhow::bail!("{message}");
+	}
+
+	eprintln!("skipping {test_name}: {message}");
+	Ok(skipped)
+}
+
+pub(crate) fn backend_test_service_required() -> bool {
+	env::var(REQUIRE_SERVICE_ENV)
+		.map(|value| matches!(value.to_ascii_lowercase().as_str(), "1" | "true" | "yes" | "on"))
+		.unwrap_or(false)
+}
+
+pub(crate) fn unique_suffix() -> anyhow::Result<String> {
+	// Tests currently run serially when they require services, but the counter
+	// keeps suffixes robust if a runner accidentally enables parallelism.
+	static COUNTER: AtomicU64 = AtomicU64::new(0);
+	let now = SystemTime::now().duration_since(UNIX_EPOCH)?;
+	let counter = COUNTER.fetch_add(1, Ordering::Relaxed);
+	Ok(format!("{}-{counter}", now.as_nanos()))
+}
diff --git a/backend/tests/storage.rs b/backend/tests/storage.rs
new file mode 100644
index 0000000..3205eba
--- /dev/null
+++ b/backend/tests/storage.rs
@@ -0,0 +1,81 @@
+mod common;
+
+use {
+	aws_sdk_s3::primitives::ByteStream,
+	backend::storage::{
+		StorageClient,
+		StorageConfig,
+	},
+	common::{
+		endpoint_is_reachable,
+		skip_or_fail,
+		unique_suffix,
+	},
+};
+
+#[tokio::test]
+#[ignore = "requires an S3-compatible storage service"]
+async fn storage_roundtrip_against_configured_service() -> anyhow::Result<()> {
+	let config = match StorageConfig::from_env() {
+		Ok(config) => config,
+		Err(error) =>
+			return skip_or_fail(
+				"storage integration test",
+				format!("storage config is unavailable: {error:#}"),
+				(),
+			),
+	};
+	if !endpoint_is_reachable(&config.endpoint_url).await? {
+		return skip_or_fail(
+			"storage integration test",
+			format!("storage endpoint is not reachable: {}", config.endpoint_url),
+			(),
+		);
+	}
+
+	let storage = StorageClient::from_storage_config(&config)?;
+	storage.ensure_bucket_exists().await?;
+
+	let prefix = unique_prefix()?;
+	let first_object = format!("{prefix}/first.txt");
+	let second_object = format!("{prefix}/second.bin");
+	let first_body = b"memory-map storage regression\n";
+	let second_body = b"delete me too\n";
+
+	storage.upload_object(&first_object, ByteStream::from_static(first_body), "text/plain").await?;
+	storage
+		.upload_object(
+			&second_object,
+			ByteStream::from_static(second_body),
+			"application/octet-stream",
+		)
+		.await?;
+
+	assert_eq!(storage.object_content_type(&first_object).await?, "text/plain");
+
+	let url = storage.presigned_get_url(&first_object, None).await?;
+	let body = reqwest::get(url).await?.error_for_status()?.bytes().await?;
+	assert_eq!(body.as_ref(), first_body);
+
+	// A signed response-content-disposition must round-trip through storage so the
+	// object resolver can force `attachment` for script-capable types (e.g. SVG).
+	let attachment_url = storage.presigned_get_url(&first_object, Some("attachment")).await?;
+	let attachment_response = reqwest::get(attachment_url).await?.error_for_status()?;
+	assert_eq!(
+		attachment_response
+			.headers()
+			.get(reqwest::header::CONTENT_DISPOSITION)
+			.and_then(|value| value.to_str().ok()),
+		Some("attachment")
+	);
+
+	storage.delete_objects(&[first_object.clone(), second_object.clone()]).await?;
+	assert!(storage.object_content_type(&first_object).await.is_err());
+	assert!(storage.object_content_type(&second_object).await.is_err());
+
+	Ok(())
+}
+
+fn unique_prefix() -> anyhow::Result<String> {
+	Ok(format!("storage-regression/{}", unique_suffix()?))
+}
diff --git a/config.example.toml b/config.example.toml
new file mode 100644
index 0000000..ee18ed4
--- /dev/null
+++ b/config.example.toml
@@ -0,0 +1,69 @@
+# Memory Map backend configuration example.
+#
+# Copy this to config.toml (gitignored), fill in the secret fields, and run the
+# backend with MEMORY_MAP_CONFIG set to the file's path. The file is optional:
+# with MEMORY_MAP_CONFIG unset the backend is configured purely from the
+# environment, exactly as before. Any value here can also be overridden by a
+# MEMORY_MAP__SECTION__KEY environment variable (the environment wins over this
+# file). Secret fields are left blank below; set them in config.toml or via env.
+
+[pg]
+host = "127.0.0.1"
+port = 5432
+dbname = "db"
+# user = "postgres"
+# password = ""  # secret; or MEMORY_MAP__PG__PASSWORD
+
+[server]
+host = "127.0.0.1"
+port = 8000
+
+[smtp]
+host = "smtp.example.com"
+user = "user"
+pass = ""  # secret; or MEMORY_MAP__SMTP__PASS
+from = "noreply@example.com"
+
+[auth]
+cookie_secret = ""  # secret; must be at least 64 bytes; or MEMORY_MAP__AUTH__COOKIE_SECRET
+enable_registration = true
+# cookie_secure = true
+
+[frontend]
+url = "http://localhost:3000"
+
+[cors]
+allowed_origins = "http://127.0.0.1:3000"
+
+[storage]
+endpoint_url = "http://127.0.0.1:9000/"
+public_endpoint_url = "http://127.0.0.1:9000/"
+access_key = ""  # secret; or MEMORY_MAP__STORAGE__ACCESS_KEY
+secret_key = ""  # secret; or MEMORY_MAP__STORAGE__SECRET_KEY
+bucket_name = "memory-map"
+region = "us-east-1"
+force_path_style = true
+presigned_url_ttl_seconds = 604800
+
+[object_lifecycle]
+pending_upload_timeout_seconds = 3600
+upload_max_file_size_bytes = 1073741824
+upload_part_size_bytes = 8388608
+upload_max_part_count = 10000
+upload_session_ttl_seconds = 3600
+upload_session_cleanup_retry_seconds = 60
+upload_session_cleanup_lease_seconds = 300
+upload_session_cleanup_max_attempts = 10
+upload_session_cleanup_batch_size = 1000
+storage_deletion_retry_seconds = 60
+storage_deletion_lease_seconds = 300
+maintenance_interval_seconds = 30
+storage_deletion_batch_size = 1000
+storage_deletion_max_attempts = 10
+
+[email_outbox]
+retry_seconds = 60
+lease_seconds = 300
+worker_interval_seconds = 30
+batch_size = 100
+max_attempts = 10
diff --git a/deny.toml b/deny.toml
index 7287a0a..126dd47 100644
--- a/deny.toml
+++ b/deny.toml
@@ -3,13 +3,6 @@ all-features = true
 
 [advisories]
 ignore = [
-	# `derivative` is pulled through minio 0.3.0. There is no safe upgrade for
-	# the crate itself; replacing the object-storage client should be evaluated
-	# as a separate dependency migration.
-	"RUSTSEC-2024-0388",
-	# `instant` is pulled through casbin -> rhai. There is no safe upgrade for
-	# the crate itself; keep this visible in dependency migration work.
-	"RUSTSEC-2024-0384",
 	# `paste` is still used by the current Leptos ecosystem. There is no safe
 	# upgrade for the crate itself.
 	"RUSTSEC-2024-0436",
diff --git a/devenv/flake.lock b/devenv/flake.lock
index b8c3ffa..4e75b08 100644
--- a/devenv/flake.lock
+++ b/devenv/flake.lock
@@ -8,11 +8,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1767596244,
-        "narHash": "sha256-P4NRZUjYbeuzv4hGrXxfdg0QpdGVoeNn0CMmzIyr398=",
+        "lastModified": 1779790483,
+        "narHash": "sha256-2wCMtmVmkCcyHaH6hkrbx7XdUgLYP5E1wl/jc1YxxTY=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "eedfb5a27900e82ec0390acc83d4d226ce86e714",
+        "rev": "6012e5463531342033571efe294ec880bf13dd95",
         "type": "github"
       },
       "original": {
@@ -64,11 +64,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1765495779,
-        "narHash": "sha256-MhA7wmo/7uogLxiewwRRmIax70g6q1U/YemqTGoFHlM=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "5635c32d666a59ec9a55cab87e898889869f7b71",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -122,12 +122,12 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765186076,
-        "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
-        "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
-        "revCount": 908783,
+        "lastModified": 1779560665,
+        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "revCount": 1004030,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.908783%2Brev-addf7cf5f383a3101ecfba091b98d0a1263dc9b8/019b03a0-b1e4-7f2a-9d10-ad8434116660/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.1004030%2Brev-64c08a7ca051951c8eae34e3e3cb1e202fe36786/019e5fd8-b716-7e01-9710-e44ec43dc50b/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -136,11 +136,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1761765539,
-        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
         "type": "github"
       },
       "original": {
@@ -149,29 +149,13 @@
         "type": "github"
       }
     },
-    "nixpkgs-minio": {
-      "locked": {
-        "lastModified": 1750111231,
-        "narHash": "sha256-3a7Tha/RwYlzH/v3PJrG7+HjOj4c6YOv2K8sqdGsHVQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e6f23dc08d3624daab7094b701aa3954923c6bbb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e6f23dc08d3624daab7094b701aa3954923c6bbb",
-        "type": "github"
-      }
-    },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1767379071,
-        "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=",
+        "lastModified": 1779560665,
+        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "fb7944c166a3b630f177938e478f0378e64ce108",
+        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
         "type": "github"
       },
       "original": {
@@ -183,11 +167,11 @@
     },
     "process-compose-flake": {
       "locked": {
-        "lastModified": 1764915241,
-        "narHash": "sha256-vTqn6IAkZhuuctvkxjhzI1EEybyzwaNd7HJvhF662O8=",
+        "lastModified": 1767863885,
+        "narHash": "sha256-XXekPAxzbv1DmHFo3Elmj/vDnvWc1V0jdDUvM0/Wf7k=",
         "owner": "Platonic-Systems",
         "repo": "process-compose-flake",
-        "rev": "36678818ecbd0e06a60740a291c55b683fec79dd",
+        "rev": "99bea96cf269cfd235833ebdf645b567069fd398",
         "type": "github"
       },
       "original": {
@@ -203,10 +187,8 @@
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-minio": "nixpkgs-minio",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "process-compose-flake": "process-compose-flake",
-        "services-flake": "services-flake",
         "systems": "systems",
         "treefmt-nix": "treefmt-nix"
       }
@@ -214,11 +196,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1767551763,
-        "narHash": "sha256-lcA/e3++3aZQSj6xCsBi2VpYyC3Q+oO/oukgfHiL+Ts=",
+        "lastModified": 1779742949,
+        "narHash": "sha256-Dk0hnFTXbmNmigsJyQkCz2NEEgtpe+MN500dPnki9Ic=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "6a1246b69ca761480b9278df019f717b549cface",
+        "rev": "462d95ca60fa7360b44258be94105bc20e203684",
         "type": "github"
       },
       "original": {
@@ -245,21 +227,6 @@
         "type": "github"
       }
     },
-    "services-flake": {
-      "locked": {
-        "lastModified": 1765168239,
-        "narHash": "sha256-NZ7H4lbbytPNwe4ZyvovycuS1BMBFwJrptgX7NiF+F0=",
-        "owner": "juspay",
-        "repo": "services-flake",
-        "rev": "8b6244f2b310f229568d5cadf7dfcb5ebe6f8bda",
-        "type": "github"
-      },
-      "original": {
-        "owner": "juspay",
-        "repo": "services-flake",
-        "type": "github"
-      }
-    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/devenv/flake.nix b/devenv/flake.nix
index e5e4ecc..cd0e99e 100644
--- a/devenv/flake.nix
+++ b/devenv/flake.nix
@@ -3,10 +3,6 @@
 
   inputs = {
     nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1";
-    # We're using this version as newer versions removed useful features
-    # https://www.reddit.com/r/selfhosted/comments/1kva3pw/avoid_minio_developers_introduce_trojan_horse/
-    # @todo Look into https://github.com/OpenMaxIO/openmaxio-object-browser or https://github.com/rustfs/rustfs
-    nixpkgs-minio.url = "github:NixOS/nixpkgs/e6f23dc08d3624daab7094b701aa3954923c6bbb";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     fenix = {
       url = "github:nix-community/fenix";
@@ -19,7 +15,6 @@
     flake-parts.url = "github:hercules-ci/flake-parts";
     systems.url = "github:nix-systems/default";
     process-compose-flake.url = "github:Platonic-Systems/process-compose-flake";
-    services-flake.url = "github:juspay/services-flake";
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -73,6 +68,197 @@
                 # For Leptos
                 targets.wasm32-unknown-unknown.stable.rust-std
               ];
+            appRustPlatform = pkgs.makeRustPlatform {
+              cargo = rustToolchain;
+              rustc = rustToolchain;
+            };
+            appSource =
+              let
+                root = toString ./..;
+              in
+              lib.cleanSourceWith {
+                src = ./..;
+                filter =
+                  path: type:
+                  let
+                    rel = lib.removePrefix "${root}/" (toString path);
+                  in
+                  !(lib.hasPrefix "target/" rel)
+                  && !(lib.hasPrefix "data/" rel)
+                  && !(lib.hasPrefix "frontend/node_modules/" rel)
+                  && !(lib.hasPrefix "frontend/dist/" rel)
+                  && rel != "process-compose.log"
+                  && rel != "frontend/public/config.json"
+                  && !(lib.hasPrefix "e2e-logs/" rel)
+                  && !(lib.hasPrefix "frontend/playwright-report/" rel)
+                  && !(lib.hasPrefix "frontend/test-results/" rel)
+                  && !(lib.hasPrefix "frontend/blob-report/" rel);
+              };
+            rustfsPackage = pkgs.callPackage ./packages/rustfs.nix { };
+            storageBootstrap = appRustPlatform.buildRustPackage {
+              pname = "memory-map-storage-bootstrap";
+              version = "0.1.0";
+              src = appSource;
+              cargoLock.lockFile = ../Cargo.lock;
+              cargoBuildFlags = [
+                "-p"
+                "backend"
+                "--bin"
+                "memory-map-storage-bootstrap"
+              ];
+              doCheck = false;
+              nativeBuildInputs = [ pkgs.pkg-config ];
+              buildInputs = [ pkgs.openssl ];
+              meta.mainProgram = "memory-map-storage-bootstrap";
+            };
+
+            localPostgres = {
+              dbName = "db";
+              host = "127.0.0.1";
+              port = 5432;
+              dataDir = "data/postgres";
+            };
+            localRustfs = {
+              dataDir = "data/rustfs";
+              apiAddress = "127.0.0.1:9000";
+              consoleAddress = "127.0.0.1:9001";
+              consoleEnabled = true;
+              healthEndpointEnabled = true;
+            };
+            localS3 = {
+              endpointUrl = "http://${localRustfs.apiAddress}";
+              publicEndpointUrl = "http://${localRustfs.apiAddress}";
+              region = "us-east-1";
+              bucketName = "memory-map";
+              forcePathStyle = true;
+              presignedUrlTtlSeconds = 604800;
+              # Deterministic local/CI credentials for the RustFS service.
+              # These are not production secrets.
+              accessKey = "memorymapdev";
+              secretKey = "memorymapdevsecret";
+            };
+            postgresPackage = pkgs.postgresql.withPackages (postgresExtensions: [
+              postgresExtensions.postgis
+            ]);
+            postgresHbaConf = pkgs.writeText "pg_hba.conf" ''
+              # Generated by Nix
+              local all all trust
+              host all all ${localPostgres.host}/32 trust
+              host all all ::1/128 trust
+              local replication all trust
+              host replication all ${localPostgres.host}/32 trust
+              host replication all ::1/128 trust
+            '';
+            postgresInit = pkgs.writeShellApplication {
+              name = "memory-map-postgres-init";
+              runtimeInputs = [
+                postgresPackage
+                pkgs.coreutils
+              ];
+              text = ''
+                set -euo pipefail
+
+                PGDATA="$(readlink -m "${localPostgres.dataDir}")"
+                export PGDATA
+                mkdir -p "$PGDATA"
+
+                if [ -s "$PGDATA/PG_VERSION" ]; then
+                  echo "PostgreSQL data directory already initialized: $PGDATA"
+                  exit 0
+                fi
+
+                initdb --locale=C --encoding=UTF8 -D "$PGDATA"
+              '';
+            };
+            postgresStart = pkgs.writeShellApplication {
+              name = "memory-map-postgres-start";
+              runtimeInputs = [
+                postgresPackage
+                pkgs.coreutils
+              ];
+              text = ''
+                set -euo pipefail
+
+                PGDATA="$(readlink -m "${localPostgres.dataDir}")"
+                export PGDATA
+
+                exec postgres \
+                  -D "$PGDATA" \
+                  -c listen_addresses=${localPostgres.host} \
+                  -c port=${toString localPostgres.port} \
+                  -c hba_file=${postgresHbaConf} \
+                  -c unix_socket_directories=
+              '';
+            };
+            postgresBootstrap = pkgs.writeShellApplication {
+              name = "memory-map-postgres-bootstrap";
+              runtimeInputs = [
+                postgresPackage
+                pkgs.gnugrep
+              ];
+              text = ''
+                set -euo pipefail
+
+                export PGHOST=${localPostgres.host}
+                export PGPORT=${toString localPostgres.port}
+                export PGDATABASE=postgres
+                export PGCONNECT_TIMEOUT=5
+
+                if ! psql -v ON_ERROR_STOP=1 -tAc "SELECT 1 FROM pg_database WHERE datname = '${localPostgres.dbName}'" | grep -qx 1; then
+                  createdb "${localPostgres.dbName}"
+                fi
+
+                psql -v ON_ERROR_STOP=1 -tAc "SELECT name FROM pg_available_extensions WHERE name = 'postgis'" | grep -qx postgis
+              '';
+            };
+            postgresTest = pkgs.writeShellApplication {
+              name = "memory-map-postgres-test";
+              runtimeInputs = [
+                postgresPackage
+                pkgs.gnugrep
+              ];
+              text = ''
+                set -euo pipefail
+
+                psql -h ${localPostgres.host} -p ${toString localPostgres.port} -d ${localPostgres.dbName} -v ON_ERROR_STOP=1 -c 'SELECT version();'
+                psql -h ${localPostgres.host} -p ${toString localPostgres.port} -d ${localPostgres.dbName} -v ON_ERROR_STOP=1 -tAc "SELECT name FROM pg_available_extensions WHERE name = 'postgis'" | grep -qx postgis
+              '';
+            };
+
+            rustfsStart = pkgs.writeShellApplication {
+              name = "memory-map-rustfs-start";
+              runtimeInputs = [
+                rustfsPackage
+                pkgs.coreutils
+              ];
+              text = ''
+                set -euo pipefail
+
+                data_dir="$(readlink -m "${localRustfs.dataDir}")"
+                mkdir -p "$data_dir"
+                exec rustfs server "$data_dir"
+              '';
+            };
+            rustfsBootstrap = pkgs.writeShellApplication {
+              name = "memory-map-rustfs-bootstrap";
+              runtimeInputs = [ storageBootstrap ];
+              text = ''
+                set -euo pipefail
+
+                export MEMORY_MAP__STORAGE__ENDPOINT_URL="${localS3.endpointUrl}"
+                export MEMORY_MAP__STORAGE__PUBLIC_ENDPOINT_URL="${localS3.publicEndpointUrl}"
+                export MEMORY_MAP__STORAGE__ACCESS_KEY="${localS3.accessKey}"
+                export MEMORY_MAP__STORAGE__SECRET_KEY="${localS3.secretKey}"
+                export MEMORY_MAP__STORAGE__BUCKET_NAME="${localS3.bucketName}"
+                export MEMORY_MAP__STORAGE__REGION="${localS3.region}"
+                export MEMORY_MAP__STORAGE__FORCE_PATH_STYLE=${lib.boolToString localS3.forcePathStyle}
+                export MEMORY_MAP__STORAGE__PRESIGNED_URL_TTL_SECONDS=${toString localS3.presignedUrlTtlSeconds}
+                export MEMORY_MAP__FRONTEND__URL="http://127.0.0.1:3000"
+                export MEMORY_MAP__CORS__ALLOWED_ORIGINS="http://127.0.0.1:3000"
+
+                exec memory-map-storage-bootstrap
+              '';
+            };
 
             treefmtEval = inputs.treefmt-nix.lib.evalModule pkgs {
               # Cargo.toml lives at the repo root (one level above devenv/).
@@ -83,6 +269,12 @@
                   enable = true;
                   package = rustToolchain;
                 };
+                shfmt = {
+                  enable = true;
+                  indent_size = 0;
+                  simplify = false;
+                  includes = [ "scripts/*.sh" ];
+                };
                 prettier = {
                   enable = true;
                   includes = [
@@ -126,6 +318,13 @@
                   always_run = true;
                   stages = [ "pre-push" ];
                 };
+                shellcheck = {
+                  enable = true;
+                  package = pkgs.shellcheck;
+                  stages = [ "pre-push" ];
+                  files = "^scripts/.*\\.sh$";
+                  entry = "${pkgs.shellcheck}/bin/shellcheck --enable=all";
+                };
               };
             };
           in
@@ -140,7 +339,7 @@
             formatter = treefmtEval.config.build.wrapper;
 
             checks = {
-              formatting = treefmtEval.config.build.check self'.self;
+              formatting = treefmtEval.config.build.check ./..;
               inherit pre-commit-check;
             };
 
@@ -148,13 +347,6 @@
               inherit system;
               config.allowUnfree = true;
               overlays = [
-                # https://github.com/hercules-ci/flake-parts/discussions/217#discussioncomment-10475578
-                (final: _prev: {
-                  minio = import inputs.nixpkgs-minio {
-                    inherit (final) system;
-                    config.allowUnfree = true;
-                  };
-                })
                 (final: _prev: {
                   unstable = import inputs.nixpkgs-unstable {
                     inherit (final) system;
@@ -165,89 +357,93 @@
             };
 
             overlayAttrs = {
-              inherit (config.packages) rustToolchain;
+              inherit (config.packages) rustToolchain rustfs storageBootstrap;
             };
 
             packages.rustToolchain = rustToolchain;
+            packages.rustfs = rustfsPackage;
+            packages.storageBootstrap = storageBootstrap;
 
             # `process-compose.foo` will add a flake package output called "foo".
             # Therefore, this will add a default package that you can build using
             # `nix build` and run using `nix run`.
-            process-compose."default" =
-              { config, ... }:
-              let
-                dbName = "db";
-              in
-              {
-                imports = [
-                  inputs.services-flake.processComposeModules.default
-                ];
-
-                services = {
-                  minio."minio1" = {
-                    enable = true;
-                    package = pkgs.minio.minio;
-                  };
-                  postgres = {
-                    "pg1" = {
-                      enable = true;
-                      extensions = extensions: [
-                        extensions.postgis
-                      ];
-                      initialDatabases = [
-                        {
-                          name = dbName;
-                        }
-                      ];
+            process-compose."default" = {
+              settings = {
+                ordered_shutdown = true;
+                processes = {
+                  pg1-init.command = postgresInit;
+                  pg1 = {
+                    command = postgresStart;
+                    depends_on."pg1-init".condition = "process_completed_successfully";
+                    shutdown = {
+                      signal = 2;
+                      timeout_seconds = 10;
+                    };
+                    readiness_probe = {
+                      exec.command = "${postgresPackage}/bin/pg_isready -h ${localPostgres.host} -p ${toString localPostgres.port} -d postgres";
+                      initial_delay_seconds = 1;
+                      period_seconds = 2;
+                      timeout_seconds = 5;
+                      success_threshold = 1;
+                      failure_threshold = 10;
+                    };
+                    availability = {
+                      restart = "on_failure";
+                      max_restarts = 5;
                     };
                   };
-                };
-
-                settings = {
-                  processes = {
-                    minio1-test = {
-                      command = pkgs.writeShellApplication {
-                        runtimeInputs = [ pkgs.curl ];
-                        text = ''
-                          curl http://127.0.0.1:9000/minio/health/live
-                        '';
-                        name = "minio1-test";
-                      };
-                      depends_on."minio1".condition = "process_healthy";
+                  pg1-bootstrap = {
+                    command = postgresBootstrap;
+                    depends_on."pg1".condition = "process_healthy";
+                  };
+                  pgweb = {
+                    environment.PGWEB_DATABASE_URL = "postgres://${localPostgres.host}:${toString localPostgres.port}/${localPostgres.dbName}";
+                    command = pkgs.pgweb;
+                    depends_on."pg1-bootstrap".condition = "process_completed_successfully";
+                  };
+                  pg1-test = {
+                    command = postgresTest;
+                    depends_on."pg1-bootstrap".condition = "process_completed_successfully";
+                  };
+                  rustfs = {
+                    command = rustfsStart;
+                    environment = {
+                      RUSTFS_ACCESS_KEY = localS3.accessKey;
+                      RUSTFS_SECRET_KEY = localS3.secretKey;
+                      RUSTFS_ADDRESS = localRustfs.apiAddress;
+                      RUSTFS_CONSOLE_ENABLE = lib.boolToString localRustfs.consoleEnabled;
+                      RUSTFS_CONSOLE_ADDRESS = localRustfs.consoleAddress;
+                      RUSTFS_REGION = localS3.region;
+                      RUSTFS_HEALTH_ENDPOINT_ENABLE = lib.boolToString localRustfs.healthEndpointEnabled;
+                    };
+                    shutdown = {
+                      signal = 15;
+                      timeout_seconds = 5;
                     };
-                    pgweb =
-                      let
-                        pgcfg = config.services.postgres.pg1;
-                      in
-                      {
-                        environment.PGWEB_DATABASE_URL = pgcfg.connectionURI { inherit dbName; };
-                        command = pkgs.pgweb;
-                        depends_on."pg1".condition = "process_healthy";
-                      };
-                    pg1-test = {
-                      command = pkgs.writeShellApplication {
-                        name = "pg1-test";
-                        runtimeInputs = [ config.services.postgres.pg1.package ];
-                        text = ''
-                          echo 'SELECT version();' | psql -h 127.0.0.1 ${dbName}
-                        '';
-                      };
-                      depends_on."pg1".condition = "process_healthy";
+                    readiness_probe = {
+                      exec.command = lib.getExe rustfsBootstrap;
+                      initial_delay_seconds = 2;
+                      period_seconds = 5;
+                      timeout_seconds = 8;
+                      success_threshold = 1;
+                      failure_threshold = 6;
+                    };
+                    availability = {
+                      restart = "on_failure";
+                      max_restarts = 3;
                     };
                   };
                 };
               };
+            };
 
             devShells.default = pkgs.mkShell {
-              inputsFrom = [
-                config.process-compose."default".services.outputs.devShell
-              ];
-
               # Alias for `nativeBuildInputs`
               # https://discourse.nixos.org/t/difference-between-buildinputs-and-packages-in-mkshell/60598/10
               packages = [
                 pkgs.bashInteractive
                 config.packages.rustToolchain
+                postgresPackage
                 pkgs.openssl
                 pkgs.pkg-config
                 pkgs.cargo-deny
@@ -255,19 +451,24 @@
                 pkgs.bacon
                 pkgs.rust-analyzer
                 pkgs.gh
+                # Keep CI git operations inside the Nix toolchain.
+                pkgs.git
                 # Stable didn't yet have cargo-generate, so we're using unstable here
                 pkgs.unstable.cargo-generate
                 pkgs.just
+                pkgs.curl
+                pkgs.process-compose
                 pkgs.pnpm
                 pkgs.nodejs-slim
+                pkgs.playwright-driver
+                pkgs.playwright-driver.browsers
                 pkgs.graphql-client
                 # For Leptos
                 pkgs.leptosfmt
                 pkgs.trunk
                 # https://github.com/trunk-rs/trunk/issues/732#issuecomment-2391810077
                 pkgs.dart-sass
-                # Stable had 0.2.105 and we needed 0.2.106, so we're using unstable here
-                pkgs.unstable.wasm-bindgen-cli
+                pkgs.unstable.wasm-bindgen-cli_0_2_118
                 # Needed for building in release mode
                 pkgs.binaryen
                 # For link checking in markdown
@@ -277,13 +478,23 @@
                 pkgs.ast-grep
                 # For ASCII-only lint check in `just doc`
                 pkgs.ripgrep
+                # For shell script linting and formatting.
+                pkgs.shellcheck
+                pkgs.shfmt
               ];
 
               env = {
+                # Keep Cargo subcommands on the flake-selected toolchain even
+                # when the parent shell exports stale toolchain paths.
+                CARGO = "${config.packages.rustToolchain}/bin/cargo";
+                RUSTC = "${config.packages.rustToolchain}/bin/rustc";
+                LD_LIBRARY_PATH = lib.makeLibraryPath [
+                  pkgs.openssl
+                ];
+                PLAYWRIGHT_BROWSERS_PATH = "${pkgs.playwright-driver.browsers}";
+                PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
                 # Required by rust-analyzer
                 RUST_SRC_PATH = "${config.packages.rustToolchain}/lib/rustlib/src/rust/library";
-                # Required by minio-rs dependency
-                LD_LIBRARY_PATH = lib.makeLibraryPath [ pkgs.openssl ];
               };
 
               inherit (pre-commit-check) shellHook;
diff --git a/devenv/packages/rustfs.nix b/devenv/packages/rustfs.nix
new file mode 100644
index 0000000..af4d580
--- /dev/null
+++ b/devenv/packages/rustfs.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
+}:
+
+let
+  # TODO: RustFS is still pinned to a pre-1.0 release. When bumping this
+  # version, revalidate the process-compose readiness assertion plus the S3
+  # contract used by the app: bucket bootstrap, put/head object behavior,
+  # multipart upload and abort, presigned upload-part PUTs, bucket CORS for
+  # browser PUTs, and exposed ETag headers for multipart completion.
+  version = "1.0.0-beta.4";
+  assets = {
+    aarch64-darwin = {
+      name = "rustfs-macos-aarch64-v${version}.zip";
+      hash = "sha256-NtdXf3tm17REnadhKzSSy/WdDuqcvxOYT6iK72Qz28Q=";
+    };
+    aarch64-linux = {
+      name = "rustfs-linux-aarch64-musl-v${version}.zip";
+      hash = "sha256-ORpcshno95IkugWPCpVHISpIDPrGWd2WF0BUR5EuaGs=";
+    };
+    x86_64-darwin = {
+      name = "rustfs-macos-x86_64-v${version}.zip";
+      hash = "sha256-iZNdTcT2XVVQVK7tWsLyqUECEBKVaLtXYCFecLqEiU4=";
+    };
+    x86_64-linux = {
+      name = "rustfs-linux-x86_64-musl-v${version}.zip";
+      hash = "sha256-Aqt3ctoxv4WWTMmXvVFNu9oZHuGZGT5yOU8fRf4U0pg=";
+    };
+  };
+  asset =
+    assets.${stdenvNoCC.hostPlatform.system}
+      or (throw "RustFS ${version} has no release asset for ${stdenvNoCC.hostPlatform.system}");
+in
+stdenvNoCC.mkDerivation {
+  pname = "rustfs";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/rustfs/rustfs/releases/download/${version}/${asset.name}";
+    inherit (asset) hash;
+  };
+
+  nativeBuildInputs = [ unzip ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    unzip -q "$src" -d source
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    rustfs_bin="$(find source -type f -name rustfs | head -n 1)"
+    if [ -z "$rustfs_bin" ]; then
+      echo "ERROR: RustFS binary not found in release archive." >&2
+      find source -maxdepth 3 -type f >&2
+      exit 1
+    fi
+
+    install -Dm755 "$rustfs_bin" "$out/bin/rustfs"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "High-performance S3-compatible object storage";
+    homepage = "https://rustfs.com";
+    license = lib.licenses.asl20;
+    mainProgram = "rustfs";
+  };
+}
diff --git a/docs/deployment.md b/docs/deployment.md
new file mode 100644
index 0000000..fa5e795
--- /dev/null
+++ b/docs/deployment.md
@@ -0,0 +1,278 @@
+# Production Deployment
+
+This project can run outside the Nix development service graph. Production
+deployments should provide real runtime services and secrets through the
+hosting platform, not through `devenv/flake.nix`.
+
+## Runtime Shape
+
+- Run the backend as a service or container with environment variables supplied
+  by the production platform.
+- Serve the frontend as static files built by Trunk.
+- Provide `/config.json` at the frontend origin at deploy time.
+- Use a real PostgreSQL instance or managed PostgreSQL service.
+- Use AWS S3, RustFS, Garage, or another S3-compatible object store.
+- Put TLS and a reverse proxy or load balancer in front of the public app.
+
+The process-compose services in `devenv/flake.nix` are for local development
+and CI only. Their deterministic credentials are not production secrets.
+
+## Backend Environment
+
+The backend reads configuration from two layered sources. An optional TOML file
+is read first, then environment variables are layered on top (so the environment
+always wins). The file is selected by the `MEMORY_MAP_CONFIG` environment
+variable: set it to the file's path and the file is loaded and required; leave it
+unset and the backend is configured purely from the environment (the default,
+unchanged from previous releases). Secrets should not be committed: keep them in
+a gitignored `config.toml` (copy `config.example.toml`, or run `just config`) or
+supply them via environment variables.
+
+In the TOML file, sections are tables and keys are flat within them, e.g.
+
+```toml
+[storage]
+endpoint_url = "http://127.0.0.1:9000/"
+
+[object_lifecycle]
+storage_deletion_retry_seconds = 60
+```
+
+All variables share the `MEMORY_MAP__` prefix; `__` is both the prefix separator
+and the path separator, so `MEMORY_MAP__STORAGE__ENDPOINT_URL` maps to
+`config.storage.endpoint_url` (and to `storage.endpoint_url` in the TOML file).
+
+Required database settings:
+
+- `MEMORY_MAP__PG__DBNAME`
+- `MEMORY_MAP__PG__HOST`
+- `MEMORY_MAP__PG__PORT`
+
+Required server settings:
+
+- `MEMORY_MAP__SERVER__HOST`
+- `MEMORY_MAP__SERVER__PORT`
+
+Required SMTP settings:
+
+- `MEMORY_MAP__SMTP__HOST`
+- `MEMORY_MAP__SMTP__USER`
+- `MEMORY_MAP__SMTP__PASS`
+- `MEMORY_MAP__SMTP__FROM`
+
+Required auth settings:
+
+- `MEMORY_MAP__AUTH__COOKIE_SECRET`
+- `MEMORY_MAP__AUTH__ENABLE_REGISTRATION`
+
+Optional auth settings:
+
+- `MEMORY_MAP__AUTH__COOKIE_SECURE` (default: infer from
+  `MEMORY_MAP__FRONTEND__URL`)
+
+Required frontend / CORS settings:
+
+- `MEMORY_MAP__FRONTEND__URL`
+- `MEMORY_MAP__CORS__ALLOWED_ORIGINS`
+
+Required S3-compatible storage settings:
+
+- `MEMORY_MAP__STORAGE__ENDPOINT_URL`
+- `MEMORY_MAP__STORAGE__ACCESS_KEY`
+- `MEMORY_MAP__STORAGE__SECRET_KEY`
+- `MEMORY_MAP__STORAGE__BUCKET_NAME`
+
+Optional S3 settings (defaults shown):
+
+- `MEMORY_MAP__STORAGE__REGION` (default `us-east-1`)
+- `MEMORY_MAP__STORAGE__FORCE_PATH_STYLE` (default `true`)
+- `MEMORY_MAP__STORAGE__PRESIGNED_URL_TTL_SECONDS` (default `604800`)
+- `MEMORY_MAP__STORAGE__PUBLIC_ENDPOINT_URL` (default: use
+  `MEMORY_MAP__STORAGE__ENDPOINT_URL`)
+
+Optional object lifecycle settings (defaults shown):
+
+- `MEMORY_MAP__OBJECT_LIFECYCLE__PENDING_UPLOAD_TIMEOUT_SECONDS` (default `3600`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_MAX_FILE_SIZE_BYTES` (default
+  `1073741824`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_PART_SIZE_BYTES` (default `8388608`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_MAX_PART_COUNT` (default `10000`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_TTL_SECONDS` (default `3600`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_RETRY_SECONDS` (default
+  `60`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_LEASE_SECONDS` (default
+  `300`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_MAX_ATTEMPTS` (default
+  `10`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_CLEANUP_BATCH_SIZE` (default
+  `1000`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_RETRY_SECONDS` (default `60`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_LEASE_SECONDS` (default `300`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__MAINTENANCE_INTERVAL_SECONDS` (default `30`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_BATCH_SIZE` (default `1000`)
+- `MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_MAX_ATTEMPTS` (default `10`)
+
+Optional email outbox settings (defaults shown):
+
+- `MEMORY_MAP__EMAIL_OUTBOX__RETRY_SECONDS` (default `60`)
+- `MEMORY_MAP__EMAIL_OUTBOX__LEASE_SECONDS` (default `300`)
+- `MEMORY_MAP__EMAIL_OUTBOX__WORKER_INTERVAL_SECONDS` (default `30`)
+- `MEMORY_MAP__EMAIL_OUTBOX__BATCH_SIZE` (default `100`)
+- `MEMORY_MAP__EMAIL_OUTBOX__MAX_ATTEMPTS` (default `10`)
+
+`MEMORY_MAP__AUTH__COOKIE_SECRET`, `MEMORY_MAP__SMTP__PASS`,
+`MEMORY_MAP__STORAGE__ACCESS_KEY`, and `MEMORY_MAP__STORAGE__SECRET_KEY` must
+come from production secret management. Do not copy values from `.env.example`
+or `devenv/flake.nix` into production.
+
+`MEMORY_MAP__STORAGE__PRESIGNED_URL_TTL_SECONDS` must be between `1` and
+`604800`.
+
+`MEMORY_MAP__AUTH__COOKIE_SECURE` overrides whether login/logout cookies use
+the `Secure` attribute. Leave it unset to infer from
+`MEMORY_MAP__FRONTEND__URL`; set it to `true` when TLS is terminated by a
+proxy but the configured frontend URL is not `https`.
+
+`MEMORY_MAP__STORAGE__PUBLIC_ENDPOINT_URL` signs browser-facing object URLs
+when the backend reaches storage through a private endpoint but browsers need a
+different public endpoint.
+
+`MEMORY_MAP__OBJECT_LIFECYCLE__PENDING_UPLOAD_TIMEOUT_SECONDS` controls when an
+unfinalized upload is treated as failed and moved into cleanup. It should be
+comfortably longer than the longest expected object upload.
+
+`MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_PART_SIZE_BYTES` must be at least
+`5242880`, the S3 multipart minimum for non-final parts. The maximum file size
+must fit within `UPLOAD_MAX_PART_COUNT` parts.
+
+`MEMORY_MAP__OBJECT_LIFECYCLE__UPLOAD_SESSION_TTL_SECONDS` controls how long a
+direct-upload session can be completed before it is eligible for reconciliation.
+
+Expired direct-upload sessions are reconciled by the backend worker. It aborts
+incomplete multipart uploads, removes pending metadata after successful aborts,
+and moves completed-object orphans into the storage-deletion outbox.
+
+`MEMORY_MAP__OBJECT_LIFECYCLE__STORAGE_DELETION_MAX_ATTEMPTS` bounds how many
+times a failing storage deletion is retried before it is parked. Rows past the
+cap remain in `object_storage_deletions` with their `last_error` populated for
+operator triage, but are no longer reclaimed by the worker.
+
+Password-reset emails are sent by a backend email outbox worker. Requests insert
+reset tokens and email rows in one database transaction; SMTP delivery happens
+after commit. `MEMORY_MAP__EMAIL_OUTBOX__MAX_ATTEMPTS` bounds delivery retries.
+Rows past the cap remain in `email_outbox` with their `last_error` populated
+for operator triage, but are no longer reclaimed by the worker.
+
+## Frontend Runtime Config
+
+The frontend is a static client-side rendered app. At runtime it fetches
+`/config.json` from the same origin as the frontend. The concrete runtime file
+`frontend/public/config.json` is intentionally ignored by Git.
+
+Production must provide a concrete `/config.json` during deployment. The
+frontend build recipe requires `frontend/public/config.json` to exist, but it
+does not create the local example automatically:
+
+```json
+{
+	"api_url": "https://api.example.com"
+}
+```
+
+`api_url` is public runtime configuration, not a secret. It should point to the
+public backend GraphQL/API origin used by browsers.
+
+For local development, run `just frontend-config` to create
+`frontend/public/config.json` from `frontend/config.example.json`. The example
+uses the local backend API URL, `http://127.0.0.1:8000`, which is not suitable
+for production. Do not deploy a frontend build with that local runtime config.
+
+## PostgreSQL
+
+Production should use a real PostgreSQL instance or a managed PostgreSQL
+service. Do not use local `data/postgres` state from process-compose.
+
+The backend runs database migrations on startup using the configured database
+connection. The database user must have the privileges needed to run those
+migrations.
+
+## Object Storage
+
+The backend uses the AWS Rust S3 SDK against the configured S3-compatible
+endpoint. The app needs:
+
+- object upload
+- multipart object upload and abort
+- object metadata lookup
+- presigned GET URLs
+- presigned multipart upload-part URLs
+- content-type metadata
+- bulk object delete
+
+Path-style guidance:
+
+- Local RustFS uses `MEMORY_MAP__STORAGE__FORCE_PATH_STYLE=true`.
+- AWS S3 normally uses `MEMORY_MAP__STORAGE__FORCE_PATH_STYLE=false`.
+- Other S3-compatible services should follow the provider's requirements.
+
+The configured bucket must be usable by the configured credentials. The backend
+verifies bucket access on startup but does not create buckets at runtime. The
+local and CI bootstrap helper can create or verify a bucket for RustFS, but
+production bucket lifecycle should be managed intentionally by the deployment.
+Buckets used by the browser direct-upload flow must allow CORS `PUT` requests
+from the public frontend origin, allow the signed request headers used by
+presigned upload-part URLs, and expose the `ETag` response header so the
+frontend can complete multipart uploads. The local RustFS bootstrap applies
+this policy from `MEMORY_MAP__FRONTEND__URL` and
+`MEMORY_MAP__CORS__ALLOWED_ORIGINS`; production bucket CORS should be managed
+with the bucket infrastructure.
+
+Database object deletes first mark metadata rows as delete-pending and enqueue
+cleanup by the immutable storage key, not the user-visible object name. A
+backend worker claims cleanup rows in bounded batches, deletes the blobs, and
+then removes the delete-pending metadata rows. If storage deletion fails, the
+queue row remains for a later retry instead of losing track of the blob cleanup
+work. Pending rows without upload sessions are also moved into the same cleanup
+path after the configured timeout.
+
+Incomplete multipart uploads: the backend reconciles expired upload sessions and
+aborts their multipart uploads, but a cleanup that fails permanently, after
+exhausting its retry budget, is parked for operator triage and its multipart
+upload is not retried. Configure a bucket lifecycle rule that aborts incomplete
+multipart uploads, for example after one day, as a backstop so abandoned upload
+parts cannot accumulate storage cost. The backend logs a warning naming the
+parked-row counts on each maintenance pass while a backlog exists.
+
+Storage origin isolation: serve object storage from an origin distinct from the
+application origin. The application embeds object media only through `<img>` and
+`<video>` and forces `Content-Disposition: attachment` on presigned GET URLs for
+script-capable types such as SVG, so a direct navigation downloads rather than
+renders them. A distinct storage origin (set
+`MEMORY_MAP__STORAGE__PUBLIC_ENDPOINT_URL` when the storage endpoint would
+otherwise share the application origin) is defense in depth that keeps any
+content served by the object store away from application cookies.
+
+## Reverse Proxy And TLS
+
+Serve the frontend over HTTPS in production.
+
+Route backend GraphQL traffic to the backend service. The backend serves
+GraphQL at `/`; browser object bytes upload directly to the configured
+S3-compatible storage endpoint through presigned multipart URLs.
+
+Set `MEMORY_MAP__FRONTEND__URL` and `MEMORY_MAP__CORS__ALLOWED_ORIGINS` to the
+public frontend origin. For example:
+
+```sh
+MEMORY_MAP__FRONTEND__URL=https://memory-map.example.com
+MEMORY_MAP__CORS__ALLOWED_ORIGINS=https://memory-map.example.com
+```
+
+Keep browser traffic on HTTPS so authenticated cookies and presigned media URL
+access are not exposed over plaintext connections.
+
+## Out Of Scope
+
+This repository does not currently define a production Docker image, systemd
+unit, NixOS module, Kubernetes manifest, or hosting-specific deployment
+artifact. Add those only after choosing a concrete production platform.
diff --git a/frontend/Cargo.toml b/frontend/Cargo.toml
index 7c73b82..442036a 100644
--- a/frontend/Cargo.toml
+++ b/frontend/Cargo.toml
@@ -11,7 +11,7 @@ anyhow = "1.0"
 console_error_panic_hook = "0.1"
 console_log = "1"
 email_address = "0.2"
-graphql_client = "0.15"
+graphql_client = "0.16"
 leptos = { version = "0.8", features = ["csr"] }
 leptos-leaflet = { version = "0.10", features = [
 	"csr",
@@ -19,7 +19,7 @@ leptos-leaflet = { version = "0.10", features = [
 leptos_meta = { version = "0.8" }
 leptos_router = { version = "0.8" }
 log = "0.4"
-lucide-leptos = { version = "2", features = [
+lucide-leptos = { version = "3", features = [
 	"account",
 	"arrows",
 	"files",
@@ -37,7 +37,7 @@ shared = { path = "../shared" }
 # @todo Bump this once out of beta.
 thaw = { version = "0.5.0-beta", features = ["csr"] }
 thiserror = "2.0"
-tokio = { version = "1.49", features = [
+tokio = { version = "1.52", features = [
 	"io-util",
 	"macros",
 	"rt",
@@ -61,8 +61,8 @@ web-sys = { version = "0.3", features = [
 ] }
 
 [dev-dependencies]
-# Locked to =0.2.106 since that's the latest available on nixpkgs
-wasm-bindgen = "=0.2.106"
+# Locked to match wasm-bindgen-cli_0_2_118 from nixpkgs.
+wasm-bindgen = "=0.2.118"
 wasm-bindgen-test = "0.3"
 
 [lints]
diff --git a/frontend/README.md b/frontend/README.md
index b78bacc..404a182 100644
--- a/frontend/README.md
+++ b/frontend/README.md
@@ -23,8 +23,10 @@ To build the frontend:
 just frontend-build
 ```
 
-This runs `pnpm install --frozen-lockfile --prefer-offline` and then builds the
-application through Trunk.
+This requires an explicit `frontend/public/config.json`, runs
+`pnpm install --frozen-lockfile --prefer-offline`, and then builds the
+application through Trunk. Use `just frontend-config` for local builds, and
+provide a deployment-specific config for production builds.
 
 ## GraphQL
 
diff --git a/frontend/config.example.json b/frontend/config.example.json
new file mode 100644
index 0000000..2a5dea4
--- /dev/null
+++ b/frontend/config.example.json
@@ -0,0 +1,3 @@
+{
+	"api_url": "http://127.0.0.1:8000"
+}
diff --git a/frontend/e2e/fixtures.ts b/frontend/e2e/fixtures.ts
new file mode 100644
index 0000000..fb64294
--- /dev/null
+++ b/frontend/e2e/fixtures.ts
@@ -0,0 +1,80 @@
+import {
+	expect,
+	test as base,
+} from "@playwright/test";
+
+// Strict by default. Negative tests can opt out only for expected messages:
+// test.use({ allowFailedRequests: [/PUT .*storage/] });
+type StrictPageOptions = {
+	allowConsoleErrors: RegExp[];
+	allowFailedRequests: RegExp[];
+};
+
+const transparentPng = Buffer.from(
+	"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAFgwJ/lz7eSgAAAABJRU5ErkJggg==",
+	"base64",
+);
+const storageUrl = process.env.E2E_STORAGE_URL ?? "http://127.0.0.1:9000";
+
+function allowedBy(
+	value: string,
+	allowed: RegExp[],
+): boolean {
+	return allowed.some((pattern) => pattern.test(value));
+}
+
+const test = base.extend<StrictPageOptions>({
+	allowConsoleErrors: [[], { option: true }],
+	allowFailedRequests: [[], { option: true }],
+	page: async (
+		{
+			allowConsoleErrors,
+			allowFailedRequests,
+			page,
+		},
+		use,
+	) => {
+		const consoleErrors: string[] = [];
+		const failedRequests: string[] = [];
+
+		await page.route("https://tile.openstreetmap.org/**", async (route) => {
+			await route.fulfill({
+				status: 200,
+				contentType: "image/png",
+				body: transparentPng,
+			});
+		});
+
+		page.on("console", (message) => {
+			if (message.type() === "error") {
+				consoleErrors.push(message.text());
+			}
+		});
+
+		page.on("requestfailed", (request) => {
+			const failure = request.failure();
+			if (
+				request.method() === "PUT" &&
+				request.url().startsWith(storageUrl) &&
+				failure?.errorText === "net::ERR_ABORTED"
+			) {
+				return;
+			}
+			failedRequests.push(
+				`${request.method()} ${request.url()} ${failure?.errorText ?? "failed"}`,
+			);
+		});
+
+		await use(page);
+
+		expect(consoleErrors.filter((message) => !allowedBy(message, allowConsoleErrors)))
+			.toEqual([]);
+		expect(failedRequests.filter((request) => !allowedBy(request, allowFailedRequests)))
+			.toEqual([]);
+	},
+});
+
+export {
+	expect,
+	test,
+};
diff --git a/frontend/e2e/fixtures/memory-map-e2e.svg b/frontend/e2e/fixtures/memory-map-e2e.svg
new file mode 100644
index 0000000..4e4cfed
--- /dev/null
+++ b/frontend/e2e/fixtures/memory-map-e2e.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="160" height="100" viewBox="0 0 160 100" role="img" aria-label="Memory Map E2E fixture">
+	<rect width="160" height="100" fill="#f4f7fb"/>
+	<circle cx="50" cy="50" r="24" fill="#2f80ed"/>
+	<path d="M95 30h35v10H95zm0 20h45v10H95zm0 20h28v10H95z" fill="#111827"/>
+</svg>
diff --git a/frontend/e2e/smoke.spec.ts b/frontend/e2e/smoke.spec.ts
new file mode 100644
index 0000000..01b43ab
--- /dev/null
+++ b/frontend/e2e/smoke.spec.ts
@@ -0,0 +1,12 @@
+import {
+	expect,
+	test,
+} from "./fixtures";
+
+test("home page loads the map shell", async ({ page }) => {
+	await page.goto("/");
+
+	await expect(page).toHaveTitle(/Memory Map/);
+	await expect(page.locator(".leaflet-container")).toBeVisible();
+	await expect(page.getByRole("button", { name: "Open menu" })).toBeVisible();
+});
diff --git a/frontend/e2e/workflow.spec.ts b/frontend/e2e/workflow.spec.ts
new file mode 100644
index 0000000..857e6a8
--- /dev/null
+++ b/frontend/e2e/workflow.spec.ts
@@ -0,0 +1,327 @@
+import fs from "node:fs";
+import path from "node:path";
+import type {
+	Locator,
+	Page,
+	Response as PlaywrightResponse,
+} from "@playwright/test";
+
+import {
+	expect,
+	test,
+} from "./fixtures";
+
+const fixtureBuffer = fs.readFileSync(
+	path.join(__dirname, "fixtures", "memory-map-e2e.svg"),
+);
+
+const password = "memory-map-e2e-password-123";
+const backendUrl = process.env.E2E_BACKEND_URL ?? "http://127.0.0.1:8000";
+const storageUrl = process.env.E2E_STORAGE_URL ?? "http://127.0.0.1:9000";
+
+function runId(): string {
+	return `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+
+async function expectImageLoaded(locator: Locator): Promise<void> {
+	await expect(locator).toBeVisible();
+	await expect
+		.poll(async () =>
+			locator.evaluate((element) => {
+				if (!(element instanceof HTMLImageElement)) {
+					return false;
+				}
+				return element.complete && element.naturalWidth > 0 && element.naturalHeight > 0;
+			}),
+		)
+		.toBe(true);
+}
+
+async function openMenu(page: Page): Promise<void> {
+	await page.getByRole("button", { name: "Open menu" }).click();
+	await expect(page.getByRole("button", { name: "Close menu" })).toBeVisible();
+}
+
+async function openMarkerPopup(
+	page: Page,
+	text: string,
+): Promise<Locator> {
+	const markers = page.locator(".leaflet-marker-icon");
+	await expect(markers.first()).toBeVisible();
+
+	const count = await markers.count();
+	for (let index = 0; index < count; index += 1) {
+		await markers.nth(index).click();
+		const popupHeading = page.getByRole("heading", { name: text });
+		if (await popupHeading.isVisible().catch(() => false)) {
+			return popupHeading;
+		}
+	}
+
+	throw new Error(`Could not find marker popup for ${text}`);
+}
+
+async function registerAndSignIn(
+	page: Page,
+	email: string,
+): Promise<void> {
+	await page.goto("/register");
+	await expect(page.getByRole("heading", { name: "Register" })).toBeVisible();
+	await page.getByLabel("Email").fill(email);
+	await page.getByLabel("Password", { exact: true }).fill(password);
+	await page.getByLabel("Confirm Password").fill(password);
+	await page.getByRole("button", { name: "Register" }).click();
+	await expect(page).toHaveURL(/\/sign-in$/);
+
+	await page.getByLabel("Email").fill(email);
+	await page.getByLabel("Password", { exact: true }).fill(password);
+	await page.getByRole("button", { name: "Sign In" }).click();
+	await expect(page).toHaveURL(/\/$/);
+}
+
+async function openAddObjectDialog(page: Page): Promise<void> {
+	await page.goto("/objects");
+	await expect(page.getByRole("heading", { name: "Objects" })).toBeVisible();
+	await page.getByRole("button", { name: "Add Object" }).click();
+	await expect(page.getByRole("heading", { name: "Add Object", exact: true })).toBeVisible();
+}
+
+async function fillUploadForm(
+	page: Page,
+	objectName: string,
+	latitude: string,
+	longitude: string,
+): Promise<void> {
+	await page.getByLabel("Set latitude").fill(latitude);
+	await page.getByLabel("Set longitude").fill(longitude);
+	await page.getByLabel("Set date and time").fill("2026-05-29T12:34");
+	await page.getByLabel("Select files to upload").setInputFiles({
+		name: objectName,
+		mimeType: "image/svg+xml",
+		buffer: fixtureBuffer,
+	});
+}
+
+function waitForGraphqlOperation(
+	page: Page,
+	operationName: string,
+): Promise<PlaywrightResponse> {
+	return page.waitForResponse((response) => {
+		const request = response.request();
+		return (
+			request.method() === "POST" &&
+			response.url().startsWith(backendUrl) &&
+			(request.postData()?.includes(operationName) ?? false)
+		);
+	});
+}
+
+async function expectBackendGraphqlUsedAuthCookie(
+	response: PlaywrightResponse,
+): Promise<void> {
+	const headers = await response.request().allHeaders();
+	expect(headers.cookie ?? "").toContain("auth_token=");
+}
+
+async function expectStoragePutUsedPresignedUrlWithoutAppCookie(
+	response: PlaywrightResponse,
+): Promise<void> {
+	const request = response.request();
+	const headers = await request.allHeaders();
+
+	expect(request.method()).toBe("PUT");
+	expect(response.url().startsWith(storageUrl)).toBe(true);
+	expect(headers.cookie).toBeUndefined();
+}
+
+test("authenticated object workflow covers upload preview gallery delete and logout", async ({
+	page,
+}) => {
+	const id = runId();
+	const email = `memory-map-e2e-${id}@example.test`;
+	const objectName = `memory-map-e2e-${id}.svg`;
+	const latitude = "51.505";
+	const longitude = "-0.09";
+	const locationText = `${latitude}, ${longitude}`;
+
+	await test.step("home page and anonymous menu load", async () => {
+		await page.goto("/");
+		await expect(page).toHaveTitle(/Memory Map/);
+		await expect(page.locator(".leaflet-container")).toBeVisible();
+		await openMenu(page);
+		await expect(page.getByRole("link", { name: "Sign In" })).toBeVisible();
+		await page.getByRole("button", { name: "Close menu" }).click();
+	});
+
+	await test.step("register and sign in", async () => {
+		await registerAndSignIn(page, email);
+	});
+
+	await test.step("upload object and verify table preview", async () => {
+		await openAddObjectDialog(page);
+		await fillUploadForm(page, objectName, latitude, longitude);
+
+		const createSessionPromise = waitForGraphqlOperation(
+			page,
+			"CreateObjectUploadSessionMutation",
+		);
+		const presignPartsPromise = waitForGraphqlOperation(
+			page,
+			"PresignObjectUploadPartsMutation",
+		);
+		const uploadPartPromise = page.waitForResponse(
+			(response) =>
+				response.request().method() === "PUT" &&
+				response.url().startsWith(storageUrl),
+		);
+		const completeUploadPromise = waitForGraphqlOperation(
+			page,
+			"CompleteObjectUploadMutation",
+		);
+		await page.getByRole("button", { name: "Submit" }).click();
+		const createSessionResponse = await createSessionPromise;
+		const presignPartsResponse = await presignPartsPromise;
+		const uploadPartResponse = await uploadPartPromise;
+		const completeUploadResponse = await completeUploadPromise;
+		expect(createSessionResponse.ok()).toBe(true);
+		expect(presignPartsResponse.ok()).toBe(true);
+		expect(uploadPartResponse.ok()).toBe(true);
+		expect(completeUploadResponse.ok()).toBe(true);
+		await expectBackendGraphqlUsedAuthCookie(createSessionResponse);
+		await expectBackendGraphqlUsedAuthCookie(presignPartsResponse);
+		await expectBackendGraphqlUsedAuthCookie(completeUploadResponse);
+		await expectStoragePutUsedPresignedUrlWithoutAppCookie(uploadPartResponse);
+		expect(new URL(page.url()).search).toBe("");
+
+		const row = page.getByRole("row").filter({ hasText: objectName });
+		await expect(row).toBeVisible();
+		await expect(row).toContainText(locationText);
+
+		const thumbnail = row.getByRole("img", { name: objectName });
+		await expectImageLoaded(thumbnail);
+
+		await row.getByRole("button", { name: objectName }).click();
+		const previewDialog = page
+			.getByRole("dialog")
+			.filter({ has: page.getByRole("img", { name: objectName }) })
+			.last();
+		await expect(previewDialog).toBeVisible();
+		await expectImageLoaded(previewDialog.getByRole("img", { name: objectName }));
+		await previewDialog.getByRole("button", { name: "Close" }).click();
+		await expect(previewDialog).toBeHidden();
+	});
+
+	await test.step("verify map marker and gallery", async () => {
+		await page.goto("/");
+		await expect(page.locator(".leaflet-container")).toBeVisible();
+		await openMarkerPopup(page, locationText);
+		await page.getByRole("button", { name: "Open Gallery" }).click();
+
+		const galleryDialog = page.getByRole("dialog").filter({ hasText: locationText });
+		await expect(galleryDialog).toBeVisible();
+		await expectImageLoaded(galleryDialog.getByRole("img", { name: objectName }).first());
+		await galleryDialog.getByRole("button", { name: "Close" }).click();
+		await expect(galleryDialog).toBeHidden();
+	});
+
+	await test.step("delete object and verify protected route logout behavior", async () => {
+		await page.goto("/objects");
+		const row = page.getByRole("row").filter({ hasText: objectName });
+		await expect(row).toBeVisible();
+		await row.getByRole("button", { name: "Delete" }).click();
+
+		const confirmDialog = page.getByRole("dialog").filter({ hasText: objectName });
+		await expect(confirmDialog).toBeVisible();
+		await confirmDialog.getByRole("button", { name: "Yes" }).click();
+		await expect(page.getByRole("row").filter({ hasText: objectName })).toHaveCount(0);
+
+		await openMenu(page);
+		const markersReloaded = waitForGraphqlOperation(page, "S3ObjectsQuery");
+		await page.getByRole("button", { name: "Log Out" }).click();
+		await expect(page).toHaveURL(/\/$/);
+		expect((await markersReloaded).ok()).toBe(true);
+
+		await page.goto("/objects");
+		await expect(page).toHaveURL(/\/sign-in$/);
+		await expect(page.getByRole("heading", { name: "Sign In" })).toBeVisible();
+	});
+});
+
+test.describe("direct upload failure handling", () => {
+	test.use({
+		allowConsoleErrors: [
+			/^Failed to load resource: the server responded with a status of 503/,
+		],
+	});
+
+	test("direct upload part failure aborts the upload session", async ({ page }) => {
+		const id = runId();
+		const email = `memory-map-e2e-abort-${id}@example.test`;
+		const objectName = `memory-map-e2e-abort-${id}.svg`;
+		const latitude = "51.505";
+		const longitude = "-0.09";
+
+		await registerAndSignIn(page, email);
+		await openAddObjectDialog(page);
+		await fillUploadForm(page, objectName, latitude, longitude);
+
+		await page.route(`${storageUrl}/**`, async (route) => {
+			if (route.request().method() === "PUT") {
+				await route.fulfill({
+					status: 503,
+					body: "simulated storage upload failure",
+				});
+				return;
+			}
+
+			await route.continue();
+		});
+
+		const createSessionPromise = waitForGraphqlOperation(
+			page,
+			"CreateObjectUploadSessionMutation",
+		);
+		const presignPartsPromise = waitForGraphqlOperation(
+			page,
+			"PresignObjectUploadPartsMutation",
+		);
+		const failedUploadPartPromise = page.waitForResponse((response) =>
+			response.request().method() === "PUT" && response.url().startsWith(storageUrl)
+		);
+		const abortUploadPromise = waitForGraphqlOperation(
+			page,
+			"AbortObjectUploadMutation",
+		);
+
+		await page.getByRole("button", { name: "Submit" }).click();
+
+		const createSessionResponse = await createSessionPromise;
+		const presignPartsResponse = await presignPartsPromise;
+		const failedUploadPartResponse = await failedUploadPartPromise;
+		const abortUploadResponse = await abortUploadPromise;
+		expect(createSessionResponse.ok()).toBe(true);
+		expect(presignPartsResponse.ok()).toBe(true);
+		expect(failedUploadPartResponse.status()).toBe(503);
+		expect(abortUploadResponse.ok()).toBe(true);
+		await expectBackendGraphqlUsedAuthCookie(createSessionResponse);
+		await expectBackendGraphqlUsedAuthCookie(presignPartsResponse);
+		await expectBackendGraphqlUsedAuthCookie(abortUploadResponse);
+		await expectStoragePutUsedPresignedUrlWithoutAppCookie(failedUploadPartResponse);
+		await expect(page.getByText(/Failed to upload files\. Status: 503/)).toBeVisible();
+		await expect(page.getByRole("heading", { name: "Add Object", exact: true }))
+			.toBeVisible();
+		await expect(page.getByRole("button", { name: "Submit" })).toBeEnabled();
+	});
+});
+
+test("mobile map and menu smoke", async ({ page }) => {
+	await page.setViewportSize({ width: 390, height: 844 });
+	await page.goto("/");
+
+	await expect(page.getByRole("heading", { name: "Map" })).toBeVisible();
+	await expect(page.locator(".leaflet-container")).toBeVisible();
+	await openMenu(page);
+	await expect(page.getByRole("link", { name: "Sign In" })).toBeVisible();
+	await page.getByRole("button", { name: "Close menu" }).click();
+	await expect(page.getByRole("button", { name: "Open menu" })).toBeVisible();
+});
diff --git a/frontend/graphql/abortObjectUpload.graphql b/frontend/graphql/abortObjectUpload.graphql
new file mode 100644
index 0000000..4c32d4a
--- /dev/null
+++ b/frontend/graphql/abortObjectUpload.graphql
@@ -0,0 +1,5 @@
+mutation AbortObjectUploadMutation($objectId: ID!) {
+	abortObjectUpload(objectId: $objectId) {
+		objectId
+	}
+}
diff --git a/frontend/graphql/completeObjectUpload.graphql b/frontend/graphql/completeObjectUpload.graphql
new file mode 100644
index 0000000..9f40458
--- /dev/null
+++ b/frontend/graphql/completeObjectUpload.graphql
@@ -0,0 +1,18 @@
+mutation CompleteObjectUploadMutation(
+	$objectId: ID!
+	$parts: [CompletedObjectUploadPartInput!]!
+) {
+	completeObjectUpload(objectId: $objectId, parts: $parts) {
+		id
+		name
+		madeOn
+		location {
+			latitude
+			longitude
+		}
+		url
+		contentType
+		publicity
+		allowedUsers
+	}
+}
diff --git a/frontend/graphql/createObjectUploadSession.graphql b/frontend/graphql/createObjectUploadSession.graphql
new file mode 100644
index 0000000..fa5ad45
--- /dev/null
+++ b/frontend/graphql/createObjectUploadSession.graphql
@@ -0,0 +1,8 @@
+mutation CreateObjectUploadSessionMutation($input: CreateObjectUploadSessionInput!) {
+	createObjectUploadSession(input: $input) {
+		objectId
+		partSizeBytes
+		totalParts
+		expiresAt
+	}
+}
diff --git a/frontend/graphql/presignObjectUploadParts.graphql b/frontend/graphql/presignObjectUploadParts.graphql
new file mode 100644
index 0000000..ab179ec
--- /dev/null
+++ b/frontend/graphql/presignObjectUploadParts.graphql
@@ -0,0 +1,13 @@
+mutation PresignObjectUploadPartsMutation($objectId: ID!, $partNumbers: [Int!]!) {
+	presignObjectUploadParts(objectId: $objectId, partNumbers: $partNumbers) {
+		partNumber
+		url
+		method
+		headers {
+			name
+			value
+		}
+		expectedContentLength
+		urlExpiresAt
+	}
+}
diff --git a/frontend/graphql/schema.json b/frontend/graphql/schema.json
index b33e4a4..cd2bba7 100644
--- a/frontend/graphql/schema.json
+++ b/frontend/graphql/schema.json
@@ -114,6 +114,33 @@
       },
       "subscriptionType": null,
       "types": [
+        {
+          "description": null,
+          "enumValues": null,
+          "fields": [
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "objectId",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "ID",
+                  "ofType": null
+                }
+              }
+            }
+          ],
+          "inputFields": null,
+          "interfaces": [],
+          "kind": "OBJECT",
+          "name": "AbortedObjectUpload",
+          "possibleTypes": null
+        },
         {
           "description": "The `Boolean` scalar type represents `true` or `false`.",
           "enumValues": null,
@@ -124,6 +151,225 @@
           "name": "Boolean",
           "possibleTypes": null
         },
+        {
+          "description": null,
+          "enumValues": null,
+          "fields": null,
+          "inputFields": [
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "partNumber",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Int",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "eTag",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            }
+          ],
+          "interfaces": null,
+          "kind": "INPUT_OBJECT",
+          "name": "CompletedObjectUploadPartInput",
+          "possibleTypes": null
+        },
+        {
+          "description": null,
+          "enumValues": null,
+          "fields": null,
+          "inputFields": [
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "name",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "contentType",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "fileSizeBytes",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Int",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "madeOn",
+              "type": {
+                "kind": "SCALAR",
+                "name": "String",
+                "ofType": null
+              }
+            },
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "location",
+              "type": {
+                "kind": "INPUT_OBJECT",
+                "name": "LocationInput",
+                "ofType": null
+              }
+            },
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "publicity",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "ENUM",
+                  "name": "PublicityOverride",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "defaultValue": null,
+              "description": null,
+              "name": "allowedUsers",
+              "type": {
+                "kind": "LIST",
+                "name": null,
+                "ofType": {
+                  "kind": "NON_NULL",
+                  "name": null,
+                  "ofType": {
+                    "kind": "SCALAR",
+                    "name": "String",
+                    "ofType": null
+                  }
+                }
+              }
+            }
+          ],
+          "interfaces": null,
+          "kind": "INPUT_OBJECT",
+          "name": "CreateObjectUploadSessionInput",
+          "possibleTypes": null
+        },
+        {
+          "description": null,
+          "enumValues": null,
+          "fields": [
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "objectId",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "ID",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "partSizeBytes",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Int",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "totalParts",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Int",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "expiresAt",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            }
+          ],
+          "inputFields": null,
+          "interfaces": [],
+          "kind": "OBJECT",
+          "name": "CreatedObjectUploadSession",
+          "possibleTypes": null
+        },
         {
           "description": "The `Float` scalar type represents signed double-precision fractional values as specified by [IEEE 754](https://en.wikipedia.org/wiki/IEEE_floating_point).",
           "enumValues": null,
@@ -240,6 +486,182 @@
           "description": null,
           "enumValues": null,
           "fields": [
+            {
+              "args": [
+                {
+                  "defaultValue": null,
+                  "description": null,
+                  "name": "input",
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "INPUT_OBJECT",
+                      "name": "CreateObjectUploadSessionInput",
+                      "ofType": null
+                    }
+                  }
+                }
+              ],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "createObjectUploadSession",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "OBJECT",
+                  "name": "CreatedObjectUploadSession",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [
+                {
+                  "defaultValue": null,
+                  "description": null,
+                  "name": "objectId",
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "SCALAR",
+                      "name": "ID",
+                      "ofType": null
+                    }
+                  }
+                },
+                {
+                  "defaultValue": null,
+                  "description": null,
+                  "name": "partNumbers",
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "LIST",
+                      "name": null,
+                      "ofType": {
+                        "kind": "NON_NULL",
+                        "name": null,
+                        "ofType": {
+                          "kind": "SCALAR",
+                          "name": "Int",
+                          "ofType": null
+                        }
+                      }
+                    }
+                  }
+                }
+              ],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "presignObjectUploadParts",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "LIST",
+                  "name": null,
+                  "ofType": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "OBJECT",
+                      "name": "PresignedObjectUploadPart",
+                      "ofType": null
+                    }
+                  }
+                }
+              }
+            },
+            {
+              "args": [
+                {
+                  "defaultValue": null,
+                  "description": null,
+                  "name": "objectId",
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "SCALAR",
+                      "name": "ID",
+                      "ofType": null
+                    }
+                  }
+                },
+                {
+                  "defaultValue": null,
+                  "description": null,
+                  "name": "parts",
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "LIST",
+                      "name": null,
+                      "ofType": {
+                        "kind": "NON_NULL",
+                        "name": null,
+                        "ofType": {
+                          "kind": "INPUT_OBJECT",
+                          "name": "CompletedObjectUploadPartInput",
+                          "ofType": null
+                        }
+                      }
+                    }
+                  }
+                }
+              ],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "completeObjectUpload",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "OBJECT",
+                  "name": "S3Object",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [
+                {
+                  "defaultValue": null,
+                  "description": null,
+                  "name": "objectId",
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "SCALAR",
+                      "name": "ID",
+                      "ofType": null
+                    }
+                  }
+                }
+              ],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "abortObjectUpload",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "OBJECT",
+                  "name": "AbortedObjectUpload",
+                  "ofType": null
+                }
+              }
+            },
             {
               "args": [
                 {
@@ -318,37 +740,6 @@
                 }
               }
             },
-            {
-              "args": [
-                {
-                  "defaultValue": null,
-                  "description": null,
-                  "name": "input",
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "INPUT_OBJECT",
-                      "name": "UpsertS3ObjectInput",
-                      "ofType": null
-                    }
-                  }
-                }
-              ],
-              "deprecationReason": null,
-              "description": null,
-              "isDeprecated": false,
-              "name": "upsertS3Object",
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "S3Object",
-                  "ofType": null
-                }
-              }
-            },
             {
               "args": [
                 {
@@ -696,6 +1087,164 @@
           "name": "Mutation",
           "possibleTypes": null
         },
+        {
+          "description": null,
+          "enumValues": null,
+          "fields": [
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "partNumber",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Int",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "url",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "method",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "headers",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "LIST",
+                  "name": null,
+                  "ofType": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "OBJECT",
+                      "name": "PresignedRequestHeader",
+                      "ofType": null
+                    }
+                  }
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "expectedContentLength",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Int",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "urlExpiresAt",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            }
+          ],
+          "inputFields": null,
+          "interfaces": [],
+          "kind": "OBJECT",
+          "name": "PresignedObjectUploadPart",
+          "possibleTypes": null
+        },
+        {
+          "description": null,
+          "enumValues": null,
+          "fields": [
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "name",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            },
+            {
+              "args": [],
+              "deprecationReason": null,
+              "description": null,
+              "isDeprecated": false,
+              "name": "value",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "String",
+                  "ofType": null
+                }
+              }
+            }
+          ],
+          "inputFields": null,
+          "interfaces": [],
+          "kind": "OBJECT",
+          "name": "PresignedRequestHeader",
+          "possibleTypes": null
+        },
         {
           "description": null,
           "enumValues": null,
@@ -1170,83 +1719,6 @@
           "name": "UpdateS3ObjectInput",
           "possibleTypes": null
         },
-        {
-          "description": null,
-          "enumValues": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "defaultValue": null,
-              "description": null,
-              "name": "name",
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              }
-            },
-            {
-              "defaultValue": null,
-              "description": null,
-              "name": "madeOn",
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              }
-            },
-            {
-              "defaultValue": null,
-              "description": null,
-              "name": "location",
-              "type": {
-                "kind": "INPUT_OBJECT",
-                "name": "LocationInput",
-                "ofType": null
-              }
-            },
-            {
-              "defaultValue": null,
-              "description": null,
-              "name": "publicity",
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "PublicityOverride",
-                  "ofType": null
-                }
-              }
-            },
-            {
-              "defaultValue": null,
-              "description": null,
-              "name": "allowedUsers",
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  }
-                }
-              }
-            }
-          ],
-          "interfaces": null,
-          "kind": "INPUT_OBJECT",
-          "name": "UpsertS3ObjectInput",
-          "possibleTypes": null
-        },
         {
           "description": null,
           "enumValues": null,
diff --git a/frontend/graphql/upsertS3Object.graphql b/frontend/graphql/upsertS3Object.graphql
deleted file mode 100644
index c66e1d3..0000000
--- a/frontend/graphql/upsertS3Object.graphql
+++ /dev/null
@@ -1,12 +0,0 @@
-mutation UpsertS3ObjectMutation($input: UpsertS3ObjectInput!) {
-	upsertS3Object(input: $input) {
-		name
-		madeOn
-		location {
-			latitude
-			longitude
-		}
-		publicity
-		allowedUsers
-	}
-}
diff --git a/frontend/package.json b/frontend/package.json
index 4ccd4f8..0951738 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,8 +1,14 @@
 {
+	"scripts": {
+		"e2e:typecheck": "tsc --noEmit --project tsconfig.json"
+	},
 	"devDependencies": {
-		"@unocss/cli": "66.5.4",
-		"@unocss/preset-wind4": "^66.5.4",
-		"unocss": "^66.5.4"
+		"@playwright/test": "1.59.1",
+		"@types/node": "^25.9.1",
+		"@unocss/cli": "66.7.0",
+		"@unocss/preset-wind4": "^66.7.0",
+		"typescript": "^6.0.3",
+		"unocss": "^66.7.0"
 	},
 	"dependencies": {
 		"leaflet": "^1.9.4"
diff --git a/frontend/playwright.config.ts b/frontend/playwright.config.ts
new file mode 100644
index 0000000..8a6ca69
--- /dev/null
+++ b/frontend/playwright.config.ts
@@ -0,0 +1,34 @@
+import {
+	defineConfig,
+	devices,
+} from "@playwright/test";
+
+const frontendUrl = process.env.E2E_FRONTEND_URL ?? "http://127.0.0.1:3000";
+
+export default defineConfig({
+	testDir: "./e2e",
+	timeout: 60_000,
+	expect: {
+		timeout: 10_000,
+	},
+	fullyParallel: false,
+	workers: 1,
+	reporter: [
+		["list"],
+		["html", { open: "never" }],
+	],
+	use: {
+		baseURL: frontendUrl,
+		trace: "retain-on-failure",
+		screenshot: "only-on-failure",
+		video: "retain-on-failure",
+		actionTimeout: 10_000,
+		navigationTimeout: 30_000,
+	},
+	projects: [
+		{
+			name: "chromium",
+			use: { ...devices["Desktop Chrome"] },
+		},
+	],
+});
diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml
index d0f2ba9..5973519 100644
--- a/frontend/pnpm-lock.yaml
+++ b/frontend/pnpm-lock.yaml
@@ -12,61 +12,38 @@ importers:
         specifier: ^1.9.4
         version: 1.9.4
     devDependencies:
+      '@playwright/test':
+        specifier: 1.59.1
+        version: 1.59.1
+      '@types/node':
+        specifier: ^25.9.1
+        version: 25.9.1
       '@unocss/cli':
-        specifier: 66.5.4
-        version: 66.5.4
+        specifier: 66.7.0
+        version: 66.7.0
       '@unocss/preset-wind4':
-        specifier: ^66.5.4
-        version: 66.5.4
+        specifier: ^66.7.0
+        version: 66.7.0
+      typescript:
+        specifier: ^6.0.3
+        version: 6.0.3
       unocss:
-        specifier: ^66.5.4
-        version: 66.5.4(postcss@8.5.6)(vite@7.1.12(jiti@2.6.1))
+        specifier: ^66.7.0
+        version: 66.7.0(vite@7.1.12(@types/node@25.9.1)(jiti@2.7.0))
 
 packages:
 
   '@antfu/install-pkg@1.1.0':
     resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
 
-  '@antfu/utils@9.3.0':
-    resolution: {integrity: sha512-9hFT4RauhcUzqOE4f1+frMKLZrgNog5b06I7VmZQV1BkvwvqrbC8EBZf3L1eEL2AKb6rNKjER0sEvJiSP1FXEA==}
-
-  '@babel/code-frame@7.27.1':
-    resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/generator@7.28.5':
-    resolution: {integrity: sha512-3EwLFhZ38J4VyIP6WNtt2kUdW9dokXA9Cr4IVIFHuCpZ3H8/YFOl5JjZHisrn1fATPBmKKqXzDFvh9fUwHz6CQ==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/helper-string-parser@7.27.1':
-    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/helper-validator-identifier@7.28.5':
-    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
-    engines: {node: '>=6.9.0'}
+  '@emnapi/core@1.10.0':
+    resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
 
-  '@babel/parser@7.27.7':
-    resolution: {integrity: sha512-qnzXzDXdr/po3bOTbTIQZ7+TxNKxpkN5IifVLXS+r7qwynkZfPyjZfE7hCXbo7IoO9TNcSyibgONsf2HauUd3Q==}
-    engines: {node: '>=6.0.0'}
-    hasBin: true
-
-  '@babel/parser@7.28.5':
-    resolution: {integrity: sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==}
-    engines: {node: '>=6.0.0'}
-    hasBin: true
+  '@emnapi/runtime@1.10.0':
+    resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
 
-  '@babel/template@7.27.2':
-    resolution: {integrity: sha512-LPDZ85aEJyYSd18/DkjNh4/y1ntkE5KwUHWTiqgRxruuZL2F1yuHligVHLvcHY2vMHXttKFpJn6LwfI7cw7ODw==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/traverse@7.27.7':
-    resolution: {integrity: sha512-X6ZlfR/O/s5EQ/SnUSLzr+6kGnkg8HXGMzpgsMsrJVcfDtH1vIp6ctCN4eZ1LS5c0+te5Cb6Y514fASjMRJ1nw==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/types@7.28.5':
-    resolution: {integrity: sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==}
-    engines: {node: '>=6.9.0'}
+  '@emnapi/wasi-threads@1.2.1':
+    resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
 
   '@esbuild/aix-ppc64@0.25.12':
     resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
@@ -227,8 +204,8 @@ packages:
   '@iconify/types@2.0.0':
     resolution: {integrity: sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==}
 
-  '@iconify/utils@3.0.2':
-    resolution: {integrity: sha512-EfJS0rLfVuRuJRn4psJHtK2A9TqVnkxPpHY6lYHiB9+8eSuudsxbwMiavocG45ujOo6FJ+CIRlRnlOGinzkaGQ==}
+  '@iconify/utils@3.1.3':
+    resolution: {integrity: sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw==}
 
   '@jridgewell/gen-mapping@0.3.13':
     resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
@@ -246,235 +223,381 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
+  '@napi-rs/wasm-runtime@1.1.4':
+    resolution: {integrity: sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==}
+    peerDependencies:
+      '@emnapi/core': ^1.7.1
+      '@emnapi/runtime': ^1.7.1
+
+  '@oxc-parser/binding-android-arm-eabi@0.131.0':
+    resolution: {integrity: sha512-t2xicr9pfzkSRYx5aPqZqlLaayIwJTqgQ81Jor31Xep2nGyL2Aq3d0K5wOfeR7VevaSdxaS9dzSQP9xDwn8fDg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [android]
+
+  '@oxc-parser/binding-android-arm64@0.131.0':
+    resolution: {integrity: sha512-nlGIod6gw75x1aEDgLS+srj+JRGY0HHm9MI9YgzE/B64l6d6+H3MSP9NOgp0+HTg8tp4vV9rVfgQGgd+TfVZcA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [android]
+
+  '@oxc-parser/binding-darwin-arm64@0.131.0':
+    resolution: {integrity: sha512-jukuV6xe5RbQKFo7QD34NDCLDZp4PSOm8rmckhNdH/60ymG5zXbDzGBEyc+nTkuLQNama2aSGCt+CPfpjNTqyw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@oxc-parser/binding-darwin-x64@0.131.0':
+    resolution: {integrity: sha512-g3JOo4khe9rslHm5WYaVDWb0HS/M1MLR3I9S8560MkKIcC96VQY00QjOlsuRyfSj/JDXj8i9T7ryPO2RidiXVg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@oxc-parser/binding-freebsd-x64@0.131.0':
+    resolution: {integrity: sha512-1hziITDTxjMePnX+dR9ocVT+EuZkQ8wm4FPAbmbEiKG+Phbo73J1ZnPAA6Y/aGsWF3McOFnQuZIktAFwalkfJQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.131.0':
+    resolution: {integrity: sha512-9uRxfXwyKG9+MwmGQBo2ncPNwZH5HTmCETFM2WiuDBNDCW4NC5ttSQkwCAMrTAWgwMzVBH1CP8pM0v7nebCWXQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-arm-musleabihf@0.131.0':
+    resolution: {integrity: sha512-mgbLvzRShXOLBdWGInf08Af4q+pfj1xD8hSgLClDZ9of/BXkB6+LIhTH7fihiDUipqB3yoSkKBWaZ3Ejlf5Yag==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@oxc-parser/binding-linux-arm64-gnu@0.131.0':
+    resolution: {integrity: sha512-OPT8++4aN6j2GJ8+3IZHS/byXoZP4aSBn+FoG6rgBJ2fKwPKXWF3MqrFMNW7NKHM28FLY579xYLxJSfgobEqPA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@oxc-parser/binding-linux-arm64-musl@0.131.0':
+    resolution: {integrity: sha512-vtPiwmfVTAXzaxDKsOXG+LwgRAA7WEnaeHzhS5z0GE89gAK18KSXnly7Z6saXXq6L3dVMyK44uoTI03zKxrpmw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@oxc-parser/binding-linux-ppc64-gnu@0.131.0':
+    resolution: {integrity: sha512-8AW8L7w5cGHSdZPcyZX2yR0+GUODsT15rbRjfdD54rv6DMbtuEB19ysLOpKJlRGfH6UNYNpCHaU1uJWgTWf1/w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@oxc-parser/binding-linux-riscv64-gnu@0.131.0':
+    resolution: {integrity: sha512-vvpjkjEOUsPcsYf8evE4MO3aGx9+3wodXEBOicGNnOwTuAik8eBONNkgSdhkGsAblQmfVHJyanRnpxglddTXIA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@oxc-parser/binding-linux-riscv64-musl@0.131.0':
+    resolution: {integrity: sha512-AqmcNC3fClXX+fxQ6VGEN1667xVFiRBkY0CZmDMSiaeFUsv1+UkBPYYi48IUKcA9/ivvoKNRzQl2I4//kT9F/w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
+  '@oxc-parser/binding-linux-s390x-gnu@0.131.0':
+    resolution: {integrity: sha512-7d3jOMKy7RSQCcDLIci+ySll2FgsOMl/GiRux4q2JNv0zg4EdhFISa9idvrdN/HEUIQQJNg6dmveUeJl2YErGA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@oxc-parser/binding-linux-x64-gnu@0.131.0':
+    resolution: {integrity: sha512-JHK/h95qVqVQ+ITER837kcTdwBDFpFaNnOTYGCP0zdUSX/mLKC7tXOoyrTb6vG7iRPwGlcgBil3v2IjYw1FqJA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@oxc-parser/binding-linux-x64-musl@0.131.0':
+    resolution: {integrity: sha512-b2BO82O8azXAyf7EUgOPKu145nWypbNyk07HbU09fkzhm9lEA5oPvaN/M8Nlo7tOErVTa2WOgS4QbOnxAPXdDQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@oxc-parser/binding-openharmony-arm64@0.131.0':
+    resolution: {integrity: sha512-GHO9glZaX7LkX/OGfluEPf1yjg+ehiFbUdowbX6uNWOQhmwKWU4m4+nZ9FJkrHNKuxyI1KKertMdGjVKCApKWA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@oxc-parser/binding-wasm32-wasi@0.131.0':
+    resolution: {integrity: sha512-3SkikPaEFoih1N83qLVEDLRLeY4nYsf6JT9SnWiMCQ5lGQdKup6bEuKCqkRiG9dD1IIaFeYz9RjlciPmYoFIWA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [wasm32]
+
+  '@oxc-parser/binding-win32-arm64-msvc@0.131.0':
+    resolution: {integrity: sha512-Os5bEhryeA2jkH+ZrnZyAC1EP5gs+X4YB1Fjqml7UPD5kU7ecsK1MPEVMfCrdt/GDNpDbavYXiOXOdyJ5b3OPw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@oxc-parser/binding-win32-ia32-msvc@0.131.0':
+    resolution: {integrity: sha512-m+jNz9EuF0NXoiptc6B9h5yompZQVW/a5MJeOu5zojfH5yWk82tvF2ccrHkfhgtrS9h9DD5l1Qv8dWlfY7Nz8g==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@oxc-parser/binding-win32-x64-msvc@0.131.0':
+    resolution: {integrity: sha512-o14Hk8dAyiEUMFEWEgmAwFZvBt1RzAYLM3xeQ+5315JXgVYhoemivgYcbYVRbsFkS71ShMGlAFE0kPnr460rww==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [win32]
+
+  '@oxc-project/types@0.131.0':
+    resolution: {integrity: sha512-PgnWDfV0h+b16XNKbXU7Daib/BFSt/J2mEzfYIBu6JB/wNdlU+kVYXCkGA1A9fWkTbOgbjh4e6NhPeQOYvFhEA==}
+
+  '@playwright/test@1.59.1':
+    resolution: {integrity: sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
   '@polka/url@1.0.0-next.29':
     resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
 
-  '@quansync/fs@0.1.5':
-    resolution: {integrity: sha512-lNS9hL2aS2NZgNW7BBj+6EBl4rOf8l+tQ0eRY6JWCI8jI2kc53gSoqbjojU0OnAWhzoXiOjFyGsHcDGePB3lhA==}
+  '@quansync/fs@1.0.0':
+    resolution: {integrity: sha512-4TJ3DFtlf1L5LDMaM6CanJ/0lckGNtJcMjQ1NAV6zDmA0tEHKZtxNKin8EgPaVX1YzljbxckyT2tJrpQKAtngQ==}
 
-  '@rollup/rollup-android-arm-eabi@4.52.5':
-    resolution: {integrity: sha512-8c1vW4ocv3UOMp9K+gToY5zL2XiiVw3k7f1ksf4yO1FlDFQ1C2u72iACFnSOceJFsWskc2WZNqeRhFRPzv+wtQ==}
+  '@rollup/rollup-android-arm-eabi@4.60.4':
+    resolution: {integrity: sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.52.5':
-    resolution: {integrity: sha512-mQGfsIEFcu21mvqkEKKu2dYmtuSZOBMmAl5CFlPGLY94Vlcm+zWApK7F/eocsNzp8tKmbeBP8yXyAbx0XHsFNA==}
+  '@rollup/rollup-android-arm64@4.60.4':
+    resolution: {integrity: sha512-GxxTKApUpzRhof7poWvCJHRF51C67u1R7D6DiluBE8wKU1u5GWE8t+v81JvJYtbawoBFX1hLv5Ei4eVjkWokaw==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.52.5':
-    resolution: {integrity: sha512-takF3CR71mCAGA+v794QUZ0b6ZSrgJkArC+gUiG6LB6TQty9T0Mqh3m2ImRBOxS2IeYBo4lKWIieSvnEk2OQWA==}
+  '@rollup/rollup-darwin-arm64@4.60.4':
+    resolution: {integrity: sha512-tua0TaJxMOB1R0V0RS1jFZ/RpURFDJIOR2A6jWwQeawuFyS4gBW+rntLRaQd0EQ4bd6Vp44Z2rXW+YYDBsj6IA==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.52.5':
-    resolution: {integrity: sha512-W901Pla8Ya95WpxDn//VF9K9u2JbocwV/v75TE0YIHNTbhqUTv9w4VuQ9MaWlNOkkEfFwkdNhXgcLqPSmHy0fA==}
+  '@rollup/rollup-darwin-x64@4.60.4':
+    resolution: {integrity: sha512-CSKq7MsP+5PFIcydhAiR1K0UhEI1A2jWXVKHPCBZ151yOutENwvnPocgVHkivu2kviURtCEB6zUQw0vs8RrhMg==}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-freebsd-arm64@4.52.5':
-    resolution: {integrity: sha512-QofO7i7JycsYOWxe0GFqhLmF6l1TqBswJMvICnRUjqCx8b47MTo46W8AoeQwiokAx3zVryVnxtBMcGcnX12LvA==}
+  '@rollup/rollup-freebsd-arm64@4.60.4':
+    resolution: {integrity: sha512-+O8OkVdyvXMtJEciu2wS/pzm1IxntEEQx3z5TAVy4l32G0etZn+RsA48ARRrFm6Ri8fvqPQfgrvNxSjKAbnd3g==}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.52.5':
-    resolution: {integrity: sha512-jr21b/99ew8ujZubPo9skbrItHEIE50WdV86cdSoRkKtmWa+DDr6fu2c/xyRT0F/WazZpam6kk7IHBerSL7LDQ==}
+  '@rollup/rollup-freebsd-x64@4.60.4':
+    resolution: {integrity: sha512-Iw3oMskH3AfNuhU0MSN7vNbdi4me/NiYo2azqPz/Le16zHSa+3RRmliCMWWQmh4lcndccU40xcJuTYJZxNo/lw==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.5':
-    resolution: {integrity: sha512-PsNAbcyv9CcecAUagQefwX8fQn9LQ4nZkpDboBOttmyffnInRy8R8dSg6hxxl2Re5QhHBf6FYIDhIj5v982ATQ==}
+  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
+    resolution: {integrity: sha512-EIPRXTVQpHyF8WOo219AD2yEltPehLTcTMz2fn6JsatLYSzQf00hj3rulF+yauOlF9/FtM2WpkT/hJh/KJFGhA==}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.5':
-    resolution: {integrity: sha512-Fw4tysRutyQc/wwkmcyoqFtJhh0u31K+Q6jYjeicsGJJ7bbEq8LwPWV/w0cnzOqR2m694/Af6hpFayLJZkG2VQ==}
+  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
+    resolution: {integrity: sha512-J3Yh9PzzF1Ovah2At+lHiGQdsYgArxBbXv/zHfSyaiFQEqvNv7DcW98pCrmdjCZBrqBiKrKKe2V+aaSGWuBe/w==}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.5':
-    resolution: {integrity: sha512-a+3wVnAYdQClOTlyapKmyI6BLPAFYs0JM8HRpgYZQO02rMR09ZcV9LbQB+NL6sljzG38869YqThrRnfPMCDtZg==}
+  '@rollup/rollup-linux-arm64-gnu@4.60.4':
+    resolution: {integrity: sha512-BFDEZMYfUvLn37ONE1yMBojPxnMlTFsdyNoqncT0qFq1mAfllL+ATMMJd8TeuVMiX84s1KbcxcZbXInmcO2mRg==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
-  '@rollup/rollup-linux-arm64-musl@4.52.5':
-    resolution: {integrity: sha512-AvttBOMwO9Pcuuf7m9PkC1PUIKsfaAJ4AYhy944qeTJgQOqJYJ9oVl2nYgY7Rk0mkbsuOpCAYSs6wLYB2Xiw0Q==}
+  '@rollup/rollup-linux-arm64-musl@4.60.4':
+    resolution: {integrity: sha512-pc9EYOSlOgdQ2uPl1o9PF6/kLSgaUosia7gOuS8mB69IxJvlclko1MECXysjs5ryez1/5zjYqx3+xYU0TU6R1A==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-loong64-gnu@4.60.4':
+    resolution: {integrity: sha512-NxnomyxYerDh5n4iLrNa+sH+Z+U4BMEE46V2PgQ/hoB909i8gV1M5wPojWg9fk1jWpO3IQnOs20K4wyZuFLEFQ==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.5':
-    resolution: {integrity: sha512-DkDk8pmXQV2wVrF6oq5tONK6UHLz/XcEVow4JTTerdeV1uqPeHxwcg7aFsfnSm9L+OO8WJsWotKM2JJPMWrQtA==}
+  '@rollup/rollup-linux-loong64-musl@4.60.4':
+    resolution: {integrity: sha512-nbJnQ8a3z1mtmrwImCYhc6BGpThAyYVRQxw9uKSKG4wR6aAYno9sVjJ0zaZcW9BPJX1GbrDPf+SvdWjgTuDmnw==}
     cpu: [loong64]
     os: [linux]
+    libc: [musl]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.5':
-    resolution: {integrity: sha512-W/b9ZN/U9+hPQVvlGwjzi+Wy4xdoH2I8EjaCkMvzpI7wJUs8sWJ03Rq96jRnHkSrcHTpQe8h5Tg3ZzUPGauvAw==}
+  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
+    resolution: {integrity: sha512-2EU6acNrQLd8tYvo/LXW535wupT3m6fo7HKo6lr7ktQoItxTyOL1ZCR/GfGCuXl2vR+zmfI6eRXkSemafv+iVg==}
     cpu: [ppc64]
     os: [linux]
+    libc: [glibc]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.5':
-    resolution: {integrity: sha512-sjQLr9BW7R/ZiXnQiWPkErNfLMkkWIoCz7YMn27HldKsADEKa5WYdobaa1hmN6slu9oWQbB6/jFpJ+P2IkVrmw==}
+  '@rollup/rollup-linux-ppc64-musl@4.60.4':
+    resolution: {integrity: sha512-WeBtoMuaMxiiIrO2IYP3xs6GMWkJP2C0EoT8beTLkUPmzV1i/UcOSVw1d5r9KBODtHKilG5yFxsGRnBbK3wJ4A==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
+    resolution: {integrity: sha512-FJHFfqpKUI3A10WrWKiFbBZ7yVbGT4q4B5o1qKFFojqpaYoh9LrQgqWCmmcxQzVSXYtyB5bzkXrYzlHTs21MYA==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.5':
-    resolution: {integrity: sha512-hq3jU/kGyjXWTvAh2awn8oHroCbrPm8JqM7RUpKjalIRWWXE01CQOf/tUNWNHjmbMHg/hmNCwc/Pz3k1T/j/Lg==}
+  '@rollup/rollup-linux-riscv64-musl@4.60.4':
+    resolution: {integrity: sha512-mcEl6CUT5IAUmQf1m9FYSmVqCJlpQ8r8eyftFUHG8i9OhY7BkBXSUdnLH5DOf0wCOjcP9v/QO93zpmF1SptCCw==}
     cpu: [riscv64]
     os: [linux]
+    libc: [musl]
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.5':
-    resolution: {integrity: sha512-gn8kHOrku8D4NGHMK1Y7NA7INQTRdVOntt1OCYypZPRt6skGbddska44K8iocdpxHTMMNui5oH4elPH4QOLrFQ==}
+  '@rollup/rollup-linux-s390x-gnu@4.60.4':
+    resolution: {integrity: sha512-ynt3JxVd2w2buzoKDWIyiV1pJW93xlQic1THVLXilz429oijRpSHivZAgp65KBu+cMcgf1eVVjdnTLvPxgCuoQ==}
     cpu: [s390x]
     os: [linux]
+    libc: [glibc]
 
-  '@rollup/rollup-linux-x64-gnu@4.52.5':
-    resolution: {integrity: sha512-hXGLYpdhiNElzN770+H2nlx+jRog8TyynpTVzdlc6bndktjKWyZyiCsuDAlpd+j+W+WNqfcyAWz9HxxIGfZm1Q==}
+  '@rollup/rollup-linux-x64-gnu@4.60.4':
+    resolution: {integrity: sha512-Boiz5+MsaROEWDf+GGEwF8VMHGhlUoQMtIPjOgA5fv4osupqTVnJteQNKJwUcnUog2G55jYXH7KZFFiJe0TEzQ==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
-  '@rollup/rollup-linux-x64-musl@4.52.5':
-    resolution: {integrity: sha512-arCGIcuNKjBoKAXD+y7XomR9gY6Mw7HnFBv5Rw7wQRvwYLR7gBAgV7Mb2QTyjXfTveBNFAtPt46/36vV9STLNg==}
+  '@rollup/rollup-linux-x64-musl@4.60.4':
+    resolution: {integrity: sha512-+qfSY27qIrFfI/Hom04KYFw3GKZSGU4lXus51wsb5EuySfFlWRwjkKWoE9emgRw/ukoT4Udsj4W/+xxG8VbPKg==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
-  '@rollup/rollup-openharmony-arm64@4.52.5':
-    resolution: {integrity: sha512-QoFqB6+/9Rly/RiPjaomPLmR/13cgkIGfA40LHly9zcH1S0bN2HVFYk3a1eAyHQyjs3ZJYlXvIGtcCs5tko9Cw==}
+  '@rollup/rollup-openbsd-x64@4.60.4':
+    resolution: {integrity: sha512-VpTfOPHgVXEBeeR8hZ2O0F3aSso+JDWqTWmTmzcQKted54IAdUVbxE+j/MVxUsKa8L20HJhv3vUezVPoquqWjA==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.60.4':
+    resolution: {integrity: sha512-IPOsh5aRYuLv/nkU51X10Bf75Bsf6+gZdx1X+QP5QM6lIJFHHqbHLG0uJn/hWthzo13UAc2umiUorqZy3axoZg==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.52.5':
-    resolution: {integrity: sha512-w0cDWVR6MlTstla1cIfOGyl8+qb93FlAVutcor14Gf5Md5ap5ySfQ7R9S/NjNaMLSFdUnKGEasmVnu3lCMqB7w==}
+  '@rollup/rollup-win32-arm64-msvc@4.60.4':
+    resolution: {integrity: sha512-4QzE9E81OohJ/HKzHhsqU+zcYYojVOXlFMs1DdyMT6qXl/niOH7AVElmmEdUNHHS/oRkc++d5k6Vy85zFs0DEw==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.5':
-    resolution: {integrity: sha512-Aufdpzp7DpOTULJCuvzqcItSGDH73pF3ko/f+ckJhxQyHtp67rHw3HMNxoIdDMUITJESNE6a8uh4Lo4SLouOUg==}
+  '@rollup/rollup-win32-ia32-msvc@4.60.4':
+    resolution: {integrity: sha512-zTPgT1YuHHcd+Tmx7h8aml0FWFVelV5N54oHow9SLj+GfoDy/huQ+UV396N/C7KpMDMiPspRktzM1/0r1usYEA==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-gnu@4.52.5':
-    resolution: {integrity: sha512-UGBUGPFp1vkj6p8wCRraqNhqwX/4kNQPS57BCFc8wYh0g94iVIW33wJtQAx3G7vrjjNtRaxiMUylM0ktp/TRSQ==}
+  '@rollup/rollup-win32-x64-gnu@4.60.4':
+    resolution: {integrity: sha512-DRS4G7mi9lJxqEDezIkKCaUIKCrLUUDCUaCsTPCi/rtqaC6D/jjwslMQyiDU50Ka0JKpeXeRBFBAXwArY52vBw==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.52.5':
-    resolution: {integrity: sha512-TAcgQh2sSkykPRWLrdyy2AiceMckNf5loITqXxFI5VuQjS5tSuw3WlwdN8qv8vzjLAUTvYaH/mVjSFpbkFbpTg==}
+  '@rollup/rollup-win32-x64-msvc@4.60.4':
+    resolution: {integrity: sha512-QVTUovf40zgTqlFVrKA1uXMVvU2QWEFWfAH8Wdc48IxLvrJMQVMBRjuQyUpzZCDkakImib9eVazbWlC6ksWtJw==}
     cpu: [x64]
     os: [win32]
 
+  '@tybys/wasm-util@0.10.2':
+    resolution: {integrity: sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==}
+
   '@types/estree@1.0.8':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
-  '@unocss/astro@66.5.4':
-    resolution: {integrity: sha512-6KsilC1SiTBmEJRMuPl+Mg8KDWB1+DaVoirGZR7BAEtMf2NzrfQcR4+O/3DHtzb38pfb0K1aHCfWwCozHxLlfA==}
-    peerDependencies:
-      vite: ^2.9.0 || ^3.0.0-0 || ^4.0.0 || ^5.0.0-0 || ^6.0.0-0 || ^7.0.0-0
-    peerDependenciesMeta:
-      vite:
-        optional: true
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
-  '@unocss/cli@66.5.4':
-    resolution: {integrity: sha512-GltHfmJ27O5VHB/ABkkUWwWT72xGBVwFyhTnhIOut4EPkIurKDnfY5MZFEl2PLlIFnYqIJxeTHMHONVg7pySMg==}
-    engines: {node: '>=14'}
-    hasBin: true
-
-  '@unocss/config@66.5.4':
-    resolution: {integrity: sha512-TYwkUw9nZlLTBGCndsyrcHCJ7M+sEsJiK77Edggmd6B3urjkVc1cDjKF3k3tjg4ghQteGsc2akhzn1a4TouybQ==}
-    engines: {node: '>=14'}
+  '@types/node@25.9.1':
+    resolution: {integrity: sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==}
 
-  '@unocss/core@66.5.4':
-    resolution: {integrity: sha512-UDS2CRgyQCEFH+5kStDyJd7OFtgkIUZYn5Ahr5z7v3jc/pEfeOJ0mxsNAr+FgMS/xb17vy4sVFvx3jj/FwMZ1A==}
+  '@unocss/cli@66.7.0':
+    resolution: {integrity: sha512-Pkd/R+WDs8gc1i9fI5XDW8N5r7aoCWjNzt8wGGj5FWTbmsEzewueaL5LQTH4ymv/BhSHFcYpL7geQ5vYont+BA==}
+    hasBin: true
 
-  '@unocss/extractor-arbitrary-variants@66.5.4':
-    resolution: {integrity: sha512-JsgITF11Z2WdXzF8eO2/qkcFIff/dEEc9C2eKYOSUv5pe+RMZxXHoAw4x+D4n0UrGAbHpoUVaJ8E7kG0ayTbGw==}
+  '@unocss/config@66.7.0':
+    resolution: {integrity: sha512-C6waL+xzqAPzz5n47qnrs4GbyAtlusNYYmcV6DKYh1MgUP4EFhMnEMyuR2mw3M3tsBpyGuehLdRK5+ECF5yLkA==}
 
-  '@unocss/inspector@66.5.4':
-    resolution: {integrity: sha512-eBf1HAxwNz1YItNiiP/YQaIE9LWeErt4Ofdm7Imj0WW464ZZ/TqXhu0ZREcCgyQDy2Lghuyq6Q3d9orm2Cby/w==}
+  '@unocss/core@66.7.0':
+    resolution: {integrity: sha512-j6MFMx5C3iIwW4T4hVbh+30fKWgSGkmS3bCcdjlfqM88lRT+dHFBN9nkfNOBJT6e6IHN9415nexuzcQvTjJXxw==}
 
-  '@unocss/postcss@66.5.4':
-    resolution: {integrity: sha512-EpizX20MR8wTWlCI9+E6pI8Xj5S1kk2jRVQuQAxjjXcOEFoLZNTZmyULSlaIpg9vEtT5kuxQgBN6VmvyMgeD7g==}
-    engines: {node: '>=14'}
-    peerDependencies:
-      postcss: ^8.4.21
+  '@unocss/extractor-arbitrary-variants@66.7.0':
+    resolution: {integrity: sha512-iHMlXmb8aGtYgPQ8o3D4rMz9DKOqSp8g/LWvEoiM7arSjJF9jMpcpYlqZXzkg1mSQX23TRW76Qxj1gyI4lRd9w==}
 
-  '@unocss/preset-attributify@66.5.4':
-    resolution: {integrity: sha512-6NmRUKpXp4qc+ZwWI+ImBIUzcdPRKWISfYu65hi8Sads453jzLJko78WOCVTLlgnmkquUJ98akNW5twG9p2mDw==}
+  '@unocss/inspector@66.7.0':
+    resolution: {integrity: sha512-W1MOO2d/1ZHwFR8+mrUUW6KW3MgJ6FdrSWfWeQ1+fgb0TVj8CweNzeSh46sTEXEcpvlui5mnGYFxanpLMoyOtA==}
 
-  '@unocss/preset-icons@66.5.4':
-    resolution: {integrity: sha512-wPR2j191mw89hstQflQvsACzu+3QkueV9lHH8as94By9PKfswWnVZ1nPqJBc3Yl5v8fHEAR1YY4i7egN7TEjIA==}
+  '@unocss/preset-attributify@66.7.0':
+    resolution: {integrity: sha512-n8ikthHHkAOeHWUwqRNIMGijV6LuIhiZb3D6kreV3oK98wJYupGNGYMByx7R9gQD9uBNLGs0f1jsaAScV3S2Sw==}
 
-  '@unocss/preset-mini@66.5.4':
-    resolution: {integrity: sha512-KaBGsw3+Pi5ZTsp5u0OrUUUXFVltHin02cYhv3A4b9392Kej5R3y7zIf1VjiQ3ZXR4KZWfv0CQj0LBqIqAJ5WA==}
+  '@unocss/preset-icons@66.7.0':
+    resolution: {integrity: sha512-y6I2qZ2cwNAS2XRBig1lHzdFG9qTnZM/mx3fL3XnURnEYZird4uidLyWOyUGcdy1kMot1QcYVb0D/s9NgrEOgQ==}
 
-  '@unocss/preset-tagify@66.5.4':
-    resolution: {integrity: sha512-ck71rFCQZEwYDzwf99sjCBuzpT0PnkzwdqWwnR34pN71Lf3ePN16hV6pEo7pWuIiatAGFzXh0AHzJrIQ/61Cxw==}
+  '@unocss/preset-mini@66.7.0':
+    resolution: {integrity: sha512-+YtRlr1Fjd24GYWhPB93r6fjefTBCnFUsZCASncSEU29u2Mi8MYINjefLfKlSJFMKg6AKzWbelKMCQfoKlUkbg==}
 
-  '@unocss/preset-typography@66.5.4':
-    resolution: {integrity: sha512-RG0Bw4lGvwAJxHw8I/0Hx2/r4t8L6fnkWyEP4Iehie3kEGJ+S7Ku9sF6kkIeyOqjwL6Hp68rlnTGAycnYofoEg==}
+  '@unocss/preset-tagify@66.7.0':
+    resolution: {integrity: sha512-MaM07ChHsX8XZM3tlMPuRsZxbNvRVTbmIncOj9cCCrFpeOu8hy2ggRAgGOalWIwnIHc+5KQIkqucbgmXN7KBdA==}
 
-  '@unocss/preset-uno@66.5.4':
-    resolution: {integrity: sha512-CEBtkNbbd1lYbCJw+s7HDeOtPeCEkvf+NDi/IrVkkBhOCcYRtYC+VDxjBgh4zjlmgZIQifkU2l7PPfGjd4IMNA==}
+  '@unocss/preset-typography@66.7.0':
+    resolution: {integrity: sha512-Ekdz7jw/TYTiH+QFqMWcWNMnvBnUZ/XPUF938C8DfqD79hZyLdRPo0kQaZh62cit13xNRAb49QP3HIUJIUxoGA==}
 
-  '@unocss/preset-web-fonts@66.5.4':
-    resolution: {integrity: sha512-FQ/P/a1fSmGkkjWn/FNmErwK5YtsuX2VrkHsEa9DTP372td8Oea3hkK40UUYj3zRUivA71PmjVwhbBf+35nAiA==}
+  '@unocss/preset-uno@66.7.0':
+    resolution: {integrity: sha512-fcLTj5Wax3QydCSdJq9yQHhqKph6Mx9exwNnkaBCXtmBvrSBd2O6O9ZAylcISnACeXJkjSverU8qVu1X2tITdA==}
 
-  '@unocss/preset-wind3@66.5.4':
-    resolution: {integrity: sha512-cqQGg9E2476YVpnX3sgO/jEoA4cKCA5rEl2NgemoAJpKAgdM68JPB+Tve4LlSLssxRQZ7ZYNO6hOfW8R2gVVuw==}
+  '@unocss/preset-web-fonts@66.7.0':
+    resolution: {integrity: sha512-jpNLjo/2X/J2J+G/M9W+y6VuiIhjZ9AyOnyNJHsdhmSJYCsnMuaYtP9eFn4d9+oe3Sz2lVNPV0A9RiqQ+xVAyQ==}
 
-  '@unocss/preset-wind4@66.5.4':
-    resolution: {integrity: sha512-S5ZysCSTfl/h93jDnXIss214jqYfq+W6xZH50Krc1QTWy5teAOVCFTluRJEB70JTDOdUMwcTtmqFklSHIU5I7g==}
+  '@unocss/preset-wind3@66.7.0':
+    resolution: {integrity: sha512-1xxHBV4TtUHXPpYnWH8J2UHhxaMF84fTvadVzRRaXkyVrXD86Hveh/lfbXHXnCyf0JxwqsleOq8CnCTT8AgoAg==}
 
-  '@unocss/preset-wind@66.5.4':
-    resolution: {integrity: sha512-2TWP2QrJwGFr21iwVsPKVzDa2JWjh1EUt1+OtAk5JQfGmmTeyw8EF3pIAcaM06WVi/m4em55RKIPNoW/Kr61yg==}
+  '@unocss/preset-wind4@66.7.0':
+    resolution: {integrity: sha512-5o3y2BcImLbkxa0fNtwaH8iB47FrOKzT7Xogni5PIDOX/DsoHfDLNiNBRrHHHHBeZ3jqvjv2T9T5kEkD5/WtYQ==}
 
-  '@unocss/reset@66.5.4':
-    resolution: {integrity: sha512-RF/Xscv4mOEDUltUpdKYZEBgIiE7nAVkipJ8gZWEwKfmUFz0TRcwlf0igjqjgGn11tuix0mJyk5Uwis9LioX4Q==}
+  '@unocss/preset-wind@66.7.0':
+    resolution: {integrity: sha512-K2cCgQawl4GzFyI9almN4jZ33OJNI6U7WxZ9s7D5bivZYfHPaStLTPffNxWlmawwUZF0qpH0S+S7H745ZzgajQ==}
 
-  '@unocss/rule-utils@66.5.4':
-    resolution: {integrity: sha512-LFzLuXQfZKI/qJBrsqkaVKlw0ECU8Xw7m+MaKIKyFH/hqggzkvNG0PyWU2HnPNzz1dIiVBn+Epfpz8pzi+MLFA==}
-    engines: {node: '>=14'}
+  '@unocss/rule-utils@66.7.0':
+    resolution: {integrity: sha512-DMJIiey/m+xr0hpSbxFhSbKlC3e7QsuwdAEdgMmIM7pEcu/AEMl7oH198QYX9880P2X0hy5iFE6UCWx9CwGAXQ==}
 
-  '@unocss/transformer-attributify-jsx@66.5.4':
-    resolution: {integrity: sha512-VHzrxiWKBVsUZhFU0vG7e6MjSiQG/rR/PidPgi8KaMGAWi+CA6faRBfHaUQbfix2bLBhtDOdaZUDp9AsIgu1ZQ==}
+  '@unocss/transformer-attributify-jsx@66.7.0':
+    resolution: {integrity: sha512-mmsAUluRprSyejbzeQnC3ST056EUj2IxD2hMpPJPtnA4QkkyIgBNCmi2OSeVcEWMat1s3r4LcYSTqN88EcX5Kg==}
 
-  '@unocss/transformer-compile-class@66.5.4':
-    resolution: {integrity: sha512-H+IX9C8PHFMCJfYutIRjzkpgIiW/AFC7PzP/EQwM+p9VoC8LH+Wd8Csl/Uyi+uoQ+a78q4nQ2lDYZr42eanmgg==}
+  '@unocss/transformer-compile-class@66.7.0':
+    resolution: {integrity: sha512-Z3K/s3TmUqUBGgB2SThWbUAP5E9VIFacbs2+bNJNn+53y1kqdLA1MIje3xlU5hig3OzGk8newwiMflh3s3Jzhg==}
 
-  '@unocss/transformer-directives@66.5.4':
-    resolution: {integrity: sha512-BqM4fRqCC5wIRkEB14SN476/KWKlEhHhrHECL9kOjbZYmIcxBDCYKf/iuZGvtK9IZJtE0JhrSGAdYfyp0Td7fQ==}
+  '@unocss/transformer-directives@66.7.0':
+    resolution: {integrity: sha512-6T9JxrPfLQlJFNLv7paG4yGiIgGrJY30268HWLkBFwgsldNPtQ+GeQJOzfemCH19UXXqqXMP0WnvbsFucdclmg==}
 
-  '@unocss/transformer-variant-group@66.5.4':
-    resolution: {integrity: sha512-n/A74083b8zZtl05A3M0Lo9oWepFKuvRZKPXh+y4bJM2oSZl1Clzm1I+qmgvO/DKoa4rjgj4a/CRaIxeDpoO9A==}
+  '@unocss/transformer-variant-group@66.7.0':
+    resolution: {integrity: sha512-2TXYLowPMXszGNYRXAWzQ1G9nGP6EYv9XeJvwNvnf0w9J6qOQVVtW/ZViIz61Kk083c06cZ6nai8pCBnc8aPAw==}
 
-  '@unocss/vite@66.5.4':
-    resolution: {integrity: sha512-dmSJ3h7/kMbFOIrAyycg2W1VVN+59WCnH5s0dJTGRla2kUTAFB0iWJWdIa/W6IsvFlicMtsoLYJmTnQ/kBQm7A==}
+  '@unocss/vite@66.7.0':
+    resolution: {integrity: sha512-7J8Mk9M1j55S3bXL87/yHOspnuAaftQWbc3HjCH0/sXNLZJZnlpmUue3EtT5Ez+PE01T3DK1D9Xxn/MvtdvXtA==}
     peerDependencies:
-      vite: ^2.9.0 || ^3.0.0-0 || ^4.0.0 || ^5.0.0-0 || ^6.0.0-0 || ^7.0.0-0
+      vite: ^5.0.0-0 || ^6.0.0-0 || ^7.0.0-0 || ^8.0.0-0
 
-  acorn@8.15.0:
-    resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==}
+  acorn@8.16.0:
+    resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
     engines: {node: '>=0.4.0'}
     hasBin: true
 
-  anymatch@3.1.3:
-    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
-    engines: {node: '>= 8'}
-
-  binary-extensions@2.3.0:
-    resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
-    engines: {node: '>=8'}
-
-  braces@3.0.3:
-    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
-    engines: {node: '>=8'}
-
-  cac@6.7.14:
-    resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
-    engines: {node: '>=8'}
+  cac@7.0.0:
+    resolution: {integrity: sha512-tixWYgm5ZoOD+3g6UTea91eow5z6AAHaho3g0V9CNSNb45gM8SmflpAc+GRd1InC4AqN/07Unrgp56Y94N9hJQ==}
+    engines: {node: '>=20.19.0'}
 
-  chokidar@3.6.0:
-    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
-    engines: {node: '>= 8.10.0'}
+  chokidar@5.0.0:
+    resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
+    engines: {node: '>= 20.19.0'}
 
   colorette@2.0.20:
     resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==}
@@ -482,28 +605,16 @@ packages:
   confbox@0.1.8:
     resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
 
-  confbox@0.2.2:
-    resolution: {integrity: sha512-1NB+BKqhtNipMsov4xI/NnhCKp9XG9NamYp5PVm9klAT0fsrNPjaFICsCFhNhwZJKNh7zB/3q8qXz0E9oaMNtQ==}
-
   consola@3.4.2:
     resolution: {integrity: sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==}
     engines: {node: ^14.18.0 || >=16.10.0}
 
-  css-tree@3.1.0:
-    resolution: {integrity: sha512-0eW44TGN5SQXU1mWSkKwFstI/22X2bG1nYzZTYMAWjylYURhse752YgbE4Cx46AC+bAvI+/dYTPRk1LqSUnu6w==}
+  css-tree@3.2.1:
+    resolution: {integrity: sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==}
     engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0}
 
-  debug@4.4.3:
-    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
-    engines: {node: '>=6.0'}
-    peerDependencies:
-      supports-color: '*'
-    peerDependenciesMeta:
-      supports-color:
-        optional: true
-
-  defu@6.1.4:
-    resolution: {integrity: sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==}
+  defu@6.1.7:
+    resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
 
   destr@2.0.5:
     resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
@@ -516,8 +627,8 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
-  exsolve@1.0.7:
-    resolution: {integrity: sha512-VO5fQUzZtI6C+vx4w/4BWJpg3s/5l+6pRQEHzFRM8WFi4XffSP1Z+4qi7GbjWbvRQEbdIco5mIMq+zX4rPuLrw==}
+  estree-walker@3.0.3:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
 
   fdir@6.5.0:
     resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
@@ -528,139 +639,112 @@ packages:
       picomatch:
         optional: true
 
-  fill-range@7.1.1:
-    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
-    engines: {node: '>=8'}
+  fsevents@2.3.2:
+    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
 
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
-  glob-parent@5.1.2:
-    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
-    engines: {node: '>= 6'}
-
-  globals@11.12.0:
-    resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
-    engines: {node: '>=4'}
-
-  globals@15.15.0:
-    resolution: {integrity: sha512-7ACyT3wmyp3I61S4fG682L0VA2RGD9otkqGJIwNUMF1SWUombIIk+af1unuDYgMm082aHYwD+mzJvv9Iu8dsgg==}
-    engines: {node: '>=18'}
-
   gzip-size@6.0.0:
     resolution: {integrity: sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==}
     engines: {node: '>=10'}
 
-  is-binary-path@2.1.0:
-    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
-    engines: {node: '>=8'}
-
-  is-extglob@2.1.1:
-    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
-    engines: {node: '>=0.10.0'}
-
-  is-glob@4.0.3:
-    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
-    engines: {node: '>=0.10.0'}
+  import-meta-resolve@4.2.0:
+    resolution: {integrity: sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==}
 
-  is-number@7.0.0:
-    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
-    engines: {node: '>=0.12.0'}
-
-  jiti@2.6.1:
-    resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
-    hasBin: true
-
-  js-tokens@4.0.0:
-    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
-
-  jsesc@3.1.0:
-    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
-    engines: {node: '>=6'}
+  jiti@2.7.0:
+    resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
-  kolorist@1.8.0:
-    resolution: {integrity: sha512-Y+60/zizpJ3HRH8DCss+q95yr6145JXZo46OTpFvDZWLfRCE4qChOyk1b26nMaNpfHHgxagk9dXT5OP0Tfe+dQ==}
-
   leaflet@1.9.4:
     resolution: {integrity: sha512-nxS1ynzJOmOlHp+iL3FyWqK89GtNL8U8rvlMOsQdTTssxZwCXh8N2NB3GDQOL+YR3XnWyZAxwQixURb+FA74PA==}
 
-  local-pkg@1.1.2:
-    resolution: {integrity: sha512-arhlxbFRmoQHl33a0Zkle/YWlmNwoyt6QNZEIJcqNbdrsix5Lvc4HyyI3EnwxTYlZYc32EbYrQ8SzEZ7dqgg9A==}
-    engines: {node: '>=14'}
+  magic-regexp@0.10.0:
+    resolution: {integrity: sha512-Uly1Bu4lO1hwHUW0CQeSWuRtzCMNO00CmXtS8N6fyvB3B979GOEEeAkiTUDsmbYLAbvpUS/Kt5c4ibosAzVyVg==}
 
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
-  mdn-data@2.12.2:
-    resolution: {integrity: sha512-IEn+pegP1aManZuckezWCO+XZQDplx1366JoVhTpMpBB1sPey/SbveZQUosKiKiGYjg1wH4pMlNgXbCiYgihQA==}
+  mdn-data@2.27.1:
+    resolution: {integrity: sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==}
 
-  mlly@1.8.0:
-    resolution: {integrity: sha512-l8D9ODSRWLe2KHJSifWGwBqpTZXIXTeo8mlKjY+E2HAakaTeNpqAyBZ8GSqLzHgw4XmHmC8whvpjJNMbFZN7/g==}
+  mlly@1.8.2:
+    resolution: {integrity: sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==}
 
   mrmime@2.0.1:
     resolution: {integrity: sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==}
     engines: {node: '>=10'}
 
-  ms@2.1.3:
-    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
-
-  nanoid@3.3.11:
-    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+  nanoid@3.3.12:
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
   node-fetch-native@1.6.7:
     resolution: {integrity: sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==}
 
-  normalize-path@3.0.0:
-    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
-    engines: {node: '>=0.10.0'}
-
   ofetch@1.5.1:
     resolution: {integrity: sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA==}
 
-  package-manager-detector@1.5.0:
-    resolution: {integrity: sha512-uBj69dVlYe/+wxj8JOpr97XfsxH/eumMt6HqjNTmJDf/6NO9s+0uxeOneIz3AsPt2m6y9PqzDzd3ATcU17MNfw==}
+  oxc-parser@0.131.0:
+    resolution: {integrity: sha512-SJ3/7ZPbgie8dr5Z9BI/M51zZbpXba+hRSG0MDzVwMW5CRQg2fjYE0jHGlLX4eeiibGgC/mzoDFKSDHwVZEHRQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+
+  oxc-walker@0.7.0:
+    resolution: {integrity: sha512-54B4KUhrzbzc4sKvKwVYm7E2PgeROpGba0/2nlNZMqfDyca+yOor5IMb4WLGBatGDT0nkzYdYuzylg7n3YfB7A==}
+    peerDependencies:
+      oxc-parser: '>=0.98.0'
+
+  package-manager-detector@1.6.0:
+    resolution: {integrity: sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==}
 
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
-  perfect-debounce@1.0.0:
-    resolution: {integrity: sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==}
+  perfect-debounce@2.1.0:
+    resolution: {integrity: sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==}
 
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
-  picomatch@2.3.1:
-    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
-    engines: {node: '>=8.6'}
-
-  picomatch@4.0.3:
-    resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
     engines: {node: '>=12'}
 
   pkg-types@1.3.1:
     resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
 
-  pkg-types@2.3.0:
-    resolution: {integrity: sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig==}
+  playwright-core@1.59.1:
+    resolution: {integrity: sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==}
+    engines: {node: '>=18'}
+    hasBin: true
 
-  postcss@8.5.6:
-    resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
+  playwright@1.59.1:
+    resolution: {integrity: sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
     engines: {node: ^10 || ^12 || >=14}
 
-  quansync@0.2.11:
-    resolution: {integrity: sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==}
+  quansync@1.0.0:
+    resolution: {integrity: sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA==}
+
+  readdirp@5.0.0:
+    resolution: {integrity: sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==}
+    engines: {node: '>= 20.19.0'}
 
-  readdirp@3.6.0:
-    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
-    engines: {node: '>=8.10.0'}
+  regexp-tree@0.1.27:
+    resolution: {integrity: sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==}
+    hasBin: true
 
-  rollup@4.52.5:
-    resolution: {integrity: sha512-3GuObel8h7Kqdjt0gxkEzaifHTqLVW56Y/bjN7PSQtkKr0w3V/QYSdt6QWYtd7A1xUtYQigtdUfgj1RvWVtorw==}
+  rollup@4.60.4:
+    resolution: {integrity: sha512-WHeFSbZYsPu3+bLoNRUuAO+wavNlocOPf3wSHTP7hcFKVnJeWsYlCDbr3mTS14FCizf9ccIxXA8sGL8zKeQN3g==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -672,43 +756,63 @@ packages:
     resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
     engines: {node: '>=0.10.0'}
 
-  tinyexec@1.0.1:
-    resolution: {integrity: sha512-5uC6DDlmeqiOwCPmK9jMSdOuZTh8bU39Ys6yidB+UTt5hfZUPGAypSgFRiEp+jbi9qH40BLDvy85jIU88wKSqw==}
+  tinyexec@1.2.2:
+    resolution: {integrity: sha512-M/Q0B2cp4K7kynaT/vnED1j8TlLY+Pp7C6Wl2bl/7u/F0mUVwdyOpwomQb8JpYLitHUssAJRmLZdMCGsrx7i+g==}
+    engines: {node: '>=18'}
 
-  tinyglobby@0.2.15:
-    resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
+  tinyglobby@0.2.16:
+    resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
     engines: {node: '>=12.0.0'}
 
-  to-regex-range@5.0.1:
-    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
-    engines: {node: '>=8.0'}
-
   totalist@3.0.1:
     resolution: {integrity: sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==}
     engines: {node: '>=6'}
 
-  ufo@1.6.1:
-    resolution: {integrity: sha512-9a4/uxlTWJ4+a5i0ooc1rU7C7YOw3wT+UGqdeNNHWnOF9qcMBgLRS+4IYUqbczewFx4mLEig6gawh7X6mFlEkA==}
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  type-level-regexp@0.1.17:
+    resolution: {integrity: sha512-wTk4DH3cxwk196uGLK/E9pE45aLfeKJacKmcEgEOA/q5dnPGNxXt0cfYdFxb57L+sEpf1oJH4Dnx/pnRcku9jg==}
+
+  typescript@6.0.3:
+    resolution: {integrity: sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  ufo@1.6.4:
+    resolution: {integrity: sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==}
+
+  unconfig-core@7.5.0:
+    resolution: {integrity: sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w==}
 
-  unconfig@7.3.3:
-    resolution: {integrity: sha512-QCkQoOnJF8L107gxfHL0uavn7WD9b3dpBcFX6HtfQYmjw2YzWxGuFQ0N0J6tE9oguCBJn9KOvfqYDCMPHIZrBA==}
+  unconfig@7.5.0:
+    resolution: {integrity: sha512-oi8Qy2JV4D3UQ0PsopR28CzdQ3S/5A1zwsUwp/rosSbfhJ5z7b90bIyTwi/F7hCLD4SGcZVjDzd4XoUQcEanvA==}
 
-  unocss@66.5.4:
-    resolution: {integrity: sha512-yNajR8ADgvOzLhDkMKAXVE/SHM4sDrtVhhCnhBjiUMOR0LHIYO7cqunJJudbccrsfJbRTn/odSTBGu9f2IaXOg==}
-    engines: {node: '>=14'}
+  undici-types@7.24.6:
+    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
+
+  unocss@66.7.0:
+    resolution: {integrity: sha512-dVfkL7SQv3fOiZdqeRX1PdpQqXlB+wHcEQjVR0D/2nXsuqmUqTVnX3EUUWFjqVR83Z51zQ0EyVgym8ooDfcVvw==}
     peerDependencies:
-      '@unocss/webpack': 66.5.4
-      vite: ^2.9.0 || ^3.0.0-0 || ^4.0.0 || ^5.0.0-0 || ^6.0.0-0 || ^7.0.0-0
+      '@unocss/astro': 66.7.0
+      '@unocss/postcss': 66.7.0
+      '@unocss/webpack': 66.7.0
     peerDependenciesMeta:
-      '@unocss/webpack':
+      '@unocss/astro':
         optional: true
-      vite:
+      '@unocss/postcss':
+        optional: true
+      '@unocss/webpack':
         optional: true
 
   unplugin-utils@0.3.1:
     resolution: {integrity: sha512-5lWVjgi6vuHhJ526bI4nlCOmkCIF3nnfXkCMDeMJrtdvxTs6ZFCM8oNufGTsDbKv/tJ/xj8RpvXjRuPBZJuJog==}
     engines: {node: '>=20.19.0'}
 
+  unplugin@2.3.11:
+    resolution: {integrity: sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww==}
+    engines: {node: '>=18.12.0'}
+
   vite@7.1.12:
     resolution: {integrity: sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -749,66 +853,31 @@ packages:
       yaml:
         optional: true
 
-  vue-flow-layout@0.2.0:
-    resolution: {integrity: sha512-zKgsWWkXq0xrus7H4Mc+uFs1ESrmdTXlO0YNbR6wMdPaFvosL3fMB8N7uTV308UhGy9UvTrGhIY7mVz9eN+L0Q==}
+  webpack-virtual-modules@0.6.2:
+    resolution: {integrity: sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ==}
 
 snapshots:
 
   '@antfu/install-pkg@1.1.0':
     dependencies:
-      package-manager-detector: 1.5.0
-      tinyexec: 1.0.1
-
-  '@antfu/utils@9.3.0': {}
-
-  '@babel/code-frame@7.27.1':
-    dependencies:
-      '@babel/helper-validator-identifier': 7.28.5
-      js-tokens: 4.0.0
-      picocolors: 1.1.1
-
-  '@babel/generator@7.28.5':
-    dependencies:
-      '@babel/parser': 7.28.5
-      '@babel/types': 7.28.5
-      '@jridgewell/gen-mapping': 0.3.13
-      '@jridgewell/trace-mapping': 0.3.31
-      jsesc: 3.1.0
-
-  '@babel/helper-string-parser@7.27.1': {}
-
-  '@babel/helper-validator-identifier@7.28.5': {}
-
-  '@babel/parser@7.27.7':
-    dependencies:
-      '@babel/types': 7.28.5
-
-  '@babel/parser@7.28.5':
-    dependencies:
-      '@babel/types': 7.28.5
+      package-manager-detector: 1.6.0
+      tinyexec: 1.2.2
 
-  '@babel/template@7.27.2':
+  '@emnapi/core@1.10.0':
     dependencies:
-      '@babel/code-frame': 7.27.1
-      '@babel/parser': 7.27.7
-      '@babel/types': 7.28.5
+      '@emnapi/wasi-threads': 1.2.1
+      tslib: 2.8.1
+    optional: true
 
-  '@babel/traverse@7.27.7':
+  '@emnapi/runtime@1.10.0':
     dependencies:
-      '@babel/code-frame': 7.27.1
-      '@babel/generator': 7.28.5
-      '@babel/parser': 7.27.7
-      '@babel/template': 7.27.2
-      '@babel/types': 7.28.5
-      debug: 4.4.3
-      globals: 11.12.0
-    transitivePeerDependencies:
-      - supports-color
+      tslib: 2.8.1
+    optional: true
 
-  '@babel/types@7.28.5':
+  '@emnapi/wasi-threads@1.2.1':
     dependencies:
-      '@babel/helper-string-parser': 7.27.1
-      '@babel/helper-validator-identifier': 7.28.5
+      tslib: 2.8.1
+    optional: true
 
   '@esbuild/aix-ppc64@0.25.12':
     optional: true
@@ -890,18 +959,11 @@ snapshots:
 
   '@iconify/types@2.0.0': {}
 
-  '@iconify/utils@3.0.2':
+  '@iconify/utils@3.1.3':
     dependencies:
       '@antfu/install-pkg': 1.1.0
-      '@antfu/utils': 9.3.0
       '@iconify/types': 2.0.0
-      debug: 4.4.3
-      globals: 15.15.0
-      kolorist: 1.8.0
-      local-pkg: 1.1.2
-      mlly: 1.8.0
-    transitivePeerDependencies:
-      - supports-color
+      import-meta-resolve: 4.2.0
 
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
@@ -922,274 +984,326 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@tybys/wasm-util': 0.10.2
+    optional: true
+
+  '@oxc-parser/binding-android-arm-eabi@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-android-arm64@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-darwin-arm64@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-darwin-x64@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-freebsd-x64@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm-musleabihf@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm64-gnu@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-arm64-musl@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-ppc64-gnu@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-riscv64-gnu@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-riscv64-musl@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-s390x-gnu@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-x64-gnu@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-linux-x64-musl@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-openharmony-arm64@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-wasm32-wasi@0.131.0':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+    optional: true
+
+  '@oxc-parser/binding-win32-arm64-msvc@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-win32-ia32-msvc@0.131.0':
+    optional: true
+
+  '@oxc-parser/binding-win32-x64-msvc@0.131.0':
+    optional: true
+
+  '@oxc-project/types@0.131.0': {}
+
+  '@playwright/test@1.59.1':
+    dependencies:
+      playwright: 1.59.1
+
   '@polka/url@1.0.0-next.29': {}
 
-  '@quansync/fs@0.1.5':
+  '@quansync/fs@1.0.0':
     dependencies:
-      quansync: 0.2.11
+      quansync: 1.0.0
+
+  '@rollup/rollup-android-arm-eabi@4.60.4':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.60.4':
+    optional: true
 
-  '@rollup/rollup-android-arm-eabi@4.52.5':
+  '@rollup/rollup-darwin-arm64@4.60.4':
     optional: true
 
-  '@rollup/rollup-android-arm64@4.52.5':
+  '@rollup/rollup-darwin-x64@4.60.4':
     optional: true
 
-  '@rollup/rollup-darwin-arm64@4.52.5':
+  '@rollup/rollup-freebsd-arm64@4.60.4':
     optional: true
 
-  '@rollup/rollup-darwin-x64@4.52.5':
+  '@rollup/rollup-freebsd-x64@4.60.4':
     optional: true
 
-  '@rollup/rollup-freebsd-arm64@4.52.5':
+  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.52.5':
+  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.5':
+  '@rollup/rollup-linux-arm64-gnu@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.5':
+  '@rollup/rollup-linux-arm64-musl@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.5':
+  '@rollup/rollup-linux-loong64-gnu@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.52.5':
+  '@rollup/rollup-linux-loong64-musl@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.5':
+  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.5':
+  '@rollup/rollup-linux-ppc64-musl@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.5':
+  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.5':
+  '@rollup/rollup-linux-riscv64-musl@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.5':
+  '@rollup/rollup-linux-s390x-gnu@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.52.5':
+  '@rollup/rollup-linux-x64-gnu@4.60.4':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.52.5':
+  '@rollup/rollup-linux-x64-musl@4.60.4':
     optional: true
 
-  '@rollup/rollup-openharmony-arm64@4.52.5':
+  '@rollup/rollup-openbsd-x64@4.60.4':
     optional: true
 
-  '@rollup/rollup-win32-arm64-msvc@4.52.5':
+  '@rollup/rollup-openharmony-arm64@4.60.4':
     optional: true
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.5':
+  '@rollup/rollup-win32-arm64-msvc@4.60.4':
     optional: true
 
-  '@rollup/rollup-win32-x64-gnu@4.52.5':
+  '@rollup/rollup-win32-ia32-msvc@4.60.4':
     optional: true
 
-  '@rollup/rollup-win32-x64-msvc@4.52.5':
+  '@rollup/rollup-win32-x64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.60.4':
+    optional: true
+
+  '@tybys/wasm-util@0.10.2':
+    dependencies:
+      tslib: 2.8.1
     optional: true
 
   '@types/estree@1.0.8': {}
 
-  '@unocss/astro@66.5.4(vite@7.1.12(jiti@2.6.1))':
+  '@types/estree@1.0.9': {}
+
+  '@types/node@25.9.1':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/reset': 66.5.4
-      '@unocss/vite': 66.5.4(vite@7.1.12(jiti@2.6.1))
-    optionalDependencies:
-      vite: 7.1.12(jiti@2.6.1)
+      undici-types: 7.24.6
 
-  '@unocss/cli@66.5.4':
+  '@unocss/cli@66.7.0':
     dependencies:
       '@jridgewell/remapping': 2.3.5
-      '@unocss/config': 66.5.4
-      '@unocss/core': 66.5.4
-      '@unocss/preset-uno': 66.5.4
-      cac: 6.7.14
-      chokidar: 3.6.0
+      '@unocss/config': 66.7.0
+      '@unocss/core': 66.7.0
+      '@unocss/preset-wind3': 66.7.0
+      '@unocss/preset-wind4': 66.7.0
+      '@unocss/transformer-directives': 66.7.0
+      cac: 7.0.0
+      chokidar: 5.0.0
       colorette: 2.0.20
       consola: 3.4.2
       magic-string: 0.30.21
       pathe: 2.0.3
-      perfect-debounce: 1.0.0
-      tinyglobby: 0.2.15
+      perfect-debounce: 2.1.0
+      tinyglobby: 0.2.16
       unplugin-utils: 0.3.1
 
-  '@unocss/config@66.5.4':
+  '@unocss/config@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      unconfig: 7.3.3
+      '@unocss/core': 66.7.0
+      colorette: 2.0.20
+      consola: 3.4.2
+      unconfig: 7.5.0
 
-  '@unocss/core@66.5.4': {}
+  '@unocss/core@66.7.0': {}
 
-  '@unocss/extractor-arbitrary-variants@66.5.4':
+  '@unocss/extractor-arbitrary-variants@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
+      '@unocss/core': 66.7.0
 
-  '@unocss/inspector@66.5.4':
+  '@unocss/inspector@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/rule-utils': 66.5.4
+      '@unocss/core': 66.7.0
+      '@unocss/rule-utils': 66.7.0
       colorette: 2.0.20
       gzip-size: 6.0.0
       sirv: 3.0.2
-      vue-flow-layout: 0.2.0
 
-  '@unocss/postcss@66.5.4(postcss@8.5.6)':
+  '@unocss/preset-attributify@66.7.0':
     dependencies:
-      '@unocss/config': 66.5.4
-      '@unocss/core': 66.5.4
-      '@unocss/rule-utils': 66.5.4
-      css-tree: 3.1.0
-      postcss: 8.5.6
-      tinyglobby: 0.2.15
-
-  '@unocss/preset-attributify@66.5.4':
-    dependencies:
-      '@unocss/core': 66.5.4
+      '@unocss/core': 66.7.0
 
-  '@unocss/preset-icons@66.5.4':
+  '@unocss/preset-icons@66.7.0':
     dependencies:
-      '@iconify/utils': 3.0.2
-      '@unocss/core': 66.5.4
+      '@iconify/utils': 3.1.3
+      '@unocss/core': 66.7.0
       ofetch: 1.5.1
-    transitivePeerDependencies:
-      - supports-color
 
-  '@unocss/preset-mini@66.5.4':
+  '@unocss/preset-mini@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/extractor-arbitrary-variants': 66.5.4
-      '@unocss/rule-utils': 66.5.4
+      '@unocss/core': 66.7.0
+      '@unocss/extractor-arbitrary-variants': 66.7.0
+      '@unocss/rule-utils': 66.7.0
 
-  '@unocss/preset-tagify@66.5.4':
+  '@unocss/preset-tagify@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
+      '@unocss/core': 66.7.0
 
-  '@unocss/preset-typography@66.5.4':
+  '@unocss/preset-typography@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/rule-utils': 66.5.4
+      '@unocss/core': 66.7.0
+      '@unocss/rule-utils': 66.7.0
 
-  '@unocss/preset-uno@66.5.4':
+  '@unocss/preset-uno@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/preset-wind3': 66.5.4
+      '@unocss/core': 66.7.0
+      '@unocss/preset-wind3': 66.7.0
 
-  '@unocss/preset-web-fonts@66.5.4':
+  '@unocss/preset-web-fonts@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
+      '@unocss/core': 66.7.0
       ofetch: 1.5.1
 
-  '@unocss/preset-wind3@66.5.4':
+  '@unocss/preset-wind3@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/preset-mini': 66.5.4
-      '@unocss/rule-utils': 66.5.4
+      '@unocss/core': 66.7.0
+      '@unocss/preset-mini': 66.7.0
+      '@unocss/rule-utils': 66.7.0
 
-  '@unocss/preset-wind4@66.5.4':
+  '@unocss/preset-wind4@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/extractor-arbitrary-variants': 66.5.4
-      '@unocss/rule-utils': 66.5.4
+      '@unocss/core': 66.7.0
+      '@unocss/extractor-arbitrary-variants': 66.7.0
+      '@unocss/rule-utils': 66.7.0
 
-  '@unocss/preset-wind@66.5.4':
+  '@unocss/preset-wind@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/preset-wind3': 66.5.4
-
-  '@unocss/reset@66.5.4': {}
+      '@unocss/core': 66.7.0
+      '@unocss/preset-wind3': 66.7.0
 
-  '@unocss/rule-utils@66.5.4':
+  '@unocss/rule-utils@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
+      '@unocss/core': 66.7.0
       magic-string: 0.30.21
 
-  '@unocss/transformer-attributify-jsx@66.5.4':
+  '@unocss/transformer-attributify-jsx@66.7.0':
     dependencies:
-      '@babel/parser': 7.27.7
-      '@babel/traverse': 7.27.7
-      '@unocss/core': 66.5.4
-    transitivePeerDependencies:
-      - supports-color
+      '@unocss/core': 66.7.0
+      oxc-parser: 0.131.0
+      oxc-walker: 0.7.0(oxc-parser@0.131.0)
 
-  '@unocss/transformer-compile-class@66.5.4':
+  '@unocss/transformer-compile-class@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
+      '@unocss/core': 66.7.0
 
-  '@unocss/transformer-directives@66.5.4':
+  '@unocss/transformer-directives@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
-      '@unocss/rule-utils': 66.5.4
-      css-tree: 3.1.0
+      '@unocss/core': 66.7.0
+      '@unocss/rule-utils': 66.7.0
+      css-tree: 3.2.1
 
-  '@unocss/transformer-variant-group@66.5.4':
+  '@unocss/transformer-variant-group@66.7.0':
     dependencies:
-      '@unocss/core': 66.5.4
+      '@unocss/core': 66.7.0
 
-  '@unocss/vite@66.5.4(vite@7.1.12(jiti@2.6.1))':
+  '@unocss/vite@66.7.0(vite@7.1.12(@types/node@25.9.1)(jiti@2.7.0))':
     dependencies:
       '@jridgewell/remapping': 2.3.5
-      '@unocss/config': 66.5.4
-      '@unocss/core': 66.5.4
-      '@unocss/inspector': 66.5.4
-      chokidar: 3.6.0
+      '@unocss/config': 66.7.0
+      '@unocss/core': 66.7.0
+      '@unocss/inspector': 66.7.0
+      chokidar: 5.0.0
       magic-string: 0.30.21
       pathe: 2.0.3
-      tinyglobby: 0.2.15
+      tinyglobby: 0.2.16
       unplugin-utils: 0.3.1
-      vite: 7.1.12(jiti@2.6.1)
-
-  acorn@8.15.0: {}
+      vite: 7.1.12(@types/node@25.9.1)(jiti@2.7.0)
 
-  anymatch@3.1.3:
-    dependencies:
-      normalize-path: 3.0.0
-      picomatch: 2.3.1
-
-  binary-extensions@2.3.0: {}
-
-  braces@3.0.3:
-    dependencies:
-      fill-range: 7.1.1
+  acorn@8.16.0: {}
 
-  cac@6.7.14: {}
+  cac@7.0.0: {}
 
-  chokidar@3.6.0:
+  chokidar@5.0.0:
     dependencies:
-      anymatch: 3.1.3
-      braces: 3.0.3
-      glob-parent: 5.1.2
-      is-binary-path: 2.1.0
-      is-glob: 4.0.3
-      normalize-path: 3.0.0
-      readdirp: 3.6.0
-    optionalDependencies:
-      fsevents: 2.3.3
+      readdirp: 5.0.0
 
   colorette@2.0.20: {}
 
   confbox@0.1.8: {}
 
-  confbox@0.2.2: {}
-
   consola@3.4.2: {}
 
-  css-tree@3.1.0:
+  css-tree@3.2.1:
     dependencies:
-      mdn-data: 2.12.2
+      mdn-data: 2.27.1
       source-map-js: 1.2.1
 
-  debug@4.4.3:
-    dependencies:
-      ms: 2.1.3
-
-  defu@6.1.4: {}
+  defu@6.1.7: {}
 
   destr@2.0.5: {}
 
@@ -1224,150 +1338,160 @@ snapshots:
       '@esbuild/win32-ia32': 0.25.12
       '@esbuild/win32-x64': 0.25.12
 
-  exsolve@1.0.7: {}
+  estree-walker@3.0.3:
+    dependencies:
+      '@types/estree': 1.0.9
 
-  fdir@6.5.0(picomatch@4.0.3):
+  fdir@6.5.0(picomatch@4.0.4):
     optionalDependencies:
-      picomatch: 4.0.3
+      picomatch: 4.0.4
 
-  fill-range@7.1.1:
-    dependencies:
-      to-regex-range: 5.0.1
+  fsevents@2.3.2:
+    optional: true
 
   fsevents@2.3.3:
     optional: true
 
-  glob-parent@5.1.2:
-    dependencies:
-      is-glob: 4.0.3
-
-  globals@11.12.0: {}
-
-  globals@15.15.0: {}
-
   gzip-size@6.0.0:
     dependencies:
       duplexer: 0.1.2
 
-  is-binary-path@2.1.0:
-    dependencies:
-      binary-extensions: 2.3.0
-
-  is-extglob@2.1.1: {}
-
-  is-glob@4.0.3:
-    dependencies:
-      is-extglob: 2.1.1
-
-  is-number@7.0.0: {}
-
-  jiti@2.6.1: {}
-
-  js-tokens@4.0.0: {}
+  import-meta-resolve@4.2.0: {}
 
-  jsesc@3.1.0: {}
-
-  kolorist@1.8.0: {}
+  jiti@2.7.0: {}
 
   leaflet@1.9.4: {}
 
-  local-pkg@1.1.2:
+  magic-regexp@0.10.0:
     dependencies:
-      mlly: 1.8.0
-      pkg-types: 2.3.0
-      quansync: 0.2.11
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+      mlly: 1.8.2
+      regexp-tree: 0.1.27
+      type-level-regexp: 0.1.17
+      ufo: 1.6.4
+      unplugin: 2.3.11
 
   magic-string@0.30.21:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  mdn-data@2.12.2: {}
+  mdn-data@2.27.1: {}
 
-  mlly@1.8.0:
+  mlly@1.8.2:
     dependencies:
-      acorn: 8.15.0
+      acorn: 8.16.0
       pathe: 2.0.3
       pkg-types: 1.3.1
-      ufo: 1.6.1
+      ufo: 1.6.4
 
   mrmime@2.0.1: {}
 
-  ms@2.1.3: {}
-
-  nanoid@3.3.11: {}
+  nanoid@3.3.12: {}
 
   node-fetch-native@1.6.7: {}
 
-  normalize-path@3.0.0: {}
-
   ofetch@1.5.1:
     dependencies:
       destr: 2.0.5
       node-fetch-native: 1.6.7
-      ufo: 1.6.1
+      ufo: 1.6.4
 
-  package-manager-detector@1.5.0: {}
+  oxc-parser@0.131.0:
+    dependencies:
+      '@oxc-project/types': 0.131.0
+    optionalDependencies:
+      '@oxc-parser/binding-android-arm-eabi': 0.131.0
+      '@oxc-parser/binding-android-arm64': 0.131.0
+      '@oxc-parser/binding-darwin-arm64': 0.131.0
+      '@oxc-parser/binding-darwin-x64': 0.131.0
+      '@oxc-parser/binding-freebsd-x64': 0.131.0
+      '@oxc-parser/binding-linux-arm-gnueabihf': 0.131.0
+      '@oxc-parser/binding-linux-arm-musleabihf': 0.131.0
+      '@oxc-parser/binding-linux-arm64-gnu': 0.131.0
+      '@oxc-parser/binding-linux-arm64-musl': 0.131.0
+      '@oxc-parser/binding-linux-ppc64-gnu': 0.131.0
+      '@oxc-parser/binding-linux-riscv64-gnu': 0.131.0
+      '@oxc-parser/binding-linux-riscv64-musl': 0.131.0
+      '@oxc-parser/binding-linux-s390x-gnu': 0.131.0
+      '@oxc-parser/binding-linux-x64-gnu': 0.131.0
+      '@oxc-parser/binding-linux-x64-musl': 0.131.0
+      '@oxc-parser/binding-openharmony-arm64': 0.131.0
+      '@oxc-parser/binding-wasm32-wasi': 0.131.0
+      '@oxc-parser/binding-win32-arm64-msvc': 0.131.0
+      '@oxc-parser/binding-win32-ia32-msvc': 0.131.0
+      '@oxc-parser/binding-win32-x64-msvc': 0.131.0
+
+  oxc-walker@0.7.0(oxc-parser@0.131.0):
+    dependencies:
+      magic-regexp: 0.10.0
+      oxc-parser: 0.131.0
+
+  package-manager-detector@1.6.0: {}
 
   pathe@2.0.3: {}
 
-  perfect-debounce@1.0.0: {}
+  perfect-debounce@2.1.0: {}
 
   picocolors@1.1.1: {}
 
-  picomatch@2.3.1: {}
-
-  picomatch@4.0.3: {}
+  picomatch@4.0.4: {}
 
   pkg-types@1.3.1:
     dependencies:
       confbox: 0.1.8
-      mlly: 1.8.0
+      mlly: 1.8.2
       pathe: 2.0.3
 
-  pkg-types@2.3.0:
+  playwright-core@1.59.1: {}
+
+  playwright@1.59.1:
     dependencies:
-      confbox: 0.2.2
-      exsolve: 1.0.7
-      pathe: 2.0.3
+      playwright-core: 1.59.1
+    optionalDependencies:
+      fsevents: 2.3.2
 
-  postcss@8.5.6:
+  postcss@8.5.15:
     dependencies:
-      nanoid: 3.3.11
+      nanoid: 3.3.12
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  quansync@0.2.11: {}
+  quansync@1.0.0: {}
 
-  readdirp@3.6.0:
-    dependencies:
-      picomatch: 2.3.1
+  readdirp@5.0.0: {}
+
+  regexp-tree@0.1.27: {}
 
-  rollup@4.52.5:
+  rollup@4.60.4:
     dependencies:
       '@types/estree': 1.0.8
     optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.52.5
-      '@rollup/rollup-android-arm64': 4.52.5
-      '@rollup/rollup-darwin-arm64': 4.52.5
-      '@rollup/rollup-darwin-x64': 4.52.5
-      '@rollup/rollup-freebsd-arm64': 4.52.5
-      '@rollup/rollup-freebsd-x64': 4.52.5
-      '@rollup/rollup-linux-arm-gnueabihf': 4.52.5
-      '@rollup/rollup-linux-arm-musleabihf': 4.52.5
-      '@rollup/rollup-linux-arm64-gnu': 4.52.5
-      '@rollup/rollup-linux-arm64-musl': 4.52.5
-      '@rollup/rollup-linux-loong64-gnu': 4.52.5
-      '@rollup/rollup-linux-ppc64-gnu': 4.52.5
-      '@rollup/rollup-linux-riscv64-gnu': 4.52.5
-      '@rollup/rollup-linux-riscv64-musl': 4.52.5
-      '@rollup/rollup-linux-s390x-gnu': 4.52.5
-      '@rollup/rollup-linux-x64-gnu': 4.52.5
-      '@rollup/rollup-linux-x64-musl': 4.52.5
-      '@rollup/rollup-openharmony-arm64': 4.52.5
-      '@rollup/rollup-win32-arm64-msvc': 4.52.5
-      '@rollup/rollup-win32-ia32-msvc': 4.52.5
-      '@rollup/rollup-win32-x64-gnu': 4.52.5
-      '@rollup/rollup-win32-x64-msvc': 4.52.5
+      '@rollup/rollup-android-arm-eabi': 4.60.4
+      '@rollup/rollup-android-arm64': 4.60.4
+      '@rollup/rollup-darwin-arm64': 4.60.4
+      '@rollup/rollup-darwin-x64': 4.60.4
+      '@rollup/rollup-freebsd-arm64': 4.60.4
+      '@rollup/rollup-freebsd-x64': 4.60.4
+      '@rollup/rollup-linux-arm-gnueabihf': 4.60.4
+      '@rollup/rollup-linux-arm-musleabihf': 4.60.4
+      '@rollup/rollup-linux-arm64-gnu': 4.60.4
+      '@rollup/rollup-linux-arm64-musl': 4.60.4
+      '@rollup/rollup-linux-loong64-gnu': 4.60.4
+      '@rollup/rollup-linux-loong64-musl': 4.60.4
+      '@rollup/rollup-linux-ppc64-gnu': 4.60.4
+      '@rollup/rollup-linux-ppc64-musl': 4.60.4
+      '@rollup/rollup-linux-riscv64-gnu': 4.60.4
+      '@rollup/rollup-linux-riscv64-musl': 4.60.4
+      '@rollup/rollup-linux-s390x-gnu': 4.60.4
+      '@rollup/rollup-linux-x64-gnu': 4.60.4
+      '@rollup/rollup-linux-x64-musl': 4.60.4
+      '@rollup/rollup-openbsd-x64': 4.60.4
+      '@rollup/rollup-openharmony-arm64': 4.60.4
+      '@rollup/rollup-win32-arm64-msvc': 4.60.4
+      '@rollup/rollup-win32-ia32-msvc': 4.60.4
+      '@rollup/rollup-win32-x64-gnu': 4.60.4
+      '@rollup/rollup-win32-x64-msvc': 4.60.4
       fsevents: 2.3.3
 
   sirv@3.0.2:
@@ -1378,70 +1502,84 @@ snapshots:
 
   source-map-js@1.2.1: {}
 
-  tinyexec@1.0.1: {}
+  tinyexec@1.2.2: {}
 
-  tinyglobby@0.2.15:
+  tinyglobby@0.2.16:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
-
-  to-regex-range@5.0.1:
-    dependencies:
-      is-number: 7.0.0
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
 
   totalist@3.0.1: {}
 
-  ufo@1.6.1: {}
+  tslib@2.8.1:
+    optional: true
+
+  type-level-regexp@0.1.17: {}
 
-  unconfig@7.3.3:
+  typescript@6.0.3: {}
+
+  ufo@1.6.4: {}
+
+  unconfig-core@7.5.0:
     dependencies:
-      '@quansync/fs': 0.1.5
-      defu: 6.1.4
-      jiti: 2.6.1
-      quansync: 0.2.11
+      '@quansync/fs': 1.0.0
+      quansync: 1.0.0
 
-  unocss@66.5.4(postcss@8.5.6)(vite@7.1.12(jiti@2.6.1)):
+  unconfig@7.5.0:
     dependencies:
-      '@unocss/astro': 66.5.4(vite@7.1.12(jiti@2.6.1))
-      '@unocss/cli': 66.5.4
-      '@unocss/core': 66.5.4
-      '@unocss/postcss': 66.5.4(postcss@8.5.6)
-      '@unocss/preset-attributify': 66.5.4
-      '@unocss/preset-icons': 66.5.4
-      '@unocss/preset-mini': 66.5.4
-      '@unocss/preset-tagify': 66.5.4
-      '@unocss/preset-typography': 66.5.4
-      '@unocss/preset-uno': 66.5.4
-      '@unocss/preset-web-fonts': 66.5.4
-      '@unocss/preset-wind': 66.5.4
-      '@unocss/preset-wind3': 66.5.4
-      '@unocss/preset-wind4': 66.5.4
-      '@unocss/transformer-attributify-jsx': 66.5.4
-      '@unocss/transformer-compile-class': 66.5.4
-      '@unocss/transformer-directives': 66.5.4
-      '@unocss/transformer-variant-group': 66.5.4
-      '@unocss/vite': 66.5.4(vite@7.1.12(jiti@2.6.1))
-    optionalDependencies:
-      vite: 7.1.12(jiti@2.6.1)
+      '@quansync/fs': 1.0.0
+      defu: 6.1.7
+      jiti: 2.7.0
+      quansync: 1.0.0
+      unconfig-core: 7.5.0
+
+  undici-types@7.24.6: {}
+
+  unocss@66.7.0(vite@7.1.12(@types/node@25.9.1)(jiti@2.7.0)):
+    dependencies:
+      '@unocss/cli': 66.7.0
+      '@unocss/core': 66.7.0
+      '@unocss/preset-attributify': 66.7.0
+      '@unocss/preset-icons': 66.7.0
+      '@unocss/preset-mini': 66.7.0
+      '@unocss/preset-tagify': 66.7.0
+      '@unocss/preset-typography': 66.7.0
+      '@unocss/preset-uno': 66.7.0
+      '@unocss/preset-web-fonts': 66.7.0
+      '@unocss/preset-wind': 66.7.0
+      '@unocss/preset-wind3': 66.7.0
+      '@unocss/preset-wind4': 66.7.0
+      '@unocss/transformer-attributify-jsx': 66.7.0
+      '@unocss/transformer-compile-class': 66.7.0
+      '@unocss/transformer-directives': 66.7.0
+      '@unocss/transformer-variant-group': 66.7.0
+      '@unocss/vite': 66.7.0(vite@7.1.12(@types/node@25.9.1)(jiti@2.7.0))
     transitivePeerDependencies:
-      - postcss
-      - supports-color
+      - vite
 
   unplugin-utils@0.3.1:
     dependencies:
       pathe: 2.0.3
-      picomatch: 4.0.3
+      picomatch: 4.0.4
+
+  unplugin@2.3.11:
+    dependencies:
+      '@jridgewell/remapping': 2.3.5
+      acorn: 8.16.0
+      picomatch: 4.0.4
+      webpack-virtual-modules: 0.6.2
 
-  vite@7.1.12(jiti@2.6.1):
+  vite@7.1.12(@types/node@25.9.1)(jiti@2.7.0):
     dependencies:
       esbuild: 0.25.12
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
-      postcss: 8.5.6
-      rollup: 4.52.5
-      tinyglobby: 0.2.15
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+      postcss: 8.5.15
+      rollup: 4.60.4
+      tinyglobby: 0.2.16
     optionalDependencies:
+      '@types/node': 25.9.1
       fsevents: 2.3.3
-      jiti: 2.6.1
+      jiti: 2.7.0
 
-  vue-flow-layout@0.2.0: {}
+  webpack-virtual-modules@0.6.2: {}
diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml
new file mode 100644
index 0000000..5ed0b5a
--- /dev/null
+++ b/frontend/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+allowBuilds:
+  esbuild: true
diff --git a/frontend/public/config.json b/frontend/public/config.json
deleted file mode 100644
index 077c969..0000000
--- a/frontend/public/config.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "api_url": "http://127.0.0.1:8000"
-}
diff --git a/frontend/src/components/edit_s3_object_form.rs b/frontend/src/components/edit_s3_object_form.rs
index 00c73d0..47c178a 100644
--- a/frontend/src/components/edit_s3_object_form.rs
+++ b/frontend/src/components/edit_s3_object_form.rs
@@ -31,7 +31,10 @@ use {
 		dump_errors,
 		errors::use_context_safe,
 		graphql_queries::{
-			s3_object_by_id::S3ObjectByIdQuery,
+			s3_object_by_id::{
+				S3ObjectByIdQuery,
+				s3_object_by_id_query,
+			},
 			s3_objects::s3_objects_query::S3ObjectsQueryS3Objects,
 			types::PublicityOverride,
 			update_s3_object::{
@@ -96,7 +99,14 @@ pub fn EditS3ObjectForm(
 				return Err("Invalid ID".to_string());
 			}
 			// Fetch the S3 object data by ID
-			S3ObjectByIdQuery::run(api_url, id).await.map_err(|e| e.to_string())
+			crate::graphql_queries::run::<S3ObjectByIdQuery>(
+				api_url,
+				s3_object_by_id_query::Variables {
+					id,
+				},
+			)
+			.await
+			.map_err(|e| e.to_string())
 		}
 	});
 
@@ -216,7 +226,7 @@ pub fn EditS3ObjectForm(
 				},
 			};
 
-			match UpdateS3ObjectMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run::<UpdateS3ObjectMutation>(api_url, variables).await {
 				Ok(updated_obj) => {
 					if let Some(toaster) = toaster {
 						toaster.dispatch_toast(
diff --git a/frontend/src/components/file_upload.rs b/frontend/src/components/file_upload.rs
index affa477..f4dd053 100644
--- a/frontend/src/components/file_upload.rs
+++ b/frontend/src/components/file_upload.rs
@@ -25,6 +25,29 @@ use {
 			use_context_safe,
 			use_error_context,
 		},
+		graphql_queries::{
+			abort_object_upload::{
+				AbortObjectUploadMutation,
+				abort_object_upload_mutation,
+			},
+			complete_object_upload::{
+				CompleteObjectUploadMutation,
+				CompletedUploadPartInput,
+				complete_object_upload_mutation,
+			},
+			create_object_upload_session::{
+				CreateObjectUploadSessionInput,
+				CreateObjectUploadSessionMutation,
+				PublicityOverride,
+				UploadLocationInput,
+				create_object_upload_session_mutation,
+			},
+			presign_object_upload_parts::{
+				PresignObjectUploadPartsMutation,
+				PresignedUploadPart,
+				presign_object_upload_parts_mutation,
+			},
+		},
 		js_date_value_to_iso,
 	},
 	leptos::{
@@ -34,20 +57,42 @@ use {
 		wasm_bindgen::JsCast,
 		web_sys::{
 			self,
+			File,
 			FormData,
+			Headers,
 			HtmlFormElement,
 			MouseEvent,
 			Request,
+			RequestCredentials,
 			RequestInit,
+			RequestMode,
+			Response,
 			SubmitEvent,
 		},
 	},
-	leptos_router::components::Form,
-	shared::ALLOWED_MIME_TYPES,
+	shared::{
+		ALLOWED_MIME_TYPES,
+		MAX_PRESIGN_PARTS_PER_REQUEST,
+	},
 	thaw::*,
 	wasm_bindgen_futures::JsFuture,
 };
 
+#[derive(Clone, Debug)]
+struct UploadMetadata {
+	made_on: Option<String>,
+	location: Option<(f64, f64)>,
+}
+
+impl UploadMetadata {
+	fn location_input(&self) -> Option<UploadLocationInput> {
+		self.location.map(|(latitude, longitude)| UploadLocationInput {
+			latitude,
+			longitude,
+		})
+	}
+}
+
 #[component]
 pub fn FileUpload(
 	// Callback to trigger a refresh of the parent's data (e.g., table)
@@ -61,9 +106,14 @@ pub fn FileUpload(
 	let error_ctx = use_error_context();
 	let file_input_ref = NodeRef::<Input>::new();
 	let made_on_input_ref = NodeRef::<Input>::new();
+	let (uploading, set_uploading) = signal(false);
 
 	let on_submit = move |event: SubmitEvent| {
 		event.prevent_default();
+		if uploading.get_untracked() {
+			return;
+		}
+
 		let Some(target) = event.target() else {
 			error_ctx.report(AppError::System("Submit event has no target".to_string()));
 			return;
@@ -78,92 +128,40 @@ pub fn FileUpload(
 			return;
 		};
 
-		if let Some(input) = made_on_input_ref.get() {
+		let made_on = made_on_input_ref.get().and_then(|input| {
 			let value = input.value();
-			if let Some(iso_str) = js_date_value_to_iso(&value) {
-				let _ = form_data.set_with_str("made_on", &iso_str);
+			js_date_value_to_iso(&value)
+		});
+		let metadata = match upload_metadata(&form_data, made_on) {
+			Ok(metadata) => metadata,
+			Err(error) => {
+				error_ctx.report(error);
+				return;
 			}
-		}
+		};
 
-		// Client-side validation
-		if let Some(input) = file_input_ref.get() &&
-			let Some(files) = input.files()
-		{
-			let files_length = files.length();
-			if files_length == 0 {
-				error_ctx.report(AppError::Validation(ERROR_SELECT_FILE.to_string()));
+		let files = match selected_files(file_input_ref) {
+			Ok(files) => files,
+			Err(error) => {
+				error_ctx.report(error);
 				return;
 			}
-			for i in 0 .. files_length {
-				let Some(file) = files.item(i) else {
-					continue;
-				};
-				let file_type = file.type_();
-				if !ALLOWED_MIME_TYPES.contains(&file_type.as_str()) {
-					let file_name = file.name();
-					error_ctx.report(AppError::Validation(format!(
-						"{}{file_name} ({file_type})",
-						ERR_UNSUPPORTED_FILE_TYPE
-					)));
-					return;
-				}
-			}
-		}
+		};
 
 		let api_url = config.api_url.clone();
+		set_uploading.set(true);
 		spawn_local(async move {
-			let options = RequestInit::new();
-			options.set_method("POST");
-			options.set_body(&form_data);
-
-			let url = format!("{api_url}/api/locations/");
-			let Ok(request) = Request::new_with_str_and_init(&url, &options) else {
-				error_ctx.report(AppError::System(ERR_SYSTEM_REQUEST_FAILED.to_string()));
-				return;
-			};
-
-			let Some(window) = web_sys::window() else {
-				error_ctx.report(AppError::System(ERR_SYSTEM_NO_WINDOW.to_string()));
-				return;
-			};
-
-			match JsFuture::from(window.fetch_with_request(&request)).await {
-				Ok(resp_value) => {
-					let Ok(resp) = resp_value.dyn_into::<web_sys::Response>() else {
-						error_ctx.report(AppError::System(ERR_SYSTEM_RESPONSE_CAST.to_string()));
-						return;
-					};
-					if resp.ok() {
-						// Trigger the parent's refresh callback instead of reloading the page
-						on_success.run(());
-					} else {
-						let text = if let Ok(text_promise) = resp.text() {
-							JsFuture::from(text_promise)
-								.await
-								.ok()
-								.and_then(|v| v.as_string())
-								.unwrap_or_default()
-						} else {
-							Default::default()
-						};
-						error_ctx.report(AppError::Network(format!(
-							"{}{} {}, Body: {}",
-							ERR_NETWORK_UPLOAD_FAILED,
-							resp.status(),
-							resp.status_text(),
-							text
-						)));
-					}
-				}
-				Err(e) => {
-					error_ctx.report(AppError::from(e));
-				}
+			let result = upload_files(api_url, files, metadata).await;
+			set_uploading.set(false);
+			match result {
+				Ok(()) => on_success.run(()),
+				Err(error) => error_ctx.report(error),
 			}
 		});
 	};
 	view! {
 		<ErrorBoundary fallback=dump_errors>
-			<Form action="" on:submit=on_submit>
+			<form on:submit=on_submit>
 				<div class="relative grid gap-4">
 					<label>
 						<div class="font-bold">{LABEL_SET_LATITUDE}</div>
@@ -200,21 +198,276 @@ pub fn FileUpload(
 						/>
 					</label>
 					<div class="grid grid-flow-col justify-start gap-4">
-						<Button class="w-fit">{BUTTON_SUBMIT}</Button>
+						<Button attr:r#type="submit" attr:disabled=move || uploading.get() class="w-fit">
+							{move || if uploading.get() { "Uploading..." } else { BUTTON_SUBMIT }}
+						</Button>
 						<Button
+							attr:r#type="button"
+							attr:disabled=move || uploading.get()
 							class="w-fit"
 							appearance=ButtonAppearance::Subtle
 							on_click=move |e: MouseEvent| {
 								e.prevent_default();
-								on_cancel.run(());
+								if !uploading.get_untracked() {
+									on_cancel.run(());
+								}
 							}
 						>
 							{BUTTON_CANCEL}
 						</Button>
 					</div>
 				</div>
-			</Form>
+			</form>
 		</ErrorBoundary>
 	}
 	.into_any()
 }
+
+fn selected_files(file_input_ref: NodeRef<Input>) -> Result<Vec<File>, AppError> {
+	let input =
+		file_input_ref.get().ok_or_else(|| AppError::Validation(ERROR_SELECT_FILE.to_string()))?;
+	let files = input.files().ok_or_else(|| AppError::Validation(ERROR_SELECT_FILE.to_string()))?;
+	let files_length = files.length();
+	if files_length == 0 {
+		return Err(AppError::Validation(ERROR_SELECT_FILE.to_string()));
+	}
+
+	let mut selected = Vec::with_capacity(files_length as usize);
+	for index in 0 .. files_length {
+		let Some(file) = files.item(index) else {
+			continue;
+		};
+		let file_type = file.type_();
+		if !ALLOWED_MIME_TYPES.contains(&file_type.as_str()) {
+			return Err(AppError::Validation(format!(
+				"{}{} ({})",
+				ERR_UNSUPPORTED_FILE_TYPE,
+				file.name(),
+				file_type
+			)));
+		}
+		if file.size() <= 0.0 {
+			return Err(AppError::Validation(format!("{} is empty", file.name())));
+		}
+		selected.push(file);
+	}
+
+	if selected.is_empty() {
+		return Err(AppError::Validation(ERROR_SELECT_FILE.to_string()));
+	}
+	Ok(selected)
+}
+
+fn upload_metadata(
+	form_data: &FormData,
+	made_on: Option<String>,
+) -> Result<UploadMetadata, AppError> {
+	let latitude = form_value(form_data, "latitude");
+	let longitude = form_value(form_data, "longitude");
+	let location = match (latitude.as_deref(), longitude.as_deref()) {
+		(None, None) => None,
+		(Some(_), None) | (None, Some(_)) =>
+			return Err(AppError::Validation(
+				"Latitude and longitude must both be provided or both be left blank".to_string(),
+			)),
+		(Some(latitude), Some(longitude)) => Some((
+			parse_coordinate(latitude, "latitude", -90.0, 90.0)?,
+			parse_coordinate(longitude, "longitude", -180.0, 180.0)?,
+		)),
+	};
+
+	Ok(UploadMetadata {
+		made_on,
+		location,
+	})
+}
+
+fn form_value(
+	form_data: &FormData,
+	name: &str,
+) -> Option<String> {
+	let value = form_data.get(name).as_string()?;
+	let value = value.trim();
+	if value.is_empty() { None } else { Some(value.to_string()) }
+}
+
+fn parse_coordinate(
+	value: &str,
+	name: &str,
+	min: f64,
+	max: f64,
+) -> Result<f64, AppError> {
+	let coordinate =
+		value.parse::<f64>().map_err(|_| AppError::Validation(format!("Invalid {name}")))?;
+	if !(min ..= max).contains(&coordinate) {
+		return Err(AppError::Validation(format!("{name} must be between {min} and {max}")));
+	}
+	Ok(coordinate)
+}
+
+async fn upload_files(
+	api_url: String,
+	files: Vec<File>,
+	metadata: UploadMetadata,
+) -> Result<(), AppError> {
+	for file in files {
+		upload_file(api_url.clone(), file, &metadata).await?;
+	}
+	Ok(())
+}
+
+async fn upload_file(
+	api_url: String,
+	file: File,
+	metadata: &UploadMetadata,
+) -> Result<(), AppError> {
+	let content_type = file.type_();
+	let file_size_bytes = file_size_bytes(&file)?;
+	let session = crate::graphql_queries::run::<CreateObjectUploadSessionMutation>(
+		api_url.clone(),
+		create_object_upload_session_mutation::Variables {
+			input: CreateObjectUploadSessionInput {
+				name: file.name(),
+				content_type,
+				file_size_bytes,
+				made_on: metadata.made_on.clone(),
+				location: metadata.location_input(),
+				publicity: PublicityOverride::Default,
+				allowed_users: Some(Vec::new()),
+			},
+		},
+	)
+	.await?;
+
+	let completed_parts = match upload_file_parts(
+		api_url.clone(),
+		&file,
+		&session.object_id,
+		session.part_size_bytes,
+		session.total_parts,
+	)
+	.await
+	{
+		Ok(completed_parts) => completed_parts,
+		Err(error) => {
+			let _ = crate::graphql_queries::run::<AbortObjectUploadMutation>(
+				api_url,
+				abort_object_upload_mutation::Variables {
+					object_id: session.object_id,
+				},
+			)
+			.await;
+			return Err(error);
+		}
+	};
+
+	crate::graphql_queries::run::<CompleteObjectUploadMutation>(
+		api_url,
+		complete_object_upload_mutation::Variables {
+			object_id: session.object_id,
+			parts: completed_parts,
+		},
+	)
+	.await?;
+	Ok(())
+}
+
+fn file_size_bytes(file: &File) -> Result<i64, AppError> {
+	let size = file.size();
+	if !size.is_finite() || size <= 0.0 || size > i64::MAX as f64 {
+		return Err(AppError::Validation(format!("Invalid file size for {}", file.name())));
+	}
+	Ok(size as i64)
+}
+
+async fn upload_file_parts(
+	api_url: String,
+	file: &File,
+	object_id: &str,
+	part_size_bytes: i64,
+	total_parts: i64,
+) -> Result<Vec<CompletedUploadPartInput>, AppError> {
+	let mut completed_parts = Vec::with_capacity(total_parts as usize);
+	let mut next_part_number = 1;
+	while next_part_number <= total_parts {
+		let last_part_number =
+			(next_part_number + MAX_PRESIGN_PARTS_PER_REQUEST as i64 - 1).min(total_parts);
+		let part_numbers = (next_part_number ..= last_part_number).collect::<Vec<_>>();
+		let mut presigned_parts = crate::graphql_queries::run::<PresignObjectUploadPartsMutation>(
+			api_url.clone(),
+			presign_object_upload_parts_mutation::Variables {
+				object_id: object_id.to_string(),
+				part_numbers,
+			},
+		)
+		.await?;
+		presigned_parts.sort_by_key(|part| part.part_number);
+
+		for part in presigned_parts {
+			completed_parts.push(upload_presigned_part(file, part_size_bytes, part).await?);
+		}
+		next_part_number = last_part_number + 1;
+	}
+
+	Ok(completed_parts)
+}
+
+async fn upload_presigned_part(
+	file: &File,
+	part_size_bytes: i64,
+	part: PresignedUploadPart,
+) -> Result<CompletedUploadPartInput, AppError> {
+	let part_start = (part.part_number - 1)
+		.checked_mul(part_size_bytes)
+		.ok_or_else(|| AppError::Validation("Upload part offset overflowed".to_string()))?;
+	let part_end = part_start
+		.checked_add(part.expected_content_length)
+		.ok_or_else(|| AppError::Validation("Upload part end offset overflowed".to_string()))?;
+	let chunk =
+		file.slice_with_f64_and_f64(part_start as f64, part_end as f64).map_err(AppError::from)?;
+	if chunk.size() as i64 != part.expected_content_length {
+		return Err(AppError::Validation(format!(
+			"Upload part {} size did not match signed content length",
+			part.part_number
+		)));
+	}
+
+	let options = RequestInit::new();
+	options.set_method(&part.method);
+	options.set_mode(RequestMode::Cors);
+	options.set_credentials(RequestCredentials::Omit);
+	options.set_body(&chunk);
+
+	let headers = Headers::new().map_err(AppError::from)?;
+	for header in part.headers {
+		headers.set(&header.name, &header.value).map_err(AppError::from)?;
+	}
+	options.set_headers(&headers);
+
+	let request = Request::new_with_str_and_init(&part.url, &options)
+		.map_err(|_| AppError::System(ERR_SYSTEM_REQUEST_FAILED.to_string()))?;
+	let window =
+		web_sys::window().ok_or_else(|| AppError::System(ERR_SYSTEM_NO_WINDOW.to_string()))?;
+	let response_value = JsFuture::from(window.fetch_with_request(&request)).await?;
+	let response = response_value
+		.dyn_into::<Response>()
+		.map_err(|_| AppError::System(ERR_SYSTEM_RESPONSE_CAST.to_string()))?;
+	if !response.ok() {
+		return Err(AppError::Network(format!(
+			"{}{} {}",
+			ERR_NETWORK_UPLOAD_FAILED,
+			response.status(),
+			response.status_text()
+		)));
+	}
+	let e_tag = response
+		.headers()
+		.get("ETag")
+		.map_err(AppError::from)?
+		.ok_or_else(|| AppError::Network("Upload response did not include ETag".to_string()))?;
+
+	Ok(CompletedUploadPartInput {
+		part_number: part.part_number,
+		e_tag,
+	})
+}
diff --git a/frontend/src/components/header.rs b/frontend/src/components/header.rs
index ebf5f92..dd140c3 100644
--- a/frontend/src/components/header.rs
+++ b/frontend/src/components/header.rs
@@ -63,7 +63,11 @@ pub fn Header(#[prop(into)] menu_open: RwSignal<bool>) -> impl IntoView {
 		let navigate = navigate.clone();
 		let api_url = config.api_url.clone();
 		spawn_local(async move {
-			let _ = LogoutMutation::run(api_url).await;
+			let _ = crate::graphql_queries::run::<LogoutMutation>(
+				api_url,
+				crate::graphql_queries::logout::logout_mutation::Variables {},
+			)
+			.await;
 			if let Some(ctx) = user_ctx {
 				ctx.refetch.run(());
 			}
@@ -186,7 +190,7 @@ pub fn Header(#[prop(into)] menu_open: RwSignal<bool>) -> impl IntoView {
 					<button
 						class="pointer-events-auto relative z-1 cursor-pointer justify-self-end rounded-full grid place-items-center w-40px aspect-square bg-#666"
 						on:click=move |_| toggle_header_menu()
-						attr:aria-label=move || {
+						aria-label=move || {
 							if menu_open.get() { ARIA_CLOSE_MENU } else { ARIA_OPEN_MENU }
 						}
 					>
diff --git a/frontend/src/components/location_markers.rs b/frontend/src/components/location_markers.rs
index 8c583b8..2efae42 100644
--- a/frontend/src/components/location_markers.rs
+++ b/frontend/src/components/location_markers.rs
@@ -57,8 +57,12 @@ pub fn LocationMarkers() -> impl IntoView {
 		Some(c) => c,
 		None => return view! { <p>{ERR_SYSTEM_CONFIG_MISSING}</p> }.into_any(),
 	};
-	let s3_objects_resource =
-		LocalResource::new(move || S3ObjectsQuery::run(config.api_url.clone()));
+	let s3_objects_resource = LocalResource::new(move || {
+		crate::graphql_queries::run::<S3ObjectsQuery>(
+			config.api_url.clone(),
+			crate::graphql_queries::s3_objects::s3_objects_query::Variables {},
+		)
+	});
 	view! {
 		<ErrorBoundary fallback=|errors| {
 			debug_error!("Failed to load markers: {:?}", errors.get());
diff --git a/frontend/src/components/s3_object.rs b/frontend/src/components/s3_object.rs
index e77bc04..db81cd7 100644
--- a/frontend/src/components/s3_object.rs
+++ b/frontend/src/components/s3_object.rs
@@ -21,9 +21,16 @@ pub fn S3Object(
 					.map(|m| m.type_().as_str().to_string())
 					.unwrap_or_default()
 					.as_str(),
-				"image" => view! { <img class=move || class.get() src=move || s3_object.url.clone() /> },
+				"image" => view! {
+					<img
+						alt=s3_object.name.clone()
+						class=move || class.get()
+						src=move || s3_object.url.clone()
+					/>
+				},
 				"video" | "audio" => view! {
 					<video
+						aria-label=s3_object.name.clone()
 						class=move || class.get()
 						src=move || s3_object.url.clone()
 						controls
diff --git a/frontend/src/components/s3_object_table_row.rs b/frontend/src/components/s3_object_table_row.rs
index 4e7e15b..ed0d8ec 100644
--- a/frontend/src/components/s3_object_table_row.rs
+++ b/frontend/src/components/s3_object_table_row.rs
@@ -113,7 +113,7 @@ pub fn S3ObjectTableRow(
 				},
 			};
 
-			match UpdateS3ObjectMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run::<UpdateS3ObjectMutation>(api_url, variables).await {
 				Ok(updated_obj) => {
 					if let Some(toaster) = toaster {
 						toaster.dispatch_toast(
diff --git a/frontend/src/components/s3_objects_table.rs b/frontend/src/components/s3_objects_table.rs
index 74f00f9..d40a124 100644
--- a/frontend/src/components/s3_objects_table.rs
+++ b/frontend/src/components/s3_objects_table.rs
@@ -22,8 +22,12 @@ use {
 			MSG_DELETE_SUCCESS,
 		},
 		dump_errors,
+		errors::AppError,
 		graphql_queries::{
-			delete_s3_objects::DeleteS3ObjectsMutation,
+			delete_s3_objects::{
+				DeleteS3ObjectsMutation,
+				delete_s3_objects_mutation,
+			},
 			s3_objects::s3_objects_query::S3ObjectsQueryS3Objects as S3Object,
 		},
 	},
@@ -42,7 +46,7 @@ use {
 
 #[component]
 pub fn S3ObjectsTable(
-	#[prop(into)] s3_objects_resource: Signal<LocalResource<Result<Vec<S3Object>, Error>>>,
+	#[prop(into)] s3_objects_resource: Signal<LocalResource<Result<Vec<S3Object>, AppError>>>,
 	#[prop(into, default = Callback::new(|_| BUTTON_CLOSE.into_any()))]
 	close_button_content: CallbackAnyView,
 	// Callback to trigger a refresh of the data after deletion
@@ -66,8 +70,11 @@ pub fn S3ObjectsTable(
 		let api_url = config.api_url.clone();
 		spawn_local(async move {
 			let ids: Vec<String> = objects.iter().map(|o| o.id.clone()).collect();
+			let variables = delete_s3_objects_mutation::Variables {
+				ids,
+			};
 
-			match DeleteS3ObjectsMutation::run(api_url, ids).await {
+			match crate::graphql_queries::run::<DeleteS3ObjectsMutation>(api_url, variables).await {
 				Ok(_) => {
 					debug_log!("{}", MSG_DELETE_SUCCESS);
 					on_change.run(());
diff --git a/frontend/src/constants.rs b/frontend/src/constants.rs
index 28d321d..598d44c 100644
--- a/frontend/src/constants.rs
+++ b/frontend/src/constants.rs
@@ -150,13 +150,8 @@ pub const ERR_SYSTEM_REQUEST_FAILED: &str = "Failed to create Request";
 pub const ERR_SYSTEM_NO_WINDOW: &str = "No window found";
 pub const ERR_SYSTEM_RESPONSE_CAST: &str = "Failed to cast response value to Response";
 pub const ERR_NETWORK_UPLOAD_FAILED: &str = "Failed to upload files. Status: ";
-pub const ERR_NETWORK_PREFIX: &str = "Network error: ";
-pub const ERR_GRAPHQL_PREFIX: &str = "GraphQL error: ";
-pub const ERR_VALIDATION_PREFIX: &str = "Validation error: ";
-pub const ERR_AUTHENTICATION_PREFIX: &str = "Authentication error: ";
-pub const ERR_SYSTEM_PREFIX: &str = "System error: ";
-pub const ERR_NOT_FOUND_MSG: &str = "Not found";
-pub const ERR_JS_PREFIX: &str = "JS error: ";
+// Display prefixes for AppError variants live in #[error(...)] attrs on
+// the variant; only constants referenced from non-Display sites remain.
 pub const ERR_CONTEXT_MISSING: &str = "Context missing: ";
 pub const ERR_UNSUPPORTED_FILE_TYPE: &str = "Unsupported file type: ";
 pub const MSG_FAILED_LOAD_USERS: &str = "Failed to load users";
diff --git a/frontend/src/errors.rs b/frontend/src/errors.rs
index 793e9c1..f5d3a33 100644
--- a/frontend/src/errors.rs
+++ b/frontend/src/errors.rs
@@ -1,48 +1,62 @@
 use {
-	crate::constants::{
-		ERR_AUTHENTICATION_PREFIX,
-		ERR_CONTEXT_MISSING,
-		ERR_GRAPHQL_PREFIX,
-		ERR_JS_PREFIX,
-		ERR_NETWORK_PREFIX,
-		ERR_NOT_FOUND_MSG,
-		ERR_SYSTEM_PREFIX,
-		ERR_VALIDATION_PREFIX,
-	},
+	crate::constants::ERR_CONTEXT_MISSING,
 	leptos::prelude::*,
-	std::fmt,
 	wasm_bindgen::JsValue,
 };
 
-#[derive(Debug, Clone, PartialEq)]
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
 pub enum AppError {
+	#[error("Network error: {0}")]
 	Network(String),
+	#[error("GraphQL error: {0}")]
 	GraphQL(String),
+	#[error("Validation error: {0}")]
 	Validation(String),
+	#[error("Authentication error: {0}")]
 	Authentication(String),
+	#[error("Forbidden: {0}")]
+	Forbidden(String),
+	#[error("System error: {0}")]
 	System(String),
+	#[error("Not found")]
 	NotFound,
+	#[error("JS error: {0}")]
 	Js(String),
 }
 
-impl fmt::Display for AppError {
-	fn fmt(
-		&self,
-		f: &mut fmt::Formatter<'_>,
-	) -> fmt::Result {
-		match self {
-			AppError::Network(msg) => write!(f, "{}{}", ERR_NETWORK_PREFIX, msg),
-			AppError::GraphQL(msg) => write!(f, "{}{}", ERR_GRAPHQL_PREFIX, msg),
-			AppError::Validation(msg) => write!(f, "{}{}", ERR_VALIDATION_PREFIX, msg),
-			AppError::Authentication(msg) => write!(f, "{}{}", ERR_AUTHENTICATION_PREFIX, msg),
-			AppError::System(msg) => write!(f, "{}{}", ERR_SYSTEM_PREFIX, msg),
-			AppError::NotFound => write!(f, "{}", ERR_NOT_FOUND_MSG),
-			AppError::Js(msg) => write!(f, "{}{}", ERR_JS_PREFIX, msg),
-		}
+impl AppError {
+	/// Maps a GraphQL response's first error (if any) to the matching variant,
+	/// reading the backend's stable `extensions.code`. Falls back to
+	/// `AppError::GraphQL` when no code is present or the code is unknown.
+	pub fn from_graphql_errors(errors: &[graphql_client::Error]) -> Option<Self> {
+		let error = errors.first()?;
+		let code = error
+			.extensions
+			.as_ref()
+			.and_then(|ext| ext.get("code"))
+			.and_then(|value| value.as_str());
+		Some(match code {
+			Some("UNAUTHORIZED") => AppError::Authentication(error.message.clone()),
+			Some("FORBIDDEN") => AppError::Forbidden(error.message.clone()),
+			Some("NOT_FOUND") => AppError::NotFound,
+			Some("VALIDATION") => AppError::Validation(error.message.clone()),
+			_ => AppError::GraphQL(error.message.clone()),
+		})
 	}
 }
 
-impl std::error::Error for AppError {
+/// Unwraps the `data` of a GraphQL response, surfacing any backend errors as
+/// the matching `AppError` variant. Use at the boundary of every `run()`
+/// function so the frontend's error UX is consistent with the backend's
+/// stable error codes.
+pub fn graphql_data<T>(response: graphql_client::Response<T>) -> Result<T, AppError> {
+	if let Some(errors) = response.errors.as_ref() &&
+		!errors.is_empty()
+	{
+		return Err(AppError::from_graphql_errors(errors)
+			.unwrap_or_else(|| AppError::GraphQL("Unknown error".to_string())));
+	}
+	response.data.ok_or_else(|| AppError::GraphQL("Empty response".to_string()))
 }
 
 impl From<JsValue> for AppError {
@@ -51,6 +65,22 @@ impl From<JsValue> for AppError {
 	}
 }
 
+// Network and serialization errors from the GraphQL HTTP client come through as
+// a boxed std::error::Error (for the authed helper) or a bare reqwest::Error
+// (for the unauthed helper); both are treated as Network failures so the UI can
+// distinguish them from server-reported GraphQL errors.
+impl From<Box<dyn std::error::Error + Send + Sync>> for AppError {
+	fn from(err: Box<dyn std::error::Error + Send + Sync>) -> Self {
+		AppError::Network(err.to_string())
+	}
+}
+
+impl From<reqwest::Error> for AppError {
+	fn from(err: reqwest::Error) -> Self {
+		AppError::Network(err.to_string())
+	}
+}
+
 #[derive(Clone, Copy)]
 pub struct ErrorContext {
 	pub error: RwSignal<Option<AppError>>,
diff --git a/frontend/src/graphql_queries.rs b/frontend/src/graphql_queries.rs
index 1fff10d..8db8ec1 100644
--- a/frontend/src/graphql_queries.rs
+++ b/frontend/src/graphql_queries.rs
@@ -1,11 +1,27 @@
+use {
+	crate::{
+		errors::{
+			AppError,
+			graphql_data,
+		},
+		post_graphql,
+		post_graphql_with_auth,
+	},
+	graphql_client::GraphQLQuery,
+};
+
+pub mod abort_object_upload;
 pub mod admin_update_user;
 pub mod change_email;
 pub mod change_password;
+pub mod complete_object_upload;
 pub mod config;
+pub mod create_object_upload_session;
 pub mod delete_s3_objects;
 pub mod login;
 pub mod logout;
 pub mod me;
+pub mod presign_object_upload_parts;
 pub mod register;
 pub mod request_password_reset;
 pub mod reset_password;
@@ -14,5 +30,27 @@ pub mod s3_objects;
 pub mod types;
 pub mod update_s3_object;
 pub mod update_user_publicity;
-pub mod upsert_s3_object;
 pub mod users;
+
+pub trait GraphqlOp: GraphQLQuery {
+	type Output;
+
+	fn extract(data: Self::ResponseData) -> Self::Output;
+}
+
+pub async fn run<O: GraphqlOp>(
+	api_url: String,
+	variables: O::Variables,
+) -> Result<O::Output, AppError> {
+	let response =
+		post_graphql_with_auth::<O, _>(&reqwest::Client::new(), api_url, variables).await?;
+	Ok(O::extract(graphql_data(response)?))
+}
+
+pub async fn run_unauthenticated<O: GraphqlOp>(
+	api_url: String,
+	variables: O::Variables,
+) -> Result<O::Output, AppError> {
+	let response = post_graphql::<O, _>(&reqwest::Client::new(), api_url, variables).await?;
+	Ok(O::extract(graphql_data(response)?))
+}
diff --git a/frontend/src/graphql_queries/abort_object_upload.rs b/frontend/src/graphql_queries/abort_object_upload.rs
new file mode 100644
index 0000000..d93922c
--- /dev/null
+++ b/frontend/src/graphql_queries/abort_object_upload.rs
@@ -0,0 +1,22 @@
+use {
+	crate::graphql_queries::GraphqlOp,
+	graphql_client::GraphQLQuery,
+};
+
+#[derive(GraphQLQuery)]
+#[graphql(
+	schema_path = "graphql/schema.json",
+	query_path = "graphql/abortObjectUpload.graphql",
+	response_derives = "Clone,Debug"
+)]
+pub struct AbortObjectUploadMutation;
+
+use self::abort_object_upload_mutation::AbortObjectUploadMutationAbortObjectUpload as AbortedObjectUpload;
+
+impl GraphqlOp for AbortObjectUploadMutation {
+	type Output = AbortedObjectUpload;
+
+	fn extract(data: abort_object_upload_mutation::ResponseData) -> Self::Output {
+		data.abort_object_upload
+	}
+}
diff --git a/frontend/src/graphql_queries/admin_update_user.rs b/frontend/src/graphql_queries/admin_update_user.rs
index 9008856..95614fe 100644
--- a/frontend/src/graphql_queries/admin_update_user.rs
+++ b/frontend/src/graphql_queries/admin_update_user.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::admin_update_user::admin_update_user_mutation::{
-			AdminUpdateUserMutationAdminUpdateUser as User,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		admin_update_user::admin_update_user_mutation::AdminUpdateUserMutationAdminUpdateUser as User,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -18,19 +14,10 @@ use {
 )]
 pub struct AdminUpdateUserMutation;
 
-impl AdminUpdateUserMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<User, Error> {
-		Ok(post_graphql_with_auth::<AdminUpdateUserMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.admin_update_user)?)
+impl GraphqlOp for AdminUpdateUserMutation {
+	type Output = User;
+
+	fn extract(data: admin_update_user_mutation::ResponseData) -> Self::Output {
+		data.admin_update_user
 	}
 }
diff --git a/frontend/src/graphql_queries/change_email.rs b/frontend/src/graphql_queries/change_email.rs
index dbeae0d..f6e3f90 100644
--- a/frontend/src/graphql_queries/change_email.rs
+++ b/frontend/src/graphql_queries/change_email.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::change_email::change_email_mutation::{
-			ChangeEmailMutationChangeEmail as User,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		change_email::change_email_mutation::ChangeEmailMutationChangeEmail as User,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -18,19 +14,10 @@ use {
 )]
 pub struct ChangeEmailMutation;
 
-impl ChangeEmailMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<User, Error> {
-		Ok(post_graphql_with_auth::<ChangeEmailMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.change_email)?)
+impl GraphqlOp for ChangeEmailMutation {
+	type Output = User;
+
+	fn extract(data: change_email_mutation::ResponseData) -> Self::Output {
+		data.change_email
 	}
 }
diff --git a/frontend/src/graphql_queries/change_password.rs b/frontend/src/graphql_queries/change_password.rs
index 6890382..34094bd 100644
--- a/frontend/src/graphql_queries/change_password.rs
+++ b/frontend/src/graphql_queries/change_password.rs
@@ -1,10 +1,6 @@
 use {
-	crate::{
-		graphql_queries::change_password::change_password_mutation::Variables,
-		post_graphql_with_auth,
-	},
+	crate::graphql_queries::GraphqlOp,
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -15,19 +11,10 @@ use {
 )]
 pub struct ChangePasswordMutation;
 
-impl ChangePasswordMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<bool, Error> {
-		Ok(post_graphql_with_auth::<ChangePasswordMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.change_password)?)
+impl GraphqlOp for ChangePasswordMutation {
+	type Output = bool;
+
+	fn extract(data: change_password_mutation::ResponseData) -> Self::Output {
+		data.change_password
 	}
 }
diff --git a/frontend/src/graphql_queries/complete_object_upload.rs b/frontend/src/graphql_queries/complete_object_upload.rs
new file mode 100644
index 0000000..3a13850
--- /dev/null
+++ b/frontend/src/graphql_queries/complete_object_upload.rs
@@ -0,0 +1,28 @@
+use {
+	crate::graphql_queries::GraphqlOp,
+	graphql_client::GraphQLQuery,
+};
+
+#[derive(GraphQLQuery)]
+#[graphql(
+	schema_path = "graphql/schema.json",
+	query_path = "graphql/completeObjectUpload.graphql",
+	extern_enums("PublicityOverride"),
+	response_derives = "Clone,Debug"
+)]
+pub struct CompleteObjectUploadMutation;
+
+pub use {
+	self::complete_object_upload_mutation::CompletedObjectUploadPartInput as CompletedUploadPartInput,
+	crate::graphql_queries::types::PublicityOverride,
+};
+
+use self::complete_object_upload_mutation::CompleteObjectUploadMutationCompleteObjectUpload as CompletedObjectUpload;
+
+impl GraphqlOp for CompleteObjectUploadMutation {
+	type Output = CompletedObjectUpload;
+
+	fn extract(data: complete_object_upload_mutation::ResponseData) -> Self::Output {
+		data.complete_object_upload
+	}
+}
diff --git a/frontend/src/graphql_queries/config.rs b/frontend/src/graphql_queries/config.rs
index cbaa033..f782f76 100644
--- a/frontend/src/graphql_queries/config.rs
+++ b/frontend/src/graphql_queries/config.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::config::config_query::{
-			ConfigQueryConfig as PublicConfig,
-			Variables,
-		},
-		post_graphql,
+	crate::graphql_queries::{
+		GraphqlOp,
+		config::config_query::ConfigQueryConfig as PublicConfig,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -18,12 +14,10 @@ use {
 )]
 pub struct ConfigQuery;
 
-impl ConfigQuery {
-	pub async fn run(api_url: String) -> Result<PublicConfig, Error> {
-		Ok(post_graphql::<ConfigQuery, _>(&reqwest::Client::new(), api_url, Variables {})
-			.await?
-			.data
-			.ok_or("Empty response".to_string())
-			.map(|response| response.config)?)
+impl GraphqlOp for ConfigQuery {
+	type Output = PublicConfig;
+
+	fn extract(data: config_query::ResponseData) -> Self::Output {
+		data.config
 	}
 }
diff --git a/frontend/src/graphql_queries/create_object_upload_session.rs b/frontend/src/graphql_queries/create_object_upload_session.rs
new file mode 100644
index 0000000..c4583d7
--- /dev/null
+++ b/frontend/src/graphql_queries/create_object_upload_session.rs
@@ -0,0 +1,31 @@
+use {
+	crate::graphql_queries::GraphqlOp,
+	graphql_client::GraphQLQuery,
+};
+
+#[derive(GraphQLQuery)]
+#[graphql(
+	schema_path = "graphql/schema.json",
+	query_path = "graphql/createObjectUploadSession.graphql",
+	extern_enums("PublicityOverride"),
+	response_derives = "Clone,Debug"
+)]
+pub struct CreateObjectUploadSessionMutation;
+
+pub use {
+	self::create_object_upload_session_mutation::{
+		CreateObjectUploadSessionInput,
+		LocationInput as UploadLocationInput,
+	},
+	crate::graphql_queries::types::PublicityOverride,
+};
+
+use self::create_object_upload_session_mutation::CreateObjectUploadSessionMutationCreateObjectUploadSession as CreatedObjectUploadSession;
+
+impl GraphqlOp for CreateObjectUploadSessionMutation {
+	type Output = CreatedObjectUploadSession;
+
+	fn extract(data: create_object_upload_session_mutation::ResponseData) -> Self::Output {
+		data.create_object_upload_session
+	}
+}
diff --git a/frontend/src/graphql_queries/delete_s3_objects.rs b/frontend/src/graphql_queries/delete_s3_objects.rs
index 6254b05..3f25351 100644
--- a/frontend/src/graphql_queries/delete_s3_objects.rs
+++ b/frontend/src/graphql_queries/delete_s3_objects.rs
@@ -1,7 +1,6 @@
 use {
-	crate::post_graphql_with_auth,
+	crate::graphql_queries::GraphqlOp,
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -12,26 +11,12 @@ use {
 )]
 pub struct DeleteS3ObjectsMutation;
 
-use self::delete_s3_objects_mutation::{
-	DeleteS3ObjectsMutationDeleteS3Objects as DeletedS3Object,
-	Variables,
-};
+use self::delete_s3_objects_mutation::DeleteS3ObjectsMutationDeleteS3Objects as DeletedS3Object;
+
+impl GraphqlOp for DeleteS3ObjectsMutation {
+	type Output = Vec<DeletedS3Object>;
 
-impl DeleteS3ObjectsMutation {
-	pub async fn run(
-		api_url: String,
-		ids: Vec<String>,
-	) -> Result<Vec<DeletedS3Object>, Error> {
-		Ok(post_graphql_with_auth::<DeleteS3ObjectsMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			Variables {
-				ids,
-			},
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.delete_s3_objects)?)
+	fn extract(data: delete_s3_objects_mutation::ResponseData) -> Self::Output {
+		data.delete_s3_objects
 	}
 }
diff --git a/frontend/src/graphql_queries/login.rs b/frontend/src/graphql_queries/login.rs
index be2f49e..57e3260 100644
--- a/frontend/src/graphql_queries/login.rs
+++ b/frontend/src/graphql_queries/login.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::login::login_mutation::{
-			LoginMutationLogin as User,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		login::login_mutation::LoginMutationLogin as User,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -18,15 +14,10 @@ use {
 )]
 pub struct LoginMutation;
 
-impl LoginMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<User, Error> {
-		Ok(post_graphql_with_auth::<LoginMutation, _>(&reqwest::Client::new(), api_url, variables)
-			.await?
-			.data
-			.ok_or("Empty response".to_string())
-			.map(|response| response.login)?)
+impl GraphqlOp for LoginMutation {
+	type Output = User;
+
+	fn extract(data: login_mutation::ResponseData) -> Self::Output {
+		data.login
 	}
 }
diff --git a/frontend/src/graphql_queries/logout.rs b/frontend/src/graphql_queries/logout.rs
index 60d844f..7ed040d 100644
--- a/frontend/src/graphql_queries/logout.rs
+++ b/frontend/src/graphql_queries/logout.rs
@@ -1,10 +1,6 @@
 use {
-	crate::{
-		graphql_queries::logout::logout_mutation::Variables,
-		post_graphql_with_auth,
-	},
+	crate::graphql_queries::GraphqlOp,
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -15,16 +11,10 @@ use {
 )]
 pub struct LogoutMutation;
 
-impl LogoutMutation {
-	pub async fn run(api_url: String) -> Result<bool, Error> {
-		Ok(post_graphql_with_auth::<LogoutMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			Variables {},
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.logout)?)
+impl GraphqlOp for LogoutMutation {
+	type Output = bool;
+
+	fn extract(data: logout_mutation::ResponseData) -> Self::Output {
+		data.logout
 	}
 }
diff --git a/frontend/src/graphql_queries/me.rs b/frontend/src/graphql_queries/me.rs
index 4f5fa2d..43f94cc 100644
--- a/frontend/src/graphql_queries/me.rs
+++ b/frontend/src/graphql_queries/me.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::me::me_query::{
-			MeQueryMe as User,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		me::me_query::MeQueryMe as User,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -24,12 +20,10 @@ pub use crate::graphql_queries::types::{
 	UserRole,
 };
 
-impl MeQuery {
-	pub async fn run(api_url: String) -> Result<Option<User>, Error> {
-		Ok(post_graphql_with_auth::<MeQuery, _>(&reqwest::Client::new(), api_url, Variables {})
-			.await?
-			.data
-			.ok_or("Empty response".to_string())
-			.map(|response| response.me)?)
+impl GraphqlOp for MeQuery {
+	type Output = Option<User>;
+
+	fn extract(data: me_query::ResponseData) -> Self::Output {
+		data.me
 	}
 }
diff --git a/frontend/src/graphql_queries/presign_object_upload_parts.rs b/frontend/src/graphql_queries/presign_object_upload_parts.rs
new file mode 100644
index 0000000..8f65a6e
--- /dev/null
+++ b/frontend/src/graphql_queries/presign_object_upload_parts.rs
@@ -0,0 +1,24 @@
+use {
+	crate::graphql_queries::GraphqlOp,
+	graphql_client::GraphQLQuery,
+};
+
+#[derive(GraphQLQuery)]
+#[graphql(
+	schema_path = "graphql/schema.json",
+	query_path = "graphql/presignObjectUploadParts.graphql",
+	response_derives = "Clone,Debug"
+)]
+pub struct PresignObjectUploadPartsMutation;
+
+use self::presign_object_upload_parts_mutation::PresignObjectUploadPartsMutationPresignObjectUploadParts as PresignedObjectUploadPart;
+
+impl GraphqlOp for PresignObjectUploadPartsMutation {
+	type Output = Vec<PresignedObjectUploadPart>;
+
+	fn extract(data: presign_object_upload_parts_mutation::ResponseData) -> Self::Output {
+		data.presign_object_upload_parts
+	}
+}
+
+pub type PresignedUploadPart = PresignedObjectUploadPart;
diff --git a/frontend/src/graphql_queries/register.rs b/frontend/src/graphql_queries/register.rs
index e5104d8..001948b 100644
--- a/frontend/src/graphql_queries/register.rs
+++ b/frontend/src/graphql_queries/register.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::register::register_mutation::{
-			RegisterMutationRegister as User,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		register::register_mutation::RegisterMutationRegister as User,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -18,19 +14,10 @@ use {
 )]
 pub struct RegisterMutation;
 
-impl RegisterMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<User, Error> {
-		Ok(post_graphql_with_auth::<RegisterMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.register)?)
+impl GraphqlOp for RegisterMutation {
+	type Output = User;
+
+	fn extract(data: register_mutation::ResponseData) -> Self::Output {
+		data.register
 	}
 }
diff --git a/frontend/src/graphql_queries/request_password_reset.rs b/frontend/src/graphql_queries/request_password_reset.rs
index 0527ffc..c1d7fd0 100644
--- a/frontend/src/graphql_queries/request_password_reset.rs
+++ b/frontend/src/graphql_queries/request_password_reset.rs
@@ -1,10 +1,6 @@
 use {
-	crate::{
-		graphql_queries::request_password_reset::request_password_reset_mutation::Variables,
-		post_graphql_with_auth,
-	},
+	crate::graphql_queries::GraphqlOp,
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -15,19 +11,10 @@ use {
 )]
 pub struct RequestPasswordResetMutation;
 
-impl RequestPasswordResetMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<bool, Error> {
-		Ok(post_graphql_with_auth::<RequestPasswordResetMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.request_password_reset)?)
+impl GraphqlOp for RequestPasswordResetMutation {
+	type Output = bool;
+
+	fn extract(data: request_password_reset_mutation::ResponseData) -> Self::Output {
+		data.request_password_reset
 	}
 }
diff --git a/frontend/src/graphql_queries/reset_password.rs b/frontend/src/graphql_queries/reset_password.rs
index a41329a..be276fe 100644
--- a/frontend/src/graphql_queries/reset_password.rs
+++ b/frontend/src/graphql_queries/reset_password.rs
@@ -1,10 +1,6 @@
 use {
-	crate::{
-		graphql_queries::reset_password::reset_password_mutation::Variables,
-		post_graphql_with_auth,
-	},
+	crate::graphql_queries::GraphqlOp,
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -15,19 +11,10 @@ use {
 )]
 pub struct ResetPasswordMutation;
 
-impl ResetPasswordMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<bool, Error> {
-		Ok(post_graphql_with_auth::<ResetPasswordMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.reset_password)?)
+impl GraphqlOp for ResetPasswordMutation {
+	type Output = bool;
+
+	fn extract(data: reset_password_mutation::ResponseData) -> Self::Output {
+		data.reset_password
 	}
 }
diff --git a/frontend/src/graphql_queries/s3_object_by_id.rs b/frontend/src/graphql_queries/s3_object_by_id.rs
index dfa66f7..c859310 100644
--- a/frontend/src/graphql_queries/s3_object_by_id.rs
+++ b/frontend/src/graphql_queries/s3_object_by_id.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::s3_object_by_id::s3_object_by_id_query::{
-			S3ObjectByIdQueryS3ObjectById as S3Object,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		s3_object_by_id::s3_object_by_id_query::S3ObjectByIdQueryS3ObjectById as S3Object,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -21,21 +17,10 @@ pub struct S3ObjectByIdQuery;
 
 pub use crate::graphql_queries::types::PublicityOverride;
 
-impl S3ObjectByIdQuery {
-	pub async fn run(
-		api_url: String,
-		id: i64,
-	) -> Result<S3Object, Error> {
-		Ok(post_graphql_with_auth::<S3ObjectByIdQuery, _>(
-			&reqwest::Client::new(),
-			api_url,
-			Variables {
-				id,
-			},
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.s3_object_by_id)?)
+impl GraphqlOp for S3ObjectByIdQuery {
+	type Output = S3Object;
+
+	fn extract(data: s3_object_by_id_query::ResponseData) -> Self::Output {
+		data.s3_object_by_id
 	}
 }
diff --git a/frontend/src/graphql_queries/s3_objects.rs b/frontend/src/graphql_queries/s3_objects.rs
index b74af2b..41c8ead 100644
--- a/frontend/src/graphql_queries/s3_objects.rs
+++ b/frontend/src/graphql_queries/s3_objects.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::s3_objects::s3_objects_query::{
-			S3ObjectsQueryS3Objects as S3Object,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		s3_objects::s3_objects_query::S3ObjectsQueryS3Objects as S3Object,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -21,16 +17,10 @@ pub struct S3ObjectsQuery;
 
 pub use crate::graphql_queries::types::PublicityOverride;
 
-impl S3ObjectsQuery {
-	pub async fn run(api_url: String) -> Result<Vec<S3Object>, Error> {
-		Ok(post_graphql_with_auth::<S3ObjectsQuery, _>(
-			&reqwest::Client::new(),
-			api_url,
-			Variables {},
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.s3_objects)?)
+impl GraphqlOp for S3ObjectsQuery {
+	type Output = Vec<S3Object>;
+
+	fn extract(data: s3_objects_query::ResponseData) -> Self::Output {
+		data.s3_objects
 	}
 }
diff --git a/frontend/src/graphql_queries/update_s3_object.rs b/frontend/src/graphql_queries/update_s3_object.rs
index c369cde..e722d98 100644
--- a/frontend/src/graphql_queries/update_s3_object.rs
+++ b/frontend/src/graphql_queries/update_s3_object.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::update_s3_object::update_s3_object_mutation::{
-			UpdateS3ObjectMutationUpdateS3Object as S3Object,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		update_s3_object::update_s3_object_mutation::UpdateS3ObjectMutationUpdateS3Object as S3Object,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -21,20 +17,10 @@ pub struct UpdateS3ObjectMutation;
 
 pub use crate::graphql_queries::types::PublicityOverride;
 
-impl UpdateS3ObjectMutation {
-	/// Executes the UpdateS3ObjectQuery against the GraphQL API.
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<S3Object, Error> {
-		Ok(post_graphql_with_auth::<UpdateS3ObjectMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.update_s3_object)?)
+impl GraphqlOp for UpdateS3ObjectMutation {
+	type Output = S3Object;
+
+	fn extract(data: update_s3_object_mutation::ResponseData) -> Self::Output {
+		data.update_s3_object
 	}
 }
diff --git a/frontend/src/graphql_queries/update_user_publicity.rs b/frontend/src/graphql_queries/update_user_publicity.rs
index bebdc71..cd84cdf 100644
--- a/frontend/src/graphql_queries/update_user_publicity.rs
+++ b/frontend/src/graphql_queries/update_user_publicity.rs
@@ -1,16 +1,10 @@
 use {
-	crate::{
-		graphql_queries::{
-			types::PublicityDefault,
-			update_user_publicity::update_user_publicity_mutation::{
-				UpdateUserPublicityMutationUpdateUserPublicity as User,
-				Variables,
-			},
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		types::PublicityDefault,
+		update_user_publicity::update_user_publicity_mutation::UpdateUserPublicityMutationUpdateUserPublicity as User,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -22,19 +16,10 @@ use {
 )]
 pub struct UpdateUserPublicityMutation;
 
-impl UpdateUserPublicityMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<User, Error> {
-		Ok(post_graphql_with_auth::<UpdateUserPublicityMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.update_user_publicity)?)
+impl GraphqlOp for UpdateUserPublicityMutation {
+	type Output = User;
+
+	fn extract(data: update_user_publicity_mutation::ResponseData) -> Self::Output {
+		data.update_user_publicity
 	}
 }
diff --git a/frontend/src/graphql_queries/upsert_s3_object.rs b/frontend/src/graphql_queries/upsert_s3_object.rs
deleted file mode 100644
index 216d5f5..0000000
--- a/frontend/src/graphql_queries/upsert_s3_object.rs
+++ /dev/null
@@ -1,39 +0,0 @@
-use {
-	crate::{
-		graphql_queries::upsert_s3_object::upsert_s3_object_mutation::{
-			UpsertS3ObjectMutationUpsertS3Object as S3Object,
-			Variables,
-		},
-		post_graphql_with_auth,
-	},
-	graphql_client::GraphQLQuery,
-	leptos::error::Error,
-};
-
-#[derive(GraphQLQuery)]
-#[graphql(
-	schema_path = "graphql/schema.json",
-	query_path = "graphql/upsertS3Object.graphql",
-	extern_enums("PublicityOverride"),
-	response_derives = "Clone,Debug"
-)]
-pub struct UpsertS3ObjectMutation;
-
-pub use crate::graphql_queries::types::PublicityOverride;
-
-impl UpsertS3ObjectMutation {
-	pub async fn run(
-		api_url: String,
-		variables: Variables,
-	) -> Result<S3Object, Error> {
-		Ok(post_graphql_with_auth::<UpsertS3ObjectMutation, _>(
-			&reqwest::Client::new(),
-			api_url,
-			variables,
-		)
-		.await?
-		.data
-		.ok_or("Empty response".to_string())
-		.map(|response| response.upsert_s3_object)?)
-	}
-}
diff --git a/frontend/src/graphql_queries/users.rs b/frontend/src/graphql_queries/users.rs
index 7149cc4..bd7291f 100644
--- a/frontend/src/graphql_queries/users.rs
+++ b/frontend/src/graphql_queries/users.rs
@@ -1,13 +1,9 @@
 use {
-	crate::{
-		graphql_queries::users::users_query::{
-			UsersQueryUsers as User,
-			Variables,
-		},
-		post_graphql_with_auth,
+	crate::graphql_queries::{
+		GraphqlOp,
+		users::users_query::UsersQueryUsers as User,
 	},
 	graphql_client::GraphQLQuery,
-	leptos::error::Error,
 };
 
 #[derive(GraphQLQuery)]
@@ -20,12 +16,10 @@ pub struct UsersQuery;
 
 pub use users_query::UserRole;
 
-impl UsersQuery {
-	pub async fn run(api_url: String) -> Result<Vec<User>, Error> {
-		Ok(post_graphql_with_auth::<UsersQuery, _>(&reqwest::Client::new(), api_url, Variables {})
-			.await?
-			.data
-			.ok_or("Empty response".to_string())
-			.map(|response| response.users)?)
+impl GraphqlOp for UsersQuery {
+	type Output = Vec<User>;
+
+	fn extract(data: users_query::ResponseData) -> Self::Output {
+		data.users
 	}
 }
diff --git a/frontend/src/lib.rs b/frontend/src/lib.rs
index 1050975..2104d57 100644
--- a/frontend/src/lib.rs
+++ b/frontend/src/lib.rs
@@ -226,7 +226,12 @@ pub fn App() -> impl IntoView {
 	let user_resource = LocalResource::new(move || {
 		trigger.get();
 		let api_url = api_url.clone();
-		async move { MeQuery::run(api_url).await.ok().flatten() }
+		async move {
+			graphql_queries::run::<MeQuery>(api_url, graphql_queries::me::me_query::Variables {})
+				.await
+				.ok()
+				.flatten()
+		}
 	});
 
 	provide_context(UserContext {
diff --git a/frontend/src/pages/account.rs b/frontend/src/pages/account.rs
index cb7c085..eff3bb7 100644
--- a/frontend/src/pages/account.rs
+++ b/frontend/src/pages/account.rs
@@ -91,7 +91,7 @@ pub fn Account() -> impl IntoView {
 			let variables = change_email_mutation::Variables {
 				new_email: email_val,
 			};
-			match ChangeEmailMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run::<ChangeEmailMutation>(api_url, variables).await {
 				Ok(_) => {
 					email_message.set(Some(MSG_EMAIL_UPDATED.to_string()));
 					email_error.set(None);
@@ -122,7 +122,7 @@ pub fn Account() -> impl IntoView {
 				old_password: old_pass,
 				new_password: new_pass,
 			};
-			match ChangePasswordMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run::<ChangePasswordMutation>(api_url, variables).await {
 				Ok(_) => {
 					password_message.set(Some(MSG_PASSWORD_UPDATED.to_string()));
 					password_error.set(None);
@@ -147,7 +147,9 @@ pub fn Account() -> impl IntoView {
 				let variables = update_user_publicity_mutation::Variables {
 					default_publicity: new_publicity,
 				};
-				match UpdateUserPublicityMutation::run(api_url, variables).await {
+				match crate::graphql_queries::run::<UpdateUserPublicityMutation>(api_url, variables)
+					.await
+				{
 					Ok(_) => {
 						publicity_message.set(Some(MSG_PUBLICITY_UPDATED.to_string()));
 						publicity_error.set(None);
diff --git a/frontend/src/pages/admin/users.rs b/frontend/src/pages/admin/users.rs
index 20cbf41..aceee5c 100644
--- a/frontend/src/pages/admin/users.rs
+++ b/frontend/src/pages/admin/users.rs
@@ -33,6 +33,7 @@ use {
 			users::{
 				UserRole,
 				UsersQuery,
+				users_query,
 			},
 		},
 	},
@@ -56,7 +57,10 @@ pub fn Users() -> impl IntoView {
 	let config = StoredValue::new(config);
 	let users_resource = LocalResource::new(move || {
 		trigger.get();
-		UsersQuery::run(config.with_value(|c| c.api_url.clone()))
+		crate::graphql_queries::run::<UsersQuery>(
+			config.with_value(|c| c.api_url.clone()),
+			users_query::Variables {},
+		)
 	});
 
 	let on_update_email = move |id: String, email: String, loading: RwSignal<bool>| {
@@ -68,7 +72,9 @@ pub fn Users() -> impl IntoView {
 				role: None,
 				email: Some(email),
 			};
-			if let Err(e) = AdminUpdateUserMutation::run(api_url, variables).await {
+			if let Err(e) =
+				crate::graphql_queries::run::<AdminUpdateUserMutation>(api_url, variables).await
+			{
 				error_ctx.report(AppError::GraphQL(e.to_string()));
 			}
 			loading.set(false);
@@ -86,7 +92,9 @@ pub fn Users() -> impl IntoView {
 				role: Some(new_role),
 				email: None,
 			};
-			if let Err(e) = AdminUpdateUserMutation::run(api_url, variables).await {
+			if let Err(e) =
+				crate::graphql_queries::run::<AdminUpdateUserMutation>(api_url, variables).await
+			{
 				error_ctx.report(AppError::GraphQL(e.to_string()));
 			}
 			loading.set(false);
@@ -102,7 +110,11 @@ pub fn Users() -> impl IntoView {
 			let variables = request_password_reset_mutation::Variables {
 				email,
 			};
-			if let Err(e) = RequestPasswordResetMutation::run(api_url, variables).await {
+			if let Err(e) = crate::graphql_queries::run_unauthenticated::<
+				RequestPasswordResetMutation,
+			>(api_url, variables)
+			.await
+			{
 				error_ctx.report(AppError::GraphQL(e.to_string()));
 			}
 			loading.set(false);
diff --git a/frontend/src/pages/objects.rs b/frontend/src/pages/objects.rs
index c106021..ac4c384 100644
--- a/frontend/src/pages/objects.rs
+++ b/frontend/src/pages/objects.rs
@@ -49,7 +49,10 @@ pub fn Objects() -> impl IntoView {
 	};
 	let s3_objects_resource = LocalResource::new(move || {
 		trigger.get();
-		S3ObjectsQuery::run(config.api_url.clone())
+		crate::graphql_queries::run::<S3ObjectsQuery>(
+			config.api_url.clone(),
+			crate::graphql_queries::s3_objects::s3_objects_query::Variables {},
+		)
 	});
 
 	// Callback to update the trigger, effectively reloading the table
diff --git a/frontend/src/pages/register.rs b/frontend/src/pages/register.rs
index a91ef35..28eaaa5 100644
--- a/frontend/src/pages/register.rs
+++ b/frontend/src/pages/register.rs
@@ -45,7 +45,14 @@ pub fn Register() -> impl IntoView {
 	let api_url = config.api_url.clone();
 	let config_resource = LocalResource::new(move || {
 		let api_url = api_url.clone();
-		async move { ConfigQuery::run(api_url).await.ok() }
+		async move {
+			crate::graphql_queries::run_unauthenticated::<ConfigQuery>(
+				api_url,
+				crate::graphql_queries::config::config_query::Variables {},
+			)
+			.await
+			.ok()
+		}
 	});
 
 	let navigate_effect = navigate.clone();
@@ -82,7 +89,7 @@ pub fn Register() -> impl IntoView {
 				password: password_val,
 			};
 
-			match RegisterMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run::<RegisterMutation>(api_url, variables).await {
 				Ok(_) => {
 					navigate("/sign-in", Default::default());
 				}
diff --git a/frontend/src/pages/reset_password.rs b/frontend/src/pages/reset_password.rs
index b69bf4f..6d66bce 100644
--- a/frontend/src/pages/reset_password.rs
+++ b/frontend/src/pages/reset_password.rs
@@ -71,7 +71,7 @@ pub fn ResetPassword() -> impl IntoView {
 				new_password: password_val,
 			};
 
-			match ResetPasswordMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run::<ResetPasswordMutation>(api_url, variables).await {
 				Ok(_) => {
 					success_message.set(Some(MSG_RESET_SUCCESS.to_string()));
 					error_message.set(None);
diff --git a/frontend/src/pages/sign_in.rs b/frontend/src/pages/sign_in.rs
index 47bef91..6a49443 100644
--- a/frontend/src/pages/sign_in.rs
+++ b/frontend/src/pages/sign_in.rs
@@ -57,7 +57,14 @@ pub fn SignIn() -> impl IntoView {
 	let api_url = config.api_url.clone();
 	let config_resource = LocalResource::new(move || {
 		let api_url = api_url.clone();
-		async move { ConfigQuery::run(api_url).await.ok() }
+		async move {
+			crate::graphql_queries::run_unauthenticated::<ConfigQuery>(
+				api_url,
+				crate::graphql_queries::config::config_query::Variables {},
+			)
+			.await
+			.ok()
+		}
 	});
 
 	let on_sign_in = move |_| {
@@ -78,7 +85,7 @@ pub fn SignIn() -> impl IntoView {
 				password: password_val,
 			};
 
-			match LoginMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run::<LoginMutation>(api_url, variables).await {
 				Ok(_) => {
 					let _ = window().location().set_href("/");
 				}
@@ -110,7 +117,11 @@ pub fn SignIn() -> impl IntoView {
 				email: email_val,
 			};
 
-			match RequestPasswordResetMutation::run(api_url, variables).await {
+			match crate::graphql_queries::run_unauthenticated::<RequestPasswordResetMutation>(
+				api_url, variables,
+			)
+			.await
+			{
 				Ok(_) => {
 					success_message.set(Some(MSG_RESET_EMAIL_SENT.to_string()));
 					error_message.set(None);
diff --git a/frontend/style/uno.css b/frontend/style/uno.css
index 4a1bab5..914da53 100644
--- a/frontend/style/uno.css
+++ b/frontend/style/uno.css
@@ -515,14 +515,16 @@ input:where([type='button'], [type='reset'], [type='submit']),
 .mx-auto{margin-inline:auto;}
 .mb-2{margin-bottom:calc(var(--spacing) * 2);}
 .mb-4{margin-bottom:calc(var(--spacing) * 4);}
+.me{margin-inline-end:calc(var(--spacing) * 4);}
 .mt-100px{margin-top:100px;}
 .p-0{padding:calc(var(--spacing) * 0);}
 .p-2{padding:calc(var(--spacing) * 2);}
 .p-20px{padding:20px;}
 .p-4{padding:calc(var(--spacing) * 4);}
 .p-unset{padding:unset;}
-.px-2{padding-inline:calc(var(--spacing) * 2);}
+.px,
 .px-4{padding-inline:calc(var(--spacing) * 4);}
+.px-2{padding-inline:calc(var(--spacing) * 2);}
 .py-2{padding-block:calc(var(--spacing) * 2);}
 .py-4{padding-block:calc(var(--spacing) * 4);}
 .pt-10{padding-top:calc(var(--spacing) * 10);}
diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json
new file mode 100644
index 0000000..fe79981
--- /dev/null
+++ b/frontend/tsconfig.json
@@ -0,0 +1,20 @@
+{
+	"compilerOptions": {
+		"target": "ES2022",
+		"module": "NodeNext",
+		"moduleResolution": "NodeNext",
+		"strict": true,
+		"noEmit": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"skipLibCheck": true,
+		"types": [
+			"node",
+			"@playwright/test"
+		]
+	},
+	"include": [
+		"playwright.config.ts",
+		"e2e/**/*.ts"
+	]
+}
diff --git a/justfile b/justfile
index 0855da7..ed5560c 100644
--- a/justfile
+++ b/justfile
@@ -1,5 +1,6 @@
 set dotenv-load
 set shell := ["bash", "-c"]
+set tempdir := "/tmp"
 
 # Load the Nix development environment via direnv for local recipes. CI invokes
 # recipes via `nix develop --command just`, so SKIP_DIRENV=1 bypasses the prefix.
@@ -19,16 +20,44 @@ default:
 allow-env:
 	direnv allow
 
-# Start PostgreSQL and Minio servers.
+# Start PostgreSQL and RustFS servers.
 servers:
 	{{ direnv_prefix }} nix run ./devenv
 
+# Remove local service state created by current and legacy service recipes.
+clean-service-state:
+	rm -rf data/postgres data/rustfs data/pg1 data/minio1
+
 # Start backend server.
 backend:
-	{{ direnv_prefix }} bash -c 'cd backend; {{ log_prefix }} bacon run -- {{ release_flag }}'
+	{{ direnv_prefix }} bash -c 'cd backend; {{ log_prefix }} bacon run -- --bin backend {{ release_flag }}'
+
+# Create local frontend runtime config when missing.
+frontend-config:
+	@if [ ! -f frontend/public/config.json ]; then \
+		cp frontend/config.example.json frontend/public/config.json; \
+		echo "Created frontend/public/config.json from frontend/config.example.json"; \
+	fi
+
+# Create a local backend TOML config from the example when missing. Opt-in: the
+# backend only reads it when MEMORY_MAP_CONFIG points at it (otherwise it is
+# configured purely from the environment, e.g. .env).
+config:
+	@if [ ! -f config.toml ]; then \
+		cp config.example.toml config.toml; \
+		echo "Created config.toml from config.example.toml; set MEMORY_MAP_CONFIG=\$(pwd)/config.toml to use it"; \
+	fi
+
+# Require an explicit frontend runtime config for builds that copy /config.json.
+require-frontend-config:
+	@if [ ! -f frontend/public/config.json ]; then \
+		echo "ERROR: frontend/public/config.json is required for frontend-build." >&2; \
+		echo "Run 'just frontend-config' for local development or provide a deployment-specific config file." >&2; \
+		exit 1; \
+	fi
 
 # Start frontend server. https://github.com/trunk-rs/trunk/issues/732#issuecomment-2391810077
-frontend:
+frontend: frontend-config
 	{{ direnv_prefix }} bash -c 'cd frontend; ping -c 1 8.8.8.8 && pnpm i --prefer-offline; env -u NO_COLOR trunk serve {{ release_flag }} --skip-version-check --offline --open'
 
 # Regenerate "frontend/graphql/schema.json".
@@ -66,7 +95,7 @@ doc *args:
 	set -euo pipefail
 
 	ascii_roots=()
-	for path in README.md CONTRIBUTING.md AGENTS.md frontend/README.md backend/src frontend/src shared/src; do
+	for path in README.md CONTRIBUTING.md AGENTS.md docs frontend/README.md backend/src frontend/src shared/src; do
 		if [[ -e "$path" ]]; then
 			ascii_roots+=("$path")
 		fi
@@ -81,7 +110,7 @@ doc *args:
 		exit 1
 	fi
 
-	{{ direnv_prefix }} lychee --offline --no-progress README.md frontend/README.md
+	{{ direnv_prefix }} lychee --offline --no-progress README.md docs/deployment.md frontend/README.md
 
 	if [ "$#" -eq 0 ]; then
 		set -- --workspace --all-features --no-deps
@@ -99,9 +128,13 @@ build *args:
 	{{ direnv_prefix }} cargo build "$@"
 
 # Build the frontend application through Trunk.
-frontend-build:
+frontend-build: require-frontend-config
 	{{ direnv_prefix }} bash -c 'cd frontend && pnpm install --frozen-lockfile --prefer-offline && env -u NO_COLOR trunk build {{ release_flag }} --skip-version-check'
 
+# Typecheck the Playwright E2E TypeScript support code and specs.
+frontend-e2e-typecheck:
+	{{ direnv_prefix }} bash -c 'cd frontend && pnpm install --frozen-lockfile --prefer-offline && pnpm run e2e:typecheck'
+
 # Run any cargo subcommand except test; use `just test` for tests.
 [positional-arguments]
 cargo *args:
@@ -117,57 +150,167 @@ cargo *args:
 	fi
 	{{ direnv_prefix }} cargo "$@"
 
-# Run tests with output caching. Re-runs only when tracked source files change.
+# Run tests.
 [positional-arguments]
 test *args:
 	#!/usr/bin/env bash
 	set -euo pipefail
-	mkdir -p .cache/test-output
-	ARGS=$(printf '%q ' "$@")
-	CONTENT_HASH=$(git ls-files -z | xargs -0 md5sum 2>/dev/null | md5sum | cut -c1-32 || true)
-	CACHE_KEY=$(echo "${ARGS}:${CONTENT_HASH}" | md5sum | cut -c1-12)
-	OUTPUT_FILE=".cache/test-output/test-output-${CACHE_KEY}.txt"
-	STATUS_FILE=".cache/test-output/test-output-${CACHE_KEY}.status"
-	if [ -s "$OUTPUT_FILE" ] && [ -s "$STATUS_FILE" ]; then
-		echo "No source changes, proceeding to print cached test outputs:"
-		(trap '' PIPE; cat "$OUTPUT_FILE")
-		echo "Finished printing cached test outputs."
-		exit "$(cat "$STATUS_FILE")"
-	else
-		echo "No cached outputs currently present, proceeding to run tests:"
-		TEMP_FILE="${OUTPUT_FILE}.tmp"
-		TEMP_STATUS_FILE="${STATUS_FILE}.tmp"
-		rm -f "$TEMP_FILE"
-		rm -f "$TEMP_STATUS_FILE"
-		trap 'rm -f "$TEMP_FILE" "$TEMP_STATUS_FILE"' INT TERM HUP
-		RC=0
-		if [ "$#" -eq 0 ]; then
-			set -- --workspace --all-features
+	if [ "$#" -eq 0 ]; then
+		set -- --workspace --all-features
+	fi
+	{{ direnv_prefix }} cargo test "$@"
+
+# Run storage integration tests against a configured S3-compatible service.
+[positional-arguments]
+storage-test *args:
+	#!/usr/bin/env bash
+	set -euo pipefail
+	if [ "$#" -eq 0 ]; then
+		set -- --ignored --nocapture
+	fi
+	{{ direnv_prefix }} cargo test -p backend --test storage -- "$@"
+
+# Run storage integration tests against the headless local service graph.
+storage-ci:
+	#!/usr/bin/env bash
+	set -euo pipefail
+	source scripts/e2e-env.sh
+	source scripts/service-graph.sh
+
+	log_file="${PROCESS_COMPOSE_LOG:-process-compose.log}"
+	port="${PROCESS_COMPOSE_PORT:-8080}"
+
+	memory_map_with_process_compose "$port" "$log_file" -- env BACKEND_TEST_REQUIRE_SERVICE=true just storage-test
+
+# Run backend API/auth integration tests against configured local services.
+[positional-arguments]
+backend-integration-test *args:
+	#!/usr/bin/env bash
+	set -euo pipefail
+	if [ "$#" -eq 0 ]; then
+		set -- --ignored --nocapture --test-threads=1
+	fi
+	source scripts/e2e-env.sh
+	BACKEND_TEST_REQUIRE_SERVICE=true {{ direnv_prefix }} cargo test -p backend --test api_auth -- "$@"
+
+# Run backend API/auth integration tests against the headless local service graph.
+backend-integration:
+	#!/usr/bin/env bash
+	set -euo pipefail
+
+	source scripts/e2e-env.sh
+	source scripts/service-graph.sh
+	log_dir="${BACKEND_INTEGRATION_LOG_DIR:-backend-integration-logs}"
+	log_file="${BACKEND_INTEGRATION_PROCESS_COMPOSE_LOG:-$log_dir/process-compose.log}"
+	port="${BACKEND_INTEGRATION_PROCESS_COMPOSE_PORT:-$PROCESS_COMPOSE_PORT}"
+
+	memory_map_require_port_free "$E2E_PG_PORT" "PostgreSQL"
+	memory_map_require_port_free "$E2E_STORAGE_API_PORT" "RustFS API"
+	memory_map_require_port_free "$E2E_STORAGE_CONSOLE_PORT" "RustFS console"
+	memory_map_require_port_free "$port" "process-compose"
+
+	memory_map_with_process_compose "$port" "$log_file" -- just backend-integration-test
+
+# Run Playwright E2E tests against the headless local service graph.
+e2e: frontend-config frontend-e2e-typecheck
+	#!/usr/bin/env bash
+	set -euo pipefail
+
+	source scripts/e2e-env.sh
+	source scripts/service-graph.sh
+	mkdir -p "$E2E_LOG_DIR"
+
+	run_e2e() {
+		local backend_pid=""
+		local frontend_pid=""
+
+		cleanup_app_servers() {
+			local status=$?
+
+			trap - EXIT INT TERM
+			memory_map_stop_pid "${frontend_pid:-}"
+			memory_map_stop_pid "${backend_pid:-}"
+			exit "$status"
+		}
+		trap cleanup_app_servers EXIT INT TERM
+
+		{{ direnv_prefix }} bash -c 'cd backend && exec cargo run --bin backend' > "$E2E_LOG_DIR/backend.log" 2>&1 &
+		backend_pid=$!
+		if ! memory_map_wait_for_http "$E2E_BACKEND_URL/" 120 "GraphiQL"; then
+			echo "ERROR: backend did not become ready; see $E2E_LOG_DIR/backend.log." >&2
+			tail -n 80 "$E2E_LOG_DIR/backend.log" >&2 || true
+			return 1
 		fi
-		{{ direnv_prefix }} cargo test "$@" > "$TEMP_FILE" 2>&1 || RC=$?
-		if [ ! -s "$TEMP_FILE" ]; then
-			rm -f "$TEMP_FILE"
-			rm -f "$TEMP_STATUS_FILE"
-			exit "${RC:-1}"
+
+		{{ direnv_prefix }} bash -c 'cd frontend && exec env -u NO_COLOR trunk serve --address "$E2E_FRONTEND_HOST" --port "$E2E_FRONTEND_PORT" --no-autoreload --skip-version-check --offline' > "$E2E_LOG_DIR/frontend.log" 2>&1 &
+		frontend_pid=$!
+		if ! memory_map_wait_for_http "$E2E_FRONTEND_URL/" 120; then
+			echo "ERROR: frontend did not become ready; see $E2E_LOG_DIR/frontend.log." >&2
+			tail -n 80 "$E2E_LOG_DIR/frontend.log" >&2 || true
+			return 1
 		fi
-		printf '%s\n' "$RC" > "$TEMP_STATUS_FILE"
-		mv "$TEMP_FILE" "$OUTPUT_FILE"
-		mv "$TEMP_STATUS_FILE" "$STATUS_FILE"
-		(trap '' PIPE; cat "$OUTPUT_FILE")
-		echo "Test outputs and exit status saved to cache files:"
-		echo "  output: $OUTPUT_FILE"
-		echo "  status: $STATUS_FILE"
-		exit "$RC"
-	fi
 
-# Remove build artifacts and test cache.
+		{{ direnv_prefix }} bash -c 'cd frontend && exec pnpm exec playwright test'
+	}
+
+	memory_map_require_port_free "$E2E_PG_PORT" "PostgreSQL"
+	memory_map_require_port_free "$E2E_STORAGE_API_PORT" "RustFS API"
+	memory_map_require_port_free "$E2E_STORAGE_CONSOLE_PORT" "RustFS console"
+	memory_map_require_port_free "$E2E_BACKEND_PORT" "backend"
+	memory_map_require_port_free "$E2E_FRONTEND_PORT" "frontend"
+	memory_map_require_port_free "$PROCESS_COMPOSE_PORT" "process-compose"
+
+	{{ direnv_prefix }} cargo build --bin backend
+	{{ direnv_prefix }} bash -c 'cd frontend && pnpm install --frozen-lockfile --prefer-offline && env -u NO_COLOR trunk build --skip-version-check --offline'
+
+	memory_map_with_process_compose "$PROCESS_COMPOSE_PORT" "$PROCESS_COMPOSE_LOG" -- run_e2e
+
+# Remove build artifacts.
 clean:
 	{{ direnv_prefix }} cargo clean
-	rm -rf .cache/test-output/
 
 # Check licenses and advisories with cargo-deny.
 deny:
-	{{ direnv_prefix }} cargo deny check
+	#!/usr/bin/env bash
+	set -euo pipefail
+
+	if [[ "${CI:-}" == "true" && -z "${CARGO_HOME:-}" ]]; then
+		export CARGO_HOME="${RUNNER_TEMP:-$PWD/.cargo-deny}/cargo-home"
+	fi
+	cargo_home="${CARGO_HOME:-$HOME/.cargo}"
+
+	prepare_ci_advisory_db() {
+		local advisory_root="$cargo_home/advisory-dbs"
+		# cargo-deny 0.18+ documents this stable directory for the default RustSec DB URL.
+		local advisory_db="$advisory_root/advisory-db-3157b0e258782691"
+
+		mkdir -p "$advisory_root"
+		if [[ ! -d "$advisory_db/.git" ]]; then
+			rm -rf "$advisory_db"
+			git clone --depth 1 https://github.com/rustsec/advisory-db "$advisory_db"
+		fi
+
+		git -C "$advisory_db" fetch --depth 1 origin HEAD
+		git -C "$advisory_db" reset --hard FETCH_HEAD
+	}
+
+	run_deny() {
+		if [[ "${CI:-}" == "true" ]]; then
+			prepare_ci_advisory_db
+			{{ direnv_prefix }} cargo deny check --disable-fetch
+		else
+			{{ direnv_prefix }} cargo deny check
+		fi
+	}
+
+	if ! run_deny; then
+		if [[ "${CI:-}" != "true" ]]; then
+			exit 1
+		fi
+
+		rm -rf "$cargo_home/advisory-dbs"
+		run_deny
+	fi
 
 # Run an allowed just recipe and filter its output with a caller-provided rg regex.
 [positional-arguments]
@@ -185,7 +328,7 @@ filtered recipe filter *args:
 	fi
 
 	case "$recipe" in
-		build|check|clippy|deny|doc|fmt|frontend-build|test|verify) ;;
+		backend-integration|backend-integration-test|build|check|clippy|deny|doc|e2e|fmt|frontend-build|frontend-e2e-typecheck|shellcheck|storage-ci|storage-test|test|verify|verify-fast) ;;
 		*)
 			echo "ERROR: unsupported filtered recipe: $recipe" >&2
 			exit 2
@@ -222,16 +365,37 @@ filtered recipe filter *args:
 
 	exit "$recipe_status"
 
+# Check shell scripts with ShellCheck.
+shellcheck:
+	{{ direnv_prefix }} shellcheck --enable=all scripts/*.sh
+
 # Scan for hardcoded values.
 scan-hardcoded:
 	./scripts/scan_hardcoded.sh
 
-# Verify: fmt, check, clippy, deny, doc, test, frontend build.
-verify:
+# Fast verification: every check that does not need the local service graph
+# (fmt, shell scripts, check, clippy, deny, doc, test, frontend build). The
+# service-skipping unit/integration tests run here too. Use this for the quick
+# inner loop; use `verify` for the full suite.
+verify-fast:
 	just fmt
+	just shellcheck
 	just check
 	just clippy
 	just deny
 	just doc
 	just test
+	just frontend-e2e-typecheck
+	just frontend-config
 	just frontend-build
+
+# Full verification: everything `verify-fast` runs, then the service-backed
+# suites (storage integration, backend integration, and Playwright e2e), each
+# of which stands up the local Postgres + RustFS service graph. Runs serially
+# and is slow; CI runs these as parallel jobs instead. Run this before opening a
+# pull request to validate everything locally in one command.
+verify:
+	just verify-fast
+	just storage-ci
+	just backend-integration
+	just e2e
diff --git a/memory-map.code-workspace b/memory-map.code-workspace
deleted file mode 100644
index 26369f3..0000000
--- a/memory-map.code-workspace
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "folders": [
-    {
-      "path": "."
-    }
-  ],
-  "settings": {
-    "rust-analyzer.procMacro.ignored": {
-      "leptos_macro": [
-        // optional:
-        // "component",
-        "server"
-      ]
-    },
-    "rust-analyzer.cargo.features": "all",
-    "rust-analyzer.rustfmt.overrideCommand": ["leptosfmt", "--stdin", "--rustfmt"]
-  }
-}
diff --git a/scripts/e2e-env.sh b/scripts/e2e-env.sh
new file mode 100644
index 0000000..9fbb1b6
--- /dev/null
+++ b/scripts/e2e-env.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+#
+# Shared local/CI integration-test environment.
+#
+# The Nix flake defines the PostgreSQL/RustFS process-compose graph, while the
+# just recipes decide which test command to run. This file keeps the ports,
+# URLs, backend MEMORY_MAP__... settings, storage credentials, and log defaults
+# consistent across storage-ci, backend-integration, and e2e.
+
+export E2E_FRONTEND_HOST="${E2E_FRONTEND_HOST:-127.0.0.1}"
+export E2E_FRONTEND_PORT="${E2E_FRONTEND_PORT:-3000}"
+export E2E_BACKEND_HOST="${E2E_BACKEND_HOST:-127.0.0.1}"
+export E2E_BACKEND_PORT="${E2E_BACKEND_PORT:-8000}"
+export E2E_PG_HOST="${E2E_PG_HOST:-127.0.0.1}"
+export E2E_PG_PORT="${E2E_PG_PORT:-5432}"
+export E2E_STORAGE_API_PORT="${E2E_STORAGE_API_PORT:-9000}"
+export E2E_STORAGE_CONSOLE_PORT="${E2E_STORAGE_CONSOLE_PORT:-9001}"
+
+export E2E_FRONTEND_URL="${E2E_FRONTEND_URL:-http://${E2E_FRONTEND_HOST}:${E2E_FRONTEND_PORT}}"
+export E2E_BACKEND_URL="${E2E_BACKEND_URL:-http://${E2E_BACKEND_HOST}:${E2E_BACKEND_PORT}}"
+
+export MEMORY_MAP__FRONTEND__URL="${E2E_FRONTEND_URL}"
+export MEMORY_MAP__CORS__ALLOWED_ORIGINS="${E2E_FRONTEND_URL}"
+export MEMORY_MAP__SERVER__HOST="${E2E_BACKEND_HOST}"
+export MEMORY_MAP__SERVER__PORT="${E2E_BACKEND_PORT}"
+
+export MEMORY_MAP__PG__DBNAME="db"
+export MEMORY_MAP__PG__HOST="${E2E_PG_HOST}"
+export MEMORY_MAP__PG__PORT="${E2E_PG_PORT}"
+
+export MEMORY_MAP__STORAGE__ENDPOINT_URL="http://127.0.0.1:${E2E_STORAGE_API_PORT}/"
+export MEMORY_MAP__STORAGE__ACCESS_KEY="memorymapdev"
+export MEMORY_MAP__STORAGE__SECRET_KEY="memorymapdevsecret"
+export MEMORY_MAP__STORAGE__BUCKET_NAME="memory-map"
+export MEMORY_MAP__STORAGE__REGION="us-east-1"
+export MEMORY_MAP__STORAGE__FORCE_PATH_STYLE="true"
+export MEMORY_MAP__STORAGE__PRESIGNED_URL_TTL_SECONDS="604800"
+
+export MEMORY_MAP__AUTH__COOKIE_SECRET="memory-map-local-e2e-cookie-secret-at-least-64-bytes-long-0001-extra"
+export MEMORY_MAP__AUTH__ENABLE_REGISTRATION="true"
+
+export MEMORY_MAP__SMTP__HOST="smtp.example.test"
+export MEMORY_MAP__SMTP__USER="memory-map-e2e"
+export MEMORY_MAP__SMTP__PASS="memory-map-e2e-password"
+export MEMORY_MAP__SMTP__FROM="noreply@example.test"
+
+export RUST_LOG="${E2E_RUST_LOG:-debug}"
+
+export PROCESS_COMPOSE_PORT="${E2E_PROCESS_COMPOSE_PORT:-8080}"
+# process-compose-flake exposes this project's wrapper as `default`.
+export PROCESS_COMPOSE_BIN="${PROCESS_COMPOSE_BIN:-default}"
+export E2E_LOG_DIR="${E2E_LOG_DIR:-e2e-logs}"
+export PROCESS_COMPOSE_LOG="${PROCESS_COMPOSE_LOG:-${E2E_LOG_DIR}/process-compose.log}"
diff --git a/scripts/scan_hardcoded.sh b/scripts/scan_hardcoded.sh
index cbc6b7b..a072b13 100755
--- a/scripts/scan_hardcoded.sh
+++ b/scripts/scan_hardcoded.sh
@@ -28,15 +28,18 @@ echo "--- Hardcoded UI Strings (Heuristic) ---"
 # Looks for strings starting with a capital letter, at least 2 chars long, inside .rs files.
 # Excludes const definitions, logging, and attributes.
 # We use a negative lookahead/exclusion via grep -v to filter out common false positives.
-git grep -nE "\"[A-Z][a-zA-Z0-9 '.,?!-]{1,}\"" -- "*.rs" | grep -vE "(const |use |log::|tracing::|println!|eprintln!|panic!|expect\(|debug_error!|#\[)"
+ui_string_matches="$(git grep -nE "\"[A-Z][a-zA-Z0-9 '.,?!-]{1,}\"" -- "*.rs" || true)"
+if [[ -n ${ui_string_matches} ]]; then
+	grep -vE "(const |use |log::|tracing::|println!|eprintln!|panic!|expect\(|debug_error!|#\[)" <<<"${ui_string_matches}" || true
+fi
 echo ""
 
 echo "--- Hardcoded Hex Colors ---"
 git grep -nE "#[0-9a-fA-F]{3,6}" -- "*.rs" "*.css" "*.scss" "*.html"
 echo ""
 
-echo "--- Local Variables with Literals (let ... = \"...\") ---"
-git grep -nE "let [a-z_]+.*= \".*\"" -- ':!*.lock' ':!*.yaml' ':!*.md' ':!*.json'
+echo '--- Local Variables with Literals (let ... = "...") ---'
+git grep -nE 'let [a-z_]+.*= ".*"' -- ':!*.lock' ':!*.yaml' ':!*.md' ':!*.json'
 echo ""
 
 echo "--- Local Variables with Numbers (let ... = 123) ---"
diff --git a/scripts/service-graph.sh b/scripts/service-graph.sh
new file mode 100644
index 0000000..9d9386e
--- /dev/null
+++ b/scripts/service-graph.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+#
+# Shared helpers for recipes that run against the local service graph.
+#
+# The service definitions live in devenv/flake.nix, but the just recipes still
+# need shell glue for direnv-vs-CI execution, process-compose startup,
+# readiness checks, port preflight checks, and reliable cleanup traps. Keeping
+# that logic here avoids duplicating fragile Bash blocks in each recipe.
+
+memory_map_run_in_dev_env() {
+	if [[ -n "${SKIP_DIRENV:-}" ]]; then
+		"$@"
+	else
+		direnv exec . "$@"
+	fi
+}
+
+memory_map_start_process_compose() {
+	if [[ "${PROCESS_COMPOSE_BIN:-default}" == "default" ]]; then
+		memory_map_run_in_dev_env nix run ./devenv -- "$@"
+	else
+		memory_map_run_in_dev_env "${PROCESS_COMPOSE_BIN}" "$@"
+	fi
+}
+
+memory_map_process_compose() {
+	memory_map_run_in_dev_env process-compose "$@"
+}
+
+memory_map_wait_for_http() {
+	local url="$1"
+	local timeout_seconds="$2"
+	local match_substring="${3:-}"
+	local response
+
+	for _ in $(seq 1 "${timeout_seconds}"); do
+		if response=$(curl --fail --silent --show-error --max-time 2 "${url}" 2>/dev/null); then
+			if [[ -z "${match_substring}" || "${response}" == *"${match_substring}"* ]]; then
+				return 0
+			fi
+		fi
+		sleep 1
+	done
+
+	echo "ERROR: ${url} did not become ready within ${timeout_seconds}s." >&2
+	return 1
+}
+
+memory_map_require_port_free() {
+	local port="$1"
+	local name="$2"
+
+	if (echo >"/dev/tcp/127.0.0.1/${port}") >/dev/null 2>&1; then
+		echo "ERROR: ${name} port ${port} is already in use." >&2
+		exit 1
+	fi
+}
+
+memory_map_stop_pid() {
+	local pid="${1:-}"
+
+	if [[ -n "${pid}" ]] && kill -0 "${pid}" 2>/dev/null; then
+		kill "${pid}" 2>/dev/null || true
+		wait "${pid}" 2>/dev/null || true
+	fi
+}
+
+memory_map_with_process_compose() {
+	local port="$1"
+	local log_path="$2"
+	shift 2
+
+	if [[ "${1:-}" != "--" ]]; then
+		echo "ERROR: memory_map_with_process_compose requires -- before the command." >&2
+		return 2
+	fi
+	shift
+	if [[ "$#" -eq 0 ]]; then
+		echo "ERROR: memory_map_with_process_compose requires a command." >&2
+		return 2
+	fi
+
+	local log_dir
+	log_dir="$(dirname "${log_path}")"
+	if [[ ${log_dir} != "." ]]; then
+		mkdir -p "${log_dir}"
+	fi
+	local down_log="${log_dir}/process-compose-down.log"
+	local process_compose_started=false
+
+	memory_map_process_compose_cleanup() {
+		if [[ "${process_compose_started}" == "true" ]]; then
+			set +e
+			memory_map_process_compose --port "${port}" down >>"${down_log}" 2>&1
+			set -e
+			process_compose_started=false
+		fi
+	}
+
+	# shellcheck disable=SC2329
+	memory_map_process_compose_exit() {
+		local status=$?
+
+		memory_map_process_compose_cleanup
+		trap - EXIT INT TERM
+		exit "${status}"
+	}
+	trap 'memory_map_process_compose_exit' EXIT INT TERM
+
+	memory_map_start_process_compose --port "${port}" --log-file "${log_path}" --detached -t=false --logs-truncate
+	process_compose_started=true
+	memory_map_process_compose --port "${port}" project is-ready --wait
+
+	set +e
+	(
+		set -e
+		"$@"
+	)
+	local command_status=$?
+	set -e
+
+	memory_map_process_compose_cleanup
+	trap - EXIT INT TERM
+	return "${command_status}"
+}
diff --git a/shared/src/lib.rs b/shared/src/lib.rs
index b8245ef..785ed55 100644
--- a/shared/src/lib.rs
+++ b/shared/src/lib.rs
@@ -17,3 +17,9 @@ pub const ALLOWED_MIME_TYPES: [&str; 17] = [
 	"audio/aac",
 	"audio/mp4",
 ];
+
+/// Maximum number of upload parts the backend will presign in one request, and
+/// the chunk size the frontend uses when batching presign requests. The two
+/// MUST agree, so this constant is the single source of truth shared across the
+/// API boundary.
+pub const MAX_PRESIGN_PARTS_PER_REQUEST: usize = 100;