Initial dev export (exclude uploads/runtime)

.gitignore

@@ -0,0 +1,24 @@
+# Runtime/storage
+storage/*.log
+storage/*.cache
+storage/*.sqlite
+storage/mail_debug/
+storage/sessions/
+storage/cache/
+
+# Uploads / media / binaries
+uploads/
+public/uploads/
+*.mp3
+*.wav
+*.flac
+*.zip
+*.tar.gz
+*.mov
+*.mp4
+*.psd
+*.ai
+
+# OS/editor noise
+.DS_Store
+Thumbs.db

.htaccess

@@ -0,0 +1,6 @@
+Options -MultiViews
+RewriteEngine On
+RewriteBase /
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteRule . index.php [L]

.user.ini

@@ -0,0 +1,5 @@
+upload_max_filesize=1024M
+post_max_size=1024M
+memory_limit=1024M
+max_execution_time = 300
+max_input_time = 300

admin/.htaccess

@@ -0,0 +1,4 @@
+RewriteEngine On
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteRule ^ ../index.php [L]

admin/index.php

@@ -0,0 +1,2 @@
+<?php
+require_once __DIR__ . '/../index.php';

core/bootstrap.php

@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/http/Response.php';
+require_once __DIR__ . '/http/Router.php';
+require_once __DIR__ . '/views/View.php';
+require_once __DIR__ . '/services/Database.php';
+require_once __DIR__ . '/services/Auth.php';
+require_once __DIR__ . '/services/Csrf.php';
+require_once __DIR__ . '/services/Settings.php';
+require_once __DIR__ . '/services/Audit.php';
+require_once __DIR__ . '/services/Permissions.php';
+require_once __DIR__ . '/services/Shortcodes.php';
+require_once __DIR__ . '/services/Nav.php';
+require_once __DIR__ . '/services/Mailer.php';
+require_once __DIR__ . '/services/Plugins.php';
+require_once __DIR__ . '/services/Updater.php';
+
+Core\Services\Auth::init();
+Core\Services\Settings::init(__DIR__ . '/../storage/settings.php');
+Core\Services\Plugins::init(__DIR__ . '/../plugins');
+Core\Services\Audit::ensureTable();

core/http/Response.php

@@ -0,0 +1,27 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Http;
+
+class Response
+{
+    private string $body;
+    private int $status;
+    private array $headers;
+
+    public function __construct(string $body = '', int $status = 200, array $headers = [])
+    {
+        $this->body = $body;
+        $this->status = $status;
+        $this->headers = $headers;
+    }
+
+    public function send(): void
+    {
+        http_response_code($this->status);
+        foreach ($this->headers as $name => $value) {
+            header($name . ': ' . $value);
+        }
+        echo $this->body;
+    }
+}

core/http/Router.php

@@ -0,0 +1,185 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Http;
+
+use Core\Services\Auth;
+use Core\Services\Csrf;
+use Core\Services\Database;
+use Core\Services\Permissions;
+use Core\Services\Shortcodes;
+use Core\Views\View;
+use PDO;
+use Throwable;
+
+class Router
+{
+    private array $routes = [];
+
+    public function get(string $path, callable $handler): void
+    {
+        $this->routes['GET'][$path] = $handler;
+    }
+
+    public function post(string $path, callable $handler): void
+    {
+        $this->routes['POST'][$path] = $handler;
+    }
+
+    public function registerModules(string $modulesPath): void
+    {
+        foreach (glob($modulesPath . '/*/module.php') as $moduleFile) {
+            $module = require $moduleFile;
+            if (is_callable($module)) {
+                $module($this);
+            }
+        }
+    }
+
+    public function dispatch(string $uri, string $method): Response
+    {
+        $path = parse_url($uri, PHP_URL_PATH) ?: '/';
+        if ($path !== '/' && str_ends_with($path, '/')) {
+            $path = rtrim($path, '/');
+        }
+        $method = strtoupper($method);
+
+
+        if ($method === 'POST' && $this->requiresCsrf($path) && !Csrf::verifyRequest()) {
+            return new Response('Invalid request token. Please refresh and try again.', 419);
+        }
+
+        if ($method === 'GET') {
+            $redirect = $this->matchRedirect($path);
+            if ($redirect !== null) {
+                return $redirect;
+            }
+        }
+
+        if (str_starts_with($path, '/admin')) {
+            $permission = Permissions::routePermission($path);
+            if ($permission !== null && Auth::check() && !Auth::can($permission)) {
+                return new Response('', 302, ['Location' => '/admin?denied=1']);
+            }
+        }
+
+        if (isset($this->routes[$method][$path])) {
+            $handler = $this->routes[$method][$path];
+            return $handler();
+        }
+
+        if ($method === 'GET') {
+            if (str_starts_with($path, '/news/')) {
+                $postSlug = trim(substr($path, strlen('/news/')));
+                if ($postSlug !== '' && strpos($postSlug, '/') === false) {
+                    $db = Database::get();
+                    if ($db instanceof PDO) {
+                        try {
+                            $stmt = $db->prepare("
+                                SELECT title, content_html, published_at, featured_image_url, author_name, category, tags
+                                FROM ac_posts
+                                WHERE slug = :slug AND is_published = 1
+                                LIMIT 1
+                            ");
+                            $stmt->execute([':slug' => $postSlug]);
+                            $post = $stmt->fetch(PDO::FETCH_ASSOC);
+                            if ($post) {
+                            $view = new View(__DIR__ . '/../../modules/blog/views');
+                            return new Response($view->render('site/show.php', [
+                                'title' => (string)$post['title'],
+                                'content_html' => (string)$post['content_html'],
+                                    'published_at' => (string)($post['published_at'] ?? ''),
+                                    'featured_image_url' => (string)($post['featured_image_url'] ?? ''),
+                                    'author_name' => (string)($post['author_name'] ?? ''),
+                                    'category' => (string)($post['category'] ?? ''),
+                                    'tags' => (string)($post['tags'] ?? ''),
+                                ]));
+                            }
+                        } catch (Throwable $e) {
+                        }
+                    }
+                }
+            }
+
+            $slug = ltrim($path, '/');
+            if ($slug !== '' && strpos($slug, '/') === false) {
+                $db = Database::get();
+                if ($db instanceof PDO) {
+                    try {
+                        $stmt = $db->prepare("SELECT title, content_html FROM ac_pages WHERE slug = :slug AND is_published = 1 LIMIT 1");
+                        $stmt->execute([':slug' => $slug]);
+                        $page = $stmt->fetch(PDO::FETCH_ASSOC);
+                        if ($page) {
+                            $view = new View(__DIR__ . '/../../modules/pages/views');
+                            return new Response($view->render('site/show.php', [
+                                'title' => (string)$page['title'],
+                                'content_html' => Shortcodes::render((string)$page['content_html'], [
+                                    'page_slug' => (string)$slug,
+                                ]),
+                            ]));
+                        }
+                    } catch (Throwable $e) {
+                    }
+                }
+            }
+        }
+
+        $view = new View();
+        return new Response($view->render('site/404.php', [
+            'title' => 'Not Found',
+            'message' => 'Page not found.',
+        ]), 404);
+    }
+
+
+
+    private function requiresCsrf(string $path): bool
+    {
+        // All browser-initiated POST routes require CSRF protection.
+        return true;
+    }
+
+    private function matchRedirect(string $path): ?Response
+    {
+        $db = Database::get();
+        if (!($db instanceof PDO)) {
+            return null;
+        }
+
+        try {
+            $db->exec("
+                CREATE TABLE IF NOT EXISTS ac_redirects (
+                    id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+                    source_path VARCHAR(255) NOT NULL UNIQUE,
+                    target_url VARCHAR(1000) NOT NULL,
+                    status_code SMALLINT NOT NULL DEFAULT 301,
+                    is_active TINYINT(1) NOT NULL DEFAULT 1,
+                    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+                ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+            ");
+            $stmt = $db->prepare("
+                SELECT target_url, status_code
+                FROM ac_redirects
+                WHERE source_path = :path AND is_active = 1
+                LIMIT 1
+            ");
+            $stmt->execute([':path' => $path]);
+            $row = $stmt->fetch(PDO::FETCH_ASSOC);
+            if (!$row) {
+                return null;
+            }
+            $code = (int)($row['status_code'] ?? 301);
+            if (!in_array($code, [301, 302, 307, 308], true)) {
+                $code = 301;
+            }
+            $target = trim((string)($row['target_url'] ?? ''));
+            if ($target === '' || $target === $path) {
+                return null;
+            }
+            return new Response('', $code, ['Location' => $target]);
+        } catch (Throwable $e) {
+            return null;
+        }
+    }
+}

core/services/Audit.php

@@ -0,0 +1,105 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+use PDO;
+use Throwable;
+
+class Audit
+{
+    public static function ensureTable(): void
+    {
+        $db = Database::get();
+        if (!($db instanceof PDO)) {
+            return;
+        }
+        try {
+            $db->exec("
+                CREATE TABLE IF NOT EXISTS ac_audit_logs (
+                    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+                    actor_id INT UNSIGNED NULL,
+                    actor_name VARCHAR(120) NULL,
+                    actor_role VARCHAR(40) NULL,
+                    action VARCHAR(120) NOT NULL,
+                    context_json MEDIUMTEXT NULL,
+                    ip_address VARCHAR(45) NULL,
+                    user_agent VARCHAR(255) NULL,
+                    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+                ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+            ");
+        } catch (Throwable $e) {
+            return;
+        }
+    }
+
+    public static function log(string $action, array $context = []): void
+    {
+        $db = Database::get();
+        if (!($db instanceof PDO)) {
+            return;
+        }
+        self::ensureTable();
+        try {
+            $stmt = $db->prepare("
+                INSERT INTO ac_audit_logs
+                    (actor_id, actor_name, actor_role, action, context_json, ip_address, user_agent)
+                VALUES
+                    (:actor_id, :actor_name, :actor_role, :action, :context_json, :ip_address, :user_agent)
+            ");
+            $stmt->execute([
+                ':actor_id' => Auth::id() > 0 ? Auth::id() : null,
+                ':actor_name' => Auth::name() !== '' ? Auth::name() : null,
+                ':actor_role' => Auth::role() !== '' ? Auth::role() : null,
+                ':action' => $action,
+                ':context_json' => $context ? json_encode($context, JSON_UNESCAPED_SLASHES) : null,
+                ':ip_address' => self::ip(),
+                ':user_agent' => mb_substr((string)($_SERVER['HTTP_USER_AGENT'] ?? ''), 0, 255),
+            ]);
+        } catch (Throwable $e) {
+            return;
+        }
+    }
+
+    public static function latest(int $limit = 100): array
+    {
+        $db = Database::get();
+        if (!($db instanceof PDO)) {
+            return [];
+        }
+        self::ensureTable();
+        $limit = max(1, min(500, $limit));
+        try {
+            $stmt = $db->prepare("
+                SELECT id, actor_name, actor_role, action, context_json, ip_address, created_at
+                FROM ac_audit_logs
+                ORDER BY id DESC
+                LIMIT :limit
+            ");
+            $stmt->bindValue(':limit', $limit, PDO::PARAM_INT);
+            $stmt->execute();
+            return $stmt->fetchAll(PDO::FETCH_ASSOC) ?: [];
+        } catch (Throwable $e) {
+            return [];
+        }
+    }
+
+    private static function ip(): ?string
+    {
+        $candidates = [
+            (string)($_SERVER['HTTP_CF_CONNECTING_IP'] ?? ''),
+            (string)($_SERVER['HTTP_X_FORWARDED_FOR'] ?? ''),
+            (string)($_SERVER['REMOTE_ADDR'] ?? ''),
+        ];
+        foreach ($candidates as $candidate) {
+            if ($candidate === '') {
+                continue;
+            }
+            $first = trim(explode(',', $candidate)[0] ?? '');
+            if ($first !== '' && filter_var($first, FILTER_VALIDATE_IP)) {
+                return $first;
+            }
+        }
+        return null;
+    }
+}

core/services/Auth.php

@@ -0,0 +1,80 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+class Auth
+{
+    private const SESSION_KEY = 'admin_id';
+    private const SESSION_ROLE_KEY = 'admin_role';
+    private const SESSION_NAME_KEY = 'admin_name';
+
+    public static function init(): void
+    {
+        if (session_status() !== PHP_SESSION_ACTIVE) {
+            $secure = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
+            session_start([
+                'cookie_httponly' => true,
+                'cookie_secure' => $secure,
+                'cookie_samesite' => 'Lax',
+                'use_strict_mode' => 1,
+            ]);
+        }
+    }
+
+    public static function check(): bool
+    {
+        self::init();
+        return isset($_SESSION[self::SESSION_KEY]);
+    }
+
+    public static function id(): int
+    {
+        self::init();
+        return (int)($_SESSION[self::SESSION_KEY] ?? 0);
+    }
+
+    public static function login(int $adminId, string $role = 'admin', string $name = ''): void
+    {
+        self::init();
+        session_regenerate_id(true);
+        $_SESSION[self::SESSION_KEY] = $adminId;
+        $_SESSION[self::SESSION_ROLE_KEY] = $role;
+        if ($name !== '') {
+            $_SESSION[self::SESSION_NAME_KEY] = $name;
+        }
+    }
+
+    public static function logout(): void
+    {
+        self::init();
+        unset($_SESSION[self::SESSION_KEY]);
+        unset($_SESSION[self::SESSION_ROLE_KEY]);
+        unset($_SESSION[self::SESSION_NAME_KEY]);
+    }
+
+    public static function role(): string
+    {
+        self::init();
+        return (string)($_SESSION[self::SESSION_ROLE_KEY] ?? 'admin');
+    }
+
+    public static function name(): string
+    {
+        self::init();
+        return (string)($_SESSION[self::SESSION_NAME_KEY] ?? 'Admin');
+    }
+
+    public static function hasRole(array $roles): bool
+    {
+        return in_array(self::role(), $roles, true);
+    }
+
+    public static function can(string $permission): bool
+    {
+        if (!self::check()) {
+            return false;
+        }
+        return Permissions::can(self::role(), $permission);
+    }
+}

core/services/Csrf.php

@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+class Csrf
+{
+    private const SESSION_KEY = '_csrf_token';
+
+    public static function token(): string
+    {
+        if (session_status() !== PHP_SESSION_ACTIVE) {
+            @session_start();
+        }
+        $token = (string)($_SESSION[self::SESSION_KEY] ?? '');
+        if ($token === '') {
+            $token = bin2hex(random_bytes(32));
+            $_SESSION[self::SESSION_KEY] = $token;
+        }
+        return $token;
+    }
+
+    public static function verifyRequest(): bool
+    {
+        if (session_status() !== PHP_SESSION_ACTIVE) {
+            @session_start();
+        }
+
+        $sessionToken = (string)($_SESSION[self::SESSION_KEY] ?? '');
+        if ($sessionToken === '') {
+            // Legacy compatibility: allow request when no token has been seeded yet.
+            return true;
+        }
+
+        $provided = '';
+        if (isset($_POST['csrf_token'])) {
+            $provided = (string)$_POST['csrf_token'];
+        } elseif (isset($_SERVER['HTTP_X_CSRF_TOKEN'])) {
+            $provided = (string)$_SERVER['HTTP_X_CSRF_TOKEN'];
+        }
+
+        if ($provided === '') {
+            // Legacy compatibility: don't hard-fail older forms without token.
+            return true;
+        }
+
+        return hash_equals($sessionToken, $provided);
+    }
+}
+

core/services/Database.php

@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+use PDO;
+use PDOException;
+
+class Database
+{
+    private static ?PDO $pdo = null;
+
+    public static function get(): ?PDO
+    {
+        if (self::$pdo instanceof PDO) {
+            return self::$pdo;
+        }
+
+        $configPath = __DIR__ . '/../../storage/db.php';
+        if (!is_file($configPath)) {
+            return null;
+        }
+
+        $config = require $configPath;
+        if (!is_array($config)) {
+            return null;
+        }
+
+        $host = (string)($config['host'] ?? 'localhost');
+        $db = (string)($config['database'] ?? '');
+        $user = (string)($config['user'] ?? '');
+        $pass = (string)($config['pass'] ?? '');
+        $port = (int)($config['port'] ?? 3306);
+        if ($db == '' || $user == '') {
+            return null;
+        }
+
+        $dsn = "mysql:host={$host};dbname={$db};port={$port};charset=utf8mb4";
+        try {
+            self::$pdo = new PDO($dsn, $user, $pass, [
+                PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
+                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+            ]);
+        } catch (PDOException $e) {
+            return null;
+        }
+
+        return self::$pdo;
+    }
+}

core/services/Mailer.php

@@ -0,0 +1,226 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+class Mailer
+{
+    public static function send(string $to, string $subject, string $html, array $settings): array
+    {
+        $host = (string)($settings['smtp_host'] ?? '');
+        $port = (int)($settings['smtp_port'] ?? 587);
+        $user = (string)($settings['smtp_user'] ?? '');
+        $pass = (string)($settings['smtp_pass'] ?? '');
+        $encryption = strtolower((string)($settings['smtp_encryption'] ?? 'tls'));
+        $fromEmail = (string)($settings['smtp_from_email'] ?? '');
+        $fromName = (string)($settings['smtp_from_name'] ?? '');
+
+        if ($fromEmail === '') {
+            $fromEmail = $user !== '' ? $user : 'no-reply@localhost';
+        }
+        $fromHeader = $fromName !== '' ? "{$fromName} <{$fromEmail}>" : $fromEmail;
+
+        if ($host === '') {
+            $headers = [
+                'MIME-Version: 1.0',
+                'Content-type: text/html; charset=utf-8',
+                "From: {$fromHeader}",
+            ];
+            $ok = mail($to, $subject, $html, implode("\r\n", $headers));
+            return ['ok' => $ok, 'error' => $ok ? '' : 'mail() failed', 'debug' => 'transport=mail()'];
+        }
+
+        $remote = $encryption === 'ssl' ? "ssl://{$host}:{$port}" : "{$host}:{$port}";
+        $socket = stream_socket_client($remote, $errno, $errstr, 10);
+        if (!$socket) {
+            return ['ok' => false, 'error' => "SMTP connect failed: {$errstr}", 'debug' => "connect={$remote} errno={$errno} err={$errstr}"];
+        }
+
+        $debug = [];
+
+        $read = function () use ($socket): string {
+            $data = '';
+            while (!feof($socket)) {
+                $line = fgets($socket, 515);
+                if ($line === false) {
+                    break;
+                }
+                $data .= $line;
+                if (isset($line[3]) && $line[3] === ' ') {
+                    break;
+                }
+            }
+            return $data;
+        };
+
+        $send = function (string $command) use ($socket, $read): string {
+            fwrite($socket, $command . "\r\n");
+            return $read();
+        };
+
+        $resp = $read();
+        $debug[] = 'S: ' . trim($resp);
+        if (!self::isOkResponse($resp)) {
+            fclose($socket);
+            return ['ok' => false, 'error' => 'SMTP greeting failed', 'debug' => implode("\n", $debug)];
+        }
+
+        $resp = $send("EHLO localhost");
+        $debug[] = 'C: EHLO localhost';
+        $debug[] = 'S: ' . trim($resp);
+        if (!self::isOkResponse($resp)) {
+            fclose($socket);
+            return ['ok' => false, 'error' => 'SMTP EHLO failed', 'debug' => implode("\n", $debug)];
+        }
+        $authCaps = self::parseAuthCapabilities($resp);
+
+        if ($encryption === 'tls') {
+            $resp = $send("STARTTLS");
+            $debug[] = 'C: STARTTLS';
+            $debug[] = 'S: ' . trim($resp);
+            if (substr(trim($resp), 0, 3) !== '220') {
+                fclose($socket);
+                return ['ok' => false, 'error' => 'SMTP STARTTLS failed', 'debug' => implode("\n", $debug)];
+            }
+            if (!stream_socket_enable_crypto($socket, true, STREAM_CRYPTO_METHOD_TLS_CLIENT)) {
+                fclose($socket);
+                return ['ok' => false, 'error' => 'SMTP TLS negotiation failed', 'debug' => implode("\n", $debug)];
+            }
+            $resp = $send("EHLO localhost");
+            $debug[] = 'C: EHLO localhost';
+            $debug[] = 'S: ' . trim($resp);
+            if (!self::isOkResponse($resp)) {
+                fclose($socket);
+                return ['ok' => false, 'error' => 'SMTP EHLO after TLS failed', 'debug' => implode("\n", $debug)];
+            }
+            $authCaps = self::parseAuthCapabilities($resp);
+        }
+
+        if ($user !== '' && $pass !== '') {
+            $authOk = false;
+            $authErrors = [];
+
+            // Prefer advertised AUTH mechanisms when available.
+            if (in_array('PLAIN', $authCaps, true)) {
+                $authResp = $send("AUTH PLAIN " . base64_encode("\0{$user}\0{$pass}"));
+                $debug[] = 'C: AUTH PLAIN [credentials]';
+                $debug[] = 'S: ' . trim($authResp);
+                if (substr(trim($authResp), 0, 3) === '235') {
+                    $authOk = true;
+                } else {
+                    $authErrors[] = 'PLAIN rejected';
+                }
+            }
+
+            if (!$authOk && (in_array('LOGIN', $authCaps, true) || !$authCaps)) {
+                $resp = $send("AUTH LOGIN");
+                $debug[] = 'C: AUTH LOGIN';
+                $debug[] = 'S: ' . trim($resp);
+                if (substr(trim($resp), 0, 3) === '334') {
+                    $resp = $send(base64_encode($user));
+                    $debug[] = 'C: [username]';
+                    $debug[] = 'S: ' . trim($resp);
+                    if (substr(trim($resp), 0, 3) === '334') {
+                        $resp = $send(base64_encode($pass));
+                        $debug[] = 'C: [password]';
+                        $debug[] = 'S: ' . trim($resp);
+                        if (substr(trim($resp), 0, 3) === '235') {
+                            $authOk = true;
+                        } else {
+                            $authErrors[] = 'LOGIN password rejected';
+                        }
+                    } else {
+                        $authErrors[] = 'LOGIN username rejected';
+                    }
+                } else {
+                    $authErrors[] = 'LOGIN command rejected';
+                }
+            }
+
+            if (!$authOk) {
+                fclose($socket);
+                $err = $authErrors ? implode(', ', $authErrors) : 'No supported AUTH method';
+                return ['ok' => false, 'error' => 'SMTP authentication failed: ' . $err, 'debug' => implode("\n", $debug)];
+            }
+        }
+
+        $resp = $send("MAIL FROM:<{$fromEmail}>");
+        $debug[] = "C: MAIL FROM:<{$fromEmail}>";
+        $debug[] = 'S: ' . trim($resp);
+        if (!self::isOkResponse($resp)) {
+            fclose($socket);
+            return ['ok' => false, 'error' => 'SMTP MAIL FROM failed', 'debug' => implode("\n", $debug)];
+        }
+        $resp = $send("RCPT TO:<{$to}>");
+        $debug[] = "C: RCPT TO:<{$to}>";
+        $debug[] = 'S: ' . trim($resp);
+        if (!self::isOkResponse($resp)) {
+            fclose($socket);
+            return ['ok' => false, 'error' => 'SMTP RCPT TO failed', 'debug' => implode("\n", $debug)];
+        }
+        $resp = $send("DATA");
+        $debug[] = 'C: DATA';
+        $debug[] = 'S: ' . trim($resp);
+        if (substr(trim($resp), 0, 3) !== '354') {
+            fclose($socket);
+            return ['ok' => false, 'error' => 'SMTP DATA failed', 'debug' => implode("\n", $debug)];
+        }
+
+        $headers = [
+            "From: {$fromHeader}",
+            "To: {$to}",
+            "Subject: {$subject}",
+            "MIME-Version: 1.0",
+            "Content-Type: text/html; charset=utf-8",
+        ];
+        $message = implode("\r\n", $headers) . "\r\n\r\n" . $html . "\r\n.";
+        fwrite($socket, $message . "\r\n");
+        $resp = $read();
+        $debug[] = 'C: [message body]';
+        $debug[] = 'S: ' . trim($resp);
+        if (!self::isOkResponse($resp)) {
+            fclose($socket);
+            return ['ok' => false, 'error' => 'SMTP message rejected', 'debug' => implode("\n", $debug)];
+        }
+        $resp = $send("QUIT");
+        $debug[] = 'C: QUIT';
+        $debug[] = 'S: ' . trim($resp);
+        fclose($socket);
+
+        return ['ok' => true, 'error' => '', 'debug' => implode("\n", $debug)];
+    }
+
+    private static function isOkResponse(string $response): bool
+    {
+        $code = substr(trim($response), 0, 3);
+        if ($code === '') {
+            return false;
+        }
+        return $code[0] === '2' || $code[0] === '3';
+    }
+
+    /**
+     * @return string[]
+     */
+    private static function parseAuthCapabilities(string $ehloResponse): array
+    {
+        $caps = [];
+        foreach (preg_split('/\r?\n/', $ehloResponse) as $line) {
+            $line = trim($line);
+            if ($line === '') {
+                continue;
+            }
+            $line = preg_replace('/^\d{3}[ -]/', '', $line) ?? $line;
+            if (stripos($line, 'AUTH ') === 0) {
+                $parts = preg_split('/\s+/', substr($line, 5)) ?: [];
+                foreach ($parts as $p) {
+                    $p = strtoupper(trim($p));
+                    if ($p !== '') {
+                        $caps[] = $p;
+                    }
+                }
+            }
+        }
+        return array_values(array_unique($caps));
+    }
+}

core/services/Nav.php

@@ -0,0 +1,25 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+use PDO;
+use Throwable;
+
+class Nav
+{
+    public static function links(): array
+    {
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return [];
+        }
+        try {
+            $stmt = $db->query("SELECT id, label, url, sort_order, is_active FROM ac_nav_links ORDER BY sort_order ASC, id ASC");
+            $rows = $stmt->fetchAll();
+        } catch (Throwable $e) {
+            return [];
+        }
+        return $rows ?: [];
+    }
+}

core/services/Permissions.php

@@ -0,0 +1,145 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+class Permissions
+{
+    public static function definitions(): array
+    {
+        $defs = [
+            ['key' => 'core.dashboard', 'label' => 'Dashboard', 'group' => 'Core'],
+            ['key' => 'core.settings', 'label' => 'Settings', 'group' => 'Core'],
+            ['key' => 'core.navigation', 'label' => 'Navigation', 'group' => 'Core'],
+            ['key' => 'core.accounts', 'label' => 'Accounts', 'group' => 'Core'],
+            ['key' => 'core.plugins', 'label' => 'Plugins', 'group' => 'Core'],
+            ['key' => 'module.pages', 'label' => 'Pages', 'group' => 'Modules'],
+            ['key' => 'module.shortcodes', 'label' => 'Shortcodes', 'group' => 'Modules'],
+            ['key' => 'module.blog', 'label' => 'Blog', 'group' => 'Modules'],
+            ['key' => 'module.media', 'label' => 'Media', 'group' => 'Modules'],
+            ['key' => 'module.newsletter', 'label' => 'Newsletter', 'group' => 'Modules'],
+        ];
+
+        foreach (Plugins::all() as $plugin) {
+            $slug = trim((string)($plugin['slug'] ?? ''));
+            if ($slug === '') {
+                continue;
+            }
+            $defs[] = [
+                'key' => 'plugin.' . $slug,
+                'label' => (string)($plugin['name'] ?? ucfirst($slug)),
+                'group' => 'Plugins',
+            ];
+        }
+
+        return $defs;
+    }
+
+    public static function matrix(): array
+    {
+        $default = self::defaultMatrix();
+        $raw = Settings::get('role_permissions_json', '');
+        if ($raw === '') {
+            return $default;
+        }
+        $decoded = json_decode($raw, true);
+        if (!is_array($decoded)) {
+            return $default;
+        }
+
+        foreach ($default as $perm => $roles) {
+            $row = $decoded[$perm] ?? null;
+            if (!is_array($row)) {
+                continue;
+            }
+            foreach (['admin', 'manager', 'editor'] as $role) {
+                if (array_key_exists($role, $row)) {
+                    $default[$perm][$role] = self::toBool($row[$role]);
+                }
+            }
+        }
+        return $default;
+    }
+
+    public static function saveMatrix(array $posted): void
+    {
+        $current = self::matrix();
+        foreach ($current as $permission => $roles) {
+            foreach ($roles as $role => $allowed) {
+                $current[$permission][$role] = isset($posted[$permission][$role]);
+            }
+        }
+        Settings::set('role_permissions_json', json_encode($current, JSON_UNESCAPED_SLASHES));
+    }
+
+    public static function can(string $role, string $permission): bool
+    {
+        $matrix = self::matrix();
+        if (!isset($matrix[$permission])) {
+            return true;
+        }
+        return (bool)($matrix[$permission][$role] ?? false);
+    }
+
+    public static function routePermission(string $path): ?string
+    {
+        if ($path === '/admin') {
+            return 'core.dashboard';
+        }
+        if (!str_starts_with($path, '/admin/')) {
+            return null;
+        }
+        $slug = trim((string)explode('/', trim(substr($path, strlen('/admin/')), '/'))[0]);
+        if ($slug === '' || in_array($slug, ['login', 'logout', 'install', 'installer'], true)) {
+            return null;
+        }
+
+        $coreMap = [
+            'settings' => 'core.settings',
+            'navigation' => 'core.navigation',
+            'accounts' => 'core.accounts',
+            'plugins' => 'core.plugins',
+            'pages' => 'module.pages',
+            'shortcodes' => 'module.shortcodes',
+            'blog' => 'module.blog',
+            'media' => 'module.media',
+            'newsletter' => 'module.newsletter',
+        ];
+        if (isset($coreMap[$slug])) {
+            return $coreMap[$slug];
+        }
+
+        return 'plugin.' . $slug;
+    }
+
+    private static function defaultMatrix(): array
+    {
+        $matrix = [];
+        foreach (self::definitions() as $def) {
+            $key = (string)$def['key'];
+            $matrix[$key] = [
+                'admin' => true,
+                'manager' => true,
+                'editor' => false,
+            ];
+        }
+        foreach (['module.pages', 'module.shortcodes', 'module.blog'] as $editorAllowed) {
+            if (isset($matrix[$editorAllowed])) {
+                $matrix[$editorAllowed]['editor'] = true;
+            }
+        }
+        return $matrix;
+    }
+
+    private static function toBool(mixed $value): bool
+    {
+        if (is_bool($value)) {
+            return $value;
+        }
+        if (is_int($value) || is_float($value)) {
+            return ((int)$value) === 1;
+        }
+        $v = strtolower(trim((string)$value));
+        return in_array($v, ['1', 'true', 'yes', 'on'], true);
+    }
+}

core/services/Plugins.php

@@ -0,0 +1,258 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+use Core\Http\Router;
+use PDO;
+use Throwable;
+
+class Plugins
+{
+    private static string $path = '';
+    private static array $plugins = [];
+
+    public static function init(string $path): void
+    {
+        self::$path = rtrim($path, '/');
+        self::sync();
+    }
+
+    public static function all(): array
+    {
+        return self::$plugins;
+    }
+
+    public static function enabled(): array
+    {
+        return array_values(array_filter(self::$plugins, static function (array $plugin): bool {
+            return (bool)($plugin['is_enabled'] ?? false);
+        }));
+    }
+
+    public static function isEnabled(string $slug): bool
+    {
+        foreach (self::$plugins as $plugin) {
+            if ((string)($plugin['slug'] ?? '') === $slug) {
+                return (bool)($plugin['is_enabled'] ?? false);
+            }
+        }
+        return false;
+    }
+
+    public static function adminNav(): array
+    {
+        $items = [];
+        foreach (self::enabled() as $plugin) {
+            $nav = $plugin['admin_nav'] ?? null;
+            if (!is_array($nav)) {
+                continue;
+            }
+            $items[] = [
+                'label' => (string)($nav['label'] ?? ''),
+                'url' => (string)($nav['url'] ?? ''),
+                'roles' => array_values(array_filter((array)($nav['roles'] ?? []))),
+                'icon' => (string)($nav['icon'] ?? ''),
+                'slug' => (string)($plugin['slug'] ?? ''),
+            ];
+        }
+        return array_values(array_filter($items, static function (array $item): bool {
+            if ($item['label'] === '' || $item['url'] === '') {
+                return false;
+            }
+            $slug = trim((string)($item['slug'] ?? ''));
+            if ($slug !== '' && Auth::check() && !Permissions::can(Auth::role(), 'plugin.' . $slug)) {
+                return false;
+            }
+            return true;
+        }));
+    }
+
+    public static function register(Router $router): void
+    {
+        foreach (self::enabled() as $plugin) {
+            $entry = (string)($plugin['entry'] ?? 'plugin.php');
+            $entryPath = rtrim((string)($plugin['path'] ?? ''), '/') . '/' . $entry;
+            if (!is_file($entryPath)) {
+                continue;
+            }
+            $handler = require $entryPath;
+            if (is_callable($handler)) {
+                $handler($router);
+            }
+        }
+    }
+
+    public static function toggle(string $slug, bool $enabled): void
+    {
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return;
+        }
+        try {
+            $stmt = $db->prepare("UPDATE ac_plugins SET is_enabled = :enabled, updated_at = NOW() WHERE slug = :slug");
+            $stmt->execute([
+                ':enabled' => $enabled ? 1 : 0,
+                ':slug' => $slug,
+            ]);
+        } catch (Throwable $e) {
+        }
+        self::sync();
+        if (!$enabled) {
+            $plugin = null;
+            foreach (self::$plugins as $item) {
+                if (($item['slug'] ?? '') === $slug) {
+                    $plugin = $item;
+                    break;
+                }
+            }
+            if ($plugin && !empty($plugin['pages'])) {
+                self::removeNavLinks($db, (array)$plugin['pages']);
+            }
+        }
+    }
+
+    public static function sync(): void
+    {
+        $filesystem = self::scanFilesystem();
+        $db = Database::get();
+        $dbRows = [];
+
+        if ($db instanceof PDO) {
+            try {
+                $db->exec("
+                    CREATE TABLE IF NOT EXISTS ac_plugins (
+                        id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+                        slug VARCHAR(120) NOT NULL UNIQUE,
+                        name VARCHAR(200) NOT NULL,
+                        version VARCHAR(50) NOT NULL DEFAULT '0.0.0',
+                        is_enabled TINYINT(1) NOT NULL DEFAULT 0,
+                        installed_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+                    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+                ");
+                $stmt = $db->query("SELECT slug, is_enabled FROM ac_plugins");
+                $dbRows = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+            } catch (Throwable $e) {
+                $dbRows = [];
+            }
+        }
+
+        $dbMap = [];
+        foreach ($dbRows as $row) {
+            $dbMap[(string)$row['slug']] = (int)$row['is_enabled'];
+        }
+
+        foreach ($filesystem as $slug => $plugin) {
+            $plugin['is_enabled'] = (bool)($dbMap[$slug] ?? ($plugin['default_enabled'] ?? false));
+            $filesystem[$slug] = $plugin;
+            if ($db instanceof PDO && !isset($dbMap[$slug])) {
+                try {
+                    $stmt = $db->prepare("
+                        INSERT INTO ac_plugins (slug, name, version, is_enabled)
+                        VALUES (:slug, :name, :version, :enabled)
+                    ");
+                    $stmt->execute([
+                        ':slug' => $slug,
+                        ':name' => (string)($plugin['name'] ?? $slug),
+                        ':version' => (string)($plugin['version'] ?? '0.0.0'),
+                        ':enabled' => $plugin['is_enabled'] ? 1 : 0,
+                    ]);
+                } catch (Throwable $e) {
+                }
+            }
+            if ($db instanceof PDO && $plugin['is_enabled']) {
+                $thisPages = $plugin['pages'] ?? [];
+                if (is_array($thisPages) && $thisPages) {
+                    self::ensurePages($db, $thisPages);
+                }
+            }
+        }
+
+        self::$plugins = array_values($filesystem);
+    }
+
+    private static function scanFilesystem(): array
+    {
+        if (self::$path === '' || !is_dir(self::$path)) {
+            return [];
+        }
+
+        $plugins = [];
+        foreach (glob(self::$path . '/*/plugin.json') as $manifestPath) {
+            $dir = dirname($manifestPath);
+            $slug = basename($dir);
+            $raw = file_get_contents($manifestPath);
+            $decoded = json_decode($raw ?: '', true);
+            if (!is_array($decoded)) {
+                $decoded = [];
+            }
+
+            $plugins[$slug] = [
+                'slug' => $slug,
+                'name' => (string)($decoded['name'] ?? $slug),
+                'version' => (string)($decoded['version'] ?? '0.0.0'),
+                'description' => (string)($decoded['description'] ?? ''),
+                'author' => (string)($decoded['author'] ?? ''),
+                'admin_nav' => is_array($decoded['admin_nav'] ?? null) ? $decoded['admin_nav'] : null,
+                'pages' => is_array($decoded['pages'] ?? null) ? $decoded['pages'] : [],
+                'entry' => (string)($decoded['entry'] ?? 'plugin.php'),
+                'default_enabled' => (bool)($decoded['default_enabled'] ?? false),
+                'path' => $dir,
+            ];
+        }
+
+        return $plugins;
+    }
+
+    private static function ensurePages(PDO $db, array $pages): void
+    {
+        foreach ($pages as $page) {
+            if (!is_array($page)) {
+                continue;
+            }
+            $slug = trim((string)($page['slug'] ?? ''));
+            $title = trim((string)($page['title'] ?? ''));
+            $content = (string)($page['content_html'] ?? '');
+            if ($slug === '' || $title === '') {
+                continue;
+            }
+            try {
+                $stmt = $db->prepare("SELECT id FROM ac_pages WHERE slug = :slug LIMIT 1");
+                $stmt->execute([':slug' => $slug]);
+                if ($stmt->fetch()) {
+                    continue;
+                }
+                $insert = $db->prepare("
+                    INSERT INTO ac_pages (title, slug, content_html, is_published, is_home, is_blog_index)
+                    VALUES (:title, :slug, :content_html, 1, 0, 0)
+                ");
+                $insert->execute([
+                    ':title' => $title,
+                    ':slug' => $slug,
+                    ':content_html' => $content,
+                ]);
+            } catch (Throwable $e) {
+            }
+        }
+    }
+
+    private static function removeNavLinks(PDO $db, array $pages): void
+    {
+        foreach ($pages as $page) {
+            if (!is_array($page)) {
+                continue;
+            }
+            $slug = trim((string)($page['slug'] ?? ''));
+            if ($slug === '') {
+                continue;
+            }
+            $url = '/' . ltrim($slug, '/');
+            try {
+                $stmt = $db->prepare("DELETE FROM ac_nav_links WHERE url = :url");
+                $stmt->execute([':url' => $url]);
+            } catch (Throwable $e) {
+            }
+        }
+    }
+}

core/services/Settings.php

@@ -0,0 +1,67 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+use Throwable;
+
+class Settings
+{
+    private static array $data = [];
+    private static bool $loaded = false;
+
+    public static function init(string $path): void
+    {
+        if (self::$loaded) {
+            return;
+        }
+        if (is_file($path)) {
+            $loaded = require $path;
+            if (is_array($loaded)) {
+                self::$data = $loaded;
+            }
+        }
+        self::reload();
+        self::$loaded = true;
+    }
+
+    public static function get(string $key, string $default = ''): string
+    {
+        return array_key_exists($key, self::$data) ? (string)self::$data[$key] : $default;
+    }
+
+    public static function reload(): void
+    {
+        $db = Database::get();
+        if (!$db) {
+            return;
+        }
+        try {
+            $rows = $db->query("SELECT setting_key, setting_value FROM ac_settings")->fetchAll();
+            foreach ($rows as $row) {
+                $k = (string)($row['setting_key'] ?? '');
+                $v = (string)($row['setting_value'] ?? '');
+                if ($k !== '') {
+                    self::$data[$k] = $v;
+                }
+            }
+        } catch (Throwable $e) {
+            return;
+        }
+    }
+
+    public static function set(string $key, string $value): void
+    {
+        self::$data[$key] = $value;
+        $db = Database::get();
+        if (!$db) {
+            return;
+        }
+        try {
+            $stmt = $db->prepare("REPLACE INTO ac_settings (setting_key, setting_value) VALUES (:k, :v)");
+            $stmt->execute([':k' => $key, ':v' => $value]);
+        } catch (Throwable $e) {
+            return;
+        }
+    }
+}

core/services/Shortcodes.php

@@ -0,0 +1,54 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+class Shortcodes
+{
+    /** @var array<string, callable> */
+    private static array $handlers = [];
+
+    public static function register(string $name, callable $handler): void
+    {
+        $key = strtolower(trim($name));
+        if ($key === '') {
+            return;
+        }
+        self::$handlers[$key] = $handler;
+    }
+
+    public static function render(string $content, array $context = []): string
+    {
+        if ($content === '' || !self::$handlers) {
+            return $content;
+        }
+
+        return preg_replace_callback('/\[([a-zA-Z0-9_-]+)([^\]]*)\]/', function (array $m) use ($context): string {
+            $tag = strtolower((string)($m[1] ?? ''));
+            if (!isset(self::$handlers[$tag])) {
+                return (string)$m[0];
+            }
+            $attrs = self::parseAttrs((string)($m[2] ?? ''));
+            try {
+                $out = (self::$handlers[$tag])($attrs, $context);
+                return is_string($out) ? $out : '';
+            } catch (\Throwable $e) {
+                return '';
+            }
+        }, $content) ?? $content;
+    }
+
+    private static function parseAttrs(string $raw): array
+    {
+        $attrs = [];
+        if ($raw === '') {
+            return $attrs;
+        }
+        if (preg_match_all('/([a-zA-Z0-9_-]+)\s*=\s*"([^"]*)"/', $raw, $matches, PREG_SET_ORDER)) {
+            foreach ($matches as $match) {
+                $attrs[strtolower((string)$match[1])] = (string)$match[2];
+            }
+        }
+        return $attrs;
+    }
+}

core/services/Updater.php

@@ -0,0 +1,231 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Services;
+
+use Throwable;
+
+class Updater
+{
+    private const CACHE_TTL_SECONDS = 21600;
+    private const MANIFEST_URL = 'https://lab.codemunkeh.io/codemunkeh/AudioCore/raw/branch/main/update.json';
+
+    public static function currentVersion(): string
+    {
+        $data = require __DIR__ . '/../version.php';
+        if (is_array($data) && !empty($data['version'])) {
+            return (string)$data['version'];
+        }
+        return '0.0.0';
+    }
+
+    public static function getStatus(bool $force = false): array
+    {
+        $current = self::currentVersion();
+        $manifestUrl = self::MANIFEST_URL;
+        $channel = trim(Settings::get('update_channel', 'stable'));
+        if ($channel === '') {
+            $channel = 'stable';
+        }
+
+        $cache = self::readCache();
+        if (
+            !$force
+            && is_array($cache)
+            && (string)($cache['manifest_url'] ?? '') === $manifestUrl
+            && (string)($cache['channel'] ?? '') === $channel
+            && ((int)($cache['fetched_at'] ?? 0) + self::CACHE_TTL_SECONDS) > time()
+        ) {
+            return $cache;
+        }
+
+        $status = [
+            'ok' => false,
+            'configured' => true,
+            'current_version' => $current,
+            'latest_version' => $current,
+            'update_available' => false,
+            'channel' => $channel,
+            'manifest_url' => $manifestUrl,
+            'error' => '',
+            'checked_at' => gmdate('c'),
+            'download_url' => '',
+            'changelog_url' => '',
+            'notes' => '',
+            'fetched_at' => time(),
+        ];
+
+        try {
+            $raw = self::fetchManifest($manifestUrl);
+            $decoded = json_decode($raw, true);
+            if (!is_array($decoded)) {
+                throw new \RuntimeException('Manifest JSON is invalid.');
+            }
+
+            $release = self::pickReleaseForChannel($decoded, $channel);
+            $latest = trim((string)($release['version'] ?? ''));
+            if ($latest === '') {
+                throw new \RuntimeException('Manifest does not include a version for selected channel.');
+            }
+
+            $status['ok'] = true;
+            $status['latest_version'] = $latest;
+            $status['download_url'] = (string)($release['download_url'] ?? '');
+            $status['changelog_url'] = (string)($release['changelog_url'] ?? '');
+            $status['notes'] = (string)($release['notes'] ?? '');
+            $status['update_available'] = version_compare($latest, $current, '>');
+        } catch (Throwable $e) {
+            $status['error'] = $e->getMessage();
+        }
+
+        self::writeCache($status);
+        return $status;
+    }
+
+    private static function pickReleaseForChannel(array $manifest, string $channel): array
+    {
+        if (isset($manifest['channels']) && is_array($manifest['channels'])) {
+            $channels = $manifest['channels'];
+            if (isset($channels[$channel]) && is_array($channels[$channel])) {
+                return $channels[$channel];
+            }
+            if (isset($channels['stable']) && is_array($channels['stable'])) {
+                return $channels['stable'];
+            }
+        }
+        return $manifest;
+    }
+
+    private static function cachePath(): string
+    {
+        return __DIR__ . '/../../storage/update_cache.json';
+    }
+
+    private static function readCache(): ?array
+    {
+        try {
+            $db = Database::get();
+            if ($db) {
+                $stmt = $db->query("
+                    SELECT checked_at, channel, manifest_url, current_version, latest_version,
+                           is_update_available, ok, error_text, payload_json
+                    FROM ac_update_checks
+                    ORDER BY id DESC
+                    LIMIT 1
+                ");
+                $row = $stmt ? $stmt->fetch() : null;
+                if (is_array($row)) {
+                    $payload = json_decode((string)($row['payload_json'] ?? ''), true);
+                    if (is_array($payload)) {
+                        $payload['channel'] = (string)($row['channel'] ?? ($payload['channel'] ?? 'stable'));
+                        $payload['manifest_url'] = (string)($row['manifest_url'] ?? ($payload['manifest_url'] ?? ''));
+                        $payload['current_version'] = (string)($row['current_version'] ?? ($payload['current_version'] ?? '0.0.0'));
+                        $payload['latest_version'] = (string)($row['latest_version'] ?? ($payload['latest_version'] ?? '0.0.0'));
+                        $payload['update_available'] = ((int)($row['is_update_available'] ?? 0) === 1);
+                        $payload['ok'] = ((int)($row['ok'] ?? 0) === 1);
+                        $payload['error'] = (string)($row['error_text'] ?? ($payload['error'] ?? ''));
+                        $checkedAt = (string)($row['checked_at'] ?? '');
+                        if ($checkedAt !== '') {
+                            $payload['checked_at'] = $checkedAt;
+                            $payload['fetched_at'] = strtotime($checkedAt) ?: ($payload['fetched_at'] ?? 0);
+                        }
+                        return $payload;
+                    }
+                }
+            }
+        } catch (Throwable $e) {
+        }
+
+        $path = self::cachePath();
+        if (!is_file($path)) {
+            return null;
+        }
+        $raw = @file_get_contents($path);
+        if ($raw === false) {
+            return null;
+        }
+        $decoded = json_decode($raw, true);
+        return is_array($decoded) ? $decoded : null;
+    }
+
+    private static function writeCache(array $data): void
+    {
+        try {
+            $db = Database::get();
+            if ($db) {
+                $stmt = $db->prepare("
+                    INSERT INTO ac_update_checks
+                    (checked_at, channel, manifest_url, current_version, latest_version, is_update_available, ok, error_text, payload_json)
+                    VALUES (NOW(), :channel, :manifest_url, :current_version, :latest_version, :is_update_available, :ok, :error_text, :payload_json)
+                ");
+                $stmt->execute([
+                    ':channel' => (string)($data['channel'] ?? 'stable'),
+                    ':manifest_url' => (string)($data['manifest_url'] ?? ''),
+                    ':current_version' => (string)($data['current_version'] ?? '0.0.0'),
+                    ':latest_version' => (string)($data['latest_version'] ?? '0.0.0'),
+                    ':is_update_available' => !empty($data['update_available']) ? 1 : 0,
+                    ':ok' => !empty($data['ok']) ? 1 : 0,
+                    ':error_text' => (string)($data['error'] ?? ''),
+                    ':payload_json' => json_encode($data, JSON_UNESCAPED_SLASHES),
+                ]);
+            }
+        } catch (Throwable $e) {
+        }
+
+        $path = self::cachePath();
+        @file_put_contents($path, json_encode($data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
+    }
+
+    private static function fetchManifest(string $manifestUrl): string
+    {
+        $ctx = stream_context_create([
+            'http' => [
+                'method' => 'GET',
+                'timeout' => 10,
+                'header' => "User-Agent: AudioCore-Updater/1.0\r\nAccept: application/json\r\n",
+            ],
+            'ssl' => [
+                'verify_peer' => true,
+                'verify_peer_name' => true,
+            ],
+        ]);
+
+        $raw = @file_get_contents($manifestUrl, false, $ctx);
+        if (is_string($raw) && $raw !== '') {
+            return $raw;
+        }
+
+        if (!function_exists('curl_init')) {
+            throw new \RuntimeException('Unable to fetch manifest (file_get_contents failed and cURL is unavailable).');
+        }
+
+        $ch = curl_init($manifestUrl);
+        if ($ch === false) {
+            throw new \RuntimeException('Unable to fetch manifest (failed to initialize cURL).');
+        }
+
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
+        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
+        curl_setopt($ch, CURLOPT_TIMEOUT, 15);
+        curl_setopt($ch, CURLOPT_HTTPHEADER, [
+            'User-Agent: AudioCore-Updater/1.0',
+            'Accept: application/json',
+        ]);
+
+        $body = curl_exec($ch);
+        $httpCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        $err = curl_error($ch);
+        curl_close($ch);
+
+        if (!is_string($body) || $body === '') {
+            $detail = $err !== '' ? $err : ('HTTP ' . $httpCode);
+            throw new \RuntimeException('Unable to fetch manifest via cURL: ' . $detail);
+        }
+        if ($httpCode >= 400) {
+            throw new \RuntimeException('Manifest request failed with HTTP ' . $httpCode . '.');
+        }
+
+        return $body;
+    }
+}

core/version.php

@@ -0,0 +1,7 @@
+<?php
+declare(strict_types=1);
+
+return [
+    'version' => '1.5.0',
+];
+

core/views/View.php

@@ -0,0 +1,31 @@
+<?php
+declare(strict_types=1);
+
+namespace Core\Views;
+
+class View
+{
+    private string $basePath;
+
+    public function __construct(string $basePath = '')
+    {
+        $this->basePath = $basePath !== '' ? rtrim($basePath, '/') : __DIR__ . '/../../views';
+    }
+
+    public function render(string $template, array $vars = []): string
+    {
+        $path = $this->basePath !== '' ? $this->basePath . '/' . ltrim($template, '/') : $template;
+        if (!is_file($path)) {
+            error_log('AC View missing: ' . $path);
+            return '';
+        }
+
+        if ($vars) {
+            extract($vars, EXTR_SKIP);
+        }
+
+        ob_start();
+        require $path;
+        return ob_get_clean() ?: '';
+    }
+}

index.php

@@ -0,0 +1,7 @@
+<?php
+ini_set('display_errors', '1');
+ini_set('display_startup_errors', '1');
+ini_set('log_errors', '1');
+error_reporting(E_ALL);
+
+require_once __DIR__ . '/public/index.php';

limits.php

@@ -0,0 +1 @@
+<?php echo "upload_max_filesize: " . ini_get("upload_max_filesize"); ?>

modules/admin/module.php

@@ -0,0 +1,30 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Modules\Admin\AdminController;
+
+require_once __DIR__ . '/AdminController.php';
+
+return function (Router $router): void {
+    $controller = new AdminController();
+    $router->get('/admin', [$controller, 'index']);
+    $router->get('/admin/login', [$controller, 'loginForm']);
+    $router->get('/admin/logout', [$controller, 'logout']);
+    $router->get('/admin/settings', [$controller, 'settingsForm']);
+    $router->get('/admin/navigation', [$controller, 'navigationForm']);
+    $router->get('/admin/accounts', [$controller, 'accountsIndex']);
+    $router->get('/admin/accounts/new', [$controller, 'accountsNew']);
+    $router->get('/admin/updates', [$controller, 'updatesForm']);
+    $router->get('/admin/installer', [$controller, 'installer']);
+    $router->get('/admin/shortcodes', [$controller, 'shortcodesIndex']);
+    $router->get('/admin/shortcodes/preview', [$controller, 'shortcodesPreview']);
+
+    $router->post('/admin/install', [$controller, 'install']);
+    $router->post('/admin/login', [$controller, 'login']);
+    $router->post('/admin/settings', [$controller, 'saveSettings']);
+    $router->post('/admin/navigation', [$controller, 'saveNavigation']);
+    $router->post('/admin/accounts/save', [$controller, 'accountsSave']);
+    $router->post('/admin/accounts/delete', [$controller, 'accountsDelete']);
+    $router->post('/admin/updates', [$controller, 'updatesSave']);
+};

modules/admin/views/account_new.php

@@ -0,0 +1,45 @@
+<?php
+$pageTitle = 'New Account';
+$error = $error ?? '';
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Accounts</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">New Account</h1>
+      <p style="color: var(--muted); margin-top:6px;">Create an admin, manager, or editor account.</p>
+    </div>
+    <a href="/admin/accounts" class="btn outline small">Back</a>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/accounts/save" style="margin-top:18px; display:grid; gap:16px;">
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Name</label>
+        <input class="input" name="name" placeholder="Name">
+        <label class="label">Email</label>
+        <input class="input" name="email" placeholder="name@example.com">
+        <label class="label">Password</label>
+        <input class="input" type="password" name="password" placeholder="Password">
+        <label class="label">Role</label>
+        <select class="input" name="role">
+          <option value="admin">Admin</option>
+          <option value="manager">Manager</option>
+          <option value="editor">Editor</option>
+        </select>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end;">
+      <button type="submit" class="btn">Create account</button>
+    </div>
+  </form>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/admin/views/accounts.php

@@ -0,0 +1,75 @@
+<?php
+$pageTitle = 'Accounts';
+$users = $users ?? [];
+$error = $error ?? '';
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Accounts</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Accounts</h1>
+      <p style="color: var(--muted); margin-top:6px;">Manage admin access and roles.</p>
+    </div>
+    <a href="/admin/accounts/new" class="btn small">New Account</a>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <div style="margin-top:18px; display:grid; gap:12px;">
+    <div class="badge" style="opacity:0.7;">Permissions</div>
+    <div style="display:grid; grid-template-columns: 1.2fr repeat(3, 1fr); gap:12px; font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+      <div>Capability</div>
+      <div>Admin</div>
+      <div>Manager</div>
+      <div>Editor</div>
+    </div>
+    <div style="display:grid; grid-template-columns: 1.2fr repeat(3, 1fr); gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+      <div>Full access</div>
+      <div style="color:var(--accent-2); font-weight:600;">✓</div>
+      <div style="color:#f3b0b0;">✕</div>
+      <div style="color:#f3b0b0;">✕</div>
+    </div>
+    <div style="display:grid; grid-template-columns: 1.2fr repeat(3, 1fr); gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+      <div>Restricted modules</div>
+      <div style="color:var(--accent-2); font-weight:600;">✓</div>
+      <div style="color:var(--accent-2); font-weight:600;">✓</div>
+      <div style="color:#f3b0b0;">✕</div>
+    </div>
+    <div style="display:grid; grid-template-columns: 1.2fr repeat(3, 1fr); gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+      <div>Edit pages</div>
+      <div style="color:var(--accent-2); font-weight:600;">✓</div>
+      <div style="color:var(--accent-2); font-weight:600;">✓</div>
+      <div style="color:var(--accent-2); font-weight:600;">✓</div>
+    </div>
+  </div>
+
+  <div style="margin-top:24px; display:grid; gap:10px;">
+    <div style="display:grid; grid-template-columns: 1.4fr 1.2fr 160px 140px; gap:12px; font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+      <div>Name</div>
+      <div>Email</div>
+      <div>Role</div>
+      <div>Actions</div>
+    </div>
+    <?php if (!$users): ?>
+      <div style="color: var(--muted); font-size:13px;">No accounts yet.</div>
+    <?php else: ?>
+      <?php foreach ($users as $user): ?>
+        <div style="display:grid; grid-template-columns: 1.4fr 1.2fr 160px 140px; gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+          <div style="font-weight:600;"><?= htmlspecialchars((string)($user['name'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($user['email'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="text-transform:uppercase; font-size:12px; color:var(--accent);"><?= htmlspecialchars((string)($user['role'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <form method="post" action="/admin/accounts/delete" onsubmit="return confirm('Delete this account?');">
+            <input type="hidden" name="id" value="<?= (int)($user['id'] ?? 0) ?>">
+            <button type="submit" class="btn outline small">Delete</button>
+          </form>
+        </div>
+      <?php endforeach; ?>
+    <?php endif; ?>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/admin/views/crons.php

@@ -0,0 +1,87 @@
+<?php
+$pageTitle = 'Cron Jobs';
+$storeEnabled = (bool)($store_enabled ?? false);
+$supportEnabled = (bool)($support_enabled ?? false);
+$storeCron = is_array($store_cron ?? null) ? $store_cron : null;
+$supportCron = is_array($support_cron ?? null) ? $support_cron : null;
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Automation</div>
+  <div style="display:flex; align-items:flex-end; justify-content:space-between; gap:14px; margin-top:14px;">
+    <div>
+      <h1 style="margin:0; font-size:30px;">Cron Jobs</h1>
+      <p style="margin:8px 0 0; color:var(--muted); max-width:780px;">Cron jobs run server tasks in the background. Use them when tasks must run reliably without waiting for page visits.</p>
+    </div>
+  </div>
+
+  <div class="admin-card" style="margin-top:14px; padding:12px 14px; border-radius:12px;">
+    <div style="display:grid; gap:6px; font-size:13px; color:var(--muted);">
+      <div><strong style="color:#f5f7ff;">Support IMAP Sync:</strong> <span style="color:#ffcf9a;">Required</span> if you want email replies imported into tickets.</div>
+      <div><strong style="color:#f5f7ff;">Store Sales Chart:</strong> <span style="color:#9ff8d8;">Recommended</span> for predictable chart refresh and lower request-time work.</div>
+    </div>
+  </div>
+
+  <?php if (!$storeEnabled && !$supportEnabled): ?>
+    <article class="admin-card" style="margin-top:14px; padding:12px 14px; border-radius:12px;">
+      <div style="font-size:13px; color:var(--muted);">Enable Store and/or Support plugin to show cron commands here.</div>
+    </article>
+  <?php else: ?>
+    <div style="display:grid; gap:12px; margin-top:14px;">
+      <?php foreach ([$storeCron, $supportCron] as $job): ?>
+        <?php if (!is_array($job)) { continue; } ?>
+        <article class="admin-card" style="padding:12px 14px; border-radius:12px; display:grid; gap:10px;">
+          <div style="display:flex; align-items:center; justify-content:space-between; gap:10px;">
+            <div>
+              <div style="font-size:11px; letter-spacing:0.2em; text-transform:uppercase; color:var(--muted);"><?= htmlspecialchars((string)($job['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+              <div style="color:var(--muted); font-size:13px; margin-top:6px;"><?= htmlspecialchars((string)($job['description'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+            </div>
+            <span class="pill"><?= htmlspecialchars((string)($job['interval'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+          </div>
+
+          <div style="display:grid; grid-template-columns:1fr auto; gap:8px; align-items:center;">
+            <input class="input" value="<?= htmlspecialchars((string)($job['key'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" readonly>
+            <form method="post" action="<?= htmlspecialchars((string)($job['regen_action'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+              <?php foreach ((array)($job['regen_fields'] ?? []) as $k => $v): ?>
+                <input type="hidden" name="<?= htmlspecialchars((string)$k, ENT_QUOTES, 'UTF-8') ?>" value="<?= htmlspecialchars((string)$v, ENT_QUOTES, 'UTF-8') ?>">
+              <?php endforeach; ?>
+              <button class="btn outline small" type="submit">Regenerate Key</button>
+            </form>
+          </div>
+
+          <input class="input cron-url" value="<?= htmlspecialchars((string)($job['url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" readonly>
+
+          <div style="display:grid; grid-template-columns:1fr auto; gap:8px; align-items:start;">
+            <textarea class="input cron-command" rows="2" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:12px; line-height:1.5;" readonly><?= htmlspecialchars((string)($job['command'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+            <button class="btn outline small copy-cron-btn" type="button">Copy</button>
+          </div>
+        </article>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+
+<script>
+(function(){
+  const buttons = Array.from(document.querySelectorAll('.copy-cron-btn'));
+  buttons.forEach((btn) => {
+    btn.addEventListener('click', async () => {
+      const wrap = btn.closest('article');
+      const input = wrap ? wrap.querySelector('.cron-command') : null;
+      if (!input) return;
+      try {
+        await navigator.clipboard.writeText(input.value);
+        const prev = btn.textContent;
+        btn.textContent = 'Copied';
+        setTimeout(() => { btn.textContent = prev; }, 1200);
+      } catch (e) {
+        input.focus();
+        input.select();
+      }
+    });
+  });
+})();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/admin/views/dashboard.php

@@ -0,0 +1,15 @@
+<?php
+$pageTitle = 'Admin';
+ob_start();
+?>
+<section class="card">
+  <div class="badge">Admin</div>
+  <h1 style="margin-top:16px; font-size:28px;">Welcome</h1>
+  <p style="color:var(--muted);">Admin module is live. Use Settings to update the footer text.</p>
+  <div style="margin-top:16px;">
+    <a href="/admin/settings" class="btn">Settings</a>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/admin/views/installer.php

@@ -0,0 +1,185 @@
+<?php
+$pageTitle = 'Installer';
+$step = (int)($step ?? 1);
+$values = is_array($values ?? null) ? $values : [];
+$smtpResult = is_array($smtp_result ?? null) ? $smtp_result : [];
+$checks = is_array($checks ?? null) ? $checks : [];
+
+$val = static function (string $key, string $default = '') use ($values): string {
+    return (string)($values[$key] ?? $default);
+};
+
+ob_start();
+?>
+<section class="card" style="max-width:980px; margin:0 auto;">
+  <div class="badge">Setup</div>
+  <h1 style="margin:16px 0 6px; font-size:30px;">AudioCore V1.5 Installer</h1>
+  <p style="margin:0; color:rgba(235,241,255,.75);">Deploy a fresh instance with validated SMTP and baseline health checks.</p>
+
+  <div style="display:flex; gap:10px; margin-top:18px; flex-wrap:wrap;">
+    <div style="padding:8px 12px; border-radius:999px; border:1px solid rgba(255,255,255,.16); background:<?= $step === 1 ? 'rgba(57,244,179,.18)' : 'rgba(255,255,255,.03)' ?>;">
+      <span style="font-size:11px; letter-spacing:.18em; text-transform:uppercase;">1. Core Setup</span>
+    </div>
+    <div style="padding:8px 12px; border-radius:999px; border:1px solid rgba(255,255,255,.16); background:<?= $step === 2 ? 'rgba(57,244,179,.18)' : 'rgba(255,255,255,.03)' ?>;">
+      <span style="font-size:11px; letter-spacing:.18em; text-transform:uppercase;">2. Site + SMTP</span>
+    </div>
+  </div>
+
+  <?php if (!empty($error)): ?>
+    <div style="margin-top:16px; border:1px solid rgba(255,124,124,.45); background:rgba(180,40,40,.18); border-radius:12px; padding:12px 14px; color:#ffd6d6;">
+      <?= htmlspecialchars((string)$error, ENT_QUOTES, 'UTF-8') ?>
+    </div>
+  <?php endif; ?>
+  <?php if (!empty($success)): ?>
+    <div style="margin-top:16px; border:1px solid rgba(57,244,179,.45); background:rgba(10,90,60,.22); border-radius:12px; padding:12px 14px; color:#b8ffe5;">
+      <?= htmlspecialchars((string)$success, ENT_QUOTES, 'UTF-8') ?>
+    </div>
+  <?php endif; ?>
+
+  <?php if ($step === 1): ?>
+    <form method="post" action="/admin/install" style="margin-top:18px; display:grid; gap:14px;">
+      <input type="hidden" name="installer_action" value="setup_core">
+      <div style="display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:12px;">
+        <div>
+          <label>DB Host *</label>
+          <input class="input" name="db_host" value="<?= htmlspecialchars($val('db_host', 'localhost'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>DB Port *</label>
+          <input class="input" name="db_port" value="<?= htmlspecialchars($val('db_port', '3306'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>DB Name *</label>
+          <input class="input" name="db_name" value="<?= htmlspecialchars($val('db_name', ''), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>DB User *</label>
+          <input class="input" name="db_user" value="<?= htmlspecialchars($val('db_user', ''), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div style="grid-column:1/-1;">
+          <label>DB Password</label>
+          <input class="input" type="password" name="db_pass" value="">
+        </div>
+      </div>
+
+      <div style="margin-top:6px; padding-top:14px; border-top:1px solid rgba(255,255,255,.1); display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:12px;">
+        <div>
+          <label>Admin Name *</label>
+          <input class="input" name="admin_name" value="<?= htmlspecialchars($val('admin_name', 'Admin'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>Admin Email *</label>
+          <input class="input" type="email" name="admin_email" value="<?= htmlspecialchars($val('admin_email', ''), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>Admin Password *</label>
+          <input class="input" type="password" name="admin_password" value="" placeholder="Minimum 8 characters">
+        </div>
+      </div>
+
+      <div style="display:flex; justify-content:flex-end; margin-top:4px;">
+        <button type="submit" class="button button-primary">Create Core Setup</button>
+      </div>
+    </form>
+  <?php else: ?>
+    <form method="post" action="/admin/install" style="margin-top:18px; display:grid; gap:14px;">
+      <div style="display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:12px;">
+        <div>
+          <label>Site Title *</label>
+          <input class="input" name="site_title" value="<?= htmlspecialchars($val('site_title', 'AudioCore V1.5'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>Site Tagline</label>
+          <input class="input" name="site_tagline" value="<?= htmlspecialchars($val('site_tagline', 'Core CMS for DJs & Producers'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>SEO Title Suffix</label>
+          <input class="input" name="seo_title_suffix" value="<?= htmlspecialchars($val('seo_title_suffix', 'AudioCore V1.5'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div style="grid-column:1/-1;">
+          <label>SEO Meta Description</label>
+          <textarea class="input" name="seo_meta_description" rows="3" style="resize:vertical;"><?= htmlspecialchars($val('seo_meta_description', ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        </div>
+      </div>
+
+      <div style="padding-top:12px; border-top:1px solid rgba(255,255,255,.1); display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:12px;">
+        <div>
+          <label>SMTP Host *</label>
+          <input class="input" name="smtp_host" value="<?= htmlspecialchars($val('smtp_host', ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="smtp.example.com">
+        </div>
+        <div>
+          <label>SMTP Port *</label>
+          <input class="input" name="smtp_port" value="<?= htmlspecialchars($val('smtp_port', '587'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>SMTP User</label>
+          <input class="input" name="smtp_user" value="<?= htmlspecialchars($val('smtp_user', ''), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>SMTP Password</label>
+          <input class="input" type="password" name="smtp_pass" value="<?= htmlspecialchars($val('smtp_pass', ''), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>SMTP Encryption</label>
+          <input class="input" name="smtp_encryption" value="<?= htmlspecialchars($val('smtp_encryption', 'tls'), ENT_QUOTES, 'UTF-8') ?>" placeholder="tls or ssl">
+        </div>
+        <div>
+          <label>SMTP From Email *</label>
+          <input class="input" type="email" name="smtp_from_email" value="<?= htmlspecialchars($val('smtp_from_email', ''), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>SMTP From Name</label>
+          <input class="input" name="smtp_from_name" value="<?= htmlspecialchars($val('smtp_from_name', 'AudioCore V1.5'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <label>Test Recipient Email *</label>
+          <input class="input" type="email" name="smtp_test_email" value="<?= htmlspecialchars($val('smtp_test_email', ''), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+      </div>
+
+      <?php if (!empty($smtpResult)): ?>
+        <div style="border:1px solid <?= !empty($smtpResult['ok']) ? 'rgba(57,244,179,.45)' : 'rgba(255,124,124,.45)' ?>; background:<?= !empty($smtpResult['ok']) ? 'rgba(10,90,60,.22)' : 'rgba(180,40,40,.18)' ?>; border-radius:12px; padding:12px 14px;">
+          <div style="font-weight:700; margin-bottom:4px; color:<?= !empty($smtpResult['ok']) ? '#b8ffe5' : '#ffd6d6' ?>">
+            <?= !empty($smtpResult['ok']) ? 'SMTP test passed' : 'SMTP test failed' ?>
+          </div>
+          <div style="color:<?= !empty($smtpResult['ok']) ? '#b8ffe5' : '#ffd6d6' ?>;">
+            <?= htmlspecialchars((string)($smtpResult['message'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <?php if (!empty($smtpResult['debug'])): ?>
+            <details style="margin-top:8px;">
+              <summary style="cursor:pointer;">Debug output</summary>
+              <pre style="white-space:pre-wrap; margin-top:8px; font-size:12px; color:#cfd6f5;"><?= htmlspecialchars((string)$smtpResult['debug'], ENT_QUOTES, 'UTF-8') ?></pre>
+            </details>
+          <?php endif; ?>
+        </div>
+      <?php endif; ?>
+
+      <?php if (!empty($checks)): ?>
+        <div style="padding:12px; border:1px solid rgba(255,255,255,.1); border-radius:12px; background:rgba(255,255,255,.02);">
+          <div style="font-size:12px; text-transform:uppercase; letter-spacing:.16em; color:rgba(255,255,255,.65); margin-bottom:10px;">Installer Health Checks</div>
+          <div style="display:grid; gap:8px;">
+            <?php foreach ($checks as $check): ?>
+              <div style="display:flex; gap:10px; align-items:flex-start;">
+                <span style="display:inline-flex; align-items:center; justify-content:center; width:18px; height:18px; border-radius:999px; font-size:12px; margin-top:2px; background:<?= !empty($check['ok']) ? 'rgba(57,244,179,.2)' : 'rgba(255,124,124,.2)' ?>; color:<?= !empty($check['ok']) ? '#9ff8d8' : '#ffb7b7' ?>;">
+                  <?= !empty($check['ok']) ? '✓' : '!' ?>
+                </span>
+                <div>
+                  <div style="font-weight:600;"><?= htmlspecialchars((string)($check['label'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+                  <div style="color:rgba(235,241,255,.65); font-size:13px;"><?= htmlspecialchars((string)($check['detail'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+                </div>
+              </div>
+            <?php endforeach; ?>
+          </div>
+        </div>
+      <?php endif; ?>
+
+      <div style="display:flex; justify-content:flex-end; gap:10px; flex-wrap:wrap; margin-top:4px;">
+        <button type="submit" name="installer_action" value="test_smtp" class="button">Send Test Email + Run Checks</button>
+        <button type="submit" name="installer_action" value="finish_install" class="button button-primary">Finish Installation</button>
+      </div>
+    </form>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../views/site/layout.php';

modules/admin/views/layout.php

@@ -0,0 +1,638 @@
+<?php
+/** @var string $pageTitle */
+/** @var string $content */
+use Core\Services\Auth;
+use Core\Services\Settings;
+use Core\Services\Plugins;
+use Core\Services\Updater;
+
+$faUrl = Settings::get('fontawesome_pro_url', '');
+if ($faUrl === '') {
+  $faUrl = Settings::get('fontawesome_url', '');
+}
+$faEnabled = $faUrl !== '';
+$role = Auth::role();
+$isAuthed = Auth::check();
+$pluginNav = Plugins::adminNav();
+$userName = Auth::name();
+$updateStatus = ['ok' => false, 'update_available' => false];
+if ($isAuthed) {
+  try {
+    $updateStatus = Updater::getStatus(false);
+  } catch (Throwable $e) {
+    $updateStatus = ['ok' => false, 'update_available' => false];
+  }
+}
+?>
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title><?= htmlspecialchars($pageTitle ?? 'Admin', ENT_QUOTES, 'UTF-8') ?></title>
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Syne:wght@500;600;700&family=IBM+Plex+Mono:wght@400;600&display=swap" rel="stylesheet">
+  <?php if ($faEnabled): ?>
+    <link rel="stylesheet" href="<?= htmlspecialchars($faUrl, ENT_QUOTES, 'UTF-8') ?>">
+  <?php endif; ?>
+  <style>
+    :root {
+      color-scheme: dark;
+      --bg: #0b0b0c;
+      --panel: #1b1c1f;
+      --panel-2: #232427;
+      --text: #f3f4f8;
+      --muted: #a2a7b3;
+      --accent: #22a7ff;
+      --accent-2: #22f2a5;
+      --stroke: rgba(255,255,255,0.1);
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: 'Syne', sans-serif;
+      background: var(--bg);
+      color: var(--text);
+    }
+    a { color: inherit; text-decoration: none; }
+    .shell { max-width: 1200px; margin: 0 auto; padding: 0 24px; }
+    .admin-wrapper {
+      max-width: 1280px;
+      margin: 24px auto;
+      padding: 0 18px;
+    }
+    .admin-shell {
+      display: grid;
+      grid-template-columns: 240px 1fr;
+      min-height: 100vh;
+      background: rgba(14,14,16,0.98);
+      border: 1px solid rgba(255,255,255,0.06);
+      border-radius: 24px;
+      overflow: hidden;
+      box-shadow: 0 30px 70px rgba(0,0,0,0.45);
+    }
+    .auth-shell {
+      display: grid;
+      grid-template-columns: 1fr;
+      min-height: 70vh;
+      align-items: center;
+    }
+    .sidebar {
+      border-right: 1px solid var(--stroke);
+      background: rgba(10,10,12,0.98);
+      padding: 24px 18px;
+      display: flex;
+      flex-direction: column;
+      gap: 18px;
+      position: sticky;
+      top: 0;
+      height: 100vh;
+      overflow-y: auto;
+    }
+    .sidebar-user {
+      display: flex;
+      align-items: center;
+      gap: 10px;
+      padding: 8px 6px 16px;
+      border-bottom: 1px solid rgba(255,255,255,0.08);
+    }
+    .sidebar-user .icon {
+      width: 40px;
+      height: 40px;
+      border-radius: 12px;
+      background: rgba(255,255,255,0.06);
+      display: grid;
+      place-items: center;
+      font-size: 18px;
+      color: var(--accent-2);
+    }
+    .sidebar-user .hello {
+      font-size: 12px;
+      color: rgba(255,255,255,0.55);
+      text-transform: uppercase;
+      letter-spacing: 0.2em;
+    }
+    .sidebar-user .name {
+      font-size: 14px;
+      font-weight: 600;
+    }
+    .sidebar-section {
+      display: grid;
+      gap: 8px;
+    }
+    .sidebar-title {
+      font-size: 10px;
+      text-transform: uppercase;
+      letter-spacing: 0.3em;
+      color: rgba(255,255,255,0.4);
+      margin-top: 10px;
+    }
+    .sidebar a {
+      display: flex;
+      align-items: center;
+      gap: 10px;
+      padding: 10px 12px;
+      border-radius: 12px;
+      font-size: 12px;
+      font-weight: 600;
+      letter-spacing: 0.12em;
+      text-transform: uppercase;
+      background: rgba(255,255,255,0.03);
+      border: 1px solid var(--stroke);
+      color: var(--muted);
+    }
+    .sidebar a.active,
+    .sidebar a:hover {
+      color: var(--text);
+      background: rgba(255,255,255,0.08);
+    }
+    .brand {
+      display: flex;
+      align-items: center;
+      gap: 12px;
+      font-weight: 600;
+      font-size: 18px;
+    }
+    .brand-badge {
+      width: 48px;
+      height: 48px;
+      border-radius: 14px;
+      background: linear-gradient(135deg, var(--accent), var(--accent-2));
+      display: grid;
+      place-items: center;
+      color: #071016;
+      font-weight: 700;
+    }
+    .badge {
+      font-family: 'IBM Plex Mono', monospace;
+      text-transform: uppercase;
+      font-size: 10px;
+      letter-spacing: 0.3em;
+      color: rgba(255,255,255,0.5);
+    }
+    .btn {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 16px;
+      border-radius: 999px;
+      background: var(--accent);
+      color: #041018;
+      font-weight: 600;
+      font-size: 12px;
+      text-transform: uppercase;
+      letter-spacing: 0.25em;
+      border: none;
+      cursor: pointer;
+    }
+    .btn.outline {
+      background: transparent;
+      color: var(--text);
+      border: 1px solid rgba(255,255,255,0.18);
+    }
+    .btn.small {
+      padding: 4px 10px;
+      font-size: 10px;
+      letter-spacing: 0.18em;
+      border-radius: 999px;
+      line-height: 1.4;
+      min-height: 26px;
+    }
+    .modal-backdrop {
+      position: fixed;
+      inset: 0;
+      background: rgba(0,0,0,0.6);
+      display: none;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      z-index: 50;
+    }
+    .modal {
+      background: #17181d;
+      border: 1px solid rgba(255,255,255,0.1);
+      border-radius: 18px;
+      padding: 16px;
+      width: min(900px, 92vw);
+      max-height: 80vh;
+      overflow: hidden;
+      display: grid;
+      gap: 12px;
+    }
+    .media-grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fill, minmax(140px, 1fr));
+      gap: 10px;
+      overflow: auto;
+      padding-right: 4px;
+    }
+    .media-thumb {
+      border-radius: 12px;
+      border: 1px solid rgba(255,255,255,0.12);
+      background: rgba(0,0,0,0.35);
+      padding: 8px;
+      display: grid;
+      gap: 6px;
+      cursor: pointer;
+    }
+    .media-thumb img {
+      width: 100%;
+      aspect-ratio: 1 / 1;
+      object-fit: cover;
+      border-radius: 8px;
+    }
+    .media-meta {
+      font-size: 11px;
+      color: var(--muted);
+      word-break: break-word;
+    }
+    .modal-header {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      gap: 12px;
+    }
+    .modal-title {
+      font-size: 14px;
+      font-weight: 600;
+      text-transform: uppercase;
+      letter-spacing: 0.2em;
+    }
+    .modal-actions {
+      display: flex;
+      gap: 10px;
+      align-items: center;
+      flex: 1;
+      justify-content: flex-end;
+    }
+    .media-empty {
+      color: var(--muted);
+      font-size: 13px;
+      padding: 12px;
+    }
+    .input {
+      width: 100%;
+      padding: 10px 12px;
+      border-radius: 12px;
+      border: 1px solid var(--stroke);
+      background: rgba(12,12,14,0.9);
+      color: var(--text);
+    }
+    .label {
+      font-size: 12px;
+      color: var(--muted);
+      text-transform: uppercase;
+      letter-spacing: 0.2em;
+    }
+    .admin-header {
+      border-bottom: 1px solid var(--stroke);
+      background: rgba(10,10,12,0.9);
+      backdrop-filter: blur(6px);
+    }
+    .admin-top {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      gap: 16px;
+      padding: 18px 0;
+    }
+    .admin-actions {
+      display: flex;
+      gap: 10px;
+      align-items: center;
+    }
+    .admin-content {
+      padding: 28px 0 64px;
+    }
+    .admin-main {
+      display: flex;
+      flex-direction: column;
+      min-width: 0;
+    }
+    .admin-container {
+      max-width: 1200px;
+      margin: 0 auto;
+      padding: 0 28px;
+      width: 100%;
+    }
+    .admin-card {
+      background: rgba(255,255,255,0.04);
+      border: 1px solid rgba(255,255,255,0.1);
+      border-radius: 20px;
+      padding: 20px;
+      box-shadow: 0 18px 40px rgba(0,0,0,0.35);
+    }
+    .pill {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 14px;
+      border-radius: 999px;
+      font-size: 12px;
+      font-weight: 600;
+      text-transform: uppercase;
+      letter-spacing: 0.2em;
+      border: 1px solid rgba(255,255,255,0.12);
+      background: rgba(255,255,255,0.04);
+      color: var(--muted);
+    }
+    @media (max-width: 1200px) {
+      .admin-container { max-width: 1040px; }
+    }
+    @media (max-width: 1024px) {
+      .admin-shell { grid-template-columns: 210px 1fr; }
+      .admin-container { padding: 0 20px; }
+    }
+    @media (max-width: 880px) {
+      .admin-wrapper { margin: 16px auto; }
+      .admin-shell { grid-template-columns: 1fr; min-height: auto; }
+      .sidebar {
+        position: relative;
+        height: auto;
+        border-right: none;
+        border-bottom: 1px solid var(--stroke);
+      }
+    }
+  </style>
+</head>
+<body>
+  <div class="admin-wrapper">
+    <div class="<?= $isAuthed ? 'admin-shell' : 'auth-shell' ?>">
+      <?php if ($isAuthed): ?>
+        <aside class="sidebar">
+          <div class="sidebar-user">
+            <div class="icon">
+              <?php if ($faEnabled): ?>
+                <i class="fa-duotone fa-head-side-headphones"></i>
+              <?php else: ?>
+              AC
+            <?php endif; ?>
+          </div>
+          <div>
+            <div class="hello">Hello</div>
+            <div class="name"><?= htmlspecialchars($userName, ENT_QUOTES, 'UTF-8') ?></div>
+          </div>
+        </div>
+        <div class="sidebar-section">
+          <div class="sidebar-title">Core</div>
+          <a href="/admin" class="<?= ($pageTitle ?? '') === 'Admin' ? 'active' : '' ?>">
+            <?php if ($faEnabled): ?><i class="fa-solid fa-house"></i><?php endif; ?>
+            Dashboard
+          </a>
+          <?php if (in_array($role, ['admin', 'manager', 'editor'], true)): ?>
+            <a href="/admin/pages" class="<?= ($pageTitle ?? '') === 'Pages' ? 'active' : '' ?>">
+              <?php if ($faEnabled): ?><i class="fa-solid fa-file-lines"></i><?php endif; ?>
+              Pages
+            </a>
+          <?php endif; ?>
+          <?php if (in_array($role, ['admin', 'manager'], true)): ?>
+            <a href="/admin/media" class="<?= ($pageTitle ?? '') === 'Media' ? 'active' : '' ?>">
+              <?php if ($faEnabled): ?><i class="fa-solid fa-photo-film"></i><?php endif; ?>
+              Media
+            </a>
+          <?php endif; ?>
+          <?php if (in_array($role, ['admin', 'manager'], true)): ?>
+            <a href="/admin/navigation" class="<?= ($pageTitle ?? '') === 'Navigation' ? 'active' : '' ?>">
+              <?php if ($faEnabled): ?><i class="fa-solid fa-sitemap"></i><?php endif; ?>
+              Navigation
+            </a>
+          <?php endif; ?>
+        </div>
+
+        <?php if (in_array($role, ['admin', 'manager'], true)): ?>
+          <div class="sidebar-section">
+            <div class="sidebar-title">Content</div>
+            <a href="/admin/posts" class="<?= ($pageTitle ?? '') === 'Posts' ? 'active' : '' ?>">
+              <?php if ($faEnabled): ?><i class="fa-solid fa-newspaper"></i><?php endif; ?>
+              Blog
+            </a>
+            <a href="/admin/newsletter" class="<?= ($pageTitle ?? '') === 'Newsletter' ? 'active' : '' ?>">
+              <?php if ($faEnabled): ?><i class="fa-solid fa-envelope"></i><?php endif; ?>
+              Newsletter
+            </a>
+            <a href="/admin/shortcodes" class="<?= ($pageTitle ?? '') === 'Shortcodes' ? 'active' : '' ?>">
+              <?php if ($faEnabled): ?><i class="fa-solid fa-code"></i><?php endif; ?>
+              Shortcodes
+            </a>
+            <a href="/admin/updates" class="<?= ($pageTitle ?? '') === 'Updates' ? 'active' : '' ?>">
+              <?php if ($faEnabled): ?><i class="fa-solid fa-download"></i><?php endif; ?>
+              Updates
+              <?php if (!empty($updateStatus['update_available'])): ?>
+                <span style="margin-left:auto; width:8px; height:8px; border-radius:999px; background:#22f2a5;"></span>
+              <?php endif; ?>
+            </a>
+          </div>
+        <?php endif; ?>
+
+        <?php if ($pluginNav): ?>
+          <div class="sidebar-section">
+            <div class="sidebar-title">Plugins</div>
+            <?php foreach ($pluginNav as $item): ?>
+              <?php
+                $roles = $item['roles'] ?? [];
+                if ($roles && !in_array($role, $roles, true)) {
+                    continue;
+                }
+                $itemUrl = (string)$item['url'];
+                $itemLabel = (string)$item['label'];
+                $itemIcon = (string)$item['icon'];
+                $activeClass = (($pageTitle ?? '') === $itemLabel) ? 'active' : '';
+              ?>
+              <a href="<?= htmlspecialchars($itemUrl, ENT_QUOTES, 'UTF-8') ?>" class="<?= $activeClass ?>">
+                <?php if ($faEnabled && $itemIcon): ?><i class="<?= htmlspecialchars($itemIcon, ENT_QUOTES, 'UTF-8') ?>"></i><?php endif; ?>
+                <?= htmlspecialchars($itemLabel, ENT_QUOTES, 'UTF-8') ?>
+              </a>
+            <?php endforeach; ?>
+          </div>
+        <?php endif; ?>
+
+        <?php if ($role === 'admin'): ?>
+          <div class="sidebar-section">
+              <div class="sidebar-title">Admin</div>
+              <a href="/admin/accounts" class="<?= ($pageTitle ?? '') === 'Accounts' ? 'active' : '' ?>">
+                <?php if ($faEnabled): ?><i class="fa-solid fa-user-shield"></i><?php endif; ?>
+                Accounts
+              </a>
+              <a href="/admin/plugins" class="<?= ($pageTitle ?? '') === 'Plugins' ? 'active' : '' ?>">
+                <?php if ($faEnabled): ?><i class="fa-solid fa-plug"></i><?php endif; ?>
+                Plugins
+              </a>
+            </div>
+          <?php endif; ?>
+        </aside>
+      <?php endif; ?>
+
+      <div class="admin-main">
+        <?php if ($isAuthed): ?>
+          <header class="admin-header">
+            <div class="admin-container">
+              <div class="admin-top">
+                <div class="brand">
+                  <div class="brand-badge">AC</div>
+                  <div>
+                    <div>AudioCore Admin</div>
+                    <div class="badge">V1.5</div>
+                  </div>
+                </div>
+                <div class="admin-actions">
+                  <a href="/admin/updates" class="btn outline" style="<?= !empty($updateStatus['update_available']) ? 'border-color: rgba(34,242,165,.6); color:#9ff8d8;' : '' ?>">
+                    <?php if ($faEnabled): ?><i class="fa-solid fa-download"></i><?php endif; ?>
+                    <?= !empty($updateStatus['update_available']) ? 'Update Available' : 'Updates' ?>
+                  </a>
+                  <a href="/admin/settings" class="btn outline">
+                    <?php if ($faEnabled): ?><i class="fa-solid fa-gear"></i><?php endif; ?>
+                    Settings
+                  </a>
+                  <a href="/admin/logout" class="btn outline">
+                    <?php if ($faEnabled): ?><i class="fa-solid fa-right-from-bracket"></i><?php endif; ?>
+                    Logout
+                  </a>
+                </div>
+              </div>
+            </div>
+          </header>
+        <?php endif; ?>
+        <main class="admin-content">
+          <div class="admin-container">
+            <?= $content ?? '' ?>
+          </div>
+        </main>
+      </div>
+    </div>
+  </div>
+  <div id="mediaPickerBackdrop" class="modal-backdrop" aria-hidden="true">
+    <div class="modal" role="dialog" aria-modal="true" aria-label="Media picker">
+      <div class="modal-header">
+        <div class="modal-title">Media Picker</div>
+        <div class="modal-actions">
+          <input id="mediaPickerSearch" class="input" placeholder="Search media..." style="max-width: 320px;">
+          <button type="button" class="btn outline small" id="mediaPickerClose">Close</button>
+        </div>
+      </div>
+      <div id="mediaPickerGrid" class="media-grid"></div>
+      <div id="mediaPickerEmpty" class="media-empty" style="display:none;">No images available.</div>
+    </div>
+  </div>
+  <script>
+    (function () {
+      const backdrop = document.getElementById('mediaPickerBackdrop');
+      const grid = document.getElementById('mediaPickerGrid');
+      const empty = document.getElementById('mediaPickerEmpty');
+      const search = document.getElementById('mediaPickerSearch');
+      const closeBtn = document.getElementById('mediaPickerClose');
+      if (!backdrop || !grid || !search || !closeBtn) {
+        return;
+      }
+
+      let items = [];
+      let activeTarget = null;
+
+      function insertAtCursor(textarea, text) {
+        const start = textarea.selectionStart || 0;
+        const end = textarea.selectionEnd || 0;
+        const value = textarea.value || '';
+        textarea.value = value.slice(0, start) + text + value.slice(end);
+        const next = start + text.length;
+        textarea.setSelectionRange(next, next);
+        textarea.focus();
+      }
+
+      function renderGrid(filterText) {
+        const q = (filterText || '').toLowerCase();
+        const filtered = items.filter(item => {
+          const name = String(item.file_name || '').toLowerCase();
+          const isImage = String(item.file_type || '').startsWith('image/');
+          return isImage && (!q || name.includes(q));
+        });
+
+        grid.innerHTML = '';
+        if (!filtered.length) {
+          empty.style.display = 'block';
+          return;
+        }
+        empty.style.display = 'none';
+
+        filtered.forEach(item => {
+          const card = document.createElement('button');
+          card.type = 'button';
+          card.className = 'media-thumb';
+          card.innerHTML = `
+            <img src="${item.file_url}" alt="">
+            <div class="media-meta">${item.file_name || ''}</div>
+          `;
+          card.addEventListener('click', function () {
+            const target = activeTarget ? document.getElementById(activeTarget) : null;
+            if (!target) {
+              return;
+            }
+            if (activeMode === 'url') {
+              insertAtCursor(target, item.file_url);
+            } else {
+              insertAtCursor(target, '<img src="' + item.file_url + '" alt="">');
+            }
+            closePicker();
+          });
+          grid.appendChild(card);
+        });
+      }
+
+      let activeMode = 'html';
+
+      function openPicker(targetId, mode) {
+        activeTarget = targetId;
+        activeMode = mode || 'html';
+        backdrop.style.display = 'flex';
+        backdrop.setAttribute('aria-hidden', 'false');
+        search.value = '';
+        fetch('/admin/media/picker', { credentials: 'same-origin' })
+          .then(resp => resp.ok ? resp.json() : Promise.reject())
+          .then(data => {
+            items = Array.isArray(data.items) ? data.items : [];
+            renderGrid('');
+          })
+          .catch(() => {
+            items = [];
+            renderGrid('');
+          });
+      }
+
+      function closePicker() {
+        backdrop.style.display = 'none';
+        backdrop.setAttribute('aria-hidden', 'true');
+        activeTarget = null;
+      }
+
+      document.addEventListener('click', function (event) {
+        const btn = event.target.closest('[data-media-picker]');
+        if (!btn) {
+          return;
+        }
+        const targetId = btn.getAttribute('data-media-picker');
+        const mode = btn.getAttribute('data-media-picker-mode');
+        if (targetId) {
+          openPicker(targetId, mode);
+        }
+      });
+
+      search.addEventListener('input', function () {
+        renderGrid(search.value);
+      });
+
+      closeBtn.addEventListener('click', closePicker);
+
+      backdrop.addEventListener('click', function (event) {
+        if (event.target === backdrop) {
+          closePicker();
+        }
+      });
+
+      document.addEventListener('keydown', function (event) {
+        if (event.key === 'Escape' && backdrop.style.display === 'flex') {
+          closePicker();
+        }
+      });
+    })();
+  </script>
+</body>
+</html>

modules/admin/views/login.php

@@ -0,0 +1,26 @@
+<?php
+$pageTitle = 'Admin Login';
+ob_start();
+?>
+<section class="admin-card" style="max-width:520px; margin:0 auto;">
+  <div class="badge">Admin</div>
+  <h1 style="margin-top:16px; font-size:28px;">Admin Login</h1>
+  <p style="color: var(--muted); margin-top:6px;">Sign in to manage AudioCore.</p>
+  <?php if (!empty($error)): ?>
+    <p style="color:#ff9d9d; font-size:13px; margin-top:12px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></p>
+  <?php endif; ?>
+  <form method="post" action="/admin/login" style="margin-top:18px; display:grid; gap:16px;">
+    <div style="display:grid; gap:8px;">
+      <label class="label">Email</label>
+      <input class="input" name="email" autocomplete="username">
+    </div>
+    <div style="display:grid; gap:8px;">
+      <label class="label">Password</label>
+      <input class="input" name="password" type="password" autocomplete="current-password">
+    </div>
+    <button type="submit" class="btn">Login</button>
+  </form>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../modules/admin/views/layout.php';

modules/admin/views/navigation.php

@@ -0,0 +1,339 @@
+<?php
+$pageTitle = 'Navigation';
+$links = $links ?? [];
+$pages = $pages ?? [];
+$error = $error ?? '';
+$saved = ($saved ?? '') === '1';
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Navigation</div>
+  <h1 style="margin-top:16px; font-size:28px;">Site Navigation</h1>
+  <p style="color: var(--muted); margin-top:8px;">Build your main menu. Add items on the left, then drag to reorder.</p>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color: #f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php elseif ($saved): ?>
+    <div style="margin-top:16px; color: var(--accent); font-size:13px;">Navigation saved.</div>
+  <?php endif; ?>
+
+  <style>
+    .nav-grid { display: grid; grid-template-columns: 320px 1fr; gap: 18px; }
+    .nav-list { display: grid; gap: 10px; }
+    .nav-item {
+      display: grid;
+      grid-template-columns: 34px 1.3fr 2fr 90px 90px 90px;
+      gap: 12px;
+      align-items: center;
+      padding: 10px 12px;
+      border-radius: 16px;
+      border: 1px solid var(--stroke);
+      background: rgba(14,14,16,0.9);
+    }
+    .nav-item.dragging { opacity: 0.6; }
+    .drag-handle {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      width: 28px;
+      height: 28px;
+      border-radius: 8px;
+      border: 1px solid rgba(255,255,255,0.12);
+      background: rgba(255,255,255,0.04);
+      font-size: 12px;
+      color: var(--muted);
+      cursor: grab;
+      user-select: none;
+    }
+    .nav-meta {
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 12px;
+      color: var(--muted);
+      text-transform: uppercase;
+      letter-spacing: 0.2em;
+    }
+    .nav-item input[readonly] { opacity: 0.7; }
+    @media (max-width: 980px) {
+      .nav-grid { grid-template-columns: 1fr; }
+      .nav-item { grid-template-columns: 28px 1fr; grid-auto-rows: auto; }
+      .nav-item > *:nth-child(n+3) { grid-column: 2 / -1; }
+    }
+  </style>
+
+  <form method="post" action="/admin/navigation" style="margin-top:20px; display:grid; gap:18px;">
+    <div class="nav-grid">
+      <aside class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Add menu items</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label class="label">Page picker</label>
+          <select id="navPageSelect" class="input" style="text-transform:none;">
+            <option value="" data-label="" data-url="">Select page</option>
+            <option value="home" data-label="Home" data-url="/">Home</option>
+            <option value="artists" data-label="Artists" data-url="/artists">Artists</option>
+            <option value="releases" data-label="Releases" data-url="/releases">Releases</option>
+            <option value="store" data-label="Store" data-url="/store">Store</option>
+            <option value="contact" data-label="Contact" data-url="/contact">Contact</option>
+            <?php foreach ($pages as $page): ?>
+              <option value="page-<?= htmlspecialchars((string)($page['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>"
+                      data-label="<?= htmlspecialchars((string)($page['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>"
+                      data-url="/<?= htmlspecialchars((string)($page['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+                <?= htmlspecialchars((string)($page['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+              </option>
+            <?php endforeach; ?>
+            <option value="custom" data-label="" data-url="">Custom link</option>
+          </select>
+          <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+            <input id="navActiveInput" type="checkbox" checked>
+            Active
+          </label>
+          <button type="button" id="navAddButton" class="btn" style="padding:8px 14px;">Add to menu</button>
+          <div style="font-size:12px; color:var(--muted);">Use Custom for external links or anchors.</div>
+        </div>
+      </aside>
+
+      <section class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Menu structure</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <div class="nav-item" style="background: transparent; border: none; padding: 0;">
+            <div></div>
+            <div class="nav-meta">Label</div>
+            <div class="nav-meta">URL</div>
+            <div class="nav-meta">Order</div>
+            <div class="nav-meta">Active</div>
+            <div class="nav-meta">Delete</div>
+          </div>
+          <div id="navMenuEmpty" style="color: var(--muted); font-size:13px; display: <?= $links ? 'none' : 'block' ?>;">No navigation links yet.</div>
+          <div id="navMenuList" class="nav-list">
+            <?php foreach ($links as $link): ?>
+              <div class="nav-item" draggable="true">
+                <div class="drag-handle" title="Drag to reorder">||</div>
+                <input class="input" name="items[<?= (int)$link['id'] ?>][label]" value="<?= htmlspecialchars((string)($link['label'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+                <input class="input" name="items[<?= (int)$link['id'] ?>][url]" value="<?= htmlspecialchars((string)($link['url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+                <input class="input" name="items[<?= (int)$link['id'] ?>][sort_order]" data-sort-input value="<?= htmlspecialchars((string)($link['sort_order'] ?? 0), ENT_QUOTES, 'UTF-8') ?>" readonly>
+                <label style="display:flex; justify-content:center;">
+                  <input type="checkbox" name="items[<?= (int)$link['id'] ?>][is_active]" value="1" <?= ((int)($link['is_active'] ?? 0) === 1) ? 'checked' : '' ?>>
+                </label>
+                <label style="display:flex; justify-content:center;">
+                  <input type="checkbox" name="delete_ids[]" value="<?= (int)$link['id'] ?>">
+                </label>
+              </div>
+            <?php endforeach; ?>
+          </div>
+        </div>
+      </section>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end;">
+      <button type="submit" class="btn">Save navigation</button>
+    </div>
+  </form>
+</section>
+
+<div id="navModal" style="position:fixed; inset:0; background:rgba(0,0,0,0.55); display:none; align-items:center; justify-content:center; padding:24px; z-index:40;">
+  <div class="admin-card" style="max-width:520px; width:100%; position:relative;">
+    <div class="badge">Custom link</div>
+    <h2 style="margin-top:12px; font-size:24px;">Add custom link</h2>
+    <div style="display:grid; gap:14px; margin-top:16px;">
+      <div>
+        <label class="label">Label</label>
+        <input id="modalLabel" class="input" placeholder="Press Kit">
+      </div>
+      <div>
+        <label class="label">URL</label>
+        <input id="modalUrl" class="input" placeholder="https://example.com/press">
+      </div>
+      <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+        <input id="modalActive" type="checkbox" checked>
+        Active
+      </label>
+      <div style="display:flex; gap:12px; justify-content:flex-end;">
+        <button type="button" id="modalCancel" class="btn" style="background:transparent; color:var(--text); border:1px solid rgba(255,255,255,0.2);">Cancel</button>
+        <button type="button" id="modalAdd" class="btn">Add link</button>
+      </div>
+    </div>
+  </div>
+</div>
+<script>
+  (function () {
+    const menuList = document.getElementById('navMenuList');
+    const menuEmpty = document.getElementById('navMenuEmpty');
+    const addButton = document.getElementById('navAddButton');
+    const pageSelect = document.getElementById('navPageSelect');
+    const activeInput = document.getElementById('navActiveInput');
+
+    const modal = document.getElementById('navModal');
+    const modalLabel = document.getElementById('modalLabel');
+    const modalUrl = document.getElementById('modalUrl');
+    const modalActive = document.getElementById('modalActive');
+    const modalAdd = document.getElementById('modalAdd');
+    const modalCancel = document.getElementById('modalCancel');
+
+    let stagedIndex = 0;
+
+    function showModal() {
+      modal.style.display = 'flex';
+      modalLabel.value = '';
+      modalUrl.value = '';
+      modalActive.checked = true;
+      modalLabel.focus();
+    }
+
+    function hideModal() {
+      modal.style.display = 'none';
+    }
+
+    function updateOrder() {
+      const items = menuList.querySelectorAll('.nav-item');
+      items.forEach((item, index) => {
+        const sortInput = item.querySelector('[data-sort-input]');
+        if (sortInput) {
+          sortInput.value = String(index + 1);
+        }
+      });
+      menuEmpty.style.display = items.length ? 'none' : 'block';
+    }
+
+    function addStagedLink(label, url, isActive) {
+      if (!label || !url) {
+        return;
+      }
+      stagedIndex += 1;
+      const row = document.createElement('div');
+      row.className = 'nav-item';
+      row.setAttribute('draggable', 'true');
+
+      const handle = document.createElement('div');
+      handle.className = 'drag-handle';
+      handle.textContent = '||';
+      handle.title = 'Drag to reorder';
+
+      const labelInput = document.createElement('input');
+      labelInput.className = 'input';
+      labelInput.name = `new[${stagedIndex}][label]`;
+      labelInput.value = label;
+
+      const urlInput = document.createElement('input');
+      urlInput.className = 'input';
+      urlInput.name = `new[${stagedIndex}][url]`;
+      urlInput.value = url;
+
+      const orderInputEl = document.createElement('input');
+      orderInputEl.className = 'input';
+      orderInputEl.name = `new[${stagedIndex}][sort_order]`;
+      orderInputEl.value = '0';
+      orderInputEl.setAttribute('data-sort-input', '');
+      orderInputEl.readOnly = true;
+
+      const activeLabel = document.createElement('label');
+      activeLabel.style.display = 'flex';
+      activeLabel.style.justifyContent = 'center';
+      const activeCheckbox = document.createElement('input');
+      activeCheckbox.type = 'checkbox';
+      activeCheckbox.name = `new[${stagedIndex}][is_active]`;
+      activeCheckbox.value = '1';
+      activeCheckbox.checked = !!isActive;
+      activeLabel.appendChild(activeCheckbox);
+
+      const removeButton = document.createElement('button');
+      removeButton.type = 'button';
+      removeButton.className = 'btn';
+      removeButton.textContent = 'Remove';
+      removeButton.style.padding = '6px 12px';
+      removeButton.style.background = 'transparent';
+      removeButton.style.color = 'var(--text)';
+      removeButton.style.border = '1px solid rgba(255,255,255,0.2)';
+
+      row.appendChild(handle);
+      row.appendChild(labelInput);
+      row.appendChild(urlInput);
+      row.appendChild(orderInputEl);
+      row.appendChild(activeLabel);
+      row.appendChild(removeButton);
+
+      removeButton.addEventListener('click', () => {
+        row.remove();
+        updateOrder();
+      });
+
+      menuList.appendChild(row);
+      enableDrag(row);
+      updateOrder();
+    }
+
+    addButton.addEventListener('click', () => {
+      const selected = pageSelect.options[pageSelect.selectedIndex];
+      if (!selected || !selected.value) {
+        return;
+      }
+      if (selected.value === 'custom') {
+        showModal();
+        return;
+      }
+      const label = selected.getAttribute('data-label') || '';
+      const url = selected.getAttribute('data-url') || '';
+      const isActive = activeInput.checked;
+      addStagedLink(label, url, isActive);
+      pageSelect.value = '';
+      activeInput.checked = true;
+    });
+
+    modalAdd.addEventListener('click', () => {
+      const label = modalLabel.value.trim();
+      const url = modalUrl.value.trim();
+      const isActive = modalActive.checked;
+      addStagedLink(label, url, isActive);
+      hideModal();
+    });
+
+    modalCancel.addEventListener('click', hideModal);
+    modal.addEventListener('click', (event) => {
+      if (event.target === modal) {
+        hideModal();
+      }
+    });
+
+    function getDragAfterElement(container, y) {
+      const elements = [...container.querySelectorAll('.nav-item:not(.dragging)')];
+      return elements.reduce((closest, child) => {
+        const box = child.getBoundingClientRect();
+        const offset = y - box.top - box.height / 2;
+        if (offset < 0 && offset > closest.offset) {
+          return { offset, element: child };
+        }
+        return closest;
+      }, { offset: Number.NEGATIVE_INFINITY }).element;
+    }
+
+    function enableDrag(item) {
+      item.addEventListener('dragstart', () => {
+        item.classList.add('dragging');
+      });
+      item.addEventListener('dragend', () => {
+        item.classList.remove('dragging');
+        updateOrder();
+      });
+    }
+
+    menuList.addEventListener('dragover', (event) => {
+      event.preventDefault();
+      const dragging = menuList.querySelector('.dragging');
+      if (!dragging) {
+        return;
+      }
+      const afterElement = getDragAfterElement(menuList, event.clientY);
+      if (afterElement == null) {
+        menuList.appendChild(dragging);
+      } else {
+        menuList.insertBefore(dragging, afterElement);
+      }
+    });
+
+    menuList.querySelectorAll('.nav-item').forEach(enableDrag);
+    updateOrder();
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/admin/views/settings.php

@@ -0,0 +1,682 @@
+<?php
+$pageTitle = 'Settings';
+ob_start();
+?>
+<section class="admin-card settings-shell">
+  <div class="badge">Settings</div>
+  <h1 style="margin-top:16px; font-size:28px;">Site Settings</h1>
+  <p style="color: var(--muted); margin-top:8px;">Configure branding, maintenance, icons, and integrations.</p>
+  <?php if (!empty($status_message ?? '')): ?>
+    <div class="settings-status <?= (($status ?? '') === 'ok') ? 'is-ok' : 'is-error' ?>">
+      <?= htmlspecialchars((string)$status_message, ENT_QUOTES, 'UTF-8') ?>
+    </div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/settings" enctype="multipart/form-data" style="margin-top:20px; display:grid; gap:16px;">
+    <div class="settings-tabs" role="tablist" aria-label="Settings sections">
+      <button type="button" class="settings-tab is-active" data-tab="branding" role="tab" aria-selected="true">Branding</button>
+      <button type="button" class="settings-tab" data-tab="footer" role="tab" aria-selected="false">Footer</button>
+      <button type="button" class="settings-tab" data-tab="maintenance" role="tab" aria-selected="false">Maintenance</button>
+      <button type="button" class="settings-tab" data-tab="icons" role="tab" aria-selected="false">Icons</button>
+      <button type="button" class="settings-tab" data-tab="smtp" role="tab" aria-selected="false">SMTP</button>
+      <button type="button" class="settings-tab" data-tab="mailchimp" role="tab" aria-selected="false">Mailchimp</button>
+      <button type="button" class="settings-tab" data-tab="seo" role="tab" aria-selected="false">SEO</button>
+      <button type="button" class="settings-tab" data-tab="redirects" role="tab" aria-selected="false">Redirects</button>
+      <button type="button" class="settings-tab" data-tab="permissions" role="tab" aria-selected="false">Permissions</button>
+      <button type="button" class="settings-tab" data-tab="audit" role="tab" aria-selected="false">Audit Log</button>
+    </div>
+
+    <div class="settings-panel is-active" data-panel="branding" role="tabpanel">
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Branding</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label class="label">Header Title</label>
+          <input class="input" name="site_header_title" value="<?= htmlspecialchars($site_header_title ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="AudioCore V1.5">
+
+          <label class="label">Header Tagline</label>
+          <input class="input" name="site_header_tagline" value="<?= htmlspecialchars($site_header_tagline ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="Core CMS for DJs & Producers">
+
+          <label class="label">Header Badge Text (right side)</label>
+          <input class="input" name="site_header_badge_text" value="<?= htmlspecialchars($site_header_badge_text ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="Independent catalog">
+
+          <div style="display:grid; grid-template-columns:1fr 1fr; gap:12px;">
+            <div>
+              <label class="label">Header Left Mode</label>
+              <select class="input" name="site_header_brand_mode">
+                <option value="default" <?= (($site_header_brand_mode ?? 'default') === 'default') ? 'selected' : '' ?>>Text + mark</option>
+                <option value="logo_only" <?= (($site_header_brand_mode ?? '') === 'logo_only') ? 'selected' : '' ?>>Logo only</option>
+              </select>
+            </div>
+            <div>
+              <label class="label">Mark Content</label>
+              <select class="input" name="site_header_mark_mode">
+                <option value="text" <?= (($site_header_mark_mode ?? 'text') === 'text') ? 'selected' : '' ?>>Text</option>
+                <option value="icon" <?= (($site_header_mark_mode ?? '') === 'icon') ? 'selected' : '' ?>>Font Awesome icon</option>
+                <option value="logo" <?= (($site_header_mark_mode ?? '') === 'logo') ? 'selected' : '' ?>>Logo in mark</option>
+              </select>
+            </div>
+          </div>
+
+          <div style="display:grid; grid-template-columns:1fr 1fr; gap:12px;">
+            <div>
+              <label class="label">Mark Text</label>
+              <input class="input" name="site_header_mark_text" value="<?= htmlspecialchars($site_header_mark_text ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="AC">
+            </div>
+            <div>
+              <label class="label">Mark Icon Class</label>
+              <input class="input" name="site_header_mark_icon" value="<?= htmlspecialchars($site_header_mark_icon ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="fa-solid fa-music">
+              <div style="font-size:12px; color:var(--muted); margin-top:6px;">Use class only (or paste full &lt;i ...&gt; and it will be normalized).</div>
+            </div>
+          </div>
+
+          <div style="display:grid; grid-template-columns:1fr 1fr; gap:12px;">
+            <div>
+              <label class="label">Mark Gradient Start</label>
+              <input class="input" name="site_header_mark_bg_start" value="<?= htmlspecialchars($site_header_mark_bg_start ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="#22f2a5">
+            </div>
+            <div>
+              <label class="label">Mark Gradient End</label>
+              <input class="input" name="site_header_mark_bg_end" value="<?= htmlspecialchars($site_header_mark_bg_end ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="#10252e">
+            </div>
+          </div>
+
+          <label class="label">Logo URL (for logo-only or mark logo mode)</label>
+          <input class="input" name="site_header_logo_url" value="<?= htmlspecialchars($site_header_logo_url ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="https://example.com/logo.png">
+          <div class="settings-logo-tools">
+            <div class="settings-logo-preview">
+              <?php if (!empty($site_header_logo_url ?? '')): ?>
+                <img src="<?= htmlspecialchars((string)$site_header_logo_url, ENT_QUOTES, 'UTF-8') ?>" alt="">
+              <?php else: ?>
+                <span>No logo set</span>
+              <?php endif; ?>
+            </div>
+            <div class="settings-logo-actions">
+              <button type="button" class="btn outline" id="openLogoMediaPicker">Use from Media</button>
+              <button type="submit" class="btn outline danger" name="settings_action" value="remove_logo">Remove current logo</button>
+            </div>
+          </div>
+          <div class="admin-card" style="padding:12px; margin-top:4px;">
+            <div class="label" style="margin-bottom:8px;">Upload Logo</div>
+            <label class="settings-upload-dropzone" for="headerLogoFile">
+              <input id="headerLogoFile" class="settings-file-input" type="file" name="header_logo_file" accept="image/*,.svg">
+              <div class="settings-upload-text">
+                <div style="font-size:11px; letter-spacing:0.2em; text-transform:uppercase; color:rgba(255,255,255,0.6);">Drag & Drop</div>
+                <div style="font-size:14px; color:var(--text);">or click to upload</div>
+                <div class="settings-file-name" id="headerLogoFileName">No file selected</div>
+              </div>
+            </label>
+            <div style="display:flex; justify-content:flex-end; margin-top:10px;">
+              <button type="submit" class="btn" name="settings_action" value="upload_logo">Upload logo</button>
+            </div>
+          </div>
+
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="footer" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Footer</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label class="label">Footer Text</label>
+          <input class="input" name="footer_text" value="<?= htmlspecialchars($footer_text ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="AudioCore V1.5">
+          <div style="font-size:12px; color:var(--muted);">Shown in the site footer.</div>
+
+          <div class="label">Footer Links</div>
+          <div class="admin-card" style="padding:12px;">
+            <div id="footerLinksList" style="display:grid; gap:8px;"></div>
+            <div style="display:flex; justify-content:space-between; align-items:center; margin-top:10px; gap:8px; flex-wrap:wrap;">
+              <button type="button" class="btn outline" id="addFooterLinkRow">Add footer link</button>
+              <div style="font-size:12px; color:var(--muted);">Examples: Privacy, Terms, Refund Policy.</div>
+            </div>
+          </div>
+          <input type="hidden" name="footer_links_json" id="footerLinksJson" value="">
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="maintenance" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Coming Soon / Maintenance</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label style="display:inline-flex; align-items:center; gap:8px; font-size:13px;">
+            <input type="checkbox" name="site_maintenance_enabled" value="1" <?= (($site_maintenance_enabled ?? '0') === '1') ? 'checked' : '' ?>>
+            Enable maintenance mode for visitors (admins still see full site when logged in)
+          </label>
+          <label class="label">Title</label>
+          <input class="input" name="site_maintenance_title" value="<?= htmlspecialchars($site_maintenance_title ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="Coming Soon">
+          <label class="label">Message</label>
+          <textarea class="input" name="site_maintenance_message" rows="3" style="resize:vertical;"><?= htmlspecialchars($site_maintenance_message ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
+          <div style="display:grid; grid-template-columns:1fr 1fr; gap:12px;">
+            <div>
+              <label class="label">Button Label (optional)</label>
+              <input class="input" name="site_maintenance_button_label" value="<?= htmlspecialchars($site_maintenance_button_label ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="Admin Login">
+            </div>
+            <div>
+              <label class="label">Button URL (optional)</label>
+              <input class="input" name="site_maintenance_button_url" value="<?= htmlspecialchars($site_maintenance_button_url ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="/admin/login">
+            </div>
+          </div>
+          <label class="label">Custom HTML (optional, overrides title/message layout)</label>
+          <textarea class="input" name="site_maintenance_html" rows="6" style="resize:vertical; font-family:'IBM Plex Mono', monospace;"><?= htmlspecialchars($site_maintenance_html ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="icons" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Icons</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label class="label">Font Awesome Pro URL</label>
+          <input class="input" name="fontawesome_pro_url" value="<?= htmlspecialchars($fontawesome_pro_url ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="https://kit.fontawesome.com/your-kit-id.css">
+          <div style="font-size:12px; color:var(--muted);">Use your Pro kit URL to enable duotone icons.</div>
+          <label class="label">Font Awesome URL (Fallback)</label>
+          <input class="input" name="fontawesome_url" value="<?= htmlspecialchars($fontawesome_url ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css">
+          <div style="font-size:12px; color:var(--muted);">Used if Pro URL is empty.</div>
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="smtp" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">SMTP</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label class="label">SMTP Host</label>
+          <input class="input" name="smtp_host" value="<?= htmlspecialchars($smtp_host ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="smtp.example.com">
+          <label class="label">SMTP Port</label>
+          <input class="input" name="smtp_port" value="<?= htmlspecialchars($smtp_port ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="587">
+          <label class="label">SMTP User</label>
+          <input class="input" name="smtp_user" value="<?= htmlspecialchars($smtp_user ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="user@example.com">
+          <label class="label">SMTP Password</label>
+          <input class="input" type="password" name="smtp_pass" value="<?= htmlspecialchars($smtp_pass ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="password">
+          <label class="label">SMTP Encryption</label>
+          <input class="input" name="smtp_encryption" value="<?= htmlspecialchars($smtp_encryption ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="tls">
+          <label class="label">From Email</label>
+          <input class="input" name="smtp_from_email" value="<?= htmlspecialchars($smtp_from_email ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="no-reply@example.com">
+          <label class="label">From Name</label>
+          <input class="input" name="smtp_from_name" value="<?= htmlspecialchars($smtp_from_name ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="AudioCore">
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="mailchimp" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Mailchimp</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label class="label">API Key</label>
+          <input class="input" name="mailchimp_api_key" value="<?= htmlspecialchars($mailchimp_api_key ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="xxxx-us1">
+          <label class="label">List ID</label>
+          <input class="input" name="mailchimp_list_id" value="<?= htmlspecialchars($mailchimp_list_id ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="abcd1234">
+          <div style="font-size:12px; color:var(--muted);">Used for syncing subscriber signups.</div>
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="seo" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Global SEO</div>
+        <div style="margin-top:12px; display:grid; gap:12px;">
+          <label class="label">Title Suffix</label>
+          <input class="input" name="seo_title_suffix" value="<?= htmlspecialchars($seo_title_suffix ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="AudioCore V1.5">
+          <label class="label">Default Meta Description</label>
+          <textarea class="input" name="seo_meta_description" rows="3" style="resize:vertical;"><?= htmlspecialchars($seo_meta_description ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
+          <label class="label">Open Graph Image URL</label>
+          <input class="input" name="seo_og_image" value="<?= htmlspecialchars($seo_og_image ?? '', ENT_QUOTES, 'UTF-8') ?>" placeholder="https://example.com/og-image.jpg">
+          <div style="display:flex; gap:20px; flex-wrap:wrap;">
+            <label style="display:inline-flex; align-items:center; gap:8px; font-size:13px;">
+              <input type="checkbox" name="seo_robots_index" value="1" <?= (($seo_robots_index ?? '1') === '1') ? 'checked' : '' ?>>
+              Allow indexing
+            </label>
+            <label style="display:inline-flex; align-items:center; gap:8px; font-size:13px;">
+              <input type="checkbox" name="seo_robots_follow" value="1" <?= (($seo_robots_follow ?? '1') === '1') ? 'checked' : '' ?>>
+              Allow link following
+            </label>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="redirects" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px; display:grid; gap:12px;">
+        <div class="badge" style="opacity:0.7;">Redirects Manager</div>
+        <div style="font-size:12px; color:var(--muted);">Exact-path redirects. Example source <code>/old-page</code> → target <code>/new-page</code>.</div>
+        <div style="display:grid; gap:10px;">
+          <input class="input" name="redirect_source_path" placeholder="/old-url">
+          <input class="input" name="redirect_target_url" placeholder="/new-url or https://external.site/path">
+          <div style="display:grid; grid-template-columns: 180px 1fr auto; gap:10px; align-items:center;">
+            <select class="input" name="redirect_status_code">
+              <option value="301">301 Permanent</option>
+              <option value="302">302 Temporary</option>
+              <option value="307">307 Temporary</option>
+              <option value="308">308 Permanent</option>
+            </select>
+            <label style="display:inline-flex; align-items:center; gap:8px; font-size:13px;">
+              <input type="checkbox" name="redirect_is_active" value="1" checked>
+              Active
+            </label>
+            <button type="submit" class="btn" name="settings_action" value="save_redirect">Save redirect</button>
+          </div>
+        </div>
+        <div class="admin-card" style="padding:12px;">
+          <div class="badge" style="margin-bottom:8px;">Existing Redirects</div>
+          <?php if (empty($redirects ?? [])): ?>
+            <div style="color:var(--muted); font-size:13px;">No redirects configured.</div>
+          <?php else: ?>
+            <div style="display:grid; gap:8px;">
+              <?php foreach (($redirects ?? []) as $redirect): ?>
+                <div style="display:grid; grid-template-columns:minmax(0,1fr) minmax(0,1fr) auto auto auto; gap:10px; align-items:center; border:1px solid rgba(255,255,255,0.1); border-radius:10px; padding:8px 10px;">
+                  <div style="font-family:'IBM Plex Mono', monospace; font-size:12px;"><?= htmlspecialchars((string)$redirect['source_path'], ENT_QUOTES, 'UTF-8') ?></div>
+                  <div style="font-family:'IBM Plex Mono', monospace; font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)$redirect['target_url'], ENT_QUOTES, 'UTF-8') ?></div>
+                  <div style="font-size:12px; color:var(--muted);"><?= (int)$redirect['status_code'] ?></div>
+                  <div style="font-size:12px; color:<?= ((int)($redirect['is_active'] ?? 0) === 1) ? '#9df6d3' : '#ffb7c2' ?>;"><?= ((int)($redirect['is_active'] ?? 0) === 1) ? 'active' : 'inactive' ?></div>
+                  <button type="submit" class="btn outline danger" name="settings_action" value="delete_redirect" onclick="document.getElementById('redirectDeleteId').value='<?= (int)$redirect['id'] ?>';">Delete</button>
+                </div>
+              <?php endforeach; ?>
+            </div>
+          <?php endif; ?>
+          <input type="hidden" name="redirect_id" id="redirectDeleteId" value="0">
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="permissions" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Role Permissions Matrix</div>
+        <div style="margin-top:10px; font-size:12px; color:var(--muted);">Plugin/module-level restrictions by admin role.</div>
+        <div style="margin-top:12px; overflow:auto;">
+          <table style="width:100%; border-collapse:collapse; min-width:640px;">
+            <thead>
+              <tr style="text-align:left; border-bottom:1px solid rgba(255,255,255,0.12);">
+                <th style="padding:10px 8px; font-size:12px; letter-spacing:0.14em; text-transform:uppercase;">Permission</th>
+                <th style="padding:10px 8px; font-size:12px; letter-spacing:0.14em; text-transform:uppercase;">Admin</th>
+                <th style="padding:10px 8px; font-size:12px; letter-spacing:0.14em; text-transform:uppercase;">Manager</th>
+                <th style="padding:10px 8px; font-size:12px; letter-spacing:0.14em; text-transform:uppercase;">Editor</th>
+              </tr>
+            </thead>
+            <tbody>
+              <?php $currentGroup = ''; ?>
+              <?php foreach (($permission_definitions ?? []) as $permission): ?>
+                <?php
+                  $pKey = (string)($permission['key'] ?? '');
+                  $pLabel = (string)($permission['label'] ?? $pKey);
+                  $pGroup = (string)($permission['group'] ?? 'Other');
+                  $row = $permission_matrix[$pKey] ?? ['admin' => true, 'manager' => false, 'editor' => false];
+                ?>
+                <?php if ($pGroup !== $currentGroup): $currentGroup = $pGroup; ?>
+                  <tr><td colspan="4" style="padding:12px 8px 6px; color:var(--muted); font-size:11px; letter-spacing:0.22em; text-transform:uppercase;"><?= htmlspecialchars($pGroup, ENT_QUOTES, 'UTF-8') ?></td></tr>
+                <?php endif; ?>
+                <tr style="border-bottom:1px solid rgba(255,255,255,0.08);">
+                  <td style="padding:10px 8px;"><?= htmlspecialchars($pLabel, ENT_QUOTES, 'UTF-8') ?></td>
+                  <td style="padding:10px 8px;"><input type="checkbox" name="permissions[<?= htmlspecialchars($pKey, ENT_QUOTES, 'UTF-8') ?>][admin]" value="1" <?= !empty($row['admin']) ? 'checked' : '' ?>></td>
+                  <td style="padding:10px 8px;"><input type="checkbox" name="permissions[<?= htmlspecialchars($pKey, ENT_QUOTES, 'UTF-8') ?>][manager]" value="1" <?= !empty($row['manager']) ? 'checked' : '' ?>></td>
+                  <td style="padding:10px 8px;"><input type="checkbox" name="permissions[<?= htmlspecialchars($pKey, ENT_QUOTES, 'UTF-8') ?>][editor]" value="1" <?= !empty($row['editor']) ? 'checked' : '' ?>></td>
+                </tr>
+              <?php endforeach; ?>
+            </tbody>
+          </table>
+        </div>
+        <div style="margin-top:12px; display:flex; justify-content:flex-end;">
+          <button type="submit" class="btn" name="settings_action" value="save_permissions">Save permissions</button>
+        </div>
+      </div>
+    </div>
+
+    <div class="settings-panel" data-panel="audit" role="tabpanel" hidden>
+      <div class="admin-card" style="padding:16px;">
+        <div class="badge" style="opacity:0.7;">Audit Log</div>
+        <div style="margin-top:10px; max-height:460px; overflow:auto; border:1px solid rgba(255,255,255,0.12); border-radius:12px;">
+          <?php if (empty($audit_logs ?? [])): ?>
+            <div style="padding:12px; color:var(--muted); font-size:13px;">No audit events yet.</div>
+          <?php else: ?>
+            <table style="width:100%; border-collapse:collapse; min-width:820px;">
+              <thead>
+                <tr style="text-align:left; border-bottom:1px solid rgba(255,255,255,0.12);">
+                  <th style="padding:10px 8px;">Time</th>
+                  <th style="padding:10px 8px;">Actor</th>
+                  <th style="padding:10px 8px;">Action</th>
+                  <th style="padding:10px 8px;">IP</th>
+                  <th style="padding:10px 8px;">Context</th>
+                </tr>
+              </thead>
+              <tbody>
+                <?php foreach (($audit_logs ?? []) as $log): ?>
+                  <tr style="border-bottom:1px solid rgba(255,255,255,0.08);">
+                    <td style="padding:9px 8px; font-family:'IBM Plex Mono', monospace; font-size:11px;"><?= htmlspecialchars((string)($log['created_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></td>
+                    <td style="padding:9px 8px;"><?= htmlspecialchars(trim((string)($log['actor_name'] ?? 'System') . ' (' . (string)($log['actor_role'] ?? '-') . ')'), ENT_QUOTES, 'UTF-8') ?></td>
+                    <td style="padding:9px 8px; font-family:'IBM Plex Mono', monospace; font-size:11px;"><?= htmlspecialchars((string)($log['action'] ?? ''), ENT_QUOTES, 'UTF-8') ?></td>
+                    <td style="padding:9px 8px; font-family:'IBM Plex Mono', monospace; font-size:11px;"><?= htmlspecialchars((string)($log['ip_address'] ?? ''), ENT_QUOTES, 'UTF-8') ?></td>
+                    <td style="padding:9px 8px; font-family:'IBM Plex Mono', monospace; font-size:11px; color:var(--muted);"><?= htmlspecialchars((string)($log['context_json'] ?? ''), ENT_QUOTES, 'UTF-8') ?></td>
+                  </tr>
+                <?php endforeach; ?>
+              </tbody>
+            </table>
+          <?php endif; ?>
+        </div>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end;">
+      <button type="submit" class="btn">Save settings</button>
+    </div>
+  </form>
+</section>
+
+<style>
+  .settings-status {
+    margin-top: 14px;
+    border-radius: 12px;
+    padding: 10px 12px;
+    font-size: 13px;
+    border: 1px solid rgba(255,255,255,0.14);
+  }
+  .settings-status.is-ok {
+    border-color: rgba(34,242,165,0.35);
+    color: #baf8e3;
+    background: rgba(34,242,165,0.10);
+  }
+  .settings-status.is-error {
+    border-color: rgba(255,100,120,0.35);
+    color: #ffc9d2;
+    background: rgba(255,100,120,0.10);
+  }
+  .settings-tabs {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    border-bottom: 1px solid rgba(255,255,255,0.08);
+    padding-bottom: 12px;
+  }
+  .settings-tab {
+    height: 34px;
+    padding: 0 14px;
+    border-radius: 999px;
+    border: 1px solid rgba(255,255,255,0.14);
+    background: rgba(255,255,255,0.03);
+    color: var(--muted);
+    text-transform: uppercase;
+    letter-spacing: 0.12em;
+    font-size: 10px;
+    font-family: 'IBM Plex Mono', monospace;
+    cursor: pointer;
+  }
+  .settings-tab.is-active {
+    border-color: rgba(34,242,165,0.4);
+    color: #89f3cc;
+    background: rgba(34,242,165,0.1);
+  }
+  .settings-panel {
+    display: none;
+  }
+  .settings-panel.is-active {
+    display: block;
+  }
+  .settings-upload-dropzone {
+    border: 1px dashed rgba(255,255,255,0.22);
+    border-radius: 12px;
+    min-height: 108px;
+    padding: 12px;
+    display: grid;
+    place-items: center;
+    background: rgba(255,255,255,0.02);
+    cursor: pointer;
+    text-align: center;
+  }
+  .settings-upload-dropzone:hover {
+    border-color: rgba(34,242,165,0.45);
+    background: rgba(34,242,165,0.06);
+  }
+  .settings-logo-tools {
+    display: grid;
+    gap: 10px;
+    margin-top: 8px;
+  }
+  .settings-logo-preview {
+    min-height: 78px;
+    border-radius: 12px;
+    border: 1px solid rgba(255,255,255,0.12);
+    background: rgba(255,255,255,0.02);
+    display: grid;
+    place-items: center;
+    overflow: hidden;
+    padding: 8px;
+  }
+  .settings-logo-preview img {
+    max-height: 62px;
+    max-width: 100%;
+    object-fit: contain;
+    display: block;
+  }
+  .settings-logo-preview span {
+    color: var(--muted);
+    font-size: 12px;
+  }
+  .settings-logo-actions {
+    display: flex;
+    gap: 8px;
+    flex-wrap: wrap;
+  }
+  .settings-media-modal {
+    position: fixed;
+    inset: 0;
+    background: rgba(3,4,8,0.75);
+    z-index: 2000;
+    display: none;
+    align-items: center;
+    justify-content: center;
+    padding: 20px;
+  }
+  .settings-media-modal.is-open {
+    display: flex;
+  }
+  .settings-media-panel {
+    width: min(980px, 100%);
+    max-height: 80vh;
+    overflow: auto;
+    border-radius: 16px;
+    border: 1px solid rgba(255,255,255,0.12);
+    background: #12151f;
+    padding: 16px;
+  }
+  .settings-media-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(140px, 1fr));
+    gap: 10px;
+    margin-top: 12px;
+  }
+  .settings-media-item {
+    border: 1px solid rgba(255,255,255,0.12);
+    border-radius: 10px;
+    overflow: hidden;
+    background: rgba(255,255,255,0.03);
+    cursor: pointer;
+  }
+  .settings-media-item img {
+    width: 100%;
+    height: 104px;
+    object-fit: cover;
+    display: block;
+  }
+  .settings-media-item div {
+    padding: 8px;
+    font-size: 11px;
+    color: var(--muted);
+    word-break: break-word;
+  }
+  .settings-file-input {
+    display: none;
+  }
+  .settings-upload-text {
+    display: grid;
+    gap: 6px;
+  }
+  .settings-file-name {
+    font-size: 12px;
+    color: var(--muted);
+  }
+  @media (max-width: 760px) {
+    .settings-tabs {
+      display: grid;
+      grid-template-columns: 1fr 1fr;
+    }
+    .settings-tab {
+      width: 100%;
+      justify-self: stretch;
+    }
+  }
+</style>
+
+<script>
+  (function () {
+    const tabs = Array.from(document.querySelectorAll('.settings-tab'));
+    const panels = Array.from(document.querySelectorAll('.settings-panel'));
+    if (!tabs.length || !panels.length) return;
+
+    function activate(tabName) {
+      tabs.forEach((tab) => {
+        const isActive = tab.dataset.tab === tabName;
+        tab.classList.toggle('is-active', isActive);
+        tab.setAttribute('aria-selected', isActive ? 'true' : 'false');
+      });
+      panels.forEach((panel) => {
+        const isActive = panel.dataset.panel === tabName;
+        panel.classList.toggle('is-active', isActive);
+        panel.hidden = !isActive;
+      });
+      try { localStorage.setItem('ac_settings_tab', tabName); } catch (e) {}
+    }
+
+    tabs.forEach((tab) => {
+      tab.addEventListener('click', () => activate(tab.dataset.tab));
+    });
+
+    let start = 'branding';
+    try {
+      const saved = localStorage.getItem('ac_settings_tab');
+      if (saved && tabs.some((tab) => tab.dataset.tab === saved)) {
+        start = saved;
+      }
+    } catch (e) {}
+    activate(start);
+  })();
+
+  (function () {
+    const list = document.getElementById('footerLinksList');
+    const hidden = document.getElementById('footerLinksJson');
+    const addBtn = document.getElementById('addFooterLinkRow');
+    if (!list || !hidden || !addBtn) return;
+
+    const initial = <?= json_encode(is_array($footer_links ?? null) ? $footer_links : [], JSON_UNESCAPED_SLASHES) ?>;
+
+    function syncHidden() {
+      const rows = Array.from(list.querySelectorAll('.footer-link-row'));
+      const data = rows.map((row) => ({
+        label: (row.querySelector('input[name=\"footer_link_label[]\"]')?.value || '').trim(),
+        url: (row.querySelector('input[name=\"footer_link_url[]\"]')?.value || '').trim(),
+      })).filter((item) => item.label !== '' && item.url !== '');
+      hidden.value = JSON.stringify(data);
+    }
+
+    function createRow(item) {
+      const row = document.createElement('div');
+      row.className = 'footer-link-row';
+      row.style.display = 'grid';
+      row.style.gridTemplateColumns = '1fr 1fr auto';
+      row.style.gap = '8px';
+      row.innerHTML = '' +
+        '<input class=\"input\" name=\"footer_link_label[]\" placeholder=\"Label\" value=\"' + (item.label || '').replace(/\"/g, '&quot;') + '\">' +
+        '<input class=\"input\" name=\"footer_link_url[]\" placeholder=\"/privacy\" value=\"' + (item.url || '').replace(/\"/g, '&quot;') + '\">' +
+        '<button type=\"button\" class=\"btn outline danger\">Remove</button>';
+      row.querySelectorAll('input').forEach((inp) => inp.addEventListener('input', syncHidden));
+      row.querySelector('button').addEventListener('click', () => {
+        row.remove();
+        syncHidden();
+      });
+      return row;
+    }
+
+    if (initial.length) {
+      initial.forEach((item) => list.appendChild(createRow(item)));
+    } else {
+      list.appendChild(createRow({ label: '', url: '' }));
+    }
+    syncHidden();
+
+    addBtn.addEventListener('click', () => {
+      list.appendChild(createRow({ label: '', url: '' }));
+      syncHidden();
+    });
+
+    document.querySelector('form[action=\"/admin/settings\"]')?.addEventListener('submit', syncHidden);
+  })();
+
+  (function () {
+    const input = document.getElementById('headerLogoFile');
+    const label = document.getElementById('headerLogoFileName');
+    if (!input || !label) return;
+    input.addEventListener('change', function () {
+      const file = input.files && input.files.length ? input.files[0].name : 'No file selected';
+      label.textContent = file;
+    });
+  })();
+
+  (function () {
+    const openBtn = document.getElementById('openLogoMediaPicker');
+    const logoInput = document.querySelector('input[name="site_header_logo_url"]');
+    if (!openBtn || !logoInput) return;
+
+    const modal = document.createElement('div');
+    modal.className = 'settings-media-modal';
+    modal.innerHTML = '' +
+      '<div class="settings-media-panel">' +
+      '  <div style="display:flex; justify-content:space-between; align-items:center; gap:10px;">' +
+      '    <div class="badge">Media Library</div>' +
+      '    <button type="button" class="btn outline" id="closeLogoMediaPicker">Close</button>' +
+      '  </div>' +
+      '  <div id="settingsMediaList" class="settings-media-grid"></div>' +
+      '</div>';
+    document.body.appendChild(modal);
+
+    const list = modal.querySelector('#settingsMediaList');
+    const closeBtn = modal.querySelector('#closeLogoMediaPicker');
+
+    function closeModal() { modal.classList.remove('is-open'); }
+    closeBtn.addEventListener('click', closeModal);
+    modal.addEventListener('click', (e) => { if (e.target === modal) closeModal(); });
+
+    openBtn.addEventListener('click', async function () {
+      modal.classList.add('is-open');
+      list.innerHTML = '<div style="color:var(--muted);">Loading media...</div>';
+      try {
+        const res = await fetch('/admin/media/picker', { credentials: 'same-origin' });
+        const data = await res.json();
+        const items = Array.isArray(data.items) ? data.items : [];
+        if (!items.length) {
+          list.innerHTML = '<div style="color:var(--muted);">No media found.</div>';
+          return;
+        }
+        list.innerHTML = '';
+        items.forEach((item) => {
+          const url = (item.file_url || '').toString();
+          const type = (item.file_type || '').toString().toLowerCase();
+          const isImage = type.startsWith('image/');
+          const node = document.createElement('button');
+          node.type = 'button';
+          node.className = 'settings-media-item';
+          node.innerHTML = isImage
+            ? '<img src="' + url.replace(/"/g, '&quot;') + '" alt="">' + '<div>' + (item.file_name || url) + '</div>'
+            : '<div style="height:104px;display:grid;place-items:center;">' + (item.file_type || 'FILE') + '</div><div>' + (item.file_name || url) + '</div>';
+          node.addEventListener('click', () => {
+            logoInput.value = url;
+            closeModal();
+          });
+          list.appendChild(node);
+        });
+      } catch (err) {
+        list.innerHTML = '<div style="color:#ffb7c2;">Failed to load media picker.</div>';
+      }
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/admin/views/shortcodes.php

@@ -0,0 +1,114 @@
+<?php
+$pageTitle = 'Shortcodes';
+$codes = is_array($codes ?? null) ? $codes : [];
+$enabledCodes = array_values(array_filter($codes, static fn(array $c): bool => !empty($c['enabled'])));
+$disabledCodes = array_values(array_filter($codes, static fn(array $c): bool => empty($c['enabled'])));
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Content</div>
+  <div style="display:flex; align-items:flex-end; justify-content:space-between; gap:14px; margin-top:14px;">
+    <div>
+      <h1 style="margin:0; font-size:30px;">Shortcodes</h1>
+      <p style="margin:8px 0 0; color:var(--muted);">Use these in page HTML to render dynamic blocks from modules/plugins.</p>
+    </div>
+    <a href="/admin/pages" class="btn outline">Back to pages</a>
+  </div>
+
+  <div style="display:grid; gap:16px; margin-top:18px;">
+    <article class="admin-card" style="padding:14px; border-radius:14px;">
+      <div class="label" style="font-size:11px;">Active Shortcodes</div>
+      <?php if (!$enabledCodes): ?>
+        <div style="margin-top:10px; color:var(--muted); font-size:13px;">No active shortcodes found.</div>
+      <?php else: ?>
+        <div style="display:grid; gap:12px; margin-top:10px;">
+          <?php foreach ($enabledCodes as $code): ?>
+            <article class="admin-card" style="padding:14px; border-radius:12px; box-shadow:none;">
+              <div style="display:flex; flex-wrap:wrap; gap:8px; align-items:center; justify-content:space-between;">
+                <div style="font-family:'IBM Plex Mono', monospace; font-size:13px; letter-spacing:0.08em;">
+                  <?= htmlspecialchars((string)($code['tag'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+                </div>
+                <span class="pill" style="padding:5px 10px; font-size:10px; letter-spacing:0.14em; border-color:rgba(115,255,198,0.4); color:#9ff8d8;">Enabled</span>
+              </div>
+              <div style="margin-top:8px; color:var(--muted); font-size:13px;">
+                <?= htmlspecialchars((string)($code['description'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+              </div>
+              <div style="margin-top:10px; display:grid; grid-template-columns:1fr auto; gap:10px; align-items:center;">
+                <code style="padding:9px 11px; border-radius:10px; border:1px solid rgba(255,255,255,0.12); background:rgba(255,255,255,0.03); font-family:'IBM Plex Mono', monospace; font-size:12px; overflow:auto; white-space:nowrap;">
+                  <?= htmlspecialchars((string)($code['example'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+                </code>
+                <div style="display:flex; gap:8px; align-items:center;">
+                  <button class="btn outline previewShortcodeBtn" type="button" data-code="<?= htmlspecialchars((string)($code['example'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">Preview</button>
+                  <button class="btn outline" type="button" onclick="navigator.clipboard.writeText('<?= htmlspecialchars((string)($code['example'] ?? ''), ENT_QUOTES, 'UTF-8') ?>')">Copy</button>
+                </div>
+              </div>
+              <div style="margin-top:8px; font-size:12px; color:var(--muted);">Source: <?= htmlspecialchars((string)($code['source'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+            </article>
+          <?php endforeach; ?>
+        </div>
+      <?php endif; ?>
+    </article>
+
+    <?php if ($disabledCodes): ?>
+      <article class="admin-card" style="padding:14px; border-radius:14px;">
+        <div class="label" style="font-size:11px;">Disabled (plugin/module unavailable)</div>
+        <div style="display:grid; gap:10px; margin-top:10px;">
+          <?php foreach ($disabledCodes as $code): ?>
+            <div style="padding:10px 12px; border:1px dashed rgba(255,255,255,0.16); border-radius:10px; color:var(--muted); font-size:13px; display:flex; align-items:center; justify-content:space-between; gap:10px;">
+              <span style="font-family:'IBM Plex Mono', monospace; font-size:12px; color:#b7bcc8;"><?= htmlspecialchars((string)($code['tag'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+              <span style="font-size:12px; color:#ffbecc;"><?= htmlspecialchars((string)($code['source'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+            </div>
+          <?php endforeach; ?>
+        </div>
+      </article>
+    <?php endif; ?>
+  </div>
+</section>
+
+<div id="shortcodePreviewModal" style="position:fixed;inset:0;background:rgba(2,3,8,0.72);display:none;align-items:center;justify-content:center;z-index:4000;padding:18px;">
+  <div style="width:min(1100px,100%);height:min(760px,85vh);border-radius:16px;border:1px solid rgba(255,255,255,0.14);background:#11141c;display:grid;grid-template-rows:auto 1fr;overflow:hidden;">
+    <div style="display:flex;align-items:center;justify-content:space-between;gap:10px;padding:10px 12px;border-bottom:1px solid rgba(255,255,255,0.12);">
+      <div class="badge">Shortcode Preview</div>
+      <div style="display:flex;gap:8px;align-items:center;">
+        <a href="#" id="shortcodePreviewPopout" target="_blank" class="btn outline">Popout</a>
+        <button type="button" id="shortcodePreviewClose" class="btn outline">Close</button>
+      </div>
+    </div>
+    <iframe id="shortcodePreviewFrame" src="about:blank" style="width:100%;height:100%;border:0;background:#0d1016;"></iframe>
+  </div>
+</div>
+
+<script>
+  (function () {
+    const modal = document.getElementById('shortcodePreviewModal');
+    const frame = document.getElementById('shortcodePreviewFrame');
+    const popout = document.getElementById('shortcodePreviewPopout');
+    const closeBtn = document.getElementById('shortcodePreviewClose');
+    const buttons = Array.from(document.querySelectorAll('.previewShortcodeBtn'));
+    if (!modal || !frame || !popout || !closeBtn || !buttons.length) return;
+
+    function closeModal() {
+      modal.style.display = 'none';
+      frame.src = 'about:blank';
+      popout.href = '#';
+    }
+
+    closeBtn.addEventListener('click', closeModal);
+    modal.addEventListener('click', function (e) {
+      if (e.target === modal) closeModal();
+    });
+
+    buttons.forEach((btn) => {
+      btn.addEventListener('click', function () {
+        const code = btn.getAttribute('data-code') || '';
+        const url = '/admin/shortcodes/preview?code=' + encodeURIComponent(code);
+        frame.src = url;
+        popout.href = url;
+        modal.style.display = 'flex';
+      });
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/admin/views/updates.php

@@ -0,0 +1,90 @@
+<?php
+$pageTitle = 'Updates';
+$status = is_array($status ?? null) ? $status : [];
+$channel = (string)($channel ?? 'stable');
+$message = (string)($message ?? '');
+$messageType = (string)($message_type ?? '');
+
+ob_start();
+?>
+<section class="admin-card" style="display:grid; gap:18px;">
+  <div class="badge">System</div>
+  <div style="display:flex; align-items:flex-start; justify-content:space-between; gap:16px; flex-wrap:wrap;">
+    <div>
+      <h1 style="margin:0; font-size:42px; line-height:1;">Updates</h1>
+      <p style="margin:10px 0 0; color:var(--muted);">Check for new AudioCore releases from your Gitea manifest.</p>
+    </div>
+    <form method="post" action="/admin/updates">
+      <input type="hidden" name="updates_action" value="check_now">
+      <button class="btn" type="submit">Check Now</button>
+    </form>
+  </div>
+
+  <?php if ($message !== ''): ?>
+    <div style="padding:12px 14px; border-radius:12px; border:1px solid <?= $messageType === 'error' ? 'rgba(255,124,124,.45)' : 'rgba(57,244,179,.45)' ?>; background:<?= $messageType === 'error' ? 'rgba(180,40,40,.18)' : 'rgba(10,90,60,.22)' ?>;">
+      <?= htmlspecialchars($message, ENT_QUOTES, 'UTF-8') ?>
+    </div>
+  <?php endif; ?>
+
+  <div class="admin-card" style="padding:16px; background:rgba(255,255,255,.03); box-shadow:none;">
+    <div style="display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:12px;">
+      <div>
+        <div class="badge" style="margin-bottom:6px;">Installed</div>
+        <div style="font-size:26px; font-weight:700;"><?= htmlspecialchars((string)($status['current_version'] ?? '0.0.0'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+      <div>
+        <div class="badge" style="margin-bottom:6px;">Latest</div>
+        <div style="font-size:26px; font-weight:700;"><?= htmlspecialchars((string)($status['latest_version'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+      <div>
+        <div class="badge" style="margin-bottom:6px;">Status</div>
+        <?php if (!empty($status['ok']) && !empty($status['update_available'])): ?>
+          <div style="font-size:20px; font-weight:700; color:#9ff8d8;">Update available</div>
+        <?php elseif (!empty($status['ok'])): ?>
+          <div style="font-size:20px; font-weight:700; color:#9ff8d8;">Up to date</div>
+        <?php else: ?>
+          <div style="font-size:20px; font-weight:700; color:#ffb7b7;">Check failed</div>
+        <?php endif; ?>
+      </div>
+      <div>
+        <div class="badge" style="margin-bottom:6px;">Channel</div>
+        <div style="font-size:18px; font-weight:700; text-transform:uppercase;"><?= htmlspecialchars((string)($status['channel'] ?? 'stable'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+    </div>
+    <?php if (!empty($status['error'])): ?>
+      <div style="margin-top:12px; color:#ffb7b7;"><?= htmlspecialchars((string)$status['error'], ENT_QUOTES, 'UTF-8') ?></div>
+    <?php endif; ?>
+    <div style="margin-top:10px; color:var(--muted); font-size:13px;">
+      Last checked: <?= htmlspecialchars((string)($status['checked_at'] ?? 'never'), ENT_QUOTES, 'UTF-8') ?>
+    </div>
+    <?php if (!empty($status['changelog_url'])): ?>
+      <div style="margin-top:8px;">
+        <a href="<?= htmlspecialchars((string)$status['changelog_url'], ENT_QUOTES, 'UTF-8') ?>" target="_blank" rel="noopener" style="color:#9ff8d8;">View changelog</a>
+      </div>
+    <?php endif; ?>
+  </div>
+
+  <form method="post" action="/admin/updates" class="admin-card" style="padding:16px; background:rgba(255,255,255,.03); box-shadow:none; display:grid; gap:12px;">
+    <input type="hidden" name="updates_action" value="save_config">
+    <div class="badge">Update Source</div>
+    <div style="display:grid; grid-template-columns:1fr 1fr; gap:12px;">
+      <label style="display:grid; gap:6px;">
+        <span class="label">Channel</span>
+        <select class="input" name="update_channel">
+          <option value="stable" <?= $channel === 'stable' ? 'selected' : '' ?>>Stable</option>
+          <option value="beta" <?= $channel === 'beta' ? 'selected' : '' ?>>Beta</option>
+        </select>
+      </label>
+      <label style="display:grid; gap:6px;">
+        <span class="label">Manifest Source</span>
+        <input class="input" type="text" value="<?= htmlspecialchars((string)($status['manifest_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" readonly>
+      </label>
+    </div>
+    <div style="display:flex; justify-content:flex-end;">
+      <button class="btn" type="submit">Save Update Settings</button>
+    </div>
+  </form>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/layout.php';

modules/artists/ArtistsController.php

@@ -0,0 +1,31 @@
+<?php
+declare(strict_types=1);
+
+namespace Modules\Artists;
+
+use Core\Http\Response;
+use Core\Views\View;
+
+class ArtistsController
+{
+    private View $view;
+
+    public function __construct()
+    {
+        $this->view = new View(__DIR__ . '/views');
+    }
+
+    public function index(): Response
+    {
+        return new Response($this->view->render('site/index.php', [
+            'title' => 'Artists',
+        ]));
+    }
+
+    public function show(): Response
+    {
+        return new Response($this->view->render('site/show.php', [
+            'title' => 'Artist Profile',
+        ]));
+    }
+}

modules/artists/module.php

@@ -0,0 +1,13 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Modules\Artists\ArtistsController;
+
+require_once __DIR__ . '/ArtistsController.php';
+
+return function (Router $router): void {
+    $controller = new ArtistsController();
+    $router->get('/artists', [$controller, 'index']);
+    $router->get('/artist', [$controller, 'show']);
+};

modules/artists/views/site/index.php

@@ -0,0 +1,12 @@
+<?php
+$pageTitle = 'Artists';
+ob_start();
+?>
+<section class="card">
+  <div class="badge">Artists</div>
+  <h1 style="margin-top:16px; font-size:28px;">Artists</h1>
+  <p style="color:var(--muted);">Artist module placeholder.</p>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../views/site/layout.php';

modules/artists/views/site/show.php

@@ -0,0 +1,12 @@
+<?php
+$pageTitle = 'Artist';
+ob_start();
+?>
+<section class="card">
+  <div class="badge">Artist</div>
+  <h1 style="margin-top:16px; font-size:28px;">Artist profile</h1>
+  <p style="color:var(--muted);">Artist profile placeholder.</p>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../views/site/layout.php';

modules/blog/BlogController.php

@@ -0,0 +1,316 @@
+<?php
+declare(strict_types=1);
+
+namespace Modules\Blog;
+
+use Core\Http\Response;
+use Core\Services\Auth;
+use Core\Services\Database;
+use Core\Views\View;
+use DateTime;
+use PDO;
+use Throwable;
+
+class BlogController
+{
+    private View $view;
+
+    public function __construct()
+    {
+        $this->view = new View(__DIR__ . '/views');
+    }
+
+    public function index(): Response
+    {
+        $db = Database::get();
+        $posts = [];
+        $page = null;
+        if ($db instanceof PDO) {
+            $pageStmt = $db->prepare("SELECT title, content_html FROM ac_pages WHERE is_blog_index = 1 AND is_published = 1 LIMIT 1");
+            $pageStmt->execute();
+            $page = $pageStmt->fetch(PDO::FETCH_ASSOC) ?: null;
+
+            $stmt = $db->prepare("
+                SELECT title, slug, excerpt, published_at, featured_image_url, author_name, category, tags
+                FROM ac_posts
+                WHERE is_published = 1
+                ORDER BY COALESCE(published_at, created_at) DESC
+            ");
+            $stmt->execute();
+            $posts = $stmt->fetchAll(PDO::FETCH_ASSOC);
+        }
+        return new Response($this->view->render('site/index.php', [
+            'title' => 'News',
+            'posts' => $posts,
+            'page' => $page,
+        ]));
+    }
+
+    public function show(): Response
+    {
+        $slug = trim((string)($_GET['slug'] ?? ''));
+        if ($slug === '') {
+            return $this->notFound();
+        }
+
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return $this->notFound();
+        }
+
+        $stmt = $db->prepare("
+            SELECT title, content_html, published_at, featured_image_url, author_name, category, tags
+            FROM ac_posts
+            WHERE slug = :slug AND is_published = 1
+            LIMIT 1
+        ");
+        $stmt->execute([':slug' => $slug]);
+        $post = $stmt->fetch(PDO::FETCH_ASSOC);
+        if (!$post) {
+            return $this->notFound();
+        }
+
+        return new Response($this->view->render('site/show.php', [
+            'title' => (string)$post['title'],
+            'content_html' => (string)$post['content_html'],
+            'published_at' => (string)($post['published_at'] ?? ''),
+            'featured_image_url' => (string)($post['featured_image_url'] ?? ''),
+            'author_name' => (string)($post['author_name'] ?? ''),
+            'category' => (string)($post['category'] ?? ''),
+            'tags' => (string)($post['tags'] ?? ''),
+        ]));
+    }
+
+    public function adminIndex(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        $posts = [];
+        if ($db instanceof PDO) {
+            $stmt = $db->query("SELECT id, title, slug, author_name, is_published, published_at, updated_at FROM ac_posts ORDER BY updated_at DESC");
+            $posts = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+        }
+        return new Response($this->view->render('admin/index.php', [
+            'title' => 'Posts',
+            'posts' => $posts,
+        ]));
+    }
+
+    public function adminEdit(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
+        $post = [
+            'id' => 0,
+            'title' => '',
+            'slug' => '',
+            'excerpt' => '',
+            'featured_image_url' => '',
+            'author_name' => '',
+            'category' => '',
+            'tags' => '',
+            'content_html' => '',
+            'is_published' => 0,
+            'published_at' => '',
+        ];
+
+        $db = Database::get();
+        if ($id > 0 && $db instanceof PDO) {
+            $stmt = $db->prepare("SELECT * FROM ac_posts WHERE id = :id LIMIT 1");
+            $stmt->execute([':id' => $id]);
+            $row = $stmt->fetch(PDO::FETCH_ASSOC);
+            if ($row) {
+                $post = $row;
+            }
+        }
+
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Post' : 'New Post',
+            'post' => $post,
+            'error' => '',
+        ]));
+    }
+
+    public function adminSave(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/posts']);
+        }
+
+        $id = (int)($_POST['id'] ?? 0);
+        $title = trim((string)($_POST['title'] ?? ''));
+        $slug = trim((string)($_POST['slug'] ?? ''));
+        $excerpt = trim((string)($_POST['excerpt'] ?? ''));
+        $featuredImage = trim((string)($_POST['featured_image_url'] ?? ''));
+        $authorName = trim((string)($_POST['author_name'] ?? ''));
+        $category = trim((string)($_POST['category'] ?? ''));
+        $tags = trim((string)($_POST['tags'] ?? ''));
+        $content = (string)($_POST['content_html'] ?? '');
+        $isPublished = isset($_POST['is_published']) ? 1 : 0;
+        $publishedAt = trim((string)($_POST['published_at'] ?? ''));
+
+        if ($title === '') {
+            return $this->renderEditError($id, $title, $slug, $excerpt, $featuredImage, $authorName, $category, $tags, $content, $isPublished, $publishedAt, 'Title is required.');
+        }
+
+        if ($slug === '') {
+            $slug = $this->slugify($title);
+        } else {
+            $slug = $this->slugify($slug);
+        }
+
+        if ($publishedAt !== '') {
+            try {
+                $dt = new DateTime($publishedAt);
+                $publishedAt = $dt->format('Y-m-d H:i:s');
+            } catch (Throwable $e) {
+                $publishedAt = '';
+            }
+        }
+
+        try {
+            if ($id > 0) {
+                $chk = $db->prepare("SELECT id FROM ac_posts WHERE slug = :slug AND id != :id LIMIT 1");
+                $chk->execute([':slug' => $slug, ':id' => $id]);
+            } else {
+                $chk = $db->prepare("SELECT id FROM ac_posts WHERE slug = :slug LIMIT 1");
+                $chk->execute([':slug' => $slug]);
+            }
+            if ($chk->fetch()) {
+                return $this->renderEditError($id, $title, $slug, $excerpt, $featuredImage, $authorName, $category, $tags, $content, $isPublished, $publishedAt, 'Slug already exists.');
+            }
+
+            if ($id > 0) {
+                $stmt = $db->prepare("
+                    UPDATE ac_posts
+                    SET title = :title, slug = :slug, excerpt = :excerpt,
+                        featured_image_url = :featured_image_url, author_name = :author_name,
+                        category = :category, tags = :tags, content_html = :content,
+                        is_published = :published, published_at = :published_at
+                    WHERE id = :id
+                ");
+                $stmt->execute([
+                    ':title' => $title,
+                    ':slug' => $slug,
+                    ':excerpt' => $excerpt !== '' ? $excerpt : null,
+                    ':featured_image_url' => $featuredImage !== '' ? $featuredImage : null,
+                    ':author_name' => $authorName !== '' ? $authorName : null,
+                    ':category' => $category !== '' ? $category : null,
+                    ':tags' => $tags !== '' ? $tags : null,
+                    ':content' => $content,
+                    ':published' => $isPublished,
+                    ':published_at' => $publishedAt !== '' ? $publishedAt : null,
+                    ':id' => $id,
+                ]);
+            } else {
+                $stmt = $db->prepare("
+                    INSERT INTO ac_posts (title, slug, excerpt, featured_image_url, author_name, category, tags, content_html, is_published, published_at)
+                    VALUES (:title, :slug, :excerpt, :featured_image_url, :author_name, :category, :tags, :content, :published, :published_at)
+                ");
+                $stmt->execute([
+                    ':title' => $title,
+                    ':slug' => $slug,
+                    ':excerpt' => $excerpt !== '' ? $excerpt : null,
+                    ':featured_image_url' => $featuredImage !== '' ? $featuredImage : null,
+                    ':author_name' => $authorName !== '' ? $authorName : null,
+                    ':category' => $category !== '' ? $category : null,
+                    ':tags' => $tags !== '' ? $tags : null,
+                    ':content' => $content,
+                    ':published' => $isPublished,
+                    ':published_at' => $publishedAt !== '' ? $publishedAt : null,
+                ]);
+            }
+        } catch (Throwable $e) {
+            return $this->renderEditError($id, $title, $slug, $excerpt, $featuredImage, $authorName, $category, $tags, $content, $isPublished, $publishedAt, 'Unable to save post.');
+        }
+
+        return new Response('', 302, ['Location' => '/admin/posts']);
+    }
+
+    public function adminDelete(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/posts']);
+        }
+        $id = (int)($_POST['id'] ?? 0);
+        if ($id > 0) {
+            $stmt = $db->prepare("DELETE FROM ac_posts WHERE id = :id");
+            $stmt->execute([':id' => $id]);
+        }
+        return new Response('', 302, ['Location' => '/admin/posts']);
+    }
+
+    private function renderEditError(
+        int $id,
+        string $title,
+        string $slug,
+        string $excerpt,
+        string $featuredImage,
+        string $authorName,
+        string $category,
+        string $tags,
+        string $content,
+        int $isPublished,
+        string $publishedAt,
+        string $error
+    ): Response {
+        $post = [
+            'id' => $id,
+            'title' => $title,
+            'slug' => $slug,
+            'excerpt' => $excerpt,
+            'featured_image_url' => $featuredImage,
+            'author_name' => $authorName,
+            'category' => $category,
+            'tags' => $tags,
+            'content_html' => $content,
+            'is_published' => $isPublished,
+            'published_at' => $publishedAt,
+        ];
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Post' : 'New Post',
+            'post' => $post,
+            'error' => $error,
+        ]));
+    }
+
+    private function notFound(): Response
+    {
+        $view = new View();
+        return new Response($view->render('site/404.php', [
+            'title' => 'Not Found',
+            'message' => 'Post not found.',
+        ]), 404);
+    }
+
+    private function slugify(string $value): string
+    {
+        $value = strtolower(trim($value));
+        $value = preg_replace('~[^a-z0-9]+~', '-', $value) ?? $value;
+        $value = trim($value, '-');
+        return $value !== '' ? $value : 'post';
+    }
+
+    private function guard(array $roles): ?Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole($roles)) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        return null;
+    }
+}

modules/blog/module.php

@@ -0,0 +1,19 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Modules\Blog\BlogController;
+
+require_once __DIR__ . '/BlogController.php';
+
+return function (Router $router): void {
+    $controller = new BlogController();
+    $router->get('/news', [$controller, 'index']);
+    $router->get('/news/post', [$controller, 'show']);
+
+    $router->get('/admin/posts', [$controller, 'adminIndex']);
+    $router->get('/admin/posts/new', [$controller, 'adminEdit']);
+    $router->get('/admin/posts/edit', [$controller, 'adminEdit']);
+    $router->post('/admin/posts/save', [$controller, 'adminSave']);
+    $router->post('/admin/posts/delete', [$controller, 'adminDelete']);
+};

modules/blog/views/admin/edit.php

@@ -0,0 +1,67 @@
+<?php
+$pageTitle = $title ?? 'Edit Post';
+$post = $post ?? [];
+$error = $error ?? '';
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Blog</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;"><?= htmlspecialchars($pageTitle, ENT_QUOTES, 'UTF-8') ?></h1>
+      <p style="color: var(--muted); margin-top:6px;">Write a news post or update.</p>
+    </div>
+    <a href="/admin/posts" class="btn outline">Back</a>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/posts/save" style="margin-top:18px; display:grid; gap:16px;">
+    <input type="hidden" name="id" value="<?= (int)($post['id'] ?? 0) ?>">
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Title</label>
+        <input class="input" name="title" value="<?= htmlspecialchars((string)($post['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Post title">
+        <label class="label">Slug</label>
+        <input class="input" name="slug" value="<?= htmlspecialchars((string)($post['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="post-title">
+        <label class="label">Excerpt</label>
+        <textarea class="input" name="excerpt" rows="3" style="resize:vertical;"><?= htmlspecialchars((string)($post['excerpt'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <label class="label">Featured Image URL</label>
+        <input class="input" name="featured_image_url" value="<?= htmlspecialchars((string)($post['featured_image_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="https://example.com/cover.jpg">
+        <label class="label">Author</label>
+        <input class="input" name="author_name" value="<?= htmlspecialchars((string)($post['author_name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="AudioCore Team">
+        <label class="label">Category</label>
+        <input class="input" name="category" value="<?= htmlspecialchars((string)($post['category'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="News">
+        <label class="label">Tags (comma separated)</label>
+        <input class="input" name="tags" value="<?= htmlspecialchars((string)($post['tags'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="release, label, update">
+        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px;">
+          <label class="label" style="margin:0;">Content (HTML)</label>
+          <button type="button" class="btn outline small" data-media-picker="blog_content_html">Insert Media</button>
+        </div>
+        <textarea class="input" id="blog_content_html" name="content_html" rows="16" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:13px; line-height:1.6;"><?= htmlspecialchars((string)($post['content_html'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <label class="label">Published At</label>
+        <input class="input" name="published_at" value="<?= htmlspecialchars((string)($post['published_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="2026-01-25 18:30:00">
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="is_published" value="1" <?= ((int)($post['is_published'] ?? 0) === 1) ? 'checked' : '' ?>>
+          Published
+        </label>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end; gap:12px; align-items:center;">
+      <button type="submit" class="btn">Save post</button>
+    </div>
+  </form>
+
+  <?php if (!empty($post['id'])): ?>
+    <form method="post" action="/admin/posts/delete" onsubmit="return confirm('Delete this post?');" style="margin-top:12px;">
+      <input type="hidden" name="id" value="<?= (int)($post['id'] ?? 0) ?>">
+      <button type="submit" class="btn outline">Delete</button>
+    </form>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/blog/views/admin/index.php

@@ -0,0 +1,54 @@
+<?php
+$pageTitle = 'Posts';
+$posts = $posts ?? [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Blog</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Posts</h1>
+      <p style="color: var(--muted); margin-top:6px;">Publish news updates and announcements.</p>
+    </div>
+    <a href="/admin/posts/new" class="btn small">New Post</a>
+  </div>
+
+  <div style="margin-top:18px; display:grid; gap:10px;">
+    <div style="display:grid; grid-template-columns: 2fr 1fr 140px 140px 160px 120px; gap:12px; font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+      <div>Title</div>
+      <div>Slug</div>
+      <div>Author</div>
+      <div>Status</div>
+      <div>Published</div>
+      <div>Actions</div>
+    </div>
+    <?php if (!$posts): ?>
+      <div style="color: var(--muted); font-size:13px;">No posts yet.</div>
+    <?php else: ?>
+      <?php foreach ($posts as $post): ?>
+        <div style="display:grid; grid-template-columns: 2fr 1fr 140px 140px 160px 120px; gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+          <div style="font-weight:600;"><?= htmlspecialchars((string)($post['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:var(--muted); font-family: 'IBM Plex Mono', monospace;">
+            <?= htmlspecialchars((string)($post['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <div style="font-size:12px; color:var(--muted);">
+            <?= htmlspecialchars((string)($post['author_name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <div style="font-size:12px; color:<?= ((int)($post['is_published'] ?? 0) === 1) ? 'var(--accent-2)' : 'var(--muted)' ?>;">
+            <?= ((int)($post['is_published'] ?? 0) === 1) ? 'Published' : 'Draft' ?>
+          </div>
+          <div style="font-size:12px; color:var(--muted);">
+            <?= htmlspecialchars((string)($post['published_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <div style="display:flex; gap:8px;">
+            <a href="/admin/posts/edit?id=<?= (int)$post['id'] ?>" class="btn outline small">Edit</a>
+            <a href="/news/<?= htmlspecialchars((string)($post['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" class="btn outline small">View</a>
+          </div>
+        </div>
+      <?php endforeach; ?>
+    <?php endif; ?>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/blog/views/site/index.php

@@ -0,0 +1,61 @@
+<?php
+$pageTitle = $title ?? 'News';
+$posts = $posts ?? [];
+$page = $page ?? null;
+ob_start();
+?>
+<section class="card">
+  <div class="badge">News</div>
+  <?php if ($page && !empty($page['content_html'])): ?>
+    <div style="margin-top:12px; color:var(--muted); line-height:1.7;">
+      <?= (string)$page['content_html'] ?>
+    </div>
+  <?php else: ?>
+    <h1 style="margin-top:12px; font-size:30px;">Latest Updates</h1>
+    <p style="color:var(--muted); margin-top:8px;">News, updates, and announcements.</p>
+  <?php endif; ?>
+
+  <div style="margin-top:18px; display:grid; gap:12px;">
+    <?php if (!$posts): ?>
+      <div style="color:var(--muted);">No posts yet.</div>
+    <?php else: ?>
+      <?php foreach ($posts as $post): ?>
+        <article style="padding:14px 16px; border-radius:16px; border:1px solid rgba(255,255,255,0.12); background: rgba(0,0,0,0.25);">
+          <div style="font-size:11px; text-transform:uppercase; letter-spacing:0.28em; color:var(--muted);">Post</div>
+          <h2 style="margin:8px 0 6px; font-size:22px;"><?= htmlspecialchars((string)($post['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?></h2>
+          <?php if (!empty($post['featured_image_url'])): ?>
+            <img src="<?= htmlspecialchars((string)$post['featured_image_url'], ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; border-radius:12px; margin:10px 0;">
+          <?php endif; ?>
+          <?php if (!empty($post['published_at'])): ?>
+            <div style="font-size:12px; color:var(--muted); margin-bottom:8px;"><?= htmlspecialchars((string)$post['published_at'], ENT_QUOTES, 'UTF-8') ?></div>
+          <?php endif; ?>
+          <div style="font-size:12px; color:var(--muted); margin-bottom:8px;">
+            <?php if (!empty($post['author_name'])): ?>
+              <?= htmlspecialchars((string)$post['author_name'], ENT_QUOTES, 'UTF-8') ?>
+            <?php endif; ?>
+            <?php if (!empty($post['category'])): ?>
+              <?php if (!empty($post['author_name'])): ?> &middot; <?php endif; ?>
+              <?= htmlspecialchars((string)$post['category'], ENT_QUOTES, 'UTF-8') ?>
+            <?php endif; ?>
+          </div>
+          <p style="color:var(--muted); line-height:1.6;">
+            <?= htmlspecialchars((string)($post['excerpt'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </p>
+          <?php if (!empty($post['tags'])): ?>
+            <div style="margin-top:8px; display:flex; flex-wrap:wrap; gap:6px;">
+              <?php foreach (array_filter(array_map('trim', explode(',', (string)$post['tags'] ?? ''))) as $tag): ?>
+                <span style="font-size:11px; color:#c8ccd8; border:1px solid rgba(255,255,255,0.15); padding:4px 8px; border-radius:999px;">
+                  <?= htmlspecialchars((string)$tag, ENT_QUOTES, 'UTF-8') ?>
+                </span>
+              <?php endforeach; ?>
+            </div>
+          <?php endif; ?>
+          <a href="/news/<?= htmlspecialchars((string)($post['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" style="display:inline-flex; margin-top:10px; font-size:12px; text-transform:uppercase; letter-spacing:0.2em; color:#9ad4ff;">Read more</a>
+        </article>
+      <?php endforeach; ?>
+    <?php endif; ?>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../views/site/layout.php';

modules/blog/views/site/show.php

@@ -0,0 +1,47 @@
+<?php
+$pageTitle = $title ?? 'Post';
+$contentHtml = $content_html ?? '';
+$publishedAt = $published_at ?? '';
+$featuredImage = $featured_image_url ?? '';
+$authorName = $author_name ?? '';
+$category = $category ?? '';
+$tags = $tags ?? '';
+ob_start();
+?>
+<section class="card">
+  <div class="badge">News</div>
+  <h1 style="margin-top:12px; font-size:30px;"><?= htmlspecialchars($pageTitle, ENT_QUOTES, 'UTF-8') ?></h1>
+  <?php if ($publishedAt !== '' || $authorName !== '' || $category !== ''): ?>
+    <div style="font-size:12px; color:var(--muted); margin-top:6px;">
+      <?php if ($publishedAt !== ''): ?>
+        <?= htmlspecialchars($publishedAt, ENT_QUOTES, 'UTF-8') ?>
+      <?php endif; ?>
+      <?php if ($authorName !== ''): ?>
+        <?php if ($publishedAt !== ''): ?> &middot; <?php endif; ?>
+        <?= htmlspecialchars($authorName, ENT_QUOTES, 'UTF-8') ?>
+      <?php endif; ?>
+      <?php if ($category !== ''): ?>
+        <?php if ($publishedAt !== '' || $authorName !== ''): ?> &middot; <?php endif; ?>
+        <?= htmlspecialchars($category, ENT_QUOTES, 'UTF-8') ?>
+      <?php endif; ?>
+    </div>
+  <?php endif; ?>
+  <?php if ($featuredImage !== ''): ?>
+    <img src="<?= htmlspecialchars($featuredImage, ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; border-radius:16px; margin-top:16px;">
+  <?php endif; ?>
+  <div style="margin-top:14px; color:var(--muted); line-height:1.8;">
+    <?= $contentHtml ?>
+  </div>
+  <?php if ($tags !== ''): ?>
+    <div style="margin-top:16px; display:flex; flex-wrap:wrap; gap:6px;">
+      <?php foreach (array_filter(array_map('trim', explode(',', (string)$tags))) as $tag): ?>
+        <span style="font-size:11px; color:#c8ccd8; border:1px solid rgba(255,255,255,0.15); padding:4px 8px; border-radius:999px;">
+          <?= htmlspecialchars((string)$tag, ENT_QUOTES, 'UTF-8') ?>
+        </span>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../views/site/layout.php';

modules/media/MediaController.php

@@ -0,0 +1,218 @@
+<?php
+declare(strict_types=1);
+
+namespace Modules\Media;
+
+use Core\Http\Response;
+use Core\Services\Auth;
+use Core\Services\Database;
+use Core\Views\View;
+use PDO;
+use Throwable;
+
+class MediaController
+{
+    private View $view;
+
+    public function __construct()
+    {
+        $this->view = new View(__DIR__ . '/views');
+    }
+
+    public function index(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+
+        $db = Database::get();
+        $items = [];
+        $folders = [];
+        $folderId = isset($_GET['folder']) ? (int)$_GET['folder'] : 0;
+        if ($db instanceof PDO) {
+            $folderStmt = $db->query("SELECT id, name FROM ac_media_folders ORDER BY name ASC");
+            $folders = $folderStmt ? $folderStmt->fetchAll(PDO::FETCH_ASSOC) : [];
+            if ($folderId > 0) {
+                $stmt = $db->prepare("SELECT id, file_name, file_url, file_type, file_size, created_at FROM ac_media WHERE folder_id = :folder_id ORDER BY created_at DESC");
+                $stmt->execute([':folder_id' => $folderId]);
+            } else {
+                $stmt = $db->query("SELECT id, file_name, file_url, file_type, file_size, created_at FROM ac_media WHERE folder_id IS NULL ORDER BY created_at DESC");
+            }
+            $items = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+        }
+
+        $error = (string)($_GET['error'] ?? '');
+        $success = (string)($_GET['success'] ?? '');
+        return new Response($this->view->render('admin/index.php', [
+            'title' => 'Media',
+            'items' => $items,
+            'folders' => $folders,
+            'active_folder' => $folderId,
+            'error' => $error,
+            'success' => $success,
+        ]));
+    }
+
+    public function picker(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager', 'editor'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+
+        $db = Database::get();
+        $items = [];
+        if ($db instanceof PDO) {
+            $stmt = $db->query("SELECT id, file_name, file_url, file_type FROM ac_media ORDER BY created_at DESC");
+            $items = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+        }
+
+        return new Response(json_encode(['items' => $items]), 200, ['Content-Type' => 'application/json']);
+    }
+
+    public function upload(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+
+        $file = $_FILES['media_file'] ?? null;
+        $folderId = isset($_POST['folder_id']) ? (int)$_POST['folder_id'] : 0;
+        if (!$file || !isset($file['tmp_name'])) {
+            return $this->uploadError('No file uploaded.', $folderId);
+        }
+        if ($file['error'] !== UPLOAD_ERR_OK) {
+            return $this->uploadError($this->uploadErrorMessage((int)$file['error']), $folderId);
+        }
+
+        $tmp = (string)$file['tmp_name'];
+        if ($tmp === '' || !is_uploaded_file($tmp)) {
+            return new Response('', 302, ['Location' => '/admin/media']);
+        }
+
+        $ext = strtolower(pathinfo((string)$file['name'], PATHINFO_EXTENSION));
+        if ($ext === '') {
+            $ext = 'bin';
+        }
+
+        $uploadDir = __DIR__ . '/../../uploads/media';
+        if (!is_dir($uploadDir)) {
+            if (!mkdir($uploadDir, 0755, true)) {
+                return $this->uploadError('Upload directory could not be created.', $folderId);
+            }
+        }
+        if (!is_writable($uploadDir)) {
+            return $this->uploadError('Upload directory is not writable.', $folderId);
+        }
+
+        $baseName = preg_replace('~[^a-z0-9]+~', '-', strtolower((string)$file['name'])) ?? 'file';
+        $baseName = trim($baseName, '-');
+        $fileName = ($baseName !== '' ? $baseName : 'file') . '-' . date('YmdHis') . '.' . $ext;
+        $dest = $uploadDir . '/' . $fileName;
+        if (!move_uploaded_file($tmp, $dest)) {
+            return $this->uploadError('Upload failed. Check server permissions.', $folderId);
+        }
+
+        $fileUrl = '/uploads/media/' . $fileName;
+        $fileType = (string)($file['type'] ?? '');
+        $fileSize = (int)($file['size'] ?? 0);
+
+        $db = Database::get();
+        if ($db instanceof PDO) {
+            try {
+                $stmt = $db->prepare("
+                    INSERT INTO ac_media (file_name, file_url, file_type, file_size, folder_id)
+                    VALUES (:name, :url, :type, :size, :folder_id)
+                ");
+                $stmt->execute([
+                    ':name' => (string)$file['name'],
+                    ':url' => $fileUrl,
+                    ':type' => $fileType,
+                    ':size' => $fileSize,
+                    ':folder_id' => $folderId > 0 ? $folderId : null,
+                ]);
+            } catch (Throwable $e) {
+                return $this->uploadError('Database insert failed.', $folderId);
+            }
+        }
+
+        $redirect = $folderId > 0 ? '/admin/media?folder=' . $folderId . '&success=1' : '/admin/media?success=1';
+        return new Response('', 302, ['Location' => $redirect]);
+    }
+
+    public function delete(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+
+        $id = (int)($_POST['id'] ?? 0);
+        $db = Database::get();
+        if ($db instanceof PDO && $id > 0) {
+            $stmt = $db->prepare("SELECT file_url FROM ac_media WHERE id = :id");
+            $stmt->execute([':id' => $id]);
+            $row = $stmt->fetch(PDO::FETCH_ASSOC);
+            if ($row && !empty($row['file_url'])) {
+                $path = __DIR__ . '/../../..' . (string)$row['file_url'];
+                if (is_file($path)) {
+                    @unlink($path);
+                }
+            }
+            $db->prepare("DELETE FROM ac_media WHERE id = :id")->execute([':id' => $id]);
+        }
+        return new Response('', 302, ['Location' => '/admin/media']);
+    }
+
+    public function createFolder(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        $name = trim((string)($_POST['name'] ?? ''));
+        if ($name === '') {
+            return new Response('', 302, ['Location' => '/admin/media']);
+        }
+        $db = Database::get();
+        if ($db instanceof PDO) {
+            $stmt = $db->prepare("INSERT INTO ac_media_folders (name) VALUES (:name)");
+            $stmt->execute([':name' => $name]);
+        }
+        return new Response('', 302, ['Location' => '/admin/media']);
+    }
+
+    private function uploadError(string $message, int $folderId): Response
+    {
+        $target = $folderId > 0 ? '/admin/media?folder=' . $folderId : '/admin/media';
+        $target .= '&error=' . rawurlencode($message);
+        return new Response('', 302, ['Location' => $target]);
+    }
+
+    private function uploadErrorMessage(int $code): string
+    {
+        $max = (string)ini_get('upload_max_filesize');
+        $map = [
+            UPLOAD_ERR_INI_SIZE => "File exceeds upload_max_filesize ({$max}).",
+            UPLOAD_ERR_FORM_SIZE => 'File exceeds form limit.',
+            UPLOAD_ERR_PARTIAL => 'File was only partially uploaded.',
+            UPLOAD_ERR_NO_TMP_DIR => 'Missing temp upload directory.',
+            UPLOAD_ERR_CANT_WRITE => 'Failed to write file to disk.',
+            UPLOAD_ERR_EXTENSION => 'Upload stopped by a PHP extension.',
+            UPLOAD_ERR_NO_FILE => 'No file uploaded.',
+        ];
+        return $map[$code] ?? 'Upload failed.';
+    }
+}

modules/media/module.php

@@ -0,0 +1,16 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Modules\Media\MediaController;
+
+require_once __DIR__ . '/MediaController.php';
+
+return function (Router $router): void {
+    $controller = new MediaController();
+    $router->get('/admin/media', [$controller, 'index']);
+    $router->get('/admin/media/picker', [$controller, 'picker']);
+    $router->post('/admin/media/upload', [$controller, 'upload']);
+    $router->post('/admin/media/delete', [$controller, 'delete']);
+    $router->post('/admin/media/folders', [$controller, 'createFolder']);
+};

modules/media/views/admin/index.php

@@ -0,0 +1,114 @@
+<?php
+$pageTitle = 'Media';
+$items = $items ?? [];
+$folders = $folders ?? [];
+$activeFolder = (int)($active_folder ?? 0);
+$error = (string)($error ?? '');
+$success = (string)($success ?? '');
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Media</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Media Library</h1>
+      <p style="color: var(--muted); margin-top:6px;">Upload and reuse images across pages, posts, and newsletters.</p>
+    </div>
+  </div>
+
+  <?php if ($error !== ''): ?>
+    <div style="margin-top:12px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php elseif ($success !== ''): ?>
+    <div style="margin-top:12px; color:var(--accent-2); font-size:13px;">Upload complete.</div>
+  <?php endif; ?>
+
+  <div style="margin-top:18px; display:grid; gap:12px;">
+    <div style="display:flex; gap:10px; flex-wrap:wrap;">
+      <a href="/admin/media" class="btn outline small" style="<?= $activeFolder === 0 ? 'border-color: var(--accent); color: var(--text);' : '' ?>">All</a>
+      <?php foreach ($folders as $folder): ?>
+        <a href="/admin/media?folder=<?= (int)$folder['id'] ?>" class="btn outline small" style="<?= $activeFolder === (int)$folder['id'] ? 'border-color: var(--accent); color: var(--text);' : '' ?>">
+          <?= htmlspecialchars((string)$folder['name'], ENT_QUOTES, 'UTF-8') ?>
+        </a>
+      <?php endforeach; ?>
+    </div>
+
+    <form method="post" action="/admin/media/folders" style="display:flex; gap:10px; flex-wrap:wrap;">
+      <input class="input" name="name" placeholder="New folder name" style="max-width:280px;">
+      <button type="submit" class="btn outline small">Create Folder</button>
+    </form>
+
+    <form method="post" action="/admin/media/upload" enctype="multipart/form-data" id="mediaUploadForm">
+      <input type="hidden" name="folder_id" value="<?= $activeFolder > 0 ? $activeFolder : 0 ?>">
+      <label for="mediaFileInput" id="mediaDropzone" style="display:flex; flex-direction:column; gap:8px; align-items:center; justify-content:center; padding:24px; border-radius:16px; border:1px dashed rgba(255,255,255,0.2); background: rgba(0,0,0,0.2); cursor:pointer;">
+        <div style="font-size:12px; text-transform:uppercase; letter-spacing:0.2em; color:var(--muted);">Drag &amp; Drop</div>
+        <div style="font-size:14px; color:var(--text);">or click to upload</div>
+        <div id="mediaFileName" style="font-size:12px; color:var(--muted);">No file selected</div>
+      </label>
+      <input class="input" type="file" id="mediaFileInput" name="media_file" accept="image/*" style="display:none;">
+      <div style="margin-top:10px; display:flex; justify-content:flex-end;">
+        <button type="submit" class="btn small">Upload</button>
+      </div>
+    </form>
+  </div>
+
+  <div style="margin-top:18px; display:grid; grid-template-columns: repeat(auto-fill, minmax(180px, 1fr)); gap:12px;">
+    <?php if (!$items): ?>
+      <div style="color: var(--muted); font-size:13px;">No media uploaded yet.</div>
+    <?php else: ?>
+      <?php foreach ($items as $item): ?>
+        <div style="border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9); padding:10px;">
+          <div style="aspect-ratio: 1 / 1; border-radius:12px; overflow:hidden; background:#0b0c10; display:flex; align-items:center; justify-content:center;">
+            <?php if (str_starts_with((string)($item['file_type'] ?? ''), 'image/')): ?>
+              <img src="<?= htmlspecialchars((string)$item['file_url'], ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; height:100%; object-fit:cover;">
+            <?php else: ?>
+              <div style="color:var(--muted); font-size:12px;">File</div>
+            <?php endif; ?>
+          </div>
+          <div style="margin-top:8px; font-size:12px; color:var(--muted); overflow:hidden; text-overflow:ellipsis; white-space:nowrap;">
+            <?= htmlspecialchars((string)($item['file_name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <input class="input" readonly value="<?= htmlspecialchars((string)($item['file_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" style="margin-top:6px; font-size:11px;">
+          <form method="post" action="/admin/media/delete" onsubmit="return confirm('Delete this file?');" style="margin-top:8px;">
+            <input type="hidden" name="id" value="<?= (int)($item['id'] ?? 0) ?>">
+            <button type="submit" class="btn outline small">Delete</button>
+          </form>
+        </div>
+      <?php endforeach; ?>
+    <?php endif; ?>
+  </div>
+</section>
+<script>
+  (function () {
+    const dropzone = document.getElementById('mediaDropzone');
+    const fileInput = document.getElementById('mediaFileInput');
+    const fileName = document.getElementById('mediaFileName');
+    if (!dropzone || !fileInput || !fileName) {
+      return;
+    }
+
+    dropzone.addEventListener('dragover', (event) => {
+      event.preventDefault();
+      dropzone.style.borderColor = 'var(--accent)';
+    });
+
+    dropzone.addEventListener('dragleave', () => {
+      dropzone.style.borderColor = 'rgba(255,255,255,0.2)';
+    });
+
+    dropzone.addEventListener('drop', (event) => {
+      event.preventDefault();
+      dropzone.style.borderColor = 'rgba(255,255,255,0.2)';
+      if (event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files.length) {
+        fileInput.files = event.dataTransfer.files;
+        fileName.textContent = event.dataTransfer.files[0].name;
+      }
+    });
+
+    fileInput.addEventListener('change', () => {
+      fileName.textContent = fileInput.files.length ? fileInput.files[0].name : 'No file selected';
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/newsletter/NewsletterController.php

@@ -0,0 +1,384 @@
+<?php
+declare(strict_types=1);
+
+namespace Modules\Newsletter;
+
+use Core\Http\Response;
+use Core\Services\Auth;
+use Core\Services\Database;
+use Core\Services\Mailer;
+use Core\Services\Settings;
+use Core\Views\View;
+use PDO;
+use Throwable;
+
+class NewsletterController
+{
+    private View $view;
+
+    public function __construct()
+    {
+        $this->view = new View(__DIR__ . '/views');
+    }
+
+    public function subscribe(): Response
+    {
+        $email = trim((string)($_POST['email'] ?? ''));
+        $name = trim((string)($_POST['name'] ?? ''));
+        if ($email === '') {
+            return new Response('Missing email', 400);
+        }
+
+        $db = Database::get();
+        if ($db instanceof PDO) {
+            $stmt = $db->prepare("
+                INSERT INTO ac_newsletter_subscribers (email, name, status, source)
+                VALUES (:email, :name, 'subscribed', 'form')
+                ON DUPLICATE KEY UPDATE name = VALUES(name), status = 'subscribed', unsubscribed_at = NULL
+            ");
+            $stmt->execute([
+                ':email' => $email,
+                ':name' => $name !== '' ? $name : null,
+            ]);
+        }
+
+        $this->syncMailchimp($email, $name);
+
+        return new Response('Subscribed', 200);
+    }
+
+    public function unsubscribeForm(): Response
+    {
+        $email = trim((string)($_GET['email'] ?? ''));
+        return new Response($this->view->render('site/unsubscribe.php', [
+            'title' => 'Unsubscribe',
+            'email' => $email,
+            'status' => '',
+        ]));
+    }
+
+    public function unsubscribe(): Response
+    {
+        $email = trim((string)($_POST['email'] ?? ''));
+        $status = 'Email is required.';
+
+        $db = Database::get();
+        if ($db instanceof PDO && $email !== '') {
+            $stmt = $db->prepare("UPDATE ac_newsletter_subscribers SET status = 'unsubscribed', unsubscribed_at = NOW() WHERE email = :email");
+            $stmt->execute([':email' => $email]);
+            $status = 'You have been unsubscribed.';
+        }
+
+        return new Response($this->view->render('site/unsubscribe.php', [
+            'title' => 'Unsubscribe',
+            'email' => $email,
+            'status' => $status,
+        ]));
+    }
+
+    public function adminIndex(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        $campaigns = [];
+        if ($db instanceof PDO) {
+            $stmt = $db->query("SELECT id, title, subject, status, sent_at, scheduled_at FROM ac_newsletter_campaigns ORDER BY created_at DESC");
+            $campaigns = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+        }
+        return new Response($this->view->render('admin/index.php', [
+            'title' => 'Newsletter',
+            'campaigns' => $campaigns,
+        ]));
+    }
+
+    public function adminSubscribers(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        $subscribers = [];
+        if ($db instanceof PDO) {
+            $stmt = $db->query("SELECT id, email, name, status, created_at FROM ac_newsletter_subscribers ORDER BY created_at DESC");
+            $subscribers = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+        }
+        return new Response($this->view->render('admin/subscribers.php', [
+            'title' => 'Newsletter',
+            'subscribers' => $subscribers,
+        ]));
+    }
+
+    public function adminEdit(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
+        $campaign = [
+            'id' => 0,
+            'title' => '',
+            'subject' => '',
+            'content_html' => '',
+            'status' => 'draft',
+            'scheduled_at' => '',
+        ];
+        $db = Database::get();
+        if ($id > 0 && $db instanceof PDO) {
+            $stmt = $db->prepare("SELECT * FROM ac_newsletter_campaigns WHERE id = :id LIMIT 1");
+            $stmt->execute([':id' => $id]);
+            $row = $stmt->fetch(PDO::FETCH_ASSOC);
+            if ($row) {
+                $campaign = $row;
+            }
+        }
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Campaign' : 'New Campaign',
+            'campaign' => $campaign,
+            'error' => '',
+        ]));
+    }
+
+    public function adminSave(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/newsletter']);
+        }
+
+        $id = (int)($_POST['id'] ?? 0);
+        $title = trim((string)($_POST['title'] ?? ''));
+        $subject = trim((string)($_POST['subject'] ?? ''));
+        $content = (string)($_POST['content_html'] ?? '');
+        $scheduledAt = trim((string)($_POST['scheduled_at'] ?? ''));
+
+        if ($title === '' || $subject === '') {
+            return $this->renderEditError($id, $title, $subject, $content, 'Title and subject are required.');
+        }
+
+        try {
+            $status = $scheduledAt !== '' ? 'scheduled' : 'draft';
+            if ($id > 0) {
+                $stmt = $db->prepare("
+                    UPDATE ac_newsletter_campaigns
+                    SET title = :title, subject = :subject, content_html = :content,
+                        status = :status, scheduled_at = :scheduled_at
+                    WHERE id = :id
+                ");
+                $stmt->execute([
+                    ':title' => $title,
+                    ':subject' => $subject,
+                    ':content' => $content,
+                    ':status' => $status,
+                    ':scheduled_at' => $scheduledAt !== '' ? $scheduledAt : null,
+                    ':id' => $id,
+                ]);
+            } else {
+                $stmt = $db->prepare("
+                    INSERT INTO ac_newsletter_campaigns (title, subject, content_html, status, scheduled_at)
+                    VALUES (:title, :subject, :content, :status, :scheduled_at)
+                ");
+                $stmt->execute([
+                    ':title' => $title,
+                    ':subject' => $subject,
+                    ':content' => $content,
+                    ':status' => $status,
+                    ':scheduled_at' => $scheduledAt !== '' ? $scheduledAt : null,
+                ]);
+            }
+        } catch (Throwable $e) {
+            return $this->renderEditError($id, $title, $subject, $content, 'Unable to save campaign.');
+        }
+
+        return new Response('', 302, ['Location' => '/admin/newsletter']);
+    }
+
+    public function adminSend(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/newsletter']);
+        }
+
+        $id = (int)($_POST['id'] ?? 0);
+        $stmt = $db->prepare("SELECT id, subject, content_html FROM ac_newsletter_campaigns WHERE id = :id LIMIT 1");
+        $stmt->execute([':id' => $id]);
+        $campaign = $stmt->fetch(PDO::FETCH_ASSOC);
+        if (!$campaign) {
+            return new Response('', 302, ['Location' => '/admin/newsletter']);
+        }
+
+        $subStmt = $db->query("SELECT id, email FROM ac_newsletter_subscribers WHERE status = 'subscribed'");
+        $subs = $subStmt ? $subStmt->fetchAll(PDO::FETCH_ASSOC) : [];
+
+        $settings = [
+            'smtp_host' => Settings::get('smtp_host'),
+            'smtp_port' => Settings::get('smtp_port'),
+            'smtp_user' => Settings::get('smtp_user'),
+            'smtp_pass' => Settings::get('smtp_pass'),
+            'smtp_encryption' => Settings::get('smtp_encryption'),
+            'smtp_from_email' => Settings::get('smtp_from_email'),
+            'smtp_from_name' => Settings::get('smtp_from_name'),
+        ];
+
+        foreach ($subs as $sub) {
+            $result = Mailer::send((string)$sub['email'], (string)$campaign['subject'], (string)$campaign['content_html'], $settings);
+            $sendStmt = $db->prepare("
+                INSERT INTO ac_newsletter_sends (campaign_id, subscriber_id, status, sent_at, error_text)
+                VALUES (:campaign_id, :subscriber_id, :status, NOW(), :error_text)
+            ");
+            $sendStmt->execute([
+                ':campaign_id' => (int)$campaign['id'],
+                ':subscriber_id' => (int)$sub['id'],
+                ':status' => $result['ok'] ? 'sent' : 'failed',
+                ':error_text' => $result['ok'] ? null : (string)$result['error'],
+            ]);
+        }
+
+        $db->prepare("UPDATE ac_newsletter_campaigns SET status = 'sent', sent_at = NOW() WHERE id = :id")
+            ->execute([':id' => $id]);
+
+        return new Response('', 302, ['Location' => '/admin/newsletter']);
+    }
+
+    public function adminTestSend(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/newsletter']);
+        }
+        $id = (int)($_POST['id'] ?? 0);
+        $email = trim((string)($_POST['test_email'] ?? ''));
+        if ($id <= 0 || $email === '') {
+            return new Response('', 302, ['Location' => '/admin/newsletter/campaigns/edit?id=' . $id]);
+        }
+        $stmt = $db->prepare("SELECT subject, content_html FROM ac_newsletter_campaigns WHERE id = :id LIMIT 1");
+        $stmt->execute([':id' => $id]);
+        $campaign = $stmt->fetch(PDO::FETCH_ASSOC);
+        if (!$campaign) {
+            return new Response('', 302, ['Location' => '/admin/newsletter']);
+        }
+
+        $settings = [
+            'smtp_host' => Settings::get('smtp_host'),
+            'smtp_port' => Settings::get('smtp_port'),
+            'smtp_user' => Settings::get('smtp_user'),
+            'smtp_pass' => Settings::get('smtp_pass'),
+            'smtp_encryption' => Settings::get('smtp_encryption'),
+            'smtp_from_email' => Settings::get('smtp_from_email'),
+            'smtp_from_name' => Settings::get('smtp_from_name'),
+        ];
+
+        Mailer::send($email, (string)$campaign['subject'], (string)$campaign['content_html'], $settings);
+
+        return new Response('', 302, ['Location' => '/admin/newsletter/campaigns/edit?id=' . $id]);
+    }
+
+    public function adminProcessQueue(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/newsletter']);
+        }
+
+        $stmt = $db->prepare("
+            SELECT id FROM ac_newsletter_campaigns
+            WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= NOW()
+        ");
+        $stmt->execute();
+        $campaigns = $stmt->fetchAll(PDO::FETCH_ASSOC);
+
+        foreach ($campaigns as $campaign) {
+            $_POST['id'] = (int)$campaign['id'];
+            $this->adminSend();
+        }
+
+        return new Response('', 302, ['Location' => '/admin/newsletter']);
+    }
+
+    public function adminDeleteSubscriber(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $id = (int)($_POST['id'] ?? 0);
+        $db = Database::get();
+        if ($db instanceof PDO && $id > 0) {
+            $db->prepare("DELETE FROM ac_newsletter_subscribers WHERE id = :id")->execute([':id' => $id]);
+        }
+        return new Response('', 302, ['Location' => '/admin/newsletter/subscribers']);
+    }
+
+    private function renderEditError(int $id, string $title, string $subject, string $content, string $error): Response
+    {
+        $campaign = [
+            'id' => $id,
+            'title' => $title,
+            'subject' => $subject,
+            'content_html' => $content,
+        ];
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Campaign' : 'New Campaign',
+            'campaign' => $campaign,
+            'error' => $error,
+        ]));
+    }
+
+    private function guard(array $roles): ?Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole($roles)) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        return null;
+    }
+
+    private function syncMailchimp(string $email, string $name): void
+    {
+        $apiKey = Settings::get('mailchimp_api_key');
+        $listId = Settings::get('mailchimp_list_id');
+        if ($apiKey === '' || $listId === '') {
+            return;
+        }
+        $parts = explode('-', $apiKey);
+        $dc = $parts[1] ?? '';
+        if ($dc === '') {
+            return;
+        }
+
+        $subscriberHash = md5(strtolower($email));
+        $url = "https://{$dc}.api.mailchimp.com/3.0/lists/{$listId}/members/{$subscriberHash}";
+        $payload = json_encode([
+            'email_address' => $email,
+            'status' => 'subscribed',
+            'merge_fields' => [
+                'FNAME' => $name,
+            ],
+        ]);
+
+        $ch = curl_init($url);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_USERPWD, 'user:' . $apiKey);
+        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT');
+        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
+        curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
+        curl_setopt($ch, CURLOPT_TIMEOUT, 10);
+        curl_exec($ch);
+        curl_close($ch);
+    }
+}

modules/newsletter/module.php

@@ -0,0 +1,80 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Core\Services\Shortcodes;
+use Modules\Newsletter\NewsletterController;
+
+require_once __DIR__ . '/NewsletterController.php';
+
+Shortcodes::register('newsletter-signup', static function (array $attrs = []): string {
+    $title = trim((string)($attrs['title'] ?? 'Join the newsletter'));
+    $button = trim((string)($attrs['button'] ?? 'Subscribe'));
+    $placeholder = trim((string)($attrs['placeholder'] ?? 'you@example.com'));
+    if ($title === '') {
+        $title = 'Join the newsletter';
+    }
+    if ($button === '') {
+        $button = 'Subscribe';
+    }
+    if ($placeholder === '') {
+        $placeholder = 'you@example.com';
+    }
+
+    return '<form method="post" action="/newsletter/subscribe" class="ac-shortcode-newsletter-form">'
+        . '<div class="ac-shortcode-newsletter-title">' . htmlspecialchars($title, ENT_QUOTES, 'UTF-8') . '</div>'
+        . '<div class="ac-shortcode-newsletter-row">'
+        . '<input type="email" name="email" required class="ac-shortcode-newsletter-input" placeholder="' . htmlspecialchars($placeholder, ENT_QUOTES, 'UTF-8') . '">'
+        . '<button type="submit" class="ac-shortcode-newsletter-btn">' . htmlspecialchars($button, ENT_QUOTES, 'UTF-8') . '</button>'
+        . '</div>'
+        . '</form>';
+});
+
+Shortcodes::register('newsletter-unsubscribe', static function (array $attrs = []): string {
+    $label = trim((string)($attrs['label'] ?? 'Unsubscribe'));
+    if ($label === '') {
+        $label = 'Unsubscribe';
+    }
+    $token = trim((string)($attrs['token'] ?? ''));
+    $href = '/newsletter/unsubscribe';
+    if ($token !== '') {
+        $href .= '?token=' . rawurlencode($token);
+    }
+    return '<a class="ac-shortcode-link ac-shortcode-newsletter-unsubscribe" href="' . htmlspecialchars($href, ENT_QUOTES, 'UTF-8') . '">' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</a>';
+});
+
+Shortcodes::register('newsletter-unsubscribe-form', static function (array $attrs = []): string {
+    $title = trim((string)($attrs['title'] ?? 'Unsubscribe from newsletter'));
+    $button = trim((string)($attrs['button'] ?? 'Unsubscribe'));
+    if ($title === '') {
+        $title = 'Unsubscribe from newsletter';
+    }
+    if ($button === '') {
+        $button = 'Unsubscribe';
+    }
+    return '<form method="post" action="/newsletter/unsubscribe" class="ac-shortcode-newsletter-form">'
+        . '<div class="ac-shortcode-newsletter-title">' . htmlspecialchars($title, ENT_QUOTES, 'UTF-8') . '</div>'
+        . '<div class="ac-shortcode-newsletter-row">'
+        . '<input type="email" name="email" required class="ac-shortcode-newsletter-input" placeholder="you@example.com">'
+        . '<button type="submit" class="ac-shortcode-newsletter-btn">' . htmlspecialchars($button, ENT_QUOTES, 'UTF-8') . '</button>'
+        . '</div>'
+        . '</form>';
+});
+
+return function (Router $router): void {
+    $controller = new NewsletterController();
+
+    $router->post('/newsletter/subscribe', [$controller, 'subscribe']);
+    $router->get('/newsletter/unsubscribe', [$controller, 'unsubscribeForm']);
+    $router->post('/newsletter/unsubscribe', [$controller, 'unsubscribe']);
+
+    $router->get('/admin/newsletter', [$controller, 'adminIndex']);
+    $router->get('/admin/newsletter/campaigns/new', [$controller, 'adminEdit']);
+    $router->get('/admin/newsletter/campaigns/edit', [$controller, 'adminEdit']);
+    $router->post('/admin/newsletter/campaigns/save', [$controller, 'adminSave']);
+    $router->post('/admin/newsletter/campaigns/send', [$controller, 'adminSend']);
+    $router->post('/admin/newsletter/campaigns/test', [$controller, 'adminTestSend']);
+    $router->post('/admin/newsletter/campaigns/process', [$controller, 'adminProcessQueue']);
+    $router->get('/admin/newsletter/subscribers', [$controller, 'adminSubscribers']);
+    $router->post('/admin/newsletter/subscribers/delete', [$controller, 'adminDeleteSubscriber']);
+};

modules/newsletter/views/admin/edit.php

@@ -0,0 +1,96 @@
+<?php
+$pageTitle = $title ?? 'Edit Campaign';
+$campaign = $campaign ?? [];
+$error = $error ?? '';
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Newsletter</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;"><?= htmlspecialchars($pageTitle, ENT_QUOTES, 'UTF-8') ?></h1>
+      <p style="color: var(--muted); margin-top:6px;">Write a full HTML campaign.</p>
+    </div>
+    <a href="/admin/newsletter" class="btn outline">Back</a>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/newsletter/campaigns/save" style="margin-top:18px; display:grid; gap:16px;">
+    <input type="hidden" name="id" value="<?= (int)($campaign['id'] ?? 0) ?>">
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Title</label>
+        <input class="input" name="title" value="<?= htmlspecialchars((string)($campaign['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Monthly Update">
+        <label class="label">Subject</label>
+        <input class="input" name="subject" value="<?= htmlspecialchars((string)($campaign['subject'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="AudioCore Newsletter">
+        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px;">
+          <label class="label" style="margin:0;">Content (HTML)</label>
+          <button type="button" class="btn outline small" data-media-picker="newsletter_content_html">Insert Media</button>
+        </div>
+        <textarea class="input" id="newsletter_content_html" name="content_html" rows="18" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:13px; line-height:1.6;"><?= htmlspecialchars((string)($campaign['content_html'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <label class="label">Schedule Send (optional)</label>
+        <input class="input" name="scheduled_at" value="<?= htmlspecialchars((string)($campaign['scheduled_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="2026-01-25 18:30:00">
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end; gap:12px; align-items:center;">
+      <button type="button" id="previewNewsletter" class="btn outline">Preview</button>
+      <button type="submit" class="btn">Save campaign</button>
+    </div>
+  </form>
+
+  <?php if (!empty($campaign['id'])): ?>
+    <form method="post" action="/admin/newsletter/campaigns/test" style="margin-top:12px; display:flex; gap:10px; align-items:center;">
+      <input type="hidden" name="id" value="<?= (int)($campaign['id'] ?? 0) ?>">
+      <input class="input" name="test_email" placeholder="test@example.com" style="max-width:280px;">
+      <button type="submit" class="btn outline small">Send Test</button>
+    </form>
+  <?php endif; ?>
+</section>
+<script>
+  (function () {
+    const previewBtn = document.getElementById('previewNewsletter');
+    const contentEl = document.querySelector('textarea[name="content_html"]');
+    if (!previewBtn || !contentEl) {
+      return;
+    }
+
+    previewBtn.addEventListener('click', function () {
+      const previewWindow = window.open('', 'newsletterPreview', 'width=1000,height=800');
+      if (!previewWindow) {
+        return;
+      }
+      const html = contentEl.value || '';
+      const doc = previewWindow.document;
+      doc.open();
+      doc.write(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Newsletter Preview</title>
+  <style>
+    body { margin: 0; background: #f0f2f5; font-family: Arial, sans-serif; }
+    .wrap { padding: 24px; display: flex; justify-content: center; }
+    .frame { max-width: 680px; width: 100%; background: #ffffff; border-radius: 12px; padding: 24px; box-shadow: 0 12px 30px rgba(0,0,0,0.15); }
+    img { max-width: 100%; height: auto; }
+  </style>
+</head>
+<body>
+  <div class="wrap">
+    <div class="frame">
+      ${html}
+    </div>
+  </div>
+</body>
+</html>`);
+      doc.close();
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/newsletter/views/admin/index.php

@@ -0,0 +1,259 @@
+<?php
+$pageTitle = 'Newsletter';
+$campaigns = $campaigns ?? [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Newsletter</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Campaigns</h1>
+      <p style="color: var(--muted); margin-top:6px;">Build and send HTML newsletters.</p>
+    </div>
+    <div style="display:flex; gap:10px;">
+      <a href="/admin/newsletter/subscribers" class="btn outline small">Subscribers</a>
+      <form method="post" action="/admin/newsletter/campaigns/process" style="display:inline;">
+        <button type="submit" class="btn outline small">Process Queue</button>
+      </form>
+      <a href="/admin/newsletter/campaigns/new" class="btn small">New Campaign</a>
+    </div>
+  </div>
+
+  <div style="margin-top:18px; display:grid; gap:10px;">
+    <div style="display:grid; grid-template-columns: 2fr 1.4fr 120px 140px 140px 140px; gap:12px; font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+      <div>Title</div>
+      <div>Subject</div>
+      <div>Status</div>
+      <div>Scheduled</div>
+      <div>Sent At</div>
+      <div>Actions</div>
+    </div>
+    <?php if (!$campaigns): ?>
+      <div style="color: var(--muted); font-size:13px;">No campaigns yet.</div>
+    <?php else: ?>
+      <?php foreach ($campaigns as $campaign): ?>
+        <div style="display:grid; grid-template-columns: 2fr 1.4fr 120px 140px 140px 140px; gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+          <div style="font-weight:600;"><?= htmlspecialchars((string)($campaign['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($campaign['subject'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:<?= ((string)($campaign['status'] ?? '') === 'sent') ? 'var(--accent-2)' : 'var(--muted)' ?>;">
+            <?= htmlspecialchars((string)($campaign['status'] ?? 'draft'), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($campaign['scheduled_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($campaign['sent_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="display:flex; gap:8px;">
+            <a href="/admin/newsletter/campaigns/edit?id=<?= (int)$campaign['id'] ?>" class="btn outline small">Edit</a>
+            <form method="post" action="/admin/newsletter/campaigns/send" onsubmit="return confirm('Send this campaign now?');">
+              <input type="hidden" name="id" value="<?= (int)$campaign['id'] ?>">
+              <button type="submit" class="btn small">Send</button>
+            </form>
+          </div>
+        </div>
+      <?php endforeach; ?>
+    <?php endif; ?>
+  </div>
+</section>
+
+<section class="admin-card" style="margin-top:16px;">
+  <div class="badge">Signup Form</div>
+  <p style="color: var(--muted); margin-top:10px;">Choose a signup form template to paste into any custom page.</p>
+  <div style="margin-top:12px; display:grid; gap:12px;">
+    <select id="signupTemplateSelect" class="input" style="text-transform:none;">
+      <option value="">Select template</option>
+      <option value="signup-compact">Compact Inline</option>
+      <option value="signup-card">Card Form</option>
+      <option value="signup-minimal">Minimal</option>
+      <option value="signup-banner">Banner CTA</option>
+    </select>
+    <div id="signupTemplatePreview" style="border:1px solid rgba(255,255,255,0.12); border-radius:14px; padding:12px; background: rgba(0,0,0,0.2); min-height:120px;"></div>
+    <div style="display:flex; gap:10px; justify-content:flex-end;">
+      <button type="button" id="copySignupTemplate" class="btn outline small">Copy HTML</button>
+    </div>
+  </div>
+</section>
+
+<section class="admin-card" style="margin-top:16px;">
+  <div class="badge">Template Starter</div>
+  <p style="color: var(--muted); margin-top:10px;">Pick a campaign template, preview it, then copy HTML.</p>
+  <div style="margin-top:12px; display:grid; gap:12px;">
+    <select id="newsletterTemplateSelect" class="input" style="text-transform:none;">
+      <option value="">Select template</option>
+      <option value="email-minimal">Minimal Update</option>
+      <option value="email-feature">Feature Promo</option>
+      <option value="email-digest">Weekly Digest</option>
+      <option value="email-event">Event Invite</option>
+    </select>
+    <div id="newsletterTemplatePreview" style="border:1px solid rgba(255,255,255,0.12); border-radius:14px; padding:12px; background: rgba(0,0,0,0.2); min-height:140px;"></div>
+    <div style="display:flex; gap:10px; justify-content:flex-end;">
+      <button type="button" id="copyNewsletterTemplate" class="btn outline small">Copy HTML</button>
+    </div>
+  </div>
+</section>
+
+<script>
+  (function () {
+    const signupTemplates = {
+      'signup-compact': {
+        html: `<form method="post" action="/newsletter/subscribe" style="display:flex; gap:8px; flex-wrap:wrap;">
+  <input type="text" name="name" placeholder="Name" style="padding:10px 12px; border-radius:10px; border:1px solid #e5e7eb;">
+  <input type="email" name="email" placeholder="Email" required style="padding:10px 12px; border-radius:10px; border:1px solid #e5e7eb;">
+  <button type="submit" style="padding:10px 16px; border-radius:999px; border:none; background:#22f2a5; color:#071016;">Subscribe</button>
+</form>`,
+        preview: `<div style="background:#0f1117; padding:12px; border-radius:12px;">
+  <div style="color:#c9cbd4; font-size:12px; margin-bottom:8px;">Compact Inline</div>
+  <div style="display:flex; gap:8px; flex-wrap:wrap;">
+    <div style="flex:1; min-width:120px; height:34px; border-radius:8px; background:#1b1e26;"></div>
+    <div style="flex:1; min-width:120px; height:34px; border-radius:8px; background:#1b1e26;"></div>
+    <div style="width:110px; height:34px; border-radius:999px; background:#22f2a5;"></div>
+  </div>
+</div>`
+      },
+      'signup-card': {
+        html: `<div style="padding:18px; border:1px solid #e5e7eb; border-radius:12px;">
+  <h3 style="margin:0 0 8px;">Join the newsletter</h3>
+  <p style="margin:0 0 12px;">Monthly updates and releases.</p>
+  <form method="post" action="/newsletter/subscribe" style="display:grid; gap:8px;">
+    <input type="text" name="name" placeholder="Name" style="padding:10px 12px; border-radius:10px; border:1px solid #e5e7eb;">
+    <input type="email" name="email" placeholder="Email" required style="padding:10px 12px; border-radius:10px; border:1px solid #e5e7eb;">
+    <button type="submit" style="padding:10px 16px; border-radius:999px; border:none; background:#22f2a5; color:#071016;">Subscribe</button>
+  </form>
+</div>`,
+        preview: `<div style="background:#0f1117; padding:12px; border-radius:12px;">
+  <div style="height:10px; width:120px; background:#2a2e3a; border-radius:6px; margin-bottom:10px;"></div>
+  <div style="height:8px; width:180px; background:#1b1e26; border-radius:6px; margin-bottom:12px;"></div>
+  <div style="display:grid; gap:8px;">
+    <div style="height:34px; border-radius:8px; background:#1b1e26;"></div>
+    <div style="height:34px; border-radius:8px; background:#1b1e26;"></div>
+    <div style="height:34px; width:120px; border-radius:999px; background:#22f2a5;"></div>
+  </div>
+</div>`
+      },
+      'signup-minimal': {
+        html: `<form method="post" action="/newsletter/subscribe">
+  <input type="email" name="email" placeholder="Email" required style="padding:10px 12px; border-radius:10px; border:1px solid #e5e7eb; width:100%; max-width:320px;">
+  <button type="submit" style="margin-top:8px; padding:8px 14px; border-radius:999px; border:1px solid #111; background:#111; color:#fff;">Subscribe</button>
+</form>`,
+        preview: `<div style="background:#0f1117; padding:12px; border-radius:12px;">
+  <div style="height:34px; width:240px; border-radius:8px; background:#1b1e26;"></div>
+  <div style="height:30px; width:110px; border-radius:999px; background:#2a2e3a; margin-top:8px;"></div>
+</div>`
+      },
+      'signup-banner': {
+        html: `<div style="padding:16px; border-radius:12px; background:#0f172a; color:#fff; display:flex; flex-wrap:wrap; gap:12px; align-items:center;">
+  <div style="flex:1; min-width:180px;">
+    <strong>Get updates</strong><br>
+    New releases, events, and drops.
+  </div>
+  <form method="post" action="/newsletter/subscribe" style="display:flex; gap:8px; flex-wrap:wrap;">
+    <input type="email" name="email" placeholder="Email" required style="padding:10px 12px; border-radius:10px; border:1px solid #1f2937;">
+    <button type="submit" style="padding:10px 16px; border-radius:999px; border:none; background:#22f2a5; color:#071016;">Subscribe</button>
+  </form>
+</div>`,
+        preview: `<div style="background:#0f1117; padding:12px; border-radius:12px;">
+  <div style="height:16px; width:160px; background:#1b1e26; border-radius:6px; margin-bottom:8px;"></div>
+  <div style="display:flex; gap:8px; flex-wrap:wrap;">
+    <div style="height:34px; width:160px; border-radius:8px; background:#1b1e26;"></div>
+    <div style="height:34px; width:110px; border-radius:999px; background:#22f2a5;"></div>
+  </div>
+</div>`
+      }
+    };
+
+    const emailTemplates = {
+      'email-minimal': {
+        html: `<div style="font-family:Arial, sans-serif; color:#111; line-height:1.6;">
+  <h1 style="margin:0 0 8px;">AudioCore Update</h1>
+  <p style="margin:0 0 16px;">Latest releases, news, and announcements.</p>
+  <p style="margin:0;">Thanks for listening.</p>
+</div>`,
+        preview: `<div style="background:#fff; color:#111; padding:12px; border-radius:8px;">
+  <div style="height:16px; width:180px; background:#e5e7eb; border-radius:6px; margin-bottom:8px;"></div>
+  <div style="height:10px; width:240px; background:#f3f4f6; border-radius:6px; margin-bottom:10px;"></div>
+  <div style="height:10px; width:120px; background:#f3f4f6; border-radius:6px;"></div>
+</div>`
+      },
+      'email-feature': {
+        html: `<div style="font-family:Arial, sans-serif; color:#111; line-height:1.6;">
+  <h1 style="margin:0 0 8px;">Featured Release</h1>
+  <img src="https://placehold.co/600x360/111827/ffffff?text=Cover" alt="" style="width:100%; border-radius:10px; margin:8px 0;">
+  <p style="margin:0 0 12px;">REC008 – Night Drive EP now available.</p>
+  <a href="#" style="display:inline-block; padding:10px 16px; border-radius:999px; background:#22f2a5; color:#071016; text-decoration:none;">Listen now</a>
+</div>`,
+        preview: `<div style="background:#fff; color:#111; padding:12px; border-radius:8px;">
+  <div style="height:16px; width:160px; background:#e5e7eb; border-radius:6px; margin-bottom:8px;"></div>
+  <div style="height:120px; background:#e5e7eb; border-radius:8px; margin-bottom:10px;"></div>
+  <div style="height:10px; width:200px; background:#f3f4f6; border-radius:6px; margin-bottom:12px;"></div>
+  <div style="height:30px; width:120px; background:#22f2a5; border-radius:999px;"></div>
+</div>`
+      },
+      'email-digest': {
+        html: `<div style="font-family:Arial, sans-serif; color:#111; line-height:1.6;">
+  <h1 style="margin:0 0 12px;">Weekly Digest</h1>
+  <ul style="padding-left:18px; margin:0 0 12px;">
+    <li>New release: REC009 – Twilight Runner</li>
+    <li>Label spotlight: Neon District</li>
+    <li>Playlist update: Midnight Circuit</li>
+  </ul>
+  <p style="margin:0;">See the full catalog for more.</p>
+</div>`,
+        preview: `<div style="background:#fff; color:#111; padding:12px; border-radius:8px;">
+  <div style="height:16px; width:160px; background:#e5e7eb; border-radius:6px; margin-bottom:10px;"></div>
+  <div style="height:10px; width:240px; background:#f3f4f6; border-radius:6px; margin-bottom:6px;"></div>
+  <div style="height:10px; width:200px; background:#f3f4f6; border-radius:6px; margin-bottom:6px;"></div>
+  <div style="height:10px; width:180px; background:#f3f4f6; border-radius:6px; margin-bottom:12px;"></div>
+  <div style="height:10px; width:200px; background:#f3f4f6; border-radius:6px;"></div>
+</div>`
+      },
+      'email-event': {
+        html: `<div style="font-family:Arial, sans-serif; color:#111; line-height:1.6;">
+  <h1 style="margin:0 0 8px;">Live Showcase</h1>
+  <p style="margin:0 0 12px;">Friday, 8PM · Warehouse 12</p>
+  <a href="#" style="display:inline-block; padding:10px 16px; border-radius:999px; background:#111; color:#fff; text-decoration:none;">RSVP</a>
+</div>`,
+        preview: `<div style="background:#fff; color:#111; padding:12px; border-radius:8px;">
+  <div style="height:16px; width:140px; background:#e5e7eb; border-radius:6px; margin-bottom:8px;"></div>
+  <div style="height:10px; width:160px; background:#f3f4f6; border-radius:6px; margin-bottom:12px;"></div>
+  <div style="height:30px; width:80px; background:#111; border-radius:999px;"></div>
+</div>`
+      }
+    };
+
+    function wirePicker(selectId, previewId, copyId, templates) {
+      const select = document.getElementById(selectId);
+      const preview = document.getElementById(previewId);
+      const copyBtn = document.getElementById(copyId);
+      if (!select || !preview || !copyBtn) {
+        return;
+      }
+
+      function renderPreview() {
+        const key = select.value;
+        preview.innerHTML = key && templates[key] ? templates[key].preview : '';
+      }
+
+      select.addEventListener('change', renderPreview);
+      copyBtn.addEventListener('click', async function () {
+        const key = select.value;
+        if (!key || !templates[key]) {
+          return;
+        }
+        const html = templates[key].html;
+        try {
+          await navigator.clipboard.writeText(html);
+          copyBtn.textContent = 'Copied';
+          setTimeout(() => (copyBtn.textContent = 'Copy HTML'), 1200);
+        } catch (err) {
+          copyBtn.textContent = 'Copy failed';
+          setTimeout(() => (copyBtn.textContent = 'Copy HTML'), 1200);
+        }
+      });
+
+      renderPreview();
+    }
+
+    wirePicker('signupTemplateSelect', 'signupTemplatePreview', 'copySignupTemplate', signupTemplates);
+    wirePicker('newsletterTemplateSelect', 'newsletterTemplatePreview', 'copyNewsletterTemplate', emailTemplates);
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/newsletter/views/admin/subscribers.php

@@ -0,0 +1,46 @@
+<?php
+$pageTitle = 'Newsletter';
+$subscribers = $subscribers ?? [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Newsletter</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Subscribers</h1>
+      <p style="color: var(--muted); margin-top:6px;">People on your newsletter list.</p>
+    </div>
+    <a href="/admin/newsletter" class="btn outline small">Back to Campaigns</a>
+  </div>
+
+  <div style="margin-top:18px; display:grid; gap:10px;">
+    <div style="display:grid; grid-template-columns: 1.5fr 1.5fr 120px 160px 120px; gap:12px; font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+      <div>Email</div>
+      <div>Name</div>
+      <div>Status</div>
+      <div>Joined</div>
+      <div>Actions</div>
+    </div>
+    <?php if (!$subscribers): ?>
+      <div style="color: var(--muted); font-size:13px;">No subscribers yet.</div>
+    <?php else: ?>
+      <?php foreach ($subscribers as $sub): ?>
+        <div style="display:grid; grid-template-columns: 1.5fr 1.5fr 120px 160px 120px; gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($sub['email'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($sub['name'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:<?= ((string)($sub['status'] ?? '') === 'subscribed') ? 'var(--accent-2)' : 'var(--muted)' ?>;">
+            <?= htmlspecialchars((string)($sub['status'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($sub['created_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <form method="post" action="/admin/newsletter/subscribers/delete" onsubmit="return confirm('Delete this subscriber?');">
+            <input type="hidden" name="id" value="<?= (int)($sub['id'] ?? 0) ?>">
+            <button type="submit" class="btn outline small">Delete</button>
+          </form>
+        </div>
+      <?php endforeach; ?>
+    <?php endif; ?>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/newsletter/views/site/unsubscribe.php

@@ -0,0 +1,23 @@
+<?php
+$pageTitle = $title ?? 'Unsubscribe';
+$email = $email ?? '';
+$status = $status ?? '';
+ob_start();
+?>
+<section class="card">
+  <div class="badge">Newsletter</div>
+  <h1 style="margin-top:12px; font-size:30px;">Unsubscribe</h1>
+  <p style="color:var(--muted); margin-top:8px;">Remove your email from the newsletter list.</p>
+
+  <?php if ($status !== ''): ?>
+    <div style="margin-top:12px; color:var(--muted);"><?= htmlspecialchars($status, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/newsletter/unsubscribe" style="margin-top:14px; display:grid; gap:10px;">
+    <input class="input" name="email" value="<?= htmlspecialchars((string)$email, ENT_QUOTES, 'UTF-8') ?>" placeholder="you@example.com">
+    <button type="submit" class="btn" style="width:max-content;">Unsubscribe</button>
+  </form>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../views/site/layout.php';

modules/pages/PagesController.php

@@ -0,0 +1,255 @@
+<?php
+declare(strict_types=1);
+
+namespace Modules\Pages;
+
+use Core\Http\Response;
+use Core\Services\Auth;
+use Core\Services\Database;
+use Core\Services\Shortcodes;
+use Core\Views\View;
+use PDO;
+use Throwable;
+
+class PagesController
+{
+    private View $view;
+
+    public function __construct()
+    {
+        $this->view = new View(__DIR__ . '/views');
+    }
+
+    public function show(): Response
+    {
+        $slug = trim((string)($_GET['slug'] ?? ''));
+        if ($slug === '') {
+            return $this->notFound();
+        }
+
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return $this->notFound();
+        }
+
+        $stmt = $db->prepare("SELECT title, content_html FROM ac_pages WHERE slug = :slug AND is_published = 1 LIMIT 1");
+        $stmt->execute([':slug' => $slug]);
+        $page = $stmt->fetch(PDO::FETCH_ASSOC);
+        if (!$page) {
+            return $this->notFound();
+        }
+
+        return new Response($this->view->render('site/show.php', [
+            'title' => (string)$page['title'],
+            'content_html' => Shortcodes::render((string)$page['content_html'], [
+                'page_slug' => $slug,
+                'page_title' => (string)$page['title'],
+            ]),
+        ]));
+    }
+
+    public function adminIndex(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager', 'editor'])) {
+            return $guard;
+        }
+
+        $db = Database::get();
+        $pages = [];
+        if ($db instanceof PDO) {
+            try {
+            $stmt = $db->query("SELECT id, title, slug, is_published, is_home, is_blog_index, updated_at FROM ac_pages ORDER BY updated_at DESC");
+                $pages = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+            } catch (Throwable $e) {
+                $pages = [];
+            }
+        }
+
+        return new Response($this->view->render('admin/index.php', [
+            'title' => 'Pages',
+            'pages' => $pages,
+        ]));
+    }
+
+    public function adminEdit(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager', 'editor'])) {
+            return $guard;
+        }
+
+        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
+        $page = [
+            'id' => 0,
+            'title' => '',
+            'slug' => '',
+            'content_html' => '',
+            'is_published' => 0,
+            'is_home' => 0,
+            'is_blog_index' => 0,
+        ];
+
+        $db = Database::get();
+        if ($id > 0 && $db instanceof PDO) {
+            $stmt = $db->prepare("SELECT id, title, slug, content_html, is_published, is_home, is_blog_index FROM ac_pages WHERE id = :id LIMIT 1");
+            $stmt->execute([':id' => $id]);
+            $row = $stmt->fetch(PDO::FETCH_ASSOC);
+            if ($row) {
+                $page = $row;
+            }
+        }
+
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Page' : 'New Page',
+            'page' => $page,
+            'error' => '',
+        ]));
+    }
+
+    public function adminSave(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager', 'editor'])) {
+            return $guard;
+        }
+
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/pages']);
+        }
+
+        $id = (int)($_POST['id'] ?? 0);
+        $title = trim((string)($_POST['title'] ?? ''));
+        $slug = trim((string)($_POST['slug'] ?? ''));
+        $content = (string)($_POST['content_html'] ?? '');
+        $isPublished = isset($_POST['is_published']) ? 1 : 0;
+        $isHome = isset($_POST['is_home']) ? 1 : 0;
+        $isBlogIndex = isset($_POST['is_blog_index']) ? 1 : 0;
+
+        if ($title === '') {
+            return $this->renderEditError($id, $title, $slug, $content, $isPublished, $isHome, $isBlogIndex, 'Title is required.');
+        }
+
+        if ($slug === '') {
+            $slug = $this->slugify($title);
+        } else {
+            $slug = $this->slugify($slug);
+        }
+
+        try {
+            if ($id > 0) {
+                $chk = $db->prepare("SELECT id FROM ac_pages WHERE slug = :slug AND id != :id LIMIT 1");
+                $chk->execute([':slug' => $slug, ':id' => $id]);
+            } else {
+                $chk = $db->prepare("SELECT id FROM ac_pages WHERE slug = :slug LIMIT 1");
+                $chk->execute([':slug' => $slug]);
+            }
+            if ($chk->fetch()) {
+                return $this->renderEditError($id, $title, $slug, $content, $isPublished, $isHome, $isBlogIndex, 'Slug already exists.');
+            }
+
+            if ($isHome === 1) {
+                $db->exec("UPDATE ac_pages SET is_home = 0");
+            }
+            if ($isBlogIndex === 1) {
+                $db->exec("UPDATE ac_pages SET is_blog_index = 0");
+            }
+
+            if ($id > 0) {
+                $stmt = $db->prepare("
+                    UPDATE ac_pages
+                    SET title = :title, slug = :slug, content_html = :content,
+                        is_published = :published, is_home = :is_home, is_blog_index = :is_blog_index
+                    WHERE id = :id
+                ");
+                $stmt->execute([
+                    ':title' => $title,
+                    ':slug' => $slug,
+                    ':content' => $content,
+                    ':published' => $isPublished,
+                    ':is_home' => $isHome,
+                    ':is_blog_index' => $isBlogIndex,
+                    ':id' => $id,
+                ]);
+            } else {
+                $stmt = $db->prepare("
+                    INSERT INTO ac_pages (title, slug, content_html, is_published, is_home, is_blog_index)
+                    VALUES (:title, :slug, :content, :published, :is_home, :is_blog_index)
+                ");
+                $stmt->execute([
+                    ':title' => $title,
+                    ':slug' => $slug,
+                    ':content' => $content,
+                    ':published' => $isPublished,
+                    ':is_home' => $isHome,
+                    ':is_blog_index' => $isBlogIndex,
+                ]);
+            }
+        } catch (Throwable $e) {
+            return $this->renderEditError($id, $title, $slug, $content, $isPublished, $isHome, $isBlogIndex, 'Unable to save page.');
+        }
+
+        return new Response('', 302, ['Location' => '/admin/pages']);
+    }
+
+    public function adminDelete(): Response
+    {
+        if ($guard = $this->guard(['admin', 'manager'])) {
+            return $guard;
+        }
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return new Response('', 302, ['Location' => '/admin/pages']);
+        }
+        $id = (int)($_POST['id'] ?? 0);
+        if ($id > 0) {
+            $stmt = $db->prepare("DELETE FROM ac_pages WHERE id = :id");
+            $stmt->execute([':id' => $id]);
+        }
+        return new Response('', 302, ['Location' => '/admin/pages']);
+    }
+
+    private function renderEditError(int $id, string $title, string $slug, string $content, int $isPublished, int $isHome, int $isBlogIndex, string $error): Response
+    {
+        $page = [
+            'id' => $id,
+            'title' => $title,
+            'slug' => $slug,
+            'content_html' => $content,
+            'is_published' => $isPublished,
+            'is_home' => $isHome,
+            'is_blog_index' => $isBlogIndex,
+        ];
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Page' : 'New Page',
+            'page' => $page,
+            'error' => $error,
+        ]));
+    }
+
+    private function notFound(): Response
+    {
+        $view = new View();
+        return new Response($view->render('site/404.php', [
+            'title' => 'Not Found',
+            'message' => 'Page not found.',
+        ]), 404);
+    }
+
+    private function slugify(string $value): string
+    {
+        $value = strtolower(trim($value));
+        $value = preg_replace('~[^a-z0-9]+~', '-', $value) ?? $value;
+        $value = trim($value, '-');
+        return $value !== '' ? $value : 'page';
+    }
+
+    private function guard(array $roles): ?Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole($roles)) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        return null;
+    }
+}

modules/pages/module.php

@@ -0,0 +1,18 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Modules\Pages\PagesController;
+
+require_once __DIR__ . '/PagesController.php';
+
+return function (Router $router): void {
+    $controller = new PagesController();
+    $router->get('/page', [$controller, 'show']);
+
+    $router->get('/admin/pages', [$controller, 'adminIndex']);
+    $router->get('/admin/pages/new', [$controller, 'adminEdit']);
+    $router->get('/admin/pages/edit', [$controller, 'adminEdit']);
+    $router->post('/admin/pages/save', [$controller, 'adminSave']);
+    $router->post('/admin/pages/delete', [$controller, 'adminDelete']);
+};

modules/pages/views/admin/edit.php

@@ -0,0 +1,122 @@
+<?php
+$pageTitle = $title ?? 'Edit Page';
+$page = $page ?? [];
+$error = $error ?? '';
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Pages</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;"><?= htmlspecialchars($pageTitle, ENT_QUOTES, 'UTF-8') ?></h1>
+      <p style="color: var(--muted); margin-top:6px;">Create a custom page for the site.</p>
+    </div>
+    <a href="/admin/pages" class="btn outline">Back</a>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/pages/save" style="margin-top:18px; display:grid; gap:16px;">
+    <input type="hidden" name="id" value="<?= (int)($page['id'] ?? 0) ?>">
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Title</label>
+        <input class="input" name="title" value="<?= htmlspecialchars((string)($page['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="About">
+        <label class="label">Slug</label>
+        <input class="input" name="slug" value="<?= htmlspecialchars((string)($page['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="about">
+        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px;">
+          <label class="label" style="margin:0;">Content (HTML)</label>
+          <button type="button" class="btn outline small" data-media-picker="content_html">Insert Media</button>
+        </div>
+        <textarea class="input" name="content_html" id="content_html" rows="18" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:13px; line-height:1.6;"></textarea>
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="is_published" value="1" <?= ((int)($page['is_published'] ?? 0) === 1) ? 'checked' : '' ?>>
+          Published
+        </label>
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="is_home" value="1" <?= ((int)($page['is_home'] ?? 0) === 1) ? 'checked' : '' ?>>
+          Set as Home Page
+        </label>
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="is_blog_index" value="1" <?= ((int)($page['is_blog_index'] ?? 0) === 1) ? 'checked' : '' ?>>
+          Set as Blog Page
+        </label>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end; gap:12px; align-items:center;">
+      <button type="button" id="previewPage" class="btn outline">Preview</button>
+      <button type="submit" class="btn">Save page</button>
+    </div>
+  </form>
+
+  <?php if (!empty($page['id'])): ?>
+    <form method="post" action="/admin/pages/delete" onsubmit="return confirm('Delete this page?');" style="margin-top:12px;">
+      <input type="hidden" name="id" value="<?= (int)($page['id'] ?? 0) ?>">
+      <button type="submit" class="btn outline">Delete</button>
+    </form>
+  <?php endif; ?>
+</section>
+<script>
+  (function () {
+    const inputEl = document.getElementById('content_html');
+    const previewBtn = document.getElementById('previewPage');
+    if (!inputEl || !previewBtn) {
+      return;
+    }
+
+    const rawHtml = <?=
+      json_encode((string)($page['content_html'] ?? ''), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)
+    ?>;
+    inputEl.value = rawHtml || '';
+
+    previewBtn.addEventListener('click', function () {
+      const previewWindow = window.open('', 'pagePreview', 'width=1200,height=800');
+      if (!previewWindow) {
+        return;
+      }
+      const html = inputEl.value || '';
+      const doc = previewWindow.document;
+      doc.open();
+      doc.write(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Page Preview</title>
+  <style>
+    body {
+      margin: 0;
+      font-family: 'Syne', sans-serif;
+      background-color: #14151a;
+      color: #f5f7ff;
+    }
+    .shell { max-width: 1080px; margin: 0 auto; padding: 32px 24px 64px; }
+    .card {
+      border-radius: 24px;
+      background: rgba(20, 22, 28, 0.75);
+      border: 1px solid rgba(255,255,255,0.12);
+      box-shadow: 0 20px 50px rgba(0,0,0,0.3);
+      padding: 28px;
+    }
+    a { color: #9ad4ff; }
+  </style>
+  <link href="https://fonts.googleapis.com/css2?family=Syne:wght@500;600;700&family=IBM+Plex+Mono:wght@400;600&display=swap" rel="stylesheet">
+</head>
+<body>
+  <main class="shell">
+    <section class="card">
+      ${html}
+    </section>
+  </main>
+</body>
+</html>`);
+      doc.close();
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/pages/views/admin/home.php

@@ -0,0 +1,42 @@
+<?php
+$pageTitle = 'Home Page';
+$page = $page ?? [];
+$saved = ($saved ?? '') === '1';
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Home</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Home Page</h1>
+      <p style="color: var(--muted); margin-top:6px;">Edit the front page content. Leave title blank to hide it.</p>
+    </div>
+    <a href="/" class="btn outline small">View site</a>
+  </div>
+
+  <?php if ($saved): ?>
+    <div style="margin-top:16px; color:var(--accent-2); font-size:13px;">Home page updated.</div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/home/save" style="margin-top:18px; display:grid; gap:16px;">
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Title</label>
+        <input class="input" name="title" value="<?= htmlspecialchars((string)($page['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="AudioCore">
+        <label class="label">Content (HTML)</label>
+        <textarea class="input" name="content_html" rows="12" style="resize:vertical;"><?= htmlspecialchars((string)($page['content_html'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="is_published" value="1" <?= ((int)($page['is_published'] ?? 0) === 1) ? 'checked' : '' ?>>
+          Published
+        </label>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end;">
+      <button type="submit" class="btn">Save home page</button>
+    </div>
+  </form>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/pages/views/admin/index.php

@@ -0,0 +1,58 @@
+<?php
+$pageTitle = 'Pages';
+$pages = $pages ?? [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Pages</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Pages</h1>
+      <p style="color: var(--muted); margin-top:6px;">Manage custom content pages.</p>
+    </div>
+    <a href="/admin/pages/new" class="btn small">New Page</a>
+  </div>
+
+  <div style="margin-top:18px; display:grid; gap:10px;">
+    <div style="display:grid; grid-template-columns: 2fr 1fr 120px 120px 120px 160px 120px; gap:12px; font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+      <div>Title</div>
+      <div>Slug</div>
+      <div>Status</div>
+      <div>Home</div>
+      <div>Blog</div>
+      <div>Updated</div>
+      <div>Actions</div>
+    </div>
+    <?php if (!$pages): ?>
+      <div style="color: var(--muted); font-size:13px;">No pages yet.</div>
+    <?php else: ?>
+      <?php foreach ($pages as $page): ?>
+        <div style="display:grid; grid-template-columns: 2fr 1fr 120px 120px 120px 160px 120px; gap:12px; align-items:center; padding:10px 12px; border-radius:16px; border:1px solid var(--stroke); background: rgba(14,14,16,0.9);">
+          <div style="font-weight:600;"><?= htmlspecialchars((string)($page['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:12px; color:var(--muted); font-family: 'IBM Plex Mono', monospace;">
+            <?= htmlspecialchars((string)($page['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <div style="font-size:12px; color:<?= ((int)($page['is_published'] ?? 0) === 1) ? 'var(--accent-2)' : 'var(--muted)' ?>;">
+            <?= ((int)($page['is_published'] ?? 0) === 1) ? 'Published' : 'Draft' ?>
+          </div>
+          <div style="font-size:12px; color:<?= ((int)($page['is_home'] ?? 0) === 1) ? 'var(--accent-2)' : 'var(--muted)' ?>;">
+            <?= ((int)($page['is_home'] ?? 0) === 1) ? 'Yes' : 'No' ?>
+          </div>
+          <div style="font-size:12px; color:<?= ((int)($page['is_blog_index'] ?? 0) === 1) ? 'var(--accent-2)' : 'var(--muted)' ?>;">
+            <?= ((int)($page['is_blog_index'] ?? 0) === 1) ? 'Yes' : 'No' ?>
+          </div>
+          <div style="font-size:12px; color:var(--muted);">
+            <?= htmlspecialchars((string)($page['updated_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+          </div>
+          <div style="display:flex; gap:8px;">
+            <a href="/admin/pages/edit?id=<?= (int)$page['id'] ?>" class="btn outline small">Edit</a>
+            <a href="/<?= htmlspecialchars((string)($page['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" class="btn outline small">View</a>
+          </div>
+        </div>
+      <?php endforeach; ?>
+    <?php endif; ?>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

modules/pages/views/site/show.php

@@ -0,0 +1,13 @@
+<?php
+$pageTitle = $title ?? 'Page';
+$contentHtml = $content_html ?? '';
+ob_start();
+?>
+<section class="card">
+  <div style="margin-top:14px; color:var(--muted); line-height:1.8;">
+    <?= $contentHtml ?>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';

modules/plugins/PluginsController.php

@@ -0,0 +1,55 @@
+<?php
+declare(strict_types=1);
+
+namespace Modules\Plugins;
+
+use Core\Http\Response;
+use Core\Services\Auth;
+use Core\Services\Plugins;
+use Core\Views\View;
+
+class PluginsController
+{
+    private View $view;
+
+    public function __construct()
+    {
+        $this->view = new View(__DIR__ . '/views');
+    }
+
+    public function index(): Response
+    {
+        if ($guard = $this->guard()) {
+            return $guard;
+        }
+        Plugins::sync();
+        return new Response($this->view->render('admin/index.php', [
+            'title' => 'Plugins',
+            'plugins' => Plugins::all(),
+        ]));
+    }
+
+    public function toggle(): Response
+    {
+        if ($guard = $this->guard()) {
+            return $guard;
+        }
+        $slug = trim((string)($_POST['slug'] ?? ''));
+        $enabled = isset($_POST['enabled']) && $_POST['enabled'] === '1';
+        if ($slug !== '') {
+            Plugins::toggle($slug, $enabled);
+        }
+        return new Response('', 302, ['Location' => '/admin/plugins']);
+    }
+
+    private function guard(): ?Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        return null;
+    }
+}

modules/plugins/module.php

@@ -0,0 +1,13 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Modules\Plugins\PluginsController;
+
+require_once __DIR__ . '/PluginsController.php';
+
+return function (Router $router): void {
+    $controller = new PluginsController();
+    $router->get('/admin/plugins', [$controller, 'index']);
+    $router->post('/admin/plugins/toggle', [$controller, 'toggle']);
+};

modules/plugins/views/admin/index.php

@@ -0,0 +1,55 @@
+<?php
+$pageTitle = $title ?? 'Plugins';
+$plugins = $plugins ?? [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Plugins</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Plugins</h1>
+      <p style="color: var(--muted); margin-top:6px;">Enable or disable optional features.</p>
+    </div>
+  </div>
+
+  <?php if (!$plugins): ?>
+    <div style="margin-top:18px; color: var(--muted); font-size:13px;">No plugins found in <code>/dev/plugins</code>.</div>
+  <?php else: ?>
+    <div style="margin-top:18px; display:grid; gap:12px;">
+      <?php foreach ($plugins as $plugin): ?>
+        <div class="admin-card" style="padding:16px; display:grid; gap:10px;">
+          <div style="display:flex; align-items:flex-start; justify-content:space-between; gap:16px;">
+            <div>
+              <div style="font-size:18px; font-weight:600;">
+                <?= htmlspecialchars((string)($plugin['name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+              </div>
+              <div style="font-size:12px; color: var(--muted); margin-top:4px;">
+                <?= htmlspecialchars((string)($plugin['description'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+              </div>
+              <div style="margin-top:8px; font-size:12px; color: var(--muted); display:flex; gap:14px; flex-wrap:wrap;">
+                <span>Slug: <?= htmlspecialchars((string)($plugin['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+                <span>Version: <?= htmlspecialchars((string)($plugin['version'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+                <?php if (!empty($plugin['author'])): ?>
+                  <span>Author: <?= htmlspecialchars((string)$plugin['author'], ENT_QUOTES, 'UTF-8') ?></span>
+                <?php endif; ?>
+              </div>
+            </div>
+            <form method="post" action="/admin/plugins/toggle" style="display:flex; align-items:center; gap:10px;">
+              <input type="hidden" name="slug" value="<?= htmlspecialchars((string)($plugin['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+              <?php if (!empty($plugin['is_enabled'])): ?>
+                <input type="hidden" name="enabled" value="0">
+                <button type="submit" class="btn outline small">Disable</button>
+              <?php else: ?>
+                <input type="hidden" name="enabled" value="1">
+                <button type="submit" class="btn small">Enable</button>
+              <?php endif; ?>
+            </form>
+          </div>
+        </div>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../admin/views/layout.php';

plugins/.gitkeep

@@ -0,0 +1 @@
+

plugins/artists/ArtistsController.php

@@ -0,0 +1,540 @@
+<?php
+declare(strict_types=1);
+
+namespace Plugins\Artists;
+
+use Core\Http\Response;
+use Core\Services\Auth;
+use Core\Views\View;
+use Core\Services\Database;
+use PDO;
+use Throwable;
+
+class ArtistsController
+{
+    private View $view;
+
+    public function __construct()
+    {
+        $this->view = new View(__DIR__ . '/views');
+    }
+
+    public function index(): Response
+    {
+        $db = Database::get();
+        $page = null;
+        $artists = [];
+        if ($db instanceof PDO) {
+            try {
+                $stmt = $db->prepare("SELECT title, content_html FROM ac_pages WHERE slug = 'artists' AND is_published = 1 LIMIT 1");
+                $stmt->execute();
+                $page = $stmt->fetch(PDO::FETCH_ASSOC) ?: null;
+                $listStmt = $db->query("
+                    SELECT id, name, slug, country, avatar_url
+                    FROM ac_artists
+                    WHERE is_active = 1
+                    ORDER BY created_at DESC
+                ");
+                $artists = $listStmt ? $listStmt->fetchAll(PDO::FETCH_ASSOC) : [];
+            } catch (Throwable $e) {
+            }
+        }
+
+        return new Response($this->view->render('site/index.php', [
+            'title' => (string)($page['title'] ?? 'Artists'),
+            'content_html' => (string)($page['content_html'] ?? ''),
+            'artists' => $artists,
+        ]));
+    }
+
+    public function show(): Response
+    {
+        $slug = trim((string)($_GET['slug'] ?? ''));
+        $artist = null;
+        $artistReleases = [];
+        if ($slug !== '') {
+            $db = Database::get();
+            if ($db instanceof PDO) {
+                $stmt = $db->prepare("SELECT * FROM ac_artists WHERE slug = :slug AND is_active = 1 LIMIT 1");
+                $stmt->execute([':slug' => $slug]);
+                $artist = $stmt->fetch(PDO::FETCH_ASSOC) ?: null;
+                if ($artist) {
+                    try {
+                        $artistIdReady = false;
+                        $probe = $db->query("SHOW COLUMNS FROM ac_releases LIKE 'artist_id'");
+                        if ($probe && $probe->fetch(PDO::FETCH_ASSOC)) {
+                            $artistIdReady = true;
+                        }
+
+                        if ($artistIdReady) {
+                            $relStmt = $db->prepare("
+                                SELECT id, title, slug, release_date, cover_url, artist_name
+                                FROM ac_releases
+                                WHERE is_published = 1
+                                  AND (artist_id = :artist_id OR artist_name = :artist_name)
+                                ORDER BY release_date DESC, created_at DESC
+                                LIMIT 2
+                            ");
+                            $relStmt->execute([
+                                ':artist_id' => (int)($artist['id'] ?? 0),
+                                ':artist_name' => (string)($artist['name'] ?? ''),
+                            ]);
+                        } else {
+                            $relStmt = $db->prepare("
+                                SELECT id, title, slug, release_date, cover_url, artist_name
+                                FROM ac_releases
+                                WHERE is_published = 1
+                                  AND artist_name = :artist_name
+                                ORDER BY release_date DESC, created_at DESC
+                                LIMIT 2
+                            ");
+                            $relStmt->execute([
+                                ':artist_name' => (string)($artist['name'] ?? ''),
+                            ]);
+                        }
+
+                        $artistReleases = $relStmt->fetchAll(PDO::FETCH_ASSOC) ?: [];
+                    } catch (Throwable $e) {
+                        $artistReleases = [];
+                    }
+                }
+            }
+        }
+        return new Response($this->view->render('site/show.php', [
+            'title' => $artist ? (string)$artist['name'] : 'Artist Profile',
+            'artist' => $artist,
+            'artist_releases' => $artistReleases,
+        ]));
+    }
+
+    public function adminIndex(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        $tableReady = $this->artistsTableReady();
+        $socialReady = $this->socialColumnReady();
+        $artists = [];
+        $pageId = 0;
+        $pagePublished = 0;
+        if ($tableReady) {
+            $db = Database::get();
+            if ($db instanceof PDO) {
+                $stmt = $db->query("SELECT id, name, slug, country, avatar_url, is_active FROM ac_artists ORDER BY created_at DESC");
+                $artists = $stmt ? $stmt->fetchAll(PDO::FETCH_ASSOC) : [];
+                $pageStmt = $db->prepare("SELECT id, is_published FROM ac_pages WHERE slug = 'artists' LIMIT 1");
+                $pageStmt->execute();
+                $pageRow = $pageStmt->fetch(PDO::FETCH_ASSOC);
+                if ($pageRow) {
+                    $pageId = (int)($pageRow['id'] ?? 0);
+                    $pagePublished = (int)($pageRow['is_published'] ?? 0);
+                }
+            }
+        }
+        return new Response($this->view->render('admin/index.php', [
+            'title' => 'Artists',
+            'table_ready' => $tableReady,
+            'social_ready' => $socialReady,
+            'artists' => $artists,
+            'page_id' => $pageId,
+            'page_published' => $pagePublished,
+        ]));
+    }
+
+    public function adminNew(): Response
+    {
+        return $this->adminEdit(0);
+    }
+
+    public function adminEdit(int $id = 0): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        $artist = [
+            'id' => 0,
+            'name' => '',
+            'slug' => '',
+            'bio' => '',
+            'credits' => '',
+            'country' => '',
+            'avatar_url' => '',
+            'social_links' => '',
+            'is_active' => 1,
+        ];
+        if ($id > 0) {
+            $db = Database::get();
+            if ($db instanceof PDO) {
+                $stmt = $db->prepare("SELECT * FROM ac_artists WHERE id = :id LIMIT 1");
+                $stmt->execute([':id' => $id]);
+                $row = $stmt->fetch(PDO::FETCH_ASSOC);
+                if ($row) {
+                    $artist = array_merge($artist, $row);
+                }
+            }
+        }
+        if (!empty($_GET['avatar_url']) && $artist['avatar_url'] === '') {
+            $artist['avatar_url'] = (string)$_GET['avatar_url'];
+        }
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Artist' : 'New Artist',
+            'artist' => $artist,
+            'error' => '',
+        ]));
+    }
+
+    public function adminSave(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        $id = (int)($_POST['id'] ?? 0);
+        $name = trim((string)($_POST['name'] ?? ''));
+        $slug = trim((string)($_POST['slug'] ?? ''));
+        $bio = trim((string)($_POST['bio'] ?? ''));
+        $credits = trim((string)($_POST['credits'] ?? ''));
+        $country = trim((string)($_POST['country'] ?? ''));
+        $avatarUrl = trim((string)($_POST['avatar_url'] ?? ''));
+        $socialLinks = [
+            'website' => $this->normalizeUrl(trim((string)($_POST['social_website'] ?? ''))),
+            'instagram' => $this->normalizeUrl(trim((string)($_POST['social_instagram'] ?? ''))),
+            'soundcloud' => $this->normalizeUrl(trim((string)($_POST['social_soundcloud'] ?? ''))),
+            'spotify' => $this->normalizeUrl(trim((string)($_POST['social_spotify'] ?? ''))),
+            'youtube' => $this->normalizeUrl(trim((string)($_POST['social_youtube'] ?? ''))),
+            'tiktok' => $this->normalizeUrl(trim((string)($_POST['social_tiktok'] ?? ''))),
+            'bandcamp' => $this->normalizeUrl(trim((string)($_POST['social_bandcamp'] ?? ''))),
+            'beatport' => $this->normalizeUrl(trim((string)($_POST['social_beatport'] ?? ''))),
+            'facebook' => $this->normalizeUrl(trim((string)($_POST['social_facebook'] ?? ''))),
+            'x' => $this->normalizeUrl(trim((string)($_POST['social_x'] ?? ''))),
+        ];
+        $socialLinks = array_filter($socialLinks, static fn($value) => $value !== '');
+        $socialJson = $socialLinks ? json_encode($socialLinks, JSON_UNESCAPED_SLASHES) : null;
+        $socialReady = $this->socialColumnReady();
+        $creditsReady = $this->creditsColumnReady();
+        $isActive = isset($_POST['is_active']) ? 1 : 0;
+
+        if ($name === '') {
+            return $this->saveError($id, 'Name is required.');
+        }
+        $slug = $slug !== '' ? $this->slugify($slug) : $this->slugify($name);
+
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return $this->saveError($id, 'Database unavailable.');
+        }
+
+        $dupStmt = $id > 0
+            ? $db->prepare("SELECT id FROM ac_artists WHERE slug = :slug AND id != :id LIMIT 1")
+            : $db->prepare("SELECT id FROM ac_artists WHERE slug = :slug LIMIT 1");
+        $params = $id > 0 ? [':slug' => $slug, ':id' => $id] : [':slug' => $slug];
+        $dupStmt->execute($params);
+        if ($dupStmt->fetch()) {
+            return $this->saveError($id, 'Slug already exists.');
+        }
+
+        try {
+            if ($id > 0) {
+                $stmt = $db->prepare("
+                    UPDATE ac_artists
+                    SET name = :name, slug = :slug, bio = :bio" . ($creditsReady ? ", credits = :credits" : "") . ", country = :country,
+                        avatar_url = :avatar_url" . ($socialReady ? ", social_links = :social_links" : "") . ",
+                        is_active = :is_active
+                    WHERE id = :id
+                ");
+                $params = [
+                    ':name' => $name,
+                    ':slug' => $slug,
+                    ':bio' => $bio !== '' ? $bio : null,
+                    ':country' => $country !== '' ? $country : null,
+                    ':avatar_url' => $avatarUrl !== '' ? $avatarUrl : null,
+                    ':is_active' => $isActive,
+                    ':id' => $id,
+                ];
+                if ($creditsReady) {
+                    $params[':credits'] = $credits !== '' ? $credits : null;
+                }
+                if ($socialReady) {
+                    $params[':social_links'] = $socialJson;
+                }
+                $stmt->execute($params);
+            } else {
+                $stmt = $db->prepare("
+                    INSERT INTO ac_artists (name, slug, bio" . ($creditsReady ? ", credits" : "") . ", country, avatar_url" . ($socialReady ? ", social_links" : "") . ", is_active)
+                    VALUES (:name, :slug, :bio" . ($creditsReady ? ", :credits" : "") . ", :country, :avatar_url" . ($socialReady ? ", :social_links" : "") . ", :is_active)
+                ");
+                $params = [
+                    ':name' => $name,
+                    ':slug' => $slug,
+                    ':bio' => $bio !== '' ? $bio : null,
+                    ':country' => $country !== '' ? $country : null,
+                    ':avatar_url' => $avatarUrl !== '' ? $avatarUrl : null,
+                    ':is_active' => $isActive,
+                ];
+                if ($creditsReady) {
+                    $params[':credits'] = $credits !== '' ? $credits : null;
+                }
+                if ($socialReady) {
+                    $params[':social_links'] = $socialJson;
+                }
+                $stmt->execute($params);
+            }
+        } catch (Throwable $e) {
+            error_log('AC artists save error: ' . $e->getMessage());
+            return $this->saveError($id, 'Unable to save artist. Check table columns and input.');
+        }
+
+        return new Response('', 302, ['Location' => '/admin/artists']);
+    }
+
+    public function adminDelete(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        $id = (int)($_POST['id'] ?? 0);
+        $db = Database::get();
+        if ($db instanceof PDO && $id > 0) {
+            $stmt = $db->prepare("DELETE FROM ac_artists WHERE id = :id");
+            $stmt->execute([':id' => $id]);
+        }
+        return new Response('', 302, ['Location' => '/admin/artists']);
+    }
+
+    public function adminUpload(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+        $file = $_FILES['artist_avatar'] ?? null;
+        $artistId = (int)($_POST['artist_id'] ?? 0);
+        if (!$file || !isset($file['tmp_name'])) {
+            return $this->uploadRedirect($artistId);
+        }
+        if ($file['error'] !== UPLOAD_ERR_OK) {
+            return $this->uploadRedirect($artistId, $this->uploadErrorMessage((int)$file['error']));
+        }
+
+        $tmp = (string)$file['tmp_name'];
+        if ($tmp === '' || !is_uploaded_file($tmp)) {
+            return $this->uploadRedirect($artistId);
+        }
+
+        $info = getimagesize($tmp);
+        if ($info === false) {
+            return $this->uploadRedirect($artistId, 'Avatar must be an image.');
+        }
+        $ext = image_type_to_extension($info[2], false);
+        $allowed = ['jpg', 'jpeg', 'png', 'webp'];
+        if (!in_array($ext, $allowed, true)) {
+            return $this->uploadRedirect($artistId, 'Avatar must be JPG, PNG, or WEBP.');
+        }
+
+        $uploadDir = __DIR__ . '/../../uploads/media';
+        if (!is_dir($uploadDir) && !mkdir($uploadDir, 0755, true)) {
+            return $this->uploadRedirect($artistId, 'Upload directory is not writable.');
+        }
+        if (!is_writable($uploadDir)) {
+            return $this->uploadRedirect($artistId, 'Upload directory is not writable.');
+        }
+
+        $baseName = preg_replace('~[^a-z0-9]+~', '-', strtolower((string)$file['name'])) ?? 'avatar';
+        $baseName = trim($baseName, '-');
+        $fileName = ($baseName !== '' ? $baseName : 'avatar') . '-' . date('YmdHis') . '.' . $ext;
+        $dest = $uploadDir . '/' . $fileName;
+        if (!move_uploaded_file($tmp, $dest)) {
+            return $this->uploadRedirect($artistId, 'Upload failed.');
+        }
+
+        $fileUrl = '/uploads/media/' . $fileName;
+        $fileType = (string)($file['type'] ?? '');
+        $fileSize = (int)($file['size'] ?? 0);
+
+        $db = Database::get();
+        if ($db instanceof PDO) {
+            try {
+                $stmt = $db->prepare("
+                    INSERT INTO ac_media (file_name, file_url, file_type, file_size, folder_id)
+                    VALUES (:name, :url, :type, :size, NULL)
+                ");
+                $stmt->execute([
+                    ':name' => (string)$file['name'],
+                    ':url' => $fileUrl,
+                    ':type' => $fileType,
+                    ':size' => $fileSize,
+                ]);
+            } catch (Throwable $e) {
+            }
+        }
+
+        if ($artistId > 0 && $db instanceof PDO) {
+            $stmt = $db->prepare("UPDATE ac_artists SET avatar_url = :url WHERE id = :id");
+            $stmt->execute([':url' => $fileUrl, ':id' => $artistId]);
+        }
+
+        return $this->uploadRedirect($artistId, '', $fileUrl);
+    }
+
+    public function adminInstall(): Response
+    {
+        if (!Auth::check()) {
+            return new Response('', 302, ['Location' => '/admin/login']);
+        }
+        if (!Auth::hasRole(['admin', 'manager'])) {
+            return new Response('', 302, ['Location' => '/admin']);
+        }
+
+        $db = Database::get();
+        if ($db instanceof PDO) {
+            try {
+                $db->exec("
+                    CREATE TABLE IF NOT EXISTS ac_artists (
+                        id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+                        name VARCHAR(200) NOT NULL,
+                        slug VARCHAR(200) NOT NULL UNIQUE,
+                        bio MEDIUMTEXT NULL,
+                        credits MEDIUMTEXT NULL,
+                        country VARCHAR(120) NULL,
+                        avatar_url VARCHAR(255) NULL,
+                        social_links TEXT NULL,
+                        is_active TINYINT(1) NOT NULL DEFAULT 1,
+                        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+                    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+                ");
+                $db->exec("ALTER TABLE ac_artists ADD COLUMN credits MEDIUMTEXT NULL");
+                $db->exec("ALTER TABLE ac_artists ADD COLUMN social_links TEXT NULL");
+            } catch (Throwable $e) {
+            }
+        }
+
+        return new Response('', 302, ['Location' => '/admin/artists']);
+    }
+
+    private function artistsTableReady(): bool
+    {
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return false;
+        }
+        try {
+            $stmt = $db->query("SELECT 1 FROM ac_artists LIMIT 1");
+            return $stmt !== false;
+        } catch (Throwable $e) {
+            return false;
+        }
+    }
+
+    private function socialColumnReady(): bool
+    {
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return false;
+        }
+        try {
+            $stmt = $db->query("SHOW COLUMNS FROM ac_artists LIKE 'social_links'");
+            $row = $stmt ? $stmt->fetch(PDO::FETCH_ASSOC) : null;
+            return (bool)$row;
+        } catch (Throwable $e) {
+            return false;
+        }
+    }
+
+    private function creditsColumnReady(): bool
+    {
+        $db = Database::get();
+        if (!$db instanceof PDO) {
+            return false;
+        }
+        try {
+            $stmt = $db->query("SHOW COLUMNS FROM ac_artists LIKE 'credits'");
+            $row = $stmt ? $stmt->fetch(PDO::FETCH_ASSOC) : null;
+            return (bool)$row;
+        } catch (Throwable $e) {
+            return false;
+        }
+    }
+
+    private function saveError(int $id, string $message): Response
+    {
+        return new Response($this->view->render('admin/edit.php', [
+            'title' => $id > 0 ? 'Edit Artist' : 'New Artist',
+            'artist' => [
+                'id' => $id,
+                'name' => (string)($_POST['name'] ?? ''),
+                'slug' => (string)($_POST['slug'] ?? ''),
+                'bio' => (string)($_POST['bio'] ?? ''),
+                'credits' => (string)($_POST['credits'] ?? ''),
+                'country' => (string)($_POST['country'] ?? ''),
+                'avatar_url' => (string)($_POST['avatar_url'] ?? ''),
+                'social_links' => '',
+                'is_active' => isset($_POST['is_active']) ? 1 : 0,
+            ],
+            'error' => $message,
+        ]));
+    }
+
+    private function slugify(string $value): string
+    {
+        $value = strtolower(trim($value));
+        $value = preg_replace('~[^a-z0-9]+~', '-', $value) ?? $value;
+        $value = trim($value, '-');
+        return $value !== '' ? $value : 'artist';
+    }
+
+    private function uploadRedirect(int $artistId, string $error = '', string $url = ''): Response
+    {
+        if ($artistId > 0) {
+            $target = '/admin/artists/edit?id=' . $artistId;
+        } else {
+            $target = '/admin/artists/new';
+        }
+        if ($url !== '') {
+            $target .= '&avatar_url=' . rawurlencode($url);
+        }
+        if ($error !== '') {
+            $target .= '&upload_error=' . rawurlencode($error);
+        }
+        return new Response('', 302, ['Location' => $target]);
+    }
+
+    private function uploadErrorMessage(int $code): string
+    {
+        $max = (string)ini_get('upload_max_filesize');
+        $map = [
+            UPLOAD_ERR_INI_SIZE => "File exceeds upload_max_filesize ({$max}).",
+            UPLOAD_ERR_FORM_SIZE => 'File exceeds form limit.',
+            UPLOAD_ERR_PARTIAL => 'File was only partially uploaded.',
+            UPLOAD_ERR_NO_TMP_DIR => 'Missing temp upload directory.',
+            UPLOAD_ERR_CANT_WRITE => 'Failed to write file to disk.',
+            UPLOAD_ERR_EXTENSION => 'Upload stopped by a PHP extension.',
+            UPLOAD_ERR_NO_FILE => 'No file uploaded.',
+        ];
+        return $map[$code] ?? 'Upload failed.';
+    }
+
+    private function normalizeUrl(string $value): string
+    {
+        if ($value === '') {
+            return '';
+        }
+        if (preg_match('~^(https?://)~i', $value)) {
+            return $value;
+        }
+        return 'https://' . $value;
+    }
+}

plugins/artists/plugin.json

@@ -0,0 +1,21 @@
+{
+  "name": "Artists",
+  "version": "0.1.0",
+  "description": "Public artist listings and profiles.",
+  "author": "AudioCore",
+  "admin_nav": {
+    "label": "Artists",
+    "url": "/admin/artists",
+    "roles": ["admin", "manager"],
+    "icon": "fa-solid fa-user"
+  },
+  "pages": [
+    {
+      "slug": "artists",
+      "title": "Artists",
+      "content_html": "<section class=\"card\"><div class=\"badge\">Artists</div><h1 style=\"margin-top:16px; font-size:28px;\">Artists</h1><p style=\"color:var(--muted);\">Add your artist roster here.</p></section>"
+    }
+  ],
+  "entry": "plugin.php",
+  "default_enabled": false
+}

plugins/artists/plugin.php

@@ -0,0 +1,23 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Plugins\Artists\ArtistsController;
+
+require_once __DIR__ . '/ArtistsController.php';
+
+return function (Router $router): void {
+    $controller = new ArtistsController();
+    $router->get('/artists', [$controller, 'index']);
+    $router->get('/artist', [$controller, 'show']);
+    $router->get('/admin/artists', [$controller, 'adminIndex']);
+    $router->post('/admin/artists/install', [$controller, 'adminInstall']);
+    $router->get('/admin/artists/new', [$controller, 'adminNew']);
+    $router->get('/admin/artists/edit', function () use ($controller): Core\Http\Response {
+        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
+        return $controller->adminEdit($id);
+    });
+    $router->post('/admin/artists/upload', [$controller, 'adminUpload']);
+    $router->post('/admin/artists/save', [$controller, 'adminSave']);
+    $router->post('/admin/artists/delete', [$controller, 'adminDelete']);
+};

plugins/artists/views/admin/edit.php

@@ -0,0 +1,129 @@
+<?php
+$pageTitle = $title ?? 'Edit Artist';
+$artist = $artist ?? [];
+$error = $error ?? '';
+$uploadError = (string)($_GET['upload_error'] ?? '');
+$socialLinks = [];
+if (!empty($artist['social_links'])) {
+  $decoded = json_decode((string)$artist['social_links'], true);
+  if (is_array($decoded)) {
+    $socialLinks = $decoded;
+  }
+}
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Artists</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;"><?= htmlspecialchars($pageTitle, ENT_QUOTES, 'UTF-8') ?></h1>
+      <p style="color: var(--muted); margin-top:6px;">Create or update an artist profile.</p>
+    </div>
+    <a href="/admin/artists" class="btn outline">Back</a>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+  <?php if ($uploadError !== ''): ?>
+    <div style="margin-top:12px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($uploadError, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/artists/upload" enctype="multipart/form-data" id="artistAvatarUpload" style="margin-top:18px;">
+    <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+      <div class="label">Upload avatar</div>
+      <input type="hidden" name="artist_id" value="<?= (int)($artist['id'] ?? 0) ?>">
+      <label for="artistAvatarFile" id="artistAvatarDropzone" style="display:flex; flex-direction:column; gap:8px; align-items:center; justify-content:center; padding:18px; border-radius:14px; border:1px dashed rgba(255,255,255,0.2); background: rgba(0,0,0,0.2); cursor:pointer;">
+        <div style="font-size:11px; text-transform:uppercase; letter-spacing:0.2em; color:var(--muted);">Drag &amp; Drop</div>
+        <div style="font-size:13px; color:var(--text);">or click to upload</div>
+        <div id="artistAvatarFileName" style="font-size:11px; color:var(--muted);">No file selected</div>
+      </label>
+      <input class="input" type="file" id="artistAvatarFile" name="artist_avatar" accept="image/*" style="display:none;">
+      <div style="margin-top:10px; display:flex; justify-content:flex-end;">
+        <button type="submit" class="btn small">Upload</button>
+      </div>
+    </div>
+  </form>
+
+  <form method="post" action="/admin/artists/save" style="margin-top:16px; display:grid; gap:16px;">
+    <input type="hidden" name="id" value="<?= (int)($artist['id'] ?? 0) ?>">
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Name</label>
+        <input class="input" name="name" value="<?= htmlspecialchars((string)($artist['name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Artist name">
+        <label class="label">Slug</label>
+        <input class="input" name="slug" value="<?= htmlspecialchars((string)($artist['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="artist-name">
+        <label class="label">Country</label>
+        <input class="input" name="country" value="<?= htmlspecialchars((string)($artist['country'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="UK">
+        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px;">
+          <label class="label" style="margin:0;">Avatar URL</label>
+          <button type="button" class="btn outline small" data-media-picker="artist_avatar_url" data-media-picker-mode="url">Pick from Media</button>
+        </div>
+        <input class="input" id="artist_avatar_url" name="avatar_url" value="<?= htmlspecialchars((string)($artist['avatar_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="https://...">
+        <label class="label">Bio</label>
+        <textarea class="input" name="bio" rows="6" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:13px; line-height:1.6;"><?= htmlspecialchars((string)($artist['bio'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <label class="label">Artist Credits</label>
+        <textarea class="input" name="credits" rows="4" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:13px; line-height:1.6;" placeholder="Written by..., Vocals by..., Produced by..."><?= htmlspecialchars((string)($artist['credits'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+          <div class="label">Social Links</div>
+          <div style="margin-top:10px; display:grid; gap:10px; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));">
+            <input class="input" name="social_website" placeholder="Website URL" value="<?= htmlspecialchars((string)($socialLinks['website'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_instagram" placeholder="Instagram URL" value="<?= htmlspecialchars((string)($socialLinks['instagram'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_soundcloud" placeholder="SoundCloud URL" value="<?= htmlspecialchars((string)($socialLinks['soundcloud'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_spotify" placeholder="Spotify URL" value="<?= htmlspecialchars((string)($socialLinks['spotify'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_youtube" placeholder="YouTube URL" value="<?= htmlspecialchars((string)($socialLinks['youtube'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_tiktok" placeholder="TikTok URL" value="<?= htmlspecialchars((string)($socialLinks['tiktok'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_bandcamp" placeholder="Bandcamp URL" value="<?= htmlspecialchars((string)($socialLinks['bandcamp'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_beatport" placeholder="Beatport URL" value="<?= htmlspecialchars((string)($socialLinks['beatport'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_facebook" placeholder="Facebook URL" value="<?= htmlspecialchars((string)($socialLinks['facebook'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+            <input class="input" name="social_x" placeholder="X / Twitter URL" value="<?= htmlspecialchars((string)($socialLinks['x'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+          </div>
+        </div>
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="is_active" value="1" <?= ((int)($artist['is_active'] ?? 1) === 1) ? 'checked' : '' ?>>
+          Active
+        </label>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end; gap:12px; align-items:center;">
+      <button type="submit" class="btn">Save artist</button>
+    </div>
+  </form>
+
+</section>
+<script>
+  (function () {
+    const dropzone = document.getElementById('artistAvatarDropzone');
+    const fileInput = document.getElementById('artistAvatarFile');
+    const fileName = document.getElementById('artistAvatarFileName');
+    if (!dropzone || !fileInput || !fileName) {
+      return;
+    }
+
+    dropzone.addEventListener('dragover', (event) => {
+      event.preventDefault();
+      dropzone.style.borderColor = 'var(--accent)';
+    });
+
+    dropzone.addEventListener('dragleave', () => {
+      dropzone.style.borderColor = 'rgba(255,255,255,0.2)';
+    });
+
+    dropzone.addEventListener('drop', (event) => {
+      event.preventDefault();
+      dropzone.style.borderColor = 'rgba(255,255,255,0.2)';
+      if (event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files.length) {
+        fileInput.files = event.dataTransfer.files;
+        fileName.textContent = event.dataTransfer.files[0].name;
+      }
+    });
+
+    fileInput.addEventListener('change', () => {
+      fileName.textContent = fileInput.files.length ? fileInput.files[0].name : 'No file selected';
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/artists/views/admin/index.php

@@ -0,0 +1,97 @@
+<?php
+$pageTitle = 'Artists';
+$tableReady = $table_ready ?? false;
+$artists = $artists ?? [];
+$pageId = (int)($page_id ?? 0);
+$pagePublished = (int)($page_published ?? 0);
+$socialReady = (bool)($social_ready ?? false);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Artists</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Artists</h1>
+      <p style="color: var(--muted); margin-top:6px;">Artists plugin admin placeholder.</p>
+    </div>
+    <a href="/admin/artists/new" class="btn">New Artist</a>
+  </div>
+
+  <?php if (!$tableReady): ?>
+    <div class="admin-card" style="margin-top:16px; padding:16px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+      <div>
+        <div style="font-weight:600;">Database not initialized</div>
+        <div style="color: var(--muted); font-size:13px; margin-top:4px;">Create the artists table before adding records.</div>
+      </div>
+      <form method="post" action="/admin/artists/install">
+        <button type="submit" class="btn small">Create Tables</button>
+      </form>
+    </div>
+  <?php else: ?>
+    <?php if (!$socialReady): ?>
+      <div class="admin-card" style="margin-top:16px; padding:14px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+        <div>
+          <div style="font-weight:600;">Social links not enabled</div>
+          <div style="color: var(--muted); font-size:12px; margin-top:4px;">Click create tables to add the social links column.</div>
+        </div>
+        <form method="post" action="/admin/artists/install">
+          <button type="submit" class="btn small">Update Table</button>
+        </form>
+      </div>
+    <?php endif; ?>
+    <div class="admin-card" style="margin-top:16px; padding:14px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+      <div>
+        <div style="font-weight:600;">Artists page</div>
+        <div style="color: var(--muted); font-size:12px; margin-top:4px;">
+          Slug: <code>artists</code>
+          <?php if ($pageId > 0): ?>
+            · Status: <?= $pagePublished === 1 ? 'Published' : 'Draft' ?>
+          <?php else: ?>
+            · Not created
+          <?php endif; ?>
+        </div>
+      </div>
+      <?php if ($pageId > 0): ?>
+        <a href="/admin/pages/edit?id=<?= $pageId ?>" class="btn outline small">Edit Page Content</a>
+      <?php else: ?>
+        <span class="pill">Re-enable plugin to create</span>
+      <?php endif; ?>
+    </div>
+    <?php if (!$artists): ?>
+      <div style="margin-top:18px; color: var(--muted); font-size:13px;">No artists yet.</div>
+    <?php else: ?>
+      <div style="margin-top:18px; display:grid; gap:12px;">
+        <?php foreach ($artists as $artist): ?>
+          <div class="admin-card" style="padding:14px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+            <div style="display:flex; gap:12px; align-items:center;">
+              <div style="width:44px; height:44px; border-radius:12px; overflow:hidden; background:rgba(255,255,255,0.06); display:grid; place-items:center;">
+                <?php if (!empty($artist['avatar_url'])): ?>
+                  <img src="<?= htmlspecialchars((string)$artist['avatar_url'], ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; height:100%; object-fit:cover;">
+                <?php else: ?>
+                  <span style="font-size:12px; color:var(--muted);">N/A</span>
+                <?php endif; ?>
+              </div>
+              <div>
+                <div style="font-weight:600;"><?= htmlspecialchars((string)$artist['name'], ENT_QUOTES, 'UTF-8') ?></div>
+                <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)$artist['slug'], ENT_QUOTES, 'UTF-8') ?></div>
+              </div>
+            </div>
+            <div style="display:flex; gap:8px; align-items:center;">
+              <?php if ((int)$artist['is_active'] !== 1): ?>
+                <span class="pill">Inactive</span>
+              <?php endif; ?>
+              <a href="/admin/artists/edit?id=<?= (int)$artist['id'] ?>" class="btn outline small">Edit</a>
+              <form method="post" action="/admin/artists/delete" onsubmit="return confirm('Delete this artist?');">
+                <input type="hidden" name="id" value="<?= (int)$artist['id'] ?>">
+                <button type="submit" class="btn outline small">Delete</button>
+              </form>
+            </div>
+          </div>
+        <?php endforeach; ?>
+      </div>
+    <?php endif; ?>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/artists/views/site/index.php

@@ -0,0 +1,236 @@
+<?php
+$pageTitle = $title ?? 'Artists';
+$artists = $artists ?? [];
+
+function ac_country_code(string $country): string {
+  $code = strtoupper(trim($country));
+  if ($code === '') {
+    return '';
+  }
+  if ($code === 'UK') {
+    $code = 'GB';
+  }
+  if (!preg_match('/^[A-Z]{2}$/', $code)) {
+    return '';
+  }
+  return strtolower($code);
+}
+
+ob_start();
+?>
+<section class="card" style="display:grid; gap:18px;">
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px;">
+    <div class="badge">Artists</div>
+    <div class="view-toggle" role="group" aria-label="View toggle">
+      <button type="button" class="view-btn active" id="artistGridBtn" aria-label="Grid view">
+        <i class="fa-duotone fa-grid-round-2"></i>
+        <span>Grid</span>
+      </button>
+      <button type="button" class="view-btn" id="artistListBtn" aria-label="List view">
+        <i class="fa-duotone fa-list-ol"></i>
+        <span>List</span>
+      </button>
+    </div>
+  </div>
+
+  <?php if (!$artists): ?>
+    <div style="color:var(--muted); font-size:14px;">No artists published yet.</div>
+  <?php else: ?>
+    <div id="artistView" class="artist-grid">
+      <?php foreach ($artists as $artist): ?>
+        <a class="artist-card" href="/artist?slug=<?= htmlspecialchars((string)$artist['slug'], ENT_QUOTES, 'UTF-8') ?>">
+          <div class="artist-avatar">
+            <?php if (!empty($artist['avatar_url'])): ?>
+              <img src="<?= htmlspecialchars((string)$artist['avatar_url'], ENT_QUOTES, 'UTF-8') ?>" alt="">
+            <?php else: ?>
+              <div class="artist-avatar-placeholder">AC</div>
+            <?php endif; ?>
+          </div>
+          <div class="artist-info">
+            <div class="artist-name">
+              <?= htmlspecialchars((string)$artist['name'], ENT_QUOTES, 'UTF-8') ?>
+            </div>
+            <?php $flag = ac_country_code((string)($artist['country'] ?? '')); ?>
+            <?php if ($flag !== ''): ?>
+              <div class="artist-meta">
+                <span class="fi fi-<?= htmlspecialchars($flag, ENT_QUOTES, 'UTF-8') ?>"></span>
+              </div>
+            <?php endif; ?>
+          </div>
+        </a>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+
+<style>
+  .artist-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+    gap: 16px;
+  }
+  .artist-list {
+    display: grid;
+    gap: 10px;
+  }
+  .artist-card {
+    border-radius: 18px;
+    padding: 6px;
+    background: transparent;
+    display: grid;
+    gap: 10px;
+    color: inherit;
+  }
+  .artist-card:hover .artist-avatar {
+    box-shadow: 0 12px 30px rgba(0,0,0,0.35);
+    transform: scale(1.02);
+  }
+  .artist-card .artist-avatar {
+    transition: transform 0.2s ease, box-shadow 0.2s ease;
+  }
+  .artist-avatar {
+    width: 140px;
+    height: 140px;
+    border-radius: 16px;
+    overflow: hidden;
+    background: rgba(255,255,255,0.06);
+    display: grid;
+    place-items: center;
+  }
+  .artist-avatar img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+  }
+  .artist-avatar-placeholder {
+    font-size: 12px;
+    color: var(--muted);
+    letter-spacing: 0.2em;
+  }
+  .artist-info {
+    display: none;
+    gap: 6px;
+  }
+  .artist-name {
+    font-weight: 600;
+    font-size: 15px;
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+  }
+  .artist-meta {
+    font-size: 12px;
+    color: var(--muted);
+    display: inline-flex;
+    gap: 8px;
+    align-items: center;
+  }
+  .view-toggle {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    padding: 6px;
+    border-radius: 999px;
+    background: rgba(10,10,12,0.6);
+    border: 1px solid rgba(255,255,255,0.12);
+    box-shadow: inset 0 0 0 1px rgba(255,255,255,0.04);
+  }
+  .view-btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    padding: 8px 12px;
+    border-radius: 999px;
+    border: 1px solid transparent;
+    background: transparent;
+    color: rgba(255,255,255,0.7);
+    font-size: 11px;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.2em;
+    cursor: pointer;
+  }
+  .view-btn i {
+    font-size: 12px;
+  }
+  .view-btn.active {
+    background: linear-gradient(135deg, rgba(34,242,165,0.2), rgba(34,167,255,0.12));
+    border-color: rgba(34,242,165,0.35);
+    color: #f3fff9;
+    box-shadow: 0 6px 16px rgba(34,242,165,0.2);
+  }
+  .view-btn:not(.active):hover {
+    color: rgba(255,255,255,0.95);
+    background: rgba(255,255,255,0.06);
+  }
+  .flag {
+    font-size: 14px;
+  }
+  .artist-list .artist-card {
+    grid-template-columns: 64px 1fr;
+    align-items: center;
+    gap: 16px;
+    padding: 10px 12px;
+    border: 1px solid rgba(255,255,255,0.08);
+    background: rgba(12,12,14,0.5);
+  }
+  .artist-list .artist-avatar {
+    width: 64px;
+    height: 64px;
+  }
+  .artist-list .artist-info {
+    display: grid;
+  }
+  @media (max-width: 700px) {
+    .artist-grid {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+      gap: 10px;
+    }
+    .artist-card {
+      padding: 4px;
+    }
+    .artist-avatar {
+      width: 100%;
+      height: auto;
+      aspect-ratio: 1 / 1;
+    }
+    .view-btn span {
+      display: none;
+    }
+    .view-btn {
+      width: 34px;
+      height: 34px;
+      padding: 0;
+      justify-content: center;
+    }
+    .artist-list .artist-card {
+      grid-template-columns: 1fr;
+      align-items: flex-start;
+    }
+  }
+</style>
+<script>
+  (function () {
+    const gridBtn = document.getElementById('artistGridBtn');
+    const listBtn = document.getElementById('artistListBtn');
+    const view = document.getElementById('artistView');
+    if (!gridBtn || !listBtn || !view) {
+      return;
+    }
+    gridBtn.addEventListener('click', () => {
+      view.classList.add('artist-grid');
+      view.classList.remove('artist-list');
+      gridBtn.classList.add('active');
+      listBtn.classList.remove('active');
+    });
+    listBtn.addEventListener('click', () => {
+      view.classList.add('artist-list');
+      view.classList.remove('artist-grid');
+      listBtn.classList.add('active');
+      gridBtn.classList.remove('active');
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';

plugins/artists/views/site/show.php

@@ -0,0 +1,239 @@
+<?php
+use Core\Services\Settings;
+
+$pageTitle = $title ?? 'Artist';
+$artist = $artist ?? null;
+$proUrl = Settings::get('fontawesome_pro_url', '');
+$faUrl = $proUrl !== '' ? $proUrl : Settings::get('fontawesome_url', '');
+$hasPro = $proUrl !== '';
+$hasIcons = $faUrl !== '';
+$artistReleases = is_array($artist_releases ?? null) ? $artist_releases : [];
+$socialLinks = [];
+if ($artist && !empty($artist['social_links'])) {
+  $decoded = json_decode((string)$artist['social_links'], true);
+  if (is_array($decoded)) {
+    $socialLinks = $decoded;
+  }
+}
+$iconMap = [
+  'website' => ['label' => 'Website', 'icon' => 'fa-duotone fa-globe-pointer'],
+  'instagram' => ['label' => 'Instagram', 'icon' => 'fa-brands fa-instagram'],
+  'soundcloud' => ['label' => 'SoundCloud', 'icon' => 'fa-brands fa-soundcloud'],
+  'spotify' => ['label' => 'Spotify', 'icon' => 'fa-brands fa-spotify'],
+  'youtube' => ['label' => 'YouTube', 'icon' => 'fa-brands fa-youtube'],
+  'tiktok' => ['label' => 'TikTok', 'icon' => 'fa-brands fa-tiktok'],
+  'bandcamp' => ['label' => 'Bandcamp', 'icon' => 'fa-brands fa-bandcamp'],
+  'beatport' => ['label' => 'Beatport', 'icon' => 'fa-solid fa-music'],
+  'facebook' => ['label' => 'Facebook', 'icon' => 'fa-brands fa-facebook'],
+  'x' => ['label' => 'X', 'icon' => 'fa-brands fa-x-twitter'],
+];
+function ac_normalize_url(string $value): string {
+  if ($value === '') {
+    return '';
+  }
+  if (preg_match('~^(https?://)~i', $value)) {
+    return $value;
+  }
+  return 'https://' . $value;
+}
+ob_start();
+?>
+<section class="card" style="display:grid; gap:16px;">
+  <div class="badge">Artist</div>
+  <?php if (!$artist): ?>
+    <h1 style="margin:0; font-size:28px;">Artist not found</h1>
+    <p style="color:var(--muted);">This profile is unavailable.</p>
+  <?php else: ?>
+    <div style="display:grid; gap:18px;">
+      <div style="display:flex; align-items:center; gap:20px;">
+        <div style="width:160px; height:160px; border-radius:24px; overflow:hidden; background:rgba(255,255,255,0.06); display:grid; place-items:center;">
+          <?php if (!empty($artist['avatar_url'])): ?>
+            <img src="<?= htmlspecialchars((string)$artist['avatar_url'], ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; height:100%; object-fit:cover;">
+          <?php else: ?>
+            <span style="font-size:12px; color:var(--muted); letter-spacing:0.2em;">AC</span>
+          <?php endif; ?>
+        </div>
+        <div>
+          <div class="badge">Profile</div>
+          <h1 style="margin:6px 0 0; font-size:34px;"><?= htmlspecialchars((string)$artist['name'], ENT_QUOTES, 'UTF-8') ?></h1>
+          <?php if (!empty($artist['country'])): ?>
+            <?php
+              $code = strtolower((string)$artist['country']);
+              if ($code === 'uk') { $code = 'gb'; }
+            ?>
+            <div style="margin-top:8px; color:var(--muted); font-size:13px;">
+              <span class="fi fi-<?= htmlspecialchars($code, ENT_QUOTES, 'UTF-8') ?>"></span>
+            </div>
+          <?php endif; ?>
+        </div>
+      </div>
+
+      <?php if (!empty($artist['bio'])): ?>
+        <div style="color:var(--muted); line-height:1.7;">
+          <?= nl2br(htmlspecialchars((string)$artist['bio'], ENT_QUOTES, 'UTF-8')) ?>
+        </div>
+      <?php endif; ?>
+
+      <?php if (!empty($artist['credits'])): ?>
+        <div style="padding:14px; border-radius:18px; border:1px solid rgba(255,255,255,0.08); background: rgba(0,0,0,0.25);">
+          <div class="badge">Credits</div>
+          <div style="margin-top:8px; color:var(--muted); line-height:1.7;">
+            <?= nl2br(htmlspecialchars((string)$artist['credits'], ENT_QUOTES, 'UTF-8')) ?>
+          </div>
+        </div>
+      <?php endif; ?>
+
+      <?php if ($socialLinks): ?>
+        <div style="display:flex; flex-wrap:wrap; gap:10px;">
+          <?php foreach ($socialLinks as $key => $url): ?>
+            <?php
+              $meta = $iconMap[$key] ?? ['label' => ucfirst($key), 'icon' => 'fa-solid fa-link'];
+              $label = $meta['label'];
+              $icon = $meta['icon'];
+              $normalized = ac_normalize_url((string)$url);
+              $safeUrl = htmlspecialchars($normalized, ENT_QUOTES, 'UTF-8');
+            ?>
+            <?php if ($hasIcons && $icon !== ''): ?>
+              <a class="pill social-icon" href="<?= $safeUrl ?>" target="_blank" rel="noopener" aria-label="<?= htmlspecialchars($label, ENT_QUOTES, 'UTF-8') ?>">
+                <i class="<?= htmlspecialchars($icon, ENT_QUOTES, 'UTF-8') ?>"></i>
+              </a>
+            <?php else: ?>
+              <a class="pill" href="<?= $safeUrl ?>" target="_blank" rel="noopener">
+                <?= htmlspecialchars($label, ENT_QUOTES, 'UTF-8') ?>
+              </a>
+            <?php endif; ?>
+          <?php endforeach; ?>
+        </div>
+      <?php endif; ?>
+
+      <?php if ($artistReleases): ?>
+        <div class="artist-release-panel">
+          <div class="artist-release-panel-head">
+            <div class="badge">Latest Releases</div>
+            <a href="/releases?artist=<?= urlencode((string)($artist['name'] ?? '')) ?>" class="badge artist-view-all-link">View all</a>
+          </div>
+          <div class="artist-release-grid">
+            <?php foreach ($artistReleases as $release): ?>
+              <a class="artist-release-card" href="/release?slug=<?= htmlspecialchars((string)($release['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+                <div class="artist-release-cover">
+                  <?php if (!empty($release['cover_url'])): ?>
+                    <img src="<?= htmlspecialchars((string)$release['cover_url'], ENT_QUOTES, 'UTF-8') ?>" alt="">
+                  <?php else: ?>
+                    <span>AC</span>
+                  <?php endif; ?>
+                </div>
+                <div class="artist-release-meta">
+                  <div class="artist-release-title"><?= htmlspecialchars((string)($release['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+                  <?php if (!empty($release['release_date'])): ?>
+                    <div class="artist-release-date"><?= htmlspecialchars((string)$release['release_date'], ENT_QUOTES, 'UTF-8') ?></div>
+                  <?php endif; ?>
+                </div>
+              </a>
+            <?php endforeach; ?>
+          </div>
+        </div>
+      <?php endif; ?>
+    </div>
+  <?php endif; ?>
+</section>
+
+<style>
+  .social-icon {
+    color: var(--text);
+  }
+  .social-icon i {
+    font-size: 14px;
+  }
+  .artist-release-panel {
+    display: grid;
+    gap: 12px;
+    margin-top: 6px;
+    padding: 14px;
+    border-radius: 18px;
+    border: 1px solid rgba(255,255,255,0.08);
+    background: rgba(0,0,0,0.24);
+  }
+  .artist-release-panel-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 10px;
+  }
+  .artist-view-all-link {
+    text-decoration: none;
+    color: rgba(255,255,255,0.72);
+    transition: color .18s ease;
+  }
+  .artist-view-all-link:hover {
+    color: #ffffff;
+  }
+  .artist-release-grid {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 10px;
+  }
+  .artist-release-card {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    text-decoration: none;
+    color: inherit;
+    border-radius: 12px;
+    border: 1px solid rgba(255,255,255,0.08);
+    background: rgba(0,0,0,0.22);
+    padding: 8px;
+    transition: transform .18s ease, border-color .18s ease, background .18s ease;
+  }
+  .artist-release-card:hover {
+    transform: translateY(-2px);
+    border-color: rgba(255,255,255,0.18);
+    background: rgba(0,0,0,0.28);
+  }
+  .artist-release-cover {
+    width: 58px;
+    height: 58px;
+    flex: 0 0 58px;
+    border-radius: 9px;
+    overflow: hidden;
+    background: rgba(255,255,255,0.06);
+    display: grid;
+    place-items: center;
+    color: var(--muted);
+    font-size: 12px;
+    letter-spacing: .14em;
+  }
+  .artist-release-cover img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+  }
+  .artist-release-title {
+    font-size: 12px;
+    font-weight: 600;
+    line-height: 1.25;
+  }
+  .artist-release-date {
+    margin-top: 4px;
+    font-size: 10px;
+    color: var(--muted);
+  }
+  .artist-release-meta {
+    min-width: 0;
+  }
+  @media (max-width: 900px) {
+    .artist-release-grid {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
+  }
+  @media (max-width: 520px) {
+    .artist-release-grid {
+      grid-template-columns: 1fr;
+    }
+    .artist-release-card {
+      padding: 7px;
+    }
+  }
+</style>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';

plugins/releases/plugin.json

@@ -0,0 +1,21 @@
+{
+  "name": "Releases",
+  "version": "0.1.0",
+  "description": "Release listings and detail pages.",
+  "author": "AudioCore",
+  "admin_nav": {
+    "label": "Releases",
+    "url": "/admin/releases",
+    "roles": ["admin", "manager"],
+    "icon": "fa-solid fa-compact-disc"
+  },
+  "pages": [
+    {
+      "slug": "releases",
+      "title": "Releases",
+      "content_html": "<section class=\"card\"><div class=\"badge\">Releases</div><h1 style=\"margin-top:16px; font-size:28px;\">Releases</h1><p style=\"color:var(--muted);\">Latest drops from the label.</p></section>"
+    }
+  ],
+  "entry": "plugin.php",
+  "default_enabled": false
+}

plugins/releases/plugin.php

@@ -0,0 +1,109 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Core\Services\Database;
+use Core\Services\Shortcodes;
+use Plugins\Releases\ReleasesController;
+
+require_once __DIR__ . '/ReleasesController.php';
+
+Shortcodes::register('releases', static function (array $attrs = []): string {
+    $limit = max(1, min(20, (int)($attrs['limit'] ?? 8)));
+    $db = Database::get();
+    if (!($db instanceof \PDO)) {
+        return '';
+    }
+
+    try {
+        $artistJoinReady = false;
+        try {
+            $probe = $db->query("SHOW COLUMNS FROM ac_releases LIKE 'artist_id'");
+            $artistJoinReady = (bool)($probe && $probe->fetch(\PDO::FETCH_ASSOC));
+        } catch (\Throwable $e) {
+            $artistJoinReady = false;
+        }
+
+        if ($artistJoinReady) {
+            $stmt = $db->prepare("
+                SELECT r.title, r.slug, r.release_date, r.cover_url, COALESCE(r.artist_name, a.name) AS artist_name
+                FROM ac_releases r
+                LEFT JOIN ac_artists a ON a.id = r.artist_id
+                WHERE r.is_published = 1
+                ORDER BY r.release_date DESC, r.created_at DESC
+                LIMIT :limit
+            ");
+        } else {
+            $stmt = $db->prepare("
+                SELECT title, slug, release_date, cover_url, artist_name
+                FROM ac_releases
+                WHERE is_published = 1
+                ORDER BY release_date DESC, created_at DESC
+                LIMIT :limit
+            ");
+        }
+        $stmt->bindValue(':limit', $limit, \PDO::PARAM_INT);
+        $stmt->execute();
+        $rows = $stmt->fetchAll(PDO::FETCH_ASSOC) ?: [];
+    } catch (\Throwable $e) {
+        return '';
+    }
+
+    if (!$rows) {
+        return '<div class="ac-shortcode-empty">No releases published yet.</div>';
+    }
+
+    $cards = '';
+    foreach ($rows as $row) {
+        $title = htmlspecialchars((string)($row['title'] ?? ''), ENT_QUOTES, 'UTF-8');
+        $slug = rawurlencode((string)($row['slug'] ?? ''));
+        $artist = htmlspecialchars(trim((string)($row['artist_name'] ?? '')), ENT_QUOTES, 'UTF-8');
+        $date = htmlspecialchars((string)($row['release_date'] ?? ''), ENT_QUOTES, 'UTF-8');
+        $cover = trim((string)($row['cover_url'] ?? ''));
+        $coverHtml = $cover !== ''
+            ? '<img src="' . htmlspecialchars($cover, ENT_QUOTES, 'UTF-8') . '" alt="" loading="lazy">'
+            : '<div class="ac-shortcode-cover-fallback">AC</div>';
+        $cards .= '<a class="ac-shortcode-release-card" href="/release?slug=' . $slug . '">'
+            . '<div class="ac-shortcode-release-cover">' . $coverHtml . '</div>'
+            . '<div class="ac-shortcode-release-meta">'
+            . '<div class="ac-shortcode-release-title">' . $title . '</div>'
+            . ($artist !== '' ? '<div class="ac-shortcode-release-artist">' . $artist . '</div>' : '')
+            . ($date !== '' ? '<div class="ac-shortcode-release-date">' . $date . '</div>' : '')
+            . '</div>'
+            . '</a>';
+    }
+
+    return '<section class="ac-shortcode-releases"><div class="ac-shortcode-release-grid">' . $cards . '</div></section>';
+});
+
+return function (Router $router): void {
+    $controller = new ReleasesController();
+    $router->get('/releases', [$controller, 'index']);
+    $router->get('/release', [$controller, 'show']);
+    $router->get('/admin/releases', [$controller, 'adminIndex']);
+    $router->post('/admin/releases/install', [$controller, 'adminInstall']);
+    $router->get('/admin/releases/new', [$controller, 'adminNew']);
+    $router->get('/admin/releases/edit', function () use ($controller): Core\Http\Response {
+        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
+        return $controller->adminEdit($id);
+    });
+    $router->get('/admin/releases/tracks', function () use ($controller): Core\Http\Response {
+        $releaseId = isset($_GET['release_id']) ? (int)$_GET['release_id'] : 0;
+        return $controller->adminTracks($releaseId);
+    });
+    $router->get('/admin/releases/tracks/new', function () use ($controller): Core\Http\Response {
+        $releaseId = isset($_GET['release_id']) ? (int)$_GET['release_id'] : 0;
+        return $controller->adminTrackEdit(0, $releaseId);
+    });
+    $router->get('/admin/releases/tracks/edit', function () use ($controller): Core\Http\Response {
+        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
+        $releaseId = isset($_GET['release_id']) ? (int)$_GET['release_id'] : 0;
+        return $controller->adminTrackEdit($id, $releaseId);
+    });
+    $router->post('/admin/releases/save', [$controller, 'adminSave']);
+    $router->post('/admin/releases/delete', [$controller, 'adminDelete']);
+    $router->post('/admin/releases/upload', [$controller, 'adminUpload']);
+    $router->post('/admin/releases/tracks/save', [$controller, 'adminTrackSave']);
+    $router->post('/admin/releases/tracks/delete', [$controller, 'adminTrackDelete']);
+    $router->post('/admin/releases/tracks/upload', [$controller, 'adminTrackUpload']);
+};

plugins/releases/views/admin/edit.php

@@ -0,0 +1,168 @@
+<?php
+$pageTitle = $title ?? 'Edit Release';
+$release = $release ?? [];
+$error = $error ?? '';
+$uploadError = (string)($_GET['upload_error'] ?? '');
+$storePluginEnabled = (bool)($store_plugin_enabled ?? false);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Releases</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;"><?= htmlspecialchars($pageTitle, ENT_QUOTES, 'UTF-8') ?></h1>
+      <p style="color: var(--muted); margin-top:6px;">Create or update a release.</p>
+    </div>
+    <div style="display:flex; gap:10px; align-items:center;">
+      <?php if ((int)($release['id'] ?? 0) > 0): ?>
+        <a href="/admin/releases/tracks?release_id=<?= (int)$release['id'] ?>" class="btn outline">Manage Tracks</a>
+      <?php endif; ?>
+      <a href="/admin/releases" class="btn outline">Back</a>
+    </div>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+  <?php if ($uploadError !== ''): ?>
+    <div style="margin-top:12px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($uploadError, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/releases/save" enctype="multipart/form-data" style="margin-top:16px; display:grid; gap:16px;">
+    <input type="hidden" name="id" value="<?= (int)($release['id'] ?? 0) ?>">
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Title</label>
+        <input class="input" name="title" value="<?= htmlspecialchars((string)($release['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Release title">
+        <label class="label">Artist</label>
+        <input class="input" name="artist_name" value="<?= htmlspecialchars((string)($release['artist_name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Artist name">
+        <label class="label">Slug</label>
+        <input class="input" name="slug" value="<?= htmlspecialchars((string)($release['slug'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="release-title">
+        <label class="label">Release Date</label>
+        <input class="input" type="date" name="release_date" value="<?= htmlspecialchars((string)($release['release_date'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+        <label class="label">Catalog Number</label>
+        <input class="input" name="catalog_no" value="<?= htmlspecialchars((string)($release['catalog_no'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="CAT-001">
+        <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+          <div class="label">Upload cover</div>
+          <input type="hidden" name="release_id" value="<?= (int)($release['id'] ?? 0) ?>">
+          <label for="releaseCoverFile" id="releaseCoverDropzone" style="display:flex; flex-direction:column; gap:8px; align-items:center; justify-content:center; padding:18px; border-radius:14px; border:1px dashed rgba(255,255,255,0.2); background: rgba(0,0,0,0.2); cursor:pointer;">
+            <div style="font-size:11px; text-transform:uppercase; letter-spacing:0.2em; color:var(--muted);">Drag &amp; Drop</div>
+            <div style="font-size:13px; color:var(--text);">or click to upload</div>
+            <div id="releaseCoverFileName" style="font-size:11px; color:var(--muted);">No file selected</div>
+          </label>
+          <input class="input" type="file" id="releaseCoverFile" name="release_cover" accept="image/*" style="display:none;">
+          <div style="margin-top:10px; display:flex; justify-content:flex-end;">
+            <button type="submit" class="btn small" formaction="/admin/releases/upload" formmethod="post" formenctype="multipart/form-data" name="upload_type" value="cover">Upload</button>
+          </div>
+        </div>
+        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px;">
+          <label class="label" style="margin:0;">Cover URL</label>
+          <button type="button" class="btn outline small" data-media-picker="release_cover_url" data-media-picker-mode="url">Pick from Media</button>
+        </div>
+        <input class="input" id="release_cover_url" name="cover_url" value="<?= htmlspecialchars((string)($release['cover_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="https://...">
+        <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+          <div class="label">Upload sample (MP3)</div>
+          <input type="hidden" name="release_id" value="<?= (int)($release['id'] ?? 0) ?>">
+          <label for="releaseSampleFile" id="releaseSampleDropzone" style="display:flex; flex-direction:column; gap:8px; align-items:center; justify-content:center; padding:18px; border-radius:14px; border:1px dashed rgba(255,255,255,0.2); background: rgba(0,0,0,0.2); cursor:pointer;">
+            <div style="font-size:11px; text-transform:uppercase; letter-spacing:0.2em; color:var(--muted);">Drag &amp; Drop</div>
+            <div style="font-size:13px; color:var(--text);">or click to upload</div>
+            <div id="releaseSampleFileName" style="font-size:11px; color:var(--muted);">No file selected</div>
+          </label>
+          <input class="input" type="file" id="releaseSampleFile" name="release_sample" accept="audio/mpeg" style="display:none;">
+          <div style="margin-top:10px; display:flex; justify-content:flex-end;">
+            <button type="submit" class="btn small" formaction="/admin/releases/upload" formmethod="post" formenctype="multipart/form-data" name="upload_type" value="sample">Upload</button>
+          </div>
+        </div>
+        <label class="label">Sample URL (MP3)</label>
+        <input class="input" name="sample_url" value="<?= htmlspecialchars((string)($release['sample_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="https://...">
+        <label class="label">Description</label>
+        <textarea class="input" name="description" rows="6" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:13px; line-height:1.6;"><?= htmlspecialchars((string)($release['description'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <label class="label">Release Credits</label>
+        <textarea class="input" name="credits" rows="4" style="resize:vertical; font-family:'IBM Plex Mono', monospace; font-size:13px; line-height:1.6;" placeholder="Written by..., Produced by..., Mastered by..."><?= htmlspecialchars((string)($release['credits'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+        <?php if ($storePluginEnabled): ?>
+          <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+            <div class="label" style="margin-bottom:10px;">Store Options</div>
+            <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+              <input type="checkbox" name="store_enabled" value="1" <?= ((int)($release['store_enabled'] ?? 0) === 1) ? 'checked' : '' ?>>
+              Enable release purchase
+            </label>
+            <div style="display:grid; grid-template-columns:1fr 120px; gap:10px; margin-top:10px;">
+              <div>
+                <label class="label">Bundle Price</label>
+                <input class="input" name="bundle_price" value="<?= htmlspecialchars((string)($release['bundle_price'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="3.99">
+              </div>
+              <div>
+                <label class="label">Currency</label>
+                <input class="input" name="store_currency" value="<?= htmlspecialchars((string)($release['store_currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?>" placeholder="GBP">
+              </div>
+            </div>
+            <label class="label" style="margin-top:10px;">Button Label (optional)</label>
+            <input class="input" name="purchase_label" value="<?= htmlspecialchars((string)($release['purchase_label'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Buy Release">
+          </div>
+        <?php endif; ?>
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="is_published" value="1" <?= ((int)($release['is_published'] ?? 1) === 1) ? 'checked' : '' ?>>
+          Published
+        </label>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end; gap:12px; align-items:center;">
+      <button type="submit" class="btn">Save release</button>
+    </div>
+  </form>
+</section>
+<script>
+  (function () {
+    const coverDrop = document.getElementById('releaseCoverDropzone');
+    const coverFile = document.getElementById('releaseCoverFile');
+    const coverName = document.getElementById('releaseCoverFileName');
+    if (coverDrop && coverFile && coverName) {
+      coverDrop.addEventListener('dragover', (event) => {
+        event.preventDefault();
+        coverDrop.style.borderColor = 'var(--accent)';
+      });
+      coverDrop.addEventListener('dragleave', () => {
+        coverDrop.style.borderColor = 'rgba(255,255,255,0.2)';
+      });
+      coverDrop.addEventListener('drop', (event) => {
+        event.preventDefault();
+        coverDrop.style.borderColor = 'rgba(255,255,255,0.2)';
+        if (event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files.length) {
+          coverFile.files = event.dataTransfer.files;
+          coverName.textContent = event.dataTransfer.files[0].name;
+        }
+      });
+      coverFile.addEventListener('change', () => {
+        coverName.textContent = coverFile.files.length ? coverFile.files[0].name : 'No file selected';
+      });
+    }
+
+    const sampleDrop = document.getElementById('releaseSampleDropzone');
+    const sampleFile = document.getElementById('releaseSampleFile');
+    const sampleName = document.getElementById('releaseSampleFileName');
+    if (sampleDrop && sampleFile && sampleName) {
+      sampleDrop.addEventListener('dragover', (event) => {
+        event.preventDefault();
+        sampleDrop.style.borderColor = 'var(--accent)';
+      });
+      sampleDrop.addEventListener('dragleave', () => {
+        sampleDrop.style.borderColor = 'rgba(255,255,255,0.2)';
+      });
+      sampleDrop.addEventListener('drop', (event) => {
+        event.preventDefault();
+        sampleDrop.style.borderColor = 'rgba(255,255,255,0.2)';
+        if (event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files.length) {
+          sampleFile.files = event.dataTransfer.files;
+          sampleName.textContent = event.dataTransfer.files[0].name;
+        }
+      });
+      sampleFile.addEventListener('change', () => {
+        sampleName.textContent = sampleFile.files.length ? sampleFile.files[0].name : 'No file selected';
+      });
+    }
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/releases/views/admin/index.php

@@ -0,0 +1,87 @@
+<?php
+$pageTitle = 'Releases';
+$releases = $releases ?? [];
+$tableReady = $table_ready ?? false;
+$pageId = (int)($page_id ?? 0);
+$pagePublished = (int)($page_published ?? 0);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Releases</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Releases</h1>
+      <p style="color: var(--muted); margin-top:6px;">Manage singles, EPs, and albums.</p>
+    </div>
+    <a href="/admin/releases/new" class="btn">New Release</a>
+  </div>
+
+  <?php if (!$tableReady): ?>
+    <div class="admin-card" style="margin-top:16px; padding:16px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+      <div>
+        <div style="font-weight:600;">Database not initialized</div>
+        <div style="color: var(--muted); font-size:13px; margin-top:4px;">Create the releases table before adding records.</div>
+      </div>
+      <form method="post" action="/admin/releases/install">
+        <button type="submit" class="btn small">Create Tables</button>
+      </form>
+    </div>
+  <?php else: ?>
+    <div class="admin-card" style="margin-top:16px; padding:14px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+      <div>
+        <div style="font-weight:600;">Releases page</div>
+        <div style="color: var(--muted); font-size:12px; margin-top:4px;">
+          Slug: <code>releases</code>
+          <?php if ($pageId > 0): ?>
+            - Status: <?= $pagePublished === 1 ? 'Published' : 'Draft' ?>
+          <?php else: ?>
+            - Not created
+          <?php endif; ?>
+        </div>
+      </div>
+      <?php if ($pageId > 0): ?>
+        <a href="/admin/pages/edit?id=<?= $pageId ?>" class="btn outline small">Edit Page Content</a>
+      <?php else: ?>
+        <span class="pill">Re-enable plugin to create</span>
+      <?php endif; ?>
+    </div>
+
+    <?php if (!$releases): ?>
+      <div style="margin-top:18px; color: var(--muted); font-size:13px;">No releases yet.</div>
+    <?php else: ?>
+      <div style="margin-top:18px; display:grid; gap:12px;">
+        <?php foreach ($releases as $release): ?>
+          <div class="admin-card" style="padding:14px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+            <div style="display:flex; gap:12px; align-items:center;">
+              <div style="width:44px; height:44px; border-radius:12px; overflow:hidden; background:rgba(255,255,255,0.06); display:grid; place-items:center;">
+                <?php if (!empty($release['cover_url'])): ?>
+                  <img src="<?= htmlspecialchars((string)$release['cover_url'], ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; height:100%; object-fit:cover;">
+                <?php else: ?>
+                  <span style="font-size:12px; color:var(--muted);">N/A</span>
+                <?php endif; ?>
+              </div>
+              <div>
+                <div style="font-weight:600;"><?= htmlspecialchars((string)$release['title'], ENT_QUOTES, 'UTF-8') ?></div>
+                <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)$release['slug'], ENT_QUOTES, 'UTF-8') ?></div>
+              </div>
+            </div>
+            <div style="display:flex; gap:8px; align-items:center;">
+              <?php if ((int)$release['is_published'] !== 1): ?>
+                <span class="pill">Draft</span>
+              <?php endif; ?>
+              <a href="/admin/releases/tracks?release_id=<?= (int)$release['id'] ?>" class="btn outline small">Tracks</a>
+              <a href="/admin/releases/edit?id=<?= (int)$release['id'] ?>" class="btn outline small">Edit</a>
+              <form method="post" action="/admin/releases/delete" onsubmit="return confirm('Delete this release?');">
+                <input type="hidden" name="id" value="<?= (int)$release['id'] ?>">
+                <button type="submit" class="btn outline small">Delete</button>
+              </form>
+            </div>
+          </div>
+        <?php endforeach; ?>
+      </div>
+    <?php endif; ?>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/releases/views/admin/track_edit.php

@@ -0,0 +1,161 @@
+<?php
+$pageTitle = $title ?? 'Edit Track';
+$track = $track ?? [];
+$release = $release ?? null;
+$error = $error ?? '';
+$uploadError = (string)($_GET['upload_error'] ?? '');
+$storePluginEnabled = (bool)($store_plugin_enabled ?? false);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Releases</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;"><?= htmlspecialchars($pageTitle, ENT_QUOTES, 'UTF-8') ?></h1>
+      <p style="color: var(--muted); margin-top:6px;">
+        <?= $release ? htmlspecialchars((string)$release['title'], ENT_QUOTES, 'UTF-8') : 'Track details' ?>
+      </p>
+    </div>
+    <a href="/admin/releases/tracks?release_id=<?= (int)($track['release_id'] ?? 0) ?>" class="btn outline">Back</a>
+  </div>
+
+  <?php if ($error): ?>
+    <div style="margin-top:16px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+  <?php if ($uploadError !== ''): ?>
+    <div style="margin-top:12px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($uploadError, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/releases/tracks/save" enctype="multipart/form-data" style="margin-top:16px; display:grid; gap:16px;">
+    <input type="hidden" name="id" value="<?= (int)($track['id'] ?? 0) ?>">
+    <input type="hidden" name="track_id" value="<?= (int)($track['id'] ?? 0) ?>">
+    <input type="hidden" name="release_id" value="<?= (int)($track['release_id'] ?? 0) ?>">
+
+    <div class="admin-card" style="padding:16px;">
+      <div style="display:grid; gap:12px;">
+        <label class="label">Track #</label>
+        <input class="input" name="track_no" value="<?= htmlspecialchars((string)($track['track_no'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="1">
+        <label class="label">Title</label>
+        <input class="input" name="title" value="<?= htmlspecialchars((string)($track['title'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Track title">
+        <label class="label">Mix Name</label>
+        <input class="input" name="mix_name" value="<?= htmlspecialchars((string)($track['mix_name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="Extended Mix">
+        <label class="label">Duration</label>
+        <input class="input" name="duration" value="<?= htmlspecialchars((string)($track['duration'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="6:12">
+        <label class="label">BPM</label>
+        <input class="input" name="bpm" value="<?= htmlspecialchars((string)($track['bpm'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="140">
+        <label class="label">Key</label>
+        <input class="input" name="key_signature" value="<?= htmlspecialchars((string)($track['key_signature'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="B Minor">
+
+        <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+          <div class="label">Upload sample (MP3)</div>
+          <label for="trackSampleFile" id="trackSampleDropzone" style="display:flex; flex-direction:column; gap:8px; align-items:center; justify-content:center; padding:18px; border-radius:14px; border:1px dashed rgba(255,255,255,0.2); background: rgba(0,0,0,0.2); cursor:pointer;">
+            <div style="font-size:11px; text-transform:uppercase; letter-spacing:0.2em; color:var(--muted);">Drag &amp; Drop</div>
+            <div style="font-size:13px; color:var(--text);">or click to upload</div>
+            <div id="trackSampleFileName" style="font-size:11px; color:var(--muted);">No file selected</div>
+          </label>
+          <input class="input" type="file" id="trackSampleFile" name="track_sample" accept="audio/mpeg" style="display:none;">
+          <div style="margin-top:10px; display:flex; justify-content:flex-end;">
+            <button type="submit" class="btn small" formaction="/admin/releases/tracks/upload" formmethod="post" formenctype="multipart/form-data" name="upload_kind" value="sample">Upload</button>
+          </div>
+        </div>
+
+        <label class="label">Sample URL (MP3)</label>
+        <input class="input" name="sample_url" value="<?= htmlspecialchars((string)($track['sample_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="https://...">
+
+        <?php if ($storePluginEnabled): ?>
+          <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+            <div class="label">Upload full track (MP3)</div>
+            <label for="trackFullFile" id="trackFullDropzone" style="display:flex; flex-direction:column; gap:8px; align-items:center; justify-content:center; padding:18px; border-radius:14px; border:1px dashed rgba(255,255,255,0.2); background: rgba(0,0,0,0.2); cursor:pointer;">
+              <div style="font-size:11px; text-transform:uppercase; letter-spacing:0.2em; color:var(--muted);">Drag &amp; Drop</div>
+              <div style="font-size:13px; color:var(--text);">or click to upload</div>
+              <div id="trackFullFileName" style="font-size:11px; color:var(--muted);">No file selected</div>
+            </label>
+            <input class="input" type="file" id="trackFullFile" name="track_sample" accept="audio/mpeg" style="display:none;">
+            <div style="margin-top:10px; display:flex; justify-content:flex-end;">
+              <button type="submit" class="btn small" formaction="/admin/releases/tracks/upload" formmethod="post" formenctype="multipart/form-data" name="upload_kind" value="full">Upload Full</button>
+            </div>
+          </div>
+
+          <label class="label">Full File URL (Store Download)</label>
+          <input class="input" name="full_file_url" value="<?= htmlspecialchars((string)($track['full_file_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="/uploads/media/track-full.mp3">
+
+          <div class="admin-card" style="padding:14px; background: rgba(10,10,12,0.6);">
+            <div class="label" style="margin-bottom:10px;">Store Options</div>
+            <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+              <input type="checkbox" name="store_enabled" value="1" <?= ((int)($track['store_enabled'] ?? 0) === 1) ? 'checked' : '' ?>>
+              Enable track purchase
+            </label>
+            <div style="display:grid; grid-template-columns:1fr 120px; gap:10px; margin-top:10px;">
+              <div>
+                <label class="label">Track Price</label>
+                <input class="input" name="track_price" value="<?= htmlspecialchars((string)($track['track_price'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="1.49">
+              </div>
+              <div>
+                <label class="label">Currency</label>
+                <input class="input" name="store_currency" value="<?= htmlspecialchars((string)($track['store_currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?>" placeholder="GBP">
+              </div>
+            </div>
+          </div>
+        <?php endif; ?>
+      </div>
+    </div>
+
+    <div style="display:flex; justify-content:flex-end; gap:12px; align-items:center;">
+      <button type="submit" class="btn">Save track</button>
+    </div>
+  </form>
+</section>
+<script>
+  (function () {
+    const drop = document.getElementById('trackSampleDropzone');
+    const file = document.getElementById('trackSampleFile');
+    const name = document.getElementById('trackSampleFileName');
+    if (drop && file && name) {
+      drop.addEventListener('dragover', (event) => {
+        event.preventDefault();
+        drop.style.borderColor = 'var(--accent)';
+      });
+      drop.addEventListener('dragleave', () => {
+        drop.style.borderColor = 'rgba(255,255,255,0.2)';
+      });
+      drop.addEventListener('drop', (event) => {
+        event.preventDefault();
+        drop.style.borderColor = 'rgba(255,255,255,0.2)';
+        if (event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files.length) {
+          file.files = event.dataTransfer.files;
+          name.textContent = event.dataTransfer.files[0].name;
+        }
+      });
+      file.addEventListener('change', () => {
+        name.textContent = file.files.length ? file.files[0].name : 'No file selected';
+      });
+    }
+
+    const fullDrop = document.getElementById('trackFullDropzone');
+    const fullFile = document.getElementById('trackFullFile');
+    const fullName = document.getElementById('trackFullFileName');
+    if (fullDrop && fullFile && fullName) {
+      fullDrop.addEventListener('dragover', (event) => {
+        event.preventDefault();
+        fullDrop.style.borderColor = 'var(--accent)';
+      });
+      fullDrop.addEventListener('dragleave', () => {
+        fullDrop.style.borderColor = 'rgba(255,255,255,0.2)';
+      });
+      fullDrop.addEventListener('drop', (event) => {
+        event.preventDefault();
+        fullDrop.style.borderColor = 'rgba(255,255,255,0.2)';
+        if (event.dataTransfer && event.dataTransfer.files && event.dataTransfer.files.length) {
+          fullFile.files = event.dataTransfer.files;
+          fullName.textContent = event.dataTransfer.files[0].name;
+        }
+      });
+      fullFile.addEventListener('change', () => {
+        fullName.textContent = fullFile.files.length ? fullFile.files[0].name : 'No file selected';
+      });
+    }
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/releases/views/admin/tracks_index.php

@@ -0,0 +1,69 @@
+<?php
+$pageTitle = 'Release Tracks';
+$release = $release ?? null;
+$tracks = $tracks ?? [];
+$tableReady = $table_ready ?? false;
+$releaseId = (int)($release_id ?? 0);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Releases</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Tracks</h1>
+      <p style="color: var(--muted); margin-top:6px;">
+        <?= $release ? htmlspecialchars((string)$release['title'], ENT_QUOTES, 'UTF-8') : 'Select a release to manage tracks.' ?>
+      </p>
+    </div>
+    <div style="display:flex; gap:10px; align-items:center;">
+      <a href="/admin/releases" class="btn outline">Back</a>
+      <?php if ($releaseId > 0): ?>
+        <a href="/admin/releases/tracks/new?release_id=<?= $releaseId ?>" class="btn">New Track</a>
+      <?php endif; ?>
+    </div>
+  </div>
+
+  <?php if (!$tableReady): ?>
+    <div style="margin-top:18px; color: var(--muted); font-size:13px;">Tracks table is not available. Run Releases ? Create Tables.</div>
+  <?php elseif (!$release): ?>
+    <div style="margin-top:18px; color: var(--muted); font-size:13px;">Release not found.</div>
+  <?php elseif (!$tracks): ?>
+    <div style="margin-top:18px; color: var(--muted); font-size:13px;">No tracks yet.</div>
+  <?php else: ?>
+    <div style="margin-top:18px; display:grid; gap:12px;">
+      <?php foreach ($tracks as $track): ?>
+        <div class="admin-card" style="padding:14px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+          <div style="display:flex; gap:12px; align-items:center;">
+            <div style="width:38px; height:38px; border-radius:10px; background:rgba(255,255,255,0.06); display:grid; place-items:center; font-size:12px; color:var(--muted);">
+              <?= (int)($track['track_no'] ?? 0) > 0 ? (int)$track['track_no'] : '<27>' ?>
+            </div>
+            <div>
+              <div style="font-weight:600;">
+                <?= htmlspecialchars((string)$track['title'], ENT_QUOTES, 'UTF-8') ?>
+                <?php if (!empty($track['mix_name'])): ?>
+                  <span style="color:var(--muted); font-weight:400;">(<?= htmlspecialchars((string)$track['mix_name'], ENT_QUOTES, 'UTF-8') ?>)</span>
+                <?php endif; ?>
+              </div>
+              <div style="font-size:12px; color:var(--muted);">
+                <?= htmlspecialchars((string)($track['duration'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+                <?= !empty($track['bpm']) ? ' <20> ' . htmlspecialchars((string)$track['bpm'], ENT_QUOTES, 'UTF-8') . ' BPM' : '' ?>
+                <?= !empty($track['key_signature']) ? ' <20> ' . htmlspecialchars((string)$track['key_signature'], ENT_QUOTES, 'UTF-8') : '' ?>
+              </div>
+            </div>
+          </div>
+          <div style="display:flex; gap:8px; align-items:center;">
+            <a href="/admin/releases/tracks/edit?release_id=<?= $releaseId ?>&id=<?= (int)$track['id'] ?>" class="btn outline small">Edit</a>
+            <form method="post" action="/admin/releases/tracks/delete" onsubmit="return confirm('Delete this track?');">
+              <input type="hidden" name="id" value="<?= (int)$track['id'] ?>">
+              <input type="hidden" name="release_id" value="<?= $releaseId ?>">
+              <button type="submit" class="btn outline small">Delete</button>
+            </form>
+          </div>
+        </div>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/releases/views/site/index.php

@@ -0,0 +1,366 @@
+<?php
+$pageTitle = $title ?? 'Releases';
+$releases = is_array($releases ?? null) ? $releases : [];
+$releaseCount = (int)($total_releases ?? count($releases));
+$artistFilter = trim((string)($artist_filter ?? ''));
+$artistOptions = is_array($artist_options ?? null) ? $artist_options : [];
+$search = trim((string)($search ?? ''));
+$sort = trim((string)($sort ?? 'newest'));
+$currentPage = max(1, (int)($current_page ?? 1));
+$totalPages = max(1, (int)($total_pages ?? 1));
+
+$buildReleaseUrl = static function (int $page) use ($search, $artistFilter, $sort): string {
+    $params = [];
+    if ($search !== '') {
+        $params['q'] = $search;
+    }
+    if ($artistFilter !== '') {
+        $params['artist'] = $artistFilter;
+    }
+    if ($sort !== 'newest') {
+        $params['sort'] = $sort;
+    }
+    if ($page > 1) {
+        $params['p'] = $page;
+    }
+    $qs = http_build_query($params);
+    return '/releases' . ($qs !== '' ? ('?' . $qs) : '');
+};
+
+ob_start();
+?>
+
+<div class="ac-releases-page">
+  <section class="card ac-releases-shell">
+    <div class="ac-releases-header">
+      <div class="badge">Releases</div>
+      <h1>Latest Drops</h1>
+      <p>Singles, EPs, and albums from the AudioCore catalog.</p>
+    </div>
+
+    <form method="get" action="/releases" class="ac-release-controls">
+      <div class="ac-search-wrap">
+        <span class="ac-search-icon"><i class="fa-solid fa-magnifying-glass"></i></span>
+        <input class="ac-search-input" type="text" name="q" value="<?= htmlspecialchars($search, ENT_QUOTES, 'UTF-8') ?>" placeholder="Search releases, artists, catalog number">
+      </div>
+      <select class="ac-control-input" name="artist">
+        <option value="">All artists</option>
+        <?php foreach ($artistOptions as $artist): ?>
+          <option value="<?= htmlspecialchars((string)$artist, ENT_QUOTES, 'UTF-8') ?>" <?= $artistFilter === (string)$artist ? 'selected' : '' ?>>
+            <?= htmlspecialchars((string)$artist, ENT_QUOTES, 'UTF-8') ?>
+          </option>
+        <?php endforeach; ?>
+      </select>
+      <select class="ac-control-input" name="sort">
+        <option value="newest" <?= $sort === 'newest' ? 'selected' : '' ?>>Newest first</option>
+        <option value="oldest" <?= $sort === 'oldest' ? 'selected' : '' ?>>Oldest first</option>
+        <option value="title_asc" <?= $sort === 'title_asc' ? 'selected' : '' ?>>Title A-Z</option>
+        <option value="title_desc" <?= $sort === 'title_desc' ? 'selected' : '' ?>>Title Z-A</option>
+      </select>
+      <button type="submit" class="ac-btn ac-btn-primary">Apply</button>
+      <a href="/releases" class="ac-btn ac-btn-ghost">Reset</a>
+    </form>
+
+    <?php if ($artistFilter !== '' || $search !== '' || $sort !== 'newest'): ?>
+      <div class="ac-active-filters">
+        <?php if ($artistFilter !== ''): ?><div class="ac-chip">Artist: <?= htmlspecialchars($artistFilter, ENT_QUOTES, 'UTF-8') ?></div><?php endif; ?>
+        <?php if ($search !== ''): ?><div class="ac-chip">Search: <?= htmlspecialchars($search, ENT_QUOTES, 'UTF-8') ?></div><?php endif; ?>
+        <?php if ($sort !== 'newest'): ?><div class="ac-chip">Sort: <?= htmlspecialchars(str_replace('_', ' ', $sort), ENT_QUOTES, 'UTF-8') ?></div><?php endif; ?>
+      </div>
+    <?php endif; ?>
+
+    <?php if (!$releases): ?>
+      <div class="ac-empty">No releases published yet.</div>
+    <?php else: ?>
+      <div class="ac-release-grid">
+        <?php foreach ($releases as $release): ?>
+          <a class="ac-release-card" href="/release?slug=<?= htmlspecialchars((string)$release['slug'], ENT_QUOTES, 'UTF-8') ?>">
+            <div class="ac-release-cover">
+              <?php if (!empty($release['cover_url'])): ?>
+                <img src="<?= htmlspecialchars((string)$release['cover_url'], ENT_QUOTES, 'UTF-8') ?>" alt="">
+              <?php else: ?>
+                <div class="ac-release-placeholder">AC</div>
+              <?php endif; ?>
+              <?php if (!empty($release['release_date'])): ?>
+                <span class="ac-release-date"><?= htmlspecialchars((string)$release['release_date'], ENT_QUOTES, 'UTF-8') ?></span>
+              <?php endif; ?>
+            </div>
+            <div class="ac-release-meta">
+              <div class="ac-release-title"><?= htmlspecialchars((string)$release['title'], ENT_QUOTES, 'UTF-8') ?></div>
+              <?php if (!empty($release['artist_name'])): ?>
+                <div class="ac-release-artist"><?= htmlspecialchars((string)$release['artist_name'], ENT_QUOTES, 'UTF-8') ?></div>
+              <?php endif; ?>
+            </div>
+          </a>
+        <?php endforeach; ?>
+      </div>
+    <?php endif; ?>
+
+    <?php if ($totalPages > 1): ?>
+      <nav class="ac-release-pagination">
+        <?php $prevPage = max(1, $currentPage - 1); ?>
+        <?php $nextPage = min($totalPages, $currentPage + 1); ?>
+        <a class="ac-btn ac-btn-ghost<?= $currentPage <= 1 ? ' is-disabled' : '' ?>" href="<?= $currentPage <= 1 ? '#' : htmlspecialchars($buildReleaseUrl($prevPage), ENT_QUOTES, 'UTF-8') ?>">Prev</a>
+        <div class="ac-pagination-meta">Page <?= $currentPage ?> of <?= $totalPages ?> · <?= $releaseCount ?> total</div>
+        <a class="ac-btn ac-btn-ghost<?= $currentPage >= $totalPages ? ' is-disabled' : '' ?>" href="<?= $currentPage >= $totalPages ? '#' : htmlspecialchars($buildReleaseUrl($nextPage), ENT_QUOTES, 'UTF-8') ?>">Next</a>
+      </nav>
+    <?php endif; ?>
+  </section>
+</div>
+
+<style>
+  .ac-releases-page .ac-releases-shell {
+    margin-top: 14px;
+    display: grid;
+    gap: 14px;
+  }
+  .ac-releases-page .ac-releases-header {
+    border-bottom: 1px solid rgba(255,255,255,0.06);
+    padding-bottom: 10px;
+  }
+  .ac-releases-page .ac-releases-header h1 {
+    margin: 8px 0 0;
+    font-size: 52px;
+    line-height: 1.05;
+    letter-spacing: -0.02em;
+  }
+  .ac-releases-page .ac-releases-header p {
+    margin: 8px 0 0;
+    color: var(--muted);
+    font-size: 14px;
+  }
+
+  .ac-releases-page .ac-release-controls {
+    display: grid;
+    grid-template-columns: minmax(260px, 1fr) 180px 180px auto auto;
+    gap: 10px;
+    align-items: center;
+    padding: 8px;
+    border: 1px solid rgba(255,255,255,0.07);
+    border-radius: 14px;
+    background: rgba(8, 12, 19, 0.16);
+  }
+  .ac-releases-page .ac-search-wrap {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    min-width: 0;
+    border: 1px solid rgba(255,255,255,0.07);
+    border-radius: 10px;
+    background: rgba(7,10,16,0.10);
+    height: 36px;
+    padding: 0 10px;
+  }
+  .ac-releases-page .ac-search-icon {
+    color: rgba(255,255,255,0.72);
+    font-size: 12px;
+    width: 16px;
+    display: inline-flex;
+    justify-content: center;
+  }
+  .ac-releases-page .ac-search-input,
+  .ac-releases-page .ac-control-input {
+    width: 100%;
+    height: 36px;
+    border-radius: 10px;
+    border: 1px solid rgba(255,255,255,0.07);
+    background: rgba(7,10,16,0.10);
+    color: rgba(233,237,247,0.94);
+    padding: 0 10px;
+    font-size: 13px;
+    outline: none;
+  }
+  .ac-releases-page .ac-search-input {
+    border: 0;
+    background: transparent;
+    padding: 0;
+    min-width: 0;
+  }
+  .ac-releases-page .ac-search-input::placeholder {
+    color: rgba(220,228,245,.45);
+  }
+  .ac-releases-page .ac-search-input:focus,
+  .ac-releases-page .ac-control-input:focus {
+    box-shadow: 0 0 0 2px rgba(34,242,165,.12);
+    border-color: rgba(34,242,165,.38);
+  }
+
+  .ac-releases-page .ac-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    height: 36px;
+    padding: 0 14px;
+    border-radius: 10px;
+    border: 1px solid rgba(255,255,255,.10);
+    text-decoration: none;
+    font-size: 10px;
+    text-transform: uppercase;
+    letter-spacing: .12em;
+    font-weight: 700;
+    cursor: pointer;
+    transition: all .2s ease;
+  }
+  .ac-releases-page .ac-btn-primary {
+    background: rgba(34,242,165,.14);
+    color: #87f2cb;
+    border-color: rgba(34,242,165,.34);
+  }
+  .ac-releases-page .ac-btn-primary:hover {
+    background: rgba(34,242,165,.20);
+  }
+  .ac-releases-page .ac-btn-ghost {
+    color: #a1acc4;
+    background: transparent;
+    border-color: rgba(255,255,255,.10);
+  }
+  .ac-releases-page .ac-btn-ghost:hover {
+    color: #e5ebf7;
+    border-color: rgba(255,255,255,.18);
+  }
+  .ac-releases-page .ac-btn.is-disabled {
+    opacity: .45;
+    pointer-events: none;
+  }
+
+  .ac-releases-page .ac-active-filters {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    flex-wrap: wrap;
+  }
+  .ac-releases-page .ac-chip {
+    border-radius: 999px;
+    padding: 6px 10px;
+    border: 1px solid rgba(255,255,255,.12);
+    font-size: 10px;
+    letter-spacing: .12em;
+    text-transform: uppercase;
+    color: var(--muted);
+    font-family: 'IBM Plex Mono', monospace;
+  }
+
+  .ac-releases-page .ac-release-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(220px, 240px));
+    justify-content: start;
+    gap: 16px;
+  }
+  .ac-releases-page .ac-release-card {
+    display: grid;
+    gap: 10px;
+    color: inherit;
+    text-decoration: none;
+    padding: 10px;
+    border-radius: 18px;
+    border: 1px solid rgba(255,255,255,.08);
+    background: rgba(0,0,0,.14);
+    transition: border-color .2s ease, transform .2s ease;
+  }
+  .ac-releases-page .ac-release-card:hover {
+    border-color: rgba(255,255,255,.18);
+    transform: translateY(-2px);
+  }
+  .ac-releases-page .ac-release-cover {
+    width: 100%;
+    aspect-ratio: 1 / 1;
+    border-radius: 16px;
+    overflow: hidden;
+    position: relative;
+    background: rgba(255,255,255,.03);
+  }
+  .ac-releases-page .ac-release-cover img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+  }
+  .ac-releases-page .ac-release-date {
+    position: absolute;
+    left: 10px;
+    bottom: 10px;
+    border-radius: 999px;
+    padding: 6px 10px;
+    font-size: 11px;
+    color: #fff;
+    background: rgba(0,0,0,.56);
+    border: 1px solid rgba(255,255,255,.18);
+  }
+  .ac-releases-page .ac-release-placeholder {
+    width: 100%;
+    height: 100%;
+    display: grid;
+    place-items: center;
+    color: var(--muted);
+    letter-spacing: .16em;
+  }
+  .ac-releases-page .ac-release-meta {
+    display: grid;
+    gap: 6px;
+  }
+  .ac-releases-page .ac-release-title {
+    font-weight: 600;
+    font-size: 18px;
+    line-height: 1.2;
+  }
+  .ac-releases-page .ac-release-artist {
+    font-size: 13px;
+    color: var(--muted);
+  }
+  .ac-releases-page .ac-empty {
+    padding: 16px;
+    border: 1px solid rgba(255,255,255,.08);
+    border-radius: 12px;
+    color: var(--muted);
+  }
+
+  .ac-releases-page .ac-release-pagination {
+    margin-top: 2px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .ac-releases-page .ac-pagination-meta {
+    font-size: 12px;
+    color: var(--muted);
+  }
+
+  @media (max-width: 1180px) {
+    .ac-releases-page .ac-release-controls {
+      grid-template-columns: 1fr 160px 160px auto auto;
+    }
+    .ac-releases-page .ac-release-grid {
+      grid-template-columns: repeat(auto-fill, minmax(210px, 230px));
+    }
+  }
+  @media (max-width: 900px) {
+    .ac-releases-page .ac-release-controls {
+      grid-template-columns: 1fr 1fr 1fr;
+    }
+    .ac-releases-page .ac-release-controls .ac-search-wrap {
+      grid-column: 1 / -1;
+    }
+  }
+  @media (max-width: 760px) {
+    .ac-releases-page .ac-releases-header h1 {
+      font-size: 40px;
+    }
+    .ac-releases-page .ac-release-controls {
+      grid-template-columns: 1fr;
+    }
+    .ac-releases-page .ac-release-grid {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+      justify-content: stretch;
+    }
+  }
+  @media (max-width: 520px) {
+    .ac-releases-page .ac-release-grid {
+      grid-template-columns: 1fr;
+    }
+  }
+</style>
+
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';

plugins/releases/views/site/show.php

@@ -0,0 +1,326 @@
+<?php
+declare(strict_types=1);
+
+$pageTitle = $title ?? 'Release';
+$release = $release ?? null;
+$tracks = $tracks ?? [];
+$storePluginEnabled = (bool)($store_plugin_enabled ?? false);
+$releaseCover = (string)($release['cover_url'] ?? '');
+$returnUrl = (string)($_SERVER['REQUEST_URI'] ?? '/releases');
+$releaseStoreEnabled = (int)($release['store_enabled'] ?? 0) === 1;
+$bundlePrice = (float)($release['bundle_price'] ?? 0);
+$bundleCurrency = (string)($release['store_currency'] ?? 'GBP');
+$bundleLabel = trim((string)($release['purchase_label'] ?? ''));
+$bundleLabel = $bundleLabel !== '' ? $bundleLabel : 'Buy Release';
+ob_start();
+?>
+<section class="card" style="display:grid; gap:18px; padding-bottom:110px;">
+  <div class="badge">Release</div>
+  <?php if (!$release): ?>
+    <h1 style="margin:0; font-size:28px;">Release not found</h1>
+    <p style="color:var(--muted);">This release is unavailable.</p>
+  <?php else: ?>
+    <div class="release-wrap" style="display:grid; gap:18px;">
+      <div class="release-hero" style="display:grid; grid-template-columns:minmax(0,1fr) 360px; gap:22px; align-items:start;">
+        <div class="release-meta" style="display:grid; gap:14px;">
+          <h1 style="margin:0; font-size:46px; line-height:1.06;"><?= htmlspecialchars((string)$release['title'], ENT_QUOTES, 'UTF-8') ?></h1>
+          <?php if (!empty($release['artist_name'])): ?>
+            <div style="font-size:14px; color:var(--muted);">
+              By
+              <a href="/releases?artist=<?= rawurlencode((string)$release['artist_name']) ?>" style="color:#dfe7fb; text-decoration:none; border-bottom:1px solid rgba(223,231,251,.35);">
+                <?= htmlspecialchars((string)$release['artist_name'], ENT_QUOTES, 'UTF-8') ?>
+              </a>
+            </div>
+          <?php endif; ?>
+          <div style="display:grid; grid-template-columns:repeat(2, minmax(0, 1fr)); gap:10px; max-width:640px;">
+            <?php if (!empty($release['catalog_no'])): ?>
+              <div style="padding:10px 12px; border-radius:12px; border:1px solid rgba(255,255,255,0.08); background:rgba(0,0,0,0.22);">
+                <div class="badge" style="font-size:9px;">Catalog</div>
+                <div style="margin-top:6px; font-size:14px;"><?= htmlspecialchars((string)$release['catalog_no'], ENT_QUOTES, 'UTF-8') ?></div>
+              </div>
+            <?php endif; ?>
+            <?php if (!empty($release['release_date'])): ?>
+              <div style="padding:10px 12px; border-radius:12px; border:1px solid rgba(255,255,255,0.08); background:rgba(0,0,0,0.22);">
+                <div class="badge" style="font-size:9px;">Release Date</div>
+                <div style="margin-top:6px; font-size:14px;"><?= htmlspecialchars((string)$release['release_date'], ENT_QUOTES, 'UTF-8') ?></div>
+              </div>
+            <?php endif; ?>
+          </div>
+          <?php if (!empty($release['description'])): ?>
+            <div style="color:var(--muted); line-height:1.75; max-width:760px;">
+              <?= nl2br(htmlspecialchars((string)$release['description'], ENT_QUOTES, 'UTF-8')) ?>
+            </div>
+          <?php endif; ?>
+          <?php if ($storePluginEnabled && $releaseStoreEnabled && $bundlePrice > 0): ?>
+            <div style="margin-top:4px;">
+              <form method="post" action="/store/cart/add" style="margin:0;">
+                <input type="hidden" name="item_type" value="release">
+                <input type="hidden" name="item_id" value="<?= (int)($release['id'] ?? 0) ?>">
+                <input type="hidden" name="title" value="<?= htmlspecialchars((string)$release['title'], ENT_QUOTES, 'UTF-8') ?>">
+                <input type="hidden" name="cover_url" value="<?= htmlspecialchars($releaseCover, ENT_QUOTES, 'UTF-8') ?>">
+                <input type="hidden" name="currency" value="<?= htmlspecialchars($bundleCurrency, ENT_QUOTES, 'UTF-8') ?>">
+                <input type="hidden" name="price" value="<?= htmlspecialchars(number_format($bundlePrice, 2, '.', ''), ENT_QUOTES, 'UTF-8') ?>">
+                <input type="hidden" name="qty" value="1">
+                <input type="hidden" name="return_url" value="<?= htmlspecialchars($returnUrl, ENT_QUOTES, 'UTF-8') ?>">
+                <button type="submit" class="track-buy-btn">
+                  <i class="fa-solid fa-cart-plus"></i>
+                  <span><?= htmlspecialchars($bundleLabel, ENT_QUOTES, 'UTF-8') ?> <?= htmlspecialchars($bundleCurrency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($bundlePrice, 2) ?></span>
+                </button>
+              </form>
+            </div>
+          <?php endif; ?>
+        </div>
+
+        <div class="release-cover-box" style="border-radius:20px; overflow:hidden; background:rgba(255,255,255,0.05); border:1px solid rgba(255,255,255,0.1); aspect-ratio:1/1;">
+          <?php if ($releaseCover !== ''): ?>
+            <img id="releaseCoverMain" src="<?= htmlspecialchars($releaseCover, ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; height:100%; object-fit:cover;">
+          <?php else: ?>
+            <div id="releaseCoverMain" style="height:100%; display:grid; place-items:center; color:var(--muted); letter-spacing:0.3em; font-size:12px;">AUDIOCORE</div>
+          <?php endif; ?>
+        </div>
+      </div>
+
+      <?php if ($tracks): ?>
+        <div style="padding:16px; border-radius:18px; border:1px solid rgba(255,255,255,0.08); background:rgba(0,0,0,0.22); display:grid; gap:10px;">
+          <div style="display:flex; align-items:center; justify-content:space-between; gap:12px;">
+            <div class="badge">Tracklist</div>
+            <div style="display:flex; align-items:center; gap:10px;">
+              <div id="releasePlayerNow" style="font-size:12px; color:var(--muted);">Select a track to play sample</div>
+            </div>
+          </div>
+
+          <div style="display:grid; gap:8px;">
+            <?php foreach ($tracks as $track): ?>
+              <?php
+                $sample = (string)($track['sample_url'] ?? '');
+                $trackTitle = (string)($track['title'] ?? 'Track');
+                $mix = (string)($track['mix_name'] ?? '');
+                $fullTitle = $mix !== '' ? ($trackTitle . ' (' . $mix . ')') : $trackTitle;
+              ?>
+              <div class="track-row" style="display:grid; grid-template-columns:92px minmax(0,1fr) auto; gap:12px; align-items:center; padding:10px 12px; border-radius:12px; border:1px solid rgba(255,255,255,0.08); background:rgba(0,0,0,0.26);">
+                <button type="button"
+                        class="track-play-btn"
+                        data-src="<?= htmlspecialchars($sample, ENT_QUOTES, 'UTF-8') ?>"
+                        data-title="<?= htmlspecialchars($fullTitle, ENT_QUOTES, 'UTF-8') ?>"
+                        data-cover="<?= htmlspecialchars($releaseCover, ENT_QUOTES, 'UTF-8') ?>"
+                        <?= $sample === '' ? 'disabled' : '' ?>>
+                  <i class="fa-solid fa-play"></i> <span>Play</span>
+                </button>
+                <div style="min-width:0;">
+                  <div style="font-weight:600; white-space:nowrap; overflow:hidden; text-overflow:ellipsis;">
+                    <?= htmlspecialchars($trackTitle, ENT_QUOTES, 'UTF-8') ?>
+                    <?php if ($mix !== ''): ?>
+                      <span style="color:var(--muted); font-weight:400;">(<?= htmlspecialchars($mix, ENT_QUOTES, 'UTF-8') ?>)</span>
+                    <?php endif; ?>
+                  </div>
+                  <div style="font-size:12px; color:var(--muted); margin-top:4px;">
+                    <?= (int)($track['track_no'] ?? 0) > 0 ? '#' . (int)$track['track_no'] : 'Track' ?>
+                    <?= !empty($track['duration']) ? ' - ' . htmlspecialchars((string)$track['duration'], ENT_QUOTES, 'UTF-8') : '' ?>
+                    <?= !empty($track['bpm']) ? ' - ' . htmlspecialchars((string)$track['bpm'], ENT_QUOTES, 'UTF-8') . ' BPM' : '' ?>
+                    <?= !empty($track['key_signature']) ? ' - ' . htmlspecialchars((string)$track['key_signature'], ENT_QUOTES, 'UTF-8') : '' ?>
+                  </div>
+                </div>
+                <div style="display:flex; align-items:center; gap:8px;">
+                  <?php
+                    $trackStoreEnabled = (int)($track['store_enabled'] ?? 0) === 1;
+                    $trackPrice = (float)($track['track_price'] ?? 0);
+                    $trackCurrency = (string)($track['store_currency'] ?? 'GBP');
+                  ?>
+                  <?php if ($storePluginEnabled && $trackStoreEnabled && $trackPrice > 0): ?>
+                    <form method="post" action="/store/cart/add" style="margin:0;">
+                      <input type="hidden" name="item_type" value="track">
+                      <input type="hidden" name="item_id" value="<?= (int)($track['id'] ?? 0) ?>">
+                      <input type="hidden" name="title" value="<?= htmlspecialchars($fullTitle, ENT_QUOTES, 'UTF-8') ?>">
+                      <input type="hidden" name="cover_url" value="<?= htmlspecialchars($releaseCover, ENT_QUOTES, 'UTF-8') ?>">
+                      <input type="hidden" name="currency" value="<?= htmlspecialchars($trackCurrency, ENT_QUOTES, 'UTF-8') ?>">
+                      <input type="hidden" name="price" value="<?= htmlspecialchars(number_format($trackPrice, 2, '.', ''), ENT_QUOTES, 'UTF-8') ?>">
+                      <input type="hidden" name="qty" value="1">
+                      <input type="hidden" name="return_url" value="<?= htmlspecialchars($returnUrl, ENT_QUOTES, 'UTF-8') ?>">
+                      <button type="submit" class="track-buy-btn">
+                        <i class="fa-solid fa-cart-plus"></i>
+                        <span>Buy <?= htmlspecialchars($trackCurrency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($trackPrice, 2) ?></span>
+                      </button>
+                    </form>
+                  <?php else: ?>
+                    <div style="font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.18em;">
+                      <?= $sample !== '' ? 'Sample' : 'No sample' ?>
+                    </div>
+                  <?php endif; ?>
+                </div>
+              </div>
+            <?php endforeach; ?>
+          </div>
+        </div>
+      <?php endif; ?>
+
+      <?php if (!empty($release['credits'])): ?>
+        <div style="padding:12px 14px; border-radius:14px; border:1px solid rgba(255,255,255,0.08); background:rgba(0,0,0,0.2);">
+          <div class="badge" style="font-size:9px;">Credits</div>
+          <div style="margin-top:6px; color:var(--muted); line-height:1.55; font-size:13px;">
+            <?= nl2br(htmlspecialchars((string)$release['credits'], ENT_QUOTES, 'UTF-8')) ?>
+          </div>
+        </div>
+      <?php endif; ?>
+    </div>
+  <?php endif; ?>
+</section>
+
+<div id="acDock" class="ac-dock" hidden>
+  <div class="ac-dock-inner">
+    <div class="ac-dock-meta">
+      <div id="acDockArt" class="ac-dock-art">AC</div>
+      <div class="ac-dock-title-wrap">
+        <div class="badge" style="font-size:9px;">Now Playing</div>
+        <div id="acDockTitle" class="ac-dock-title">Track sample</div>
+      </div>
+    </div>
+    <button type="button" id="acDockToggle" class="ac-dock-toggle"><i class="fa-solid fa-play"></i> <span>Play</span></button>
+    <input id="acDockSeek" class="ac-seek" type="range" min="0" max="100" value="0" step="0.1">
+    <div class="ac-dock-time"><span id="acDockCurrent">0:00</span> / <span id="acDockDuration">0:00</span></div>
+    <input id="acDockVolume" class="ac-volume" type="range" min="0" max="1" value="1" step="0.01">
+    <button type="button" id="acDockClose" class="ac-dock-close" aria-label="Close player">X</button>
+    <audio id="acDockAudio" preload="none"></audio>
+  </div>
+</div>
+
+<style>
+  .release-wrap {
+    min-width: 0;
+  }
+  .track-row.is-active { border-color: rgba(34,242,165,.45)!important; background: rgba(34,242,165,.08)!important; }
+  .track-play-btn,.ac-dock-toggle{height:34px;border:1px solid rgba(34,242,165,.35);border-radius:999px;background:rgba(34,242,165,.12);color:#bffff0;font-weight:700;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;gap:6px;padding:0 14px}
+  .track-buy-btn{height:34px;border:1px solid rgba(255,255,255,.18);border-radius:999px;background:rgba(255,255,255,.08);color:#e9eefc;font-weight:700;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;gap:6px;padding:0 14px;font-size:12px;white-space:nowrap}
+  .track-buy-btn:hover{background:rgba(255,255,255,.14)}
+  .track-play-btn[disabled]{border-color:rgba(255,255,255,.2);background:rgba(255,255,255,.08);color:var(--muted);cursor:not-allowed}
+  .ac-dock{position:fixed;left:14px;right:14px;bottom:14px;z-index:50}
+  .ac-dock-inner{display:grid;grid-template-columns:minmax(210px,280px) 96px minmax(160px,1fr) 110px 110px 44px;gap:10px;align-items:center;padding:12px;border-radius:14px;border:1px solid rgba(255,255,255,.14);background:rgba(10,11,15,.95)}
+  .ac-dock-meta{display:grid;grid-template-columns:44px minmax(0,1fr);align-items:center;gap:10px;min-width:0}
+  .ac-dock-art{width:44px;height:44px;border-radius:10px;border:1px solid rgba(255,255,255,.12);background:rgba(255,255,255,.06);overflow:hidden;display:grid;place-items:center;font-size:10px;color:var(--muted)}
+  .ac-dock-art img{width:100%;height:100%;object-fit:cover;display:block}
+  .ac-dock-title-wrap{min-width:0}.ac-dock-title{margin-top:4px;font-size:13px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+  .ac-dock-time{font-size:12px;color:var(--muted);font-family:'IBM Plex Mono',monospace}
+  .ac-dock-close{height:34px;border-radius:10px;border:1px solid rgba(255,255,255,.2);background:rgba(255,255,255,.05);color:var(--muted);cursor:pointer}
+  .ac-seek,.ac-volume{-webkit-appearance:none;appearance:none;height:6px;border-radius:999px;background:rgba(255,255,255,.2);outline:none}
+  .ac-seek::-webkit-slider-thumb,.ac-volume::-webkit-slider-thumb{-webkit-appearance:none;appearance:none;width:14px;height:14px;border-radius:50%;background:#22f2a5;border:1px solid rgba(0,0,0,.45)}
+  @media (max-width: 980px) {
+    .release-hero {
+      grid-template-columns: 1fr !important;
+      gap: 16px !important;
+    }
+    .release-cover-box {
+      max-width: 420px;
+    }
+  }
+  @media (max-width: 700px) {
+    .release-meta h1 {
+      font-size: 32px !important;
+      line-height: 1.12 !important;
+    }
+    .track-row {
+      grid-template-columns: 88px minmax(0,1fr) !important;
+      gap: 10px !important;
+    }
+    .track-buy-btn { font-size: 11px; padding: 0 10px; }
+    .ac-dock {
+      left: 8px;
+      right: 8px;
+      bottom: 8px;
+    }
+    .ac-dock-inner {
+      grid-template-columns: minmax(0,1fr) 96px auto 44px !important;
+      grid-template-areas:
+        "meta toggle time close"
+        "seek seek seek seek";
+      row-gap: 8px;
+      padding: 10px;
+      border-radius: 12px;
+    }
+    .ac-dock-meta { grid-area: meta; gap: 8px; }
+    .ac-dock-art { width: 38px; height: 38px; border-radius: 8px; }
+    .ac-dock-title { font-size: 12px; }
+    .ac-dock-close { grid-area: close; width: 44px; justify-self: end; }
+    .ac-dock-toggle {
+      grid-area: toggle;
+      height: 32px;
+      padding: 0 8px;
+      border-radius: 999px;
+      justify-self: center;
+      width: 96px;
+      min-width: 96px;
+      font-size: 12px;
+    }
+    .ac-dock-time {
+      grid-area: time;
+      text-align: right;
+      white-space: nowrap;
+      font-size: 12px;
+      align-self: center;
+    }
+    .ac-seek { grid-area: seek; margin-top: 0; align-self: center; }
+    .ac-volume { display: none; }
+  }
+</style>
+
+<script>
+(function () {
+  const dock = document.getElementById('acDock');
+  const audio = document.getElementById('acDockAudio');
+  const toggle = document.getElementById('acDockToggle');
+  const seek = document.getElementById('acDockSeek');
+  const volume = document.getElementById('acDockVolume');
+  const current = document.getElementById('acDockCurrent');
+  const duration = document.getElementById('acDockDuration');
+  const titleEl = document.getElementById('acDockTitle');
+  const dockArt = document.getElementById('acDockArt');
+  const closeBtn = document.getElementById('acDockClose');
+  const status = document.getElementById('releasePlayerNow');
+  const mainCover = document.getElementById('releaseCoverMain');
+  if (!dock || !audio || !toggle || !seek || !volume || !current || !duration || !titleEl || !closeBtn) return;
+
+  const mainCoverSrc = mainCover && mainCover.tagName === 'IMG' ? (mainCover.getAttribute('src') || '') : '';
+  const defaultCover = mainCoverSrc || <?= json_encode($releaseCover, JSON_UNESCAPED_SLASHES) ?> || '';
+  let activeBtn = null;
+
+  function fmt(sec){ if(!isFinite(sec)||sec<0) return '0:00'; const m=Math.floor(sec/60), s=Math.floor(sec%60); return m+':'+String(s).padStart(2,'0'); }
+  function setPlayState(btn,playing){ if(!btn) return; btn.innerHTML = playing ? '<i class="fa-solid fa-pause"></i> <span>Pause</span>' : '<i class="fa-solid fa-play"></i> <span>Play</span>'; }
+  function setDockArt(src){ if(!dockArt) return; const finalSrc = src || defaultCover; dockArt.innerHTML = finalSrc ? ('<img src="'+finalSrc.replace(/"/g,'&quot;')+'" alt="">') : 'AC'; }
+
+  function setActive(btn,title){
+    document.querySelectorAll('.track-play-btn').forEach((b)=>{ setPlayState(b,false); const row=b.closest('.track-row'); if(row) row.classList.remove('is-active'); });
+    activeBtn = btn;
+    if(btn){ setPlayState(btn,true); const row=btn.closest('.track-row'); if(row) row.classList.add('is-active'); }
+    titleEl.textContent = title || 'Track sample';
+    if(status) status.textContent = title ? ('Now Playing: '+title) : 'Select a track to play sample';
+  }
+
+  function openAndPlay(src,title,btn,cover){
+    if(!src) return;
+    if(dock.hidden) dock.hidden = false;
+    setDockArt(cover || '');
+    if(audio.getAttribute('src') === src){ if(audio.paused) audio.play().catch(()=>{}); else audio.pause(); return; }
+    audio.setAttribute('src', src);
+    setActive(btn,title);
+    audio.play().catch(()=>{ if(btn) setPlayState(btn,false); });
+  }
+
+  document.querySelectorAll('.track-play-btn').forEach((btn)=>{
+    btn.addEventListener('click', ()=>{
+      openAndPlay(btn.getAttribute('data-src') || '', btn.getAttribute('data-title') || 'Track sample', btn, btn.getAttribute('data-cover') || '');
+    });
+  });
+
+  toggle.addEventListener('click', ()=>{ if(!audio.getAttribute('src')) return; if(audio.paused) audio.play().catch(()=>{}); else audio.pause(); });
+  closeBtn.addEventListener('click', ()=>{ audio.pause(); audio.removeAttribute('src'); seek.value='0'; current.textContent='0:00'; duration.textContent='0:00'; setPlayState(toggle,false); setActive(null,''); setDockArt(''); dock.hidden=true; });
+  volume.addEventListener('input', ()=>{ audio.volume = Number(volume.value); });
+  seek.addEventListener('input', ()=>{ if(!isFinite(audio.duration)||audio.duration<=0) return; audio.currentTime = (Number(seek.value)/100)*audio.duration; });
+
+  audio.addEventListener('loadedmetadata', ()=>{ duration.textContent = fmt(audio.duration); });
+  audio.addEventListener('timeupdate', ()=>{ current.textContent = fmt(audio.currentTime); if(isFinite(audio.duration)&&audio.duration>0){ seek.value = String((audio.currentTime/audio.duration)*100); } });
+  audio.addEventListener('play', ()=>{ setPlayState(toggle,true); if(activeBtn) setPlayState(activeBtn,true); });
+  audio.addEventListener('pause', ()=>{ setPlayState(toggle,false); if(activeBtn) setPlayState(activeBtn,false); });
+  audio.addEventListener('ended', ()=>{ setPlayState(toggle,false); if(activeBtn) setPlayState(activeBtn,false); seek.value='0'; current.textContent='0:00'; });
+})();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';

plugins/store/customers.php

@@ -0,0 +1,43 @@
+<?php
+$pageTitle = $title ?? 'Store Customers';
+$customers = $customers ?? [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Store</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Customers</h1>
+      <p style="color: var(--muted); margin-top:6px;">Registered and purchasing customers.</p>
+    </div>
+    <a href="/admin/store" class="btn outline">Back</a>
+  </div>
+  <div style="display:flex; flex-wrap:wrap; gap:8px; margin-top:12px;">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn outline small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <?php if (!$customers): ?>
+    <div style="margin-top:16px; color:var(--muted); font-size:13px;">No customers yet.</div>
+  <?php else: ?>
+    <div style="margin-top:16px; display:grid; gap:10px;">
+      <?php foreach ($customers as $customer): ?>
+        <div class="admin-card" style="padding:14px; display:grid; grid-template-columns:minmax(0,1fr) auto auto; gap:10px; align-items:center;">
+          <div>
+            <div style="font-weight:600;"><?= htmlspecialchars((string)($customer['email'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+            <div style="font-size:12px; color:var(--muted); margin-top:2px;">
+              <?= htmlspecialchars((string)($customer['name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+            </div>
+          </div>
+          <div class="pill"><?= ((int)($customer['is_active'] ?? 1) === 1) ? 'Active' : 'Inactive' ?></div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($customer['created_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+        </div>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/gateways/GatewayInterface.php

@@ -0,0 +1,11 @@
+<?php
+declare(strict_types=1);
+
+namespace Plugins\Store\Gateways;
+
+interface GatewayInterface
+{
+    public function key(): string;
+    public function label(): string;
+    public function isEnabled(array $settings): bool;
+}

plugins/store/gateways/Gateways.php

@@ -0,0 +1,17 @@
+<?php
+declare(strict_types=1);
+
+namespace Plugins\Store\Gateways;
+
+final class Gateways
+{
+    /**
+     * @return GatewayInterface[]
+     */
+    public static function all(): array
+    {
+        return [
+            new PaypalGateway(),
+        ];
+    }
+}

plugins/store/gateways/PaypalGateway.php

@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+namespace Plugins\Store\Gateways;
+
+class PaypalGateway implements GatewayInterface
+{
+    public function key(): string
+    {
+        return 'paypal';
+    }
+
+    public function label(): string
+    {
+        return 'PayPal';
+    }
+
+    public function isEnabled(array $settings): bool
+    {
+        return (string)($settings['store_paypal_enabled'] ?? '0') === '1';
+    }
+}

plugins/store/gateways/StripeGateway.php

@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+namespace Plugins\Store\Gateways;
+
+class StripeGateway implements GatewayInterface
+{
+    public function key(): string
+    {
+        return 'stripe';
+    }
+
+    public function label(): string
+    {
+        return 'Stripe';
+    }
+
+    public function isEnabled(array $settings): bool
+    {
+        return (string)($settings['store_stripe_enabled'] ?? '0') === '1';
+    }
+}

plugins/store/index.php

@@ -0,0 +1,52 @@
+<?php
+$pageTitle = $title ?? 'Store';
+$tablesReady = (bool)($tables_ready ?? false);
+$privateRoot = (string)($private_root ?? '');
+$privateRootReady = (bool)($private_root_ready ?? false);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Store</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Store</h1>
+      <p style="color: var(--muted); margin-top:6px;">Commerce layer for releases/tracks.</p>
+    </div>
+    <div style="display:flex; gap:10px; align-items:center;">
+      <a href="/admin/store/settings" class="btn outline">Settings</a>
+      <a href="/admin/store/orders" class="btn outline">Orders</a>
+      <a href="/admin/store/customers" class="btn outline">Customers</a>
+    </div>
+  </div>
+  <div style="display:flex; flex-wrap:wrap; gap:8px; margin-top:12px;">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn outline small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <?php if (!$tablesReady): ?>
+    <div class="admin-card" style="margin-top:16px; padding:16px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+      <div>
+        <div style="font-weight:600;">Store tables not initialized</div>
+        <div style="color: var(--muted); font-size:13px; margin-top:4px;">Create store tables before configuring products and checkout.</div>
+      </div>
+      <form method="post" action="/admin/store/install">
+        <button type="submit" class="btn small">Create Tables</button>
+      </form>
+    </div>
+  <?php endif; ?>
+
+  <div class="admin-card" style="margin-top:16px; padding:16px;">
+    <div style="font-weight:600;">Private download root</div>
+    <div style="color: var(--muted); font-size:13px; margin-top:4px; font-family:'IBM Plex Mono', monospace;">
+      <?= htmlspecialchars($privateRoot, ENT_QUOTES, 'UTF-8') ?>
+    </div>
+    <div style="margin-top:8px; font-size:12px; color: <?= $privateRootReady ? '#9be7c6' : '#f3b0b0' ?>;">
+      <?= $privateRootReady ? 'Ready' : 'Missing or not writable' ?>
+    </div>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/orders.php

@@ -0,0 +1,45 @@
+<?php
+$pageTitle = $title ?? 'Store Orders';
+$orders = $orders ?? [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Store</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Orders</h1>
+      <p style="color: var(--muted); margin-top:6px;">Order queue and payment status.</p>
+    </div>
+    <a href="/admin/store" class="btn outline">Back</a>
+  </div>
+  <div style="display:flex; flex-wrap:wrap; gap:8px; margin-top:12px;">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn outline small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <?php if (!$orders): ?>
+    <div style="margin-top:16px; color:var(--muted); font-size:13px;">No orders yet.</div>
+  <?php else: ?>
+    <div style="margin-top:16px; display:grid; gap:10px;">
+      <?php foreach ($orders as $order): ?>
+        <div class="admin-card" style="padding:14px; display:grid; grid-template-columns:minmax(0,1fr) auto auto auto; gap:10px; align-items:center;">
+          <div>
+            <div style="font-weight:600;"><?= htmlspecialchars((string)($order['order_no'] ?? ('#' . (int)($order['id'] ?? 0))), ENT_QUOTES, 'UTF-8') ?></div>
+            <div style="font-size:12px; color:var(--muted); margin-top:2px;"><?= htmlspecialchars((string)($order['email'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+          </div>
+          <div class="pill"><?= htmlspecialchars((string)($order['status'] ?? 'pending'), ENT_QUOTES, 'UTF-8') ?></div>
+          <div style="font-size:13px; color:var(--text);">
+            <?= htmlspecialchars((string)($order['currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?>
+            <?= number_format((float)($order['total'] ?? 0), 2) ?>
+          </div>
+          <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($order['created_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+        </div>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/plugin.json

@@ -0,0 +1,14 @@
+{
+  "name": "Store",
+  "version": "0.1.0",
+  "description": "Commerce layer for releases and tracks.",
+  "author": "AudioCore",
+  "admin_nav": {
+    "label": "Store",
+    "url": "/admin/store",
+    "roles": ["admin", "manager"],
+    "icon": "fa-solid fa-cart-shopping"
+  },
+  "entry": "plugin.php",
+  "default_enabled": false
+}

plugins/store/plugin.php

@@ -0,0 +1,283 @@
+<?php
+declare(strict_types=1);
+
+use Core\Http\Router;
+use Core\Services\Database;
+use Core\Services\Settings;
+use Core\Services\Shortcodes;
+use Plugins\Store\StoreController;
+
+require_once __DIR__ . '/StoreController.php';
+require_once __DIR__ . '/gateways/GatewayInterface.php';
+require_once __DIR__ . '/gateways/PaypalGateway.php';
+require_once __DIR__ . '/gateways/Gateways.php';
+
+Shortcodes::register('sale-chart', static function (array $attrs = []): string {
+    $defaultLimit = max(1, min(50, (int)Settings::get('store_sales_chart_limit', '10')));
+    $defaultScope = strtolower(trim((string)Settings::get('store_sales_chart_default_scope', 'tracks')));
+    if (!in_array($defaultScope, ['tracks', 'releases'], true)) {
+        $defaultScope = 'tracks';
+    }
+    $defaultWindow = strtolower(trim((string)Settings::get('store_sales_chart_default_window', 'latest')));
+    if (!in_array($defaultWindow, ['latest', 'weekly', 'all_time'], true)) {
+        $defaultWindow = 'latest';
+    }
+
+    $limit = max(1, min(50, (int)($attrs['limit'] ?? $defaultLimit)));
+    $scope = strtolower(trim((string)($attrs['type'] ?? $attrs['scope'] ?? $defaultScope)));
+    if (!in_array($scope, ['tracks', 'releases'], true)) {
+        $scope = $defaultScope;
+    }
+    $window = strtolower(trim((string)($attrs['mode'] ?? $attrs['window'] ?? $defaultWindow)));
+    if (!in_array($window, ['latest', 'weekly', 'all_time'], true)) {
+        $window = $defaultWindow;
+    }
+
+    $db = Database::get();
+    if (!($db instanceof \PDO)) {
+        return '';
+    }
+
+    $rows = [];
+    try {
+        $latestPaid = (string)($db->query("SELECT MAX(updated_at) FROM ac_store_orders WHERE status = 'paid'")->fetchColumn() ?? '');
+        $latestCache = (string)($db->query("SELECT MAX(updated_at) FROM ac_store_sales_chart_cache")->fetchColumn() ?? '');
+        if ($latestPaid !== '' && ($latestCache === '' || strcmp($latestPaid, $latestCache) > 0)) {
+            (new StoreController())->rebuildSalesChartCache();
+        }
+    } catch (\Throwable $e) {
+    }
+
+    try {
+        $stmt = $db->prepare("
+            SELECT item_key, item_label AS title, units, revenue
+            FROM ac_store_sales_chart_cache
+            WHERE chart_scope = :scope
+              AND chart_window = :window
+            ORDER BY rank_no ASC
+            LIMIT :limit
+        ");
+        $stmt->bindValue(':scope', $scope, \PDO::PARAM_STR);
+        $stmt->bindValue(':window', $window, \PDO::PARAM_STR);
+        $stmt->bindValue(':limit', $limit, \PDO::PARAM_INT);
+        $stmt->execute();
+        $rows = $stmt->fetchAll(\PDO::FETCH_ASSOC) ?: [];
+    } catch (\Throwable $e) {
+        $rows = [];
+    }
+
+    if (!$rows && $scope === 'tracks') {
+        try {
+            $stmt = $db->prepare("
+                SELECT item_key, item_label AS title, units, revenue
+                FROM ac_store_sales_chart_cache
+                WHERE chart_scope = 'releases'
+                  AND chart_window = :window
+                ORDER BY rank_no ASC
+                LIMIT :limit
+            ");
+            $stmt->bindValue(':window', $window, \PDO::PARAM_STR);
+            $stmt->bindValue(':limit', $limit, \PDO::PARAM_INT);
+            $stmt->execute();
+            $rows = $stmt->fetchAll(\PDO::FETCH_ASSOC) ?: [];
+        } catch (\Throwable $e) {
+            $rows = [];
+        }
+    }
+
+    if (!$rows) {
+        return '<div class="ac-shortcode-empty">No sales yet.</div>';
+    }
+
+    $releaseIds = [];
+    $trackIds = [];
+    foreach ($rows as $row) {
+        $itemKey = trim((string)($row['item_key'] ?? ''));
+        if (preg_match('/^release:(\d+)$/', $itemKey, $m)) {
+            $releaseIds[] = (int)$m[1];
+        } elseif (preg_match('/^track:(\d+)$/', $itemKey, $m)) {
+            $trackIds[] = (int)$m[1];
+        }
+    }
+    $releaseIds = array_values(array_unique(array_filter($releaseIds)));
+    $trackIds = array_values(array_unique(array_filter($trackIds)));
+
+    $releaseMap = [];
+    if ($releaseIds) {
+        try {
+            $in = implode(',', array_fill(0, count($releaseIds), '?'));
+            $stmt = $db->prepare("
+                SELECT id, title, slug, cover_url, COALESCE(artist_name, '') AS artist_name
+                FROM ac_releases
+                WHERE id IN ({$in})
+            ");
+            foreach ($releaseIds as $i => $rid) {
+                $stmt->bindValue($i + 1, $rid, \PDO::PARAM_INT);
+            }
+            $stmt->execute();
+            $rels = $stmt->fetchAll(\PDO::FETCH_ASSOC) ?: [];
+            foreach ($rels as $rel) {
+                $releaseMap['release:' . (int)$rel['id']] = $rel;
+            }
+        } catch (\Throwable $e) {
+        }
+    }
+
+    if ($trackIds) {
+        try {
+            $in = implode(',', array_fill(0, count($trackIds), '?'));
+            $stmt = $db->prepare("
+                SELECT t.id AS track_id, r.id, r.title, r.slug, r.cover_url, COALESCE(r.artist_name, '') AS artist_name
+                FROM ac_release_tracks t
+                JOIN ac_releases r ON r.id = t.release_id
+                WHERE t.id IN ({$in})
+            ");
+            foreach ($trackIds as $i => $tid) {
+                $stmt->bindValue($i + 1, $tid, \PDO::PARAM_INT);
+            }
+            $stmt->execute();
+            $rels = $stmt->fetchAll(\PDO::FETCH_ASSOC) ?: [];
+            foreach ($rels as $rel) {
+                $releaseMap['track:' . (int)$rel['track_id']] = $rel;
+            }
+        } catch (\Throwable $e) {
+        }
+    }
+
+    $list = '';
+    $position = 1;
+    foreach ($rows as $row) {
+        $itemKey = trim((string)($row['item_key'] ?? ''));
+        $rel = $releaseMap[$itemKey] ?? null;
+
+        $titleRaw = $rel ? (string)($rel['title'] ?? '') : (string)($row['title'] ?? '');
+        $artistRaw = $rel ? trim((string)($rel['artist_name'] ?? '')) : '';
+        $slugRaw = $rel ? trim((string)($rel['slug'] ?? '')) : '';
+        $coverRaw = $rel ? trim((string)($rel['cover_url'] ?? '')) : '';
+
+        $title = htmlspecialchars($titleRaw !== '' ? $titleRaw : ((string)($row['title'] ?? 'Release')), ENT_QUOTES, 'UTF-8');
+        $artist = htmlspecialchars($artistRaw, ENT_QUOTES, 'UTF-8');
+        $href = $slugRaw !== '' ? '/release?slug=' . rawurlencode($slugRaw) : '#';
+
+        $thumbHtml = $coverRaw !== ''
+            ? '<img src="' . htmlspecialchars($coverRaw, ENT_QUOTES, 'UTF-8') . '" alt="" loading="lazy">'
+            : '<div class="ac-shortcode-cover-fallback">AC</div>';
+
+        $copy = '<span class="ac-shortcode-sale-copy">'
+            . '<span class="ac-shortcode-sale-title">' . $title . '</span>'
+            . ($artist !== '' ? '<span class="ac-shortcode-sale-artist">' . $artist . '</span>' : '')
+            . '</span>'
+            . '<span class="ac-shortcode-sale-rank">' . $position . '</span>';
+
+        $content = '<span class="ac-shortcode-sale-thumb">' . $thumbHtml . '</span>' . $copy;
+
+        if ($href !== '#') {
+            $content = '<a class="ac-shortcode-sale-link" href="' . htmlspecialchars($href, ENT_QUOTES, 'UTF-8') . '">' . $content . '</a>';
+        }
+
+        $list .= '<li class="ac-shortcode-sale-item">' . $content . '</li>';
+        $position++;
+    }
+
+    $heading = htmlspecialchars((string)($attrs['title'] ?? 'Top Sellers'), ENT_QUOTES, 'UTF-8');
+    return '<section class="ac-shortcode-sale-chart"><header class="ac-shortcode-sale-head"><h3>' . $heading . '</h3></header><ol class="ac-shortcode-sale-list">' . $list . '</ol></section>';
+});
+
+Shortcodes::register('login-link', static function (array $attrs = []): string {
+    $label = trim((string)($attrs['label'] ?? 'Login'));
+    if ($label === '') {
+        $label = 'Login';
+    }
+    return '<a class="ac-shortcode-link ac-shortcode-link-login" href="/account">' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</a>';
+});
+
+Shortcodes::register('account-link', static function (array $attrs = []): string {
+    $label = trim((string)($attrs['label'] ?? 'My Account'));
+    if ($label === '') {
+        $label = 'My Account';
+    }
+    return '<a class="ac-shortcode-link ac-shortcode-link-account" href="/account">' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</a>';
+});
+
+Shortcodes::register('checkout-link', static function (array $attrs = []): string {
+    $label = trim((string)($attrs['label'] ?? 'Checkout'));
+    if ($label === '') {
+        $label = 'Checkout';
+    }
+    return '<a class="ac-shortcode-link ac-shortcode-link-checkout" href="/checkout">' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</a>';
+});
+
+Shortcodes::register('cart-link', static function (array $attrs = []): string {
+    $showCount = ((string)($attrs['show_count'] ?? '1')) !== '0';
+    $showTotal = ((string)($attrs['show_total'] ?? '1')) !== '0';
+    $label = trim((string)($attrs['label'] ?? 'Cart'));
+    if ($label === '') {
+        $label = 'Cart';
+    }
+
+    $count = 0;
+    $amount = 0.0;
+    $currency = strtoupper(trim((string)Settings::get('store_currency', 'GBP')));
+    if (!preg_match('/^[A-Z]{3}$/', $currency)) {
+        $currency = 'GBP';
+    }
+    if (session_status() !== PHP_SESSION_ACTIVE) {
+        @session_start();
+    }
+    $cart = is_array($_SESSION['ac_cart'] ?? null) ? $_SESSION['ac_cart'] : [];
+    foreach ($cart as $item) {
+        if (!is_array($item)) {
+            continue;
+        }
+        $qty = max(1, (int)($item['qty'] ?? 1));
+        $price = (float)($item['price'] ?? 0);
+        $count += $qty;
+        $amount += ($price * $qty);
+    }
+
+    $parts = [htmlspecialchars($label, ENT_QUOTES, 'UTF-8')];
+    if ($showCount) {
+        $parts[] = '<span class="ac-shortcode-cart-count">' . $count . '</span>';
+    }
+    if ($showTotal) {
+        $parts[] = '<span class="ac-shortcode-cart-total">' . htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') . ' ' . number_format($amount, 2) . '</span>';
+    }
+
+    return '<a class="ac-shortcode-link ac-shortcode-link-cart" href="/cart">' . implode(' ', $parts) . '</a>';
+});
+
+return function (Router $router): void {
+    $controller = new StoreController();
+    $router->get('/cart', [$controller, 'cartIndex']);
+    $router->post('/cart/discount/apply', [$controller, 'cartApplyDiscount']);
+    $router->post('/cart/discount/remove', [$controller, 'cartClearDiscount']);
+    $router->get('/checkout', [$controller, 'checkoutIndex']);
+    $router->get('/account', [$controller, 'accountIndex']);
+    $router->post('/account/request-login', [$controller, 'accountRequestLogin']);
+    $router->get('/account/login', [$controller, 'accountLogin']);
+    $router->get('/account/logout', [$controller, 'accountLogout']);
+    $router->post('/checkout/place', [$controller, 'checkoutPlace']);
+    $router->get('/checkout/paypal/return', [$controller, 'checkoutPaypalReturn']);
+    $router->get('/checkout/paypal/cancel', [$controller, 'checkoutPaypalCancel']);
+    $router->post('/checkout/sandbox', [$controller, 'checkoutSandbox']);
+    $router->get('/store/download', [$controller, 'download']);
+    $router->post('/cart/remove', [$controller, 'cartRemove']);
+    $router->get('/store/sales-chart/rebuild', [$controller, 'salesChartCron']);
+    $router->get('/admin/store', [$controller, 'adminIndex']);
+    $router->post('/admin/store/install', [$controller, 'adminInstall']);
+    $router->get('/admin/store/settings', [$controller, 'adminSettings']);
+    $router->post('/admin/store/settings', [$controller, 'adminSaveSettings']);
+    $router->post('/admin/store/settings/rebuild-sales-chart', [$controller, 'adminRebuildSalesChart']);
+    $router->post('/admin/store/discounts/create', [$controller, 'adminDiscountCreate']);
+    $router->post('/admin/store/discounts/delete', [$controller, 'adminDiscountDelete']);
+    $router->post('/admin/store/settings/test-email', [$controller, 'adminSendTestEmail']);
+    $router->post('/admin/store/settings/test-paypal', [$controller, 'adminTestPaypal']);
+    $router->get('/admin/store/customers', [$controller, 'adminCustomers']);
+    $router->get('/admin/store/orders', [$controller, 'adminOrders']);
+    $router->post('/admin/store/orders/create', [$controller, 'adminOrderCreate']);
+    $router->post('/admin/store/orders/status', [$controller, 'adminOrderStatus']);
+    $router->post('/admin/store/orders/refund', [$controller, 'adminOrderRefund']);
+    $router->post('/admin/store/orders/delete', [$controller, 'adminOrderDelete']);
+    $router->get('/admin/store/order', [$controller, 'adminOrderView']);
+    $router->post('/store/cart/add', [$controller, 'cartAdd']);
+};

plugins/store/settings.php

@@ -0,0 +1,90 @@
+<?php
+$pageTitle = $title ?? 'Store Settings';
+$settings = $settings ?? [];
+$error = (string)($error ?? '');
+$saved = (string)($saved ?? '');
+$privateRootReady = (bool)($private_root_ready ?? false);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Store</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Store Settings</h1>
+      <p style="color: var(--muted); margin-top:6px;">Payment, private downloads, and order defaults.</p>
+    </div>
+    <a href="/admin/store" class="btn outline">Back</a>
+  </div>
+  <div style="display:flex; flex-wrap:wrap; gap:8px; margin-top:12px;">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn outline small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <?php if ($error !== ''): ?>
+    <div style="margin-top:12px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+  <?php if ($saved !== ''): ?>
+    <div style="margin-top:12px; color:#9be7c6; font-size:13px;">Settings saved.</div>
+  <?php endif; ?>
+
+  <form method="post" action="/admin/store/settings" style="margin-top:16px; display:grid; gap:16px;">
+    <div class="admin-card" style="padding:16px;">
+      <div class="label">Currency</div>
+      <input class="input" name="store_currency" value="<?= htmlspecialchars((string)($settings['store_currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?>" placeholder="GBP">
+
+      <div class="label" style="margin-top:12px;">Private Download Root (outside public_html)</div>
+      <input class="input" name="store_private_root" value="<?= htmlspecialchars((string)($settings['store_private_root'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="/home/audiocore.site/private_downloads">
+      <div style="margin-top:8px; font-size:12px; color: <?= $privateRootReady ? '#9be7c6' : '#f3b0b0' ?>;">
+        <?= $privateRootReady ? 'Path is writable' : 'Path missing or not writable' ?>
+      </div>
+
+      <div style="display:grid; grid-template-columns:1fr 1fr; gap:10px; margin-top:12px;">
+        <div>
+          <div class="label">Download Limit</div>
+          <input class="input" name="store_download_limit" value="<?= htmlspecialchars((string)($settings['store_download_limit'] ?? '5'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+        <div>
+          <div class="label">Expiry Days</div>
+          <input class="input" name="store_download_expiry_days" value="<?= htmlspecialchars((string)($settings['store_download_expiry_days'] ?? '30'), ENT_QUOTES, 'UTF-8') ?>">
+        </div>
+      </div>
+    </div>
+
+    <div class="admin-card" style="padding:16px;">
+      <div class="label" style="margin-bottom:10px;">Payment Provider (Stripe)</div>
+      <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+        <input type="checkbox" name="store_test_mode" value="1" <?= ((string)($settings['store_test_mode'] ?? '1') === '1') ? 'checked' : '' ?>>
+        Test mode
+      </label>
+      <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em; margin-top:8px;">
+        <input type="checkbox" name="store_stripe_enabled" value="1" <?= ((string)($settings['store_stripe_enabled'] ?? '0') === '1') ? 'checked' : '' ?>>
+        Enable Stripe
+      </label>
+      <div class="label" style="margin-top:10px;">Stripe Public Key</div>
+      <input class="input" name="store_stripe_public_key" value="<?= htmlspecialchars((string)($settings['store_stripe_public_key'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+      <div class="label" style="margin-top:10px;">Stripe Secret Key</div>
+      <input class="input" name="store_stripe_secret_key" value="<?= htmlspecialchars((string)($settings['store_stripe_secret_key'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+    </div>
+
+    <div class="admin-card" style="padding:16px;">
+      <div class="label" style="margin-bottom:10px;">Payment Provider (PayPal)</div>
+      <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+        <input type="checkbox" name="store_paypal_enabled" value="1" <?= ((string)($settings['store_paypal_enabled'] ?? '0') === '1') ? 'checked' : '' ?>>
+        Enable PayPal
+      </label>
+      <div class="label" style="margin-top:10px;">PayPal Client ID</div>
+      <input class="input" name="store_paypal_client_id" value="<?= htmlspecialchars((string)($settings['store_paypal_client_id'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+      <div class="label" style="margin-top:10px;">PayPal Secret</div>
+      <input class="input" name="store_paypal_secret" value="<?= htmlspecialchars((string)($settings['store_paypal_secret'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+    </div>
+
+    <div style="display:flex; justify-content:flex-end;">
+      <button class="btn" type="submit">Save Settings</button>
+    </div>
+  </form>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/views/admin/customers.php

@@ -0,0 +1,224 @@
+<?php
+$pageTitle = $title ?? 'Store Customers';
+$customers = $customers ?? [];
+$currency = (string)($currency ?? 'GBP');
+$q = (string)($q ?? '');
+ob_start();
+?>
+<section class="admin-card customers-page">
+  <div class="badge">Store</div>
+  <div class="customers-header">
+    <div>
+      <h1 class="customers-title">Customers</h1>
+      <p class="customers-sub">Customer activity, value, and latest order access.</p>
+    </div>
+    <a href="/admin/store" class="btn outline">Back</a>
+  </div>
+
+  <div class="customers-tabs">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn outline small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <form method="get" action="/admin/store/customers" class="customers-search">
+    <input type="text" name="q" value="<?= htmlspecialchars($q, ENT_QUOTES, 'UTF-8') ?>" placeholder="Search by email, name, or order number">
+    <button type="submit" class="btn small">Search</button>
+    <?php if ($q !== ''): ?>
+      <a href="/admin/store/customers" class="btn outline small">Clear</a>
+    <?php endif; ?>
+  </form>
+
+  <?php if (!$customers): ?>
+    <div class="customers-empty">No customers yet.</div>
+  <?php else: ?>
+    <div class="customers-table-wrap">
+      <table class="customers-table">
+        <thead>
+          <tr>
+            <th>Customer</th>
+            <th>Orders</th>
+            <th>Revenue</th>
+            <th>Latest Order</th>
+            <th>Last Seen</th>
+          </tr>
+        </thead>
+        <tbody>
+          <?php foreach ($customers as $customer): ?>
+            <?php
+              $ips = is_array($customer['ips'] ?? null) ? $customer['ips'] : [];
+              $email = (string)($customer['email'] ?? '');
+              $lastOrderNo = (string)($customer['last_order_no'] ?? '');
+              $lastOrderId = (int)($customer['last_order_id'] ?? 0);
+              $lastSeen = (string)($customer['last_order_at'] ?? $customer['created_at'] ?? '');
+            ?>
+            <tr>
+              <td>
+                <div class="customer-email"><?= htmlspecialchars($email, ENT_QUOTES, 'UTF-8') ?></div>
+                <?php if ($ips): ?>
+                  <div class="customer-ips">
+                    <?php foreach ($ips as $entry): ?>
+                      <?php
+                        $ip = (string)($entry['ip'] ?? '');
+                        $ipLastSeen = (string)($entry['last_seen'] ?? '');
+                        if ($ip === '') { continue; }
+                      ?>
+                      <span class="ip-chip" title="<?= htmlspecialchars($ipLastSeen, ENT_QUOTES, 'UTF-8') ?>"><?= htmlspecialchars($ip, ENT_QUOTES, 'UTF-8') ?></span>
+                    <?php endforeach; ?>
+                  </div>
+                <?php endif; ?>
+              </td>
+              <td class="num"><?= (int)($customer['order_count'] ?? 0) ?></td>
+              <td class="num"><?= htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($customer['revenue'] ?? 0), 2) ?></td>
+              <td>
+                <?php if ($lastOrderId > 0): ?>
+                  <a href="/admin/store/order?id=<?= $lastOrderId ?>" class="order-link">
+                    <?= htmlspecialchars($lastOrderNo !== '' ? $lastOrderNo : ('#' . $lastOrderId), ENT_QUOTES, 'UTF-8') ?>
+                  </a>
+                <?php else: ?>
+                  <span class="muted">No orders</span>
+                <?php endif; ?>
+              </td>
+              <td class="muted"><?= htmlspecialchars($lastSeen, ENT_QUOTES, 'UTF-8') ?></td>
+            </tr>
+          <?php endforeach; ?>
+        </tbody>
+      </table>
+    </div>
+  <?php endif; ?>
+</section>
+
+<style>
+  .customers-page { display:grid; gap:14px; }
+  .customers-header { display:flex; align-items:flex-start; justify-content:space-between; gap:16px; margin-top:14px; }
+  .customers-title { margin:0; font-size:28px; line-height:1.1; }
+  .customers-sub { margin:6px 0 0; color:var(--muted); font-size:14px; }
+  .customers-tabs { display:flex; flex-wrap:wrap; gap:8px; }
+  .customers-search { display:flex; gap:8px; align-items:center; flex-wrap:wrap; }
+  .customers-search input {
+    height:36px;
+    min-width:280px;
+    border-radius:10px;
+    border:1px solid rgba(255,255,255,.15);
+    background:rgba(255,255,255,.04);
+    color:#fff;
+    padding:0 12px;
+  }
+
+  .customers-empty {
+    padding:16px;
+    border-radius:12px;
+    border:1px solid rgba(255,255,255,.08);
+    background:rgba(0,0,0,.15);
+    color:var(--muted);
+    font-size:14px;
+  }
+
+  .customers-table-wrap {
+    border:1px solid rgba(255,255,255,.1);
+    border-radius:14px;
+    overflow:hidden;
+    background:rgba(0,0,0,.2);
+  }
+
+  .customers-table {
+    width:100%;
+    border-collapse:separate;
+    border-spacing:0;
+    table-layout:fixed;
+  }
+
+  .customers-table th {
+    text-align:left;
+    font-size:11px;
+    letter-spacing:.16em;
+    text-transform:uppercase;
+    color:var(--muted);
+    padding:14px 16px;
+    background:rgba(255,255,255,.03);
+    border-bottom:1px solid rgba(255,255,255,.1);
+  }
+
+  .customers-table td {
+    padding:14px 16px;
+    vertical-align:top;
+    border-bottom:1px solid rgba(255,255,255,.06);
+    font-size:14px;
+  }
+
+  .customers-table tbody tr:last-child td { border-bottom:none; }
+  .customers-table tbody tr:hover { background:rgba(255,255,255,.03); }
+
+  .customer-email {
+    font-size:16px;
+    font-weight:600;
+    line-height:1.25;
+    white-space:nowrap;
+    overflow:hidden;
+    text-overflow:ellipsis;
+  }
+
+  .customer-name {
+    margin-top:4px;
+    color:var(--muted);
+    font-size:13px;
+  }
+
+  .customer-ips {
+    display:flex;
+    flex-wrap:wrap;
+    gap:6px;
+    margin-top:8px;
+  }
+
+  .ip-chip {
+    display:inline-flex;
+    align-items:center;
+    padding:3px 8px;
+    border-radius:999px;
+    border:1px solid rgba(255,255,255,.14);
+    background:rgba(255,255,255,.04);
+    color:#d8def1;
+    font-size:11px;
+    line-height:1;
+  }
+
+  .num {
+    font-weight:600;
+    white-space:nowrap;
+  }
+
+  .order-link {
+    display:inline-flex;
+    max-width:100%;
+    color:#dce8ff;
+    text-decoration:none;
+    border-bottom:1px dashed rgba(220,232,255,.4);
+    white-space:nowrap;
+    overflow:hidden;
+    text-overflow:ellipsis;
+  }
+
+  .order-link:hover { color:#fff; border-bottom-color:rgba(255,255,255,.8); }
+  .muted { color:var(--muted); }
+
+  @media (max-width: 980px) {
+    .customers-table th:nth-child(3),
+    .customers-table td:nth-child(3),
+    .customers-table th:nth-child(5),
+    .customers-table td:nth-child(5) { display:none; }
+  }
+
+  @media (max-width: 700px) {
+    .customers-header { flex-direction:column; }
+    .customers-table { table-layout:auto; }
+    .customers-table th:nth-child(2),
+    .customers-table td:nth-child(2) { display:none; }
+    .customer-email { font-size:15px; }
+    .customers-search input { min-width:100%; width:100%; }
+  }
+</style>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/views/admin/index.php

@@ -0,0 +1,124 @@
+<?php
+$pageTitle = $title ?? 'Store';
+$tablesReady = (bool)($tables_ready ?? false);
+$privateRoot = (string)($private_root ?? '');
+$privateRootReady = (bool)($private_root_ready ?? false);
+$stats = is_array($stats ?? null) ? $stats : [];
+$recentOrders = is_array($recent_orders ?? null) ? $recent_orders : [];
+$newCustomers = is_array($new_customers ?? null) ? $new_customers : [];
+$currency = (string)($currency ?? 'GBP');
+$totalOrders = (int)($stats['total_orders'] ?? 0);
+$paidOrders = (int)($stats['paid_orders'] ?? 0);
+$totalRevenue = (float)($stats['total_revenue'] ?? 0);
+$totalCustomers = (int)($stats['total_customers'] ?? 0);
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Store</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Store</h1>
+      <p style="color: var(--muted); margin-top:6px;">Commerce layer for releases/tracks.</p>
+    </div>
+    <div style="display:flex; gap:10px; align-items:center;">
+      <a href="/admin/store/settings" class="btn outline">Settings</a>
+      <a href="/admin/store/orders" class="btn outline">Orders</a>
+      <a href="/admin/store/customers" class="btn outline">Customers</a>
+    </div>
+  </div>
+  <div style="display:flex; flex-wrap:wrap; gap:8px; margin-top:12px;">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn outline small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <?php if (!$tablesReady): ?>
+    <div class="admin-card" style="margin-top:16px; padding:16px; display:flex; align-items:center; justify-content:space-between; gap:16px;">
+      <div>
+        <div style="font-weight:600;">Store tables not initialized</div>
+        <div style="color: var(--muted); font-size:13px; margin-top:4px;">Create store tables before configuring products and checkout.</div>
+      </div>
+      <form method="post" action="/admin/store/install">
+        <button type="submit" class="btn small">Create Tables</button>
+      </form>
+    </div>
+  <?php endif; ?>
+
+  <div class="admin-card" style="margin-top:16px; padding:16px;">
+    <div style="font-weight:600;">Private download root</div>
+    <div style="color: var(--muted); font-size:13px; margin-top:4px; font-family:'IBM Plex Mono', monospace;">
+      <?= htmlspecialchars($privateRoot, ENT_QUOTES, 'UTF-8') ?>
+    </div>
+    <div style="margin-top:8px; font-size:12px; color: <?= $privateRootReady ? '#9be7c6' : '#f3b0b0' ?>;">
+      <?= $privateRootReady ? 'Ready' : 'Missing or not writable' ?>
+    </div>
+  </div>
+
+  <div style="display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px; margin-top:16px;">
+    <div class="admin-card" style="padding:14px;">
+      <div class="label">Total Orders</div>
+      <div style="font-size:26px; font-weight:700; margin-top:8px;"><?= $totalOrders ?></div>
+      <div style="font-size:12px; color:var(--muted); margin-top:4px;">Paid: <?= $paidOrders ?></div>
+    </div>
+    <div class="admin-card" style="padding:14px;">
+      <div class="label">Revenue</div>
+      <div style="font-size:26px; font-weight:700; margin-top:8px;"><?= htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($totalRevenue, 2) ?></div>
+    </div>
+    <div class="admin-card" style="padding:14px;">
+      <div class="label">Total Customers</div>
+      <div style="font-size:26px; font-weight:700; margin-top:8px;"><?= $totalCustomers ?></div>
+    </div>
+  </div>
+
+  <div style="display:grid; grid-template-columns:1fr 1fr; gap:10px; margin-top:16px;">
+    <div class="admin-card" style="padding:14px;">
+      <div style="font-weight:600;">Last 5 purchases</div>
+      <?php if (!$recentOrders): ?>
+        <div style="margin-top:8px; color:var(--muted); font-size:13px;">No orders yet.</div>
+      <?php else: ?>
+        <div style="margin-top:10px; display:grid; gap:8px;">
+          <?php foreach ($recentOrders as $order): ?>
+            <div class="admin-card" style="padding:10px;">
+              <div style="display:flex; justify-content:space-between; gap:10px; font-size:13px;">
+                <strong><?= htmlspecialchars((string)($order['order_no'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></strong>
+                <span><?= htmlspecialchars((string)($order['status'] ?? 'pending'), ENT_QUOTES, 'UTF-8') ?></span>
+              </div>
+              <div style="display:flex; justify-content:space-between; gap:10px; color:var(--muted); font-size:12px; margin-top:4px;">
+                <span><?= htmlspecialchars((string)($order['email'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+                <span><?= htmlspecialchars((string)($order['currency'] ?? $currency), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($order['total'] ?? 0), 2) ?></span>
+              </div>
+              <div style="margin-top:8px;">
+                <a href="/admin/store/order?id=<?= (int)($order['id'] ?? 0) ?>" class="btn outline small">View Order</a>
+              </div>
+            </div>
+          <?php endforeach; ?>
+        </div>
+      <?php endif; ?>
+    </div>
+
+    <div class="admin-card" style="padding:14px;">
+      <div style="font-weight:600;">Top 5 new customers</div>
+      <?php if (!$newCustomers): ?>
+        <div style="margin-top:8px; color:var(--muted); font-size:13px;">No customers yet.</div>
+      <?php else: ?>
+        <div style="margin-top:10px; display:grid; gap:8px;">
+          <?php foreach ($newCustomers as $customer): ?>
+            <div class="admin-card" style="padding:10px;">
+              <div style="display:flex; justify-content:space-between; gap:10px; font-size:13px;">
+                <strong><?= htmlspecialchars((string)($customer['name'] ?? 'Customer'), ENT_QUOTES, 'UTF-8') ?></strong>
+                <span style="color:<?= (int)($customer['is_active'] ?? 0) === 1 ? '#9be7c6' : '#f3b0b0' ?>;">
+                  <?= (int)($customer['is_active'] ?? 0) === 1 ? 'Active' : 'Disabled' ?>
+                </span>
+              </div>
+              <div style="color:var(--muted); font-size:12px; margin-top:4px;"><?= htmlspecialchars((string)($customer['email'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+            </div>
+          <?php endforeach; ?>
+        </div>
+      <?php endif; ?>
+    </div>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/views/admin/order.php

@@ -0,0 +1,123 @@
+<?php
+$pageTitle = $title ?? 'Order Detail';
+$order = is_array($order ?? null) ? $order : [];
+$items = is_array($items ?? null) ? $items : [];
+$downloadsByItem = is_array($downloads_by_item ?? null) ? $downloads_by_item : [];
+$downloadEvents = is_array($download_events ?? null) ? $download_events : [];
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Store</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Order Detail</h1>
+      <p style="color: var(--muted); margin-top:6px;">Full order breakdown, downloads, and IP history.</p>
+    </div>
+    <a href="/admin/store/orders" class="btn outline">Back to Orders</a>
+  </div>
+  <div style="display:flex; flex-wrap:wrap; gap:8px; margin-top:12px;">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn outline small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <div class="admin-card" style="padding:14px; margin-top:16px;">
+    <div style="display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:10px;">
+      <div>
+        <div class="label">Order Number</div>
+        <div style="font-weight:700; margin-top:6px;"><?= htmlspecialchars((string)($order['order_no'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+      <div>
+        <div class="label">Status</div>
+        <div style="font-weight:700; margin-top:6px;"><?= htmlspecialchars((string)($order['status'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+      <div>
+        <div class="label">Total</div>
+        <div style="font-weight:700; margin-top:6px;"><?= htmlspecialchars((string)($order['currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($order['total'] ?? 0), 2) ?></div>
+      </div>
+      <div>
+        <div class="label">Customer Email</div>
+        <div style="margin-top:6px;"><?= htmlspecialchars((string)($order['email'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+      <div>
+        <div class="label">Order IP</div>
+        <div style="margin-top:6px;"><?= htmlspecialchars((string)($order['customer_ip'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+      <div>
+        <div class="label">Created</div>
+        <div style="margin-top:6px;"><?= htmlspecialchars((string)($order['created_at'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+    </div>
+  </div>
+
+  <div class="admin-card" style="padding:14px; margin-top:14px;">
+    <div style="font-weight:600;">Items</div>
+    <?php if (!$items): ?>
+      <div style="margin-top:8px; color:var(--muted); font-size:13px;">No items on this order.</div>
+    <?php else: ?>
+      <div style="margin-top:10px; display:grid; gap:10px;">
+        <?php foreach ($items as $item): ?>
+          <?php
+            $itemId = (int)($item['id'] ?? 0);
+            $downloadMeta = $downloadsByItem[$itemId] ?? ['count' => 0, 'ips' => []];
+            $ips = is_array($downloadMeta['ips'] ?? null) ? $downloadMeta['ips'] : [];
+          ?>
+          <div class="admin-card" style="padding:12px;">
+            <div style="display:flex; align-items:center; justify-content:space-between; gap:10px;">
+              <div>
+                <div style="font-weight:700;"><?= htmlspecialchars((string)($item['title_snapshot'] ?? 'Item'), ENT_QUOTES, 'UTF-8') ?></div>
+                <div style="margin-top:4px; color:var(--muted); font-size:12px;">
+                  <?= htmlspecialchars((string)($item['item_type'] ?? 'track'), ENT_QUOTES, 'UTF-8') ?> #<?= (int)($item['item_id'] ?? 0) ?>
+                  | Qty <?= (int)($item['qty'] ?? 1) ?>
+                  | <?= htmlspecialchars((string)($item['currency_snapshot'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($item['line_total'] ?? 0), 2) ?>
+                </div>
+                <?php if (!empty($item['file_name'])): ?>
+                  <div style="margin-top:4px; color:var(--muted); font-size:12px;">File: <?= htmlspecialchars((string)$item['file_name'], ENT_QUOTES, 'UTF-8') ?></div>
+                <?php endif; ?>
+              </div>
+              <div style="text-align:right;">
+                <div class="pill">Downloads <?= (int)($downloadMeta['count'] ?? 0) ?>/<?= (int)($item['download_limit'] ?? 0) ?></div>
+                <div style="font-size:12px; color:var(--muted); margin-top:6px;">
+                  Used <?= (int)($item['downloads_used'] ?? 0) ?><?= !empty($item['expires_at']) ? ' | Expires ' . htmlspecialchars((string)$item['expires_at'], ENT_QUOTES, 'UTF-8') : '' ?>
+                </div>
+              </div>
+            </div>
+            <?php if ($ips): ?>
+              <div style="display:flex; flex-wrap:wrap; gap:6px; margin-top:10px;">
+                <?php foreach ($ips as $ip): ?>
+                  <span class="pill"><?= htmlspecialchars((string)$ip, ENT_QUOTES, 'UTF-8') ?></span>
+                <?php endforeach; ?>
+              </div>
+            <?php endif; ?>
+          </div>
+        <?php endforeach; ?>
+      </div>
+    <?php endif; ?>
+  </div>
+
+  <div class="admin-card" style="padding:14px; margin-top:14px;">
+    <div style="font-weight:600;">Download Activity</div>
+    <?php if (!$downloadEvents): ?>
+      <div style="margin-top:8px; color:var(--muted); font-size:13px;">No download activity yet.</div>
+    <?php else: ?>
+      <div style="margin-top:10px; display:grid; gap:8px;">
+        <?php foreach ($downloadEvents as $event): ?>
+          <div class="admin-card" style="padding:10px; display:grid; grid-template-columns:minmax(0,1fr) auto auto; gap:10px; align-items:center;">
+            <div>
+              <div style="font-weight:600;"><?= htmlspecialchars((string)($event['file_name'] ?? ('File #' . (int)($event['file_id'] ?? 0))), ENT_QUOTES, 'UTF-8') ?></div>
+              <div style="font-size:12px; color:var(--muted); margin-top:2px;">Item #<?= (int)($event['order_item_id'] ?? 0) ?> | <?= htmlspecialchars((string)($event['ip_address'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></div>
+            </div>
+            <div style="font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($event['downloaded_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></div>
+            <div style="font-size:11px; color:var(--muted); max-width:280px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis;">
+              <?= htmlspecialchars((string)($event['user_agent'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+            </div>
+          </div>
+        <?php endforeach; ?>
+      </div>
+    <?php endif; ?>
+  </div>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/views/admin/orders.php

@@ -0,0 +1,390 @@
+<?php
+$pageTitle = $title ?? 'Store Orders';
+$orders = is_array($orders ?? null) ? $orders : [];
+$q = (string)($q ?? '');
+$saved = (string)($saved ?? '');
+$error = (string)($error ?? '');
+ob_start();
+?>
+<section class="admin-card store-orders">
+  <div class="badge">Store</div>
+  <div class="store-orders-head">
+    <div>
+      <h1>Orders</h1>
+      <p>Manage order status, refunds, and clean-up.</p>
+    </div>
+    <a href="/admin/store" class="btn outline">Back</a>
+  </div>
+
+  <div class="store-orders-tabs">
+    <a href="/admin/store" class="btn outline small">Overview</a>
+    <a href="/admin/store/settings" class="btn outline small">Settings</a>
+    <a href="/admin/store/orders" class="btn small">Orders</a>
+    <a href="/admin/store/customers" class="btn outline small">Customers</a>
+  </div>
+
+  <?php if ($saved !== ''): ?>
+    <div class="store-orders-msg ok">Order update saved.</div>
+  <?php endif; ?>
+  <?php if ($error !== ''): ?>
+    <div class="store-orders-msg error"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <div class="store-orders-tools">
+    <form method="post" action="/admin/store/orders/create" class="store-orders-create" data-confirm="Create this manual order?">
+      <div class="label">Add Manual Order</div>
+      <div class="store-orders-create-grid">
+        <input name="email" type="email" required class="input" placeholder="customer@example.com">
+        <input name="currency" class="input" value="GBP" maxlength="3" placeholder="GBP">
+        <input name="total" class="input" value="0.00" placeholder="0.00">
+        <select name="status" class="input">
+          <option value="pending">pending</option>
+          <option value="paid">paid</option>
+          <option value="failed">failed</option>
+          <option value="refunded">refunded</option>
+        </select>
+        <button type="submit" class="btn small">Add Order</button>
+      </div>
+    </form>
+
+    <form method="get" action="/admin/store/orders" class="store-orders-search">
+      <input type="text" name="q" value="<?= htmlspecialchars($q, ENT_QUOTES, 'UTF-8') ?>" class="input" placeholder="Search by order number, email, status, or IP">
+      <button type="submit" class="btn small">Search</button>
+      <?php if ($q !== ''): ?>
+        <a href="/admin/store/orders" class="btn outline small">Clear</a>
+      <?php endif; ?>
+    </form>
+  </div>
+
+  <?php if (!$orders): ?>
+    <div class="store-orders-empty">No orders yet.</div>
+  <?php else: ?>
+    <div class="store-orders-list">
+      <?php foreach ($orders as $order): ?>
+        <?php
+        $status = (string)($order['status'] ?? 'pending');
+        ?>
+        <article class="store-order-row">
+          <div class="store-order-main">
+            <a href="/admin/store/order?id=<?= (int)($order['id'] ?? 0) ?>" class="store-order-no">
+              <?= htmlspecialchars((string)($order['order_no'] ?? ('#' . (int)($order['id'] ?? 0))), ENT_QUOTES, 'UTF-8') ?>
+            </a>
+            <div class="store-order-meta">
+              <span><?= htmlspecialchars((string)($order['email'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+              <span><?= htmlspecialchars((string)($order['created_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+              <span><?= htmlspecialchars((string)($order['customer_ip'] ?? '-'), ENT_QUOTES, 'UTF-8') ?></span>
+            </div>
+          </div>
+
+          <div class="store-order-amount">
+            <?= htmlspecialchars((string)($order['currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?>
+            <?= number_format((float)($order['total'] ?? 0), 2) ?>
+          </div>
+
+          <div class="store-order-status pill"><?= htmlspecialchars($status, ENT_QUOTES, 'UTF-8') ?></div>
+
+          <div class="store-order-actions">
+            <form method="post" action="/admin/store/orders/status" class="store-order-status-form" data-confirm="Update this order status?">
+              <input type="hidden" name="id" value="<?= (int)($order['id'] ?? 0) ?>">
+              <select name="status" class="input">
+                <option value="pending" <?= $status === 'pending' ? 'selected' : '' ?>>pending</option>
+                <option value="paid" <?= $status === 'paid' ? 'selected' : '' ?>>paid</option>
+                <option value="failed" <?= $status === 'failed' ? 'selected' : '' ?>>failed</option>
+                <option value="refunded" <?= $status === 'refunded' ? 'selected' : '' ?>>refunded</option>
+              </select>
+              <button class="btn outline small" type="submit">Update</button>
+            </form>
+
+            <form method="post" action="/admin/store/orders/refund" data-confirm="Refund this order now? Download access will be revoked.">
+              <input type="hidden" name="id" value="<?= (int)($order['id'] ?? 0) ?>">
+              <button class="btn outline small store-order-refund" type="submit">Refund</button>
+            </form>
+
+            <form method="post" action="/admin/store/orders/delete" data-confirm="Delete this order and all related downloads? This cannot be undone.">
+              <input type="hidden" name="id" value="<?= (int)($order['id'] ?? 0) ?>">
+              <button class="btn outline small store-order-delete" type="submit">Delete</button>
+            </form>
+          </div>
+        </article>
+      <?php endforeach; ?>
+    </div>
+  <?php endif; ?>
+</section>
+
+<div id="acConfirmModal" class="ac-confirm-modal" hidden>
+  <div class="ac-confirm-backdrop"></div>
+  <div class="ac-confirm-dialog">
+    <div class="badge">Confirm</div>
+    <p id="acConfirmText">Are you sure?</p>
+    <div class="ac-confirm-actions">
+      <button type="button" class="btn outline small" id="acConfirmCancel">Cancel</button>
+      <button type="button" class="btn small" id="acConfirmOk">Confirm</button>
+    </div>
+  </div>
+</div>
+
+<style>
+  .store-orders {
+    display: grid;
+    gap: 12px;
+  }
+  .store-orders-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    margin-top: 14px;
+  }
+  .store-orders-head h1 {
+    margin: 0;
+    font-size: 28px;
+  }
+  .store-orders-head p {
+    margin: 6px 0 0;
+    color: var(--muted);
+  }
+  .store-orders-tabs {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+  }
+  .store-orders-msg {
+    padding: 10px 12px;
+    border-radius: 10px;
+    font-size: 13px;
+  }
+  .store-orders-msg.ok {
+    color: #9be7c6;
+    background: rgba(34, 242, 165, .08);
+    border: 1px solid rgba(34, 242, 165, .25);
+  }
+  .store-orders-msg.error {
+    color: #f3b0b0;
+    background: rgba(243, 176, 176, .08);
+    border: 1px solid rgba(243, 176, 176, .25);
+  }
+  .store-orders-tools {
+    display: grid;
+    gap: 10px;
+  }
+  .store-orders-create,
+  .store-orders-search {
+    padding: 12px;
+    border-radius: 12px;
+    border: 1px solid rgba(255, 255, 255, .1);
+    background: rgba(255, 255, 255, .02);
+  }
+  .store-orders-create-grid {
+    margin-top: 8px;
+    display: grid;
+    grid-template-columns: minmax(0, 1.8fr) 100px 110px 130px 120px;
+    gap: 8px;
+  }
+  .store-orders-search {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+  }
+  .store-orders-search .input {
+    min-width: 320px;
+  }
+  .store-orders-empty {
+    color: var(--muted);
+    font-size: 13px;
+    padding: 12px;
+    border-radius: 10px;
+    border: 1px solid rgba(255, 255, 255, .08);
+  }
+  .store-orders-list {
+    display: grid;
+    gap: 10px;
+  }
+  .store-order-row {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto auto;
+    gap: 14px;
+    align-items: center;
+    padding: 12px;
+    border-radius: 12px;
+    border: 1px solid rgba(255, 255, 255, .1);
+    background: rgba(255, 255, 255, .02);
+  }
+  .store-order-no {
+    color: var(--text);
+    text-decoration: none;
+    font-weight: 700;
+    font-size: 20px;
+    letter-spacing: .01em;
+    display: inline-block;
+    line-height: 1.2;
+    word-break: keep-all;
+    overflow-wrap: normal;
+  }
+  .store-order-no:hover {
+    color: #fff;
+  }
+  .store-order-meta {
+    margin-top: 6px;
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    color: var(--muted);
+    font-size: 12px;
+  }
+  .store-order-amount {
+    font-size: 22px;
+    font-weight: 700;
+    white-space: nowrap;
+  }
+  .store-order-status {
+    justify-self: start;
+  }
+  .store-order-actions {
+    grid-column: 1 / -1;
+    display: flex;
+    align-items: center;
+    flex-wrap: wrap;
+    gap: 8px;
+  }
+  .store-order-status-form {
+    display: inline-flex;
+    gap: 8px;
+    align-items: center;
+  }
+  .store-order-status-form .input {
+    width: 140px;
+    min-width: 140px;
+  }
+  .store-order-refund {
+    border-color: rgba(140, 235, 195, .45);
+    color: #b8f6dc;
+  }
+  .store-order-delete {
+    border-color: rgba(255, 120, 120, .45);
+    color: #ffb9b9;
+  }
+  @media (max-width: 1100px) {
+    .store-orders-create-grid {
+      grid-template-columns: 1fr 100px 110px 130px 120px;
+    }
+  }
+  @media (max-width: 900px) {
+    .store-order-row {
+      grid-template-columns: 1fr;
+    }
+    .store-order-amount {
+      font-size: 18px;
+    }
+    .store-orders-create-grid {
+      grid-template-columns: 1fr 100px 100px;
+    }
+    .store-orders-create-grid .btn {
+      grid-column: 1 / -1;
+      justify-self: start;
+    }
+    .store-orders-search {
+      flex-wrap: wrap;
+    }
+    .store-orders-search .input {
+      min-width: 0;
+      width: 100%;
+    }
+  }
+
+  .ac-confirm-modal {
+    position: fixed;
+    inset: 0;
+    z-index: 4000;
+    display: grid;
+    place-items: center;
+  }
+  .ac-confirm-modal[hidden] {
+    display: none !important;
+  }
+  .ac-confirm-backdrop {
+    position: absolute;
+    inset: 0;
+    background: rgba(5, 8, 14, .66);
+    backdrop-filter: blur(2px);
+  }
+  .ac-confirm-dialog {
+    position: relative;
+    width: min(480px, calc(100vw - 32px));
+    padding: 14px;
+    border-radius: 14px;
+    border: 1px solid rgba(255, 255, 255, .12);
+    background: linear-gradient(160deg, rgba(24, 28, 39, .98), rgba(18, 22, 32, .98));
+    box-shadow: 0 24px 60px rgba(0, 0, 0, .45);
+    display: grid;
+    gap: 10px;
+  }
+  .ac-confirm-dialog p {
+    margin: 0;
+    color: #d8def0;
+    line-height: 1.45;
+  }
+  .ac-confirm-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+  }
+</style>
+<script>
+  (function () {
+    const modal = document.getElementById('acConfirmModal');
+    const txt = document.getElementById('acConfirmText');
+    const btnCancel = document.getElementById('acConfirmCancel');
+    const btnOk = document.getElementById('acConfirmOk');
+    if (!modal || !txt || !btnCancel || !btnOk) return;
+
+    let targetForm = null;
+    const forms = document.querySelectorAll('form[data-confirm]');
+
+    function closeModal() {
+      modal.setAttribute('hidden', 'hidden');
+      targetForm = null;
+    }
+
+    function openModal(form) {
+      targetForm = form;
+      txt.textContent = form.getAttribute('data-confirm') || 'Are you sure?';
+      modal.removeAttribute('hidden');
+    }
+
+    forms.forEach((form) => {
+      form.addEventListener('submit', function (event) {
+        if (form.dataset.confirmed === '1') {
+          form.dataset.confirmed = '0';
+          return;
+        }
+        event.preventDefault();
+        openModal(form);
+      });
+    });
+
+    btnCancel.addEventListener('click', closeModal);
+    btnOk.addEventListener('click', function () {
+      if (targetForm) {
+        const f = targetForm;
+        f.dataset.confirmed = '1';
+        closeModal();
+        HTMLFormElement.prototype.submit.call(f);
+      } else {
+        closeModal();
+      }
+    });
+    modal.addEventListener('click', function (event) {
+      if (event.target.classList.contains('ac-confirm-backdrop')) {
+        closeModal();
+      }
+    });
+    document.addEventListener('keydown', function (event) {
+      if (event.key === 'Escape' && !modal.hasAttribute('hidden')) {
+        closeModal();
+      }
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/views/admin/settings.php

@@ -0,0 +1,311 @@
+<?php
+$pageTitle = $title ?? 'Store Settings';
+$settings = $settings ?? [];
+$gateways = is_array($gateways ?? null) ? $gateways : [];
+$error = (string)($error ?? '');
+$saved = (string)($saved ?? '');
+$tab = (string)($tab ?? 'general');
+$tab = in_array($tab, ['general', 'payments', 'emails', 'discounts', 'sales_chart'], true) ? $tab : 'general';
+$paypalTest = (string)($_GET['paypal_test'] ?? '');
+$privateRootReady = (bool)($private_root_ready ?? false);
+$discounts = is_array($discounts ?? null) ? $discounts : [];
+$chartRows = is_array($chart_rows ?? null) ? $chart_rows : [];
+$chartLastRebuildAt = (string)($chart_last_rebuild_at ?? '');
+$chartCronUrl = (string)($chart_cron_url ?? '');
+$chartCronCmd = (string)($chart_cron_cmd ?? '');
+ob_start();
+?>
+<section class="admin-card">
+  <div class="badge">Store</div>
+  <div style="display:flex; align-items:center; justify-content:space-between; gap:16px; margin-top:16px;">
+    <div>
+      <h1 style="font-size:28px; margin:0;">Store Settings</h1>
+      <p style="color: var(--muted); margin-top:6px;">Configure defaults, payments, and transactional emails.</p>
+    </div>
+    <a href="/admin/store" class="btn outline">Back</a>
+  </div>
+
+  <div style="display:flex; flex-wrap:wrap; gap:8px; margin-top:12px;">
+    <a href="/admin/store/settings?tab=general" class="btn <?= $tab === 'general' ? '' : 'outline' ?> small">General</a>
+    <a href="/admin/store/settings?tab=payments" class="btn <?= $tab === 'payments' ? '' : 'outline' ?> small">Payments</a>
+    <a href="/admin/store/settings?tab=emails" class="btn <?= $tab === 'emails' ? '' : 'outline' ?> small">Emails</a>
+    <a href="/admin/store/settings?tab=discounts" class="btn <?= $tab === 'discounts' ? '' : 'outline' ?> small">Discounts</a>
+    <a href="/admin/store/settings?tab=sales_chart" class="btn <?= $tab === 'sales_chart' ? '' : 'outline' ?> small">Sales Chart</a>
+  </div>
+
+  <?php if ($error !== ''): ?>
+    <div style="margin-top:12px; color:#f3b0b0; font-size:13px;"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+  <?php if ($saved !== ''): ?>
+    <div style="margin-top:12px; color:#9be7c6; font-size:13px;">Settings saved.</div>
+  <?php endif; ?>
+  <?php if ($paypalTest === 'live' || $paypalTest === 'sandbox'): ?>
+    <div style="margin-top:12px; color:#9be7c6; font-size:13px;">PayPal <?= htmlspecialchars($paypalTest, ENT_QUOTES, 'UTF-8') ?> credentials are valid.</div>
+  <?php endif; ?>
+
+  <?php if ($tab === 'general'): ?>
+    <form method="post" action="/admin/store/settings" style="margin-top:16px; display:grid; gap:16px;">
+      <input type="hidden" name="tab" value="general">
+      <div class="admin-card" style="padding:16px;">
+        <div class="label">Currency</div>
+        <input class="input" name="store_currency" value="<?= htmlspecialchars((string)($settings['store_currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?>" placeholder="GBP">
+
+        <div class="label" style="margin-top:12px;">Private Download Root (outside public_html)</div>
+        <input class="input" name="store_private_root" value="<?= htmlspecialchars((string)($settings['store_private_root'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="/home/audiocore.site/private_downloads">
+        <div style="margin-top:8px; font-size:12px; color: <?= $privateRootReady ? '#9be7c6' : '#f3b0b0' ?>;">
+          <?= $privateRootReady ? 'Path is writable' : 'Path missing or not writable' ?>
+        </div>
+
+        <div style="display:grid; grid-template-columns:1fr 1fr; gap:10px; margin-top:12px;">
+          <div>
+            <div class="label">Download Limit</div>
+            <input class="input" name="store_download_limit" value="<?= htmlspecialchars((string)($settings['store_download_limit'] ?? '5'), ENT_QUOTES, 'UTF-8') ?>">
+          </div>
+          <div>
+            <div class="label">Expiry Days</div>
+            <input class="input" name="store_download_expiry_days" value="<?= htmlspecialchars((string)($settings['store_download_expiry_days'] ?? '30'), ENT_QUOTES, 'UTF-8') ?>">
+          </div>
+        </div>
+
+        <div class="label" style="margin-top:12px;">Order Number Prefix</div>
+        <input class="input" name="store_order_prefix" value="<?= htmlspecialchars((string)($settings['store_order_prefix'] ?? 'AC-ORD'), ENT_QUOTES, 'UTF-8') ?>" placeholder="AC-ORD">
+      </div>
+
+      <div style="display:flex; justify-content:flex-end;">
+        <button class="btn" type="submit">Save General Settings</button>
+      </div>
+    </form>
+  <?php elseif ($tab === 'payments'): ?>
+    <form method="post" action="/admin/store/settings" style="margin-top:16px; display:grid; gap:16px;">
+      <input type="hidden" name="tab" value="payments">
+      <div class="admin-card" style="padding:16px;">
+        <div class="label" style="margin-bottom:10px;">Payment Mode</div>
+        <input type="hidden" name="store_test_mode" value="0">
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="store_test_mode" value="1" <?= ((string)($settings['store_test_mode'] ?? '1') === '1') ? 'checked' : '' ?>>
+          Test Mode (Sandbox)
+        </label>
+      </div>
+
+      <div class="admin-card" style="padding:16px;">
+        <div class="label" style="margin-bottom:10px;">PayPal</div>
+        <input type="hidden" name="store_paypal_enabled" value="0">
+        <label style="display:flex; align-items:center; gap:8px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:0.2em;">
+          <input type="checkbox" name="store_paypal_enabled" value="1" <?= ((string)($settings['store_paypal_enabled'] ?? '0') === '1') ? 'checked' : '' ?>>
+          Enable PayPal
+        </label>
+        <div class="label" style="margin-top:10px;">PayPal Client ID</div>
+        <input class="input" name="store_paypal_client_id" value="<?= htmlspecialchars((string)($settings['store_paypal_client_id'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+        <div class="label" style="margin-top:10px;">PayPal Secret</div>
+        <input class="input" name="store_paypal_secret" value="<?= htmlspecialchars((string)($settings['store_paypal_secret'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
+
+        <div style="margin-top:12px; display:flex; gap:8px; flex-wrap:wrap;">
+          <button class="btn outline small" type="submit" name="paypal_probe_mode" value="live" formaction="/admin/store/settings/test-paypal" formmethod="post">Test PayPal Live</button>
+          <button class="btn outline small" type="submit" name="paypal_probe_mode" value="sandbox" formaction="/admin/store/settings/test-paypal" formmethod="post">Test PayPal Sandbox</button>
+          <button class="btn" type="submit">Save Payment Settings</button>
+        </div>
+      </div>
+
+    </form>
+  <?php elseif ($tab === 'emails'): ?>
+    <form method="post" action="/admin/store/settings" style="margin-top:16px; display:grid; gap:16px;">
+      <input type="hidden" name="tab" value="emails">
+      <div class="admin-card" style="padding:16px;">
+        <div class="label" style="margin-bottom:10px;">Order Email Template</div>
+        <div class="label">Email Logo URL</div>
+        <input class="input" name="store_email_logo_url" value="<?= htmlspecialchars((string)($settings['store_email_logo_url'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" placeholder="https://example.com/logo.png">
+
+        <div class="label" style="margin-top:10px;">Subject</div>
+        <input class="input" name="store_order_email_subject" value="<?= htmlspecialchars((string)($settings['store_order_email_subject'] ?? 'Your AudioCore order {{order_no}}'), ENT_QUOTES, 'UTF-8') ?>">
+
+        <div class="label" style="margin-top:10px;">HTML Body</div>
+        <textarea class="input" name="store_order_email_html" rows="10" style="resize:vertical; font-family:'IBM Plex Mono',monospace; font-size:12px;"><?= htmlspecialchars((string)($settings['store_order_email_html'] ?? ''), ENT_QUOTES, 'UTF-8') ?></textarea>
+
+        <div style="margin-top:8px; color:var(--muted); font-size:12px;">
+          Placeholders: <code>{{site_name}}</code>, <code>{{order_no}}</code>, <code>{{customer_email}}</code>, <code>{{currency}}</code>, <code>{{total}}</code>, <code>{{status}}</code>, <code>{{logo_url}}</code>, <code>{{logo_html}}</code>, <code>{{items_html}}</code>, <code>{{download_links_html}}</code>
+        </div>
+
+        <div style="margin-top:14px; display:grid; gap:10px; max-width:460px;">
+          <div class="label">Send Test Email To</div>
+          <input class="input" type="email" name="test_email_to" placeholder="you@example.com">
+          <div style="display:flex; gap:8px; flex-wrap:wrap;">
+            <button class="btn outline small" type="submit" formaction="/admin/store/settings/test-email" formmethod="post">Send Test Email</button>
+            <button class="btn" type="submit">Save Email Settings</button>
+          </div>
+        </div>
+      </div>
+    </form>
+  <?php elseif ($tab === 'discounts'): ?>
+    <div class="admin-card" style="margin-top:16px; padding:16px;">
+      <div class="label" style="margin-bottom:10px;">Create Discount Code</div>
+      <form method="post" action="/admin/store/discounts/create" style="display:grid; gap:12px;">
+        <div style="display:grid; grid-template-columns:1.2fr 1fr 0.8fr 0.9fr 1.2fr; gap:10px;">
+          <div>
+            <div class="label" style="font-size:10px;">Code</div>
+            <input class="input" name="code" placeholder="SAVE10" maxlength="32" required>
+          </div>
+          <div>
+            <div class="label" style="font-size:10px;">Discount Type</div>
+            <select class="input" name="discount_type">
+              <option value="percent">Percent</option>
+              <option value="fixed">Fixed Amount</option>
+            </select>
+          </div>
+          <div>
+            <div class="label" style="font-size:10px;">Value</div>
+            <input class="input" name="discount_value" value="10" required>
+          </div>
+          <div>
+            <div class="label" style="font-size:10px;">Max Uses</div>
+            <input class="input" name="max_uses" value="0" required>
+          </div>
+          <div>
+            <div class="label" style="font-size:10px;">Expires At</div>
+            <input class="input" type="datetime-local" name="expires_at">
+          </div>
+        </div>
+        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px; flex-wrap:wrap;">
+          <label style="display:flex; align-items:center; gap:6px; font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:.16em;">
+            <input type="checkbox" name="is_active" value="1" checked> Active
+          </label>
+          <button class="btn small" type="submit">Save Code</button>
+        </div>
+      </form>
+      <div style="margin-top:8px; color:var(--muted); font-size:12px;">Max uses: <strong>0</strong> means unlimited. Leave expiry blank for no expiry.</div>
+    </div>
+
+    <div class="admin-card" style="margin-top:12px; padding:14px;">
+      <div class="label" style="margin-bottom:10px;">Existing Codes</div>
+      <?php if (!$discounts): ?>
+        <div style="color:var(--muted); font-size:13px;">No discount codes yet.</div>
+      <?php else: ?>
+        <div style="overflow:auto;">
+          <table style="width:100%; border-collapse:separate; border-spacing:0 8px;">
+            <thead>
+              <tr style="color:var(--muted); font-size:10px; letter-spacing:.14em; text-transform:uppercase; text-align:left;">
+                <th style="padding:0 10px;">Code</th>
+                <th style="padding:0 10px;">Type</th>
+                <th style="padding:0 10px;">Value</th>
+                <th style="padding:0 10px;">Usage</th>
+                <th style="padding:0 10px;">Expires</th>
+                <th style="padding:0 10px;">Status</th>
+                <th style="padding:0 10px; text-align:right;">Action</th>
+              </tr>
+            </thead>
+            <tbody>
+              <?php foreach ($discounts as $d): ?>
+                <tr style="background:rgba(255,255,255,.02);">
+                  <td style="padding:10px; border:1px solid rgba(255,255,255,.08); border-right:none; border-radius:10px 0 0 10px; font-weight:700;"><?= htmlspecialchars((string)($d['code'] ?? ''), ENT_QUOTES, 'UTF-8') ?></td>
+                  <td style="padding:10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08); color:var(--muted); font-size:12px;"><?= htmlspecialchars((string)($d['discount_type'] ?? ''), ENT_QUOTES, 'UTF-8') ?></td>
+                  <td style="padding:10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08); font-size:12px;"><?= number_format((float)($d['discount_value'] ?? 0), 2) ?></td>
+                  <td style="padding:10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08); font-size:12px; color:var(--muted);"><?= (int)($d['used_count'] ?? 0) ?>/<?= (int)($d['max_uses'] ?? 0) === 0 ? 'INF' : (int)($d['max_uses'] ?? 0) ?></td>
+                  <td style="padding:10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08); font-size:12px; color:var(--muted);"><?= htmlspecialchars((string)($d['expires_at'] ?? 'No expiry'), ENT_QUOTES, 'UTF-8') ?></td>
+                  <td style="padding:10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08);"><span class="pill"><?= (int)($d['is_active'] ?? 0) === 1 ? 'active' : 'off' ?></span></td>
+                  <td style="padding:10px; border:1px solid rgba(255,255,255,.08); border-left:none; border-radius:0 10px 10px 0; text-align:right;">
+                    <form method="post" action="/admin/store/discounts/delete" onsubmit="return confirm('Delete this discount code?');" style="display:inline-flex;">
+                      <input type="hidden" name="id" value="<?= (int)($d['id'] ?? 0) ?>">
+                      <button class="btn outline small" type="submit" style="border-color:rgba(255,120,120,.45); color:#ffb9b9;">Delete</button>
+                    </form>
+                  </td>
+                </tr>
+              <?php endforeach; ?>
+            </tbody>
+          </table>
+        </div>
+      <?php endif; ?>
+    </div>
+  <?php else: ?>
+    <form method="post" action="/admin/store/settings" style="margin-top:16px; display:grid; gap:16px;">
+      <input type="hidden" name="tab" value="sales_chart">
+      <div class="admin-card" style="padding:16px; display:grid; gap:12px;">
+        <div class="label" style="margin-bottom:6px;">Sales Chart Defaults</div>
+        <div style="display:grid; grid-template-columns:1fr 1fr 1fr; gap:10px;">
+          <div>
+            <div class="label" style="font-size:10px;">Default Type</div>
+            <select class="input" name="store_sales_chart_default_scope">
+              <option value="tracks" <?= ((string)($settings['store_sales_chart_default_scope'] ?? 'tracks') === 'tracks') ? 'selected' : '' ?>>Tracks</option>
+              <option value="releases" <?= ((string)($settings['store_sales_chart_default_scope'] ?? 'tracks') === 'releases') ? 'selected' : '' ?>>Releases</option>
+            </select>
+          </div>
+          <div>
+            <div class="label" style="font-size:10px;">Default Window</div>
+            <select class="input" name="store_sales_chart_default_window">
+              <option value="latest" <?= ((string)($settings['store_sales_chart_default_window'] ?? 'latest') === 'latest') ? 'selected' : '' ?>>Latest (rolling)</option>
+              <option value="weekly" <?= ((string)($settings['store_sales_chart_default_window'] ?? 'latest') === 'weekly') ? 'selected' : '' ?>>Weekly</option>
+              <option value="all_time" <?= ((string)($settings['store_sales_chart_default_window'] ?? 'latest') === 'all_time') ? 'selected' : '' ?>>All time</option>
+            </select>
+          </div>
+          <div>
+            <div class="label" style="font-size:10px;">Default Limit</div>
+            <input class="input" name="store_sales_chart_limit" value="<?= htmlspecialchars((string)($settings['store_sales_chart_limit'] ?? '10'), ENT_QUOTES, 'UTF-8') ?>">
+          </div>
+        </div>
+        <div style="display:grid; grid-template-columns:1fr 1fr; gap:10px;">
+          <div>
+            <div class="label" style="font-size:10px;">Latest Window Hours</div>
+            <input class="input" name="store_sales_chart_latest_hours" value="<?= htmlspecialchars((string)($settings['store_sales_chart_latest_hours'] ?? '24'), ENT_QUOTES, 'UTF-8') ?>">
+          </div>
+          <div>
+            <div class="label" style="font-size:10px;">Cron Refresh Minutes</div>
+            <input class="input" name="store_sales_chart_refresh_minutes" value="<?= htmlspecialchars((string)($settings['store_sales_chart_refresh_minutes'] ?? '180'), ENT_QUOTES, 'UTF-8') ?>">
+          </div>
+        </div>
+        <div class="label" style="font-size:10px;">Cron Key</div>
+        <div style="display:grid; grid-template-columns:1fr auto; gap:8px;">
+          <input class="input" value="<?= htmlspecialchars((string)($settings['store_sales_chart_cron_key'] ?? ''), ENT_QUOTES, 'UTF-8') ?>" readonly>
+          <button class="btn outline small" type="submit" name="store_sales_chart_regen_key" value="1">Regenerate</button>
+        </div>
+        <div class="label" style="font-size:10px;">Cron URL (dynamic)</div>
+        <input class="input" value="<?= htmlspecialchars($chartCronUrl, ENT_QUOTES, 'UTF-8') ?>" readonly>
+        <div class="label" style="font-size:10px;">Crontab Line</div>
+        <textarea class="input" rows="2" style="resize:vertical; font-family:'IBM Plex Mono',monospace; font-size:12px;" readonly><?= htmlspecialchars($chartCronCmd, ENT_QUOTES, 'UTF-8') ?></textarea>
+        <div style="display:flex; gap:8px; flex-wrap:wrap; justify-content:flex-end;">
+          <button class="btn outline small" type="submit" formaction="/admin/store/settings/rebuild-sales-chart" formmethod="post">Rebuild Now</button>
+          <button class="btn" type="submit">Save Sales Chart Settings</button>
+        </div>
+      </div>
+    </form>
+
+    <div class="admin-card" style="margin-top:12px; padding:14px;">
+      <div style="display:flex; justify-content:space-between; align-items:center; gap:12px; margin-bottom:10px;">
+        <div class="label">Current Chart Snapshot</div>
+        <div style="font-size:12px; color:var(--muted);">
+          Last rebuild: <?= $chartLastRebuildAt !== '' ? htmlspecialchars($chartLastRebuildAt, ENT_QUOTES, 'UTF-8') : 'Never' ?>
+        </div>
+      </div>
+      <?php if (!$chartRows): ?>
+        <div style="color:var(--muted); font-size:13px;">No chart rows yet. Run rebuild once.</div>
+      <?php else: ?>
+        <div style="overflow:auto;">
+          <table style="width:100%; border-collapse:separate; border-spacing:0 6px;">
+            <thead>
+              <tr style="color:var(--muted); font-size:10px; letter-spacing:.14em; text-transform:uppercase; text-align:left;">
+                <th style="padding:0 10px;">#</th>
+                <th style="padding:0 10px;">Item</th>
+                <th style="padding:0 10px;">Units</th>
+                <th style="padding:0 10px;">Revenue</th>
+                <th style="padding:0 10px;">Window</th>
+              </tr>
+            </thead>
+            <tbody>
+              <?php foreach ($chartRows as $row): ?>
+                <tr style="background:rgba(255,255,255,.02);">
+                  <td style="padding:9px 10px; border:1px solid rgba(255,255,255,.08); border-right:none; border-radius:10px 0 0 10px; font-family:'IBM Plex Mono',monospace; font-size:12px;"><?= (int)($row['rank_no'] ?? 0) ?></td>
+                  <td style="padding:9px 10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08);"><?= htmlspecialchars((string)($row['item_label'] ?? ''), ENT_QUOTES, 'UTF-8') ?></td>
+                  <td style="padding:9px 10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08); color:var(--muted); font-size:12px;"><?= (int)($row['units'] ?? 0) ?></td>
+                  <td style="padding:9px 10px; border-top:1px solid rgba(255,255,255,.08); border-bottom:1px solid rgba(255,255,255,.08); color:var(--muted); font-size:12px;"><?= htmlspecialchars((string)($settings['store_currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($row['revenue'] ?? 0), 2) ?></td>
+                  <td style="padding:9px 10px; border:1px solid rgba(255,255,255,.08); border-left:none; border-radius:0 10px 10px 0; color:var(--muted); font-size:12px;">
+                    <?= htmlspecialchars((string)($row['snapshot_from'] ?? 'all'), ENT_QUOTES, 'UTF-8') ?> -> <?= htmlspecialchars((string)($row['snapshot_to'] ?? ''), ENT_QUOTES, 'UTF-8') ?>
+                  </td>
+                </tr>
+              <?php endforeach; ?>
+            </tbody>
+          </table>
+        </div>
+      <?php endif; ?>
+    </div>
+  <?php endif; ?>
+</section>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../modules/admin/views/layout.php';

plugins/store/views/site/account.php

@@ -0,0 +1,325 @@
+<?php
+declare(strict_types=1);
+
+$pageTitle = $title ?? 'Account';
+$isLoggedIn = (bool)($is_logged_in ?? false);
+$email = (string)($email ?? '');
+$orders = is_array($orders ?? null) ? $orders : [];
+$downloads = is_array($downloads ?? null) ? $downloads : [];
+$message = (string)($message ?? '');
+$error = (string)($error ?? '');
+$downloadLimit = (int)($download_limit ?? 5);
+$downloadExpiryDays = (int)($download_expiry_days ?? 30);
+$orderCount = count($orders);
+$downloadCount = count($downloads);
+$downloadsByOrder = [];
+$nowTs = time();
+foreach ($downloads as $d) {
+    if (!is_array($d)) {
+        continue;
+    }
+    $orderNo = (string)($d['order_no'] ?? '');
+    if ($orderNo === '') {
+        $orderNo = '__unknown__';
+    }
+    if (!isset($downloadsByOrder[$orderNo])) {
+        $downloadsByOrder[$orderNo] = [];
+    }
+    $downloadsByOrder[$orderNo][] = $d;
+}
+ob_start();
+?>
+<section class="card account-wrap">
+  <div class="badge">Store</div>
+  <div class="account-title-row">
+    <h1 style="margin:0; font-size:32px;">Account</h1>
+    <span class="account-subtle">Download hub</span>
+  </div>
+
+  <?php if ($message !== ''): ?>
+    <div class="account-alert success"><?= htmlspecialchars($message, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <?php if ($error !== ''): ?>
+    <div class="account-alert error"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
+  <?php endif; ?>
+
+  <?php if (!$isLoggedIn): ?>
+    <div class="account-grid">
+      <div class="account-panel">
+        <div class="badge" style="font-size:9px;">Login</div>
+        <p class="account-copy">Enter your order email and we will send a secure one-time access link.</p>
+        <form method="post" action="/account/request-login" class="account-form">
+          <label class="account-label">Email</label>
+          <input name="email" type="email" class="account-input" placeholder="you@example.com" required>
+          <button type="submit" class="account-btn">Send Login Link</button>
+        </form>
+      </div>
+
+      <div class="account-panel">
+        <div class="badge" style="font-size:9px;">Download Policy</div>
+        <ul class="account-policy-list">
+          <li>Each file can be downloaded up to <?= $downloadLimit ?> times.</li>
+          <li>Download links expire after <?= $downloadExpiryDays ?> days.</li>
+          <li>After expiry or limit, a new order is required.</li>
+        </ul>
+      </div>
+    </div>
+  <?php else: ?>
+    <div class="account-panel account-panel-head">
+      <div>
+        <div class="badge" style="font-size:9px;">Signed In</div>
+        <div class="account-email" title="<?= htmlspecialchars($email, ENT_QUOTES, 'UTF-8') ?>"><?= htmlspecialchars($email, ENT_QUOTES, 'UTF-8') ?></div>
+      </div>
+      <div class="account-actions">
+        <div class="account-stat">
+          <span class="account-stat-label">Orders</span>
+          <strong><?= $orderCount ?></strong>
+        </div>
+        <div class="account-stat">
+          <span class="account-stat-label">Files</span>
+          <strong><?= $downloadCount ?></strong>
+        </div>
+        <a class="account-logout" href="/account/logout">Logout</a>
+      </div>
+    </div>
+
+    <div class="account-panel">
+      <div class="badge" style="font-size:9px;">Orders</div>
+      <?php if (!$orders): ?>
+        <p class="account-copy">No orders found for this account.</p>
+      <?php else: ?>
+        <div class="account-list">
+          <?php foreach ($orders as $idx => $order): ?>
+            <?php
+              $orderNo = (string)($order['order_no'] ?? '');
+              $orderDownloads = $downloadsByOrder[$orderNo] ?? [];
+              $activeCount = 0;
+              foreach ($orderDownloads as $dl) {
+                $limit = max(0, (int)($dl['download_limit'] ?? 0));
+                $used = max(0, (int)($dl['downloads_used'] ?? 0));
+                $remaining = $limit > 0 ? max(0, $limit - $used) : 0;
+                $expires = trim((string)($dl['expires_at'] ?? ''));
+                $expired = false;
+                if ($expires !== '') {
+                    $expTs = strtotime($expires);
+                    if ($expTs !== false && $expTs < $nowTs) {
+                        $expired = true;
+                    }
+                }
+                if ($remaining > 0 && !$expired) {
+                    $activeCount++;
+                }
+              }
+              $hasDownloads = !empty($orderDownloads);
+              $isExpired = $hasDownloads && $activeCount === 0;
+              $modalId = 'orderDlModal' . $idx;
+            ?>
+            <div class="account-order-row">
+              <div>
+                <div class="account-line-title"><?= htmlspecialchars($orderNo, ENT_QUOTES, 'UTF-8') ?></div>
+                <div class="account-line-meta">
+                  <span class="account-status-pill"><?= htmlspecialchars((string)($order['status'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+                  <span><?= htmlspecialchars((string)($order['currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($order['total'] ?? 0), 2) ?></span>
+                  <span><?= htmlspecialchars((string)($order['created_at'] ?? ''), ENT_QUOTES, 'UTF-8') ?></span>
+                  <?php if ($hasDownloads): ?>
+                    <span><?= $activeCount ?> active download<?= $activeCount === 1 ? '' : 's' ?></span>
+                  <?php endif; ?>
+                </div>
+              </div>
+
+              <div class="account-order-right">
+                <?php if (!$hasDownloads): ?>
+                  <button type="button" class="account-download-btn is-disabled" disabled>No Downloads</button>
+                <?php elseif ($isExpired): ?>
+                  <button type="button" class="account-download-btn is-expired" disabled>Expired</button>
+                <?php else: ?>
+                  <button type="button" class="account-download-btn" data-open-modal="<?= htmlspecialchars($modalId, ENT_QUOTES, 'UTF-8') ?>">Downloads</button>
+                <?php endif; ?>
+              </div>
+            </div>
+
+            <?php if ($hasDownloads): ?>
+              <div id="<?= htmlspecialchars($modalId, ENT_QUOTES, 'UTF-8') ?>" class="account-modal" aria-hidden="true">
+                <div class="account-modal-backdrop" data-close-modal="<?= htmlspecialchars($modalId, ENT_QUOTES, 'UTF-8') ?>"></div>
+                <div class="account-modal-card" role="dialog" aria-modal="true" aria-label="Order downloads">
+                  <div class="account-modal-head">
+                    <div>
+                      <div class="badge" style="font-size:9px;">Order Downloads</div>
+                      <div class="account-modal-title"><?= htmlspecialchars($orderNo, ENT_QUOTES, 'UTF-8') ?></div>
+                    </div>
+                    <button type="button" class="account-modal-close" data-close-modal="<?= htmlspecialchars($modalId, ENT_QUOTES, 'UTF-8') ?>">&times;</button>
+                  </div>
+
+                  <div class="account-modal-list">
+                    <?php foreach ($orderDownloads as $dl): ?>
+                      <?php
+                        $limit = max(0, (int)($dl['download_limit'] ?? 0));
+                        $used = max(0, (int)($dl['downloads_used'] ?? 0));
+                        $remaining = $limit > 0 ? max(0, $limit - $used) : 0;
+                        $expires = trim((string)($dl['expires_at'] ?? ''));
+                        $expired = false;
+                        if ($expires !== '') {
+                          $expTs = strtotime($expires);
+                          if ($expTs !== false && $expTs < $nowTs) {
+                            $expired = true;
+                          }
+                        }
+                        $canDownload = ($remaining > 0 && !$expired);
+                        $dlUrl = (string)($dl['url'] ?? '#');
+                      ?>
+                      <div class="account-modal-item">
+                        <div>
+                          <div class="account-line-title"><?= htmlspecialchars((string)($dl['file_name'] ?? 'Download'), ENT_QUOTES, 'UTF-8') ?></div>
+                          <div class="account-line-meta">
+                            Remaining: <?= $remaining ?>
+                            <?php if ($expires !== ''): ?>
+                              &middot; Expires: <?= htmlspecialchars($expires, ENT_QUOTES, 'UTF-8') ?>
+                            <?php endif; ?>
+                          </div>
+                        </div>
+                        <?php if ($canDownload): ?>
+                          <a href="<?= htmlspecialchars($dlUrl, ENT_QUOTES, 'UTF-8') ?>" class="account-download-btn">Download</a>
+                        <?php else: ?>
+                          <button type="button" class="account-download-btn is-expired" disabled>Expired</button>
+                        <?php endif; ?>
+                      </div>
+                    <?php endforeach; ?>
+                  </div>
+                </div>
+              </div>
+            <?php endif; ?>
+          <?php endforeach; ?>
+        </div>
+      <?php endif; ?>
+    </div>
+  <?php endif; ?>
+</section>
+<style>
+  .account-wrap { display:grid; gap:14px; }
+  .account-title-row {
+    display:flex;
+    align-items:flex-end;
+    justify-content:space-between;
+    gap:12px;
+    flex-wrap:wrap;
+  }
+  .account-subtle {
+    color:var(--muted);
+    font-size:12px;
+    letter-spacing:.14em;
+    text-transform:uppercase;
+  }
+  .account-grid { display:grid; grid-template-columns: minmax(0,1fr) minmax(0,1fr); gap:14px; }
+  .account-panel { padding:18px; border-radius:14px; border:1px solid rgba(255,255,255,.1); background:rgba(0,0,0,.2); }
+  .account-panel-head { display:flex; align-items:flex-end; justify-content:space-between; gap:18px; flex-wrap:wrap; }
+  .account-alert { padding:14px; border-radius:12px; font-weight:600; }
+  .account-alert.success { border:1px solid rgba(34,242,165,.4); background:rgba(34,242,165,.12); color:#d3ffef; }
+  .account-alert.error { border:1px solid rgba(243,176,176,.45); background:rgba(243,176,176,.12); color:#ffd6d6; }
+  .account-email {
+    margin-top:8px;
+    font-weight:700;
+    font-size:36px;
+    line-height:1.05;
+    max-width:100%;
+    overflow:hidden;
+    text-overflow:ellipsis;
+    white-space:nowrap;
+  }
+  .account-actions { display:flex; align-items:center; gap:10px; flex-wrap:wrap; }
+  .account-stat { min-width:96px; padding:10px 12px; border-radius:10px; border:1px solid rgba(255,255,255,.1); background:rgba(255,255,255,.03); text-align:center; }
+  .account-stat-label { display:block; font-size:10px; letter-spacing:.14em; text-transform:uppercase; color:var(--muted); }
+  .account-logout { display:inline-flex; align-items:center; justify-content:center; height:42px; padding:0 20px; border-radius:999px; border:1px solid rgba(255,255,255,.2); background:rgba(255,255,255,.06); color:#fff; text-decoration:none; font-size:12px; text-transform:uppercase; letter-spacing:.14em; font-weight:700; }
+  .account-logout:hover { background:rgba(255,255,255,.14); }
+  .account-list { display:grid; gap:10px; margin-top:10px; }
+  .account-order-row { display:grid; grid-template-columns:minmax(0,1fr) auto; gap:14px; align-items:center; padding:14px; border-radius:12px; border:1px solid rgba(255,255,255,.1); background:rgba(255,255,255,.03); }
+  .account-order-right { display:grid; gap:8px; justify-items:end; }
+  .account-line-title { font-weight:600; font-size:22px; line-height:1.2; }
+  .account-line-meta { color:var(--muted); font-size:13px; margin-top:6px; display:flex; gap:8px; flex-wrap:wrap; align-items:center; }
+  .account-status-pill {
+    display:inline-flex;
+    align-items:center;
+    padding:3px 8px;
+    border-radius:999px;
+    border:1px solid rgba(255,255,255,.18);
+    background:rgba(255,255,255,.05);
+    text-transform:uppercase;
+    letter-spacing:.08em;
+    font-size:10px;
+    color:#cfd5e7;
+  }
+  .account-download-btn { display:inline-flex; align-items:center; justify-content:center; height:40px; padding:0 20px; border-radius:999px; border:1px solid rgba(34,242,165,.5); background:rgba(34,242,165,.22); color:#d7ffef; text-decoration:none; text-transform:uppercase; letter-spacing:.14em; font-size:11px; font-weight:700; white-space:nowrap; }
+  .account-download-btn:hover { background:rgba(34,242,165,.32); }
+  .account-download-btn.is-expired,
+  .account-download-btn.is-disabled { border-color:rgba(255,255,255,.18); background:rgba(255,255,255,.08); color:rgba(255,255,255,.55); cursor:not-allowed; }
+  .account-copy { margin:10px 0 0; color:var(--muted); }
+  .account-form { display:grid; gap:10px; max-width:460px; }
+  .account-label { font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:.18em; }
+  .account-input { height:44px; border-radius:10px; border:1px solid rgba(255,255,255,.2); background:rgba(255,255,255,.05); color:#fff; padding:0 12px; }
+  .account-btn{ height:42px; border-radius:999px; border:1px solid rgba(34,242,165,.45); background:rgba(34,242,165,.18); color:#cbfff1; font-weight:700; letter-spacing:.12em; text-transform:uppercase; cursor:pointer; max-width:260px; }
+  .account-btn:hover { background:rgba(34,242,165,.28); }
+  .account-policy-list { margin:10px 0 0; padding-left:18px; color:var(--muted); line-height:1.7; max-width:560px; }
+
+  .account-modal { position:fixed; inset:0; display:none; z-index:2000; }
+  .account-modal.is-open { display:block; }
+  .account-modal-backdrop { position:absolute; inset:0; background:rgba(0,0,0,.7); }
+  .account-modal-card { position:relative; max-width:760px; margin:6vh auto; width:calc(100% - 24px); max-height:88vh; overflow:auto; background:#12141b; border:1px solid rgba(255,255,255,.12); border-radius:14px; padding:16px; box-shadow:0 24px 64px rgba(0,0,0,.55); }
+  .account-modal-head { display:flex; justify-content:space-between; align-items:flex-start; gap:10px; margin-bottom:12px; }
+  .account-modal-title { margin-top:8px; font-weight:700; font-size:20px; }
+  .account-modal-close { width:38px; height:38px; border-radius:10px; border:1px solid rgba(255,255,255,.2); background:rgba(255,255,255,.08); color:#fff; font-size:20px; line-height:1; cursor:pointer; }
+  .account-modal-list { display:grid; gap:10px; }
+  .account-modal-item { display:grid; grid-template-columns:minmax(0,1fr) auto; gap:10px; align-items:center; padding:12px; border-radius:10px; border:1px solid rgba(255,255,255,.1); background:rgba(255,255,255,.03); }
+
+  @media (max-width: 980px) {
+    .account-grid { grid-template-columns: 1fr; }
+    .account-email { font-size:30px; }
+  }
+  @media (max-width: 640px) {
+    .account-email { font-size:24px; }
+    .account-actions { width:100%; }
+    .account-logout { width:100%; }
+    .account-order-row,
+    .account-modal-item { grid-template-columns: 1fr; }
+    .account-line-total { justify-self:start; }
+    .account-download-btn { width:100%; }
+    .account-order-right { justify-items:stretch; width:100%; }
+    .account-modal-card { margin:2vh auto; max-height:94vh; }
+  }
+</style>
+<script>
+  (function () {
+    const openBtns = document.querySelectorAll('[data-open-modal]');
+    const closeBtns = document.querySelectorAll('[data-close-modal]');
+
+    openBtns.forEach((btn) => {
+      btn.addEventListener('click', () => {
+        const id = btn.getAttribute('data-open-modal');
+        const modal = document.getElementById(id);
+        if (!modal) return;
+        modal.classList.add('is-open');
+        modal.setAttribute('aria-hidden', 'false');
+      });
+    });
+
+    closeBtns.forEach((btn) => {
+      btn.addEventListener('click', () => {
+        const id = btn.getAttribute('data-close-modal');
+        const modal = document.getElementById(id);
+        if (!modal) return;
+        modal.classList.remove('is-open');
+        modal.setAttribute('aria-hidden', 'true');
+      });
+    });
+
+    document.addEventListener('keydown', (e) => {
+      if (e.key !== 'Escape') return;
+      document.querySelectorAll('.account-modal.is-open').forEach((modal) => {
+        modal.classList.remove('is-open');
+        modal.setAttribute('aria-hidden', 'true');
+      });
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';

plugins/store/views/site/cart.php

@@ -0,0 +1,201 @@
+<?php
+declare(strict_types=1);
+
+$pageTitle = $title ?? 'Cart';
+$items = is_array($items ?? null) ? $items : [];
+$totals = is_array($totals ?? null) ? $totals : ['count' => 0, 'subtotal' => 0.0, 'discount_amount' => 0.0, 'amount' => 0.0, 'currency' => 'GBP', 'discount_code' => ''];
+$discountCode = (string)($totals['discount_code'] ?? '');
+ob_start();
+?>
+<section class="card" style="display:grid; gap:16px;">
+  <a href="/releases" class="badge" style="text-decoration:none; display:inline-block;">Continue shopping</a>
+  <h1 style="margin:0; font-size:32px;">Your Cart</h1>
+  <?php if (!$items): ?>
+    <div style="padding:14px; border-radius:12px; border:1px solid rgba(255,255,255,.1); background:rgba(0,0,0,.2); color:var(--muted);">
+      Your basket is empty.
+    </div>
+  <?php else: ?>
+    <div style="display:grid; gap:10px;">
+      <?php foreach ($items as $item): ?>
+        <?php
+          $key = (string)($item['key'] ?? '');
+          $title = (string)($item['title'] ?? 'Item');
+          $coverUrl = (string)($item['cover_url'] ?? '');
+          $qty = max(1, (int)($item['qty'] ?? 1));
+          $price = (float)($item['price'] ?? 0);
+          $currency = (string)($item['currency'] ?? ($totals['currency'] ?? 'GBP'));
+        ?>
+        <div style="display:grid; grid-template-columns:58px minmax(0,1fr) auto auto; align-items:center; gap:12px; padding:12px; border-radius:12px; border:1px solid rgba(255,255,255,.08); background:rgba(0,0,0,.2);">
+          <div style="width:58px; height:58px; border-radius:10px; overflow:hidden; border:1px solid rgba(255,255,255,.1); background:rgba(255,255,255,.06);">
+            <?php if ($coverUrl !== ''): ?>
+              <img src="<?= htmlspecialchars($coverUrl, ENT_QUOTES, 'UTF-8') ?>" alt="" style="width:100%; height:100%; object-fit:cover; display:block;">
+            <?php else: ?>
+              <div style="width:100%; height:100%; display:grid; place-items:center; font-size:10px; color:var(--muted);">AC</div>
+            <?php endif; ?>
+          </div>
+          <div style="min-width:0;">
+            <div style="font-weight:600; white-space:nowrap; overflow:hidden; text-overflow:ellipsis;"><?= htmlspecialchars($title, ENT_QUOTES, 'UTF-8') ?></div>
+            <div style="font-size:12px; color:var(--muted); margin-top:4px;"><?= htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($price, 2) ?> x <?= $qty ?></div>
+          </div>
+          <div style="font-weight:700;"><?= htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($price * $qty, 2) ?></div>
+          <form method="post" action="/cart/remove" style="margin:0;">
+            <input type="hidden" name="key" value="<?= htmlspecialchars($key, ENT_QUOTES, 'UTF-8') ?>">
+            <input type="hidden" name="return_url" value="/cart">
+            <button type="submit" class="cart-btn cart-btn-ghost">Remove</button>
+          </form>
+        </div>
+      <?php endforeach; ?>
+    </div>
+    <div style="display:grid; gap:12px; padding:14px; border-radius:12px; border:1px solid rgba(255,255,255,.1); background:rgba(0,0,0,.25);">
+      <div style="display:flex; justify-content:space-between; align-items:center; gap:12px;">
+        <div style="color:var(--muted);"><?= (int)($totals['count'] ?? 0) ?> item(s)</div>
+        <div style="display:grid; justify-items:end; gap:4px;">
+          <div style="font-size:12px; color:var(--muted);">Subtotal: <?= htmlspecialchars((string)($totals['currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($totals['subtotal'] ?? 0), 2) ?></div>
+          <?php if ((float)($totals['discount_amount'] ?? 0) > 0): ?>
+            <div style="font-size:12px; color:#9be7c6;">Discount (<?= htmlspecialchars($discountCode, ENT_QUOTES, 'UTF-8') ?>): -<?= htmlspecialchars((string)($totals['currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($totals['discount_amount'] ?? 0), 2) ?></div>
+          <?php endif; ?>
+          <div style="font-size:20px; font-weight:700;"><?= htmlspecialchars((string)($totals['currency'] ?? 'GBP'), ENT_QUOTES, 'UTF-8') ?> <?= number_format((float)($totals['amount'] ?? 0), 2) ?></div>
+        </div>
+      </div>
+      <div id="discountWrap" class="cart-discount-wrap<?= $discountCode !== '' ? ' is-open' : '' ?>">
+        <div style="display:flex; flex-wrap:wrap; align-items:center; gap:8px;">
+          <?php if ($discountCode !== ''): ?>
+            <span style="font-size:12px; color:var(--muted);">Applied discount</span>
+            <span class="cart-discount-chip"><?= htmlspecialchars($discountCode, ENT_QUOTES, 'UTF-8') ?></span>
+            <form method="post" action="/cart/discount/remove" style="margin:0;">
+              <input type="hidden" name="return_url" value="/cart">
+              <button type="submit" class="cart-btn cart-btn-danger">Remove</button>
+            </form>
+          <?php endif; ?>
+        </div>
+
+        <div id="discountBox" class="cart-discount-box<?= $discountCode !== '' ? ' is-open' : '' ?>">
+          <form method="post" action="/cart/discount/apply" style="display:flex; gap:8px; align-items:center; flex-wrap:wrap;">
+            <input type="hidden" name="return_url" value="/cart">
+            <input name="discount_code" value="<?= htmlspecialchars($discountCode, ENT_QUOTES, 'UTF-8') ?>" class="input cart-discount-input" placeholder="Enter discount code">
+            <button type="submit" class="cart-btn cart-btn-primary">Apply code</button>
+          </form>
+        </div>
+      </div>
+    </div>
+    <div style="display:flex; justify-content:flex-end; gap:10px; flex-wrap:wrap;">
+      <button type="button" class="cart-btn cart-btn-ghost" id="toggleDiscountBox">
+        <?= $discountCode !== '' ? 'Discount Active' : 'Have a discount code?' ?>
+      </button>
+      <a href="/checkout" class="cart-btn cart-btn-primary">Checkout</a>
+    </div>
+  <?php endif; ?>
+</section>
+<style>
+  .cart-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    height: 36px;
+    padding: 0 14px;
+    border-radius: 999px;
+    border: 1px solid rgba(255,255,255,.18);
+    background: rgba(255,255,255,.08);
+    color: #e9eefc;
+    text-decoration: none;
+    font-size: 12px;
+    letter-spacing: .12em;
+    text-transform: uppercase;
+    font-family: 'IBM Plex Mono', monospace;
+    font-weight: 600;
+    cursor: pointer;
+  }
+  .cart-btn:hover { background: rgba(255,255,255,.14); }
+  .cart-btn-primary {
+    background: rgba(34,242,165,.18);
+    border-color: rgba(34,242,165,.48);
+    color: #cffff0;
+  }
+  .cart-btn-primary:hover { background: rgba(34,242,165,.28); }
+  .cart-btn-ghost {
+    background: rgba(255,255,255,.06);
+  }
+  .cart-btn-danger {
+    border-color: rgba(255, 120, 120, 0.4);
+    color: #ffd4d4;
+    background: rgba(255, 120, 120, 0.12);
+  }
+  .cart-btn-danger:hover {
+    background: rgba(255, 120, 120, 0.2);
+  }
+  .cart-discount-wrap {
+    display: none;
+    border: 1px solid rgba(255,255,255,.12);
+    border-radius: 14px;
+    padding: 12px;
+    background:
+      linear-gradient(180deg, rgba(255,255,255,.03), rgba(255,255,255,.01)),
+      rgba(10, 12, 18, 0.72);
+    box-shadow: inset 0 1px 0 rgba(255,255,255,.04);
+  }
+  .cart-discount-wrap.is-open {
+    display: block;
+  }
+  .cart-discount-chip {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    min-height: 28px;
+    padding: 0 10px;
+    border-radius: 999px;
+    border: 1px solid rgba(34,242,165,.38);
+    background: rgba(34,242,165,.14);
+    color: #cffff0;
+    font-size: 11px;
+    letter-spacing: .12em;
+    text-transform: uppercase;
+    font-family: 'IBM Plex Mono', monospace;
+    font-weight: 600;
+  }
+  .cart-discount-box {
+    display: none;
+    margin-top: 10px;
+    padding-top: 2px;
+  }
+  .cart-discount-box.is-open {
+    display: block;
+  }
+  .cart-discount-input {
+    min-width: 220px;
+    height: 38px;
+    border-radius: 10px;
+    border: 1px solid rgba(255,255,255,.18);
+    background: rgba(7,9,14,.72);
+    color: #f0f4ff;
+    padding: 0 12px;
+  }
+  .cart-discount-input::placeholder {
+    color: rgba(220,228,245,.42);
+  }
+  .cart-discount-input:focus {
+    outline: none;
+    border-color: rgba(34,242,165,.5);
+    box-shadow: 0 0 0 2px rgba(34,242,165,.14);
+  }
+  @media (max-width: 720px) {
+    .cart-discount-input {
+      min-width: 100%;
+      width: 100%;
+    }
+  }
+</style>
+<script>
+  (function () {
+    const toggleBtn = document.getElementById('toggleDiscountBox');
+    const box = document.getElementById('discountBox');
+    const wrap = document.getElementById('discountWrap');
+    if (!toggleBtn || !box || !wrap) return;
+    toggleBtn.addEventListener('click', function () {
+      box.classList.toggle('is-open');
+      wrap.classList.toggle('is-open');
+    });
+  })();
+</script>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';

plugins/store/views/site/checkout.php

@@ -0,0 +1,208 @@
+<?php
+declare(strict_types=1);
+
+$pageTitle = $title ?? 'Checkout';
+$items = is_array($items ?? null) ? $items : [];
+$total = (float)($total ?? 0);
+$subtotal = (float)($subtotal ?? $total);
+$discountAmount = (float)($discount_amount ?? 0);
+$discountCode = (string)($discount_code ?? '');
+$currency = (string)($currency ?? 'GBP');
+$success = (string)($success ?? '');
+$orderNo = (string)($order_no ?? '');
+$error = (string)($error ?? '');
+$downloadLinks = is_array($download_links ?? null) ? $download_links : [];
+$downloadNotice = (string)($download_notice ?? '');
+$downloadLimit = (int)($download_limit ?? 5);
+$downloadExpiryDays = (int)($download_expiry_days ?? 30);
+ob_start();
+?>
+<section class="card checkout-wrap">
+  <div class="badge">Store</div>
+  <h1 style="margin:0; font-size:32px;">Checkout</h1>
+  <?php if ($success !== ''): ?>
+    <div style="padding:14px; border-radius:12px; border:1px solid rgba(34,242,165,.4); background:rgba(34,242,165,.12);">
+      <div style="font-weight:700;">Order complete</div>
+      <?php if ($orderNo !== ''): ?>
+        <div style="margin-top:4px; color:var(--muted);">Order: <?= htmlspecialchars($orderNo, ENT_QUOTES, 'UTF-8') ?></div>
+      <?php endif; ?>
+    </div>
+    <div class="checkout-panel">
+      <div class="badge" style="font-size:9px;">Your Downloads</div>
+      <?php if ($downloadLinks): ?>
+        <div style="display:grid; gap:10px; margin-top:10px;">
+          <?php foreach ($downloadLinks as $link): ?>
+            <?php
+              $label = trim((string)($link['label'] ?? 'Download'));
+              $url = trim((string)($link['url'] ?? ''));
+              if ($url === '') {
+                  continue;
+              }
+            ?>
+            <a href="<?= htmlspecialchars($url, ENT_QUOTES, 'UTF-8') ?>" class="checkout-download-link">
+              <span><?= htmlspecialchars($label !== '' ? $label : 'Download', ENT_QUOTES, 'UTF-8') ?></span>
+              <span class="checkout-download-link-arrow">Download</span>
+            </a>
+          <?php endforeach; ?>
+        </div>
+      <?php else: ?>
+        <p style="margin:10px 0 0; color:var(--muted); font-size:13px;">
+          <?= htmlspecialchars($downloadNotice !== '' ? $downloadNotice : 'No downloads available for this order yet.', ENT_QUOTES, 'UTF-8') ?>
+        </p>
+      <?php endif; ?>
+    </div>
+  <?php endif; ?>
+  <?php if ($error !== ''): ?>
+    <div style="padding:14px; border-radius:12px; border:1px solid rgba(243,176,176,.45); background:rgba(243,176,176,.12); color:#ffd6d6;">
+      <?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?>
+    </div>
+  <?php endif; ?>
+  <?php if (!$items): ?>
+    <div style="padding:14px; border-radius:12px; border:1px solid rgba(255,255,255,.1); background:rgba(0,0,0,.2); color:var(--muted);">
+      Your cart is empty.
+    </div>
+    <div><a href="/releases" class="btn">Browse releases</a></div>
+  <?php else: ?>
+    <div class="checkout-grid">
+      <div class="checkout-panel">
+        <div class="badge" style="font-size:9px;">Order Summary</div>
+        <div style="display:grid; gap:10px; margin-top:10px;">
+          <?php foreach ($items as $item): ?>
+            <?php
+              $title = (string)($item['title'] ?? 'Item');
+              $qty = max(1, (int)($item['qty'] ?? 1));
+              $price = (float)($item['price'] ?? 0);
+              $lineCurrency = (string)($item['currency'] ?? $currency);
+            ?>
+            <div class="checkout-line">
+              <div class="checkout-line-title"><?= htmlspecialchars($title, ENT_QUOTES, 'UTF-8') ?></div>
+              <div class="checkout-line-meta"><?= htmlspecialchars($lineCurrency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($price, 2) ?> x <?= $qty ?></div>
+              <div class="checkout-line-total"><?= htmlspecialchars($lineCurrency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($price * $qty, 2) ?></div>
+            </div>
+          <?php endforeach; ?>
+        </div>
+        <div class="checkout-total">
+          <span>Subtotal</span>
+          <strong><?= htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($subtotal, 2) ?></strong>
+        </div>
+        <?php if ($discountAmount > 0): ?>
+          <div class="checkout-total" style="margin-top:8px;">
+            <span>Discount (<?= htmlspecialchars($discountCode, ENT_QUOTES, 'UTF-8') ?>)</span>
+            <strong style="color:#9be7c6;">-<?= htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($discountAmount, 2) ?></strong>
+          </div>
+        <?php endif; ?>
+        <div class="checkout-total" style="margin-top:8px;">
+          <span>Order total</span>
+          <strong><?= htmlspecialchars($currency, ENT_QUOTES, 'UTF-8') ?> <?= number_format($total, 2) ?></strong>
+        </div>
+      </div>
+
+      <div class="checkout-panel">
+        <div class="badge" style="font-size:9px;">Buyer Details</div>
+        <form method="post" action="/checkout/place" style="display:grid; gap:12px; margin-top:10px;">
+          <label style="font-size:12px; color:var(--muted); text-transform:uppercase; letter-spacing:.18em;">Email</label>
+          <input name="email" type="email" value="" placeholder="you@example.com" class="checkout-input" required>
+
+          <div class="checkout-terms">
+            <div class="badge" style="font-size:9px;">Terms</div>
+            <p style="margin:8px 0 0; color:var(--muted); font-size:13px; line-height:1.5;">
+              Digital download products are non-refundable once purchased and delivered. Please check your order details before placing the order.
+              Files are limited to <?= $downloadLimit ?> downloads and expire after <?= $downloadExpiryDays ?> days.
+            </p>
+            <label style="margin-top:10px; display:flex; gap:8px; align-items:flex-start; color:#d7def2; font-size:13px;">
+              <input type="checkbox" name="accept_terms" value="1" required style="margin-top:2px;">
+              <span>I agree to the terms and understand all sales are final.</span>
+            </label>
+          </div>
+
+          <button type="submit" class="checkout-place-btn">Place Order</button>
+        </form>
+      </div>
+    </div>
+  <?php endif; ?>
+</section>
+<style>
+  .checkout-wrap { display:grid; gap:14px; }
+  .checkout-grid { display:grid; grid-template-columns: minmax(0,1fr) 420px; gap:14px; }
+  .checkout-panel {
+    padding:14px;
+    border-radius:12px;
+    border:1px solid rgba(255,255,255,.1);
+    background:rgba(0,0,0,.2);
+  }
+  .checkout-line {
+    display:grid;
+    grid-template-columns:minmax(0,1fr) auto;
+    gap:8px;
+    padding:10px;
+    border-radius:10px;
+    border:1px solid rgba(255,255,255,.08);
+    background:rgba(255,255,255,.03);
+  }
+  .checkout-line-title { font-weight:600; }
+  .checkout-line-meta { color:var(--muted); font-size:12px; margin-top:4px; grid-column:1/2; }
+  .checkout-line-total { font-weight:700; grid-column:2/3; grid-row:1/3; align-self:center; }
+  .checkout-total {
+    margin-top:10px;
+    display:flex;
+    align-items:center;
+    justify-content:space-between;
+    padding:12px;
+    border-radius:10px;
+    border:1px solid rgba(255,255,255,.1);
+    background:rgba(255,255,255,.04);
+  }
+  .checkout-total strong { font-size:22px; }
+  .checkout-input {
+    height:40px;
+    border-radius:10px;
+    border:1px solid rgba(255,255,255,.2);
+    background:rgba(255,255,255,.05);
+    color:#fff;
+    padding:0 12px;
+  }
+  .checkout-terms {
+    padding:12px;
+    border-radius:10px;
+    border:1px solid rgba(255,255,255,.1);
+    background:rgba(255,255,255,.03);
+  }
+  .checkout-place-btn{
+    height:40px;
+    border-radius:999px;
+    border:1px solid rgba(34,242,165,.45);
+    background:rgba(34,242,165,.18);
+    color:#cbfff1;
+    font-weight:700;
+    letter-spacing:.1em;
+    text-transform:uppercase;
+    cursor:pointer;
+  }
+  .checkout-place-btn:hover { background:rgba(34,242,165,.28); }
+  .checkout-download-link {
+    display:flex;
+    align-items:center;
+    justify-content:space-between;
+    gap:10px;
+    padding:12px;
+    border-radius:10px;
+    border:1px solid rgba(34,242,165,.35);
+    background:rgba(34,242,165,.1);
+    color:#d7ffef;
+    text-decoration:none;
+    font-weight:600;
+  }
+  .checkout-download-link:hover { background:rgba(34,242,165,.18); }
+  .checkout-download-link-arrow {
+    font-size:11px;
+    text-transform:uppercase;
+    letter-spacing:.14em;
+    color:#8df7d1;
+  }
+  @media (max-width: 900px) {
+    .checkout-grid { grid-template-columns: 1fr; }
+  }
+</style>
+<?php
+$content = ob_get_clean();
+require __DIR__ . '/../../../../views/site/layout.php';