From 6359231b99808fc921810b9cc81d4bed92d8d05d Mon Sep 17 00:00:00 2001
From: Mplan <mplan_@outlook.com>
Date: Sun, 14 Jun 2026 16:57:50 +0800
Subject: [PATCH] Migrate from Supabase to local Express API

---
 .gitignore                               |    3 +
 README.md                                |   54 +-
 package-lock.json                        | 2020 +++++++++++++++++++++-
 package.json                             |   16 +-
 server/index.ts                          |  790 +++++++++
 server/schema.sql                        |  104 ++
 src/composables/useUpload.ts             |  148 +-
 src/lib/amap.ts                          |   26 +-
 src/lib/api.ts                           |  155 ++
 src/lib/authEmail.ts                     |  152 --
 src/lib/supabase.ts                      |   15 -
 src/stores/auth.ts                       |  123 +-
 src/stores/clouds.ts                     |    9 +-
 src/stores/encyclopedia.ts               |   60 +-
 src/stores/profile.ts                    |  119 +-
 src/views/admin/AdminView.vue            |  144 +-
 src/views/auth/AuthConfirmView.vue       |   79 +-
 src/views/auth/ForgotPasswordView.vue    |   16 +-
 src/views/auth/RegisterView.vue          |    6 +-
 src/views/auth/ResetPasswordView.vue     |  202 +--
 src/views/encyclopedia/CloudTypeView.vue |   29 +-
 src/views/gallery/GalleryView.vue        |   97 +-
 src/views/map/MapView.vue                |   27 +-
 vite.config.ts                           |    6 +
 24 files changed, 3208 insertions(+), 1192 deletions(-)
 create mode 100644 server/index.ts
 create mode 100644 server/schema.sql
 create mode 100644 src/lib/api.ts
 delete mode 100644 src/lib/authEmail.ts
 delete mode 100644 src/lib/supabase.ts

diff --git a/.gitignore b/.gitignore
index 34a578b..31b09e3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,6 @@ dist-ssr
 *.njsproj
 *.sln
 *.sw?
+
+# Lock
+package-lock.json
diff --git a/README.md b/README.md
index 33895ab..329092a 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,53 @@
-# Vue 3 + TypeScript + Vite
+# OpenCloud
 
-This template should help get you started developing with Vue 3 and TypeScript in Vite. The template uses Vue 3 `<script setup>` SFCs, check out the [script setup docs](https://v3.vuejs.org/api/sfc-script-setup.html#sfc-script-setup) to learn more.
+Vue 3 + Vite frontend with a Node/Express API, PostgreSQL, and local file storage.
 
-Learn more about the recommended Project Setup and IDE Support in the [Vue Docs TypeScript Guide](https://vuejs.org/guide/typescript/overview.html#project-setup).
+## Development
+
+1. Install dependencies:
+
+   ```bash
+   npm install
+   ```
+
+2. Create the PostgreSQL schema:
+
+   ```bash
+   psql "$DATABASE_URL" -f server/schema.sql
+   ```
+
+3. Start the API:
+
+   ```bash
+   DATABASE_URL="postgres://..." JWT_SECRET="change-me" npm run dev:api
+   ```
+
+4. Start the frontend:
+
+   ```bash
+   npm run dev
+   ```
+
+The Vite dev server proxies `/api/*` and `/uploads/*` to `http://localhost:3001`.
+
+## Scripts
+
+- `npm run dev` - Vite frontend dev server
+- `npm run dev:api` - Express API with `tsx`
+- `npm run build` - Vue typecheck and production frontend build
+- `npm run typecheck:api` - Typecheck the Express API
+- `npm run start:api` - Start the API with Node and `tsx`
+
+## Environment
+
+Frontend:
+
+- `VITE_AMAP_KEY` - required for map features
+- `VITE_SITE_URL` - optional canonical URL for generated SEO files
+
+Backend:
+
+- `DATABASE_URL` - PostgreSQL connection string
+- `JWT_SECRET` - secret for HTTP-only JWT session cookies
+- `PORT` - API port, defaults to `3001`
+- `UPLOAD_ROOT` - optional upload directory, defaults to `server/uploads`
diff --git a/package-lock.json b/package-lock.json
index e40a8ae..a6d8cdb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,22 +9,33 @@
       "version": "0.0.0",
       "dependencies": {
         "@amap/amap-jsapi-loader": "^1.0.1",
-        "@supabase/supabase-js": "^2.106.1",
         "@vercel/speed-insights": "^2.0.0",
+        "bcryptjs": "^3.0.3",
+        "cookie-parser": "^1.4.7",
+        "express": "^5.2.1",
+        "jsonwebtoken": "^9.0.3",
+        "multer": "^2.1.1",
         "naive-ui": "^2.44.1",
+        "pg": "^8.21.0",
         "pinia": "^3.0.4",
         "vue": "^3.5.34",
         "vue-router": "^4.5.0"
       },
       "devDependencies": {
         "@tailwindcss/vite": "^4.3.0",
+        "@types/cookie-parser": "^1.4.10",
+        "@types/express": "^5.0.6",
+        "@types/jsonwebtoken": "^9.0.10",
+        "@types/multer": "^2.1.0",
         "@types/node": "^24.12.3",
+        "@types/pg": "^8.20.0",
         "@vercel/analytics": "^2.0.1",
         "@vicons/tabler": "^0.13.0",
         "@vicons/utils": "^0.1.4",
         "@vitejs/plugin-vue": "^6.0.6",
         "@vue/tsconfig": "^0.9.1",
         "tailwindcss": "^4.3.0",
+        "tsx": "^4.22.4",
         "typescript": "~6.0.2",
         "vite": "^8.0.12",
         "vue-tsc": "^3.2.8"
@@ -140,6 +151,448 @@
       "integrity": "sha512-kBJtf7PH6aWwZ6fka3zQ0p6SBYzx4fl1LoZXE2RrnYST9Xljm7WfKJrU4g/Xr3Beg72MLrp1AWNUmuYJTL7Cow==",
       "license": "MIT"
     },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmmirror.com/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -506,90 +959,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@supabase/auth-js": {
-      "version": "2.106.1",
-      "resolved": "https://registry.npmmirror.com/@supabase/auth-js/-/auth-js-2.106.1.tgz",
-      "integrity": "sha512-7eyheXfAGwkB9bZewJPs+N3UYt6kra2JG6mIxNEgbkvcO15PLD1e75PTIUEYYl3zrifm3GrpShVl7QZxKrXO/w==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "2.8.1"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@supabase/functions-js": {
-      "version": "2.106.1",
-      "resolved": "https://registry.npmmirror.com/@supabase/functions-js/-/functions-js-2.106.1.tgz",
-      "integrity": "sha512-XbOPnR2mW7jp/EcW447xmGwCa+/Wc00Hkw8t4tUIJjRsHQ4xAESsLKcyLRhRJjJoUnJVXUlC+w0wUxUCM7CG2A==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "2.8.1"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@supabase/phoenix": {
-      "version": "0.4.2",
-      "resolved": "https://registry.npmmirror.com/@supabase/phoenix/-/phoenix-0.4.2.tgz",
-      "integrity": "sha512-YSAGnmDAfuleFCVt3CeurQZAhxRfXWeZIIkwp7NhYzQ1UwW6ePSnzsFAiUm/mbCkfoCf70QQHKW/K6RKh52a4A==",
-      "license": "MIT"
-    },
-    "node_modules/@supabase/postgrest-js": {
-      "version": "2.106.1",
-      "resolved": "https://registry.npmmirror.com/@supabase/postgrest-js/-/postgrest-js-2.106.1.tgz",
-      "integrity": "sha512-Qbn6d2lqiqeaBX1Uko0e/hL90dtQGRN6CG2wMVQtJpRFstlVW45qmUTyTOsiB8dYUWu1fWYo4YzJuDbokGv3tQ==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "2.8.1"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@supabase/realtime-js": {
-      "version": "2.106.1",
-      "resolved": "https://registry.npmmirror.com/@supabase/realtime-js/-/realtime-js-2.106.1.tgz",
-      "integrity": "sha512-eQCYri5E8KsjpDgC7g28cOOS2britjUWdNSJluFMainqrMRepzjOnaxqXc3RoAz7H0dxmBrfLUNF6NGP8C+YaA==",
-      "license": "MIT",
-      "dependencies": {
-        "@supabase/phoenix": "^0.4.2",
-        "tslib": "2.8.1"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@supabase/storage-js": {
-      "version": "2.106.1",
-      "resolved": "https://registry.npmmirror.com/@supabase/storage-js/-/storage-js-2.106.1.tgz",
-      "integrity": "sha512-HWcLIhqinhWKpOQ3WzglR2unjW0eh9J7yOu3IZrZNIEkraK4La/HDvTqndljGsNw0itPtyHhuKBxRoPG1VUARw==",
-      "license": "MIT",
-      "dependencies": {
-        "iceberg-js": "^0.8.1",
-        "tslib": "2.8.1"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@supabase/supabase-js": {
-      "version": "2.106.1",
-      "resolved": "https://registry.npmmirror.com/@supabase/supabase-js/-/supabase-js-2.106.1.tgz",
-      "integrity": "sha512-gP4HurGkGu7Z3xoOCjtAI17BKKp7jpsmwY0Ssbsks9XQRzJ7ZhK7LxfLdBSYgUdgZCQgjRK+Mr7+cl4Gxrk0Rw==",
-      "license": "MIT",
-      "dependencies": {
-        "@supabase/auth-js": "2.106.1",
-        "@supabase/functions-js": "2.106.1",
-        "@supabase/postgrest-js": "2.106.1",
-        "@supabase/realtime-js": "2.106.1",
-        "@supabase/storage-js": "2.106.1"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
     "node_modules/@tailwindcss/node": {
       "version": "4.3.0",
       "resolved": "https://registry.npmmirror.com/@tailwindcss/node/-/node-4.3.0.tgz",
@@ -885,6 +1254,80 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@types/body-parser": {
+      "version": "1.19.6",
+      "resolved": "https://registry.npmmirror.com/@types/body-parser/-/body-parser-1.19.6.tgz",
+      "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/connect": "*",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/connect": {
+      "version": "3.4.38",
+      "resolved": "https://registry.npmmirror.com/@types/connect/-/connect-3.4.38.tgz",
+      "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/cookie-parser": {
+      "version": "1.4.10",
+      "resolved": "https://registry.npmmirror.com/@types/cookie-parser/-/cookie-parser-1.4.10.tgz",
+      "integrity": "sha512-B4xqkqfZ8Wek+rCOeRxsjMS9OgvzebEzzLYw7NHYuvzb7IdxOkI0ZHGgeEBX4PUM7QGVvNSK60T3OvWj3YfBRg==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/express": "*"
+      }
+    },
+    "node_modules/@types/express": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmmirror.com/@types/express/-/express-5.0.6.tgz",
+      "integrity": "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/body-parser": "*",
+        "@types/express-serve-static-core": "^5.0.0",
+        "@types/serve-static": "^2"
+      }
+    },
+    "node_modules/@types/express-serve-static-core": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmmirror.com/@types/express-serve-static-core/-/express-serve-static-core-5.1.1.tgz",
+      "integrity": "sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@types/qs": "*",
+        "@types/range-parser": "*",
+        "@types/send": "*"
+      }
+    },
+    "node_modules/@types/http-errors": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmmirror.com/@types/http-errors/-/http-errors-2.0.5.tgz",
+      "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/jsonwebtoken": {
+      "version": "9.0.10",
+      "resolved": "https://registry.npmmirror.com/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz",
+      "integrity": "sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/ms": "*",
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/lodash": {
       "version": "4.17.24",
       "resolved": "https://registry.npmmirror.com/@types/lodash/-/lodash-4.17.24.tgz",
@@ -900,6 +1343,23 @@
         "@types/lodash": "*"
       }
     },
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmmirror.com/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/multer": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmmirror.com/@types/multer/-/multer-2.1.0.tgz",
+      "integrity": "sha512-zYZb0+nJhOHtPpGDb3vqPjwpdeGlGC157VpkqNQL+UU2qwoacoQ7MpsAmUptI/0Oa127X32JzWDqQVEXp2RcIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/express": "*"
+      }
+    },
     "node_modules/@types/node": {
       "version": "24.12.4",
       "resolved": "https://registry.npmmirror.com/@types/node/-/node-24.12.4.tgz",
@@ -910,6 +1370,53 @@
         "undici-types": "~7.16.0"
       }
     },
+    "node_modules/@types/pg": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmmirror.com/@types/pg/-/pg-8.20.0.tgz",
+      "integrity": "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "pg-protocol": "*",
+        "pg-types": "^2.2.0"
+      }
+    },
+    "node_modules/@types/qs": {
+      "version": "6.15.1",
+      "resolved": "https://registry.npmmirror.com/@types/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/range-parser": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmmirror.com/@types/range-parser/-/range-parser-1.2.7.tgz",
+      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/send": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmmirror.com/@types/send/-/send-1.2.1.tgz",
+      "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/serve-static": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmmirror.com/@types/serve-static/-/serve-static-2.2.0.tgz",
+      "integrity": "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/http-errors": "*",
+        "@types/node": "*"
+      }
+    },
     "node_modules/@vercel/analytics": {
       "version": "2.0.1",
       "resolved": "https://registry.npmmirror.com/@vercel/analytics/-/analytics-2.0.1.tgz",
@@ -1261,6 +1768,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/accepts": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/accepts/-/accepts-2.0.0.tgz",
+      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "^3.0.0",
+        "negotiator": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/alien-signals": {
       "version": "3.2.1",
       "resolved": "https://registry.npmmirror.com/alien-signals/-/alien-signals-3.2.1.tgz",
@@ -1268,12 +1788,27 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/append-field": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmmirror.com/append-field/-/append-field-1.0.0.tgz",
+      "integrity": "sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==",
+      "license": "MIT"
+    },
     "node_modules/async-validator": {
       "version": "4.2.5",
       "resolved": "https://registry.npmmirror.com/async-validator/-/async-validator-4.2.5.tgz",
       "integrity": "sha512-7HhHjtERjqlNbZtqNqy2rckN/SpOOlmDliet+lP7k+eKZEjPk3DgyeU9lIXLdeLz0uBbbVp+9Qdow9wJWgwwfg==",
       "license": "MIT"
     },
+    "node_modules/bcryptjs": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmmirror.com/bcryptjs/-/bcryptjs-3.0.3.tgz",
+      "integrity": "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==",
+      "license": "BSD-3-Clause",
+      "bin": {
+        "bcrypt": "bin/bcrypt"
+      }
+    },
     "node_modules/birpc": {
       "version": "2.9.0",
       "resolved": "https://registry.npmmirror.com/birpc/-/birpc-2.9.0.tgz",
@@ -1283,6 +1818,156 @@
         "url": "https://github.com/sponsors/antfu"
       }
     },
+    "node_modules/body-parser": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmmirror.com/body-parser/-/body-parser-2.2.2.tgz",
+      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "^3.1.2",
+        "content-type": "^1.0.5",
+        "debug": "^4.4.3",
+        "http-errors": "^2.0.0",
+        "iconv-lite": "^0.7.0",
+        "on-finished": "^2.4.1",
+        "qs": "^6.14.1",
+        "raw-body": "^3.0.1",
+        "type-is": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/buffer-equal-constant-time": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+      "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmmirror.com/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "license": "MIT"
+    },
+    "node_modules/busboy": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmmirror.com/busboy/-/busboy-1.6.0.tgz",
+      "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
+      "dependencies": {
+        "streamsearch": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=10.16.0"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmmirror.com/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmmirror.com/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmmirror.com/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/concat-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/concat-stream/-/concat-stream-2.0.0.tgz",
+      "integrity": "sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==",
+      "engines": [
+        "node >= 6.0"
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.0.2",
+        "typedarray": "^0.0.6"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmmirror.com/content-disposition/-/content-disposition-1.1.0.tgz",
+      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmmirror.com/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmmirror.com/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-parser": {
+      "version": "1.4.7",
+      "resolved": "https://registry.npmmirror.com/cookie-parser/-/cookie-parser-1.4.7.tgz",
+      "integrity": "sha512-nGUvgXnotP3BsjiLX2ypbQnWoGUPIIfHQNZkkC668ntrzGWEZVW70HDEB1qnNGMicPje6EttlIgzo51YSwNQGw==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "0.7.2",
+        "cookie-signature": "1.0.6"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmmirror.com/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
+      "license": "MIT"
+    },
     "node_modules/copy-anything": {
       "version": "4.0.5",
       "resolved": "https://registry.npmmirror.com/copy-anything/-/copy-anything-4.0.5.tgz",
@@ -1339,6 +2024,32 @@
         "date-fns": "^3.0.0 || ^4.0.0"
       }
     },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmmirror.com/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmmirror.com/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -1349,6 +2060,44 @@
         "node": ">=8"
       }
     },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ecdsa-sig-formatter": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmmirror.com/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
+      "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmmirror.com/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/enhanced-resolve": {
       "version": "5.21.5",
       "resolved": "https://registry.npmmirror.com/enhanced-resolve/-/enhanced-resolve-5.21.5.tgz",
@@ -1375,18 +2124,157 @@
         "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmmirror.com/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmmirror.com/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmmirror.com/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmmirror.com/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
     "node_modules/estree-walker": {
       "version": "2.0.2",
       "resolved": "https://registry.npmmirror.com/estree-walker/-/estree-walker-2.0.2.tgz",
       "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
       "license": "MIT"
     },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmmirror.com/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/evtd": {
       "version": "0.2.4",
       "resolved": "https://registry.npmmirror.com/evtd/-/evtd-0.2.4.tgz",
       "integrity": "sha512-qaeGN5bx63s/AXgQo8gj6fBkxge+OoLddLniox5qtLAEY5HSnuSlISXVPxnSae1dWblvTh4/HoMIB+mbMsvZzw==",
       "license": "MIT"
     },
+    "node_modules/express": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmmirror.com/express/-/express-5.2.1.tgz",
+      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "^2.0.0",
+        "body-parser": "^2.2.1",
+        "content-disposition": "^1.0.0",
+        "content-type": "^1.0.5",
+        "cookie": "^0.7.1",
+        "cookie-signature": "^1.2.1",
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "finalhandler": "^2.1.0",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.0",
+        "merge-descriptors": "^2.0.0",
+        "mime-types": "^3.0.0",
+        "on-finished": "^2.4.1",
+        "once": "^1.4.0",
+        "parseurl": "^1.3.3",
+        "proxy-addr": "^2.0.7",
+        "qs": "^6.14.0",
+        "range-parser": "^1.2.1",
+        "router": "^2.2.0",
+        "send": "^1.1.0",
+        "serve-static": "^2.2.0",
+        "statuses": "^2.0.1",
+        "type-is": "^2.0.1",
+        "vary": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/express/node_modules/cookie-signature": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmmirror.com/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.6.0"
+      }
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmmirror.com/fdir/-/fdir-6.5.0.tgz",
@@ -1405,6 +2293,45 @@
         }
       }
     },
+    "node_modules/finalhandler": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmmirror.com/finalhandler/-/finalhandler-2.1.1.tgz",
+      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "on-finished": "^2.4.1",
+        "parseurl": "^1.3.3",
+        "statuses": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmmirror.com/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/fresh/-/fresh-2.0.0.tgz",
+      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmmirror.com/fsevents/-/fsevents-2.3.3.tgz",
@@ -1420,6 +2347,64 @@
         "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmmirror.com/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmmirror.com/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmmirror.com/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
       "resolved": "https://registry.npmmirror.com/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -1427,6 +2412,30 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmmirror.com/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmmirror.com/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/highlight.js": {
       "version": "11.11.1",
       "resolved": "https://registry.npmmirror.com/highlight.js/-/highlight.js-11.11.1.tgz",
@@ -1442,15 +2451,63 @@
       "integrity": "sha512-Yc+BQe8SvoXH1643Qez1zqLRmbA5rCL+sSmk6TVos0LWVfNIB7PGncdlId77WzLGSIB5KaWgTaNTs2lNVEI6VQ==",
       "license": "MIT"
     },
-    "node_modules/iceberg-js": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmmirror.com/iceberg-js/-/iceberg-js-0.8.1.tgz",
-      "integrity": "sha512-1dhVQZXhcHje7798IVM+xoo/1ZdVfzOMIc8/rgVSijRK38EDqOJoGula9N/8ZI5RD8QTxNQtK/Gozpr+qUqRRA==",
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmmirror.com/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmmirror.com/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmmirror.com/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmmirror.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
       "license": "MIT",
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">= 0.10"
       }
     },
+    "node_modules/is-promise": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmmirror.com/is-promise/-/is-promise-4.0.0.tgz",
+      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
+      "license": "MIT"
+    },
     "node_modules/is-what": {
       "version": "5.5.0",
       "resolved": "https://registry.npmmirror.com/is-what/-/is-what-5.5.0.tgz",
@@ -1473,6 +2530,49 @@
         "jiti": "lib/jiti-cli.mjs"
       }
     },
+    "node_modules/jsonwebtoken": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmmirror.com/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
+      "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+      "license": "MIT",
+      "dependencies": {
+        "jws": "^4.0.1",
+        "lodash.includes": "^4.3.0",
+        "lodash.isboolean": "^3.0.3",
+        "lodash.isinteger": "^4.0.4",
+        "lodash.isnumber": "^3.0.3",
+        "lodash.isplainobject": "^4.0.6",
+        "lodash.isstring": "^4.0.1",
+        "lodash.once": "^4.0.0",
+        "ms": "^2.1.1",
+        "semver": "^7.5.4"
+      },
+      "engines": {
+        "node": ">=12",
+        "npm": ">=6"
+      }
+    },
+    "node_modules/jwa": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmmirror.com/jwa/-/jwa-2.0.1.tgz",
+      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-equal-constant-time": "^1.0.1",
+        "ecdsa-sig-formatter": "1.0.11",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/jws": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmmirror.com/jws/-/jws-4.0.1.tgz",
+      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+      "license": "MIT",
+      "dependencies": {
+        "jwa": "^2.0.1",
+        "safe-buffer": "^5.0.1"
+      }
+    },
     "node_modules/lightningcss": {
       "version": "1.32.0",
       "resolved": "https://registry.npmmirror.com/lightningcss/-/lightningcss-1.32.0.tgz",
@@ -1758,6 +2858,48 @@
       "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
       "license": "MIT"
     },
+    "node_modules/lodash.includes": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmmirror.com/lodash.includes/-/lodash.includes-4.3.0.tgz",
+      "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isboolean": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmmirror.com/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
+      "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isinteger": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmmirror.com/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
+      "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isnumber": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmmirror.com/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
+      "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isplainobject": {
+      "version": "4.0.6",
+      "resolved": "https://registry.npmmirror.com/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
+      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isstring": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmmirror.com/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
+      "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.once": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmmirror.com/lodash.once/-/lodash.once-4.1.1.tgz",
+      "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
+      "license": "MIT"
+    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmmirror.com/magic-string/-/magic-string-0.30.21.tgz",
@@ -1767,12 +2909,73 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmmirror.com/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmmirror.com/media-typer/-/media-typer-1.1.0.tgz",
+      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
+      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.54.0",
+      "resolved": "https://registry.npmmirror.com/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmmirror.com/mime-types/-/mime-types-3.0.2.tgz",
+      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "^1.54.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/mitt": {
       "version": "3.0.1",
       "resolved": "https://registry.npmmirror.com/mitt/-/mitt-3.0.1.tgz",
       "integrity": "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==",
       "license": "MIT"
     },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmmirror.com/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
     "node_modules/muggle-string": {
       "version": "0.4.1",
       "resolved": "https://registry.npmmirror.com/muggle-string/-/muggle-string-0.4.1.tgz",
@@ -1780,6 +2983,68 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/multer": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmmirror.com/multer/-/multer-2.1.1.tgz",
+      "integrity": "sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==",
+      "license": "MIT",
+      "dependencies": {
+        "append-field": "^1.0.0",
+        "busboy": "^1.6.0",
+        "concat-stream": "^2.0.0",
+        "type-is": "^1.6.18"
+      },
+      "engines": {
+        "node": ">= 10.16.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/multer/node_modules/media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmmirror.com/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/multer/node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmmirror.com/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/multer/node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmmirror.com/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/multer/node_modules/type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmmirror.com/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/naive-ui": {
       "version": "2.44.1",
       "resolved": "https://registry.npmmirror.com/naive-ui/-/naive-ui-2.44.1.tgz",
@@ -1830,6 +3095,57 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
+    "node_modules/negotiator": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmmirror.com/negotiator/-/negotiator-1.0.0.tgz",
+      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmmirror.com/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmmirror.com/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmmirror.com/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmmirror.com/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/path-browserify": {
       "version": "1.0.1",
       "resolved": "https://registry.npmmirror.com/path-browserify/-/path-browserify-1.0.1.tgz",
@@ -1837,12 +3153,111 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/path-to-regexp": {
+      "version": "8.4.2",
+      "resolved": "https://registry.npmmirror.com/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
+      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/perfect-debounce": {
       "version": "1.0.0",
       "resolved": "https://registry.npmmirror.com/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
       "integrity": "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==",
       "license": "MIT"
     },
+    "node_modules/pg": {
+      "version": "8.21.0",
+      "resolved": "https://registry.npmmirror.com/pg/-/pg-8.21.0.tgz",
+      "integrity": "sha512-AUP1EYJuHraQGsVoCQVIcM7TEJVGtDzxWtGFZd8rds9d+CCXlU5Js1rYgfLNvxy9iJrpHjGrRjoi/3BT9fRyiA==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-connection-string": "^2.13.0",
+        "pg-pool": "^3.14.0",
+        "pg-protocol": "^1.14.0",
+        "pg-types": "2.2.0",
+        "pgpass": "1.0.5"
+      },
+      "engines": {
+        "node": ">= 16.0.0"
+      },
+      "optionalDependencies": {
+        "pg-cloudflare": "^1.4.0"
+      },
+      "peerDependencies": {
+        "pg-native": ">=3.0.1"
+      },
+      "peerDependenciesMeta": {
+        "pg-native": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/pg-cloudflare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmmirror.com/pg-cloudflare/-/pg-cloudflare-1.4.0.tgz",
+      "integrity": "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/pg-connection-string": {
+      "version": "2.13.0",
+      "resolved": "https://registry.npmmirror.com/pg-connection-string/-/pg-connection-string-2.13.0.tgz",
+      "integrity": "sha512-EMnU9E2fSULdsbErBbMaXJvFeD9B4+nPcM3f+4lsiCR0BHLPrLVjv3DbyM2hgQQviKJaTWIRRTjKjWlHg3p2ig==",
+      "license": "MIT"
+    },
+    "node_modules/pg-int8": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/pg-int8/-/pg-int8-1.0.1.tgz",
+      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/pg-pool": {
+      "version": "3.14.0",
+      "resolved": "https://registry.npmmirror.com/pg-pool/-/pg-pool-3.14.0.tgz",
+      "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "pg": ">=8.0"
+      }
+    },
+    "node_modules/pg-protocol": {
+      "version": "1.14.0",
+      "resolved": "https://registry.npmmirror.com/pg-protocol/-/pg-protocol-1.14.0.tgz",
+      "integrity": "sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA==",
+      "license": "MIT"
+    },
+    "node_modules/pg-types": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmmirror.com/pg-types/-/pg-types-2.2.0.tgz",
+      "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-int8": "1.0.1",
+        "postgres-array": "~2.0.0",
+        "postgres-bytea": "~1.0.0",
+        "postgres-date": "~1.0.4",
+        "postgres-interval": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/pgpass": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmmirror.com/pgpass/-/pgpass-1.0.5.tgz",
+      "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.1.0"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmmirror.com/picocolors/-/picocolors-1.1.1.tgz",
@@ -1911,6 +3326,111 @@
         "node": "^10 || ^12 || >=14"
       }
     },
+    "node_modules/postgres-array": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/postgres-array/-/postgres-array-2.0.0.tgz",
+      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postgres-bytea": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/postgres-bytea/-/postgres-bytea-1.0.1.tgz",
+      "integrity": "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-date": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmmirror.com/postgres-date/-/postgres-date-1.0.7.tgz",
+      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-interval": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmmirror.com/postgres-interval/-/postgres-interval-1.2.0.tgz",
+      "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "xtend": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmmirror.com/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.15.2",
+      "resolved": "https://registry.npmmirror.com/qs/-/qs-6.15.2.tgz",
+      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmmirror.com/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmmirror.com/raw-body/-/raw-body-3.0.2.tgz",
+      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.7.0",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmmirror.com/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/rfdc": {
       "version": "1.4.1",
       "resolved": "https://registry.npmmirror.com/rfdc/-/rfdc-1.4.1.tgz",
@@ -1951,12 +3471,189 @@
         "@rolldown/binding-win32-x64-msvc": "1.0.1"
       }
     },
+    "node_modules/router": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmmirror.com/router/-/router-2.2.0.tgz",
+      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "is-promise": "^4.0.0",
+        "parseurl": "^1.3.3",
+        "path-to-regexp": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmmirror.com/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmmirror.com/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
     "node_modules/seemly": {
       "version": "0.3.10",
       "resolved": "https://registry.npmmirror.com/seemly/-/seemly-0.3.10.tgz",
       "integrity": "sha512-2+SMxtG1PcsL0uyhkumlOU6Qo9TAQ/WyH7tthnPIOQB05/12jz9naq6GZ6iZ6ApVsO3rr2gsnTf3++OV63kE1Q==",
       "license": "MIT"
     },
+    "node_modules/semver": {
+      "version": "7.8.4",
+      "resolved": "https://registry.npmmirror.com/semver/-/semver-7.8.4.tgz",
+      "integrity": "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/send": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmmirror.com/send/-/send-1.2.1.tgz",
+      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.1",
+        "mime-types": "^3.0.2",
+        "ms": "^2.1.3",
+        "on-finished": "^2.4.1",
+        "range-parser": "^1.2.1",
+        "statuses": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/serve-static": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmmirror.com/serve-static/-/serve-static-2.2.1.tgz",
+      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "parseurl": "^1.3.3",
+        "send": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmmirror.com/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmmirror.com/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmmirror.com/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/source-map-js": {
       "version": "1.2.1",
       "resolved": "https://registry.npmmirror.com/source-map-js/-/source-map-js-1.2.1.tgz",
@@ -1975,6 +3672,41 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/split2": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmmirror.com/split2/-/split2-4.2.0.tgz",
+      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">= 10.x"
+      }
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmmirror.com/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/streamsearch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmmirror.com/streamsearch/-/streamsearch-1.1.0.tgz",
+      "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmmirror.com/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
     "node_modules/superjson": {
       "version": "2.2.6",
       "resolved": "https://registry.npmmirror.com/superjson/-/superjson-2.2.6.tgz",
@@ -2025,6 +3757,15 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
     "node_modules/treemate": {
       "version": "0.3.11",
       "resolved": "https://registry.npmmirror.com/treemate/-/treemate-0.3.11.tgz",
@@ -2035,7 +3776,65 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmmirror.com/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
+      "dev": true,
+      "license": "0BSD",
+      "optional": true
+    },
+    "node_modules/tsx": {
+      "version": "4.22.4",
+      "resolved": "https://registry.npmmirror.com/tsx/-/tsx-4.22.4.tgz",
+      "integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "~0.28.0"
+      },
+      "bin": {
+        "tsx": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmmirror.com/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^2.0.0",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/type-is/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmmirror.com/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/typedarray": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmmirror.com/typedarray/-/typedarray-0.0.6.tgz",
+      "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==",
+      "license": "MIT"
     },
     "node_modules/typescript": {
       "version": "6.0.3",
@@ -2058,6 +3857,30 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmmirror.com/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmmirror.com/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmmirror.com/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/vdirs": {
       "version": "0.1.8",
       "resolved": "https://registry.npmmirror.com/vdirs/-/vdirs-0.1.8.tgz",
@@ -2243,6 +4066,21 @@
       "peerDependencies": {
         "vue": "^3.0.11"
       }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmmirror.com/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
+    "node_modules/xtend": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmmirror.com/xtend/-/xtend-4.0.2.tgz",
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4"
+      }
     }
   }
 }
diff --git a/package.json b/package.json
index 65b0d22..b1a7225 100644
--- a/package.json
+++ b/package.json
@@ -5,27 +5,41 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
+    "dev:api": "tsx server/index.ts",
     "build": "vue-tsc -b && vite build",
+    "typecheck:api": "tsc --noEmit --ignoreConfig --target es2023 --module nodenext --moduleResolution nodenext --esModuleInterop --skipLibCheck server/index.ts",
+    "start:api": "node --import tsx server/index.ts",
     "preview": "vite preview"
   },
   "dependencies": {
     "@amap/amap-jsapi-loader": "^1.0.1",
-    "@supabase/supabase-js": "^2.106.1",
     "@vercel/speed-insights": "^2.0.0",
+    "bcryptjs": "^3.0.3",
+    "cookie-parser": "^1.4.7",
+    "express": "^5.2.1",
+    "jsonwebtoken": "^9.0.3",
+    "multer": "^2.1.1",
     "naive-ui": "^2.44.1",
+    "pg": "^8.21.0",
     "pinia": "^3.0.4",
     "vue": "^3.5.34",
     "vue-router": "^4.5.0"
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.3.0",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/express": "^5.0.6",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/multer": "^2.1.0",
     "@types/node": "^24.12.3",
+    "@types/pg": "^8.20.0",
     "@vercel/analytics": "^2.0.1",
     "@vicons/tabler": "^0.13.0",
     "@vicons/utils": "^0.1.4",
     "@vitejs/plugin-vue": "^6.0.6",
     "@vue/tsconfig": "^0.9.1",
     "tailwindcss": "^4.3.0",
+    "tsx": "^4.22.4",
     "typescript": "~6.0.2",
     "vite": "^8.0.12",
     "vue-tsc": "^3.2.8"
diff --git a/server/index.ts b/server/index.ts
new file mode 100644
index 0000000..5c2c428
--- /dev/null
+++ b/server/index.ts
@@ -0,0 +1,790 @@
+import express, { type NextFunction, type Request, type Response } from 'express'
+import cookieParser from 'cookie-parser'
+import bcrypt from 'bcryptjs'
+import jwt from 'jsonwebtoken'
+import multer from 'multer'
+import { mkdir, rm, writeFile } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import pg from 'pg'
+
+type Role = 'user' | 'admin'
+type CloudStatus = 'pending' | 'approved' | 'rejected'
+
+interface AuthUser {
+  id: string
+  email: string
+  username: string
+  avatar_url: string | null
+  role: Role
+  is_disabled: boolean
+  created_at: string
+}
+
+interface JwtPayload {
+  sub: string
+}
+
+declare global {
+  namespace Express {
+    interface Request {
+      user?: AuthUser
+    }
+  }
+}
+
+const { Pool } = pg
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootDir = path.resolve(__dirname, '..')
+const uploadRoot = process.env.UPLOAD_ROOT
+  ? path.resolve(process.env.UPLOAD_ROOT)
+  : path.join(rootDir, 'server/uploads')
+const cloudUploadRoot = path.join(uploadRoot, 'clouds')
+const cookieName = 'opencloud_session'
+const jwtSecret = process.env.JWT_SECRET || 'opencloud-dev-secret-change-me'
+const port = Number(process.env.PORT || 3001)
+
+if (!process.env.DATABASE_URL) {
+  console.warn('DATABASE_URL is not set. API routes will fail until a PostgreSQL connection string is provided.')
+}
+
+const pool = new Pool({
+  connectionString: process.env.DATABASE_URL,
+})
+
+const app = express()
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: {
+    files: 2,
+    fileSize: 20 * 1024 * 1024,
+  },
+})
+
+app.use(express.json({ limit: '1mb' }))
+app.use(cookieParser())
+app.use('/uploads', express.static(uploadRoot))
+
+function asyncHandler(fn: (req: Request, res: Response, next: NextFunction) => Promise<unknown>) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    void fn(req, res, next).catch(next)
+  }
+}
+
+function assertDatabaseUrl() {
+  if (!process.env.DATABASE_URL) {
+    const error = new Error('缺少 DATABASE_URL，后端无法连接 PostgreSQL。')
+    Object.assign(error, { status: 500 })
+    throw error
+  }
+}
+
+function signSession(userId: string) {
+  return jwt.sign({ sub: userId } satisfies JwtPayload, jwtSecret, { expiresIn: '7d' })
+}
+
+function setSessionCookie(res: Response, userId: string) {
+  res.cookie(cookieName, signSession(userId), {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    maxAge: 7 * 24 * 60 * 60 * 1000,
+    path: '/',
+  })
+}
+
+function clearSessionCookie(res: Response) {
+  res.clearCookie(cookieName, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    path: '/',
+  })
+}
+
+function publicUser(row: Record<string, unknown>): AuthUser {
+  return {
+    id: String(row.id),
+    email: String(row.email),
+    username: String(row.username),
+    avatar_url: (row.avatar_url as string | null) ?? null,
+    role: row.role as Role,
+    is_disabled: Boolean(row.is_disabled),
+    created_at: String(row.created_at),
+  }
+}
+
+function publicProfile(row: Record<string, unknown>) {
+  return {
+    id: String(row.id),
+    username: String(row.username),
+    avatar_url: (row.avatar_url as string | null) ?? null,
+    role: row.role as Role,
+    is_disabled: Boolean(row.is_disabled),
+    created_at: String(row.created_at),
+  }
+}
+
+async function fetchUserById(id: string) {
+  assertDatabaseUrl()
+  const { rows } = await pool.query(
+    'select id,email,username,avatar_url,role,is_disabled,created_at from users where id = $1',
+    [id],
+  )
+  return rows[0] ? publicUser(rows[0]) : null
+}
+
+async function optionalAuth(req: Request, _res: Response, next: NextFunction) {
+  try {
+    const token = req.cookies?.[cookieName]
+    if (!token) return next()
+
+    const payload = jwt.verify(token, jwtSecret) as JwtPayload
+    const user = await fetchUserById(payload.sub)
+    if (user && !user.is_disabled) req.user = user
+    return next()
+  } catch {
+    return next()
+  }
+}
+
+function requireAuth(req: Request, _res: Response, next: NextFunction) {
+  if (!req.user) {
+    const error = new Error('请先登录。')
+    Object.assign(error, { status: 401 })
+    return next(error)
+  }
+  return next()
+}
+
+function requireAdmin(req: Request, _res: Response, next: NextFunction) {
+  if (req.user?.role !== 'admin') {
+    const error = new Error('需要管理员权限。')
+    Object.assign(error, { status: 403 })
+    return next(error)
+  }
+  return next()
+}
+
+app.use(optionalAuth)
+
+function toCloudRow(row: Record<string, unknown>) {
+  const cloudTypeId = row.cloud_type_id as number | null
+  const username = row.username as string | null
+  return {
+    id: String(row.id),
+    user_id: String(row.user_id),
+    cloud_type_id: cloudTypeId,
+    custom_cloud_type: (row.custom_cloud_type as string | null) ?? null,
+    image_url: String(row.image_url),
+    thumbnail_url: (row.thumbnail_url as string | null) ?? null,
+    latitude: row.latitude === null ? null : Number(row.latitude),
+    longitude: row.longitude === null ? null : Number(row.longitude),
+    location_name: (row.location_name as string | null) ?? null,
+    description: (row.description as string | null) ?? null,
+    captured_at: (row.captured_at as string | null) ?? null,
+    status: row.status as CloudStatus,
+    is_hidden: Boolean(row.is_hidden),
+    created_at: String(row.created_at),
+    cloud_types: cloudTypeId
+      ? {
+          id: cloudTypeId,
+          name: String(row.cloud_type_name),
+          name_en: String(row.cloud_type_name_en),
+          genus: String(row.cloud_type_genus),
+          rarity: row.cloud_type_rarity,
+          description: (row.cloud_type_description as string | null) ?? null,
+          icon_url: (row.cloud_type_icon_url as string | null) ?? null,
+          created_at: String(row.cloud_type_created_at),
+        }
+      : null,
+    profiles: username
+      ? {
+          id: String(row.user_id),
+          username,
+          avatar_url: (row.avatar_url as string | null) ?? null,
+          role: row.user_role as Role,
+          is_disabled: Boolean(row.user_is_disabled),
+          created_at: String(row.user_created_at),
+        }
+      : null,
+  }
+}
+
+const cloudSelect = `
+  c.*,
+  ct.name as cloud_type_name,
+  ct.name_en as cloud_type_name_en,
+  ct.genus as cloud_type_genus,
+  ct.rarity as cloud_type_rarity,
+  ct.description as cloud_type_description,
+  ct.icon_url as cloud_type_icon_url,
+  ct.created_at as cloud_type_created_at,
+  u.username,
+  u.avatar_url,
+  u.role as user_role,
+  u.is_disabled as user_is_disabled,
+  u.created_at as user_created_at
+`
+
+const cloudJoin = `
+  from clouds c
+  left join cloud_types ct on ct.id = c.cloud_type_id
+  join users u on u.id = c.user_id
+`
+
+function parseString(value: unknown) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null
+}
+
+function parseNullableNumber(value: unknown) {
+  if (value === null || value === undefined || value === '') return null
+  const number = Number(value)
+  return Number.isFinite(number) ? number : null
+}
+
+function parseNullableInteger(value: unknown) {
+  const number = parseNullableNumber(value)
+  return number === null ? null : Math.trunc(number)
+}
+
+function parseBoolean(value: unknown) {
+  return value === true || value === 'true' || value === '1'
+}
+
+function normalizeUploadExtension(file: Express.Multer.File) {
+  const extension = path.extname(file.originalname).toLowerCase().replace(/[^a-z0-9.]/g, '')
+  if (extension && ['.jpg', '.jpeg', '.png', '.webp', '.gif'].includes(extension)) return extension
+  if (file.mimetype === 'image/png') return '.png'
+  if (file.mimetype === 'image/webp') return '.webp'
+  if (file.mimetype === 'image/gif') return '.gif'
+  return '.jpg'
+}
+
+async function writeCloudFile(userId: string, file: Express.Multer.File, suffix = '') {
+  const userDir = path.join(cloudUploadRoot, userId)
+  await mkdir(userDir, { recursive: true })
+  const random = Math.random().toString(36).slice(2, 10)
+  const extension = suffix ? '.jpg' : normalizeUploadExtension(file)
+  const filename = `${Date.now()}-${random}${suffix}${extension}`
+  const absolutePath = path.join(userDir, filename)
+  await writeFile(absolutePath, file.buffer)
+  return {
+    absolutePath,
+    publicPath: `/uploads/clouds/${userId}/${filename}`,
+  }
+}
+
+async function removePublicFile(publicPath: string | null) {
+  if (!publicPath || !publicPath.startsWith('/uploads/clouds/')) return
+  const absolutePath = path.resolve(uploadRoot, publicPath.replace(/^\/uploads\//, ''))
+  if (!absolutePath.startsWith(cloudUploadRoot)) return
+  await rm(absolutePath, { force: true })
+}
+
+app.get('/api/health', (_req, res) => {
+  res.json({ ok: true })
+})
+
+app.post('/api/auth/register', asyncHandler(async (req, res) => {
+  assertDatabaseUrl()
+  const email = parseString(req.body.email)?.toLowerCase()
+  const password = typeof req.body.password === 'string' ? req.body.password : ''
+  const username = parseString(req.body.username)
+
+  if (!email || !username || password.length < 8) {
+    res.status(400).json({ message: '请填写有效邮箱、用户名和至少 8 位密码。' })
+    return
+  }
+
+  const passwordHash = await bcrypt.hash(password, 12)
+  try {
+    const { rows } = await pool.query(
+      `insert into users (email, password_hash, username)
+       values ($1, $2, $3)
+       returning id,email,username,avatar_url,role,is_disabled,created_at`,
+      [email, passwordHash, username],
+    )
+    const user = publicUser(rows[0])
+    setSessionCookie(res, user.id)
+    res.status(201).json({ user, profile: publicProfile(rows[0]) })
+  } catch (error) {
+    if (error && typeof error === 'object' && 'code' in error && error.code === '23505') {
+      res.status(409).json({ message: '邮箱或昵称已被使用。' })
+      return
+    }
+    throw error
+  }
+}))
+
+app.post('/api/auth/login', asyncHandler(async (req, res) => {
+  assertDatabaseUrl()
+  const email = parseString(req.body.email)?.toLowerCase()
+  const password = typeof req.body.password === 'string' ? req.body.password : ''
+  if (!email || !password) {
+    res.status(400).json({ message: '请输入邮箱和密码。' })
+    return
+  }
+
+  const { rows } = await pool.query(
+    'select id,email,password_hash,username,avatar_url,role,is_disabled,created_at from users where email = $1',
+    [email],
+  )
+  const row = rows[0]
+  if (!row || !(await bcrypt.compare(password, row.password_hash))) {
+    res.status(401).json({ message: '邮箱或密码错误。' })
+    return
+  }
+  if (row.is_disabled) {
+    res.status(403).json({ message: '账号已被禁用。' })
+    return
+  }
+
+  const user = publicUser(row)
+  setSessionCookie(res, user.id)
+  res.json({ user, profile: publicProfile(row) })
+}))
+
+app.post('/api/auth/logout', (_req, res) => {
+  clearSessionCookie(res)
+  res.json({ ok: true })
+})
+
+app.get('/api/auth/me', (req, res) => {
+  res.json({ user: req.user ?? null, profile: req.user ? publicProfile(req.user as unknown as Record<string, unknown>) : null })
+})
+
+app.patch('/api/auth/password', requireAuth, asyncHandler(async (req, res) => {
+  const password = typeof req.body.password === 'string' ? req.body.password : ''
+  if (password.length < 6) {
+    res.status(400).json({ message: '新密码至少需要 6 位。' })
+    return
+  }
+  const passwordHash = await bcrypt.hash(password, 12)
+  await pool.query('update users set password_hash = $1, updated_at = now() where id = $2', [passwordHash, req.user!.id])
+  res.json({ ok: true })
+}))
+
+app.get('/api/profiles/check-username', asyncHandler(async (req, res) => {
+  const username = parseString(req.query.username)
+  const exclude = parseString(req.query.exclude)
+  if (!username) {
+    res.json({ available: false })
+    return
+  }
+  const params: unknown[] = [username]
+  let sql = 'select id from users where username = $1'
+  if (exclude) {
+    params.push(exclude)
+    sql += ' and id <> $2'
+  }
+  sql += ' limit 1'
+  const { rows } = await pool.query(sql, params)
+  res.json({ available: rows.length === 0 })
+}))
+
+app.patch('/api/me/profile', requireAuth, asyncHandler(async (req, res) => {
+  const username = parseString(req.body.username)
+  if (!username || username.length < 2 || username.length > 32) {
+    res.status(400).json({ message: '昵称长度需要在 2 到 32 个字符之间。' })
+    return
+  }
+  try {
+    const { rows } = await pool.query(
+      `update users set username = $1, updated_at = now()
+       where id = $2
+       returning id,email,username,avatar_url,role,is_disabled,created_at`,
+      [username, req.user!.id],
+    )
+    res.json({ profile: publicProfile(rows[0]), user: publicUser(rows[0]) })
+  } catch (error) {
+    if (error && typeof error === 'object' && 'code' in error && error.code === '23505') {
+      res.status(409).json({ message: '这个昵称已经被使用，请换一个。' })
+      return
+    }
+    throw error
+  }
+}))
+
+app.get('/api/cloud-types', asyncHandler(async (_req, res) => {
+  const { rows } = await pool.query('select * from cloud_types order by id')
+  res.json({ data: rows })
+}))
+
+app.get('/api/me/collections', requireAuth, asyncHandler(async (req, res) => {
+  const { rows } = await pool.query(
+    `select uc.*, c.image_url, c.thumbnail_url, c.captured_at, c.created_at as cloud_created_at, c.location_name
+     from user_collections uc
+     left join clouds c on c.id = uc.first_cloud_id
+     where uc.user_id = $1
+     order by uc.unlocked_at asc`,
+    [req.user!.id],
+  )
+  res.json({
+    data: rows.map(row => ({
+      id: row.id,
+      user_id: row.user_id,
+      cloud_type_id: row.cloud_type_id,
+      first_cloud_id: row.first_cloud_id,
+      unlocked_at: row.unlocked_at,
+      firstCloud: row.first_cloud_id
+        ? {
+            id: row.first_cloud_id,
+            image_url: row.image_url,
+            thumbnail_url: row.thumbnail_url,
+            captured_at: row.captured_at,
+            created_at: row.cloud_created_at,
+            location_name: row.location_name,
+          }
+        : null,
+    })),
+  })
+}))
+
+app.get('/api/profiles/:id', asyncHandler(async (req, res) => {
+  const profileId = String(req.params.id)
+  const user = await fetchUserById(profileId)
+  if (!user) {
+    res.status(404).json({ message: '用户不存在。' })
+    return
+  }
+  res.json({ profile: publicProfile(user as unknown as Record<string, unknown>) })
+}))
+
+app.get('/api/profiles/:id/clouds', asyncHandler(async (req, res) => {
+  const profileId = String(req.params.id)
+  const own = req.user?.id === profileId && req.query.own === 'true'
+  const params: unknown[] = [profileId]
+  let sql = `select ${cloudSelect} ${cloudJoin} where c.user_id = $1`
+  if (!own) sql += ` and c.status = 'approved' and c.is_hidden = false`
+  sql += ' order by c.captured_at desc nulls last, c.created_at desc'
+  const { rows } = await pool.query(sql, params)
+  res.json({ data: rows.map(toCloudRow) })
+}))
+
+app.get('/api/clouds', asyncHandler(async (req, res) => {
+  const page = Math.max(1, Number(req.query.page || 1))
+  const pageSize = Math.min(100, Math.max(1, Number(req.query.pageSize || 50)))
+  const params: unknown[] = []
+  const where = [`c.status = 'approved'`, 'c.is_hidden = false']
+
+  const typeId = req.query.typeId === 'all' ? null : parseNullableInteger(req.query.typeId)
+  if (typeId) {
+    params.push(typeId)
+    where.push(`c.cloud_type_id = $${params.length}`)
+  }
+
+  const search = parseString(req.query.search)
+  if (search) {
+    if (search.startsWith('@')) {
+      params.push(`%${search.slice(1).trim()}%`)
+      where.push(`u.username ilike $${params.length}`)
+    } else {
+      params.push(`%${search}%`)
+      where.push(`(ct.name ilike $${params.length} or ct.name_en ilike $${params.length} or c.custom_cloud_type ilike $${params.length})`)
+    }
+  }
+
+  const whereSql = where.length ? `where ${where.join(' and ')}` : ''
+  const countResult = await pool.query(`select count(*)::int as count ${cloudJoin} ${whereSql}`, params)
+  params.push(pageSize, (page - 1) * pageSize)
+  const dataResult = await pool.query(
+    `select ${cloudSelect} ${cloudJoin} ${whereSql}
+     order by c.created_at desc
+     limit $${params.length - 1} offset $${params.length}`,
+    params,
+  )
+  res.json({ data: dataResult.rows.map(toCloudRow), count: countResult.rows[0].count })
+}))
+
+app.get('/api/clouds/map', asyncHandler(async (req, res) => {
+  const field = req.query.field === 'created_at' ? 'created_at' : 'captured_at'
+  const start = parseString(req.query.start)
+  const end = parseString(req.query.end)
+  if (!start || !end) {
+    res.status(400).json({ message: '缺少时间范围。' })
+    return
+  }
+  const { rows } = await pool.query(
+    `select ${cloudSelect} ${cloudJoin}
+     where c.status = 'approved'
+       and c.is_hidden = false
+       and c.latitude is not null
+       and c.longitude is not null
+       and c.${field} >= $1
+       and c.${field} < $2
+     order by c.${field} asc
+     limit 1000`,
+    [start, end],
+  )
+  res.json({ data: rows.map(toCloudRow) })
+}))
+
+app.get('/api/cloud-types/:id/gallery', asyncHandler(async (req, res) => {
+  const typeId = Number(String(req.params.id))
+  const countResult = await pool.query(
+    `select count(*)::int as count from clouds
+     where cloud_type_id = $1 and status = 'approved' and is_hidden = false`,
+    [typeId],
+  )
+  const { rows } = await pool.query(
+    `select ${cloudSelect} ${cloudJoin}
+     where c.cloud_type_id = $1 and c.status = 'approved' and c.is_hidden = false
+     order by c.captured_at desc nulls last, c.created_at desc
+     limit 24`,
+    [typeId],
+  )
+  res.json({ data: rows.map(toCloudRow), count: countResult.rows[0].count })
+}))
+
+app.post('/api/clouds', requireAuth, upload.fields([
+  { name: 'image', maxCount: 1 },
+  { name: 'thumbnail', maxCount: 1 },
+]), asyncHandler(async (req, res) => {
+  const files = req.files as Record<string, Express.Multer.File[]> | undefined
+  const image = files?.image?.[0]
+  const thumbnail = files?.thumbnail?.[0]
+  if (!image || !thumbnail) {
+    res.status(400).json({ message: '请同时上传原图和缩略图。' })
+    return
+  }
+
+  let imageFile: Awaited<ReturnType<typeof writeCloudFile>> | null = null
+  let thumbnailFile: Awaited<ReturnType<typeof writeCloudFile>> | null = null
+  const client = await pool.connect()
+  try {
+    imageFile = await writeCloudFile(req.user!.id, image)
+    thumbnailFile = await writeCloudFile(req.user!.id, thumbnail, '-thumb')
+    await client.query('begin')
+    const insertResult = await client.query(
+      `insert into clouds (
+        user_id, cloud_type_id, custom_cloud_type, image_url, thumbnail_url,
+        latitude, longitude, location_name, description, captured_at, status, is_hidden
+      ) values ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,'pending',$11)
+      returning id, cloud_type_id, created_at`,
+      [
+        req.user!.id,
+        parseNullableInteger(req.body.cloud_type_id),
+        parseString(req.body.custom_cloud_type),
+        imageFile.publicPath,
+        thumbnailFile.publicPath,
+        parseNullableNumber(req.body.latitude),
+        parseNullableNumber(req.body.longitude),
+        parseString(req.body.location_name),
+        parseString(req.body.description),
+        parseString(req.body.captured_at),
+        parseBoolean(req.body.is_hidden),
+      ],
+    )
+    const inserted = insertResult.rows[0]
+    let unlockedBadge = null
+    if (inserted.cloud_type_id) {
+      const collectionResult = await client.query(
+        `insert into user_collections (user_id, cloud_type_id, first_cloud_id)
+         values ($1, $2, $3)
+         on conflict (user_id, cloud_type_id) do nothing
+         returning cloud_type_id, unlocked_at`,
+        [req.user!.id, inserted.cloud_type_id, inserted.id],
+      )
+      const collection = collectionResult.rows[0]
+      if (collection) {
+        const typeResult = await client.query(
+          'select id,name,name_en,rarity from cloud_types where id = $1',
+          [collection.cloud_type_id],
+        )
+        const type = typeResult.rows[0]
+        if (type) {
+          unlockedBadge = {
+            cloudTypeId: type.id,
+            cloudName: type.name,
+            cloudNameEn: type.name_en,
+            rarity: type.rarity,
+            unlockedAt: collection.unlocked_at,
+          }
+        }
+      }
+    }
+    await client.query('commit')
+    res.status(201).json({ cloud: inserted, unlockedBadge })
+  } catch (error) {
+    await client.query('rollback').catch(() => undefined)
+    await Promise.all([
+      removePublicFile(imageFile?.publicPath ?? null),
+      removePublicFile(thumbnailFile?.publicPath ?? null),
+    ])
+    throw error
+  } finally {
+    client.release()
+  }
+}))
+
+app.patch('/api/clouds/:id', requireAuth, asyncHandler(async (req, res) => {
+  const cloudId = String(req.params.id)
+  const isAdmin = req.user!.role === 'admin'
+  const ownerResult = await pool.query('select user_id from clouds where id = $1', [cloudId])
+  const owner = ownerResult.rows[0]?.user_id
+  if (!owner) {
+    res.status(404).json({ message: '图片不存在。' })
+    return
+  }
+  if (!isAdmin && owner !== req.user!.id) {
+    res.status(403).json({ message: '只能修改自己的图片。' })
+    return
+  }
+
+  const allowed = ['cloud_type_id', 'custom_cloud_type', 'latitude', 'longitude', 'location_name', 'description', 'captured_at', 'is_hidden', 'status']
+  const set: string[] = []
+  const params: unknown[] = []
+  for (const key of allowed) {
+    if (!(key in req.body)) continue
+    if (key === 'status' && !isAdmin) continue
+    params.push(key === 'is_hidden'
+      ? parseBoolean(req.body[key])
+      : key === 'cloud_type_id'
+        ? parseNullableInteger(req.body[key])
+        : key === 'latitude' || key === 'longitude'
+          ? parseNullableNumber(req.body[key])
+          : parseString(req.body[key]))
+    set.push(`${key} = $${params.length}`)
+  }
+  if (!set.length) {
+    res.status(400).json({ message: '没有可更新的字段。' })
+    return
+  }
+  params.push(cloudId)
+  await pool.query(`update clouds set ${set.join(', ')}, updated_at = now() where id = $${params.length}`, params)
+  const { rows } = await pool.query(`select ${cloudSelect} ${cloudJoin} where c.id = $1`, [cloudId])
+  res.json({ cloud: toCloudRow(rows[0]) })
+}))
+
+app.delete('/api/clouds/:id', requireAuth, asyncHandler(async (req, res) => {
+  const cloudId = String(req.params.id)
+  const isAdmin = req.user!.role === 'admin'
+  const { rows } = await pool.query('select id,user_id,image_url,thumbnail_url from clouds where id = $1', [cloudId])
+  const cloud = rows[0]
+  if (!cloud) {
+    res.status(404).json({ message: '图片不存在。' })
+    return
+  }
+  if (!isAdmin && cloud.user_id !== req.user!.id) {
+    res.status(403).json({ message: '只能删除自己的图片。' })
+    return
+  }
+  await pool.query('delete from clouds where id = $1', [cloudId])
+  const fileErrors = await Promise.allSettled([
+    removePublicFile(cloud.image_url),
+    removePublicFile(cloud.thumbnail_url),
+  ])
+  const failed = fileErrors.some(result => result.status === 'rejected')
+  if (failed) console.error('cloud file deletion failed', fileErrors)
+  res.json({ deleted: [cloud.id], fileCleanupFailed: failed })
+}))
+
+app.get('/api/admin/stats', requireAuth, requireAdmin, asyncHandler(async (_req, res) => {
+  const today = new Date()
+  today.setHours(0, 0, 0, 0)
+  const { rows } = await pool.query(
+    `select
+      (select count(*)::int from users) as users,
+      (select count(*)::int from clouds) as images,
+      (select count(*)::int from clouds where created_at >= $1) as "todayUploads",
+      (select count(*)::int from clouds where status = 'pending') as pending,
+      (select count(*)::int from clouds where status = 'approved') as approved,
+      (select count(*)::int from clouds where status = 'rejected') as rejected,
+      (select count(*)::int from clouds where is_hidden = true) as hidden`,
+    [today.toISOString()],
+  )
+  res.json({ stats: rows[0] })
+}))
+
+app.get('/api/admin/users', requireAuth, requireAdmin, asyncHandler(async (_req, res) => {
+  const { rows } = await pool.query(
+    'select id,username,avatar_url,role,is_disabled,created_at from users order by created_at desc limit 100',
+  )
+  res.json({ data: rows.map(publicProfile) })
+}))
+
+app.patch('/api/admin/users/:id', requireAuth, requireAdmin, asyncHandler(async (req, res) => {
+  const userId = String(req.params.id)
+  if (userId === req.user!.id && (req.body.role !== 'admin' || parseBoolean(req.body.is_disabled))) {
+    res.status(400).json({ message: '不能移除自己的管理员权限或禁用当前账号。' })
+    return
+  }
+  const set: string[] = []
+  const params: unknown[] = []
+  if (req.body.role === 'user' || req.body.role === 'admin') {
+    params.push(req.body.role)
+    set.push(`role = $${params.length}`)
+  }
+  if ('is_disabled' in req.body) {
+    params.push(parseBoolean(req.body.is_disabled))
+    set.push(`is_disabled = $${params.length}`)
+  }
+  if (!set.length) {
+    res.status(400).json({ message: '没有可更新的字段。' })
+    return
+  }
+  params.push(userId)
+  const { rows } = await pool.query(
+    `update users set ${set.join(', ')}, updated_at = now()
+     where id = $${params.length}
+     returning id,username,avatar_url,role,is_disabled,created_at`,
+    params,
+  )
+  res.json({ profile: publicProfile(rows[0]) })
+}))
+
+app.get('/api/admin/clouds', requireAuth, requireAdmin, asyncHandler(async (_req, res) => {
+  const { rows } = await pool.query(
+    `select ${cloudSelect} ${cloudJoin}
+     order by c.created_at desc
+     limit 120`,
+  )
+  res.json({ data: rows.map(toCloudRow) })
+}))
+
+app.patch('/api/admin/clouds', requireAuth, requireAdmin, asyncHandler(async (req, res) => {
+  const ids = Array.isArray(req.body.ids) ? req.body.ids.filter((id: unknown) => typeof id === 'string') : []
+  if (!ids.length) {
+    res.status(400).json({ message: '请选择图片。' })
+    return
+  }
+  const set: string[] = []
+  const params: unknown[] = []
+  if (['pending', 'approved', 'rejected'].includes(req.body.status)) {
+    params.push(req.body.status)
+    set.push(`status = $${params.length}`)
+  }
+  if ('is_hidden' in req.body) {
+    params.push(parseBoolean(req.body.is_hidden))
+    set.push(`is_hidden = $${params.length}`)
+  }
+  if (!set.length) {
+    res.status(400).json({ message: '没有可更新的字段。' })
+    return
+  }
+  params.push(ids)
+  const { rows } = await pool.query(
+    `update clouds set ${set.join(', ')}, updated_at = now()
+     where id = any($${params.length}::uuid[])
+     returning id`,
+    params,
+  )
+  res.json({ updated: rows.map(row => row.id) })
+}))
+
+app.use((error: unknown, _req: Request, res: Response, _next: NextFunction) => {
+  const payload = error as { status?: number; message?: string }
+  const status = payload.status || 500
+  if (status >= 500) console.error(error)
+  res.status(status).json({ message: payload.message || '服务器内部错误。' })
+})
+
+if (!existsSync(uploadRoot)) {
+  await mkdir(uploadRoot, { recursive: true })
+}
+
+app.listen(port, () => {
+  console.log(`OpenCloud API listening on http://localhost:${port}`)
+})
diff --git a/server/schema.sql b/server/schema.sql
new file mode 100644
index 0000000..556a135
--- /dev/null
+++ b/server/schema.sql
@@ -0,0 +1,104 @@
+create extension if not exists pgcrypto;
+
+do $$ begin
+  create type user_role as enum ('user', 'admin');
+exception
+  when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type cloud_status as enum ('pending', 'approved', 'rejected');
+exception
+  when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type cloud_rarity as enum ('common', 'uncommon', 'rare');
+exception
+  when duplicate_object then null;
+end $$;
+
+create table if not exists users (
+  id uuid primary key default gen_random_uuid(),
+  email text not null unique,
+  password_hash text not null,
+  username text not null unique,
+  avatar_url text,
+  role user_role not null default 'user',
+  is_disabled boolean not null default false,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists cloud_types (
+  id integer primary key,
+  name text not null,
+  name_en text not null,
+  genus text not null,
+  rarity cloud_rarity not null default 'common',
+  description text,
+  icon_url text,
+  created_at timestamptz not null default now()
+);
+
+create table if not exists clouds (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null references users(id) on delete cascade,
+  cloud_type_id integer references cloud_types(id) on delete set null,
+  custom_cloud_type text,
+  image_url text not null,
+  thumbnail_url text,
+  latitude numeric(9, 6),
+  longitude numeric(9, 6),
+  location_name text,
+  description text,
+  captured_at timestamptz,
+  status cloud_status not null default 'pending',
+  is_hidden boolean not null default false,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists user_collections (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null references users(id) on delete cascade,
+  cloud_type_id integer not null references cloud_types(id) on delete cascade,
+  first_cloud_id uuid references clouds(id) on delete set null,
+  unlocked_at timestamptz not null default now(),
+  unique (user_id, cloud_type_id)
+);
+
+create index if not exists idx_clouds_public_gallery
+  on clouds (status, is_hidden, created_at desc);
+
+create index if not exists idx_clouds_type_public
+  on clouds (cloud_type_id, status, is_hidden, created_at desc);
+
+create index if not exists idx_clouds_map_captured
+  on clouds (captured_at, status, is_hidden)
+  where latitude is not null and longitude is not null;
+
+create index if not exists idx_clouds_user_created
+  on clouds (user_id, created_at desc);
+
+create index if not exists idx_user_collections_user
+  on user_collections (user_id, unlocked_at);
+
+insert into cloud_types (id, name, name_en, genus, rarity, description)
+values
+  (1, '积云', 'Cumulus', '低云', 'common', '轮廓清晰、底部较平的棉花状云，常见于晴朗天气。'),
+  (2, '层云', 'Stratus', '低云', 'common', '低而均匀的灰白色云层，常覆盖天空并带来阴沉观感。'),
+  (3, '卷云', 'Cirrus', '高云', 'common', '纤细如羽毛的高云，由冰晶组成，常预示天气变化。'),
+  (4, '积雨云', 'Cumulonimbus', '直展云', 'rare', '垂直发展旺盛的雷暴云，可带来强降水、雷电或冰雹。'),
+  (5, '层积云', 'Stratocumulus', '低云', 'common', '成片或成层的块状云，常有明暗相间的结构。'),
+  (6, '高积云', 'Altocumulus', '中云', 'uncommon', '中高度的小块状或波状云，常成群排列。'),
+  (7, '高层云', 'Altostratus', '中云', 'uncommon', '灰蓝色或灰色的中层云幕，常使太阳呈毛玻璃状。'),
+  (8, '雨层云', 'Nimbostratus', '中云', 'uncommon', '厚重暗灰的降水云层，通常带来持续性降雨或降雪。'),
+  (9, '卷层云', 'Cirrostratus', '高云', 'uncommon', '薄幕状高云，常覆盖大范围天空并产生日晕或月晕。'),
+  (10, '卷积云', 'Cirrocumulus', '高云', 'rare', '细小颗粒状高云，常呈鱼鳞状排列。')
+on conflict (id) do update set
+  name = excluded.name,
+  name_en = excluded.name_en,
+  genus = excluded.genus,
+  rarity = excluded.rarity,
+  description = excluded.description;
diff --git a/src/composables/useUpload.ts b/src/composables/useUpload.ts
index 368cdae..97ad3c1 100644
--- a/src/composables/useUpload.ts
+++ b/src/composables/useUpload.ts
@@ -1,5 +1,6 @@
 import { ref } from 'vue'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
+import { useAuthStore } from '@/stores/auth'
 import { useProfileStore } from '@/stores/profile'
 import type { CloudType } from '@/types/database'
 
@@ -170,51 +171,8 @@ function extractExifDate(buffer: ArrayBuffer): string | null {
   return null
 }
 
-async function fetchUnlockedTypeIds(userId: string) {
-  const { data, error } = await supabase
-    .from('user_collections')
-    .select('cloud_type_id')
-    .eq('user_id', userId)
-
-  if (error) throw error
-
-  return new Set(
-    (data || [])
-      .map(row => row.cloud_type_id)
-      .filter((cloudTypeId): cloudTypeId is number => typeof cloudTypeId === 'number'),
-  )
-}
-
-async function fetchBadgeDetails(unlockedRows: Array<{ cloudTypeId: number; unlockedAt: string }>) {
-  const ids = unlockedRows.map(item => item.cloudTypeId)
-  const { data, error } = await supabase
-    .from('cloud_types')
-    .select('id,name,name_en,rarity')
-    .in('id', ids)
-
-  if (error) throw error
-
-  const typeMap = new Map(
-    ((data || []) as Array<Pick<CloudType, 'id' | 'name' | 'name_en' | 'rarity'>>).map(item => [item.id, item]),
-  )
-
-  return unlockedRows
-    .map(item => {
-      const cloudType = typeMap.get(item.cloudTypeId)
-      if (!cloudType) return null
-
-      return {
-        cloudTypeId: cloudType.id,
-        cloudName: cloudType.name,
-        cloudNameEn: cloudType.name_en,
-        rarity: cloudType.rarity,
-        unlockedAt: item.unlockedAt,
-      } satisfies UnlockedBadge
-    })
-    .filter((item): item is UnlockedBadge => item !== null)
-}
-
 export function useUpload() {
+  const authStore = useAuthStore()
   const profileStore = useProfileStore()
   const items = ref<UploadItem[]>([])
   const uploading = ref(false)
@@ -313,21 +271,14 @@ export function useUpload() {
     currentItemIndex.value = 0
     overallProgress.value = 0
 
-    const userId = (await supabase.auth.getUser()).data.user?.id
+    const userId = authStore.user?.id
     if (!userId) {
       uploading.value = false
       return { ok: false, unlockedBadges: [] }
     }
 
     try {
-      let unlockedTypeIds = new Set<number>()
-      try {
-        unlockedTypeIds = await fetchUnlockedTypeIds(userId)
-      } catch {
-        unlockedTypeIds = new Set<number>()
-      }
-
-      const newlyUnlockedRows: Array<{ cloudTypeId: number; unlockedAt: string }> = []
+      const unlockedBadges: UnlockedBadge[] = []
 
       for (let i = 0; i < items.value.length; i++) {
         const item = items.value[i]
@@ -335,86 +286,29 @@ export function useUpload() {
 
         overallProgress.value = Math.round(i / items.value.length * 100)
 
-        const basePath = `${userId}/${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
-        const ext = item.file.name.split('.').pop() || 'jpg'
-        const imagePath = `${basePath}.${ext}`
-        const thumbnailPath = `${basePath}-thumb.jpg`
         const { thumbnailFile } = await createUploadAssets(item.file)
 
-        const { error: imgError } = await supabase.storage
-          .from('clouds')
-          .upload(imagePath, item.file, {
-            upsert: false,
-            contentType: item.file.type,
-          })
-        if (imgError) throw imgError
-
-        const { error: thumbError } = await supabase.storage
-          .from('clouds')
-          .upload(thumbnailPath, thumbnailFile, {
-            upsert: false,
-            contentType: thumbnailFile.type,
-          })
-        if (thumbError) throw thumbError
-
         overallProgress.value = Math.round((i + 0.5) / items.value.length * 100)
 
-        const { data: { publicUrl: imageUrl } } = supabase.storage.from('clouds').getPublicUrl(imagePath)
-        const { data: { publicUrl: thumbnailUrl } } = supabase.storage.from('clouds').getPublicUrl(thumbnailPath)
-
         const latitude = item.latitude ? blurCoordinate(item.latitude) : null
         const longitude = item.longitude ? blurCoordinate(item.longitude) : null
 
-        const { data: insertedCloud, error: dbError } = await supabase
-          .from('clouds')
-          .insert({
-            user_id: userId,
-            cloud_type_id: item.cloudCategoryId === 'other' ? null : item.cloudCategoryId,
-            custom_cloud_type: item.cloudCategoryId === 'other' ? (item.customCloudType.trim() || null) : null,
-            image_url: imageUrl,
-            thumbnail_url: thumbnailUrl,
-            latitude,
-            longitude,
-            location_name: item.locationName || null,
-            description: item.description.trim() || null,
-            captured_at: item.capturedAt,
-            status: 'pending',
-            is_hidden: item.isHidden,
-          })
-          .select('id,cloud_type_id')
-          .single()
-        if (dbError) throw dbError
-
-        if (
-          insertedCloud &&
-          typeof insertedCloud.cloud_type_id === 'number' &&
-          !unlockedTypeIds.has(insertedCloud.cloud_type_id)
-        ) {
-          try {
-            const { data: collectionRow, error: collectionError } = await supabase
-              .from('user_collections')
-              .insert({
-                user_id: userId,
-                cloud_type_id: insertedCloud.cloud_type_id,
-                first_cloud_id: insertedCloud.id,
-              })
-              .select('cloud_type_id,unlocked_at')
-              .single()
-
-            if (collectionError) {
-              const duplicate = collectionError.code === '23505'
-              if (!duplicate) throw collectionError
-            } else if (collectionRow) {
-              unlockedTypeIds.add(collectionRow.cloud_type_id)
-              newlyUnlockedRows.push({
-                cloudTypeId: collectionRow.cloud_type_id,
-                unlockedAt: collectionRow.unlocked_at,
-              })
-            }
-          } catch {
-            // Ignore collection sync failures so uploads can still complete.
-          }
+        const form = new FormData()
+        form.append('image', item.file)
+        form.append('thumbnail', thumbnailFile)
+        if (item.cloudCategoryId !== 'other' && item.cloudCategoryId !== null) {
+          form.append('cloud_type_id', String(item.cloudCategoryId))
         }
+        if (item.cloudCategoryId === 'other') form.append('custom_cloud_type', item.customCloudType.trim())
+        if (latitude !== null) form.append('latitude', String(latitude))
+        if (longitude !== null) form.append('longitude', String(longitude))
+        if (item.locationName.trim()) form.append('location_name', item.locationName.trim())
+        if (item.description.trim()) form.append('description', item.description.trim())
+        form.append('captured_at', item.capturedAt)
+        form.append('is_hidden', String(item.isHidden))
+
+        const result = await api.clouds.create(form)
+        if (result.unlockedBadge) unlockedBadges.push(result.unlockedBadge)
 
         overallProgress.value = Math.round((i + 1) / items.value.length * 100)
       }
@@ -426,7 +320,7 @@ export function useUpload() {
       profileStore.invalidateUser(userId)
       return {
         ok: true,
-        unlockedBadges: newlyUnlockedRows.length ? await fetchBadgeDetails(newlyUnlockedRows) : [],
+        unlockedBadges,
       }
     } catch {
       return { ok: false, unlockedBadges: [] }
diff --git a/src/lib/amap.ts b/src/lib/amap.ts
index aadbcb3..50c8c41 100644
--- a/src/lib/amap.ts
+++ b/src/lib/amap.ts
@@ -1,16 +1,16 @@
-import AMapLoader from '@amap/amap-jsapi-loader'
+import AMapLoader from "@amap/amap-jsapi-loader";
 
 export function loadAMap() {
-  return AMapLoader.load({
-    key: import.meta.env.VITE_AMAP_KEY,
-    version: '2.0',
-    plugins: [
-      'AMap.Scale',
-      'AMap.ToolBar',
-      'AMap.ControlBar',
-      'AMap.Geolocation',
-      'AMap.Marker',
-      'AMap.InfoWindow',
-    ],
-  })
+    return AMapLoader.load({
+        key: import.meta.env.VITE_AMAP_KEY,
+        version: "2.0",
+        plugins: [
+            "AMap.Scale",
+            "AMap.ToolBar",
+            "AMap.ControlBar",
+            "AMap.Geolocation",
+            "AMap.Marker",
+            "AMap.InfoWindow",
+        ],
+    });
 }
diff --git a/src/lib/api.ts b/src/lib/api.ts
new file mode 100644
index 0000000..80fc746
--- /dev/null
+++ b/src/lib/api.ts
@@ -0,0 +1,155 @@
+import type { Cloud, CloudType, Profile, UserCollection } from '@/types/database'
+
+export interface ApiUser {
+  id: string
+  email: string
+  username: string
+  avatar_url: string | null
+  role: Profile['role']
+  is_disabled: boolean
+  created_at: string
+}
+
+export interface CollectionEntryResponse extends UserCollection {
+  firstCloud: {
+    id: string
+    image_url: string
+    thumbnail_url: string | null
+    captured_at: string | null
+    created_at: string
+    location_name: string | null
+  } | null
+}
+
+export interface UnlockedBadgeResponse {
+  cloudTypeId: number
+  cloudName: string
+  cloudNameEn: string
+  rarity: CloudType['rarity']
+  unlockedAt: string
+}
+
+export class ApiError extends Error {
+  status: number
+
+  constructor(message: string, status: number) {
+    super(message)
+    this.name = 'ApiError'
+    this.status = status
+  }
+}
+
+type QueryValue = string | number | boolean | null | undefined
+
+function buildUrl(path: string, query?: Record<string, QueryValue>) {
+  const url = new URL(path, window.location.origin)
+  if (query) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value !== undefined && value !== null && value !== '') {
+        url.searchParams.set(key, String(value))
+      }
+    }
+  }
+  return `${url.pathname}${url.search}`
+}
+
+async function parseResponse<T>(response: Response): Promise<T> {
+  const text = await response.text()
+  const payload = text ? JSON.parse(text) : {}
+  if (!response.ok) {
+    throw new ApiError(payload.message || '请求失败', response.status)
+  }
+  return payload as T
+}
+
+export async function apiGet<T>(path: string, query?: Record<string, QueryValue>) {
+  const response = await fetch(buildUrl(path, query), {
+    credentials: 'include',
+  })
+  return parseResponse<T>(response)
+}
+
+export async function apiJson<T>(path: string, options: {
+  method?: 'POST' | 'PATCH' | 'DELETE'
+  body?: unknown
+} = {}) {
+  const response = await fetch(path, {
+    method: options.method || 'POST',
+    credentials: 'include',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+    body: options.body === undefined ? undefined : JSON.stringify(options.body),
+  })
+  return parseResponse<T>(response)
+}
+
+export async function apiForm<T>(path: string, form: FormData) {
+  const response = await fetch(path, {
+    method: 'POST',
+    credentials: 'include',
+    body: form,
+  })
+  return parseResponse<T>(response)
+}
+
+export const api = {
+  auth: {
+    me: () => apiGet<{ user: ApiUser | null; profile: Profile | null }>('/api/auth/me'),
+    login: (email: string, password: string) => apiJson<{ user: ApiUser; profile: Profile }>('/api/auth/login', {
+      body: { email, password },
+    }),
+    register: (email: string, password: string, username: string) => apiJson<{ user: ApiUser; profile: Profile }>('/api/auth/register', {
+      body: { email, password, username },
+    }),
+    logout: () => apiJson<{ ok: boolean }>('/api/auth/logout'),
+    updatePassword: (password: string) => apiJson<{ ok: boolean }>('/api/auth/password', {
+      method: 'PATCH',
+      body: { password },
+    }),
+  },
+  profiles: {
+    checkUsername: (username: string, exclude?: string) => apiGet<{ available: boolean }>('/api/profiles/check-username', {
+      username,
+      exclude,
+    }),
+    get: (id: string) => apiGet<{ profile: Profile }>(`/api/profiles/${id}`),
+    clouds: (id: string, own: boolean) => apiGet<{ data: Cloud[] }>(`/api/profiles/${id}/clouds`, { own }),
+    updateMe: (username: string) => apiJson<{ user: ApiUser; profile: Profile }>('/api/me/profile', {
+      method: 'PATCH',
+      body: { username },
+    }),
+  },
+  cloudTypes: {
+    list: () => apiGet<{ data: CloudType[] }>('/api/cloud-types'),
+    gallery: (id: number) => apiGet<{ data: Cloud[]; count: number }>(`/api/cloud-types/${id}/gallery`),
+  },
+  collections: {
+    mine: () => apiGet<{ data: CollectionEntryResponse[] }>('/api/me/collections'),
+  },
+  clouds: {
+    list: (query: { page: number; pageSize: number; typeId?: number | 'all'; search?: string }) => apiGet<{ data: Cloud[]; count: number }>('/api/clouds', query),
+    map: (query: { field: 'captured_at' | 'created_at'; start: string; end: string }) => apiGet<{ data: Cloud[] }>('/api/clouds/map', query),
+    create: (form: FormData) => apiForm<{ cloud: { id: string; cloud_type_id: number | null }; unlockedBadge: UnlockedBadgeResponse | null }>('/api/clouds', form),
+    update: (id: string, body: Record<string, unknown>) => apiJson<{ cloud: Cloud }>(`/api/clouds/${id}`, {
+      method: 'PATCH',
+      body,
+    }),
+    delete: (id: string) => apiJson<{ deleted: string[]; fileCleanupFailed: boolean }>(`/api/clouds/${id}`, {
+      method: 'DELETE',
+    }),
+  },
+  admin: {
+    stats: () => apiGet<{ stats: Record<string, number> }>('/api/admin/stats'),
+    users: () => apiGet<{ data: Profile[] }>('/api/admin/users'),
+    clouds: () => apiGet<{ data: Cloud[] }>('/api/admin/clouds'),
+    updateClouds: (ids: string[], body: { status?: string; is_hidden?: boolean }) => apiJson<{ updated: string[] }>('/api/admin/clouds', {
+      method: 'PATCH',
+      body: { ids, ...body },
+    }),
+    updateUser: (id: string, body: { role?: Profile['role']; is_disabled?: boolean }) => apiJson<{ profile: Profile }>(`/api/admin/users/${id}`, {
+      method: 'PATCH',
+      body,
+    }),
+  },
+}
diff --git a/src/lib/authEmail.ts b/src/lib/authEmail.ts
deleted file mode 100644
index bbf3d6d..0000000
--- a/src/lib/authEmail.ts
+++ /dev/null
@@ -1,152 +0,0 @@
-import {
-  createClient,
-  type EmailOtpType,
-  type Session,
-  type SupabaseClient,
-} from '@supabase/supabase-js'
-
-const supabaseUrl = import.meta.env.VITE_SUPABASE_URL
-const supabaseKey = import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY
-
-const knownEmailOtpTypes = new Set<EmailOtpType>([
-  'signup',
-  'invite',
-  'magiclink',
-  'recovery',
-  'email_change',
-  'email',
-])
-
-type AuthCallbackParams = {
-  accessToken: string | null
-  code: string | null
-  error: string | null
-  errorCode: string | null
-  errorDescription: string | null
-  refreshToken: string | null
-  tokenHash: string | null
-  type: EmailOtpType | null
-}
-
-type ResolveEmailAuthCallbackOptions = {
-  allowedTypes: EmailOtpType[]
-  client: SupabaseClient
-}
-
-type ResolveEmailAuthCallbackResult =
-  | {
-      ok: true
-      session: Session | null
-      type: EmailOtpType | null
-    }
-  | {
-      ok: false
-      error: string
-    }
-
-function parseEmailOtpType(value: string | null): EmailOtpType | null {
-  if (!value || !knownEmailOtpTypes.has(value as EmailOtpType)) {
-    return null
-  }
-
-  return value as EmailOtpType
-}
-
-export function readAuthCallbackParams(): AuthCallbackParams {
-  const search = new URLSearchParams(window.location.search)
-  const hash = new URLSearchParams(window.location.hash.slice(1))
-
-  return {
-    code: search.get('code'),
-    tokenHash: search.get('token_hash') ?? hash.get('token_hash'),
-    accessToken: hash.get('access_token'),
-    refreshToken: hash.get('refresh_token'),
-    type: parseEmailOtpType(search.get('type') ?? hash.get('type')),
-    error: search.get('error') ?? hash.get('error'),
-    errorCode: search.get('error_code') ?? hash.get('error_code'),
-    errorDescription: search.get('error_description') ?? hash.get('error_description'),
-  }
-}
-
-export function clearAuthCallbackUrl() {
-  window.history.replaceState(null, '', window.location.pathname)
-}
-
-export function createDetachedAuthClient() {
-  return createClient(supabaseUrl, supabaseKey, {
-    auth: {
-      autoRefreshToken: false,
-      detectSessionInUrl: false,
-      persistSession: false,
-    },
-  })
-}
-
-export async function resolveEmailAuthCallback(
-  options: ResolveEmailAuthCallbackOptions,
-): Promise<ResolveEmailAuthCallbackResult> {
-  const { client, allowedTypes } = options
-  const params = readAuthCallbackParams()
-  const allowedTypeSet = new Set(allowedTypes)
-
-  if (params.error || params.errorCode || params.errorDescription) {
-    return {
-      ok: false,
-      error: params.errorDescription || '链接无效或已过期。',
-    }
-  }
-
-  try {
-    let session: Session | null = null
-
-    if (params.tokenHash && params.type && allowedTypeSet.has(params.type)) {
-      const { data, error } = await client.auth.verifyOtp({
-        token_hash: params.tokenHash,
-        type: params.type,
-      })
-      if (error) throw error
-      session = data.session
-    } else if (params.code) {
-      const { data, error } = await client.auth.exchangeCodeForSession(params.code)
-      if (error) throw error
-      session = data.session
-    } else if (
-      params.accessToken
-      && params.refreshToken
-      && params.type
-      && allowedTypeSet.has(params.type)
-    ) {
-      const { data, error } = await client.auth.setSession({
-        access_token: params.accessToken,
-        refresh_token: params.refreshToken,
-      })
-      if (error) throw error
-      session = data.session
-    } else {
-      return {
-        ok: false,
-        error: '链接无效或已过期。',
-      }
-    }
-
-    if (!session) {
-      const { data, error } = await client.auth.getSession()
-      if (error) throw error
-      session = data.session
-    }
-
-    clearAuthCallbackUrl()
-
-    return {
-      ok: true,
-      session,
-      type: params.type,
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : '链接无效或已过期。'
-    return {
-      ok: false,
-      error: message,
-    }
-  }
-}
diff --git a/src/lib/supabase.ts b/src/lib/supabase.ts
deleted file mode 100644
index 95820f9..0000000
--- a/src/lib/supabase.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { createClient } from '@supabase/supabase-js'
-
-const supabaseUrl = import.meta.env.VITE_SUPABASE_URL
-const supabaseKey = import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY
-
-if (!supabaseUrl || !supabaseKey) {
-  throw new Error('Missing Supabase environment variables')
-}
-
-export const supabase = createClient(supabaseUrl, supabaseKey, {
-  auth: {
-    // Email confirmation and password recovery are handled by route components.
-    detectSessionInUrl: false,
-  },
-})
diff --git a/src/stores/auth.ts b/src/stores/auth.ts
index fa6b96f..8304c43 100644
--- a/src/stores/auth.ts
+++ b/src/stores/auth.ts
@@ -1,11 +1,10 @@
 import { defineStore } from 'pinia'
 import { ref, computed } from 'vue'
-import { supabase } from '@/lib/supabase'
-import type { User } from '@supabase/supabase-js'
+import { api, type ApiUser } from '@/lib/api'
 import type { Profile } from '@/types/database'
 
 export const useAuthStore = defineStore('auth', () => {
-  const user = ref<User | null>(null)
+  const user = ref<ApiUser | null>(null)
   const profile = ref<Profile | null>(null)
   const loading = ref(true)
 
@@ -15,74 +14,32 @@ export const useAuthStore = defineStore('auth', () => {
   async function fetchProfile(userId?: string) {
     const id = userId ?? user.value?.id
     if (!id) return
-    const { data } = await supabase
-      .from('profiles')
-      .select('*')
-      .eq('id', id)
-      .single()
-    if (data) {
-      profile.value = data as Profile
-    }
+    const { profile: nextProfile } = await api.profiles.get(id)
+    profile.value = nextProfile
   }
 
   async function ensureUsernameAvailable(username: string, currentUserId?: string) {
-    let query = supabase
-      .from('profiles')
-      .select('id')
-      .eq('username', username)
-      .limit(1)
-
-    if (currentUserId) {
-      query = query.neq('id', currentUserId)
-    }
-
-    const { data, error } = await query
-    if (error) throw error
-    if (data?.length) {
+    const { available } = await api.profiles.checkUsername(username, currentUserId)
+    if (!available) {
       throw new Error('这个昵称已经被使用，请换一个。')
     }
   }
 
   async function login(email: string, password: string) {
-    const { data, error } = await supabase.auth.signInWithPassword({ email, password })
-    if (error) {
-      if (error.message.includes('Invalid login credentials')) {
-        throw new Error('邮箱或密码错误')
-      }
-      if (error.message.includes('Email not confirmed')) {
-        throw new Error('邮箱未确认，请先查收确认邮件')
-      }
-      throw error
-    }
-    await fetchProfile(data.user.id)
+    const data = await api.auth.login(email, password)
     user.value = data.user
+    profile.value = data.profile
   }
 
   async function register(email: string, password: string, username: string) {
     await ensureUsernameAvailable(username)
-
-    const { error } = await supabase.auth.signUp({
-      email,
-      password,
-      options: {
-        data: { username },
-        emailRedirectTo: `${window.location.origin}/auth/confirm`,
-      },
-    })
-    if (error) {
-      if (error.message.includes('already registered')) {
-        throw new Error('该邮箱已被注册')
-      }
-      if (error.message.includes('Password')) {
-        throw new Error('密码强度不足，请使用至少6位密码')
-      }
-      throw error
-    }
+    const data = await api.auth.register(email, password, username)
+    user.value = data.user
+    profile.value = data.profile
   }
 
   async function logout() {
-    const { error } = await supabase.auth.signOut()
-    if (error) throw error
+    await api.auth.logout()
     user.value = null
     profile.value = null
   }
@@ -92,58 +49,28 @@ export const useAuthStore = defineStore('auth', () => {
 
     await ensureUsernameAvailable(username, user.value.id)
 
-    const { data, error } = await supabase
-      .from('profiles')
-      .update({ username })
-      .eq('id', user.value.id)
-      .select('*')
-      .single()
-
-    if (error) {
-      if (error.code === '23505') {
-        throw new Error('这个昵称已经被使用，请换一个。')
-      }
-      throw error
-    }
-
-    profile.value = data as Profile
+    const data = await api.profiles.updateMe(username)
+    user.value = data.user
+    profile.value = data.profile
   }
 
   async function updatePassword(password: string) {
-    const { error } = await supabase.auth.updateUser({ password })
-    if (error) throw error
+    await api.auth.updatePassword(password)
   }
 
   async function sendPasswordReset(email: string) {
-    const { error } = await supabase.auth.resetPasswordForEmail(email, {
-      redirectTo: `${window.location.origin}/auth/reset-password`,
-    })
-    if (error) {
-      if (error.message.includes('rate limit')) {
-        throw new Error('发送过于频繁，请稍后再试。')
-      }
-      throw error
-    }
+    void email
+    throw new Error('当前本地账号系统暂未启用邮件找回密码，请登录后在个人设置中修改密码，或联系管理员重置。')
   }
 
   async function initialize() {
-    const { data: { session } } = await supabase.auth.getSession()
-    const initialUser = session?.user ?? null
-    if (initialUser) await fetchProfile(initialUser.id)
-    user.value = initialUser
-    loading.value = false
-
-    supabase.auth.onAuthStateChange((_event, session) => {
-      const nextUser = session?.user ?? null
-      if (nextUser) {
-        fetchProfile(nextUser.id).then(() => {
-          user.value = nextUser
-        })
-      } else {
-        user.value = null
-        profile.value = null
-      }
-    })
+    try {
+      const data = await api.auth.me()
+      user.value = data.user
+      profile.value = data.profile
+    } finally {
+      loading.value = false
+    }
   }
 
   return {
diff --git a/src/stores/clouds.ts b/src/stores/clouds.ts
index 5a7a29e..c07a425 100644
--- a/src/stores/clouds.ts
+++ b/src/stores/clouds.ts
@@ -1,6 +1,6 @@
 import { defineStore } from 'pinia'
 import { ref } from 'vue'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
 import type { CloudType } from '@/types/database'
 
 export const useCloudsStore = defineStore('clouds', () => {
@@ -10,12 +10,9 @@ export const useCloudsStore = defineStore('clouds', () => {
   async function fetchCloudTypes() {
     if (cloudTypes.value.length > 0) return
     loading.value = true
-    const { data } = await supabase
-      .from('cloud_types')
-      .select('*')
-      .order('id')
+    const { data } = await api.cloudTypes.list()
     if (data) {
-      cloudTypes.value = data as CloudType[]
+      cloudTypes.value = data
     }
     loading.value = false
   }
diff --git a/src/stores/encyclopedia.ts b/src/stores/encyclopedia.ts
index 979b181..963d9f3 100644
--- a/src/stores/encyclopedia.ts
+++ b/src/stores/encyclopedia.ts
@@ -1,6 +1,6 @@
 import { computed, ref } from 'vue'
 import { defineStore } from 'pinia'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
 import { useAuthStore } from '@/stores/auth'
 import type { CloudType, UserCollection } from '@/types/database'
 
@@ -25,22 +25,6 @@ function getErrorMessage(error: unknown) {
   return '图鉴收藏加载失败'
 }
 
-function toCollectionCloudMap(rows: Array<Record<string, unknown>> | null) {
-  return new Map(
-    (rows || []).map(row => [
-      row.id as string,
-      {
-        id: row.id as string,
-        image_url: row.image_url as string,
-        thumbnail_url: (row.thumbnail_url as string | null) ?? null,
-        captured_at: (row.captured_at as string | null) ?? null,
-        created_at: row.created_at as string,
-        location_name: (row.location_name as string | null) ?? null,
-      } satisfies CollectionPreviewCloud,
-    ]),
-  )
-}
-
 export const useEncyclopediaStore = defineStore('encyclopedia', () => {
   const authStore = useAuthStore()
 
@@ -68,14 +52,8 @@ export const useEncyclopediaStore = defineStore('encyclopedia', () => {
 
     loadingCloudTypes.value = true
     try {
-      const { data, error } = await supabase
-        .from('cloud_types')
-        .select('*')
-        .order('id')
-
-      if (error) throw error
-
-      cloudTypes.value = (data || []) as CloudType[]
+      const { data } = await api.cloudTypes.list()
+      cloudTypes.value = data || []
       cloudTypesLoaded.value = true
     } finally {
       loadingCloudTypes.value = false
@@ -98,36 +76,8 @@ export const useEncyclopediaStore = defineStore('encyclopedia', () => {
     collectionError.value = ''
 
     try {
-      const { data, error } = await supabase
-        .from('user_collections')
-        .select('*')
-        .eq('user_id', userId)
-        .order('unlocked_at', { ascending: true })
-
-      if (error) throw error
-
-      const collectionRows = (data || []) as UserCollection[]
-      const firstCloudIds = collectionRows
-        .map(item => item.first_cloud_id)
-        .filter((id): id is string => typeof id === 'string' && id.length > 0)
-
-      let firstCloudMap = new Map<string, CollectionPreviewCloud>()
-
-      if (firstCloudIds.length) {
-        const { data: firstCloudData, error: firstCloudError } = await supabase
-          .from('clouds')
-          .select('id,image_url,thumbnail_url,captured_at,created_at,location_name')
-          .in('id', firstCloudIds)
-
-        if (firstCloudError) throw firstCloudError
-
-        firstCloudMap = toCollectionCloudMap(firstCloudData as Array<Record<string, unknown>> | null)
-      }
-
-      myCollection.value = collectionRows.map(item => ({
-        ...item,
-        firstCloud: item.first_cloud_id ? firstCloudMap.get(item.first_cloud_id) ?? null : null,
-      }))
+      const { data } = await api.collections.mine()
+      myCollection.value = data
       collectionLoadedForUserId.value = userId
     } catch (error) {
       myCollection.value = []
diff --git a/src/stores/profile.ts b/src/stores/profile.ts
index 761b255..209d609 100644
--- a/src/stores/profile.ts
+++ b/src/stores/profile.ts
@@ -1,6 +1,6 @@
 import { ref } from 'vue'
 import { defineStore } from 'pinia'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
 import type { CloudType, Profile } from '@/types/database'
 
 export interface ProfileCloudItem {
@@ -44,28 +44,6 @@ function toProfileCloud(row: Record<string, unknown>) {
   } satisfies ProfileCloudItem
 }
 
-function getSupabaseErrorCode(error: unknown) {
-  if (!error || typeof error !== 'object' || !('code' in error)) return null
-  const code = (error as { code?: unknown }).code
-  return typeof code === 'string' ? code : null
-}
-
-function getCloudStoragePath(publicUrl: string | null) {
-  if (!publicUrl) return null
-
-  try {
-    const url = new URL(publicUrl)
-    const marker = '/storage/v1/object/public/clouds/'
-    const markerIndex = url.pathname.indexOf(marker)
-    if (markerIndex === -1) return null
-
-    const path = url.pathname.slice(markerIndex + marker.length)
-    return path ? decodeURIComponent(path) : null
-  } catch {
-    return null
-  }
-}
-
 export const useProfileStore = defineStore('profile-page', () => {
   const profilesById = ref<Record<string, Profile>>({})
   const cloudsByKey = ref<Record<string, ProfileCloudItem[]>>({})
@@ -102,32 +80,13 @@ export const useProfileStore = defineStore('profile-page', () => {
     errorByKey.value[key] = ''
 
     try {
-      const { data: profile, error: profileError } = await supabase
-        .from('profiles')
-        .select('*')
-        .eq('id', userId)
-        .single()
+      const [{ profile }, { data: cloudRows }] = await Promise.all([
+        api.profiles.get(userId),
+        api.profiles.clouds(userId, isOwnProfile),
+      ])
 
-      if (profileError) throw profileError
-      profilesById.value[userId] = profile as Profile
-
-      let cloudsQuery = supabase
-        .from('clouds')
-        .select('id,cloud_type_id,image_url,thumbnail_url,latitude,longitude,location_name,description,captured_at,created_at,status,is_hidden,custom_cloud_type,cloud_types(name,rarity)')
-        .eq('user_id', userId)
-        .order('captured_at', { ascending: false, nullsFirst: false })
-        .order('created_at', { ascending: false })
-
-      if (!isOwnProfile) {
-        cloudsQuery = cloudsQuery
-          .eq('status', 'approved')
-          .eq('is_hidden', false)
-      }
-
-      const { data: cloudRows, error: cloudsError } = await cloudsQuery
-      if (cloudsError) throw cloudsError
-
-      cloudsByKey.value[key] = ((cloudRows || []) as Array<Record<string, unknown>>).map(toProfileCloud)
+      profilesById.value[userId] = profile
+      cloudsByKey.value[key] = ((cloudRows || []) as unknown as Array<Record<string, unknown>>).map(toProfileCloud)
     } catch (error) {
       errorByKey.value[key] = error instanceof Error ? error.message : '个人主页加载失败'
       cloudsByKey.value[key] = []
@@ -178,76 +137,24 @@ export const useProfileStore = defineStore('profile-page', () => {
     captured_at: string | null
     is_hidden: boolean
   }) {
-    const { data, error } = await supabase
-      .from('clouds')
-      .update(patch)
-      .eq('id', cloudId)
-      .eq('user_id', userId)
-      .select('id,cloud_type_id,image_url,thumbnail_url,latitude,longitude,location_name,description,captured_at,created_at,status,is_hidden,custom_cloud_type,cloud_types(name,rarity)')
-      .single()
-
-    if (error) throw error
-
-    const updated = toProfileCloud(data as Record<string, unknown>)
+    const { cloud } = await api.clouds.update(cloudId, patch)
+    const updated = toProfileCloud(cloud as unknown as Record<string, unknown>)
     patchCachedCloud(userId, cloudId, updated)
     return updated
   }
 
   async function updateCloudVisibility(userId: string, cloudId: string, isHidden: boolean) {
-    const { data, error } = await supabase
-      .from('clouds')
-      .update({ is_hidden: isHidden })
-      .eq('id', cloudId)
-      .eq('user_id', userId)
-      .select('id')
-
-    if (error) throw error
-    if (!data?.length) {
-      throw new Error('私密状态没有写入数据库，请检查 clouds 表的 UPDATE RLS policy。')
-    }
-
+    await api.clouds.update(cloudId, { is_hidden: isHidden })
     patchCachedCloud(userId, cloudId, { is_hidden: isHidden })
   }
 
   async function deleteClouds(userId: string, cloudIds: string[]) {
     if (!cloudIds.length) return 0
 
-    const { data, error } = await supabase
-      .from('clouds')
-      .delete()
-      .eq('user_id', userId)
-      .in('id', cloudIds)
-      .select('id,image_url,thumbnail_url')
-
-    if (error) {
-      if (getSupabaseErrorCode(error) === '23503') {
-        throw new Error('这张照片仍被图鉴收藏记录引用，请先在数据库把 user_collections.first_cloud_id 外键改为 ON DELETE SET NULL。')
-      }
-      throw error
-    }
-
-    const deletedIds = (data || []).map(item => item.id as string)
+    const results = await Promise.all(cloudIds.map(id => api.clouds.delete(id)))
+    const deletedIds = results.flatMap(result => result.deleted)
     if (deletedIds.length !== cloudIds.length) {
-      throw new Error('图片没有真正从数据库删除，请检查 clouds 表的 DELETE RLS policy。')
-    }
-
-    const storagePaths = Array.from(new Set(
-      (data || [])
-        .flatMap(item => [
-          getCloudStoragePath((item.image_url as string | null) ?? null),
-          getCloudStoragePath((item.thumbnail_url as string | null) ?? null),
-        ])
-        .filter((path): path is string => !!path),
-    ))
-
-    if (storagePaths.length) {
-      const { error: storageError } = await supabase.storage
-        .from('clouds')
-        .remove(storagePaths)
-
-      if (storageError) {
-        throw new Error(`图片数据库记录已删除，但 Supabase Storage 文件清理失败：${storageError.message}`)
-      }
+      throw new Error('图片没有完全删除，请刷新后重试。')
     }
 
     removeCachedClouds(userId, deletedIds)
diff --git a/src/views/admin/AdminView.vue b/src/views/admin/AdminView.vue
index 0e4c1df..be463c4 100644
--- a/src/views/admin/AdminView.vue
+++ b/src/views/admin/AdminView.vue
@@ -4,7 +4,7 @@ import { NAlert, NButton, NEmpty, NIcon, NSkeleton, NTag, useMessage } from 'nai
 import { Check, Eye, EyeOff, Refresh, Trash, X } from '@vicons/tabler'
 import ImageDetailModal from '@/components/cloud/ImageDetailModal.vue'
 import MiniLocationMap from '@/components/cloud/MiniLocationMap.vue'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
 import { useAuthStore } from '@/stores/auth'
 import { useProfileStore } from '@/stores/profile'
 import type { CloudType, Profile } from '@/types/database'
@@ -172,88 +172,27 @@ function getErrorMessage(error: unknown, fallback: string) {
   return parts.length ? parts.join('；') : fallback
 }
 
-function todayIsoStart() {
-  const date = new Date()
-  date.setHours(0, 0, 0, 0)
-  return date.toISOString()
-}
-
-async function countProfiles() {
-  const { count, error } = await supabase
-    .from('profiles')
-    .select('*', { head: true, count: 'exact' })
-  if (error) throw error
-  return count || 0
-}
-
-async function countClouds(filters: {
-  status?: CloudStatus
-  isHidden?: boolean
-  createdAfter?: string
-} = {}) {
-  let query = supabase
-    .from('clouds')
-    .select('*', { head: true, count: 'exact' })
-
-  if (filters.status) query = query.eq('status', filters.status)
-  if (typeof filters.isHidden === 'boolean') query = query.eq('is_hidden', filters.isHidden)
-  if (filters.createdAfter) query = query.gte('created_at', filters.createdAfter)
-
-  const { count, error } = await query
-  if (error) throw error
-  return count || 0
-}
-
 async function fetchStats() {
-  const [
-    userCount,
-    imageCount,
-    todayUploads,
-    pendingCount,
-    approvedCount,
-    rejectedCount,
-    hiddenCount,
-  ] = await Promise.all([
-    countProfiles(),
-    countClouds(),
-    countClouds({ createdAfter: todayIsoStart() }),
-    countClouds({ status: 'pending' }),
-    countClouds({ status: 'approved' }),
-    countClouds({ status: 'rejected' }),
-    countClouds({ isHidden: true }),
-  ])
-
+  const { stats } = await api.admin.stats()
   dashboardStats.value = {
-    users: userCount,
-    images: imageCount,
-    todayUploads,
-    pending: pendingCount,
-    approved: approvedCount,
-    rejected: rejectedCount,
-    hidden: hiddenCount,
+    users: stats.users || 0,
+    images: stats.images || 0,
+    todayUploads: stats.todayUploads || 0,
+    pending: stats.pending || 0,
+    approved: stats.approved || 0,
+    rejected: stats.rejected || 0,
+    hidden: stats.hidden || 0,
   }
 }
 
 async function fetchUsers() {
-  const { data, error } = await supabase
-    .from('profiles')
-    .select('id,username,avatar_url,role,is_disabled,created_at')
-    .order('created_at', { ascending: false })
-    .limit(100)
-
-  if (error) throw error
-  users.value = (data || []) as Profile[]
+  const { data } = await api.admin.users()
+  users.value = data || []
 }
 
 async function fetchImages() {
-  const { data, error } = await supabase
-    .from('clouds')
-    .select('id,user_id,cloud_type_id,custom_cloud_type,image_url,thumbnail_url,latitude,longitude,location_name,description,captured_at,created_at,status,is_hidden,cloud_types(name,rarity),profiles(username)')
-    .order('created_at', { ascending: false })
-    .limit(120)
-
-  if (error) throw error
-  images.value = ((data || []) as Array<Record<string, unknown>>).map(toAdminCloud)
+  const { data } = await api.admin.clouds()
+  images.value = ((data || []) as unknown as Array<Record<string, unknown>>).map(toAdminCloud)
   selectedReviewIds.value = new Set([...selectedReviewIds.value].filter(id => images.value.some(item => item.id === id)))
   selectedImageIds.value = new Set([...selectedImageIds.value].filter(id => images.value.some(item => item.id === id)))
 }
@@ -334,18 +273,9 @@ async function updateCloudStatus(ids: string[], status: CloudStatus) {
   loadError.value = ''
 
   try {
-    let query = supabase
-      .from('clouds')
-      .update({ status })
-      .select('id')
-
-    query = ids.length === 1 ? query.eq('id', ids[0]) : query.in('id', ids)
-
-    const { data, error } = await query
-
-    if (error) throw error
-    if ((data || []).length !== ids.length) {
-      throw new Error('部分图片状态没有写入数据库，请检查管理员 UPDATE RLS policy。')
+    const { updated } = await api.admin.updateClouds(ids, { status })
+    if (updated.length !== ids.length) {
+      throw new Error('部分图片状态没有写入数据库。')
     }
 
     patchImages(ids, { status })
@@ -369,15 +299,9 @@ async function updateImageVisibility(ids: string[], isHidden: boolean) {
   loadError.value = ''
 
   try {
-    const { data, error } = await supabase
-      .from('clouds')
-      .update({ is_hidden: isHidden })
-      .in('id', ids)
-      .select('id')
-
-    if (error) throw error
-    if ((data || []).length !== ids.length) {
-      throw new Error('图片可见性没有写入数据库，请检查管理员 UPDATE RLS policy。')
+    const { updated } = await api.admin.updateClouds(ids, { is_hidden: isHidden })
+    if (updated.length !== ids.length) {
+      throw new Error('图片可见性没有写入数据库。')
     }
 
     patchImages(ids, { is_hidden: isHidden })
@@ -455,18 +379,8 @@ async function updateUserRole(user: Profile, role: Profile['role']) {
   loadError.value = ''
 
   try {
-    const { data, error } = await supabase
-      .from('profiles')
-      .update({ role })
-      .eq('id', user.id)
-      .select('id,role')
-
-    if (error) throw error
-    if (!data?.length) {
-      throw new Error('用户角色没有写入数据库，请检查管理员 UPDATE RLS policy。')
-    }
-
-    users.value = users.value.map(item => (item.id === user.id ? { ...item, role } : item))
+    const { profile } = await api.admin.updateUser(user.id, { role })
+    users.value = users.value.map(item => (item.id === user.id ? profile : item))
     message.success('用户角色已更新')
   } catch (error) {
     const text = getErrorMessage(error, '用户角色更新失败')
@@ -488,18 +402,8 @@ async function toggleUserDisabled(user: Profile) {
 
   try {
     const nextDisabled = !user.is_disabled
-    const { data, error } = await supabase
-      .from('profiles')
-      .update({ is_disabled: nextDisabled })
-      .eq('id', user.id)
-      .select('id,is_disabled')
-
-    if (error) throw error
-    if (!data?.length) {
-      throw new Error('用户状态没有写入数据库，请检查 profiles 表的 UPDATE RLS policy。')
-    }
-
-    users.value = users.value.map(item => (item.id === user.id ? { ...item, is_disabled: nextDisabled } : item))
+    const { profile } = await api.admin.updateUser(user.id, { is_disabled: nextDisabled })
+    users.value = users.value.map(item => (item.id === user.id ? profile : item))
     message.success(nextDisabled ? '用户已禁用' : '用户已恢复')
   } catch (error) {
     const text = getErrorMessage(error, '用户状态更新失败')
@@ -522,7 +426,7 @@ onMounted(loadAdminData)
             <p class="text-sm font-semibold uppercase tracking-[0.24em] text-sky-700">Admin Console</p>
             <h1 class="mt-3 text-4xl font-bold text-slate-950">管理后台</h1>
             <p class="mt-4 max-w-2xl text-sm leading-7 text-slate-600">
-              集中处理社区云图审核、图片可见性、用户角色和运行数据。所有写入都直接落到 Supabase。
+              集中处理社区云图审核、图片可见性、用户角色和运行数据。所有写入都通过本地后端 API 校验后落库。
             </p>
           </div>
 
diff --git a/src/views/auth/AuthConfirmView.vue b/src/views/auth/AuthConfirmView.vue
index 911b892..1172b1c 100644
--- a/src/views/auth/AuthConfirmView.vue
+++ b/src/views/auth/AuthConfirmView.vue
@@ -1,85 +1,22 @@
 <script setup lang="ts">
-import { ref, onMounted, onUnmounted } from 'vue'
-import { useRouter } from 'vue-router'
-import { NButton, NCard, NResult, NSpin } from 'naive-ui'
-import { createDetachedAuthClient, resolveEmailAuthCallback } from '@/lib/authEmail'
-
-const router = useRouter()
-
-const state = ref<'loading' | 'success' | 'failed'>('loading')
-const countdown = ref(5)
-let countdownTimer: ReturnType<typeof setInterval> | null = null
-
-function startCountdown() {
-  countdownTimer = setInterval(() => {
-    countdown.value--
-    if (countdown.value <= 0) {
-      if (countdownTimer) clearInterval(countdownTimer)
-      router.push('/login')
-    }
-  }, 1000)
-}
-
-onMounted(async () => {
-  try {
-    const confirmClient = createDetachedAuthClient()
-    const result = await resolveEmailAuthCallback({
-      client: confirmClient,
-      allowedTypes: ['signup', 'email'],
-    })
-
-    if (!result.ok) {
-      state.value = 'failed'
-      return
-    }
-
-    await confirmClient.auth.signOut()
-    state.value = 'success'
-    startCountdown()
-  } catch {
-    state.value = 'failed'
-  }
-})
-
-onUnmounted(() => {
-  if (countdownTimer) clearInterval(countdownTimer)
-})
+import { NButton, NCard, NResult } from 'naive-ui'
 </script>
 
 <template>
   <div class="min-h-[calc(100vh-4rem)] px-4 py-10">
     <div class="mx-auto max-w-3xl">
       <NCard class="shadow-[12px_12px_0_0_rgba(15,23,42,0.08)]">
-      <template v-if="state === 'success'">
-        <NResult status="success" title="邮箱认证成功" description="你的邮箱已确认，现在可以登录了。">
+        <NResult
+          status="info"
+          title="本地账号无需邮箱确认"
+          description="OpenCloud 当前使用本地 PostgreSQL 账号系统，注册后可以直接登录。"
+        >
           <template #footer>
-            <div class="space-y-4">
-              <p class="text-sm text-slate-500">{{ countdown }} 秒后自动跳转登录页面...</p>
-              <RouterLink to="/login" class="no-underline">
-                <NButton type="primary" class="oc-primary-button oc-primary-button--teal">立即登录</NButton>
-              </RouterLink>
-            </div>
-          </template>
-        </NResult>
-      </template>
-
-      <template v-else-if="state === 'failed'">
-        <NResult status="error" title="认证失败" description="邮箱确认链接无效或已过期，请重新注册。">
-          <template #footer>
-            <RouterLink to="/register" class="no-underline">
-              <NButton type="primary" class="oc-primary-button oc-primary-button--sky">重新注册</NButton>
+            <RouterLink to="/login" class="no-underline">
+              <NButton type="primary" class="oc-primary-button oc-primary-button--teal">去登录</NButton>
             </RouterLink>
           </template>
         </NResult>
-      </template>
-
-      <template v-else>
-        <div class="flex flex-col items-center justify-center py-12 text-center">
-          <NSpin size="large" />
-          <h1 class="mt-6 text-2xl font-bold text-slate-900">正在验证...</h1>
-          <p class="mt-2 text-slate-500">请稍候</p>
-        </div>
-      </template>
       </NCard>
     </div>
   </div>
diff --git a/src/views/auth/ForgotPasswordView.vue b/src/views/auth/ForgotPasswordView.vue
index d4ad0ec..ddcc4ae 100644
--- a/src/views/auth/ForgotPasswordView.vue
+++ b/src/views/auth/ForgotPasswordView.vue
@@ -81,18 +81,18 @@ onUnmounted(() => {
           <span class="block text-sky-700">OpenCloud 账号</span>
         </h1>
         <p class="mt-6 max-w-lg text-base leading-8 text-slate-600">
-          输入注册邮箱后，我们会发送一封密码重置邮件。打开邮件中的链接，即可进入新的密码设置页面。
+          当前本地账号系统暂未启用邮件找回密码。已登录用户可以在个人设置中修改密码；无法登录时请联系管理员处理。
         </p>
         <div class="mt-8 grid gap-4 sm:grid-cols-2">
           <div class="border border-slate-200 bg-white px-4 py-3">
             <div class="text-xs uppercase tracking-[0.2em] text-slate-500">Step 1</div>
-            <div class="mt-2 text-lg font-bold text-slate-900">发送邮件</div>
-            <div class="mt-1 text-sm text-slate-500">使用注册邮箱请求重置链接</div>
+            <div class="mt-2 text-lg font-bold text-slate-900">联系管理员</div>
+            <div class="mt-1 text-sm text-slate-500">确认账号归属后处理</div>
           </div>
           <div class="border border-slate-200 bg-white px-4 py-3">
             <div class="text-xs uppercase tracking-[0.2em] text-slate-500">Step 2</div>
-            <div class="mt-2 text-lg font-bold text-slate-900">设置新密码</div>
-            <div class="mt-1 text-sm text-slate-500">在专用页面完成新密码更新</div>
+            <div class="mt-2 text-lg font-bold text-slate-900">个人设置</div>
+            <div class="mt-1 text-sm text-slate-500">登录后可自行修改密码</div>
           </div>
         </div>
       </section>
@@ -101,8 +101,8 @@ onUnmounted(() => {
         <NResult
           v-if="submitted"
           status="success"
-          title="重置邮件已发送"
-          description="如果该邮箱已注册，请查收邮件中的重置链接。"
+          title="暂未启用邮件重置"
+          description="当前版本不会发送密码重置邮件，请联系管理员或登录后在个人设置中修改。"
         >
           <template #footer>
             <div class="space-y-4">
@@ -132,7 +132,7 @@ onUnmounted(() => {
           <div class="mb-8">
             <div class="text-sm uppercase tracking-[0.22em] text-slate-500">Reset Request</div>
             <h2 class="mt-3 text-3xl font-bold text-slate-900">忘记密码</h2>
-            <p class="mt-2 text-sm text-slate-500">输入你的注册邮箱，我们会发送一封密码重置邮件。</p>
+            <p class="mt-2 text-sm text-slate-500">当前版本暂未启用邮件发送；提交后会显示处理说明。</p>
           </div>
 
           <NForm @submit.prevent="handleSendResetEmail">
diff --git a/src/views/auth/RegisterView.vue b/src/views/auth/RegisterView.vue
index f5a8bdb..22f16c3 100644
--- a/src/views/auth/RegisterView.vue
+++ b/src/views/auth/RegisterView.vue
@@ -77,13 +77,13 @@ async function handleRegister() {
         <NResult
           v-if="emailSent"
           status="success"
-          title="确认你的邮箱"
-          description="确认邮件已经发送，请查收并点击链接完成注册。"
+          title="注册成功"
+          description="账号已经创建，本地账号系统无需邮箱确认，可以直接登录。"
         >
           <template #footer>
             <div class="space-y-4">
               <p class="text-sm text-slate-500">
-                目标邮箱：
+                注册邮箱：
                 <span class="font-semibold text-slate-700">{{ email }}</span>
               </p>
               <RouterLink to="/login" class="no-underline">
diff --git a/src/views/auth/ResetPasswordView.vue b/src/views/auth/ResetPasswordView.vue
index 4580f6c..14cded0 100644
--- a/src/views/auth/ResetPasswordView.vue
+++ b/src/views/auth/ResetPasswordView.vue
@@ -1,118 +1,5 @@
 <script setup lang="ts">
-import { computed, onMounted, onUnmounted, ref } from 'vue'
-import { useRouter } from 'vue-router'
-import { NAlert, NButton, NCard, NForm, NFormItem, NInput, NResult, NSpin } from 'naive-ui'
-import { resolveEmailAuthCallback } from '@/lib/authEmail'
-import { supabase } from '@/lib/supabase'
-
-const router = useRouter()
-
-const password = ref('')
-const confirmPassword = ref('')
-const error = ref('')
-const state = ref<'checking' | 'ready' | 'invalid' | 'success'>('checking')
-const loading = ref(false)
-const countdown = ref(5)
-let countdownTimer: ReturnType<typeof setInterval> | null = null
-
-const canSubmit = computed(() =>
-  state.value === 'ready' && password.value.length >= 6 && password.value === confirmPassword.value,
-)
-
-function showInvalidRecoveryLink() {
-  error.value = '密码重置链接无效或已过期，请重新发送邮件。'
-  state.value = 'invalid'
-}
-
-function getResetErrorMessage(value: unknown) {
-  const message = value instanceof Error ? value.message : ''
-  if (
-    message.includes('Auth session missing')
-    || message.includes('session_not_found')
-    || message.includes('refresh_token_not_found')
-    || message.includes('Invalid Refresh Token')
-    || message.includes('otp_expired')
-    || message.includes('expired')
-  ) {
-    return '密码重置链接无效或已过期，请重新发送邮件。'
-  }
-
-  if (message.includes('Password should be at least')) {
-    return '新密码至少需要 6 位。'
-  }
-
-  return message || '密码重置失败，请稍后重试。'
-}
-
-function startCountdown() {
-  countdownTimer = setInterval(() => {
-    countdown.value--
-    if (countdown.value <= 0) {
-      if (countdownTimer) clearInterval(countdownTimer)
-      router.push('/')
-    }
-  }, 1000)
-}
-
-async function initializeRecoverySession() {
-  const result = await resolveEmailAuthCallback({
-    client: supabase,
-    allowedTypes: ['recovery'],
-  })
-
-  if (!result.ok || !result.session?.user) {
-    error.value = getResetErrorMessage(result.ok ? '链接无效或已过期。' : result.error)
-    state.value = 'invalid'
-    return
-  }
-
-  state.value = 'ready'
-}
-
-async function handleResetPassword() {
-  error.value = ''
-
-  if (password.value.length < 6) {
-    error.value = '新密码至少需要 6 位。'
-    return
-  }
-  if (password.value !== confirmPassword.value) {
-    error.value = '两次输入的密码不一致。'
-    return
-  }
-
-  const { data: { session }, error: sessionError } = await supabase.auth.getSession()
-  if (sessionError || !session?.user) {
-    showInvalidRecoveryLink()
-    return
-  }
-
-  loading.value = true
-  try {
-    const { error: updateError } = await supabase.auth.updateUser({ password: password.value })
-    if (updateError) throw updateError
-
-    window.history.replaceState(null, '', window.location.pathname)
-    countdown.value = 5
-    state.value = 'success'
-    startCountdown()
-  } catch (e) {
-    error.value = getResetErrorMessage(e)
-    if (error.value === '密码重置链接无效或已过期，请重新发送邮件。') {
-      state.value = 'invalid'
-    }
-  } finally {
-    loading.value = false
-  }
-}
-
-onMounted(() => {
-  void initializeRecoverySession()
-})
-
-onUnmounted(() => {
-  if (countdownTimer) clearInterval(countdownTimer)
-})
+import { NButton, NCard, NResult } from 'naive-ui'
 </script>
 
 <template>
@@ -120,88 +7,21 @@ onUnmounted(() => {
     <div class="mx-auto max-w-2xl">
       <NCard class="shadow-[12px_12px_0_0_rgba(15,23,42,0.08)]">
         <NResult
-          v-if="state === 'success'"
-          status="success"
-          title="密码已重置"
-          description="你已使用新密码完成更新，正在返回地图页。"
+          status="warning"
+          title="邮件重置暂未启用"
+          description="迁移到本地账号系统后，当前版本暂不发送密码重置邮件。已登录用户可在个人资料设置中修改密码。"
         >
           <template #footer>
-            <div class="space-y-4">
-              <p class="text-sm text-slate-500">{{ countdown }} 秒后自动跳转地图页面...</p>
-              <NButton type="primary" class="oc-primary-button oc-primary-button--teal" @click="router.push('/')">进入地图</NButton>
+            <div class="flex flex-wrap justify-center gap-3">
+              <RouterLink to="/login" class="no-underline">
+                <NButton type="primary" class="oc-primary-button oc-primary-button--teal">返回登录</NButton>
+              </RouterLink>
+              <RouterLink to="/profile/settings" class="no-underline">
+                <NButton type="default" class="oc-panel-button oc-panel-button--neutral">个人设置</NButton>
+              </RouterLink>
             </div>
           </template>
         </NResult>
-
-        <template v-else-if="state === 'checking'">
-          <div class="flex flex-col items-center justify-center py-12 text-center">
-            <NSpin size="large" />
-            <h1 class="mt-6 text-2xl font-bold text-slate-900">正在验证重置链接...</h1>
-            <p class="mt-2 text-slate-500">请稍候</p>
-          </div>
-        </template>
-
-        <template v-else>
-          <div class="mb-8">
-            <div class="text-sm uppercase tracking-[0.22em] text-slate-500">Password Recovery</div>
-            <h1 class="mt-3 text-3xl font-bold text-slate-900">设置新密码</h1>
-            <p class="mt-2 text-sm text-slate-500">
-              {{
-                state === 'invalid'
-                  ? '当前重置链接不可用，请重新发送密码重置邮件。'
-                  : '请输入新的登录密码，提交后当前重置链接会失效。'
-              }}
-            </p>
-          </div>
-
-          <NForm @submit.prevent="handleResetPassword">
-            <NFormItem label="新密码">
-              <NInput
-                v-model:value="password"
-                type="password"
-                required
-                show-password-on="click"
-                autocomplete="new-password"
-                placeholder="至少 6 位"
-              />
-            </NFormItem>
-
-            <NFormItem label="确认新密码">
-              <NInput
-                v-model:value="confirmPassword"
-                type="password"
-                required
-                show-password-on="click"
-                autocomplete="new-password"
-                placeholder="再次输入新密码"
-              />
-            </NFormItem>
-
-            <NAlert v-if="error" type="error" class="mb-4">
-              {{ error }}
-            </NAlert>
-
-            <RouterLink
-              v-if="state === 'invalid'"
-              to="/forgot-password"
-              class="mb-4 block text-sm font-semibold text-teal-700 hover:text-teal-800"
-            >
-              返回重新发送重置邮件
-            </RouterLink>
-
-            <NButton
-              attr-type="submit"
-              type="primary"
-              block
-              size="large"
-              class="oc-primary-button oc-primary-button--teal"
-              :disabled="!canSubmit"
-              :loading="loading"
-            >
-              保存新密码
-            </NButton>
-          </NForm>
-        </template>
       </NCard>
     </div>
   </div>
diff --git a/src/views/encyclopedia/CloudTypeView.vue b/src/views/encyclopedia/CloudTypeView.vue
index e50a746..bd9d931 100644
--- a/src/views/encyclopedia/CloudTypeView.vue
+++ b/src/views/encyclopedia/CloudTypeView.vue
@@ -4,7 +4,7 @@ import { NAlert, NButton, NCard, NEmpty, NSkeleton, NTag } from 'naive-ui'
 import { RouterLink, useRoute } from 'vue-router'
 import ImageDetailModal from '@/components/cloud/ImageDetailModal.vue'
 import MiniLocationMap from '@/components/cloud/MiniLocationMap.vue'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
 import { useAuthStore } from '@/stores/auth'
 import { useEncyclopediaStore } from '@/stores/encyclopedia'
 import type { CloudType } from '@/types/database'
@@ -82,32 +82,9 @@ function openGalleryDetail(item: CloudGalleryItem) {
 }
 
 async function loadGallery(typeId: number) {
-  const galleryQuery = supabase
-    .from('clouds')
-    .select('id,image_url,thumbnail_url,latitude,longitude,location_name,description,captured_at,created_at,profiles(username)')
-    .eq('cloud_type_id', typeId)
-    .eq('status', 'approved')
-    .eq('is_hidden', false)
-    .order('captured_at', { ascending: false, nullsFirst: false })
-    .order('created_at', { ascending: false })
-    .limit(24)
+  const { data: galleryData, count } = await api.cloudTypes.gallery(typeId)
 
-  const countQuery = supabase
-    .from('clouds')
-    .select('*', { head: true, count: 'exact' })
-    .eq('cloud_type_id', typeId)
-    .eq('status', 'approved')
-    .eq('is_hidden', false)
-
-  const [{ data: galleryData, error: galleryError }, { count, error: countError }] = await Promise.all([
-    galleryQuery,
-    countQuery,
-  ])
-
-  if (galleryError) throw galleryError
-  if (countError) throw countError
-
-  gallery.value = ((galleryData || []) as Array<Record<string, unknown>>).map(row => {
+  gallery.value = ((galleryData || []) as unknown as Array<Record<string, unknown>>).map(row => {
     const profiles = Array.isArray(row.profiles) ? row.profiles : row.profiles ? [row.profiles] : []
     const profile = profiles[0] as Record<string, unknown> | undefined
 
diff --git a/src/views/gallery/GalleryView.vue b/src/views/gallery/GalleryView.vue
index 8b46eb6..293c2b1 100644
--- a/src/views/gallery/GalleryView.vue
+++ b/src/views/gallery/GalleryView.vue
@@ -5,7 +5,7 @@ import { Clock, Location, Search, Settings, User, X } from '@vicons/tabler'
 import CloudEditModal, { type CloudEditFormValue } from '@/components/cloud/CloudEditModal.vue'
 import ImageDetailModal from '@/components/cloud/ImageDetailModal.vue'
 import MiniLocationMap from '@/components/cloud/MiniLocationMap.vue'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
 import { useAuthStore } from '@/stores/auth'
 import { useCloudsStore } from '@/stores/clouds'
 import { useProfileStore } from '@/stores/profile'
@@ -87,34 +87,6 @@ function formatCoordinate(value: number | null) {
 const normalizedSearch = computed(() => searchQuery.value.trim())
 const isUserSearch = computed(() => normalizedSearch.value.startsWith('@'))
 
-function sanitizeSearchTerm(term: string) {
-  return term.replace(/[(),*%]/g, ' ').replace(/\s+/g, ' ').trim()
-}
-
-function getMatchedCloudTypeIds(term: string) {
-  const lowerTerm = term.toLocaleLowerCase('zh-CN')
-  return cloudsStore.cloudTypes
-    .filter(type => {
-      return type.name.toLocaleLowerCase('zh-CN').includes(lowerTerm) ||
-        type.name_en.toLocaleLowerCase('zh-CN').includes(lowerTerm)
-    })
-    .map(type => type.id)
-}
-
-async function fetchUserIdsBySearch(term: string) {
-  const sanitized = sanitizeSearchTerm(term)
-  if (!sanitized) return []
-
-  const { data, error } = await supabase
-    .from('profiles')
-    .select('id')
-    .ilike('username', `%${sanitized}%`)
-    .limit(100)
-
-  if (error) throw error
-  return ((data || []) as Array<{ id: string }>).map(profile => profile.id)
-}
-
 function toGalleryCloud(row: Record<string, unknown>) {
   const cloudTypes = Array.isArray(row.cloud_types) ? row.cloud_types : row.cloud_types ? [row.cloud_types] : []
   const profiles = Array.isArray(row.profiles) ? row.profiles : row.profiles ? [row.profiles] : []
@@ -142,48 +114,12 @@ function toGalleryCloud(row: Record<string, unknown>) {
   } satisfies GalleryCloud
 }
 
-async function resolveSearchFilters() {
-  const search = normalizedSearch.value
-  const usernameTerm = isUserSearch.value ? sanitizeSearchTerm(search.slice(1)) : ''
-  const cloudTypeTerm = !isUserSearch.value ? sanitizeSearchTerm(search) : ''
-
-  if (isUserSearch.value && !usernameTerm) return null
-  if (search && !isUserSearch.value && !cloudTypeTerm) return null
-
-  let userIds: string[] = []
-  if (usernameTerm) {
-    userIds = await fetchUserIdsBySearch(usernameTerm)
-    if (userIds.length === 0) return null
-  }
-
-  const matchedCloudTypeIds = cloudTypeTerm ? getMatchedCloudTypeIds(cloudTypeTerm) : []
-
-  return { usernameTerm, cloudTypeTerm, userIds, matchedCloudTypeIds }
-}
-
-const FULL_SELECT = 'id,user_id,cloud_type_id,image_url,thumbnail_url,location_name,description,latitude,longitude,captured_at,created_at,status,is_hidden,custom_cloud_type,cloud_types(name,rarity),profiles(username)'
-
-function buildFilteredQuery(selectStr: string, options?: { count?: 'exact'; head?: boolean }) {
-  let query = supabase
-    .from('clouds')
-    .select(selectStr, options as any)
-    .eq('status', 'approved')
-    .eq('is_hidden', false)
-
-  if (selectedTypeId.value !== 'all') {
-    query = query.eq('cloud_type_id', selectedTypeId.value)
-  }
-
-  return query
-}
-
 async function loadPage(page: number) {
   loading.value = true
   loadError.value = ''
 
   try {
-    const filters = await resolveSearchFilters()
-    if (filters === null) {
+    if (isUserSearch.value && !normalizedSearch.value.slice(1).trim()) {
       galleryItems.value = []
       totalCount.value = 0
       currentPage.value = 1
@@ -191,29 +127,12 @@ async function loadPage(page: number) {
       return
     }
 
-    let countQuery = buildFilteredQuery('id', { count: 'exact', head: true })
-    let dataQuery = buildFilteredQuery(FULL_SELECT)
-      .order('created_at', { ascending: false })
-      .range((page - 1) * PAGE_SIZE, page * PAGE_SIZE - 1)
-
-    if (filters.usernameTerm) {
-      countQuery = countQuery.in('user_id', filters.userIds)
-      dataQuery = dataQuery.in('user_id', filters.userIds)
-    } else if (filters.cloudTypeTerm) {
-      if (filters.matchedCloudTypeIds.length) {
-        const orFilter = `cloud_type_id.in.(${filters.matchedCloudTypeIds.join(',')}),custom_cloud_type.ilike.*${filters.cloudTypeTerm}*`
-        countQuery = countQuery.or(orFilter)
-        dataQuery = dataQuery.or(orFilter)
-      } else {
-        countQuery = countQuery.ilike('custom_cloud_type', `%${filters.cloudTypeTerm}%`)
-        dataQuery = dataQuery.ilike('custom_cloud_type', `%${filters.cloudTypeTerm}%`)
-      }
-    }
-
-    const [{ count }, { data, error }] = await Promise.all([countQuery, dataQuery])
-
-    if (error) throw error
-
+    const { data, count } = await api.clouds.list({
+      page,
+      pageSize: PAGE_SIZE,
+      typeId: selectedTypeId.value,
+      search: normalizedSearch.value,
+    })
     totalCount.value = count ?? 0
     galleryItems.value = ((data || []) as unknown as Array<Record<string, unknown>>).map(toGalleryCloud)
     currentPage.value = page
diff --git a/src/views/map/MapView.vue b/src/views/map/MapView.vue
index 2461b70..4001cbd 100644
--- a/src/views/map/MapView.vue
+++ b/src/views/map/MapView.vue
@@ -3,7 +3,7 @@ import { computed, ref, onMounted, onUnmounted } from 'vue'
 import ImageDetailModal from '@/components/cloud/ImageDetailModal.vue'
 import MiniLocationMap from '@/components/cloud/MiniLocationMap.vue'
 import QuickUploadModal from '@/components/cloud/QuickUploadModal.vue'
-import { supabase } from '@/lib/supabase'
+import { api } from '@/lib/api'
 import { loadAMap } from '@/lib/amap'
 import { useAuthStore } from '@/stores/auth'
 import { NIcon } from 'naive-ui'
@@ -232,24 +232,17 @@ function toCloudMarker(row: Record<string, unknown>): CloudMarkerData {
 }
 
 async function fetchCloudsByRange(field: 'captured_at' | 'created_at', start: Date, end: Date): Promise<CloudMarkerData[]> {
-  const { data, error } = await supabase
-    .from('clouds')
-    .select('id,image_url,thumbnail_url,latitude,longitude,location_name,description,captured_at,created_at,custom_cloud_type,cloud_types(name,rarity),profiles(username)')
-    .eq('status', 'approved')
-    .eq('is_hidden', false)
-    .not('latitude', 'is', null)
-    .not('longitude', 'is', null)
-    .gte(field, start.toISOString())
-    .lt(field, end.toISOString())
-    .order(field, { ascending: true })
-    .limit(1000)
-
-  if (error) {
-    statusText.value = `查询失败: ${error.message}`
+  try {
+    const { data } = await api.clouds.map({
+      field,
+      start: start.toISOString(),
+      end: end.toISOString(),
+    })
+    return ((data || []) as unknown as Array<Record<string, unknown>>).map(toCloudMarker)
+  } catch (error) {
+    statusText.value = `查询失败: ${error instanceof Error ? error.message : '地图数据加载失败'}`
     return []
   }
-
-  return ((data || []) as Array<Record<string, unknown>>).map(toCloudMarker)
 }
 
 async function loadRealtimeClouds() {
diff --git a/vite.config.ts b/vite.config.ts
index aeca413..48492b4 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -57,6 +57,12 @@ function seoFilesPlugin() {
 
 export default defineConfig({
   plugins: [vue(), tailwindcss(), seoFilesPlugin()],
+  server: {
+    proxy: {
+      '/api': 'http://localhost:3001',
+      '/uploads': 'http://localhost:3001',
+    },
+  },
   resolve: {
     alias: {
       '@': fileURLToPath(new URL('./src', import.meta.url)),